W3SB https://paragraph.com/@w3sb Crypto and web3 security insights, including tools, hacks, and regulations. Sat, 05 Sep 2026 23:12:38 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en W3SB https://storage.googleapis.com/papyrus_images/2d636c4823f008bfbeba45f964abfea7ddf314da1d7f3cf57fc0ce0e19a4278b.jpg https://paragraph.com/@w3sb All rights reserved <![CDATA[0x49 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x49-web3-security-bulletin OBI6ujXBgf4o88TogBdV Sat, 05 Sep 2026 12:20:33 GMT TL;DR

  • Trends & Markets: Browser extensions are being weaponized as wallet drainers, tokenized assets face weekend pricing risks, and Chainalysis is expanding coverage to include support for HyperEVM.

  • Exploits & Incidents: A $75M exploit hit Tectonic via illiquid collateral manipulation, and an unchecked integer cast in Notional Finance led to a $1.73M drain.

  • Policy & Regulation: Russia's new comprehensive cryptocurrency regulatory regime has officially taken effect.

  • Capital Allocation: Firelight raised $8M to build decentralized insurance for DeFi, and YC's Verdict Machine launched AI-native cybersecurity for institutional digital assets.

  • Applied Research: Recent papers introduce a dataset mapping smart-contract CVEs to code, a graph-based blockchain screening system, and LLM-generated vulnerability benchmarks.

Subscribe

Industry Trends & Analysis

Nineteen Browser Extensions Shipped a Wallet Drainer

Socket’s Karlo Zanki tracks 18 Chrome extensions and one Edge add-on that are capable of stealing browser information, account sessions, credentials, and cryptocurrency-related data. Several legitimate extensions were reportedly acquired and later updated with modular malware targeting services including Coinbase, Binance, Kraken, OKX, MetaMask, and others. The campaign demonstrates how browser-extension supply chains can bypass assumptions users make about previously trusted software and gain privileged access to authenticated sessions. (Socket)

Weekend Oracle Gaps Create Risk for Tokenized Stocks

The QuillAudits team examines a mismatch between 24/7 tokenized-equity trading and price feeds that still depend on traditional market hours. For example Coinbase-issued tokenized stocks can continue moving on Base while underlying reference prices may remain frozen over weekends, potentially leaving DeFi protocols with stale collateral valuations. The analysis argues that bringing equities onchain requires risk models designed around both blockchain-native markets and the operating schedules of traditional finance. (Quill Audits)

Market Movements

Chainalysis Adds HyperEVM Monitoring

Chainalysis announces support for HyperEVM, extending compliance and investigative tooling to Hyperliquid’s EVM-compatible environment. The integration automatically covers ERC-20 and ERC-721 assets and makes HyperEVM activity available through KYT, address screening, and Reactor. For exchanges and other regulated businesses interacting with the ecosystem, the release expands transaction monitoring and tracing without requiring individual integrations for each token. (Chainalysis)

Non-Financial Companies Need More Than a Stablecoin Wallet

Itai Turbahn argues that stablecoin adoption by mainstream companies creates requirements far beyond simply holding and transferring tokens. Enterprises need screening, asset conversion, routing, retries, reconciliation, policy enforcement, and multi-chain connectivity behind the wallet interface. The article frames wallet infrastructure as an operational abstraction layer that lets non-financial companies use blockchain rails without rebuilding treasury, payments, and compliance systems around blockchain-specific mechanics. (Fireblocks)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 249

Total amount lost in 2026: $1,303,451,456

Tectonic’s Illiquid Token Becomes a $75M Attack Vector

Rob Behnke examines the Tectonic exploit on Cronos, where an attacker drove the thinly traded TONIC token roughly 100× higher before using the inflated asset as collateral across lending markets. Approximately $75 million was borrowed, although only a fraction escaped before Cronos validators halted the network and rolled back state. The incident demonstrates how low-liquidity collateral can turn market manipulation into a protocol-wide solvency threat. (Halborn)

Notional’s Integer Cast Turns $1.73M of Debt Into Zero

Anmol explains how an unchecked uint128 conversion in Notional Finance caused debt equal to 2^128 to truncate to zero during a solvency check. The attacker fabricated fCash claims, withdrew roughly $1.73M in DAI and USDC, converted the proceeds to ETH, and routed funds through Tornado Cash. The incident highlights how seemingly simple narrowing casts can undermine an otherwise complex financial risk model. (Quill Audits)

Policy & Regulation

Russia’s Comprehensive Crypto Regime Takes Effect

Russia’s new cryptocurrency framework entered into force September 1, bringing crypto trading into a regulated structure overseen by the Bank of Russia. Trading must move through authorized intermediaries, while non-qualified retail investors face knowledge-testing requirements and annual purchase limits. The framework continues Russia’s prohibition on domestic cryptocurrency payments while creating regulated pathways for investment and certain international uses. Existing market participants have a transition period extending into 2027. (The Industry Spread)

Capital Allocation

Firelight Raises $8M to Offset DeFi Risks

Firelight closed an $8M seed led by Gumi Cryptos Capital, with Maven 11, Metalayer, Joint Effects, and Tribe Capital.

Firelight is a decentralized cover protocol that protects onchain capital against protocol, smart contract and economic risks.

The team is starting with XRP first, then bitcoin and XLM. Flare is named as a backer; staked XRP is the initial capital. The protocol and first integrations are scheduled for September. Claims would be checked onchain by GFX Labs, Hypernative, Credora, Native, and Cyfrin. CEO Anthony DeMartino previously ran Coinbase Risk Strategies; CSO Connor Sullivan came from Fireblocks. (Firelight)

Verdict Machine Launches AI-Native Security for Institutional Crypto

Y Combinator introduced Verdict Machine, an S26 startup building AI-powered cybersecurity for financial institutions managing digital assets. Founded by former Check Point blockchain-security leaders, the company maps an institution’s onchain environment, assesses cyber risk, generates tailored controls, and evaluates transactions before execution. Verdict Machine says it already has POCs with asset managers and digital-asset infrastructure providers and is being evaluated by major banks, positioning it as a new entrant in institutional onchain security. (Y Combinator)

Applied Research

A New Dataset Maps Smart-Contract CVEs to Real Code

Monika di Angelo and Gernot Salzer introduce CVE-Smart-Contracts, a curated dataset connecting hundreds of CVE records with deployed Ethereum contracts and, where available, vulnerability labels and source locations. The collection includes source code and bytecode and is intended to support reproducible evaluation of analysis and repair tools. Importantly, the dataset preserves CVE claims rather than treating every original vulnerability report as independently revalidated ground truth. (arXiv)

Blockchain Screening Without Known Bad-Address Labels

Yury Korolev presents a graph-based blockchain screening system operating across 835M addresses and 15.8B transaction edges on five EVM chains. Instead of relying solely on sanctions lists or known labels, the model scores addresses from their position in the transaction graph and transfers detection capabilities to previously unlabeled chains. Tests on Base, Arbitrum, and Gnosis show strong recall, although adversarial simulations also identify blind spots against synthesized behavior. (arXiv)

LLMs Generate Smart-Contract Vulnerabilities for Security Testing

Luca Migliaccio, Roberto Natella, Naghmeh Ivaki, Nuno Laranjeiro, and Marco Vieira explore using LLMs to automatically inject vulnerabilities into Solidity contracts, creating ground-truth datasets for evaluating security tools. Nearly 1,000 variants targeting 49 OpenSCV vulnerability classes produced 32 validated vulnerable contracts covering 25 classes. Testing three static analyzers against the dataset revealed complementary but incomplete detection coverage, suggesting LLM-generated vulnerabilities could expand security benchmarks despite significant reliability and scalability limitations. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) hacks security web3 cybersecurity policy <![CDATA[0x48 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x48-web3-security-bulletin XrJSF06HUqFWWDwGCdl6 Fri, 28 Aug 2026 11:19:05 GMT TL;DR

  • Compliance & Infrastructure: Research argues permissionless chains can meet AML requirements at the application layer, while Fireblocks details data sovereignty controls for EU institutions.

  • Vulnerabilities & Exploits: A Term Finance governance capture drained $8.5M, an expired Tornado Cash domain enabled a massive phishing campaign, and a supply-chain zero-day exposed Trezor customer data.

  • Preventative Security: New tools are moving defense upstream, with Forta introducing pre-execution screening for OP Enterprise and ChainPatrol embedding phishing detection at the registrar level.

Industry Trends & Analysis

Permissionless Blockchains Can Meet Financial-Integrity Requirements

Rebecca Rettig, Omid Malekan, and Michael Mosier argue that regulated financial institutions do not inherently need permissioned blockchains to satisfy AML, CFT, and sanctions obligations. The paper proposes placing compliance and risk-management controls at the application layer rather than attempting to control the underlying validator network. It also addresses concerns including illicit-actor exposure, transaction privacy, asset provenance, and regulatory auditability, presenting a framework for institutions seeking to use open blockchain infrastructure without abandoning financial-integrity controls. (SSRN)

What the First 24 Hours After an Exploit Should Look Like

Quantstamp lays out an incident-response checklist focused on the period when every block can increase losses. Immediate priorities include pausing affected functionality, contacting exchanges with attacker addresses, moving internal coordination away from potentially compromised channels, issuing a minimal public acknowledgment, and bringing in forensic tracing expertise. The broader message is operational: protocols need emergency authority, communications procedures, exchange contacts, and investigation capabilities established before an exploit starts. (Quantstamp)

Verifying powdr’s zkVM Acceleration

A zkVM can prove a program ran correctly without anyone re-running it, but the prover pays for every instruction. powdr finds hot stretches of code and collapses them into one smaller circuit, the way a compiler fuses a loop. If that rewrite is too loose, a rollup could accept a fake state change. If it is too tight, an honest block might fail to prove. Certora’s tool compares the circuit before and after each rewrite. On Keccak and a Reth Ethereum-client trace it proved 99.0% and 98.7% of 6,627 checks, found no real mismatches, and caught one timestamp-overflow edge case that was not exploitable. (Certora)

AI Is a Solidity Pair Programmer, Not a Security Architect

Andrei Toma argues that AI assistants can accelerate Solidity development through scaffolding, tests, documentation, and implementation support, but their output inherits the same security risks as any other generated code. The recommended model keeps developers responsible for architecture and threat modeling while subjecting AI-generated contracts to manual review, testing, and verification. For smart contracts, productivity gains do not change the underlying requirement: every generated assumption involving money or authorization still needs independent validation. (Nethermind)

Stablecoin Freeze Keys Are a Neobank Dependency Risk

Anmol notes that crypto neobanks are relying on stablecoin administrative powers they do not control, including freezing, minting, and contract upgrades. Reserve quality therefore captures only part of the risk. Teams should inventory the stablecoins underpinning customer balances and settlement, identify who controls privileged functions, and test what happens operationally if balances suddenly become non-transferable. The article reframes stablecoin administration as a concentration and business-continuity problem rather than merely a token or reserve-management issue. (quillaudits.com)

Market Movements

Forta Brings Pre-Execution Screening to OP Enterprise

Forta Firewall now has an OP Enterprise transaction-screening option, with Kraken’s Ink becoming its first adopter. The integration places security evaluation directly in the sequencer path, allowing selected modules to examine transactions before block construction for risks such as sanctioned addresses, scams, and exploits. Forta says evaluations complete in under 10 milliseconds, while applications inherit the protection without contract or SDK changes. The model shifts security controls from post-execution detection toward preventative transaction admission. (Forta)

ChainPatrol Moves Phishing Detection Upstream to Registrars

ChainPatrol Team reports that Realtime Register has embedded ChainPatrol intelligence directly into its Abuse Monitoring platform and made it available to resellers without additional cost. Early detections included a convincing fake wallet and cloned prediction-market site. More importantly, threat clustering allows registrars to identify related malicious domains and suspend infrastructure before campaigns mature, moving Web3 phishing defense upstream from individual wallets and users toward the domain-registration layer. (ChainPatrol)

Fireblocks Details EU Data Sovereignty and Customer Key Control

Ana Santillan addresses how European financial institutions should evaluate jurisdiction, signing authority, data residency, continuity, and vendor dependence in digital-asset infrastructure. Fireblocks says its EU SaaS environment operates across four European countries, while customers retain sole transaction-signing authority under both MPC and HSM deployment models. The article’s central security argument is architectural: regulatory or operational disruption affecting the service provider should not translate into unilateral provider access to customer private keys or digital assets. (Fireblocks)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 241

