Latest Exploit News and Insights | Yellow

A signup flaw at Polymarket reportedly let attackers using stolen personal data seize nearly 500 existing U.S. accounts in late July, along with linked payment methods. Key Points: A registration bug reportedly let anyone with a trader's personal data enter that trader's live account without a usern

An attacker drained more than $9 million from liquidity pools on XPR Network (XPR) in 11 minutes, exploiting a swap contract that accepted negative withdrawal amounts. Key Points: An attacker pulled more than $9 million out of XPR Network liquidity pools in roughly 11 minutes. The flaw sat in a with

Purported white hat hackers returned 3,400 Bitcoin (BTC) to Liquid Network, leaving about 598 BTC worth roughly $47 million outstanding. Key Points: The group sent back 85% of the roughly 4,000 BTC drained from Liquid's federation wallet over the weekend. Liquid stays paused while its operators fini

Term Finance, an Ethereum (ETH)-based DeFi lending protocol, lost about $8.5 million after an attacker exploited its governance system to seize control of vault assets on Aug. 23. Key Points: The attacker drained about $8.5 million, including 2,843 ETH and roughly $1.68 million in stablecoins, accor

The Sandbox said it contained a bridge exploit after an attacker reportedly minted 14.9 billion unbacked SAND (SAND) tokens on Base and BNB Smart Chain. Key Points: PeckShield reported 14.9 billion unbacked SAND minted across two wallets, with a nominal value of about $718 million. The Sandbox said