cwu.eth

cwu.eth

2,978 Twitter followers

Follow

Security Researcher @ambergroup_io | Views are my own

Posts

Our comprehensive analysis on the Yearn hack, probably the most complicated DeFi hack so far 🫡

$9M gone. Zero bugs found. 📉🔥 The Yearn yETH "Π Collapse" is a terrifying example of how a protocol can be destroyed using its own rules. No "hack"—just pure mathematical exploitation of the StableSwap invariant. The future of DeFi security isn't just code; it's math. Full

🚨 We have identified the issue and have a quick workaround. All nodes should disable Prysm to unnecessarily generate old states to process outdated attestation. To do this, simply add the following flag to your beacon node. This flag works with v7.0.0 and you do not need to update the beacon node beyond adding this flag. No change is required for validator clients. "--disable-last-epoch-targets"

At 21:11 UTC on Nov 30, an incident occurred involving the yETH stableswap pool that resulted in the minting of a large amount of yETH. The contract impacted is a custom version of popular stableswap code, unrelated to other Yearn products. Yearn V2/V3 vaults are not at risk.

Upbit(@Official_Upbit) has been hacked — 54B KRW (~36.8M USD) in assets on #Solana have been transferred to unknown wallets. upbit.com/service_center/notic...… intel.arkm.com/explorer/entity...…

0. Announcing the Trillion Dollar Security (1TS) initiative: an ecosystem-wide effort to upgrade Ethereum’s security to help bring the world onchain.

1/ In late 2023 a former Yuga Labs security researcher was stopped at the airport after law enforcement mistakenly linked them to a $1.1M phishing theft from a Bored Ape owner. Here’s an investigation into where the stolen funds went and who’s actually responsible.

Huge shoutout to @neeksec and @0xlouistsai for being part of ETH Rangers, and to @jsvisa for making Geth run faster. Honored to be on the team with these legends! twitter.com/chiachih_wu/status...

Today at 11:30AM EST, a manipulation of Loopscale’s RateX PT token pricing functions led to an exploit of ~5.7M USDC and 1,200 SOL from the Loopscale USDC and SOL Vaults. All Loopscale markets have been temporarily halted while our team investigates further. This exploit

ZKsync security team has identified a compromised admin account that took control of ~$5M worth of ZK tokens — the remaining unclaimed tokens from the ZKsync airdrop. Necessary security measures are being taken. All user funds are safe and have never been at risk. The ZKsync

-- END --