Meowverse

SECURITY WITH SISI: November Hack Breakdown November closed with $127M confirmed losses and closer to $240/250M when small/underreported incidents are included. It made one thing brutally clear Web3 breaks at the seams where deFi, centralized infra, keys, governance and humans intersect. Major Incidents ◈ Balancer V2 $113M Exploit Vector: Composable pool invariant failure A subtle rounding bug inside Balancer’s composable pool logic allowed attackers to distort pool balances and drain liquidity across multiple integrated protocols. Because these pools were deeply wired into other protocols, the exploit cascaded across chains. A tiny math error escalated into multiprotocol contagion. Recovery: $45M frozen across cooperating protocols, remainder laundered via bridges/mixers. ◈ Stream Finance $93M Loss Vector: Off-chain fund manager failure Stream relied on an external asset manager controlling large off chain collateral. A massive loss hit the manager, wiping the backing of xUSD/xBTC/xETH. Centralized fund management undermined decentralized guarantees Recovery: Legal & forensic investigation; withdrawals still restricted. ◈ Upbit $30/36M Hot Wallet Compromise Vector: Private key inference / infrastructure level key leak Abnormal SOL outflows from Upbit’s wallets triggered an emergency freeze. Investigators claim the attacker reconstructed the hot wallet key by exploiting a "private key inference vulnerability" in Upbit’s internal infrastructure meaning the flaw was likely inside the signing system, not user accounts. Funds flowed exactly like a Lazarus op: • SOL → USDC • USDC → ETH • ETH bridged + mixed Same chain path as the 2019 Upbit hack. What’s interesting is that the hack happened exactly during Upbit parent Dunamu’s $10B acquisition by Naver Corp. The exchange’s explanation is still unusually vague Could be Lazarus or an insider disguising as Lazarus Recovery: Remaining funds moved to cold storage; full reimbursement promised. Investigation ongoing. ◈ GANA Payment $3.1M Drained Vector: Admin key compromise and delegator misuse An hacker gained access to an admin key and abused an EIP-7702 style delegation contract to drain assets. They bridged stolen ETH + BNB to Ethereum, then laundered through Tornado Cash. Recovery: None. Team announced they will “relaunch.” ◈ Beets $3.8M Exploit Vector: Smart contract vulnerability A protocol level flaw in beets allowed hackers to manipulate pool logic and extract value. Not a wallet drain, not phishing, classic contract failure. Recovery: No confirmed freezes or clawbacks announced yet. User side losses Over $33M in November came from: Seed phrase theft, clipboard malware, wallet drainer approvals, “delegation” phishing, fake support staff, malicious extensions, old keys reused across wallets Hackers increasingly target individuals because: • One whale is 8/9 figure jackpot • OPSEC is weak • Hardware wallet usage is still not default • New wallet drainers are 1 click silent approvals User mistakes remain one of the largest attack vectors in Web3. Hack Pattern Analysis: What changed this month? ◈ DeFi composability remains a multiplier for failure, one small bug → dozens of pools → multiple chains → 9 figure loss. ◈ Off chain operations are now a systemic onchain risk ◈ Stream finance proves that you can follow every smart contract rule and still lose everything if your centralized partner blows up, centralized infra is still the weakest keyholder ◈ Upbit’s private key leakage shows CEXes remain the #1 institutional attack surface. ◈ Admin/privilege misuse is still the fastest way to zero GANA’s exploit required no clever math just an overpowered admin key. ◈ Wallet hygiene is still collapsing Despite better tools, user losses remain massive and steady. Security Tips For users: Use hardware wallets, keep hot wallet risk minimal, assume all support DMs are scams, never reuse keys and never store seed phrases on devices. For teams: Use timelocks & multisig/MPC, remove unnecessary emergency powers, audit both code and operations, rotate keys, isolate environments and expect attackers to target governance and key control. For the ecosystem: Enforce transparent recovery/freeze reporting, build shared cross chain forensics and standardized admin privilege disclosures. If you’re building in web3 secure the keys, secure the people, secure the processes before securing the code.

@sisihacks Gm boss

Gm frens T-7 hours until the new security with sisi monthly hack breakdown drops followed by an investigative topic on the upbit hack. Was it really the Lazarus Group , an insider… or do we have a very convincing copycat on our hands? Here's a flower for making it through half for the week.

Gm web3 Another day reminding you to read some of security with sisi write ups. You might need the security tips more than you think. November hack analysis drops tomorrow, not many hacks but there was still some major damage and lazarus team strikes again, even though something is still not adding up imo. Have a good day 💜

@sisihacks Gm boss

Gm,happy new month... Coming up today on Security With Sisi is: The Scam That Outran the Courts: How Libra Returned Stronger After Its Asset Unfreeze Yes, the same libra wallets that rugged millions earlier this year just woke up after 9 months of silence and rotated $61.5M into $Sol like nothing happened. Stay tuned👀, in the meantime checkout last week SWS topic. You read need to read it. Stay safu and have a profitable week.

@sisihacks Not really, dev refuse to fix backend issue before mainet

@Me0wverse Gmeow intern You are back?

Gm Have you read this week's topic of security with sisi yet? Get to it if you haven't 😒

@JohnWRichKid Gmonad

gmonad

@Fohsurre Hacked?

Founder said backend will be up on Thursday then we play? What do you think of the UI/UX tho?

Check profile 🌚

Happy Sunday guys... Next week will be interesting

@monad Stooop teasing meeee

any minute now

Founder can't know that I still have the login, let's keep it quiet

@Fohsurre Yoooo, glad you guys still remember me

MEOW 💜🐱

@literal_fck Failed exam, had to retake it. Boss wasn't happing giving me this job back I missed you retards

@Me0wverse Intern had a very long vacation 💀

Took alil break from giving updates on my buildings, but I'll back next week @Me0wverse is ready The phishing tool is almost done The Warpcast app is ready for some testing Which one are you exciting for ?

@A_bashira Dev is upppp Gmonad

Gmonad

@A_bashira Gmeow dev

Gm web3 Another week to make some shmoney, get opportunities, be a believer or a hater and everything in between.