Total amount lost in 2026: $1,215,897,597

Phishing with an Expired Tornado Cash Domain

Wu Blockchain reports that a user followed a bookmarked link to the old official tornado[.]cash domain and landed on a phishing frontend. The domain had expired after the team did not renew it under OFAC sanctions; attackers then registered it and stole deposit credentials. 1,010 ETH left within 12 hours. The same group has allegedly taken nearly 4,000 ETH this way over the past 12 months. A same-day Wu follow-up cites on-chain analyst Specter arguing the purported victim may himself be a threat actor and that the drained funds may be illicit. (WuBlockchain on X))

Provenance Blockchain Bug

A bug existed in Provenance Blockchain (Cosmos SDK) prior to v1.28.0. AddAccess treated a caller as admin if they controlled 100% of a marker’s circulating supply, but accountControlsAllSupply compared the bank balance to the marker struct’s stored supply, which stays 0 for non-fixed markers. Any zero-balance account could therefore grant itself admin, mint, and withdrawal permissions in two transactions. The attack in two transactions: grant admin, then mint or withdraw. At discovery, 82 mainnet markers were exploitable, including escrow holding about $500,000 of nhash. (Trail of Bits)

Term Finance Governance Capture Drains $8.5M

An attacker turned roughly half an ETH into effective control of Term Finance’s sparsely participated governance, securing about 91% of voting power in the ETH Meta Vault and total control across several USDC vaults. The resulting proposals disabled the delay mechanism, installed attacker-controlled strategies, and drained roughly 2,843 WETH and 1.68M USDC. The core Yearn-based vault code was not exploited; the failure was governance design combined with near-zero participation. (rekt)

Pendle's PT-reUSD Oracle was Misconfigured and Exploited

kanveuler’s post reconstructs an Ethereum Morpho incident on the PT-reUSD-10DEC2026 / USDC and USDT markets. Wallet 0x854e…690d spent 320,000 SY-reUSD across 11 swapExactSyForYt trades in nine minutes. That moved a 900-second Pendle TWAP. The Ojo wrapper takes the lower of that TWAP and a linear maturity discount, so a depressed Pendle price became the oracle. The oracle fell 51 bps at the last buy, then 277 bps as the window rolled. Thirty-three liquidations repaid about $36.1M of debt, seized 38.6 million PT, and paid a 2.62% bonus. (Hackedmd)

Trezor Customer Data Exposed Through a Supply-Chain Zero-Day

Rob Behnke reviews the Trezor/ShipMonk breach, where approximately 14,000 customers had shipping or other personal information exposed even though Trezor hardware wallets themselves were unaffected. The compromise traced back to CVE-2026-72898, a CVSS 10.0 SQL-injection flaw in ShipMonk’s Metabase deployment that was exploited as a zero-day. The resulting data significantly strengthens phishing and impersonation opportunities against hardware-wallet owners, reinforcing the physical and social-engineering consequences of third-party data exposure. (Halborn)

Capital Allocation

Beldex Raises $8 Million for Privacy Tooling and AI

Beldex raised $8 million led by Sigma Capital, with NTC, Nxgen, Digital Consensus Fund, and EAK Ventures. The privacy-focused blockchain company plans to invest in confidential applications, encrypted AI-agent identities, developer tooling, protocol security, zero-knowledge systems, quantum-safe cryptography, secure memory for agent payments and BNS identities. (Beldex)

Applied Research

Bitcoin, Ethereum and Solana Face Different Post-Quantum Migration Problems

Aleksei Kodukhov reviews how cryptographically relevant quantum computers could threaten major blockchain systems relying on elliptic-curve signatures. The paper distinguishes at-rest, on-spend, and on-setup attack models and examines the particular exposure of Bitcoin, Ethereum, and Solana. It then surveys migration options, including NIST-standardized post-quantum signatures and ecosystem-specific approaches under development. The research frames quantum preparedness less as a single cryptographic upgrade than as a migration problem involving exposed keys, transaction models, compatibility, and economic risk. (arXiv)

Blockchain and Zero Knowledge Add Verifiable Trust to RAG

Baixiang Liu, Haotian Che, and Yuan Li propose TrustRAG, a blockchain-backed architecture intended to prevent tampering with documents and credibility scores used by retrieval-augmented AI systems. Expert committees evaluate content through a zero-knowledge protocol, while secure multiparty computation combines private assessments into verifiable trust scores. Hash commitments distributed across chains create an auditable record, allowing clients to detect altered or removed content and independently reproduce rankings. The work applies blockchain security primitives to AI data provenance rather than cryptocurrency itself. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) security web3 cybersecurity hacks research <![CDATA[0x47 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x47-web3-security-bulletin M1gChlb3eGczuNtWFcG2 Sat, 22 Aug 2026 16:27:09 GMT TL;DR

  • Chainalysis draws a hard line between deterministic wallet clustering and predictive ML signals, a useful reminder that attribution claims need to be reproducible and auditable.

  • AI-assisted audit work is improving fastest when protocol-specific context and expert triage stay in the loop, as Nethermind’s Lido Evergreen pilot showed.

  • This week’s operational theme is latency: RWA freeze controls, TradFi Hyperliquid approval workflows, and Harmony’s rollback all point to governance models that must act faster than manual review cycles.

  • Researchers investigating Telegram's new Mini Apps found a particularly serious issue in Telegram’s official Wallet, where exposure of a recovery mnemonic could potentially lead to complete wallet compromise. After responsible disclosure, Telegram introduced two secure-storage APIs, and subsequent testing confirmed that the official wallet no longer stored its mnemonic phrase in plaintext.

Industry Trends & Analysis

Don't Cluster Wallets with a Predictive Model

Wallet segments are Tier 1 intelligence claims that must be deterministic, reproducible, and auditable. Predictive models fail that bar even when they are accurate, because the rules are learned from training data and can shift when the data does. Chainalysis keeps machine learning for Tier 2 work, lead generation, anomaly detection, and Alterya scam scoring, and treats those outputs as signals that still need a human check. Backing up this process, they point to the 2024 Daubert ruling in United States v. Sterlingov, which tested heuristic clustering, not model output as fact. (Chainalysis)

Protocol Context Makes AI Auditing More Useful

The four-week Lido Evergreen initiative covered roughly 19,000 lines of already-audited core code using AuditAgent, AgentArena, protocol-specific documentation, and human researchers. Adding Lido-specific context raised AgentArena coverage from 67% to 83% and 44% to 78% across two test clusters. The strongest overall coverage came from combining AI agents with expert researchers, reinforcing that specialized context and human triage remain important even as autonomous security tooling improves. (Nethermind)

RWA Freeze Policies Need to Move in Seconds

Forta argues that programmable real-world assets need pre-authorized incident controls rather than purely manual freeze decisions. During the Gravity Bridge exploit, stolen PAXG remained in the attacker’s publicly visible wallet for 27 minutes before being converted to WETH despite being technically freezable. Forta proposes narrowly defined automatic triggers, temporary 72-hour freezes, transparent appeal procedures, and sub-minute execution, moving human review from the initial emergency response to determining whether the intervention should remain in force. (Forta)

Three Bugs Found Outside CompCert’s Proof Boundary

Cantina reports that its Apex system reproduced three defects around the formally verified CompCert compiler: Win64 register-state corruption, an incorrect C front-end struct layout, and assembly injection through a crafted filename. The findings do not invalidate CompCert’s core correctness theorem; instead, they occurred in parsing, target modeling, or output layers outside the proof boundary. The research illustrates an important limitation of formal verification: verified components remain dependent on surrounding code and assumptions that may themselves be vulnerable. (Cantina)

Market Movements

Human Sign-off Cannot Keep Up with Sub-second Hyperliquid Blocks

Fireblocks recommends defining venue, asset, position-size, transfer, and destination policies before trading begins so compliant transactions can execute automatically within those boundaries. The model moves humans from approving individual time-sensitive actions to establishing policy beforehand, preserving governance without allowing approval latency to create liquidation exposure. (Fireblocks)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 232

Total amount lost in 2026: $1,198,033,060

Aeternum Parks its C2 on Polygon Contracts

Aeternum, a C++ Windows botnet loader, reads command-and-control data from Polygon smart contracts instead of attacker-owned servers. Infected hosts send JSON-RPC eth_calls to public RPC endpoints. The campaign fingerprint is function selector 0xb68d1809 (getDomain()), which returns an XOR key and a Base64-encrypted domain.

Operators rotate that value with admin-only updateDomain (0xb249cd2d). Samples drop XWorm, XMRig, and stealers, then exfiltrate over Telegram. (Palo Alto Networks)

Harmony Will Rewind to Aug 11 and Drop Over 100k Transactions

Harmony has decided to rollback the chain after last week’s forged ONE mint. Validators are to restore shard 0 block 92,730,034 and shard 1 block 94,978,278 (both 23:25:37 UTC on August 11) and restart from replacement databases.

Client v2026.1.2 rejects the exploit block hashes. The discarded shard-0 window is 141,628 blocks, 109,126 regular transactions, and 315 staking transactions. Harmony said selective replay was unsafe: balances, nonces, and contract state would not match. (Cointelegraph)

Policy & Regulation

SEC Proposes Regulation Crypto Assets

The SEC issued proposed rule S7-2026-27, its first crypto-specific offering regime. Two exemptions from Securities Act registration: a startup path of up to $5 million over four years, and a fundraising path of up to $75 million in any 12-month period. Issuers still file principles-based disclosures and remain under antifraud rules. A conditional safe harbor would treat the investment contract as ended once promised managerial efforts have ceased, so the token would no longer sit under that Howey wrapper. Subpart E would preempt state registration for qualifying purchasers. Comments run 60 days after Federal Register publication. (SEC)

FASB: When a Stablecoin Can Sit in Cash Equivalents

On August 18 the Financial Accounting Standards Board proposed an Accounting Standards Update that leaves the cash-equivalent definition unchanged and adds examples. A qualifying token needs an on-demand contractual right to redeem directly with the issuer for a known cash amount, plus at least one-to-one segregated reserves in short-term, highly liquid assets. An active secondary market is not enough if the holder cannot redeem with the issuer. Reserves of crypto and gold fail the example. Entities may still choose not to present a qualifying token as cash. Comments close November 19. (FASB)

Austria Fines Bitpanda for MiCA Violations

Austria's Financial Market Authority fined Bitpanda GmbH €70,000 for violations of the EU's Markets in Crypto-Assets Regulation. The regulator found that Bitpanda failed to submit a required crypto-asset whitepaper at least 20 working days before publication and distributed marketing materials before the whitepaper was published. The communications also omitted required MiCA disclosures and contact information. The sanction is legally binding, making it a notable example of MiCA moving from implementation into active enforcement. (FMA Osterreich)

Applied Research

0xPass Splits Cross-Chain Account Trust Across Layers

Bernardo David, Keon Kim, and Krish Chelikavada propose 0xPass, a modular architecture for cross-chain accounts that separates request orchestration, transaction solving, and signing. Threshold signatures prevent any single transaction node from possessing the complete signing key, while constrained delegation, policy enforcement, recovery, distributed key generation, and auditable communications provide additional controls. A staged deployment model is designed to move implementations progressively from centralized operation toward more permissionless infrastructure without discarding authorization safeguards. (arXiv)

Telegram Mini Apps Expose Crypto Wallet Secrets

Andrea Ciccotelli, Federico Zappone, and Roberto Di Pietro analyze security weaknesses in Telegram Mini Apps handling cryptocurrency assets. Of 37 applications examined, 30 contained vulnerabilities involving plaintext secrets, recoverable encryption, or replayable tokens. Telegram’s official wallet initially exposed its recovery mnemonic in plaintext, potentially enabling account compromise. Following responsible disclosure, Telegram introduced secure-storage APIs, and the researchers confirmed that the official Wallet no longer exposed the mnemonic. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity regulations hacks <![CDATA[0x46 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x46-web3-security-bulletin xpNkUWRFp6OsnbkRWkM7 Fri, 14 Aug 2026 14:18:23 GMT TL;DR

  • AI is flooding bug bounty programs with more reports, but Coinbase’s Stellar fee-bump case shows high-context human research still catches the hard protocol edge cases.

  • Physical attacks on crypto holders are now a material self-custody risk, with 2026 losses already above $30M and home invasions making up a large share of reported incidents.

  • Regulated stablecoin issuers are moving beyond point-in-time audits toward continuous monitoring for supply changes, privileged actions, upgrades, sanctions exposure, and incident response.

  • FATF is making clear that “decentralized” is not a magic word; control, influence, admin power, governance concentration, and economic benefit remain the real tests.

  • Sanctions and fraud enforcement remain active, with OFAC-linked exchange activity and the alleged Goliath Ventures Ponzi showing how crypto rails still intersect with old-school financial crime.

