{
  "name": "0xCERT IOC feed",
  "description": "Indicators of compromise for the Web3 attack surface: attacker and drainer addresses, phishing domains, malicious URLs, ENS names, and transactions.",
  "homepage": "https://www.0xcert.com/iocs",
  "license": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/",
  "generated_at": "2026-10-09T00:35:47.375Z",
  "signature": "https://www.0xcert.com/iocs.json.asc",
  "count": 41,
  "indicators": [
    {
      "type": "tx",
      "value": "0xed265fc80e4abe42d72d6bfd1623c89dd2d12f544d53d4ca2c9c3d0fefbf2810",
      "chain": "Base",
      "label": "Malicious authorization via Safe execution (GoPlus Security)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0230",
      "advisory_id": "0xCERT-2026-0230",
      "source": "https://www.blockchainbreaches.com/en/breaches/base-wsteth-vault-2026",
      "first_seen": "2026-10-09T00:35:47.375Z",
      "updated_at": "2026-10-09T00:35:47.375Z"
    },
    {
      "type": "address",
      "value": "0xcdfe91301356da873562ef513828a60dba1f569d",
      "chain": "Base",
      "label": "Exploit contract added to vault borrow allowlist (GoPlus Security)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0230",
      "advisory_id": "0xCERT-2026-0230",
      "source": "https://www.blockchainbreaches.com/en/breaches/base-wsteth-vault-2026",
      "first_seen": "2026-10-09T00:35:47.375Z",
      "updated_at": "2026-10-09T00:35:47.375Z"
    },
    {
      "type": "address",
      "value": "0x0b5126e1bc27c0de77e02e97945760a674edb034",
      "chain": "Base",
      "label": "Attacker EOA (GoPlus Security; PeckShield)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0230",
      "advisory_id": "0xCERT-2026-0230",
      "source": "https://www.blockchainbreaches.com/en/breaches/base-wsteth-vault-2026",
      "first_seen": "2026-10-09T00:35:47.375Z",
      "updated_at": "2026-10-09T00:35:47.375Z"
    },
    {
      "type": "tx",
      "value": "0x557bfd0e8530fd3e089748ccaabaa7837877f7578b13a377008474f2e367ee8c",
      "chain": "Base",
      "label": "Attack transaction, Aave redemption of 1,783.067 wstETH (GoPlus Security)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0230",
      "advisory_id": "0xCERT-2026-0230",
      "source": "https://www.blockchainbreaches.com/en/breaches/base-wsteth-vault-2026",
      "first_seen": "2026-10-09T00:35:47.375Z",
      "updated_at": "2026-10-09T00:35:47.375Z"
    },
    {
      "type": "tx",
      "value": "0x0ec75c3be1f55bb08a92421796675e051993cdb6cbc38d5e33cc2b7f6ef2f491",
      "chain": "Base",
      "label": "Attack transaction, first borrow (GoPlus Security)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0230",
      "advisory_id": "0xCERT-2026-0230",
      "source": "https://www.blockchainbreaches.com/en/breaches/base-wsteth-vault-2026",
      "first_seen": "2026-10-09T00:35:47.375Z",
      "updated_at": "2026-10-09T00:35:47.375Z"
    },
    {
      "type": "tx",
      "value": "0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9",
      "chain": "Base",
      "label": "Exploit transaction",
      "confidence": "high",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0153",
      "advisory_id": "0xCERT-2026-0153",
      "source": "https://www.blockchainbreaches.com/en/breaches/goldpesa-2026",
      "first_seen": "2026-10-08T22:46:32.286Z",
      "updated_at": "2026-10-08T22:46:32.286Z"
    },
    {
      "type": "tx",
      "value": "0x772e73613ffbc845508377fc6ded1137f60ad730aecb2b7c18a2978a84a6ac1",
      "chain": "Starknet",
      "label": "Price-moving buy in manipulated pool (Phalcon)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0160",
      "advisory_id": "0xCERT-2026-0160",
      "source": "https://x.com/Phalcon_xyz/status/2100818035082952751",
      "first_seen": "2026-10-08T20:41:09.761Z",
      "updated_at": "2026-10-08T20:41:09.761Z"
    },
    {
      "type": "tx",
