Case study
How we saved 83 ETH with obliterated AI agents
At Devcon Mumbai, our team used frontier and less-restricted AI models to identify a signature-validation bug in legacy Cairo 0 contracts and help the Starknet Foundation secure 82.8 ETH across 12,000+ wallets in under a day.
- Partner
- Starknet Foundation
- ETH secured
- 82.8
- Date
- November 2026
The story
From an old approval to a 24-hour rescue
Starknet NFT marketplaces ask users to approve them to move tokens on their behalf. Those approvals last until they are revoked, so a marketplace built years ago can still hold a live permission over a wallet today.
The affected marketplace contracts assumed that accounts would revert on an invalid signature and did not check the returned result. For accounts that returned 0 instead, this allowed invalid orders to pass.
On November 1, a drainer bot exploited this, taking NFTs and roughly 40 ETH. The Starknet Foundation team raised the alarm and asked for help.
Tracing the attack, we found it was only the visible part. The same flaw left the ETH approvals of about 50,000 wallets open, with up to 200 ETH at stake across several old marketplaces. From Devcon in Mumbai, we alerted the Starknet Foundation right away so they could reach the affected teams and coordinate efforts to address the vulnerabilities.
Pyramid upgraded and disabled its contract, which brought the exposure down to 84 ETH. All of it sat on MintSquare, whose team the Foundation could not reach in time. So we crafted a rescue transaction that moves that ETH out of the attacker's reach and gave the Starknet team the technical information they needed to execute the operation. Between November 3 and 4, 82.8 ETH from 12,386 affected accounts, about $200k at the Nov 4 high of $2,435, was transferred to a multisig wallet controlled by the Starknet Security Council.
| Date (UTC) | Onchain events |
|---|---|
| Nov 1 | A drainer bot starts emptying wallets with old marketplace approvals. |
| Nov 3 | Pyramid upgrades its exchange contract (10:37). The first rescue transaction follows at 12:46, and by midnight 72.5 ETH from 6,149 wallets is secured. |
| Nov 4 | Another 10.3 ETH from 6,239 wallets, ending with the last transaction at 10:52. The remaining 0.8 ETH is not worth the gas to collect. |
We also proposed additional mitigation at the sequencer level: a filter designed to reject the bad signature check before the transaction commits. We backtested it on about 195,000 mainnet transactions with no false positives, and it is still under review.
The recovered ETH is currently held in a security multisignature wallet controlled by the Starknet Security Council. Further information about the recovery process will be communicated through official Starknet channels once arrangements have been finalised.
A white hat operation has been completed to protect ETH exposed by a vulnerability in legacy NFT marketplace contracts on Starknet.
Testimonial
Verity worked like part of our team. They knew what to look for, they moved before we asked, and their AI infrastructure got us through limits that would have slowed anyone else down.
Takeaway
Smart contract security in the agentic era
This incident highlights the importance of reassessing legacy contracts as account implementations and security research tools evolve. The tools security researchers use have become far stronger, and finding a hard vulnerability costs a fraction of what it did a year ago. Attackers get that leverage too, so defenders need to use similar tools, and need them first.
Here is the stack we used on Starknet:
- Research. Gemini Carbon searched Starknet for other contracts exposed to the same
is_valid_signaturepattern. - Verification. Obliterated open models, DeepSeek and Kimi, simulated real attacks on each candidate and drained test wallets to prove which ones were exploitable. Safety-tuned models refuse this work, which is why we removed their restrictions.
- Fixes. Gemini Carbon drafted the hot fix and the cold fix we proposed to the Starknet teams.
We believe far more funds sit in legacy systems and complex protocols, and agents make stealing them cheaper every month. That is why we test Gemini models before release, get cyber access from Anthropic and OpenAI, and run our own open-source model infrastructure for clients facing these threats.
Contact our team
We take 4 protocols per quarter. Formal verification demands deep focus. We'd rather verify fewer contracts well than many poorly.
Continue reading
Learn more
The proposed sequencer filter and the multisig holding the rescued ETH.
What is a formal proof? How we go beyond audits.