  • Research is pushing toward safer autonomous on-chain agents and better ways to measure decentralization, both of which matter as protocols become more agent-driven and claims of resilience get harder to verify.

Industry Trends & Analysis

AI Floods the Bug Bounty Queue but Humans Still Find the Hard Bugs

Coinbase’s Consumer Protection Tuesday post says bug reports are on track to triple year over year after doubling the year before, while valid reports fell from 14% in 2024 to 4% this year. The firm is pushing AI through its own vuln pipelines for commodity issues and refocusing the public bounty on high-ingenuity finds. Case in point: Talaria’s Joe Almeida and Anh Nguyen reported a Stellar fee-bump reconciliation flaw—under some conditions a wrapped withdrawal could look failed internally after it had already succeeded onchain, risking a double-count. No customer funds were hit. AI missed that edge case but flagged a milder related deposit bug. (Coinbase)

Physical Crypto Attacks Exceed $30M in 2026

Violent attacks against cryptocurrency holders have already stolen more than $30M in 2026, following a record $58M in 2025. Home invasions now represent 37% of reported incidents, while on-chain tracing reveals attackers ranging from opportunistic criminals using centralized exchanges to more sophisticated groups employing laundering infrastructure. The findings reinforce physical security and operational privacy as increasingly important components of self-custody risk. (Chainalysis)

Market Movements

Hacken Adds Continuous Monitoring to AllUnity’s EURAU Stablecoin

Hacken describes AllUnity’s integration of its Extractor monitoring platform into the regulated EURAU stablecoin infrastructure. The system monitors token supply, privileged governance actions, contract upgrades, large transfers, sanctions exposure, and cross-contract attacks while supporting automated mitigation. The deployment illustrates how regulated stablecoin issuers are extending security beyond audits toward continuous on-chain monitoring and incident-response controls. (Hacken)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 227

Total amount lost in 2026: $1,194,196,610

Coinsbuy Wallets Drained $7.9M+

More than $7.9M was drained from wallets associated with B2B crypto payment processor Coinsbuy across Ethereum and TRON. Some of the stolen assets were converted toward Monero through exchanges, while ChangeNOW reportedly helped freeze a six-figure amount. Coinsbuy temporarily suspended deposits and withdrawals before restoring service.

Harmony Mints 4B ONE

Harmony confirmed an exploit after analyst Juiceberg flagged roughly 4B unauthorized ONE minted, which is about 26% of supply, via empty blocks. Juiceberg said ~2.8B reached exchanges and ~97% of the mint was already on exchanges or sold; ONE fell ~37% to about $0.00077.

Harmony paused its bridge, shipped a patch to stop further minting, and asked exchanges to freeze four named wallets, but has not confirmed the mint size or root cause. Decrypt notes a rollback would undo the attack and every legitimate transaction after it. (Decrypt)

Policy & Regulation

FATF: “Decentralised” is a Claim to Test

FATF’s July 2026 Targeted Report on Regulatory Challenges from DeFi clarifies that Recommendation 15 still applies where a natural or legal person has “control or sufficient influence.”

FATF Recommendation 15 is the “New Technologies” standard. In short: countries and firms must identify, assess, and mitigate ML/TF risks from new products, practices, and tech—including crypto.

Since 2018–2019 updates, it is the main FATF rule that pulls virtual assets (VAs) and virtual asset service providers (VASPs) into the AML/CFT framework. It requires that VASPs be:

  • licensed or registered

  • supervised for AML/CFT

  • held to the same core obligations as traditional financial institutions (CDD, record-keeping, suspicious transaction reporting, sanctions screening, and—via the Interpretive Note—the Travel Rule under Rec 16)

That is why the DeFi report keeps citing R.15: if someone has “control or sufficient influence” over a DeFi arrangement and does VASP-like activity, that person is in scope under Recommendation 15—not because DeFi got its own new rule.

Three buckets: identifiable controllers; centralized in practice but hard to name; and truly decentralised. The Standards cover the first two; smart contracts themselves are not VASPs. Centralised elements “frequently persist” via governance-token concentration, admin privileges, upgrades, economic benefits, and infrastructure influence. (FATF)

OFAC Targets Crypto Exchanges Linked to Iran’s Regime

OFAC issued sanctions against Shelbit, its operator Siavash Kayvanpour, associated businesses, and Iranian exchange Aban Tether. Elliptic identified tens of millions of dollars flowing between Shelbit and Iranian entities, including approximately $71.8M connected to Central Bank of Iran funds, as well as direct transfers involving IRGC-attributed addresses. The findings illustrate how blockchain intelligence can identify sanctions exposure beyond wallet addresses explicitly published by regulators. (Elliptic)

SEC and CFTC Target Alleged $400M Crypto Ponzi

The CFTC and SEC filed parallel civil actions against Goliath Ventures and CEO Christopher Delgado, alleging hundreds of millions were raised for purported crypto liquidity-pool and trading strategies but instead used for Ponzi payments and personal spending. The CFTC says roughly 1,600 customers contributed at least $397M, while the SEC alleges more than $425M was raised from over 1,300 investors. (CFTC)

Legislative Watch

Democrats Warn SEC and CFTC May “Jump around Congress”

Politico reported that with the CLARITY Act stalled before recess, SEC Chair Paul Atkins and CFTC Chair Michael Selig are positioned to drive crypto policy from the agencies. Democrats, including critics who say the regulators are too industry-friendly, frame the coming rule slate as an end-run around months of legislative bargaining. The SEC’s August 14 meeting is set to vote on proposing “Regulation Crypto,” a tailored offering regime for certain crypto investment contracts; broader agendas include transfer-agent rules and a rethink of 2005 stock-trading rules. With no Democratic commissioners at either agency, new proposals can move faster, but that also sharpens Capitol Hill scrutiny, including Democratic demands for more balanced commission panels tied to CLARITY talks. (Politico)

Applied Research

ChainClaw Adds Safety Guardrails for Autonomous On-Chain Agents

Researchers introduce ChainClaw, a blockchain-native agent framework built on OpenClaw. It adds transaction simulation, policy checks, live chain-state monitoring, event-driven execution, and guarded signing to reduce risks from irreversible autonomous transactions. Testing across transfers, approvals, swaps, and malicious transaction scenarios showed stronger safety and task completion than general-purpose agent frameworks including ReAct, LangChain, and OpenClaw. (arXiv)

Researchers Propose New Metrics for Measuring Decentralization

Jakub Kacper Szeląg, Aydin Abadi, and Mohammad Naseri argue that blockchain research lacks a sufficiently rigorous, portable definition of decentralization. Their graph-based ontology separates decentralization from simple distribution of infrastructure or trust and introduces two quantitative measures, Void Tolerance and Imperviousness. Applying the framework to blockchain and other distributed architectures produces more consistent comparisons than existing definitions, potentially giving protocol-security researchers better tools for evaluating concentration and resilience claims. (arXiv)



]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 hacks regulations security cybersecurity <![CDATA[0x45 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x45-web3-security-bulletin Qf1X2UZc1ezBalBR7LIg Sat, 08 Aug 2026 11:15:04 GMT TL;DR

  • Crypto’s attack surface keeps moving outside audited code: privileged access, signers, weak seed generation, developer tooling, and operational controls are doing as much damage as smart-contract bugs.

  • The COLDCARD weak-seed incident is now the week’s defining custody story, with roughly 1,816 BTC tied to predictable seed generation.

  • Market infrastructure is consolidating around investigation, authorization, and policy layers: Chainalysis inks a deal with Penlink, Magic moves to becoming Newton Labs, and onchain transaction approval moving closer to real-time risk control.

  • Regulators are tightening the perimeter globally, with Russia, South Africa, the CFTC, and the SEC, all pointing toward more explicit rules for custody, trading, collateral, vaults, and cross-border flows.

  • Applied research is highly relevant this week: wallet recovery, agent transaction safety, and decentralized attestation all map directly to the same operational security failures showing up in incidents.

Industry Trends & Analysis

Crypto’s Biggest Attack Surface Is Outside the Code

Rekt argues that some of 2026’s largest crypto losses have bypassed audited smart contracts entirely by targeting privileged access, signers, credentials, and human trust. Drift and KelpDAO illustrate how compromised operators and sustained social engineering can defeat systems whose core contracts remain intact. The analysis positions audits as necessary but incomplete, calling for stronger key management, multi-party authorization, withdrawal delays, and operational security around the people and infrastructure controlling transactions. (Rekt)

Market Movements

Penlink Pulls Chainalysis Data into its Investigation Suite

Chainalysis announced a partnership with Penlink. The company builds an AI-powered digital intelligence platform for law enforcement, government, and enterprise investigators. It combines digital evidence, open-source intelligence, live communications monitoring, and data analytics in one workflow so teams can collect, analyze, and act on investigative data in real time. Investigators can submit wallet addresses inside Penlink, get entity attribution and risk context from Chainalysis, enrich against OSINT and dark-web hits, then open Reactor in one click when they need deeper onchain tracing. (Chainalysis)

Magic Labs Becomes Newton Labs

Sean Li says Magic Labs has sold its embedded-wallet business to Kraken parent Payward and is becoming Newton Labs, concentrating exclusively on Newton Protocol. From August 1, Payward began servicing Magic’s wallet customers, while Newton Labs shifted toward an authorization layer that evaluates compliance, security, identity, and risk policies before onchain transactions settle. The deal separates a wallet infrastructure business that powered more than 60 million wallets from a newly focused Web3 transaction-security and policy company. (LinkedIn)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 221

Total amount lost in 2026: $1,182,730,626

Weak COLDCARD Seeds Lead to ~$116M in Losses

From July 30, attackers brute-forced predictable Coldcard-generated seeds and swept single-signature wallets across the Bitcoin network. TRM’s August 5 write-up cites Galaxy Research’s running tally at about 1,816 BTC (~$116M) across more than 5,200 addresses in at least four waves. The first sweep moved ~594 BTC from ~500 wallets in about 25 minutes.

CoinDesk and Protos covered the same timeline as The Block's analysis. TRM sees little laundering so far, one Wasabi deposit and a Tornado Cash hop, and has not named an actor. (TRM)

XCSSET Turns Compromised Xcode Projects Into a Crypto Threat

Bill Toulas reports that XCSSET v40 is spreading through compromised Git repositories and Xcode projects, infecting developers when malicious projects are built and then propagating into additional source code. Its 17 modules include credential theft, keylogging, browser hijacking, and data exfiltration. A new Chrome hijacker can intercept cookies, credentials, and MetaMask transactions and manipulate payments in real time, combining developer supply-chain compromise with cryptocurrency theft. (BleepingComputer)

Policy & Regulation

Russia Signs Comprehensive Crypto Market Law

Russia enacted its first comprehensive framework governing cryptocurrency trading, custody, mining and digital-asset intermediaries. Exchanges will ultimately require registration and minimum capital, while non-qualified investors face annual purchase limits and suitability testing. Domestic crypto payments remain prohibited, but the legislation permits specified uses including foreign-trade settlements. Banks must also block transfers suspected of involving unauthorized crypto exchanges. The law’s core provisions take effect September 1, 2026. (TASS)

CFTC Signals Push for Stablecoin Collateral and Perpetual Futures

Michael S. Selig says the CFTC is exploring how regulated stablecoins can be used as collateral while expanding its approach to perpetual futures and round-the-clock markets. The chairman highlighted the agency’s approval of a bitcoin perpetual futures contract and argued that U.S. derivatives regulation should evolve alongside increasingly automated, digital markets rather than wait for international consensus. (Commodity Futures Trading Commission)

SEC Examines Regulatory Pathways for Onchain Vaults

SEC Crypto Task Force Staff met with Birch Hill Holdings and legal counsel to discuss how onchain vault structures intersect with federal securities laws. The discussion covered registration and exemption pathways, investment-adviser treatment for actively managed vaults, qualified-custodian requirements and tokenized credit infrastructure. The meeting did not produce new rules, but provides another indication of how the SEC is working through practical regulatory treatment of institutional DeFi structures. (SEC)

South Africa Proposes Cross-Border Crypto Controls

South Africa’s National Treasury and South African Reserve Bank published a draft Crypto Assets Manual establishing proposed requirements for cross-border crypto transactions. Transfers between domestic and offshore CASPs, or from domestic CASPs to non-custodial wallets, would trigger FinSurv reporting. The framework also addresses CASP authorization, transaction permissions and administrative responsibilities, with the government aiming to reduce regulatory arbitrage and improve detection of illicit financial flows. Comments close September 30. (South African Reserve Bank)

