- Date
- 8 Oct 2026
- Place
- South Korea
- Who
- Uranium Finance · Financial Services
- The way in
- Known software flaw
- Source
- BleepingComputer
What was reported.
A Maryland man was found guilty of stealing over $53 million across two hacks against decentralized crypto exchange Uranium Finance in April 2021. The attacker exploited smart contract coding errors to drain liquidity pools, forcing the platform to shut down.
The way in the source reports: a known flaw in software the victim ran.
On April 8, 2021, during the first breach, he drained about $1.4 million out of Uranium's liquidity pool by exploiting a flaw in its smart contract code to issue zero-token withdrawal commands, which forced the exchange to pay rewards he wasn't entitled to.BleepingComputer, added to these pages on 9 Oct 2026. The source
What a known software flaw is.
A known software flaw is a weakness the maker has published and fixed in a later version. A system still on the older version keeps the weakness until it is updated.
Once a flaw is public, attackers look across the internet for the version that has it and try the published method on every system that answers. Devices at the edge of a network, mail servers and web software are reached first because they face the internet.
We read the versions a firm's own servers and website state about themselves and match them to public records of known flaws, the government list of flaws used in attacks among them.
A version a server does not state cannot be read. A fix can also be applied without changing the version shown. A match is a reason to check the system. It is not proof the flaw was used.
This part is true of every case of this kind. It says nothing more about Uranium Finance than the source does.
What we check for it.
Software versions your site advertises and known flaws in them.
What we read for technology companies.
- The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM), read externally.
- Breach records for addresses at your own domain, read externally; nothing inside is touched.
- Names made from yours, each asked whether it is registered and set up for mail.
- The certificate your website answers with, seen externally: its name, its dates and who issued it.
- The headers and cookies your website sends to every visitor, seen externally.
- Read with the assessment. What AI assistants answer about your business. Assistants build their answers from pages they crawl. A name made from yours can be built to be crawled: its robots file invites the AI crawlers in and its page claims your name. When a client asks an assistant for your phone number, they can get the copy's. In 2025, asked for the sign-in pages of 50 brands, an AI assistant gave addresses the brand did not control one time in three (Netcraft research). The check is built to ask six assistants: Claude, ChatGPT search, Gemini, Perplexity, Grok and Copilot, through Bing. Monitoring asks again every week and tells you when a copy's phone or address is in an answer. Source: Netcraft research, read on 4 November 2026.
The rule, from its source: What does each US state's data breach law ask a business to do?
See your own firm the way an attacker reads it.
We read your domain from public records and show each way in with a check anyone can re-run.
Source.
Source: BleepingComputer ↗This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.