CriticalIntermediate
The recursive split
2016 DAO-style recursive withdrawal. An attacker exploited a reentrancy flaw to drain a public investment fund before the balance was zeroed.
Historic impact · 3.6M ETHOpen lab →
▦ The cyber range for crypto defenders
Learn crypto security by breaking realistic systems — safely.
Wallets, contracts, exchanges, bridges and DeFi systems fail in specific, learnable ways. Exploit faithful recreations on a sandboxed testnet, then read the fix beside the flaw. Beginner to auditor, defence-first.
Isolated environment.Every lab runs on a sandboxed testnet — nothing here touches a real chain or real funds.
Live target state Healthy
Vault balance100.0 ETH
Attacker balance0.0 ETH
Users at risk25
Intermediate
→ How it works
A single path from nervous beginner to working researcher.
01 — LEARN
Guided paths
Theory, annotated vulnerable contracts, and the patched version side by side.
- Reentrancy, oracle manipulation, access control
- The flaw and the fix always paired
- No prior Solidity assumed
02 — PRACTISE
Labs & challenges
Live workspace, a real objective, a live target, progressive hints.
- State-based completion, not flags
- Watch target state flip live
- Replayable and fully sandboxed
03 — EARN
Reputation
Solved labs build verifiable reputation and rank.
- Points and ranks as you progress
- Portfolio auditors can verify
- Bug-bounty programmes — later phase
▦ Incident recreations
Learn from the breaches that actually happened.
Faithful sandboxed reconstructions of landmark exploits. Run the same attack, read the same post-mortem.
CriticalAdvanced
The validator majority
Ronin-style validator-key compromise on a cross-chain bridge. Attacker obtained majority validator signatures to authorise fraudulent withdrawals.
Historic impact · $625MOpen lab →
CriticalExpert
The forged signature
Wormhole-style signature-verification bypass on a cross-chain bridge. A missing validation step allowed fabricated guardian signatures to pass.
Historic impact · $326MOpen lab →
Recreations are educational reconstructions on isolated testnets, for responsible learning and disclosure — never to target live systems.
Every lab has a walkthrough.
The channel and the range are one classroom. Watch an exploit unfold, then reproduce it yourself. The two reinforce each other.
[ channel feature embed ]12:34