0x2 Web3 Security Bulletin

Crypto and web3 security insights, including tools, hacks, and regulations.

Insightful

DPRK IT Workers: Inside North Korea’s Crypto Laundering Network

Dive into the intricate network of North Korean IT workers involved in crypto laundering, detailing their methods and the scale of their operations. Learn how these individuals exploit vulnerabilities in the global financial system to fund the DPRK's illicit activities, including weapons programs. (Chainalysis)

Stablecoin Security: How Design Choices Create Vulnerabilities and Economic Risk

What are the security implications of various stablecoin design choices? Understand how different architectural decisions can introduce vulnerabilities and economic risks. Examine the trade-offs between decentralization, collateralization mechanisms, and oracle dependencies, illustrating how flaws in these areas can lead to de-pegging events, exploits, and significant financial losses. (Hacken)

Scaling Securely: A Roadmap for Series A Protocols

Building a security roadmap for Series A protocols. Cantina focuses on evolving security practices from audit readiness to institutional-scale operations. (Cantina)

Security Coordination Across Modular Protocols

What are the complexities of security coordination in modular blockchain protocols, where different components handle specific functions like sequencers, provers, and data availability? The article highlights the challenges of aligning security roles, risks, and coordination efforts across these disparate modules to ensure overall system resilience. (Cantina)

Companies in the news

Guardrail partners with Sui

Guardrail has announced a partnership with Sui, aiming to provide real-time, continuous onchain threat monitoring and proactive security support for developers building on the Sui ecosystem. (Guardrail)

Gimme the loot

A few notable hacks from Rekt and other sources…

SBI Crypto

Japan's SBI Crypto, a major mining pool operator, was drained for $24 million by suspected North Korean hackers across five blockchains (Bitcoin, Ethereum, Litecoin, Dogecoin, and Bitcoin Cash) on September 24th. (Rekt)

Hypervault - Rugged

HyperVault, a DeFi yield aggregator on Hyperliquid's HyperEVM promising 95% APY, executed a $4.64 million rug pull on September 26th after community warnings about fake audit claims were ignored. The protocol used an internal ledger system without share tokens and privileged admin functions that allowed the team to drain all nine vaults simultaneously before bridging funds to Ethereum via deBridge and laundering them through Tornado Cash. (Rekt)

Explained: The Abracadabra Hack

In October 2025, Abracadabra, a DeFi lending protocol, suffered an approximately $1.8 million hack due to exploited vulnerabilities in its smart contracts, leading to the theft of 1.79 million Magic Internet Money (MIM) stablecoin. This incident is part of a series of high-value exploits against the protocol, including a $6.4 million loss in January 2024 and a $13 million flash loan attack in March 2025. (Halborn)

Total 2025 hack events: 158

The total amount of money lost by blockchain hackers is about

$2,679,829,362.00

We must have regulations

Stablecoin Regulation: An Overview for Issuers and Exchanges

An overview of the evolving global regulatory landscape for stablecoins, highlighting the increasing scrutiny from jurisdictions worldwide. the article discusses how different countries are approaching stablecoin regulation, focusing on aspects such as licensing requirements, reserve backing, and anti-money laundering (AML) compliance. (Hacken)