Beanstalk’s $182M Flash-Loan Governance Attack: Thirteen Seconds
No key stolen, no bug exploited — an attacker borrowed a voting majority on Aave, passed his own proposal, and drained the vaults in one block.
Costa Rica’s Conti Emergency: When Ransomware Became a National Crisis
Conti encrypted the treasury during tax season, declared war on the government, and forced the world's first ransomware state of emergency.
GitHub’s OAuth supply chain: the Heroku Token Heist That Reached npm
Attackers stole GitHub integration tokens from Heroku and Travis CI, pivoted into npm, and downloaded ~109,000 publishing credentials.
Spring4Shell: The RCE That Wasn’t Log4Shell (but Still Bit Hard)
A JDK 9 property path reopened a 2010-era bug class in Spring's data binder — and gave every Tomcat admin a very bad 48 hours.