Incident Overview
On February 27, 2025, Suji Yan, founder of Mask Network, lost approximately $4 million in a crypto hack.
The hack was first detected by on-chain security platform Cyvers, which identified suspicious outflows from Suji Yan’s wallet. Approximately $4 million in crypto was stolen, including 113 ETH, 923 WETH, 301 ezETH, 156 weETH, 90 pufET, 48,400 MASK tokens, 50,000 USDT, and 15 swETH. After being stolen, the assets were immediately converted into ETH, then distributed across six wallets, with one address ending in “df7.” Yan suggested the attack might have been an offline exploit, possibly carried out when his phone was left unattended at his birthday celebration, indicating potential physical access or phone compromise.
Currently, SlowMist and ZachXBT are assisting in the investigation, alongside law enforcement. This incident follows a series of high-profile hacks, including the Bybit breach just days earlier, highlighting the increasing sophistication of cyber threats in the crypto space.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Suji Yan, these are the critical security checks that could have prevented this incident (February 2025).
- Verify all logic paths related to Phishing are guarded by proper access controls and input validation - see the Phishing Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Suji Yan
The Suji Yan hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.