Legislative Watch

Senate Punts Clarity Vote into September

Majority Leader John Thune confirmed late on August 6 that the Senate will not take up the Clarity Act before August recess. Supporters had wanted an initial vote this week; Thune may still file cloture to queue the bill, but floor action is now expected when the chamber returns in September. Democrats refused a time agreement that would have cleared a path to a vote, citing unfinished talks on Trump-family crypto ethics language, law-enforcement concerns, and the Agriculture Committee commodities title. (POLITICO)

Applied Research

Zero-Knowledge Recovery for Compromised Bitcoin and Ethereum Wallets

Mehmet Sabir Kiraz and Suleyman Kardas introduce Z-SCAPE, a recovery protocol for self-custodial wallets whose seed-generation entropy has been compromised. Users establish an independent recovery credential before an incident and later prove ownership in zero knowledge without revealing personal records, recovery secrets, or compromised private keys. The design prevents replay and destination-substitution attacks and includes integration mechanisms for both Bitcoin and Ethereum. (IACR Eprint Archive)

Safety Invariants for Agents Moving Assets Onchain

Zhaoming Yin proposes seven safety invariants for autonomous agents executing irreversible blockchain transactions. The framework targets failures including incorrect chain or address selection, ambiguous transaction outcomes, retries, and duplicated execution, guaranteeing that ledger effects either do not occur or match the rendered transaction exactly once. Testing covered 60 adversarial scenarios, while the deployed system recorded 108 production operations across eight chains. (arXiv)

Blockchain Coordinates Continuous Attestation for AI Agents

Adam Zahir, Vincent Lefebvre, Mark Angoustures, Milan Groshev, and Carlos J. Bernardos present D-MUTRA, a decentralized remote-attestation framework for multi-agent systems. Agents continuously measure their runtime integrity and verify peers while a smart contract coordinates and records the process. A proof of concept using private Ethereum/Hyperledger Besu with ROS/Gazebo robots detected malicious software modifications with low application overhead, providing a software-based alternative to centralized attestation infrastructure. (arXiv)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) regulations hacks web3 security cybersecurity <![CDATA[0x44 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x44-web3-security-bulletin y1n8pw36W4ylaDxalhoO Fri, 31 Jul 2026 13:51:45 GMT TL;DR

  • Digital-asset security is becoming a continuous governance problem: Fireblocks, Elliptic, and Chainalysis all point towards requiring systems that can prove controls, permissions, and compliance effectiveness in real time, not just during audits or supervisory reviews.

  • Protocol security still fails at the application boundary. Uniswap v4 hooks, bridge withdrawals, DAO governance, and state-invariant transaction spam all show the same pattern: the base layer may behave correctly while custom logic, assumptions, incentives, or validation gaps create the actual exposure.

  • The incident picture stayed heavy: AFX Trade lost roughly $24.15M after hot-validator signatures cleared its Arbitrum custody bridge, VerusCoin’s bridge verified withdrawals without economic backing, and Triple-A contained unauthorized access to company treasury wallets while keeping client funds isolated.

  • Wallet and custody risk is not just private-key theft. Coinkite’s COLDCARD RNG advisory shows why seed-generation provenance matters, while Ledger’s agent stack and Fireblocks’ operating model point toward policy-controlled workflows where humans, agents, and infrastructure each have constrained authority.

  • Security tooling is moving from detection to resolution. Cantina’s Clarion launch, CyberScope’s audit-prep guidance, TAC InfoSec’s Safehouse deal, and V12’s AI-assisted vulnerability research all reinforce that finding issues is no longer enough; teams need faster prioritization, remediation, and verification.

  • The longer-term risk horizon is getting real: quantum migration gaps, privacy-chain compliance models, and AI-discovered vulnerabilities are shifting Web3 security from isolated exploit response toward infrastructure resilience, governance design, and programmatic proof that controls work under stress.

Industry Trends & Analysis

Digital-Asset Scale Requires Continuous Governance

Fireblocks argues that operational risk shifts from key custody to configuration drift as digital-asset businesses grow. The recommended model combines continuous policy and permission monitoring, audit-ready reconciliation, embedded wallet abstractions, and policy-controlled batching, swaps, staking, and DeFi access. Security and audit evidence should emerge from routine operations rather than manual preparation before reviews. (Fireblocks)

Seven Ways Uniswap v4 Hooks Fail

Nicolas Donboly identifies seven recurring security failures in Uniswap v4 hooks, including unrestricted callbacks, malicious pool selection, broken internal accounting, mismatched address permissions, and unsafe shared state. The analysis stresses that PoolManager settlement guarantees do not validate application-specific assumptions, leaving hook developers responsible for authorization, accounting, integrations, and failure handling. (Trail of Bits)

US Crypto Oversight Shifts Toward Outcomes

Peter Phelan notes that US digital-asset regulation is moving beyond procedural checklists toward demonstrable effectiveness, continuous monitoring, and coordinated supervision. He points to the passage of stablecoin legislation and updated model-risk guidance as evidence that institutions will increasingly need to prove their compliance systems work in practice, particularly when AI and on-chain data influence risk decisions. (Elliptic)

Prepare the Code Before the Audit

CyberScope recommends freezing the codebase, documenting intended behavior, expanding test coverage, running static analysis, and removing dead or confusing code before an audit begins. These steps reduce time spent reverse-engineering project intent and allow paid reviewers to concentrate on complex vulnerabilities that automated tools and routine testing are less likely to detect. (CyberScope)

Privacy Chains Require Different Compliance Models

Chainalysis Team divides blockchain privacy into four models: permissioned transaction sharing, shielded pools, encrypted extensions, and private smart-contract execution. Each exposes different information and requires different monitoring arrangements. The analysis concludes that compliance teams cannot apply one universal privacy-chain methodology across networks such as Canton, Zcash, Solana, and Aztec. (Chainalysis)

FYI: DeFi Security Summit 2026

Market Movements

Cantina Moves From Detection to Resolution

Cantina says security programs increasingly fail after vulnerabilities are discovered, as remediation queues and handoffs give attackers time to act. Its newly launched Clarion platform is designed to prioritize findings, coordinate remediation, and verify fixes using agentic workflows. The company also announced new funding that brings its total raised to $16.5M. (Cantina)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 213

Total amount lost in 2026: $1,086,629,393

AFX Trade Loses $24.15M

On July 22 Blockaid flagged a drain of about 24.15M USDC from AFX Trade’s own Arbitrum custody bridge. Rekt reports five hot-validator signatures met the roughly two-thirds quorum; the contract released funds after a 200-second dispute window with no challenge. Arbitrum’s native bridge was unaffected. Stolen USDC moved via CCTP to Ethereum, filled through UniswapX into ~12,467 ETH, then fragmented. AFX offered a 30% bounty for a 70% return. Rekt notes Zellic had audited the bridge about 49 days earlier; zeroShadow and SEAL later said the pattern may link to UNC4899 / TraderTraitor. (Rekt)

VerusCoin’s Bridge Verified an Unfunded Withdrawal

A Rekt investigation finds that VerusCoin’s Ethereum bridge lost $7.54M after accepting valid signatures and proofs for withdrawals that lacked economic backing. The exploit used a different implementation gap from the bridge’s $11.6M May incident, but crossed the same trust boundary: authenticity was proven without confirming that the underlying assets existed. (Rekt)

Triple-A: Unauthorized Access Hit Company Treasury

On July 27 Triple-A said it found unauthorized access on July 25 to wallets holding its own digital assets at Triple A Technologies Pte. Ltd. The incident was contained; services ran normally after about three hours in maintenance. Client funds were not affected, Triple-A does not custody client crypto; client money sits in separate trust accounts with safeguarding institutions that were not exposed. Impact is limited to operational treasury accounts and is being absorbed from reserves. The firm is working with cybersecurity and blockchain forensics specialists and Singapore authorities. (Triple-A)

Coinkite Warns COLDCARD Seeds May Have Weak Device RNG

Coinkite’s advisory says seeds generated on Mk3 firmware 4.0.1 (March 2021) or later may put funds at risk; Mk4, Mk5, and Q seeds made before fixed firmware had about 72 bits of entropy instead of the expected 128. Fixed builds are out: Mk4/Mk5 need 5.6.0+, Q needs 1.5.0Q+; a firmware update does not repair an existing seed.

Users who added ≥50 private dice rolls when creating the seed are not considered at risk from this RNG bug alone. TAPSIGNER, OPENDIME, and SATSCARD are unaffected. Coinkite tells affected holders to migrate carefully to a new seed on patched hardware (or interim BIP-39 passphrase / dice-only paths on Mk3). (Coinkite)

Policy & Regulation

Will the Clarity Act be Signed Before the August Recess?

Senate leaders have not yet filed cloture on the Clarity text before the August 8 recess. On July 28 SEC Chair Paul Atkins said the agency is giving Congress technical assistance and told CNBC it is “ready, willing and able” to address covered issues under existing authority if legislation fails.

He still prefers statute; agency rules alone cannot grant the CFTC nationwide digital-commodity spot authority. (Crypto News)

MiCA Staff Competence Rules Take Effect

European Securities and Markets Authority’s MiCA knowledge-and-competence guidelines became applicable on July 28. Crypto-asset service providers must assess and document the qualifications of employees who inform or advise clients, maintain ongoing training programs, and apply higher competence standards to advisory personnel. The change makes employee capability and professional development an auditable supervisory requirement for regulated crypto firms across the EU. (ESMA)

Canada Proposes Crypto Platform Fee Model

CIRO opened consultation on a dedicated regulatory fee model for crypto trading platforms on July 30. The proposal would create a more explicit framework for allocating the costs of supervising registered platforms, adding a new operational consideration for crypto businesses entering or remaining in Canada’s regulated investment market. (Ontario Securities Commission)

Capital Allocation

TAC InfoSec Signs Safehouse Acquisition Deal

TAC InfoSec, whose CyberScope subsidiary provides Web3 security and smart-contract auditing, signed a binding term sheet to acquire 100% of Israel-based Safehouse Technologies. The proposed transaction would expand TAC from enterprise and Web3 security into consumer cybersecurity. The deal remains subject to due diligence, regulatory requirements, and definitive agreements, with completion targeted within three months. (TAC Security Release)

V12 Announces $10M Seed

V12 closed a $10M seed led by Electric Capital, with ZachXBT, samczsun, Walden Yan, and others. Earlier this month its agent autonomously found a major-blockchain bug putting more than $100M at risk and took a $2.5M bounty, the largest the team says an AI agent has received. The post frames V12 as a white-box vulnerability research tool, not black-box pen-testing. (V12 on X)

Applied Research

DAO Attacks Without Smart-Contract Bugs

Vabuk Pahari and colleagues analyze governance contracts across 48 active Ethereum DAOs and identify “governance attacks” that exploit mechanism design rather than implementation vulnerabilities. The study examines how voting systems, veto powers, execution paths, and off-chain dependencies balance decentralization against security, fairness, privacy, and operational flexibility. (arXiv)

Blockchain Spam That Changes Nothing

Vabuk Pahari, Johnnatan Messias, and Christof Ferreira Torres identify nearly 1.4 billion state-invariant transactions across Ethereum, Optimism, and Base, transactions that consume network resources without changing ledger state beyond fees. The study associates much of the activity on Layer 2 networks with speculative MEV and finds that address poisoning represents a substantial portion of Ethereum’s non-reverted state-invariant traffic. (arXiv)

Digital Assets Face a Quantum Migration Gap

Lee Reiners argues that regulated finance is adopting quantum-vulnerable blockchain infrastructure faster than policymakers are establishing migration requirements. The paper frames exposed keys protecting Bitcoin, Ethereum, stablecoins, custody systems, bridges, and tokenized assets as a potential financial-stability risk, and proposes a federal quantum-resilience perimeter for institutions interacting with digital assets. (SSRN)



]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity regulations hacks <![CDATA[0x43 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x43-web3-security-bulletin IliJaXym1wST205WQCwV Fri, 24 Jul 2026 07:59:29 GMT TL;DR

  • Coinbase is treating post-quantum migration as a long-lead infrastructure program: PQ-CoreKMS, Stanford Bitcoin workshops, and the Bitcoin Security Consortium all point to years of engineering before the risk becomes urgent.

  • Herd Labs shows where DeFi risk tooling is headed: live asset-liability graphs that map token contagion across reserves, wrappers, lending markets, and off-chain exposure.

  • The incident picture stayed ugly: Allbridge lost roughly $1.65M to Solana pool manipulation, while Ostium reopened after a 23.8M USDC vault drain tied to a malicious price update.

  • Policy momentum continued with updated CLARITY Act text adding ethics constraints for officials issuing tokens, while Japan and Russia moved their own crypto market-structure rules forward.

