PeckShield

On April 22, 2018, an attacker transferred about 57.9 × 10^57 BeautyChain (BEC) tokens. After investigating, PeckShield published a post the same day stating that the transfer came from an in-the-wild attack exploiting a previously unknown vulnerability in the contract, which it named “batchOverflow” and described as essentially a classic integer overflow issue: in the contract’s batchTransfer function, an attacker could manipulate the “_value” parameter so that the computed transfer total became zero, bypassing the checks and creating large numbers of tokens out of nothing.⁠[1][1][1][1][1]

The vulnerability was then assigned CVE-2018-10299, whose record states that the integer overflow in the BEC token contract’s batchTransfer function allows attackers to make an unauthorized increase of digital assets and was exploited in the wild in April 2018; its references include PeckShield’s analysis. On April 24, PeckShield disclosed proxyOverflow, another integer overflow vulnerability. After the two posts, exchanges including OKExOKXOKX is a global digital-asset trading platform that began operating in 2017 under the name OKEx. Different regional entities provide trading, wallet, payment and related services; the global platform, OKCoin and locally licensed entities must be distinguished.Open the full entry, Poloniex, Changelly, Quoine, and HitBTC suspended services for ERC-20 tokens, while Huobi first suspended all coins and later narrowed the suspension to ERC-20 tokens.⁠[2][2][2][2][1][1][1]

PeckShield has published some of its audit reports on GitHub, covering projects including Maker MCD in October 2019, Hegic in October 2020, OlympusDAO in April 2021, Venus and Tranchess in June 2021, and Lens, Solidly, Aave V3, and LooksRare in January 2022.⁠[3][3][3][3][3][3][3][3][3]

Its smart contract audit report for Aave V3 had a release candidate completed on November 20, 2021, and version 1.0 finalized on January 10, 2022, with Xuxian Jiang as both author and approver. In its “About PeckShield” section, the report describes PeckShield Inc. as a blockchain security company whose goal is to improve the security, privacy, and usability of current blockchain ecosystems by offering services and products, including smart contract auditing.⁠[4][4][4][4][4][4]

According to PeckShield’s count, more than 60 crypto hacks occurred in the first quarter of 2025, with losses totaling $1.63 billion, up 131% from $706 million in the first quarter of 2024; the attack on Bybit alone accounted for more than 92% of all losses. By month, losses exceeded $87 million in January, jumped to $1.53 billion in February because of the Bybit incident, and fell to about $33 million in March, when the largest incident was the theft of 6,260 Ether from Abracadabra.Money.⁠[5][5][5][5][5][5]

On October 1, 2026, PeckShield published statistics through its X account PeckShieldAlert: in September 2026 the crypto industry suffered 55 major hacks with total losses of about $766.49 million, an increase of about 462% from August’s $136.3 million, with the Bitget incident (about $387 million) and the Liquid Network incident (about $320 million, of which $285 million was returned) ranking first and second. Another security firm, CertiK, counted 97 incidents and about $768.4 million in losses for the same period; the two firms use different tracking methods and their incident counts differed, but their loss totals were less than $2 million apart.⁠[6][6][6][7][6]

On October 9, 2026, PeckShield detected that the attacker behind the incident involving the 79AU79th Vault79th Vault (also called 79Vault) is a decentralized finance project deployed on BNB Chain whose token is $79AU. The project describes itself as a treasury-backed multi-pool protocol built within the CocoCat ecosystem. On October 7, 2026, the privileged permissions of the project’s operational wallet were used to move about 2.01 million 79AU out of a PancakeSwap liquidity pool and swap them for about 16,249 BNB; two days later, the attacker returned 15,000 BNB to an address designated by the project.Open the full entry project’s operational hot wallet on BNB Chain had returned 15,000 BNB, worth about $11 million, to an address designated by the project team; the attacker had earlier deposited 30 BNB into KuCoin, and the whereabouts of the remaining funds were unclear.⁠[8][8]

As of October 2026, the services listed on PeckShield’s website include blockchain security audits, smart contract security audits, DeFi security audits, exchange security audits, digital wallet security audits, penetration testing and emergency response, black-box attack and defense tests, loophole inspection, security consulting, round-the-clock security emergency response, threat monitoring and prevention, smart contract attack prevention, asset movement and blacklisted address monitoring, total security solutions for consortium blockchains, bounty program operation solutions, and customized security services.⁠[9][9][9][9][9][9][9][9]

Its digital asset anti-money-laundering platform draws on data from Bitcoin, Ethereum, and other blockchains as well as darkweb data, has collected more than 60 million address labels for Bitcoin, Ethereum, EOS, USDT, and others, and offers visualization tools for asset movement paths and transaction networks, along with real-time monitoring of large transfers, blacklisted addresses, and exchange addresses based on full-node data.⁠[9][9][9]

PeckShield: Official website: https://peckshield.com/ (opens in a new window).⁠[2]

X: Public account: https://x.com/peckshield (opens in a new window)⁠[9]