The incidents everyone cites, read from the records.
Each case is a file you can replay: a film, the investigation step by step, the cast of addresses, and a clear line between what the chain records and what others have reported.
Showing 8 of 8 cases
Case 01 · 1:24 film$1.5BBybit: Multisig Wallet TakeoverBybit: Multisig Wallet Takeover
No keys were stolen. Three signers approved what looked like a routine transfer. The call trace shows what it was: a delegatecall that ran someone else's code with the wallet's authority.
- Ethereum
- Tampered signing screen, then a delegatecall
- 7 steps
- 5 identifiers
Case 02 · 1:55 film8.72M FETSingularityNET: Bridge Drain and Token MintsSingularityNET: Bridge Drain and Token Mints
One signature check, then about 2.3 billion tokens minted across four projects. The headline said $16.77M. Followed sale by sale, the liquid proceeds come to roughly $2.29M.
- Ethereum
- Bridge signing key, then unbacked mints
- 8 steps
- 6 identifiers
Case 03 · 2:06 film≈1,816 BTCColdcard: Bitcoin Wallet DrainsColdcard: Bitcoin Wallet Drains
A firmware update left some hardware wallets choosing keys with weak randomness. 594 bitcoin arrived at one address, 562 moved once in a 341-input transaction, and it is still sitting there.
- Bitcoin
- Weak key generation in old firmware
- 6 steps
- 3 identifiers
Case 04 · 1:51 film$387.5MBitget: Exchange Wallet DrainBitget: Exchange Wallet Drain
Twenty-seven minutes between the test transaction and the first large transfer. The film reads each one from its receipt, including a stranger's contract that wrote a thousand token events into one transaction.
- Ethereum
- Exchange wallet drained after a small test
- 8 steps
- 5 identifiers
Case 05 · 2:14 film$3.5MNostra: Oracle Manipulation on StarknetNostra: Oracle Manipulation on Starknet
A thin pool, a ninety-nine dollar quote and an oracle that returned the midpoint. The exploit happened on Starknet, which Forensia does not read, so the film reports that part with its sources and starts its own record where the money lands on Ethereum.
- Ethereum
- Oracle price manipulation on Starknet, read from where the funds reach Ethereum
- 12 steps
- 4 identifiers
Case 06 · 2:17 film≈4,000 BTCLiquid Network: Unbacked L-BTC and Reserve DrainLiquid Network: Unbacked L-BTC and Reserve Drain
About four thousand bitcoin left a sidechain's reserve and no key was stolen. Four hours later a note appeared in a transaction: we are whitehats. 3,400 bitcoin came back. 598 did not, and it is still sitting at the same address.
- Bitcoin
- Unbacked sidechain coins redeemed through the normal withdrawal route
- 11 steps
- 4 identifiers
Case 07 · 2:59 film148.3M KIIKiiChain: Cosmos EVM Balance ExploitKiiChain: Cosmos EVM Balance Exploit
KiiChain reported 18 drains exploiting shared Cosmos EVM balance accounting. Follow the film from prepared vesting accounts to the BNB Chain sales, and see why a network halt could only contain funds that had not left.
- KiiChain / BNB Chain
- Vesting-account balance exploit, followed by bridge transfers and sales
- 12 steps
- 1 identifier
Case 08 · 2:47 film720.9M MANTRAMANTRA: Cosmos EVM Balance ExploitMANTRA: Cosmos EVM Balance Exploit
Two wallets lost roughly 720.9 million MANTRA through shared Cosmos EVM balance accounting. The film follows the preparation, repeated transfers and chain halt, then separates funds contained from funds recovered.
- MANTRA Chain
- Vesting-account underflow and victim-balance overflow
- 10 steps
- 2 identifiers