SECURITY BULLETIN // 17.12.2025

Heads up. New tactics are live.

1. The "Airdrop" Bait
You're getting DMs/Tweets about a "confirmed airdrop" for a major L2. The link asks for a "gas fee" to claim.
→ This is a drainer. Real airdrops don't require upfront payment.

2. The Fake Auditors
Small projects now hire "audit firms" that are just paid rubber stamps.
→ Check if the auditor is on DeFiSafety or CodeArena. If not, treat the audit as decoration.

3. Wallet-Drain Pop-ups
A new malicious script can trigger a fake MetaMask pop-up even on legitimate sites if you have a stray approval.
→ If a pop-up feels off, close your browser entirely. Restart.

YOUR ACTION ITEMS FOR TODAY:
✔️ Log out of all DApp connections in your wallet settings.
✔️ Check token approvals on every chain you use, not just Ethereum.
✔️ If you use a hot wallet, set a hard daily transaction limit right now.

AUDIT CORNER:

• Syndicate's new vault passed a Sherlock audit. Clean.

• Solana's Kamino v2 audit found minor issues; all fixed.

• Avoid any project whose audit report is just a PDF with no tracker or repo.

Remember:
The goal isn't to be unhackable. The goal is to be less attractive than the next guy.

Turn on your transaction signing notifications.
Use a burner wallet for new sites.
Don't keep your life savings in a hot wallet. Ever.

Stay sharp.

Check all your wallet approvals, not just on one chain.

Log out of every old dApp connection you are not using.

Set a strict daily spend limit on your hot wallet right now.

If an airdrop asks for a fee, it is one hundred percent a scam.

Treat any unknown auditor as just a paid rubber stamp.

Close your entire browser if a wallet pop-up feels wrong.

Use a burner wallet for testing any new site or link.

A clean audit from a known firm is the bare minimum.