LAST 6 MONTHS EXPLOITS IN WEB3
Author: Sisi
The last six months have shown exactly that, with the increasing adoption of AI and the rapid evolution of attack methods, the shift is dramatic and startling.
This is no longer just about avoiding phishing links, we are facing multi layered, high speed attacks designed to outpace human instincts and exploit vulnerabilities with devastating precision as someone who works daily inside these systems auditing codes, analysing hacks and studying adversarial behaviours and patterns. I can say with absolute certainty that the threat is real, and it's evolving fast. I’m only scratching the surface here, there have been so many breaches and attacks in the last 6 months, I could easily write a book on them.
For now, I’ll cover the 4 incidents that stood out
1. Inferno Drainer 3.0 : It was a social Engineered hack
Timeline: November 2024 - January 2025
➤ November 2024: The Inferno Drainer 3.0 campaign launched, targeting airdrop farmers. The attackers weaponised Permit2 signatures and disguised them as legitimate LayerZero airdrop claims, exploiting the lack of proper security checks in wallets.
➤ December 2024: Attackers leveraged EIP-712 structured data signatures, a method that many wallets still fail to flag correctly. The result was users wallets drained in a matter of seconds, using smart contract interactions like multicall swaps, stargate bridging and fund distribution across hundreds of addresses.
➤ January 2025: By this point, the attack had caused widespread panic, draining millions of dollars worth of assets. The speed of the attack was alarming, it only took seconds from the moment a user approved the malicious signature until their wallet was emptied.
2. MetaMask Doppelgänger
Timeline: December 2024 - February 2025
➤ December 2024: Hackers released malicious MetaMask lookalike extensions. These extensions hijacked clipboard data and could subtly change wallet addresses by swapping characters, making it impossible for users to spot the alteration.
➤ January 2025: The malware was dormant for up to 72 hours, allowing it to bypass initial antivirus scans. After activation, it began recording session data and hijacking transactions, sending funds to hacker controlled addresses.
➤ February 2025: MetaMask confirmed the extension as a major threat, after users began reporting unauthorized transactions. The fake extension flooded the Chrome store with fake reviews and was undetectable until users noticed strange activity.
3. Bybit’s $100 Million Breach
Timeline: February 2025
➤ February 2025: Bybit suffered a major breach, with attackers exploiting the exchange’s hot wallet infrastructure. A compromised internal admin was targeted through a phishing campaign and malware scraped plaintext private keys from the admin’s machine. The cold wallets were drained as a result of the attack. Around 12,000 ETH (worth approximately $100 million) were siphoned out before alarms went off. The funds were routed through RenBridge and ThorSwap, then offloaded onto offshore exchanges. It is rumored that this attack was orchestrated by the notorious Lazarus Group.
4. WalletConnect’s Silent Exploit
Timeline: March – April 2025
➤ March 2025: A critical vulnerability in WalletConnect’s session management was discovered. Sessions remain active even after users closed their browser, leaving an open window for hackers to hijack ongoing connections. March 2025: Attackers leveraged DNS cache poisoning, intercepted session IDs, and spoofed legitimate contract interactions, tricking users into signing malicious transactions.
➤ April 2025: By the time the vulnerability was publicly disclosed, attackers had siphoned funds from institutional wallets, with average losses of $142,000 per victim.
Here are my non-negotiable security measures for the next 6 months
Simulate transactions using 0-value dry runs to test legitimacy before finalizing them.
Use Web3-friendly browsers like Tor windows or Brave for DeFi transactions.
Keep separate browser profiles for different activities. • Implement wallet tiering Tier 1: Hardware wallets (for holdings only). Tier 2: Mobile wallets (for DeFi activity). Tier 3: Burner wallets (for airdrops, testing).
Never reuse wallets across airdrops.
MPC (Multi-Party Computation) wallets are crucial for high value custodial systems.
Always verify the publisher of any wallet extension, plugin, or application you use.
Regularly audit token approvals using services like Revoke cash, etherscan or famous foxes
Always manually disconnect WalletConnect sessions after use.
Use Chrome’s extension transparency logs to manually audit updates and permissions.
Upgrade to WalletConnect v2, which supports automatic session expiry.
Use signature analysis tools like Wallet Guard to inspect transaction signatures before signing. • Use hardware wallets for high-value transactions to ensure additional security.
Emerging threats I am tracking
➤ Validator node exploits on cross-chain bridges.
➤ Price oracle manipulation across DeFi aggregators.
➤ Smart wallet vulnerabilities tied to ERC-4337 account abstraction.
➤ Social engineering schemes targeting protocol operators These aren't just theoretical risks.
These exploits are being actively developed, tested and refined behind closed doors. It's getting spooky out here, stay safu and don't get rekt