Onchain Security Roundup: Nov 2 - 9

Mercado Bitcoin Hot Wallets Drained Across 11 Chains

TL;DR: On November 2nd an attacker gained access to the Brazilian cryptocurrency exchange Mercado Bitcoin’s wallets, emptied its hot wallets on 10 chains and then swept customer deposit addresses on Ethereum. Bitquery counts $48.6 million taken across 11 chains, while the exchange's own early estimate was $38 million. Issuers froze between $11.8-$15 million. Mercado Bitcoin says losses will not be passed onto clients. The same attacker took $424,000 from wallets tied to BitMart, a centralized exchange, earlier that day, per Bitquery.

The attacker's addresses were funded on the evening of November 1st. From 01:22 UTC on November 2nd, wallets Bitquery tied to BitMart started paying out to the same attacker address, and BitMart's founder later confirmed a breach. Bitquery places the first outflows from older Mercado Bitcoin addresses on the Bitcoin network 53 minutes later. The main drain began after 06:00 UTC and emptied hot wallets on 10 chains in 25 minutes. On Ethereum, the exchange's hot wallet sent 2,852 ETH ($6.53 million) at 06:24 UTC, then its USDT and USDC balances, then 189 other tokens, with the last transfer at 06:48 UTC. That leg was worth $29.57 million, 61% of Bitquery's total.

Mercado Bitcoin said at 12:56 UTC that the attack had been contained. From 12:27 UTC to 16:56 UTC, four hours past that statement, customer deposit addresses on Ethereum were still sending funds to the attacker’s address that had received the hot-wallet drain. Bitquery counts 36,042 addresses and a further $266,000. The exchange says its offline wallets, which hold most of its custodial assets, were untouched, and that it will cover the shortfall from its own funds. It said balance viewing would return on November 9th, with withdrawals and Pix (Brazil's instant payment system) transfers to follow after security checks.

Tether, Circle, and Paxos led freezes that Bitquery counts at $11.8 million; Mercado Bitcoin puts the total of frozen assets above $15 million. According to Bitquery, the attacker converted $11.9 million of 136 tokens into ETH over November 3rd and 4th through MetaMask's swap service and held 8,678 ETH ($19.87 million) afterward. The attacker's Bitcoin address holds 106.07 BTC ($8.30 million) and has never sent a transaction. The only established link to BitMart is the shared attacker address; no shared vendor has been identified. Mercado Bitcoin has not publicly confirmed how the attacker obtained signing access.

ACryptoS Vaults Minted Most of Their Shares for a One-Token Deposit

TL;DR: On November 8th, 135 addresses drained 77 of the 126 concentrated-liquidity vaults run by ACryptoS, a multichain yield-vault project, on Arbitrum, BNB Chain, Polygon, Base, and Optimism. ACryptoS puts the loss at $665,429. The vaults' deposit function accepted an amounts array shorter than the vault's token count, so a few dollars of one token could mint most of a vault's shares. ACryptoS says the flaw had been present since deployment, that honest depositors bear the loss, and that it is shutting the project down with withdrawals open.

According to ACryptoS's post-mortem, its UniswapV3-family vaults, which also wrapped SushiSwap, PancakeSwap v3, and Biswap v3 positions, exposed a depositMulti function that took an array of token amounts. When a caller passed a one-element array, the vault valued everything it held in token0 alone and minted shares against that partial figure, so a tiny token0 deposit was credited as though it matched most of the vault. A withdrawMulti call then paid out a pro-rata slice of both tokens. Pool prices were never manipulated; the attack was two ordinary calls. The project published a fork reproduction against Polygon block 96940861.

