Forensics — investigating on-chain exploits, proven byte by byte.
An interactive explorer for real bridge hacks. Each case is investigated the way a solo on-chain detective would: find the root cause in the actual contract code, follow the funds, and replay the exploit locally — with a hard rule that nothing is claimed unless it can be proven by a command anyone can re-run. It doubles as a course in reading contract code and understanding how cross-chain bridges really work.
Four cases · runs fully in the browser · no wallet, no sign-in.
The cases
2021 · ~$611M · authorization gap
Poly Network
The largest bridge hack. A relayed cross-chain message brute-forced a function-selector collision so the bridge called a privileged function on the contract it owned — rotating its own consensus keepers to the attacker.
2022 · ~$190M · optimistic proof bug
Nomad
An empty Merkle root had been trusted as “proven” since launch, so every message compared equal to a trusted root and proved with no proof at all — then a 300-address copycat swarm drained the bridge.
2022 · ~$80M · phantom deposit
Qubit Finance
A deposit of zero ETH minted collateral on another chain, because a hand-rolled safeTransferFrom treated a token transfer to a no-code address as a success — value created from nothing.
2024 · ~$3.3M · approval abuse
Socket Gateway
A newly-added bridge-aggregator route made an unvalidated, arbitrary call with the gateway’s authority — draining 127 wallets that had each granted the gateway an unlimited approval.
The method
Evidence discipline
Nothing enters a case unless it is proven by a re-runnable command — an on-chain read, a keccak recomputation, or a fork replay. Every claim carries the exact method and result.
Read the real code
An in-browser IDE shows the verbatim deployed contracts with the defect marked line by line, taught from the ground up — no prior Solidity assumed.
Run it yourself
An attacker console replays the exact historical calldata against real state at the real block, and proves the fix by simulating it — get into the mind of the attacker without touching a key.
The bridge landscape
A comparison of how LayerZero, Wormhole, CCIP, Axelar, IBC and 20+ protocols verify messages — the trust, latency and cost trade-offs, and which apps (Stargate, Mayan, Squid) stack on which layer.