Extropy Security Bytes: w26 2025
Welcome to our weekly security roundup, where we explore the latest developments and incidents impacting the web3 landscape. This edition covers events from week 26 and offers insights into various challenges, from sophisticated social engineering to smart contract vulnerabilities and broader cybersecurity concerns. Our aim is to provide a comprehensive and informative overview for the community, highlighting key takeaways for fostering a more secure digital environment.
Hacken: Security Firm Experiences Token Minting Incident
On June 20th, the cybersecurity firm Hacken experienced a security incident that resulted in a significant decline in the value of its native Hacken Token (HAI) and a loss of approximately $170,000 in digital assets.
Root Cause and Attack Vector: The primary cause of the incident was identified as a compromised private key. This key was associated with an account that held a minting role for HAI tokens on both the Ethereum and BNB Chain. Hacken attributed the exposure of this private key to “human error during architectural changes” related to a blockchain bridge upgrade, which ironically was intended to enhance security. The firm acknowledged that a delay in implementing multi-signature upgrades over five years contributed to this vulnerability.
Exploitation Mechanism: The attacker leveraged the compromised private key to seize minting privileges. With these privileges, the malicious actor minted 900 million new HAI tokens. These newly minted tokens were then swiftly introduced into decentralized exchanges, leading to a substantial price adjustment. Although a massive number of tokens were minted, the actual amount successfully realized by the attacker was limited to around $170,000 (with some estimates by Hacken’s CEO at $250,000) due to the liquidity available in the pools.
Impact: The incident resulted in an approximate financial impact of $170,000 for the attacker’s gains, and the HAI token’s value experienced a significant adjustment, plummeting by 99%.
Hacken’s Response and Recovery Efforts: Upon detection, Hacken swiftly revoked the compromised minter account and regained control. Bridge transactions on both Ethereum and BNB Chain were paused as a precautionary measure. Hacken has communicated a commitment to a new tokenomics strategy, aiming to evolve HAI into a regulated financial tool that integrates token utility with equity rights, assuring that legitimate user balances would remain trackable and offering a future token swap. The firm stated that its core infrastructure remained secure, with no evidence of compromise beyond the private keys involved in this incident. Hacken also aims to utilize this event as a case study to further educate the community on security best practices.
Lessons Learned: The Hacken incident serves as a clear reminder of the critical importance of robust private key management and security practices, especially for accounts with privileged roles like token minting. It underscores that internal process shortcomings and human factors can present significant vulnerabilities, even for organizations specializing in security. The incident highlights the need for continuous auditing and vigilant monitoring of all infrastructure, including decommissioned or less-frequently used assets, as these can inadvertently become overlooked entry points for unauthorized access.
Rowan Energy: Project Experiences Community Concerns and Value Adjustment
The Rowan Energy project, which aimed to establish a “green energy blockchain” and offer rewards for solar energy users, faced significant challenges that resulted in its RWN token experiencing a substantial value adjustment, impacting investors. The project, founded in 2011 and rebranded into crypto in 2018, experienced a complete shutdown of its public blockchain on June 25th.
Project Claims and Initial Trust: Rowan Energy claimed to offer “tokenized Renewable Energy Certificates and tokenized peer-to-peer energy trading” to revolutionize home solar. Their private blockchain was purported to track energy output from thousands of SmartMiner devices in UK homes, rewarding owners for their contributions. Marketing emphasized “sustainable mining” and “eco-friendly” mechanisms. Professional exchange listings and public-facing founder activities initially lent an air of legitimacy to the project.
Technical Insights and Operational Closure: An anonymous researcher uncovered details regarding the project’s structure through a publicly accessible RPC endpoint associated with a wallet application. This indicated a “private blockchain” with public access. A totalSupply() query revealed a discrepancy between the stated and actual number of tokens in circulation. The researcher demonstrated a "hidden mint function" within the contract by temporarily minting and then burning a large number of tokens. The project’s public blockchain was subsequently shut down on June 25, 2025. This action, coupled with the deletion of community channels and project content, suggested a centralized operational control over the blockchain.
Impact: The RWN token experienced a value adjustment of over 90%. This incident is part of a broader trend, with significant amounts lost to crypto-related incidents in the first half of 2025.
Community Identified Observations: The community noted several red flags, including reported blockchain inconsistencies, unexplained cessation of payouts, the token’s significant value adjustment, the founder’s disappearance from public engagement, the wiping of official community channels, and the presence of closed-source code and a lack of a public block explorer.
Lessons Learned: This event highlights the importance of thorough due diligence in the Web3 space. Key takeaways include the critical need for mandatory smart contract audits before token launches and the implementation of liquidity lock mechanisms for decentralized exchange (DEX) listings. It also underscores that even projects with compelling branding can have operational structures that may not align with decentralized principles, emphasizing the need for transparency regarding underlying code and system control.
Silo Finance: Test Contract Vulnerability Leads to Internal Fund Impact
On June 25th, Silo Finance, a decentralized crypto lending protocol, experienced a security breach that resulted in a loss of approximately $545,000 to $550,000 worth of 224 ETH. Importantly, no user funds were affected during this incident, as the compromised contract was solely used for testing purposes with internal funds from Silo DAO, the protocol’s decentralized autonomous organization.