  • Cyclops’ $20M Series A is another signal that stablecoin payments are moving from crypto-native tooling into financial infrastructure: the company is selling a single API for settlement, payins, payouts, and treasury.

  • In research: KASS (Knowledge-Augmented Attack Synthesis and Simulation) generated working smart-contract exploits for 94.23% of tested contracts, while new x402 research warns that facilitator validation bugs could become shared infrastructure risk across many paid APIs and agent workflows.

Industry Trends & Analysis

Coinbase Outlines PQ-CoreKMS, Bitcoin Workshops, and a Security Consortium

Coinbase's Independent Advisory Board on Quantum Computing and Blockchain is driving three workstreams. CoreKMS, which protects about 99.9% of custodied assets via MPC, gets a post-quantum track: PQ-CoreKMS aims for an automated signing pipeline within a year (enclaves, secret-sharing, threshold crypto for any PQ signature scheme), then full lattice MPC over two to three years, plus a company-wide crypto inventory and migration triggers.

Separately, Coinbase will co-host Bitcoin post-quantum sessions with Stanford starting in August, and as a founding member of the Bitcoin Security Consortium with BlackRock, Fidelity Digital Assets, Block, and others is donating and assigning engineers to open-source work such as BIP-360. (Coinbase)

Market Movements

Herd Labs Maps Token Contagion with Live Balance Sheet Graphs

Andrew Hong at Herd Labs argues one-time token reviews no longer work: vaults can touch 300+ contracts, and the first five months of 2026 saw nearly a billion dollars in related losses (Resolv USR mint, Stream Finance multisig, KelpDAO rsETH bridge). Herd recursively expands each reserve and downstream wrapper into an asset–liability graph, assets are backing positions, liabilities are issued supply plus where that supply sits in Morpho, Pendle, Silo, Euler, and similar.

For example, on InfiniFi’s iUSD, the graph shows ~43% of reserves in off-chain Fasanara Capital and ~52% of supply redeployed as siUSD, so an asset freeze turns into redemption pressure across those venues. AI agents are enabled to keep the graphs live. Herd also builds function-permission maps (for example who can mint USDC) and is beta-testing custom risk models with design partners. (Herd Labs)

Ledger Tests Agent Stack for Human-Confirmed Crypto Workflows

Ledger’s Agent Stack for AI-assisted crypto workflows: Device Management Kit Skills, Ledger Wallet CLI, Ledger Enterprise CLI, and Enterprise Multisig CLI, tested with more than 1,000 agents. Agents can read balances and history and draft actions inside Claude Code, Codex, Cursor, and similar tools, but the user must confirm on the Ledger device before a signature. Ledger lists prompt injection, autonomous execution, and agents with live resource access as the risks it is designing around; the 2026 roadmap adds agent identity, intents and policies, then proof of humanity. (nft evening)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 203

Total amount lost in 2026: $1,057,046,008

Flash Loan Skews Allbridge Liquidity Pools

Cross-chain bridge Allbridge Core was hit on July 19–20 when an attacker deployed a $1.12M USDC flash loan from Kamino to manipulate Solana USDC/USDT pool ratios. The maneuver drained approximately $1.65M before the team paused the protocol. Allbridge is now urging liquidity providers to withdraw and appealing to arbitrageurs to return profits for compensation. (decrypt)

Ostium to Reopen Trading Following the Vault Drain

Ostium reopened trading Thursday July 23 after the vault exploit that removed nearly 23.8M USDC. Open positions and pending orders carry over and mark to the live price at reopen; take-profit, stop-loss, and limit orders already through their levels execute at 10:00 a.m. ET.

New OLP deposits stay paused. Ostium said Mandiant, zeroShadow, Collisionless, and SEAL 911 are on the investigation, alongside exchanges, bridges, and stablecoin issuers. (The Defiant)

Policy & Regulation

New CLARITY Act Text Bars Officials from Issuing Tokens

Senator Cynthia Lummis released updated Digital Asset Market Clarity Act text merging Banking and Agriculture drafts. The ethics section would stop the president, vice president, members of Congress, federal judges, and their spouses from issuing or sponsoring digital assets for pay while in office through Jan. 20, 2029, force covered holdings into sale or a blind trust, and give DOJ civil power that can reach exchanges listing banned tokens. Democrats still want state attorneys general in the enforcement mix, and that fight is what most threatens a 60-vote Senate path before the August recess. (Lummis Senate Gov)

Chainalysis: FATF’s 7th Crypto Report Card Says Laws are Ahead of Enforcement

Chainalysis walks through FATF’s July 16 7th Targeted Update on VA/VASP standards. Among 147 jurisdictions, 86% have done VA risk assessments and 83% have Travel Rule laws, but 60% of those with Travel Rule statutes have taken no supervisory or enforcement action, and under 10% fully meet preventive AML/CFT measures. The FATF flags freeze-resistant proprietary stablecoins after a Cambodia-linked network issued one following a $29M issuer freeze, plus AI-amplified fraud, DeFi still largely unregulated (93% of jurisdictions have not identified qualifying DeFi arrangements), and expects VASPs to run wallet screening, analytics, and freeze/block capability as baseline compliance. (Chainalysis)

Japan Puts Crypto Under FIEA and Clears a Path for ETFs

Japan’s Diet moved crypto from a payments-centric Payment Services Act framework into the Financial Instruments and Exchange Act, with the new rules aimed at 2027. Issuers get disclosure duties; exchanges face stricter investor-protection and insider-trading rules; unregistered operators see maximum prison terms rise from three years to ten and fines from ¥3M to ¥10M. Spot crypto ETFs still need Investment Trust Act work, and a separate tax outline points to a flat ~20% crypto gains rate in 2028, down from rates that can hit 55%. (CoinDesk)

Russia’s Duma Passes Crypto Trading Law

Russia's State Duma adopted a comprehensive law governing cryptocurrency circulation, set to take effect September 1, 2026. The law lets both qualified and non-qualified investors trade cryptocurrencies through licensed intermediaries, caps annual purchases for non-qualified investors at 300,000 rubles, and still bans using crypto for domestic payments while allowing unrestricted use in cross-border trade settlements. (Bank of Russia)

Capital Allocation

MoonPay Buys Glide for Deposit Routing

On July 16 MoonPay acquired Y Combinator-backed Glide in an all-equity deal; Glide’s four-person team joins MoonPay. Founded by former Robinhood Wallet engineers, Glide routes deposits across 100+ tokens and 30 chains into apps including Wallet in Telegram, Moonshot, and Paysafe. Terms were not disclosed. It is MoonPay’s sixth acquisition announcement of 2026. (Cointelegraph)

Cyclops raises $20M Series A

Cyclops announced a $20 million Series A led by Nava Ventures on July 15, with Coinbase Ventures, Castle Island Ventures, Circle Ventures, GPT Ventures, Lasagna Ventures, F-Prime Capital, OpenFX, and Global PayTech Ventures participating. The Miami team sells one API for stablecoin settlement, payins, payouts, and treasury to payments companies, and says it orchestrates specialist vendors rather than rebuilding every layer. The post cites volume growing 350% month over month, a partner licensing network of 100+ licenses, and hires from Coinbase, Fiserv, Shift4, JPMorgan, and Paysafe, including Coinbase’s former global CCO leading compliance. (Cyclops)

Applied Research

Agentic Attack Synthesis and Simulation for Smart Contracts

KASS, a multi-agent system that plans attacks from audit knowledge, emits constrained Foundry tests, and repairs failures with nested code and strategy loops. On 104 SmartBugs-Curated contracts it produced working exploits for 94.23% of cases, beating the authors’ same-protocol Claude Code baseline and earlier REX/AdvSCanner numbers on similar sets. It validated 9 of 11 CVE-tagged contracts and can drop static findings that never produce runnable impact. (arXiv)

x402 Facilitators are Shared Payment Infrastructure and Shared Risk

This paper looks at x402, which extends HTTP 402 so APIs and AI agents negotiate payment and hand proof checks plus on-chain settlement to third-party facilitators. Those facilitators sit under many merchants at once, so one validation bug can hit many services. The authors argue live mainnet deployments are still poorly measured relative to how fast the protocol is being adopted. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 crypto hacks regulations security cybersecurity <![CDATA[0x42 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x42-web3-security-bulletin 7v5mCufrTIKGYJScrC4P Fri, 17 Jul 2026 09:42:54 GMT TL;DR

  • Nethermind shows where AI belongs in audits: not replacing senior judgment, but catching mechanical inconsistencies humans can miss. The useful model is AI doing consistency work while auditors focus on attack paths, exploitability, and impact.

  • This week’s incidents are mostly control failures hiding inside trusted plumbing: Ostium’s oracle automation accepted future-dated reports, Bonzo’s verifier accepted a zero BLS key, and Injective’s compromised SDK used fake telemetry to steal wallet material.

  • LI.FI selected Hypernative to screen tokens across 60+ chains, adding approve-or-deny risk signals for every token routed through its liquidity infrastructure.

  • Policy and capital keep moving toward institutional rails: U.S./UK agencies are coordinating on digital assets and market structure, OFAC is turning stablecoin traceability into sanctions pressure, and Velocity’s $38M raise shows stablecoin treasury infrastructure is still getting funded.

Industry Trends & Analysis

AI’s Role in Security Audits

Utku Kocakulak shows how Nethermind’s AuditAgent uncovered a subtle integer-overflow bug in accounting logic that multiple human audits had missed, simply by flagging a parenthesis mismatch between two near-identical calculations. The article argues that AI is best used for mechanical consistency checks, while senior auditors focus on attack-path analysis and impact, framing the future as “elite auditors augmented by AI” rather than AI replacing human expertise. (Nethermind)

Blockchain Forks Explained: Soft vs Hard

CyberScope explains how protocol upgrades create blockchain forks, distinguishing backward-compatible soft forks from hard forks that can split a network into competing chains with shared history but divergent rules. The article shows how governance processes and scheduled block-height activations determine whether changes become smooth upgrades or contentious chain splits with security and compliance implications for applications and exchanges. (CyberScope)

Market Movements

LI.FI Integrates Hypernative Token Screening Across 60+ Chains

LI.FI, the cross-chain liquidity router serving more than 1,000 integration partners, will use Hypernative Token Screening to flag scam tokens, rug pulls, and other fraudulent assets before they reach users. LI.FI screens its full token database and calls the Hypernative API whenever a new token is added, passing integrators a binary approve-or-deny recommendation alongside existing metadata. Hypernative scores contracts, holder concentration, DEX and CEX activity, deployer reputation, and social verification. (Hypernative)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 190

Total amount lost in 2026: $992,577,108

Ostium Loses Over $18M After an Attacker Submitted Future-dated Oracle Reports

An attacker pulled about $18M in USDC from Ostium's Arbitrum vault by abusing a registered PriceUpKeep forwarder in the protocol's Gelato price automation. Future-dated reports made losing trades look profitable and triggered the payout. Blockaid flagged the transaction.

