Recapping Notable Hacker Incidents | ChainBreaker Podcast Episode 5 Highlights
TechFlow Selected TechFlow Selected
Recapping Notable Hacker Incidents | ChainBreaker Podcast Episode 5 Highlights
In this episode, ChainNews Research Director Pan ZhiXiong hosted a deep discussion with Mr. Block (Chris) and Winkrypto (Max) on the hot topic "Let's Talk About Those Hacker Incidents."
Navigating Web3 tides with focused insights
Below is a summary of key insights from this live session.
Background
Last week was turbulent in the DeFi world. Projects such as Poly Network and Ref.Finance, a decentralized exchange within the NEAR ecosystem, were successively attacked by hackers, with losses ranging from millions to hundreds of millions of dollars. We will review several of these incidents and discuss why such attacks are so frequent and how we should respond.
Mr. Block Chris
Most developers aren’t as knowledgeable as people assume. Many are just like speculators—focused on making money and not thinking carefully about potential attack vectors. Therefore, even if a project has undergone multiple audits, it’s not necessarily secure. The relatively safer projects today are still mainly large ones like Aave, Curve, and Compound.
Be extremely cautious of high annual percentage yields (APYs). Some high-yield projects may work for one or two mining rounds before experiencing a sharp price drop or getting hacked.
Many solid projects spend significant time enhancing security rather than marketing. Be wary of projects that heavily promote themselves or progress unusually fast—these often carry higher risks. Once a project suffers an attack, user trust in it drops significantly.
Regarding audits, even projects audited by well-known firms aren't absolutely safe. With the surge in DeFi popularity, audit companies face overwhelming demand, which may lead them to conduct less rigorous reviews. Most smart contracts today are forks—for example, an audit firm might have already audited Uniswap, and then 100 other teams fork Uniswap. The auditor might treat all these as identical and issue reports after only a superficial check. However, if any team modifies even a small part of the code, the auditor could easily miss it. Moreover, many projects commission audits for marketing purposes rather than genuine security. High-profile audit firms may not perform thorough checks due to the sheer volume of requests. As a result, some smaller, local audit firms with lighter workloads might actually be more responsible and diligent.
ChainNews Pan Zhixiong
For DeFi protocol teams, what can be done to improve security? First, undergoing 1–2 security audits is essential for new protocols, as audits can uncover common vulnerabilities. Additionally, launching a bug bounty program before official mainnet deployment is highly recommended. Typically, protocols run tests on testnets prior to launch, but testnets lack incentives—if hackers discover bugs, they have no motivation to exploit or report them. These vulnerabilities then persist when the protocol goes live. As funds grow, hackers become increasingly motivated to find and exploit flaws.
For users, first understand your own risk tolerance. Diversify your funds—don’t put large amounts into a single protocol. Also, recognize that DeFi is still in its early stages. Only a few protocols like Uniswap, Curve, Compound, and Aave have undergone extensive, long-term testing. Most new protocols carry inherent risks, so avoid jumping into them too quickly.
Q&A
1. When hackers exploit contract vulnerabilities to steal large sums, are there moral or legal implications? If the hacker in the Poly Network incident hadn’t returned the funds, how would blockchain consensus resolve this? Which country would hold court or conduct the investigation?
Pan Zhixiong, ChainNews:
To answer the first question: yes, contracts are open-source and visible to everyone, and each contract defines specific business logic and intended functionality, along with certain restrictions—such as ensuring users cannot withdraw more funds than permitted. Developers may make mistakes in implementing fine-grained logic—unclear conditions, coding errors, or bugs. If a hacker exploits such a loophole in the business logic or the gap between logic and code implementation to extract profits, this is ethically and legally unjustifiable.
For the second question, if the hacker had not returned the funds, many victims would likely turn directly to O3 or the Poly Network team, since they are the project maintainers responsible for the compromised protocol.
Mr. Block Chris:
In the future, we might see a DAO emerge to act like a government or police force—where community members pool funds to comprehensively audit smart contracts across the market. Such a DAO could eventually rate protocols or even help patch vulnerabilities. Right now, the DeFi space lacks such a self-governing organization.
2. What can IDO platforms do to mitigate risks and improve project quality?
Pan Zhixiong, ChainNews:
IDO platforms can perform basic due diligence—understanding what the project does, who the team members are, and how it operates. However, IDO platforms generally lack the technical capability to conduct full audits. They mostly rely on third-party audit reports to assess a project’s safety.
About ChainBreaker
The "ChainBreaker" livestream series is initiated by Winkrypto, a global blockchain marketing agency, and co-hosted by Mr.Block, a popular YouTuber with over 10,000 subscribers, and ChainNews, the leading Chinese-language platform for blockchain content. ChainBreaker aims to listen, communicate, and connect the global crypto community. Every Friday at 8 PM, ChainBreaker invites prominent figures from the global crypto industry to discuss trending topics, share insights on technological developments, and reveal behind-the-scenes stories. Active participation in the live Q&A may also earn you exclusive rewards such as the "ChainBreaker Podcast" NFT Ticket.
Follow us and watch past episodes:
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
