- FOOM-50Negative
GoPlus Security 🚦 (@GoPlusSecurity)
GoPlus February Web3 Security Data Report In February 2026, Web3 suffered $35,736,999 in economic losses due to major security incidents. Types of security incidents included smart contract vulnerabilities, social engineering attacks, phishing attacks, honeypot scams, and rug pulls. Exploit In February, Exploits (including contract attacks, social engineering fraud, private key leaks, etc.) caused $27,737,214 in losses across 13 major incidents. Representative cases include: Feb 2: The cross-chain liquidity protocol CrossCurve was attacked due to a verification bypass vulnerability in its smart contract. The attacker forged cross-chain messages to withdraw funds, resulting in approximately $3 million stolen. Feb 18: DeFi lending protocol Moonwell was hacked. The root cause was a critical vulnerability in AI-generated smart contract code (price configuration issue). Attackers exploited price deviations to borrow excessively, resulting in about $1.78 million in bad debt. Unfortunately, this was the third attack caused by the same type of vulnerability within six months, bringing the total bad debt to over $5 million. Feb 21: The ioTube cross-chain bridge of IoTeX suffered a breach due to an Ethereum validator private key leak, allowing attackers to gain unauthorized control of the bridge contract. The incident resulted in approximately $4.4 million in losses. Feb 22: Lending protocol YieldBlox on the Stellar Network suffered an oracle manipulation attack. Attackers exploited extremely low liquidity to artificially inflate oracle prices and conduct excessive borrowing, leading to losses of approximately $10 million in USDC and XLM. Feb 26: Privacy gaming platform FOOMCASH had its smart contracts on Base and Ethereum exploited. Due to misconfigured verification keys, attackers were able to forge zkSNARK proofs and mint large amounts of FOOM tokens, causing approximately $2.26 million in losses. Phishing In February, phishing attacks caused approximately $5 million in losses, affecting around 4,000 victims. Feb 17: A user lost approximately $600,000 due to an address poisoning attack. Feb 19: A user lost about $337K in USDT after signing a malicious Approve transaction. Feb 25: Another user lost about $388K in USDT after signing a malicious Approve transaction. Attackers leveraged Phishing-as-a-Service (PhaaS) and AI technologies, significantly lowering the cost of building phishing sites and enabling large-scale phishing attacks across multiple ecosystems and communities. For users, it is essential to cultivate a Zero-Trust security mindset and operational habits. Remember the #GoPlus anti-phishing “Four Don’ts” principle: Don’t Click unknown links Don’t Install software from unknown sources Don’t Sign unclear wallet transactions Don’t Transfer funds to unverified addresses Install the GoPlus Security browser extension to block phishing links, risky signatures, approvals, and transactions in real time: https://chromewebstore.google.com/search/GoPlus HoneyPot & Scam In February, the GoPlus Token Security team detected 2,391 newly created honeypot tokens, an increase of nearly 500% compared to the previous month. A significant portion of these scams were related to the recent hype around AI Agents and OpenClaw. Breakdown by chain: Ethereum: 176 new honeypot tokens Base: 796 new honeypot tokens BSC: 1,158 new honeypot tokens