      "value": "0x741af6efcc55165e89f7ef0b8ebad7e87efeaa8daa3b60dddd62d5dcacae69d",
      "chain": "Starknet",
      "label": "Attacker NSTR/SolvBTC pool creation, one-sided liquidity (Phalcon)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0160",
      "advisory_id": "0xCERT-2026-0160",
      "source": "https://x.com/Phalcon_xyz/status/2100818035082952751",
      "first_seen": "2026-10-08T20:41:09.761Z",
      "updated_at": "2026-10-08T20:41:09.761Z"
    },
    {
      "type": "address",
      "value": "0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37",
      "chain": "Ethereum",
      "label": "Attacker consolidation address for bridged funds (CertiK)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0160",
      "advisory_id": "0xCERT-2026-0160",
      "source": "https://x.com/Phalcon_xyz/status/2100818035082952751",
      "first_seen": "2026-10-08T20:41:09.761Z",
      "updated_at": "2026-10-08T20:41:09.761Z"
    },
    {
      "type": "address",
      "value": "0x06d48ef7ab62c26e3ef1987c322096cd508e9034c82048783a6b438fc1344bc3",
      "chain": "Starknet",
      "label": "Attacker borrow account (CertiK, GoPlus)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0160",
      "advisory_id": "0xCERT-2026-0160",
      "source": "https://x.com/Phalcon_xyz/status/2100818035082952751",
      "first_seen": "2026-10-08T20:41:09.761Z",
      "updated_at": "2026-10-08T20:41:09.761Z"
    },
    {
      "type": "tx",
      "value": "0x6bc9b41bce2b6c08639c16790af064efafa15890c1ebf8cc72df99a577a1cf1",
      "chain": "Starknet",
      "label": "Manipulated GeckoTerminal oracle price entry (Phalcon)",
      "confidence": "high",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0160",
      "advisory_id": "0xCERT-2026-0160",
      "source": "https://x.com/Phalcon_xyz/status/2100818035082952751",
      "first_seen": "2026-10-08T20:41:09.761Z",
      "updated_at": "2026-10-08T20:41:09.761Z"
    },
    {
      "type": "tx",
      "value": "0x2460fde607d09f2434d1b4e6d4089c6e1f459f4ce70ba2853d3a37547cdf00e",
      "chain": "Starknet",
      "label": "Borrow at inflated NSTR valuation (Phalcon)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0160",
      "advisory_id": "0xCERT-2026-0160",
      "source": "https://x.com/Phalcon_xyz/status/2100818035082952751",
      "first_seen": "2026-10-08T20:41:09.761Z",
      "updated_at": "2026-10-08T20:41:09.761Z"
    },
    {
      "type": "address",
      "value": "0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37",
      "chain": "BNB Chain",
      "label": "BSC theft address (ZachXBT)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0151",
      "advisory_id": "0xCERT-2026-0151",
      "source": "https://t.me/investigations/365",
      "first_seen": "2026-10-08T20:41:09.091Z",
      "updated_at": "2026-10-08T20:41:09.091Z"
    },
    {
      "type": "address",
      "value": "0x9bfcca13b4ac907433ac68766e96309ac867f819",
      "chain": "Ethereum",
      "label": "Attacker forwarder wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "secret1mru6cp7ft8cfasaye4g6vum52qygnkq0cgw0az",
      "chain": "Secret Network",
      "label": "Key used to fund the vote purchase (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "0xef6c5a31df984c8569236a0abc1f27580e2a5d54",
      "chain": "Ethereum",
      "label": "Attacker collection wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "neutron1dd25c4sshelrpfs0433apg24c5phrhk8l6n605",
      "chain": "Neutron",
      "label": "Attacker wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "noble1dd25c4sshelrpfs0433apg24c5phrhk8nx0sda",
      "chain": "Noble",
      "label": "Attacker wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n",
      "chain": "Cosmos Hub",
      "label": "Attacker wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "osmo1dd25c4sshelrpfs0433apg24c5phrhk8n7fgrp",
      "chain": "Osmosis",
