0x3 Web3 Security Bulletin

Crypto and web3 security insights, including tools, hacks, and regulations.

Insightful

The Right to Disappear

“The same protocols designed to eliminate trusted third parties may soon require biometric verification. Smart contracts that were meant to execute without permission could check your government papers first.” (Rekt)

The Growing Landscape of Seizable Crypto Assets: On-Chain Balances Linked to Criminal Activity Exceed $75 Billion

On-chain analysis reveals over $75 billion in crypto assets linked to criminal activity, highlighting the increasing scale of illicit finance within the digital asset ecosystem. “Darknet market administrators and vendors alone control over $40 billion in on-chain value.” (Chainalysis)

Elliptic’s Typologies Report: Identifying AI-enabled scams and frauds

Elliptic’s latest Typologies Report highlights the emergence of AI-enabled scams and frauds in the crypto landscape. The report provides crucial insights into new deceptive tactics, helping financial institutions and law enforcement identify and combat these evolving threats. (Elliptic)

Web3 × AI Agents: Landscape, Integrations, and Foundational Challenges

A analysis of Web3-AI agent integration, revealing a rapidly evolving ecosystem with significant market traction and technical sophistication. The researchers approach mapped the landscape through systematic categorization and market analysis, identifying bidirectional synergies where AI agents leverage Web3's trustless infrastructure while enhancing Web3's accessibility and automation capabilities.

Key Results:

  • Infrastructure projects dominate 67.8% of the $6.92 billion market cap despite representing only 25.6% of projects

  • Ethereum hosts 39.5% of projects and captures 87.4% of market value

  • 20.3% of projects span multiple categories, indicating cross-category integration

  • AI agents enable autonomous DeFi trading, portfolio optimization, and market analysis

  • Governance enhancement through proposal analysis and automated monitoring

  • Security improvements via intelligent vulnerability detection achieving 90%+ precision

(ArXiv)

Gimme the loot

A few notable hacks from Rekt and other sources…

Novel EIP-7702 hack

Tikkala Security might have found the first EIP-7702 hack. The team points to a public function, pancakeV3SwapCallback(), which anyone can call to transfer tokens out. (Tikkala Security)

Thief steals seed phrase and $1.7 million in cryptocurrency

This incident underscores the critical importance of securing seed phrases and highlights the ongoing risks associated with inadequate physical security measures for digital assets. (Decrypt)

Gone phishing on X, I’d say these are waterhole attacks…

  • The official X account of Watt Protocol was compromised, leading to phishing tweets. (ScamSniffer)

  • BNB Chain's official English X account was compromised and is undergoing emergency recovery. (BNBCHAINZH)

Abracadabra (MIM) $1.8M Hack Explained: How a Virtual Hook Bypassed Solvency Checks An analysis of the Abracadabra (MIM) $1.8M hack reveals how a virtual hook mechanism was exploited to bypass solvency checks, leading to significant financial losses. This third incident for the protocol highlights the need for more robust security measures. (Hacken)

Total 2025 hack events: 161

The total amount of money lost by blockchain hackers is about $2,681,629,362.00

We must have regulations

Hong Kong Crypto License: Key Insights for 2025 Key insights for obtaining a crypto license in Hong Kong for 2025 are presented, covering regulatory requirements and market trends. This guide is essential for businesses navigating the evolving landscape of digital asset regulation in the region. (Haken)

VCs & funding

Chainalysis Doubles Down on AI Innovation with Growth Financing from Hercules Capital Chainalysis secured growth financing from Hercules Capital to accelerate its AI innovation, aiming to enhance blockchain analytics capabilities. (LinkedIn)