# 0x8 Web3 Security Bulletin

> Crypto and web3 security insights, including tools, hacks, and regulations. 

**Published by:** [W3SB](https://paragraph.com/@w3sb/)
**Published on:** 2025-11-20
**Categories:** web3, security, crypto, cybersecurity, hacks, exploits
**URL:** https://paragraph.com/@w3sb/0x8-web3-security-bulletin

## Content

Insightful Trail of Bits Discloses Elliptic Library Vulnerabilities Trail of Bits discovered and publicly disclosed two critical vulnerabilities in the elliptic JavaScript library, downloaded over 10 million times weekly, that could enable signature forgery or prevent valid signature verification. One vulnerability remains unfixed more than 90 days after disclosure. The cryptographic flaws affect numerous blockchain and cryptocurrency applications relying on elliptic curve operations for transaction signing and verification. (Trail of Bits) Cyfrin Releases Uniswap V4 Hooks Security Analysis Cyfrin published a comprehensive security deep dive on November 14, 2025, examining attack vectors and vulnerabilities in Uniswap V4's new hooks system. The analysis provides detailed guidance on secure hook implementation, highlighting common pitfalls developers must avoid when building custom liquidity pool logic and emphasizing security considerations for protocols integrating with Uniswap V4's extensible architecture. (Cyfrin) The Great Indonesian TEA Theft: A Massive, Stealthy npm Spam Campaign The IndonesianFoods campaign flooded npm with over 43,000 spam packages over two years, containing dormant scripts that enable self-replication and exploit the TEA Protocol blockchain to fraudulently earn OSS reward tokens. Packages camouflage as legitimate projects, bypassing installation-time security. This long-lived, coordinated attack exposed gaps in ecosystem defenses and highlights evolving supply chain threats, urging improved monitoring and defense strategies.​ (Endor Labs) Crypto National Security and Pig Butchering Emerge as Major Threats Chainalysis's November 13 podcast episode features Andrew Fierman and Erin West discussing how pig butchering scams have evolved into national security concerns, with $15 billion in crypto seizures and victims losing life savings to transnational criminal networks. The discussion highlights Southeast Asian scam compounds with thousands of trafficked workers, emphasizing cross-sector collaboration and proactive regulatory measures to combat organized crime networks. Analysts stress that the magnitude of these operations—spanning full cities constructed solely for fraud—remains under appreciated by policymakers and the public. (Chainalysis) Web3 Cybersecurity Standards for Institutional Adoption Cantina published guidance on November 17, 2025, outlining how Web3 projects can achieve bank-grade security standards beyond smart contract audits. Meeting institutional requirements now demands comprehensive infrastructure security, continuous monitoring capabilities, and incident response protocols that operationalize security across the entire technology stack, not merely at the contract layer. (Cantina) Companies in the news Checkmarx Partners with CredShields to Boost Web3 Security for Financial Institutions Checkmarx has partnered with CredShields to extend enterprise-grade application security into Web3, focusing on blockchain-based financial systems. This collaboration provides smart contract audits, vulnerability research, and advanced security tools to help financial institutions manage risks in decentralized ecosystems. With nearly half of major DeFi hacks linked to smart contract flaws, this partnership aims to integrate decentralized security into existing DevSecOps pipelines, supporting broader blockchain adoption in finance.​ (Financial News) Gimme the loot A few notable hacks from Rekt and other sources… Defimon Alerts are tracking a few exploits over the past week, probably rounding up to a $1M or so, not chump change, but nothing "major" this week... SlowMist stats this week Total 2025 hack events: 177 The total amount of money lost by blockchain hackers is about $2,857,562,055 We must have regulations Brazil's New Crypto Regulatory Framework Set for 2026 Brazil's Central Bank published three resolutions operationalizing the 2022 Virtual Assets Law, establishing comprehensive crypto regulations effective February 2026. The framework requires crypto businesses to meet capital thresholds ranging from R$10.8 million to R$37.2 million, implement enhanced AML/CFT measures, and segregate customer assets. With a tight February deadline and nine-month grace period, firms must quickly adapt to licensing requirements and risk management protocols that integrate crypto into existing financial sector oversight, marking a watershed moment for Latin America's largest crypto market. (Chainalysis) FATF Sets New Global Asset Recovery Standard The Financial Action Task Force’s 2025 Asset Recovery Guidance establishes a comprehensive international framework to strengthen the confiscation and management of criminal assets. It sets operational and legal expectations—spanning tracing, freezing, and restoring funds to communities—and prioritizes both effectiveness and fairness, including digital asset recovery and cross-border cooperation reforms.​ (FATF) U.S. Treasury Sanctions Burmese Armed Group and Cyber Scam Network The U.S. Treasury's OFAC has designated the Democratic Karen Benevolent Army (DKBA), its senior leaders, and associated companies for running cyber scam centers targeting Americans through fraudulent investment schemes. These operations involve human trafficking and fund criminal activities, including supporting Burma’s military regime. The action is part of a broader effort involving multiple agencies to disrupt Southeast Asian scam networks costing Americans billions annually.​ (US Treasury Dept.) VCs & funding AgentLISA the first Agentic Security Operating System Secures $12M LISA, a Web3 AI security project focused on detecting complex vulnerabilities in smart contracts and decentralized applications, has raised $12 million in a funding round. Investors include Redpoint Ventures, UOB Venture Management, Signum Capital, NGC Ventures, and Hash Global. LISA is developing an AI-native Agentic Security OS integrating AI with blockchain to outperform traditional auditing tools. (AgentLISA)

## Publication Information

- [W3SB](https://paragraph.com/@w3sb/): Publication homepage
- [All Posts](https://paragraph.com/@w3sb/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@w3sb): Subscribe to updates