      "label": "Attacker wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "axelar1dd25c4sshelrpfs0433apg24c5phrhk8ltvs7j",
      "chain": "Axelar",
      "label": "Attacker wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "dydx1dd25c4sshelrpfs0433apg24c5phrhk8ju5u4y",
      "chain": "dYdX",
      "label": "Attacker wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "neutron1ekgfga6vv4zdrrjn3dux6f62fuzektfndgaehm",
      "chain": "Neutron",
      "label": "Attacker voting wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "noble1ekgfga6vv4zdrrjn3dux6f62fuzektfnp5pn4j",
      "chain": "Noble",
      "label": "Attacker voting wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "cosmos1ekgfga6vv4zdrrjn3dux6f62fuzektfnfh5mdu",
      "chain": "Cosmos Hub",
      "label": "Attacker voting wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "osmo1erq7tre6nk0jfx203z8ey75g4m7yfrckl3qx87",
      "chain": "Osmosis",
      "label": "Attacker key used to sell THORChain refund (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "cosmos1erq7tre6nk0jfx203z8ey75g4m7yfrckh2nk3v",
      "chain": "Cosmos Hub",
      "label": "Attacker key used to sell THORChain refund (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "0xe149310eb8b1b3d9c471ccd81819d393621fba5c",
      "chain": "Ethereum",
      "label": "Attacker working wallet (Neutron post-mortem)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0143",
      "advisory_id": "0xCERT-2026-0143",
      "source": "https://x.com/crypto_crew/status/2104924316357841306",
      "first_seen": "2026-10-08T20:41:08.150Z",
      "updated_at": "2026-10-08T20:41:08.150Z"
    },
    {
      "type": "address",
      "value": "TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbK",
      "chain": "Tron",
      "label": "Hacker address (Scam Sniffer)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0148",
      "advisory_id": "0xCERT-2026-0148",
      "source": "https://x.com/realScamSniffer/status/2103059906303869042",
      "first_seen": "2026-10-08T20:41:07.633Z",
      "updated_at": "2026-10-08T20:41:07.633Z"
    },
    {
      "type": "address",
      "value": "0xa77e24fe29d16e051e487ef4ea7b056cb05aef76",
      "chain": "Ethereum",
      "label": "Hacker address, EVM (Scam Sniffer)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0148",
      "advisory_id": "0xCERT-2026-0148",
      "source": "https://x.com/realScamSniffer/status/2103059906303869042",
      "first_seen": "2026-10-08T20:41:07.633Z",
      "updated_at": "2026-10-08T20:41:07.633Z"
    },
    {
      "type": "address",
      "value": "TBWNguTTgezw9dVorX441C6nDrZpRxYwKD",
      "chain": "Tron",
      "label": "Primary attacker-controlled receiving address (Bitget)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0147",
      "advisory_id": "0xCERT-2026-0147",
      "source": "https://x.com/bitget/status/2103485484165120005",
      "first_seen": "2026-10-08T20:41:07.059Z",
      "updated_at": "2026-10-08T20:41:07.059Z"
    },
    {
      "type": "address",
      "value": "t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG",
      "chain": "Zcash",
      "label": "Primary attacker-controlled receiving address (Bitget)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0147",
      "advisory_id": "0xCERT-2026-0147",
      "source": "https://x.com/bitget/status/2103485484165120005",
      "first_seen": "2026-10-08T20:41:07.059Z",
      "updated_at": "2026-10-08T20:41:07.059Z"
    },
    {
      "type": "address",
      "value": "rwNhefsz1UQEusxhCvHip3RANinWi4CTck",
      "chain": "XRP Ledger",
      "label": "Primary attacker-controlled receiving address (Bitget)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0147",
      "advisory_id": "0xCERT-2026-0147",
      "source": "https://x.com/bitget/status/2103485484165120005",
      "first_seen": "2026-10-08T20:41:07.059Z",
