On 2024-03-05, Llama (Treasury Mgmt) suffered a proxy admin compromise incident resulting in approximately $33,879,710 in losses. The exploit targeted the protocol layer. Attribution: dprk_lazarus. This is a demonstration entry — not a real incident.
Matches the phishing drainer predicate
Matches the frontend dns hijack predicate
Matches the supply chain npm predicate
Matches the kms misconfiguration predicate
Matches the dvn collapse predicate
kms_provider = aws_kmsfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingmethod_b_root_causes = dvn_collapsekms_provider = aws_kmsfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingmethod_b_root_causes = supply_chain_npmfrontend_host = cloudflare_pagessubsector_tags = consumer_appmethod_b_root_causes = frontend_dns_hijack, supply_chain_npmkms_provider = aws_kmsfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingmethod_b_root_causes = kms_misconfigurationfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingmethod_b_root_causes = phishing_drainerfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingmethod_b_root_causes = phishing_drainerkms_provider = aws_kmssubsector_tags = infra_tooling, consumer_appmethod_b_root_causes = dvn_collapsekms_provider = aws_kmsfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingmethod_b_root_causes = frontend_dns_hijackfrontend_host = cloudflare_pagessubsector_tags = consumer_app, infra_toolingmethod_b_root_causes = dvn_collapse