Recent Crypto Hacks: 3 Attacks, 3 Different Attack Surfaces

The latest incidents show that crypto security risks extend far beyond vulnerable smart contracts. In each case, attackers targeted a different layer of the infrastructure.

#01 — Liquid Network: ~$320M

Bitcoin sidechain · Elements bug · Unbacked mint

A vulnerability in Elements, the software underlying Liquid Network, allowed an attacker to create roughly 4,000 unbacked LBTC. The attacker then used Liquid's peg-out process to convert the unbacked assets into real BTC.

The incident was not caused by a stolen private key. The failure was in the software responsible for validating transactions.

#02 — Safe Wallet: ~$7.7M

Smart wallet · Module exploit · Uniswap v4

An attacker targeted a custom module connected to a Safe wallet and attempted to drain roughly $7.7M worth of rsETH. The module interacted with a Uniswap v4 strategy, creating an attack path that could be used to access the wallet's assets.

An MEV bot intercepted the exploit transaction, so the ~$7.7M figure should be treated as the value targeted in the exploit rather than simply a confirmed permanent loss.

#03 — Nostra: ~$3.5M

Starknet lending protocol · Oracle manipulation · Starknet

An attacker manipulated a thin-liquidity NSTR market, causing the oracle to report an artificially inflated token price. The manipulated price increased the apparent value of the attacker's collateral. The attacker then borrowed roughly $3.5M in other assets against that inflated collateral value.

Three Incidents. Three Attack Surfaces.

• Liquid Network → transaction validation and consensus software
• Safe Wallet → wallet modules and external integrations
• Nostra → oracle design and market-price manipulation

The common problem is not one specific bug. It is the layer of trust between different components. A protocol may have audited smart contracts while still depending on:

• Third-party libraries and infrastructure
• Wallet modules
• Oracle providers
• External liquidity
• Cross-protocol integrations
• Transaction validation systems
• Privileged contracts and permissions
• Economic assumptions

Why This Matters

Modern crypto systems are no longer just smart contracts. They are interconnected systems where wallets, protocols, oracles, infrastructure and external markets continuously interact. That means an attacker does not always need to find a vulnerability in the core contract. They can instead attack something the contract trusts.

The security question should therefore go beyond "Is the smart contract secure?" It should also be "What does the smart contract trust?" And: "What happens if that trust is compromised?"

What Security Teams Should Review

• Dependency security: Review every external library, service and infrastructure component with privileged access.
• Wallet modules: Identify exactly which modules can execute actions or move assets on behalf of a wallet.
• Oracle resilience: Test how the protocol behaves when prices are manipulated, delayed or unavailable.
• Economic attack paths: Model whether an attacker can manipulate liquidity, collateral or pricing and immediately extract value.
• Transaction validation: Check whether technically valid transactions can still represent economically invalid actions.
• Defense in depth: Make sure one compromised component cannot directly become a path to the entire treasury.

Final Takeaway

The biggest lesson from these incidents is simple: the attack surface is larger than the smart contract. Liquid Network shows how a validation-layer vulnerability can create massive losses. Safe shows how an authorized wallet module can introduce unexpected execution risk. Nostra shows how an oracle can become a direct financial attack surface.

Security reviews should therefore examine not only the code you wrote, but also the code, infrastructure, permissions, markets and assumptions your system depends on.