      "updated_at": "2026-10-08T20:41:07.059Z"
    },
    {
      "type": "address",
      "value": "0x770b10b273fc44fe9197d6bf20f145c2e98463ee",
      "chain": "Ethereum",
      "label": "Primary attacker-controlled receiving address, EVM (Bitget)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0147",
      "advisory_id": "0xCERT-2026-0147",
      "source": "https://x.com/bitget/status/2103485484165120005",
      "first_seen": "2026-10-08T20:41:07.059Z",
      "updated_at": "2026-10-08T20:41:07.059Z"
    },
    {
      "type": "address",
      "value": "0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5fa",
      "chain": "Ethereum",
      "label": "Attacker EOA (CertiK)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0154",
      "advisory_id": "0xCERT-2026-0154",
      "source": "https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis",
      "first_seen": "2026-10-08T16:44:41.998Z",
      "updated_at": "2026-10-08T16:44:41.998Z"
    },
    {
      "type": "address",
      "value": "0xec997d2ad033277913d6002277353368e8321dcf",
      "chain": "Ethereum",
      "label": "Attack contract (CertiK)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0154",
      "advisory_id": "0xCERT-2026-0154",
      "source": "https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis",
      "first_seen": "2026-10-08T16:44:41.998Z",
      "updated_at": "2026-10-08T16:44:41.998Z"
    },
    {
      "type": "tx",
      "value": "0xb8ecff9c129d8d9331c85558eaeddff29a38c4c16b71a40986acbf8f6febefeb",
      "chain": "Ethereum",
      "label": "First Tornado Cash deposit of proceeds (CertiK)",
      "confidence": "high",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0154",
      "advisory_id": "0xCERT-2026-0154",
      "source": "https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis",
      "first_seen": "2026-10-08T16:44:41.998Z",
      "updated_at": "2026-10-08T16:44:41.998Z"
    },
    {
      "type": "tx",
      "value": "0xd4c0b18a058e7f0a12855f30174f4cb1e973c15c886063deab97e1a21f048ac6",
      "chain": "Ethereum",
      "label": "Attacker funding via Tornado Cash withdrawal (CertiK)",
      "confidence": "high",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0154",
      "advisory_id": "0xCERT-2026-0154",
      "source": "https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis",
      "first_seen": "2026-10-08T16:44:41.998Z",
      "updated_at": "2026-10-08T16:44:41.998Z"
    },
    {
      "type": "tx",
      "value": "0x4a587af4213cc345c4c109fbf5fec46f9643183f91a9edf60305380f31ad1167",
      "chain": "Ethereum",
      "label": "Attack contract deployment (CertiK)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0154",
      "advisory_id": "0xCERT-2026-0154",
      "source": "https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis",
      "first_seen": "2026-10-08T16:44:41.998Z",
      "updated_at": "2026-10-08T16:44:41.998Z"
    },
    {
      "type": "tx",
      "value": "0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88c",
      "chain": "Ethereum",
      "label": "Exploit transaction (CertiK)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0154",
      "advisory_id": "0xCERT-2026-0154",
      "source": "https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis",
      "first_seen": "2026-10-08T16:44:41.998Z",
      "updated_at": "2026-10-08T16:44:41.998Z"
    },
    {
      "type": "address",
      "value": "0xf09a13072ed939b79bc25b66aa3a836ea6dcc170",
      "chain": "Ethereum",
      "label": "Malicious adapter module used in exploit (CertiK)",
      "confidence": "confirmed",
      "advisory": "https://www.0xcert.com/advisory/0xCERT-2026-0154",
      "advisory_id": "0xCERT-2026-0154",
      "source": "https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis",
      "first_seen": "2026-10-08T16:44:41.998Z",
      "updated_at": "2026-10-08T16:44:41.998Z"
    }
  ]
}