TL;DR
Solana rolls out STRIDE, a structured security evaluation framework for projects on Solana.
QuillAudits provides guidance on auditing standards for crypto projects. For those of us in the know, this is a better methodology with wider coverage. Threat modeling, who would have thought?
Cyfrin outlines an OWASP based risk map and mitigation reference for engineering teams building in the agentic era. Plus two new tools to checkout Varlock and mlld.
Coinbase received conditional approval from the Office of the Comptroller of the Currency (OCC) for a national trust bank charter.
Octane Security, who uses a mix of static analysis, AI reasoning, and targeted trace construction to surface issues, raises a $6.75M Seed. Archetype is lead investor.
Solana Doubles Down on Ecosystem Security
Solana Foundation is rolling out new security programs aimed at making DeFi on the network more transparent, resilient, and incident-ready. The announcement centers on STRIDE, a structured evaluation framework for Solana projects, and SIRN, a response network of security firms that will coordinate during active incidents. The foundation says the effort is meant to raise standards across the ecosystem, while still leaving day-to-day security responsibility with individual protocols. (Solana)
Stablecoin's Rise to Payment Rail Dominance
The Chainalysis team previews their forthcoming "The New Rails" report, projecting that adjusted stablecoin volume, which reached $28 trillion in real economic activity in 2025, could approach $1.5 quadrillion by 2035 when accounting for a $100 trillion generational wealth transfer to crypto-native Millennials and Gen Z and accelerating point-of-sale adoption. On-chain stablecoin transaction counts are on pace to intersect with Visa and Mastercard off-chain volumes somewhere between 2031 and 2039. (Chainalysis)
Three Audits Is One Layer Repeated Three Times
The QuillAudits Team makes the case that Web3 protocols are systematically misallocating security budgets by commissioning multiple rounds of traditional audits instead of building genuinely layered defenses. Referencing Drift ($285M, two audits), Cetus ($223M, three audits), and Balancer ($125M, eleven audits), the article maps a complete multilayer security lifecycle spanning threat modeling, OpSec and multi-sig audits, fuzzing, AI-powered analysis, human review, on-chain monitoring, and bug bounties. The team notes that each layer covers structural blind spots the others cannot. (QuillAudits)
AI Safety for Developers: OWASP's Framework
Mike Karan surveys the current AI safety threat landscape for developers integrating AI into Web3 systems, drawing on OWASP's AI security framework to identify the top risk categories including prompt injection, model poisoning, and supply-chain compromise in AI-assisted tooling. The article provides a practical risk map and mitigation reference for engineering teams building in the agentic era. (Cyfrin)
U.S. Treasury Expands its Cyber-threat Briefings
CoinDesk reports that Treasury will let eligible crypto organizations recieve the same timely cybersecurity notices that traditional financial firms already receive from the Office of Cybersecurity and Critical Infrastructure Protection. Officials link the change to the President’s Working Group digital-assets report and cite the sector’s growing footprint. (CoinDesk)
Inside the $285M Drift Hack
Chainalysis breaks down the recent Drift Protocol exploit. The attackers spent six months posing as a quantitative trading firm to build trust with contributors, then exploited Solana's durable nonce feature to trick Security Council members into unknowingly pre-signing transactions that transferred admin control. The attackers subsequently listed a fabricated token (CVT) as collateral and drained $285M across 18 asset types in roughly 2.5 hours. (Chainalysis)
Total 2026 hack events: 56
The total amount of money lost this year: $438,915,414
OCC National Trust Bank Charters
Coinbase received conditional approval from the Office of the Comptroller of the Currency (OCC) for a national trust bank charter, which the exchange says will allow it to "build the next chapter of finance with the regulatory confidence" its partners need. Separately, EDX Markets, an institutional crypto exchange, submitted its own OCC application to offer crypto custody, asset management, and trade-settlement services. (JD Supra)
Fed Says Tokenized Securities Get Equal Capital Treatment
The Federal Reserve says eligible tokenized securities should generally be treated the same as their non-tokenized equivalents under bank capital rules. The FAQ emphasizes that the framework is technology neutral, so permissioned or permissionless blockchains do not change capital treatment, and eligible tokenized securities can also qualify as financial collateral if they meet the usual legal and risk-management requirements. (Federal Reserve)
Octane Security Raises $6.75M Seed
Investors are still backing automated analysis next to conventional audits. Octane describes its platform as a continuous smart contract security layer, not a one-time audit replacement. The FAQ says it scans GitHub pull requests, traces full exploit paths across imports and proxies, and uses a mix of static analysis, AI reasoning, and targeted trace construction to surface issues early. Archetype is the lead investor with Winklevoss Capital, Circle, Gemini, and others participating. (Crypto Fundraising) (Octane Security)
Read more from Nina @Forbes: bit.ly/4iZX5DI
ContractShield: Bridging Semantic-Structural Gap
This paper directly addresses a growing attack surface in Ethereum: adversaries deliberately obfuscating smart contract code via bogus code injection and control flow manipulation to evade automated vulnerability scanners. Existing multimodal detection methods fail here because they process semantic, temporal, and structural features in isolation. (arXiv)
SseRex: Practical Symbolic Execution of Solana Smart Contracts
SseRex is one of the first formal symbolic execution tools targeting the Solana ecosystem. It fills a major gap since most smart contract analysis tooling has historically focused on Ethereum's EVM. Solana's different execution model (eBPF programs, account-based state) requires adapted analysis techniques, and this paper presents a practical approach to finding vulnerabilities in Solana programs before deployment. (arXiv)