▼Losses Move to Components That Worked as Designed

Score history

Daily conviction score, 0 to 100. Higher means the thesis is more strongly corroborated.

Now 93 · -2 since Oct 9 · ranged 93 to 95

Showing the last few days. Unlock full score history.

Why the conviction moved

• Oct 9
  Strengthened +5

  Investigators trace Bitget's $387.5M theft to zero-day flaws in two third-party security appliances and to North Korea-linked actors. In the same run, NEAR Intents, Duelbits, Nostra and SingularityNET lost funds through custody integrations, private keys, oracles and cloud access. Losses are landing in operational infrastructure that contract audits never covered, which is the failure surface this thesis says is growing.

• Oct 3
  Strengthened +5

  Aave's FlashLoopAdapter asked the caller to self-report whether it was authorized instead of verifying independently, letting an attacker forge the check and drain 114 ether (about $305,000) from two Safe multisigs. The failing component executed exactly as written — the trust boundary, not the code, was the defect — which is the failure surface audits scoped to contract logic keep missing.

Showing the last 2 days. Unlock the full record.

Source trail

• Supporting · October 9, 2026

  Bitget's $387.5 Million Theft Leads a Run of Hot-Wallet and Infrastructure Breaches That Bypassed Contract Audits

  Investigators trace Bitget's $387.5M theft to zero-day flaws in two third-party security appliances and to North Korea-linked actors. In the same run, NEAR Intents, Duelbits, Nostra and SingularityNET lost funds through custody integrations, private keys, oracles and cloud access. Losses are landing in operational infrastructure that contract audits never covered, which is the failure surface this thesis says is growing.

  Rekt News (Bitget)

• Supporting · October 3, 2026

  Attacker Forged a Safe Authorization Check to Drain 114 Ether From an Aave Looping Module

  Aave's FlashLoopAdapter asked the caller to self-report whether it was authorized instead of verifying independently, letting an attacker forge the check and drain 114 ether (about $305,000) from two Safe multisigs. The failing component executed exactly as written — the trust boundary, not the code, was the defect — which is the failure surface audits scoped to contract logic keep missing.

  DeFiHackLabs (proof of concept)