SOF/LAXO Incident Analysis

Movie Token (MT) lost ~$242,000 to a double-counting flaw in its sell logic: sold tokens were also added to a pending burn variable, and burning them created a supply shock that inflated the price.

How Sui's Address Balance layer enables gasless stablecoin transfers, and why the May 2026 mainnet halts exposed risky boundaries between gas charging, settlement, and validator restarts.

How flash loan attacks work in DeFi: borrowing uncollateralized funds inside one block to manipulate prices, arbitrage or trigger liquidations, then repaying — the $182M Beanstalk Farms exploit.

On 6 September 2026, attackers primed the Elements rangeproof cache and reused a cached validation result to mint unauthorized L-BTC, then pegged out roughly 3,998.5 L-BTC worth about $318.7 million.

On 23 July 2026, an attacker embedded duplicate state roots in Verus notarizations and relayed them to Ethereum, overwriting the trusted root to authorize inflated withdrawals and drain $7.44M.

On 16 July 2026, DeFiTuna on Solana lost $569,601 USDC: attackers routed borrowed USDC through an illiquid TUNA/USDC pool, rounding the position's assets to zero and bypassing the solvency check.