Drainers
Anatomy of a permit drainer
412 wallets signed a gasless permit in six hours. None of them sent a transaction, and all of them lost their USDC.
11 min read ·
incidents --all
Incidents
Post-mortems of real attack patterns, retold with made-up names. What happened, minute by minute, and what a check would have shown.
airdrops · 9 Sep 2026
The airdrop that asked for everything
7 min read ·
A claim page that needed one signature: setApprovalForAll on every NFT you own.
phishing · 21 Jul 2026
Fake revoke sites, explained
6 min read ·
People who tried to clean up their approvals signed new ones instead.
addresses · 3 Jun 2026
Address poisoning: the lookalike in your history
8 min read ·
A zero-value transfer plants an address that matches the first and last four characters.
frontends · 18 Apr 2026
When the frontend was the exploit
9 min read ·
The contracts were fine. The DNS was not, for 47 minutes.
Read. Then sign.
Add Presign to your wallet and see every request in plain words before you confirm it.