The first exploiter was funded with 12.98 ETH ($28,979) through a Mayan Swift cross-chain order at 01:50 UTC and struck Arbitrum at 02:02 UTC. From 09:30 UTC, per the post-mortem, more than 100 copycat addresses, many of them EIP-7702 delegated wallets, ran the same round on every chain. A community member reported the drain on Telegram at 09:34 UTC and the developer was notified at 14:19 UTC. A beacon upgrade disabled deposits on 11 proxy beacons between 15:38 UTC and 16:40 UTC, and exploitation stopped on each chain as the upgrade landed. ACryptoS's per-chain tally is $230,213 on Arbitrum, $190,845 on BNB Chain, $134,686 on Polygon, $69,813 on Base, and $39,871 on Optimism, at prices from 17:00 UTC on November 8th and excluding 19,400 ACS that it did not price.

ACryptoS listed five exploiter addresses, said the funds moved through Mayan, Across, Relay, and Squid, and offered a 10% bounty. It also said it has no resources to maintain the protocol and asked users to withdraw. One secondary report labels the incident a reentrancy attack; the post-mortem describes a missing input check. No funds have been recovered to date.

TENDRIL Sell Tax Burned the Pool and Let a Swap Drain the USDT

TL;DR: On November 4th a single transaction on BNB Chain emptied the USDT side of the PancakeSwap V2 pool for TENDRIL, a token with a 30% sell tax, taking 555,670 USDT. Its sell-tax hook burned TENDRIL out of the pool and resynced its reserves before the seller's remaining tokens arrived, leaving almost no TENDRIL recorded against 4.42 million USDT. The attacker's profit transfer was 308,959 USDT, and estimates of its net gain vary with how a pre-attack token purchase is counted. The TENDRIL team has not publicly confirmed the incident.

TENDRIL charged a 30% tax on sells and routed it through a helper contract. During a taxed sell, TENDRIL was burned directly out of the PancakeSwap pair and the pair's sync function was called before the seller's remaining 70% had arrived. At 16:02 UTC on November 4th the attacker borrowed 30.64 million USDT from PancakeSwap's Infinity vault in a flash loan and ran the sell. The pool's recorded TENDRIL reserve collapsed to 6,678 wei against 4,421,023 USDT, and the attacker swapped a trivial amount of TENDRIL for nearly all of the USDT and repaid the loan in the same transaction. PancakeSwap's code was not at fault and no key was stolen.

The pool lost 555,670 USDT net. One in-transaction transfer sent 308,959 USDT to a profit address. The rest of the pool's loss also left in the same transaction: the tax helper paid 232,165 USDT to three addresses, and the attacker spent 14,546 USDT buying TVS tokens.

ExVul puts the whole campaign's profit at no more than 181,910 USDT after subtracting the tokens the attacker bought beforehand and gas. Phalcon later found that most of the gain came from 33 billion TENDRIL acquired for under $10,000 through a liquidity position in a V3 pool the attacker created before the attack. The loss falls on the liquidity providers in the pair. The TENDRIL team has not publicly confirmed the incident.

Vari Points OTC Escrow Emptied by Its Own Signers (intent not established)

TL;DR: On November 6th the Safe used as escrow by Vari Points OTC, an unofficial over-the-counter (OTC) desk for trading points issued by the Variational protocol, sent out 511,118 USDC on Arbitrum in five transactions, each executed with the signatures its 2-of-3 threshold requires. Community investigators describe a drain by the desk's own signers followed by a bridge out through Across. Neither the desk nor Variational has commented, so whether this was a deliberate exit or a compromise of the signers is not established.

The Safe, a 2-of-3 multisig active since February, made five USDC payments to two receiving addresses: 40,000 at 02:26 UTC, 40,000 at 03:24 UTC, 600 at 03:40 UTC, 100,000 at 04:29 UTC, and 330,518.32 at 04:32 UTC. In October it had received 18 deposits from users posting escrow, ranging from 240 to 40,600 USDC.

Safe transactions execute only with the required signatures, so either the signers chose to move the funds or someone else obtained their keys. The only public account is a community thread, which says the signers did it. Variational's own protocol was not exploited, and the desk was a third party trading claims on its points. Neither Vari Points OTC nor Variational has publicly confirmed the incident, and no funds have been recovered to date.