Incident Overview: The exploit specifically targeted a pre-release leverage smart contract on the Ethereum Mainnet and Sonic, which was separate from Silo’s core contracts. This contract, LeverageUsingSiloFlashloanWithGeneralSwap, was deployed at address 0xCbEe4.
Root Cause and Vulnerability: The primary cause of the exploit was improper input validation. A vulnerability was identified in a user-controlled input issue within the contract’s openLeveragePosition function. The core vulnerability lay in the fact that a function within the targeted contract accepted _swapArgs as an argument but failed to validate the data provided.
Exploitation Mechanism: The attacker leveraged this vulnerability by inputting malicious swapArgs. These malicious arguments were crafted to set the attacker's address as the receiver and the victim's (Silo DAO's) address as the borrower. The victim's address had previously granted maximum allowance of assets to the contract, which enabled the malicious operation. Instead of executing a legitimate token swap, the manipulated input caused the contract to perform an unintended borrow transaction on behalf of the victim. Following the theft, the attacker routed the stolen 224 ETH through Tornado Cash in multiple transactions to obscure the trail.
Impact: The financial impact was approximately $545,000 to $550,000 worth of 224 ETH, drained from the Silo DAO’s internal testing funds. While no user funds were directly impacted, the SILO token price experienced an 11% decline in the 24 hours following the incident, as on-chain analytics indicated traders adjusted their holdings.
Response and Recovery Efforts: Silo Finance promptly paused the affected contract upon detection of the breach. The team issued a statement assuring users that the core smart contracts, where user funds are held, remained unaffected. Blockchain security firm PeckShield’s threat intelligence system had detected suspicious code shortly before the exploit was executed, highlighting the potential effectiveness of real-time monitoring.
Lessons Learned: The incident underscores the paramount importance of rigorous validation of all user-provided data (calldata) in smart contracts. This event serves as a strong reminder that even in testing environments, thorough input validation is essential to prevent unintended operations.
Resupply Protocol: $9.8 Million Lost in Malicious Donation Attack
In June 2025, the on-chain lending protocol Resupply experienced a security breach, resulting in the loss of approximately $9.8 million in digital assets. The attack occurred within just two hours of the affected vault’s deployment. Resupply operates as a stablecoin issuer, with its stablecoin backed by Collateralized Debt Positions (CDPs), functioning as a sub-DAO of Convex and Yearn Finance.
Vulnerability and Root Cause: The core vulnerability stemmed from the low liquidity of a newly deployed vault (specifically, a crcrvUSD or wstUSR vault). This made the vault highly susceptible to price oracle manipulation. The incident is identified as a classic example of a malicious donation attack, enabled by insecure value calculation and weak deployment processes.
Exploitation Mechanism: The attacker initiated the exploit by making a small donation to the newly deployed, low-liquidity vault. Following this, the attacker minted a single wei of shares. Due to the minimal existing liquidity, this small action drastically manipulated the vault’s internal exchange rate, making that single wei of shares appear to have a value equivalent to the attacker’s donation (e.g., 2,000 crvUSD). Leveraging this manipulated exchange rate, the attacker then proceeded to drain value from the protocol’s smart contracts, either by borrowing 10 million reUSD or directly draining the entire market using the low-value shares as collateral. After extracting the funds, the attacker distributed them to two separate addresses, subsequently sending these tokens to Tornado Cash for laundering to obscure the transaction trail.
Impact: Resupply suffered a loss of approximately $9.8 million.
Lessons Learned and Prevention: The Resupply hack serves as a reminder of a well-known attack vector in DeFi. To prevent such exploits, projects are advised to introduce sufficient initial liquidity into newly deployed vaults. This increases the cost for an attacker to significantly manipulate the exchange rate, thereby making the attack economically unfeasible. The incident highlights the critical need for secure value calculation mechanisms and robust deployment procedures, emphasizing adherence to guidelines for developers, particularly when utilizing protocols like ERC-4626, to mitigate such vulnerabilities.
This overview of recent security incidents highlights the continuous evolution of threats in the Web3 space. From external compromises and social engineering tactics to vulnerabilities in smart contract deployments and broader cybersecurity concerns, staying informed and adopting a proactive security posture remains crucial for all participants. As the ecosystem matures, the collective commitment to robust security measures will be key to fostering greater trust and enabling sustained innovation.
Since 2017, Extropy has been at the forefront of blockchain security, auditing smart contracts across Ethereum and Zero-Knowledge (ZK) protocols. We have collaborated with leading ecosystems, including Base, Starknet, and MINA, ensuring their smart contracts are resilient, efficient, and secure.
We specialize in DeFi, on-chain games, and ZK applications, leveraging formal verification, static analysis, and deep manual reviews to uncover vulnerabilities before they become exploits. Whether you’re working with Solidity, Rust, Cairo, or zkVMs, our collaborative approach ensures your project meets the highest security standards.
- Website: security.extropy.io
- Email: info@extropy.io
Get in touch today — let’s build safer smart contracts together!
