Real incidents,
verified evidence.
Each investigation reconstructs a real Web3 security incident from on-chain evidence: what happened, when, where the value went, and what the evidence proves or could not prove.
See the evidence before you trust the verdict.
8
In corpus
5
Chains covered
2021-2023
Incident range
Counts reflect the XemaS investigation corpus - a curated selection, not a catalogue of all historical incidents.
Failure categories
Incident corpus
Each page is a permanent, evidence-backed reference for its incident.
Squid Game Token (SQUID)
Anonymous deployer, honeypot transfer logic, no liquidity lock. Risk score 97.
Evidence
USDC / SVB Depeg (2023)
A banking failure priced on-chain in hours: $3.3B reserve exposure, ~$0.88 low, DAI contagion, information-driven recovery.
Evidence
Euler Finance Exploit (2023)
A governance upgrade skipped one health check: ~$197M drained via donate-and-self-liquidate, then returned over three weeks.
Evidence
Nomad Bridge Hack (2022)
One zeroed initialization parameter made verification a no-op: ~$190M drained permissionlessly by hundreds of copycat addresses.
Evidence
Ronin Bridge Hack (2022)
Five of nine validator keys compromised: 173,600 ETH and 25.5M USDC drained in two forged withdrawals and undetected for 6 days. Attributed to Lazarus Group by US Treasury.
Evidence
Harmony Horizon Bridge Hack (2022)
Two of five validator keys compromised: ~$100M drained 91 days after Ronin, moved through Tornado Cash within hours. Same attacker group; complete loss. Attributed to Lazarus Group by FBI and OFAC.
Evidence
Mango Markets Oracle Manipulation (2022)
No code exploit: oracle assumptions failed. MNGO oracle price inflated ~30x; $116M borrowed against manufactured collateral. Conviction: Avraham Eisenberg, SDNY, April 2024.
Evidence
Beanstalk Farms Governance Exploit (2022)
No code exploit: governance assumptions failed. Flash-borrowed supermajority passed a malicious BIP in one block; $182M drained with no execution delay to stop it. Complete loss.
Evidence
How investigations are produced
The same evidence standard that governs every platform scan governs every investigation.
One evidence standard
Every claim is collected, verified, and resolved into facts before it appears. The same pipeline the platform uses internally - not a separate editorial standard.
Honest limits stated
Where evidence was not visible, the investigation says so explicitly. A claim we cannot support does not appear, and coverage limits are part of the report, not a footnote.
Admission gate
A page is a canonical investigation only when it reconstructs a real incident from on-chain evidence that passes the Entity History admission gate.
Investigate any address with the same evidence engine
Every scan returns verified evidence, coverage state, and explicit limits - not a traffic-light score.
Scan a token or walletNo account required for a first scan.