Towards Verifiability of Total Value Locked (TVL) in Decentralized Finance

Total Value Locked TVL aims to measure the aggregate value of cryptoassets deposited in Decentralized Finance DeFi protocols. Although blockchain data is public, the way TVL is computed is not well understood. In practice, its calculation on major TVL aggregators relies on self-reports from...

Malicious code in defi-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2a9667f769678a9fe048b57918ea5bfd54ef1323131a91f8d9e581feca74948 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3779 Malicious code in defi-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2a9667f769678a9fe048b57918ea5bfd54ef1323131a91f8d9e581feca74948 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth-defi (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in defi-handbook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8160c8cc94eeeb56db2b1b93ced943ad36eaba53c64c82a994bda43d14ab4dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2503 Malicious code in defi-handbook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8160c8cc94eeeb56db2b1b93ced943ad36eaba53c64c82a994bda43d14ab4dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Canadian Charged in $65M KyberSwap, Indexed Finance DeFi Hack

Canadian man charged in $65 million DeFi hack. Exploited KyberSwap, Indexed Finance smart contracts, laundered funds, and attempted extortion. Faces 20 years...

PARSIQ’s Reactive Network Provides Solution for DeFi Exchange Vulnerabilities

Over the past few years, decentralised finance DeFi has revolutionised the financial sector. DeFi introduced transparent, permissionless and…...

Top 5 Platforms for Identifying Smart Contract Vulnerabilities

How well do you know your smart contracts’ health? This article highlights the top five platforms that DeFi…...

CVE-2024-11365

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

CVE-2024-11365

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

CVE-2024-11365

CVE-2024-11365 affects the WordPress plugin Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes . The vulnerability is a Reflected Cross-Site Scripting (XSS) due to unsafe use of the URL-building function add_query_arg without proper escaping, in versions up to and including 1.1.6. This enab...

CVE-2024-11365 Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...

WordPress Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin <= 1.1.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Crypto and DeFi Widgets versions = 1.1.6...

PT-2024-16937 · WordPress · The Crypto/Defi Widgets – Web3 Cryptocurrency Shortcodes

Name of the Vulnerable Software and Affected Versions: The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress versions up to, and including, 1.1.6 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated...

WordPress Crypto and DeFi Widgets Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Crypto and DeFi Widgets Type Plugin Vulnerable versions = 1.1.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11365 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5b571d52ad59 Credits vgo0 Requir...

North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS

A threat actor with ties to the Democratic People's Republic of Korea DPRK has been observed targeting cryptocurrency-related businesses with a multi-stage malware capable of infecting Apple macOS devices. Cybersecurity company SentinelOne, which dubbed the campaign Hidden Risk , attributed it wi...

Crypto Scam App Disguised as WalletConnect Steals $70K in Five-Month Campaign

Cybersecurity researchers have discovered a malicious Android app on the Google Play Store that enabled the threat actors behind it to steal approximately $70,000 in cryptocurrency from victims over a period of nearly five months. The dodgy app, identified by Check Point, masqueraded as the...

Nexera DeFi Protocol Hacked: $1.8M Stolen in Major Smart Contract Exploit

Learn how a smart contract vulnerability led to the theft of $1.8 million from Nexera, a DeFi protocol.…...

DeFi Hack Alert: Squarespace Domains Vulnerable to DNS Hijacking

DeFi apps on Squarespace are vulnerable to a DNS hijacking attack that redirects users to malicious sites. Over…...