HackTrail maps the drain, step-by-step:

Ostium runs RWA perpetuals, had processed over $50 billion in volume, and raised $27.8 million, including a Series A co-led by General Catalyst and Jump Crypto. (CoinDesk)

Bonzo Lost $9M Because Supra's Verifier Treated Zero as a Valid BLS Key

rekt.news walked through the July 11 Bonzo Lend exploit on Hedera: Supra's pull-oracle verifier accepted a zeroed signature with a zeroed public key, the BLS identity element, so the pairing check passed without a real committee attestation. The attacker deposited about 250 SAUCE (a few dollars), inflated the SAUCE/wHBAR feed, and borrowed roughly $9.05 million in USDC and wrapped HBAR in eight seconds. Supra said the broken verifier had been live for about two years; an identity-element check alone would have stopped it. (rekt)

Injective SDK NPM Package Steals Wallet Keys via Fake Telemetry

Socket reported July 9 that @injectivelabs/sdk-ts@1.20.21 was published from a compromised Injective Labs contributor GitHub account with hooks on fromMnemonic and fromHex that log keys and mnemonics through a fake trackKeyDerivation telemetry path. The payload base64-encodes the material and POSTs it to an obfuscated Injective public gRPC-web endpoint so traffic blends with normal SDK use; 17 other @injectivelabs packages at 1.20.21 pinned the malicious SDK. The account owner reverted within about an hour and shipped clean 1.20.23, but npm only deprecated 1.20.21 after 310 downloads, and GitHub release artifacts remained available. (Socket)

Policy & Regulation

U.S. and UK Release Transatlantic Taskforce Recommendations on Digital Assets and Capital Markets

The U.S. Department of the Treasury and HM Treasury published July 14 the Transatlantic Taskforce for Markets of the Future recommendations, co-announced by Secretary Scott Bessent and Chancellor Rachel Reeves after the September 2025 State Visit. On digital assets, BoE, CFTC, FCA, and SEC staff will seek common approaches to tokenized-securities settlement finality and whether stablecoins or tokenized money market funds can serve as CCP margin collateral; the governments also backed a multi-money mix of stablecoins, tokenized deposits, and other digital money, plus a Basel review of cryptoasset prudential standards. The same day they issued a joint stablecoin statement affirming 1:1 high-quality reserves, reserve segregation, and work toward cross-border market access without mutual recognition of each other's licenses. (U.S. Department of the Treasury)

OFAC Freezes $131M in Iran Central Bank Stablecoins

OFAC expanded sanctions on Iran’s Central Bank by designating four crypto wallets that together received $165M in stablecoins, prompting Tether to immediately freeze $131M in balances. The analysis shows how Iran’s reliance on stablecoins for sanctions evasion and funding has become a vulnerability, with nearly $475M in Central Bank-linked Tether now blocked and on-chain tracing revealing upstream institutional liquidity providers and payment processors. (Chainalysis)

Legislative Watch

Capital Allocation

Velocity Raises $38M Series A

Velocity announced July 14 a $38M Series A led by Dragonfly and FirstMark, with Activant Capital, Capital One Ventures, QED Investors, Coinbase Ventures, Wintermute Ventures, and Ripple participating, bringing total capital raised to nearly $50M since May 2025. The London-based stablecoin treasury and settlement platform targets CFOs and treasury teams at merchants, payment providers, fintechs, and financial institutions, combining stablecoin rails with local banking, compliance, custody, and settlement orchestration. Funding will expand its banking and payments network, product work, and regulatory capabilities as enterprises push stablecoins into liquidity management and cross-border settlement. (Velocity)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security crypto cybersecurity regulations hacks <![CDATA[0x41 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x41-web3-security-bulletin wUJg4fIqDLeLlCwZn7s0 Fri, 10 Jul 2026 09:24:42 GMT TL;DR

  • Security failures are moving beyond smart contracts. This week’s incidents show losses coming from governance capture, stale accounting assumptions, weak wallet generation, and frontend or operational control gaps.

  • Governance is now an attack surface. BonkDAO's $20M loss shows that attackers can drain treasuries through vote buying and proposal execution without exploiting contract code.

  • Accounting assumptions can become exploit paths. Summer.fi’s vault drain shows how stale NAV inputs and deprecated strategy components can turn into direct user losses.

  • Wallet generation failures are still catastrophic. Ill Bloom is a reminder that weak randomness can leave keys enumerable for years, across multiple chains, before users know they are exposed.

  • Regulation is turning into infrastructure pressure. The UK, EU, SEC, and Kraken stories all point toward the same future: stablecoins, custody, trading, and exchange operations will need banking-grade controls and clearer supervisory models.

  • Institutional capital is backing regulated crypto rails. Paradigm and EDX show that serious money is still flowing into digital-asset infrastructure, especially where security, compliance, and market structure can support larger institutions.

  • Privacy is becoming a wallet-layer problem. Browser-extension research shows that users can be deanonymized through RPC routing, fingerprinting, and telemetry even when on-chain activity appears pseudonymous.

  • The strongest teams will connect research to controls. Formal verification, blockchain attack taxonomies, wallet privacy studies, and chain-abstraction work only matter if they become tests, monitoring, governance rules, and design requirements.

Industry Trends & Analysis

From CertiPlonk to zkVMs: Verifying RISC‑V Conformance

Nethermind’s research team explains how CertiPlonk‑style formal verification scales to three RISC‑V zkVM implementations: OpenVM, Brevis Pico, and Plonky3’s Poseidon2, by modeling buses in Lean and proving per‑opcode equivalence theorems. The post shows that once memory consistency is derived formally, proofs can be reused across forks, turning labor‑intensive circuit audits into reusable assurance for production zk systems. (Nethermind)

Questions About AI in Compliance That Nobody Can Answer

Elliptic explores unresolved questions around deploying AI in financial crime compliance, including accountability, explainability, and regulatory expectations for model governance.

If a regulator examined your AI governance tomorrow, what would it actually show? How well documented is it and how effective has it been at stopping bad things from reaching your organization?

The post argues that while AI can enhance detection, institutions still lack clear answers on liability, audit trails, and how supervisors will assess AI‑driven decision‑making. (Elliptic)

Market Movements

Breadth, Depth, and Quality in Blockchain Analytics

Chainalysis argues that comparing blockchain analytics vendors purely by cluster count misses what matters most: how addresses are grouped and how reliably those clusters are attributed to real‑world entities. The article urges compliance teams to ask whether groupings are deterministic, auditable, and structurally independent of labels, and if operator–beneficiary distinctions are captured to avoid false positives in investigations. (Chainalysis)

EMURGO Steps Down from Cardano Pentad Governance After SecondFi Exploit

EMURGO, one of Cardano's three founding entities and developer of the SecondFi wallet, is leaving the Pentad governance coalition to focus on recovering user funds from last month's exploit. The group said stepping aside reflects accountability owed as a founding entity while it runs a dedicated asset-recovery team.

Pentad, formed earlier in 2026, coordinates treasury-backed infrastructure work among Input Output Global, the Cardano Foundation, Intersect, the Midnight Foundation, and EMURGO. (The Block)

Exploits & Incidents

BonkDAO Loses $20M to a Malicious Governance Vote

BonkDAO, the DAO behind Solana memecoin BONK, said a malicious governance proposal drained an estimated $20M in BONK from its treasury all without touching contract code. BonkDAO said the attacker bought BONK on exchanges ahead of the vote, the DAO has notified law enforcement, and is working with exchanges, bridges, and the Solana Foundation on recovery. The attack follows a June Balancer governance takeover that drained $1.58M, adding to a run of governance-linked losses in 2026. (The Defiant)

Chainalysis Traces BonkDAO Heist into a Shadow "BONK 2.0" Multisig

Chainalysis found that the wallet behind BonkDAO's governance attack parked roughly $19M of stolen BONK in a new multisig it calls "BONK 2.0," controlled by the malicious voter, the exploiter wallet, and a third financially linked address.

The firm traced a June 30 treasury-drain proposal, $8M in exchange purchases plus DeFi borrowing on July 4–5 to reach the 1% BONK vote threshold, and a July 6 execution that sent about $188,000 to an exchange before the rest landed in the shadow DAO treasury. An hour after the drain, the voter wallet sold $5.3M of its voting stake. (The Defiant)

Summer.fi Post-mortem Blames Stale NAV Pricing for $6M Vault Drain

Summer.fi said in an X post-mortem that on July 6 an attacker manipulated share prices on two Lazy Summer Protocol USDC vaults on Ethereum mainnet and extracted about $6.04M of depositor value in one atomic transaction.

The team attributed the loss to donating Silo "Varlamore" tokens that still carried stale November 2025 Stream Finance valuations into a strategy module slated for removal but still counted in net asset value, inflating the share price roughly 9.5% before the attacker redeemed about $71M against a $64.8M deposit. Summer.fi paused all vaults via the DAO Guardian multisig. (Summer.fi on X)

Analysis: Ill Bloom Weak-seed Wallet Drainer

Ill Bloom documents a wallet-generation flaw where weak randomness during recovery-phrase creation left keys enumerable across Bitcoin, Ethereum, Tron, Rootstock, and Polygon. As of June 30 Coinspect tracked 2,114 active addresses in its first exposed set; a coordinated May 27 sweep drained 431 accounts for about $3.14M, mostly Bitcoin ($2.57M).

Peak historical exposure hit roughly $12.56M in April 2022. New weak-key wallets kept receiving funds through 2025 and into 2026, and Coinspect says the count is still rising. (Ill Bloom)

SlowMist stats this week

2026 hacks: 187

Total amount lost in 2026: $983,248,608

Policy & Regulation

How the UK’s Stablecoin Rules Came Together

Elliptic traces the policy and consultation process that led to the UK’s stablecoin rules, from early proposals to final regulatory texts. The article focuses on how industry feedback, prudential concerns, and consumer‑protection goals shaped the final regime, giving compliance leaders useful context for upcoming supervision. (Elliptic)

SEC Schedules Three Crypto Rulemakings for 2026 Agenda

The SEC placed three crypto-focused items on its 2026 Unified Regulatory Agenda, each at proposed-rule stage with a July target for notices of proposed rulemaking. The Crypto Assets rule (RIN 3235-AN38) would address digital-asset offers and sales, potentially including exemptions and safe harbors. A broker-dealer item (RIN 3235-AN48) would amend net-capital and customer-protection rules for crypto custody, and Crypto Market Structure Amendments (RIN 3235-AN49) would cover trading on alternative trading systems and national exchanges. Congress is still negotiating the CLARITY Act ahead of an August recess deadline. (The Defiant)

EU Plans MiCA Revision in 2027 to Cover non-EU Stablecoin Issuers

The European Union will revisit Markets in Crypto-Assets regulation as early as 2027, with EU diplomats saying a reopening looks unavoidable after MiCA's July 1 licensing cliff and pressure from U.S. stablecoin policy under the GENIUS Act. The European Commission is consulting stakeholders through September 30 on extending rules to non-EU issuers serving European customers, tokenized payments, and deposits. Diplomats cited ECB concerns and the complexity of regulating dollar-backed stablecoins with multiple issuers, as the transatlantic regulatory gap widens. (Euronews)

Kraken Pursues Full European Banking License

Kraken is seeking a full banking license in Europe, with Lithuania as the target jurisdiction, following the same specialized-bank path Revolut took in 2018 through the Bank of Lithuania. A person familiar with the plans said Payward, Kraken's parent, is building licenses globally over the next decade through acquisitions or de novo applications; Kraken Financial already gained Federal Reserve payment-rail access in March 2026 and VARA authorization in the UAE in May. (CoinDesk)

Legislative Watch

(Polymarket)

Capital Allocation

Paradigm Closes $1.2B Fourth Fund Across Crypto, AI, and Robotics

Paradigm raised a $1.2B Fund IV to back founders at the frontier of crypto, AI, robotics, and other emerging tech. The firm named crypto bets including Hyperliquid, Stripe co-founded stablecoin blockchain Tempo, and prediction-market platform Kalshi, alongside non-crypto portfolio companies such as Zipline, SendCutSend, True Anomaly, and Nous Research. Paradigm also highlighted open-source work on blockchain tooling (Foundry, Reth), agent infrastructure (Centaur), and the EVMbench smart-contract security benchmark built with OpenAI. (Paradigm)

EDX Markets Raises a $76M Series C

EDX Markets closed a $76M Series C led by Japan's SBI Holdings to expand institutional trading, clearing, and settlement infrastructure. CEO Tony Acuña-Rohter said SBI's global financial network will help scale regulated digital-asset products; SBI chairman Yoshitaka Kitao cited EDX's compliance-focused platform as a foundation for institutional adoption alongside SBI's yen stablecoin JPYSC and U.S. dollar stablecoin handling. EDX, backed by Citadel Securities, Fidelity, and Charles Schwab, recently launched FlowConnect crypto-as-a-service and filed to establish EDX Trust as a proposed OCC national trust bank. (PRN)

Applied Research

Browser-extension Wallets Leak Privacy

Researchers audit privacy threats in Web3 browser-extension wallets, documenting how extensions expose browsing patterns, RPC endpoints, and transaction metadata that can deanonymize users even when on-chain activity looks opaque. The authors propose wallet-side mitigations including stricter RPC routing and reduced third-party telemetry. (arXiv)

A Survey Maps Blockchain Attack Surfaces from Cryptography to Apps

Researchers publish a cross-domain taxonomy of blockchain attacks and defenses, spanning the data and cryptographic layer, network and consensus layers, smart-contract execution, and application logic. The paper links historical incidents to recurring failure classes including key compromise, eclipse attacks, and cross-layer trust assumptions. (arXiv)

Crossroads: A Smart Contract Layer for Chain-Abstracted Assets

James Austgen, Dani Vilardell, and Ari Juels present Crossroads, a smart contract layer designed to secure assets that move across chain-abstraction protocols, a growing category in multi-chain DeFi. The paper addresses new attack surfaces created as ecosystems increasingly bridge assets between Ethereum, Solana, and other major chains. Their design offers a security-first approach to an area that has seen frequent bridge exploits. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) crypto hacks security cybersecurity regulations <![CDATA[0x40 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x40-web3-security-bulletin D0W7zPnPaWFwbUHhyFf0 Fri, 03 Jul 2026 08:43:01 GMT TL;DR

  • Exploit mechanics are getting clearer, but losses are still operational. OpenZeppelin’s latest bug digest and TRM’s H1 data both point to the same lesson: smart contract flaws matter, but the expensive failures still cluster around keys, infrastructure, phishing, and weak operational controls.