Ankr Ethereum Bridge Paid Five Withdrawals on Forged Receipts

TL;DR: On November 9th, five withdrawal calls on the Ethereum bridge of Ankr, a node and liquid-staking infrastructure provider, sent 82.9 ankrETH, 7.98 million ANKR, 515,206 ankrPOL, 5,372 aMATICb, and 0.82 aETHb to a new address, worth $304,209 at the time. Every call reused the receipt of one small Optimism deposit that had already been redeemed, and each passed the bridge's signature check. The bridge was paused later that morning, and the attacker has moved part of the proceeds to Tornado Cash. Ankr has not publicly confirmed the incident.

Ankr's bridge releases tokens on Ethereum when a caller presents transaction data from the source chain together with two signatures, one from the client side and one from Ankr's server side. From 08:09 UTC to 08:11 UTC on November 9th, five transactions called that withdraw function from one address and paid out to another freshly created one, in blocks 26376043 through 26376055. They released 82.9 ankrETH ($214,437), 7.98 million ANKR ($30,461), 515,206 ankrPOL ($57,130), 5,372 aMATICb ($467), and 0.82 aETHb ($1,714). Each call carried the same Optimism receipt data as a legitimate withdrawal of 0.0044 ankrETH ($11) on November 3rd, with only the token and amount changed, and each passed the bridge's signature check.

Blockaid flagged the exploit as ongoing at 08:42 UTC, and SlowMist described the five calls as forged cross-chain receipts carrying valid signatures. At 09:51 UTC a 3-of-5 Safe with pause rights over the bridge paused it. The bridge holds none of the five tokens, and there has been no further activity on it since the pause.

From 09:12 UTC the attacker swapped 77.91 ankrETH and all 7.98 million ANKR, along with smaller token amounts, for 103.26 ETH through MetaMask's swap service. At 11:36 UTC it sent 104.72 ETH ($222,150) to a second address, which deposited 113.7 ETH ($241,205) into Tornado Cash between 11:39 UTC and 11:44 UTC. The attacker still holds 5 ankrETH ($12,932) and all of the ankrPOL, aMATICb, and aETHb. Whether a signer key or a signing service was compromised is not known. Ankr has not publicly confirmed the incident, and no funds have been recovered to date.

CoreVault Redemption Priced off a Flash-Loan-Moved Spot Price

TL;DR: On November 3rd a single transaction on BNB Chain borrowed 207,358 WBNB ($145.18 million) from Lista DAO's Moolah, sold 195,000 of it into PancakeSwap's WBNB/USDT pool, and redeemed a position in CoreVault, a vault product in the OSK ecosystem, while the pool showed BNB at 1% of its real price. The reserve behind CoreVault, OSK's InsurancePool contract, lost a net 259.09 BNB ($181,399), and the attacker kept 160.26 BNB ($112,203). No funds have been recovered to date.

At 21:50 UTC on November 3rd the whole exploit ran from the constructor of a contract deployed in the attacking transaction, which leaves no separate contract address to watch. The flash loan, a 195,000 WBNB ($136.53 million) dump that moved the pool's spot price from $697 to $7.16, the redemption, the reversal of the swap, and the repayment all happened in that one transaction. CertiK estimates the redemption was inflated 33 times. The reserve paid out 260.22 BNB ($182,190) gross. Of that, 160.26 BNB went to the attacker and 99.96 BNB ($69,986) covered the loan shortfall: 98.83 BNB ($69,195) lost on the round-trip swap plus the 1.13 BNB ($791) the attacker had paid into the reserve during the redemption.

The reported root cause is that CoreVault's redemption price came from an oracle helper that took a median of three sources and fell back to the PancakeSwap spot price when its time-weighted inputs were not yet populated. CoreVault and OSK have not publicly confirmed the root cause, and no funds have been recovered to date.

