Bridge verificationpostmortem
Nomad: when an initialized default becomes permission to process a message
A bridge authentication failure illustrates why deployment state, default values and upgrade behavior need a single security model.
Incident:
Incident studies
Read past the
headline number.
The useful question is where trust broke, why a control failed, and what could have revealed the problem sooner. These are independent analyses of published investigations—not claims that we investigated the affected organizations.
Incident dates describe the event; publication dates describe our analysis. This is a curated historical library, not a live alert feed.
12 notes
Lending invariantspostmortem
Euler V1: every path that changes collateral belongs in the solvency model
The March 2023 exploit connects an omitted account-health check to liquidation incentives and multi-step accounting invariants.
Incident:
Publishing & runtime codepostmortem
Ledger Connect Kit: offboarding and runtime dependencies share a security boundary
A package-publishing compromise reached applications through dynamically loaded code without changing their own repositories.
Incident:
Backups & privileged devicespostmortem
LastPass 2022: backup access can be the production-data incident
The disclosed chain from development information to privileged endpoint compromise and stolen backups challenges narrow production boundaries.
Advisory:
Support evidence & sessionspostmortem
Okta support system 2023: diagnostic files can carry live account authority
A support-system compromise links browser synchronization, service-account access and sensitive HAR files to session hijacking.
Incident:
Web3postmortem
Bybit and Safe: the signing interface is part of your security boundary
The February 2025 theft shows why multiple signatures cannot compensate for a shared, compromised view of a transaction.
Incident:
Web3postmortem
Radiant Capital: a document request can become a treasury incident
A reported malware delivery chain connects developer communications, workstation trust and multisig operations.
Incident:
Web3postmortem
WazirX: make custody responsibilities testable before an incident
The July 2024 wallet theft illustrates the operational consequences of unclear verification and response responsibilities.
Incident:
Web2postmortem
Snowflake customer intrusions: old credentials can remain a live attack path
Mandiant’s 2024 investigation connects infostealer exposure, missing MFA and cloud data theft.
Incident:
Web2postmortem
Cloudflare’s Thanksgiving incident: a rotation checklist needs closure evidence
A 2024 disclosure about a 2023 intrusion shows how residual credentials can outlive an initial response.
Incident:
Supply chainpostmortem
tj-actions compromise: CI logs can become a secret-exfiltration channel
CVE-2025-30066 demonstrates why action versions, workflow permissions and build logs belong in one threat model.
Incident:
Supply chainpostmortem
XZ backdoor: review the artifact you deploy, not only the repository
CVE-2024-3094 illustrates the gap between source review, release packaging and the executable shipped downstream.
Incident:
Research and guides are dated, curated publications. How we source and correct our work.