  • Tokenized markets are moving from thesis to infrastructure. Robinhood’s L2 push for tokenized equities shows major brokerages are no longer treating onchain assets as a side product. The next competitive layer is 24/7 execution, settlement, and automated trading workflows.

  • Regulators are turning crypto into an operating environment. The UK’s finalized crypto regime and Hong Kong’s institutional-market strategy are less about “whether crypto is allowed” and more about custody, disclosures, stablecoins, market abuse, and who can operate at scale.

  • Frontend and supply-chain risk remain underpriced. The Polymarket user losses are a reminder that users can lose funds even when core contracts are not the failure point. Web app integrity, vendor controls, and approval hygiene are now part of protocol security.

  • Audit findings need better translation into loss prevention. The strongest research this week reinforces a familiar gap: knowing vulnerabilities exist is not the same as reducing exploitability, especially when attacker paths depend on governance, deployment, monitoring, and human behavior.

Industry Trends & Analysis

OpenZeppelin Bug Digest #9

OpenZeppelin's June 30 Notorious Bug Digest #9 covers recent vulnerability classes including rule-downgrade bugs, zero-knowledge circuit misconstraints, and the Aftermath exploit pattern. The digest links public audit findings to live mainnet failures, giving developers a quick reference for recurring 2026 exploit mechanics. The useful signal here is pattern recognition: teams can map audit findings against live exploit paths before they show up in their own deployments. For builders, this is a reminder that “known class of bug” should translate into test cases, monitoring rules, and upgrade playbooks. (OpenZeppelin)

Blockchain Development for Builders and Businesses

Cyberscope clarifies that “blockchain development” spans core protocol engineering, smart contract and dApp work on existing networks, and enterprise integrations on permissioned chains. The article breaks down fundamental components such as consensus, data structures, smart contracts, and stresses that modern practice increasingly includes security, tooling and compliance considerations as blockchains move from niche experiments into finance, gaming, identity and infrastructure. As blockchain work becomes normal software infrastructure, security can’t sit off to the side as a final audit step. Teams entering the space need to treat consensus choices, contract design, key management, and compliance as architecture decisions from day one. (Cyberscope)

Market Movements

Robinhood Launches L2 for Tokenized Stocks

Robinhood launched Robinhood Chain, an Ethereum layer-2 for 24/7 tokenized equities, perpetuals via Lighter, and AI-agent trading workflows. The move extends Robinhood from brokerage into onchain market infrastructure as regulated venues race to host real-world assets and automated execution on public chains. Tokenized equities are becoming a venue and workflow competition, not just a product wrapper. The security question moves from “can assets be represented onchain?” to whether settlement, custody, automation, and market controls can survive real brokerage-scale usage. (CoinDesk)

Exploits & Incidents

TRM H1 2026 Hacks

TRM Labs reported that the first half of 2026 saw 207 separate hacks, more than double the 83 in H1 2025, while stolen funds fell to $972 million from $2.3 billion. Smart contract exploits made up 125 incidents but a small slice of dollar losses; infrastructure and key-compromise attacks drove about 76% of value stolen on just 15% of events. North Korea-linked activity accounted for roughly $643 million, mostly April's Drift and KelpDAO thefts. TRM cautions the lower total reflects fewer mega-heists, not weaker attackers. The incident count is rising even as headline losses fall, which means attacker activity is broadening rather than fading. Security teams should keep smart contract review in place, but the money is still being lost through keys, infrastructure, access paths, and operational failures. (TRM Labs)

Polymarket Users Lose $3M Supply-Chain Attack

Polymarket will reimburse users after attackers injected malicious JavaScript through a compromised third-party frontend vendor, tricking fewer than 15 accounts into approving roughly $3M in ParyonUSD.

PeckShield said stolen funds were bridged from Polygon to Ethereum and swapped into about 1,893 ETH. Polymarket confirmed its own servers were not breached, a reminder that prediction-market risk often sits in the web app even when contracts are fine. This is exactly the kind of loss pattern that gets missed when teams define protocol security too narrowly. Frontend integrity, third-party code, wallet approvals, and user transaction context are now part of the security boundary. (The Defiant)

SlowMist stats this week

2026 hacks: 182

Total amount lost in 2026: $955,864,608

Policy & Regulation

Hong Kong is Attracting Institutional Capital

Elliptic explains that Hong Kong’s licensing regime for exchanges and custodians, tokenized securities pilots, and emerging stablecoin frameworks have moved the city from experimentation into a market-building phase. The piece argues that clear rules, operational exchanges and regulated tokenization are now drawing institutional capital, while supervisors continue to prioritize AML, suitability and robust custody over speculative yield products. Hong Kong is showing how regulation can become market infrastructure when licensing, custody, tokenization, and stablecoin rules move together. For institutions, the differentiator is shifting from crypto exposure to whether venues can meet operational and supervisory standards. (Elliptic)

UK's FCA Finalizes Crypto Regime

The FCA published June 30 a package of five policy statements (PS26/9 through PS26/13) completing its cryptoasset rulebook under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, passed February 4. The regime covers stablecoin issuance, trading platforms, custody, staking, lending, admissions and disclosures, and a crypto market-abuse framework. The full regulated scope takes effect October 25, 2027. The UK is moving crypto firms into a much more explicit authorization, prudential, and market-abuse environment. Operators now have a real implementation clock, and the firms that treat this as an operating model change will be better positioned than those treating it as paperwork. (FCA)

Legislative Watch

(Polymarket)

Applied Research

Four-year Study Finds Audit Findings Don't Match Losses

Stefan Beyer's arXiv paper analyzes Web3 security from January 2022 through March 2026, combining 23,818 public audit findings from 22 firms with 218 Rekt documented exploits totaling roughly $7.76B. Critical and High audit findings held steady at 15–17% each year, but loss categories diverged sharply: private-key compromise, phishing, and social engineering drove about 49.6% of dollar losses while barely appearing in published audit output. Losses were also heavily concentrated: the eight largest incidents accounted for 50.6% of cumulative damage and the top twenty for 71.4%. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity crypto hacks regulations <![CDATA[0x39 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x39-web3-security-bulletin Ki5kEhLBhT77FAVNvLlu Fri, 26 Jun 2026 06:43:41 GMT TL;DR

  • Base’s two-hour mainnet stall showed that L2 security is also a liveness and resilience problem: invalid-block handling, sequencer design, client diversity, and upgrade discipline now matter as much as exploit prevention.

  • Nethermind reviews how institutional privacy is moving from theory to implementation, with ZK proofs, shielded pools, FHE, TEEs, and MPC giving public-chain finance a path toward confidentiality, verifiability, and selective disclosure.

  • Hypernative’s rebrand points to a maturing onchain security market, where institutions want continuous monitoring, transaction guardrails, wallet protection, fraud detection, RBAC, MFA, and audit logs in one control layer.

  • SecondFi’s $20M wallet loss was a pure fundamentals failure: predictable Ed25519 nonce generation turned ordinary signatures into private-key exposure, reinforcing the need for hardened crypto libraries and strict wallet security review.

  • Bridge and cross-chain assumptions failed again, with Secret Network and Taiko incidents showing how missing source-channel checks or forged message proofs can convert verification gaps into real asset loss.

  • Policy pressure is tightening around the operating layer: TRM traced billions between CoinEx and sanctioned Iranian exchanges, stablecoin issuers face banking-style customer identification rules, and Binance is still searching for a viable MiCA path.

  • Applied research is raising the stakes on both offense and compliance, with new work showing LLMs can generate smart contract exploits across vulnerability classes while ZK compliance schemes try to preserve privacy without weakening authorization.

Industry Trends & Analysis

Base Mainnet Stalled for Hours After Invalid Block

On June 25 Coinbase's Base L2 halted block production in what the team called a "Mainnet Chain Stall" and "Unsafe Head Stall," with deposits, withdrawals, and client software affected for roughly two hours. Base isolated a consensus problem that sequenced an invalid block after block 47,806,542, stopping subsequent block building; Jesse Pollak said funds were safe and the issue was not a security exploit.

EtherWorld frames the outage as a liveness failure, not a safety breach, and notes it landed the same day as the scheduled Beryl upgrade. The article argues the incident renews questions about OP Stack sequencer centralization, client diversity, and whether L2 reliability can match adoption on one of Ethereum's busiest rollups. The security lesson is operational rather than exploit-driven: rollups need liveness, client diversity, upgrade discipline, and clear failover paths before they can credibly carry institutional-scale activity. (EtherWorld)

Institutional Privacy on Public Blockchains Gets Practical

Stefano De Angelis outlines how institutions can use shielded pools, zero-knowledge proofs, FHE, TEEs, and MPC to achieve private transfers and computations on public chains without sacrificing verifiability. The article argues that privacy is a hard requirement for on-chain finance, but must be paired with selective disclosure, access control, and standardized tooling to satisfy regulators and operational constraints. This matters because privacy is becoming a control layer, not a feature request: institutions need confidentiality, selective disclosure, auditability, and access control to coexist on public rails. (Nethermind)

DePINs Bring Crypto Incentives to Real-World Infrastructure

CyberScope introduces decentralized physical infrastructure networks (DePINs) as token-incentivized systems where ordinary users deploy hardware to provide wireless coverage, storage, compute, or sensor data. The article highlights proof-of-physical-work schemes, security challenges like Sybil attacks and node compromise, and argues DePINs will likely coexist with traditional cloud as a cost-effective, censorship-resistant layer for specific workloads. The security baseline for DePINs is physical-world trust: protocols have to prove nodes are real, data is authentic, incentives are not gameable, and compromised hardware cannot poison the network. (CyberScope)

Market Movements

Hypernative Rebrands as Institutional Onchain Security Layer

Hypernative announced that it is refreshing its brand and product naming to match a customer base that now spans crypto-native protocols, Layer 1 teams, and traditional financial institutions building tokenized funds and stablecoin programs. The company says its platform monitors more than $100B in digital assets across 75+ chains for 350+ organizations and has helped prevent over $3B in onchain losses. The rebrand groups capabilities into lifecycle-stage applications including onchain monitoring, transaction guard, fraud prevention, wallet protection, and screening. The product includes shared ML detection infrastructure with 300+ risk agents. New enterprise features include MFA, RBAC, and audit logs. (Hypernative)

Exploits & Incidents

SecondFi Wallet Flaw Results in $20M Loss Across 374 Wallets

SecondFi said June 25 that the root cause was confined to its native Cardano web wallet generation software, with on-chain analysis estimating roughly 16 million ADA in losses from a sophisticated automated attack between June 21 and 23. The team identified two attackers: one drained 171 wallets in two waves via three collection addresses, the other swept 203 wallets in a third wave, with about 4.02 million ADA still sitting in Attacker B's flagged collection address. SecondFi put the platform in secure maintenance mode, took a balance snapshot, and said it is working with IOG, the Cardano Foundation, Intersect, and SundaeSwap while an independent security firm validates findings. The team warned the flaw is address-level and urged affected users to follow official recovery steps rather than importing seed phrases elsewhere. The incident is a reminder that wallet software is security-critical infrastructure: one flawed signing implementation can turn ordinary user activity into private-key exposure at scale. (SecondFi on X)

Root Cause Analysis of SecondFi's Ed25519 Nonce Flaw

SecondFi's Cardano web wallet derived Ed25519 signing nonces from the public transaction message alone (k = H(M)) instead of from a secret seed. Because Ed25519 signatures publish R and s on-chain, anyone could recompute k, plug into a = (s − k) / H(R, A, M), and recover the private key from a single signed transaction, worse than classic nonce reuse, which typically needs two signatures. The failure was custom wallet signing logic, not a Cardano protocol bug; audited libraries like libsodium derive nonces from secrets and prevent this class of leak entirely. The fundamental failure was cryptographic hygiene: teams should use battle-tested signing libraries, avoid custom nonce logic, and treat key-generation code as a high-assurance control surface. (Jonathan on X)

JaredFromSubway MEV Bot Drained for $15M

The JaredFromSubway sandwich bot lost roughly $15M when an attacker fed it fake profitable pools, accumulated ERC-20 approvals up to 92 WETH on helper contracts, then called transferFrom on WETH, USDC, and USDT balances. The lesson here is that automated trading systems are still approval, simulation, and adversarial-input systems; if they trust fake opportunities, attackers can turn speed into liability. Quit's X thread covers the details step by step.