Keplr Social-Login Wallets Exposed Through a Web3Auth Flaw

TL;DR: Over November 6th and 7th, wallets created with a Google or Apple login in Keplr, a widely used Cosmos ecosystem wallet, were swept on at least seven Cosmos chains and Injective. Web3Auth, which runs the key infrastructure behind that login, blamed a security issue in its own systems; Keplr called it a private-key breach. Bitquery counted at least 44,041 wallets emptied into two addresses holding $6.01 million, but those addresses are Web3Auth's own recovery wallets. The attacker's take is not confirmed; GoPlus estimates at least $1 million.

Web3Auth posted at 21:13 UTC on November 6th that it was aware of a security issue affecting services some third parties use and had paused its embedded wallet service. Keplr followed at 04:38 UTC on November 7th with a warning that accounts created with Google or Apple login were seeing unauthorized transactions and that it had paused social login. Both companies say wallets created from a recovery phrase or a hardware wallet were not affected. By the afternoon of November 7th Web3Auth had narrowed the issue to its own infrastructure as used by Keplr's embedded wallets, and that evening Keplr described it as a vulnerability leading to a private-key breach.

Bitquery's trace shows the first sweeps starting 21 minutes before Web3Auth's first notice, with 86% of them running after Keplr's warning. On the afternoon of November 7th Web3Auth said it had begun what it called a whitehat recovery, using the same path as the attacker to move funds out of vulnerable wallets that had not yet been hit. On November 8th it published recovery addresses on Cosmos Hub, Osmosis, Injective, and eight EVM chains. Those are the two addresses Bitquery had been counting, and Bitquery corrected its report, which had first described the $6.01 million as stolen.

The numbers in circulation measure different things. Bitquery's $6.01 million is what sat in the recovery wallets at 15:38 UTC on November 7th. The Block reports that Web3Auth put the amount it moved to recovery at $5.6 million. GoPlus estimates that at least $1 million was stolen and $6 million moved to the official recovery address, without publishing its basis. On November 9th the Cosmos Hub recovery wallet held 549,460 ATOM ($733,041) plus 1.96 million ATOM ($2.61 million) as tokenized validator shares, which let staked ATOM move without the 21-day unbonding wait.

None of these is a confirmed loss figure. Web3Auth has not publicly confirmed a root cause, and the funds in recovery have not been returned to users to date.

Loopscale Paused After a Collateral-Pricing Misconfiguration (no user loss reported)

TL;DR: Loopscale, a Solana lending protocol, paused on November 5th after a week-long campaign of more than 30,000 malicious API requests a day aimed at its SOL and USDC Genesis Vaults. Misconfigured pricing parameters valued deposited collateral as a different asset and allowed an undercollateralized loan of $412,000; a second attempt tried to inflate the USDC vault's net asset value and redeem $521,000 before Loopscale's systems stopped it within 30 seconds, per the team. Loopscale says both vaults were restored to full value.

Loopscale described two paths. In the SOL Genesis Vault, a combination of pricing parameters valued a deposited collateral token as if it were a different asset; NullTX reports this as kySOL priced as zBTC through a decimal mismatch, in a loan of 4,597 SOL ($412,000, per Loopscale). In the USDC Genesis Vault, an atomic bundle sold a loan carrying an extreme interest rate into the vault to push up its net asset value and then redeemed against the inflated figure.

Loopscale has not published Solana transaction signatures. Priority lending functions were restored on November 6th with vault withdrawals still restricted, and the protocol resumed more fully on November 7th with a full post-mortem promised. Loopscale's Genesis Vaults were also exploited on April 26, 2025, when 5.73 million USDC and 1,211 SOL ($179,930) were taken and later returned. Loopscale says the $412,000 loan was covered and the $521,000 redemption never completed, but it has not publicly confirmed who funded the top-up.