Nomad Bridge: The $190M Config Bug That Became a Mob Looting
A routine upgrade left message proofs rubber-stamped. Hundreds of copycats drained the bridge in crypto’s most chaotic heist.
Twitter’s 5.4M Scrape: When an API Becomes a Breach Oracle
A patched OAuth endpoint answered one question too honestly: which phone belongs to which handle. The dataset sold for $30k — the class lesson is still with us.
26 Million Requests Per Second: Cloudflare’s Record DDoS
Five thousand cloud VMs, each pushing 5,000 rps of encrypted traffic at one small website. June 2022’s record flood and the edge doctrine it sealed.
Harmony Horizon: $100M for Two Stolen Keys
A 2-of-5 multisig guarding nine figures. Lazarus took the two keys it needed, and the bridge-custody era changed for good.
Follina in the Wild: TA413, Patch Gaps and Zero-Day Economics
Sixteen days between disclosure and patch. Who exploited Follina in the gap, how fast state and commodity actors moved, and the doctrine it forged.
Confluence CVE-2022-26134: OGNL Injection RCE Under Fire
Exploited in the wild two days before the patch existed. How OGNL injection turned Confluence into June 2022’s internet-scale fire drill — and the playbook it left behind.
Heroku Held the Keys: Anatomy of a Vendor-Token Breach
GitHub’s OAuth tokens lived in Heroku’s infrastructure. One compromised CI cache later, an ecosystem learned where vendor tokens really live.
Beanstalk’s $182M Flash-Loan Governance Attack: Thirteen Seconds
No key stolen, no bug exploited — an attacker borrowed a voting majority on Aave, passed his own proposal, and drained the vaults in one block.
Costa Rica’s Conti Emergency: When Ransomware Became a National Crisis
Conti encrypted the treasury during tax season, declared war on the government, and forced the world’s first ransomware state of emergency.
Spring4Shell: The RCE That Wasn’t Log4Shell (but Still Bit Hard)
A JDK 9 property path reopened a 2010-era bug class in Spring’s data binder — and gave every Tomcat admin a very bad 48 hours.
Lapsus$ vs Microsoft: When Teen Hackers Beat a Hyperscaler’s Odds
37GB claimed, one account compromised, no customer data lost — and a DEV-0536 profile that taught the industry how social engineering beats MFA.
Ronin Bridge: The $625M Heist That Ran on Five Keys
North Korea’s Lazarus Group drained Axie Infinity’s Ronin bridge of $625M with five forged signatures and a leftover permission nobody revoked.
- Go to the previous page
- 1
- …
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- …
- 14
- Go to the next page