Vasiliy Melovatskiy @Mark__VC

POLYMARKET EXPLOIT DETAILS📛 Suspected major incident on the UMA CTF Adapter contract running on Polygon. Over $520,000 already drained from the system. The UMA CTF Adapter is the key oracle bridge Polymarket uses to settle all prediction markets through UMA’s Optimistic Oracle. It directly handles conditional tokens and final market resolutions. Still early, but it looks like a potential smart contract or oracle-related vector. On-chain activity is being tracked closely right now Immediate action:
 If you have open positions or liquidity on Polymarket (especially Polygon), check your wallets and monitor everything. This is the second notable incident in the prediction market space recently. As these platforms scale massively, oracle and adapter security is becoming critical #DeFi #Polymarket #exploit #crypto

@DriftProtocol will there be any details on how Tether will give their credit line?

@DeFiCarrot @bluemoose123 We at Vega Finance don't want a project as strong as DeFi Carrot to simply disappear. We are ready to fully take over the infrastructure and continue development - with care for the users and for CRT. The team, the community - we are here and ready to help

Instead of watching an hour of Netflix, watch this 60 minute lecture from Steve Jobs after being fired from Apple. It will teach you more about building companies than most startup books ever will.

Elon Musk's dance 🕺

We need to implement the following defi-industry The key is monitoring of historical wallet activity. Transactions with anomalously large amounts must be automatically frozen for two hours. During this time, a mandatory compliance check and on-chain history analysis are initiated. For stablecoins, it is necessary to contact Tether and Circle to verify all details. This is our only way out, otherwise, the witch hunt and chaos will never end. #usdc #usdt #tron #exploit #crypto #defi

cryptoworld now

@0x_Abdul Imho AAVE will be fine after this. They have enough money to compensate all loses to their users

@0x_Abdul DeFi needs to react faster We need flexible monitoring system that would help protocols to protect their users

@kir_varlamov Hey, I saw news from here @AggrNews Then checked Etherscan to find tx

rsETH TOKEN POTENTIALLY EXPLOITED FOR $291M Tx:etherscan.io/tx/0x1ae232da2… #exploit #kelpdao #ETH

Funny how EVM fans were writing shit about Solana after Drift Exploit So KelpDAO was exploited Don’t laugh at others, or you might find yourself in their shoes #EVM #Solana #KelpDAO #Exploit

🚨 MAJOR EXPLOIT ALERT: ~$292 MILLION drained from Kelp DAO’s rsETH bridge. This is one of the biggest DeFi hits we've seen recently. An attacker targeted the LayerZero-powered cross-chain bridge, making off with a staggering 116,500 rsETH. Here is exactly how it went down 1/ The Setup & Execution At 17:35 UTC on Saturday, the attacker manipulated LayerZero’s EndpointV2 contract by triggering an lzReceive call. This forced Kelp's bridge contract to release the 116.5k rsETH to an exploiter address. Classic DeFi hacker move: the wallet was funded via Tornado Cash ~10 hours prior to cover their tracks. 2/ The Response Kelp DAO’s emergency multisig stepped in, but not instantly. About 46 minutes after the initial drain, they executed a pauseAll function, freezing the core contracts (LRT Deposit Pool, Withdrawal, Oracle, etc.). This clutch move successfully blocked two subsequent drain attempts at 18:26 and 18:28 UTC. 3/ The Fallout & Contagion The stolen funds aren't just a drop in the bucket—116,500 rsETH represents a massive 18% of the ENTIRE circulating supply. The ripple effect? $AAVE dropped ~10% shortly after, driven by market fears that the lending platform could be saddled with bad debt as a result of the hack. 4/ A Bad Case of Deja Vu? This marks the second major security incident for Kelp DAO in just 12 months. Back in April 2025, they had to pause deposits/withdrawals due to a fee contract bug that caused excess rsETH minting (though no user funds were lost at that time). 5/ Radio Silence As of now, we are still waiting on official word. Neither @KelpDAO nor their parent protocol @kernel_dao have issued a public statement on X regarding the $292M loss. DeFi security remains a wild west. Stay safe out there, anon, and always manage your risk! #exploit #kelpdao #eth #aave #layerzero

KELPDAO exploiter wallet: 178m$ in stolen funds etherscan.io/address/0x5d39… #ETH #KELPDAO #Exploit #DeFi

wtf is going on --April 1 - Drift exploit --April 18 - Kelp DAO exploit

🚀DRIFT RECOVERY UPDATE Launch of a Recovery Token (separate from DRIFT) - each affected user will receive a share of the Recovery Pool with the ability to trade it Full protocol relaunch: migration to USDT, new community-governed multisig with strict rules (timelocks, dedicated devices, alerts) Two independent audits AND complete code restructuring based on security best practices Recovery Pool: up to $127.5M from Tether + $20 million from partners + protocol fees Insurance Fund is completely safe drift.trade/updates/incide… #Drift #Solana #usdt

@Vega_DeFi @TheCapital_One @DriftProtocol interesting

THE HACKER WHO EXPLOITED DRIFT HAS BEEN IDENTIFIED After analyzing the obtained information, we want to announce that the hackers are from @TheCapital_One. Here are several facts supporting our conclusion: First, according to the @DriftProtocol investigation, from December 2025 to January 2026, the attackers connected the Ecosystem Vault on Drift, and it was fund. If we go to the relevant section of the DEX website and check the age of all vaults, we can see that only the SOL and USDC Staking Vaults fits (app.drift.trade/vaults/strateg… and app.drift.trade/vaults/strateg…). Second, if we visit The Capital website, we find that their vaults are listed on Drift. Moreover, the descriptions provided on their site and on Drift match. Moreover, by looking at their open positions, one can notice that their strategy is based on a long JLP position with 1x leverage and hedging through perps. The key point is that this is an absolutely standard strategy in its most basic configuration, which may indicate that the fund did not engage in prolonged development of this strategy. Additionally, if you go to the Overview and look at the Lock Up Period & Withdrawals section, you can see that the withdrawal period is 0 minutes. This further demonstrates the simplicity and shortsightedness of the strategy, because in this case, anyone can deposit $1 million and withdraw it a day later. This would lead to the liquidation of the manager, as they would not have enough time to prepare the liquidity. In fact, the Vault is technically unequipped to accept capital. Third, the X account was created and verified in November 2025, just shortly before the listing on Drift. Fourth, if we go to their Telegram channel, it opens into a chat where we can see that 2 admins (out of 6 total people) were online on March 29, 2026. Based on the above, we are confident that the individuals behind the hack and the fund withdrawal are from The Capital. WARNING! Be EXTREMELY cautious when visiting their website. Do not click on any links, as this may be dangerous and could lead to the loss of your funds. #DeFi #Drift #Exploit #Driftexploit

Velocity @VelocityDEX

4 months ago

x.com/i/article/2040…

652 681 4K 6.6M 2K