On February 18, 2025 Cardex (fantasy trading card game on Abstract layer-2) suffered a session key compromise affecting approximately 9,000 wallets when a session signer private key was exposed on the frontend, allowing attackers to impersonate all active user sessions and drain approximately $400,000 from users who had approved session keys.

On February 18, 2025, Abstract discovered a security incident involving the Cardex app within The Portal, affecting approximately 9,000 wallets with a total loss of around $400,000 in ETH. A leaked key in Cardex's frontend code led to the compromise of the session signer wallet. Since this wallet was shared across all sessions, all users who had created sessions on Cardex were impacted.