Secret Network Details Axelar IBC Bridge Exploit

Secret Network's forum post says an attacker exploited the ics20-for-axelar contract on June 10 by opening a permissionless IBC channel from a counterfeit chain, minting about $4.67M in unbacked saTokens (saUSDT, saUSDC, saWETH, and four others) in six minutes, then redeeming them through the real Axelar bridge to drain escrow reserves in roughly 18 minutes. The bug dates to a 2023 escrow-to-mint rework that dropped source-channel authentication; a March 2026 migration carried the flaw forward. Secret was not told until June 17. Proceeds moved via Osmosis to Ethereum and BSC, swapped to about 2,349 ETH on CoW Protocol, and cashed out mainly through ChangeNOW and KuCoin; roughly $770,000 remains on Axelar, which Secret says Axelar declined to freeze. Native SCRT, Noble USDC, and other IBC bridges were unaffected. This is a bridge-authentication failure in plain terms: cross-chain systems must verify source channels, message provenance, and migration safety because one missing check can mint unbacked assets into real liquidity. (SCRT)

Taiko L2 Loses $1.7M to Forged Bridge Message Proofs

Taiko halted block production after an attacker exploited bridge message-proof verification, registering fraudulent withdrawals on Ethereum L1 without legitimate MessageSent events on the rollup.

Losses totaled about $1.7M before the team paused the L1 bridge and ERC20Vault. Taiko urged users to exit bridges immediately and asked exchanges to suspend TAIKO deposits. The Taiko exploit reinforces that bridge proofs are core security assumptions; when state verification fails, every dependent bridge and withdrawal path becomes suspect. (The Block)

SlowMist stats this week

2026 hacks: 175

Total amount lost in 2026: $948,394,808

Policy & Regulation

TRM Traces $3.84B Between CoinEx and Sanctioned Iranian Exchanges

TRM Labs reported that blockchain-verified flows between global exchange CoinEx and more than 60 Iranian platforms totaled $3.84B over seven years, including $2.7B with Nobitex at roughly $1M per day. CoinEx's illicit-volume share is nearly 8%, against a 0.3% threshold typical of compliant venues. TRM also traced $67M from the Central Bank of Iran through a multi-chain "National–Tether" laundering playbook ending at CoinEx off-ramps, plus $154M in ViaBTC mining payouts to Nobitex-linked wallets that supplied emergency liquidity after a 2025 cyberattack. The compliance takeaway is that blockchain transparency only helps when exchanges, issuers, and off-ramps convert visibility into controls, sanctions screening, and accountable transaction monitoring. (TRM Labs)

Stablecoin Issuers are Facing Banking Compliance Requirements

FinCEN, OCC, the Fed, FDIC, and NCUA proposed a GENIUS Act rule requiring permitted payment stablecoin issuers to maintain formal customer identification programs under the Bank Secrecy Act. The rule would cover direct issuer relationships like issuance, redemption, custody, and authorized digital asset services, while carving out ordinary secondary-market transfers and smart-contract-only interactions. The operational signal: stablecoin compliance is being designed around issuer-controlled entry points, not a blanket KYC obligation for every wallet-to-wallet payment. The rule shows where stablecoin regulation is likely to land first: issuer-controlled touchpoints, custody, redemption, and authorized services, rather than every peer-to-peer transfer. (Federal Register)

Binance Searches for New MiCA Path

Reuters reported June 24 that Binance Europe head Gillian Lynch said the exchange is not leaving the EU after Greece reportedly rejected its MiCA license bid, and is exploring other member-state routes. ESMA said firms without authorization must wind down EU activities in an orderly way. Sources cited concerns over past AML penalties, corporate structure, and executive backgrounds. Binance has roughly one week before its current EU permission expires. The MiCA setback matters because licensing is becoming an operational security signal: governance structure, AML history, executive accountability, and control maturity now affect market access. (Reuters)

Legislative Watch

(Polymarket)

Applied Research

LLM Exploit-generation Benchmark Across 23 Smart Contract Vulnerability Classes

The June paper introduces a data-centric benchmark using Foundry/Forge harnesses to test whether large language models can generate working exploits for 23 documented blockchain vulnerability types. Results show how automated offensive tooling may compress attacker reconnaissance timelines. The research shows that attacker automation is getting cheaper; smart contract teams need better pre-deployment testing, exploit simulation, and secure-by-default patterns before AI compresses the attack cycle further. (arXiv)

Zero-Knowledge Compliance for Ethereum Transactions

Supriya Khadka and Sanchari Das introduce Selective Disclosure Authorization Schemes (SDAS), a new primitive for privacy-preserving regulatory compliance on public ledgers. Their ZK-Compliance prototype on Ethereum binds zero-knowledge proofs to the on-chain sender, preventing proof reuse and front-running while keeping user attributes private, with browser-side proving and on-chain verification kept practical for real-world deployment. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity crypto exploits regulations <![CDATA[0x38 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x38-web3-security-bulletin j44pLCCaD7wMIkSjF72B Fri, 19 Jun 2026 05:25:04 GMT TL;DR

  • Audits are becoming continuous, not ceremonial: CyberScope’s audit-cadence guidance, AuditVault’s reusable finding library, and the latest research all point the same way: security work has to track code changes, TVL, integrations, and attacker learning curves.

  • The audit gap is now measurable: Stefan Beyer’s research pairs 23,818 audit findings with 218 real exploits and shows the uncomfortable truth: audits catch code risk, while nearly half of dollar losses now come from human-vector failures like key theft, phishing, governance, and supply-chain compromise.

  • Humanity Protocol is still the cleanest warning shot: Seven production keys on one compromised laptop turned into a $36M mint-and-dump, ProxyAdmin takeover, token migration, and compensation scramble.

  • Bridge risk keeps hiding in old assumptions: Gravity Bridge lost $5.4M through denom-mapping poisoning, while Aztec’s deprecated immutable bridges lost about $4M across two drains. Legacy bridge logic and residual TVL remain dangerous long after the product story moves on.

  • Compliance infrastructure is moving deeper into the stack: OFAC-aware monitoring, Elliptic’s accuracy-first intelligence model, NYDFS-EBA stablecoin coordination, and Coinbase’s licensed brokerage/derivatives push all show the same pattern: compliance is becoming product architecture.

  • MiCA is forcing the issue in Europe: Binance’s reported Greek license setback, the June 30 deadline, and cross-border stablecoin supervision are turning regulatory posture into a market-access control. The question is no longer whether crypto firms want licenses; it is whether they can operate without them.

  • Institutional rails keep absorbing crypto primitives: Fireblocks is tightening staking operations for large ETH holders, Trace Finance raised $32M for regulated cross-border settlement, and Coinbase is expanding into stocks, derivatives, prediction markets, advisory, and tokenized equities. The crypto capital stack is getting more regulated, not less.

Industry Trends & Analysis

How Often Should Smart Contracts Be Audited?

CyberScope argues that audits are not a one‑off checkbox but a recurring process tied to code changes, TVL milestones and evolving attack techniques. Pre‑deployment audits are described as non‑negotiable, with follow‑up reviews recommended after significant logic changes, governance upgrades, major integrations, or when TVL crosses preset thresholds. The article also urges teams to pair annual audits with continuous on‑chain monitoring and public bug bounties so that operational security keeps pace with growing capital at risk. (Cyberscope)

OFAC and Crypto Crime

This research catalogues all OFAC Specially Designated Nationals (SDNs) with known crypto addresses, showing how sanctions authorities are increasingly targeting wallets linked to ransomware gangs, darknet markets, terror groups and nation‑state actors. It highlights patterns in address reuse and laundering typologies and argues that financial institutions need SDN‑aware blockchain monitoring to avoid indirect exposure. Sanctions risk now moves through wallets, bridges, services, and counterparties, which means compliance teams need address-level intelligence baked into transaction monitoring before exposure becomes indirect liability.(Chainalysis)

AuditVault Builds an Obsidian Security Knowledge Base

Auditware released AuditVault, an MIT-licensed Obsidian vault that links high- and critical-severity audit findings with DeFi hack post-mortems. The repo ingests Solodit/Cyfrin, Frankcastleauditor, Auditware audits, and Rekt leaderboard data into findings/, hacks/, protocols/, and auditors/ folders, with hand-curated taxonomy in classifications/. Each entry carries 10+ tag axes covering severity, language, chain, sector, vulnerability pattern, impact, trigger, and fix type. A builtin crawler, vault-admin/crawler/, refreshes sources and retags new content. The useful shift is institutional memory: auditors and builders can stop treating every finding as isolated and start querying prior exploit patterns, fixes, and protocol failures as reusable security knowledge. (GitHub AuditVault)

Market Movements

Fireblocks Raises the Bar for Institutional ETH Staking

Fireblocks describes how its new ETH Staking Link standardizes validator integrations and expands support from two to five staking providers, adding Blockdaemon, P2P and MAVAN alongside existing Figment and Kiln. The article explains that post‑Pectra “compounding validators” now support auto‑compounding rewards, top‑ups, partial withdrawals and balances up to 2,048 ETH per validator, simplifying operations for large institutional positions. It also notes that institutions can mix native staking with Lido liquid staking, while Fireblocks enforces policy controls across all staking workflows. As ETH staking becomes institutional infrastructure, custody policy, validator operations, withdrawals, and provider diversification become part of the control plane, not back-office plumbing. (Fireblocks)

How Elliptic Scales Its Intelligence Without Sacrificing Its Accuracy

Elliptic explains how it expands blockchain intelligence coverage, adding more assets, services, and risk typologies, while maintaining low false‑positive rates through layered machine learning, analyst review and feedback loops. The post argues that accuracy is critical for compliance teams facing regulatory pressure and that poorly tuned analytics can create both missed‑risk and de‑risking problems. More coverage is only useful if it does not drown compliance teams in false positives; bad attribution can miss real risk or cut off legitimate users. (Elliptic)

Capital Allocation

Trace Finance Raises $32M Series A

Trace Finance announced on June 17 a $32M Series A led by CoinFund, with Coinbase Ventures, Haun Ventures, Jump Capital, Paxos, HOF Capital, Chainlink Labs, and others participating. The U.S.-based cross-border payments firm says it has processed more than $10B in institutional volume and is a core infrastructure provider for four of the largest global payment companies operating in Latin America, including dLocal. CEO Bernardo Brites said the round will deepen FX, banking connectivity, compliance, and settlement rails as new rules push institutional flows toward regulated infrastructure. Trace plans to expand in the U.S., Brazil, LatAm, and APAC, with new stablecoin-based settlement products in development. Stablecoin settlement is moving from crypto-native rails into regulated cross-border payments, where banking access, FX coverage, and compliance controls decide who wins distribution. (Trace Finance)

Exploits & Incidents

Humanity Protocol’s “Trust Layer” Unravels in $36M Key Compromise

Rekt News recounts how Humanity Protocol, a proof‑of‑humanity project pitched as “the trust layer of the internet,” lost 447 million H tokens after seven production keys ended up on one malware‑infected laptop, enabling an attacker to seize its ProxyAdmin and mint on BSC. The post walks through DPRK‑style spear‑phishing, mint‑and‑dump flows that realized about $36.4M, competing theories over whether it was a staged rug or pure key leak, and the rushed recovery: a new ERC‑20 H, a compensation portal, and a short window for holders to migrate. This is the recurring Web3 failure mode: sophisticated protocol branding sitting on fragile operational security, where one compromised endpoint can become a governance, minting, and migration crisis. (Rekt)

Gravity Bridge $5.4M Exploit Analysis

QuillAudits’ post‑mortem explains how an attacker minted worthless tokens on Osmosis, poisoned Gravity Bridge’s token registry with a fabricated denom string, and then used that mis‑registered asset to withdraw about $5.4M in real tokens. The analysis walks through the flawed validation logic, the cross‑chain impact and the defensive lessons for bridge designers around registry hardening and stricter on‑chain checks. (QuillAudits)

Aztec’s Deprecated Bridges Lose $4M Across Two Exploits

Protos reported that Aztec Labs' sunset Aztec Connect and Private Rollup Bridge contracts were drained twice in one week for about $4M combined.

BlockSec attributed both incidents to public input binding flaws in escape-hatch logic. Aztec stressed the contracts are immutable legacy code from 2021–2023, but residual TVL in deprecated systems remains a recurring 2026 bridge-loss theme, with 14 bridge exploits and more than $340M stolen year to date per Protos' tally. If old immutable contracts still hold value, they remain live attack surface with fewer defenders watching. (Protos)

SlowMist stats this week

2026 hacks: 164

Total amount lost in 2026: $929,947,808

Policy & Regulation

Binance May Lose EU MiCA License

Reuters reported June 16 that Binance's application to Greece's Hellenic Capital Market Commission is set for rejection, which would end its ability to serve EU clients after the June 30 MiCA deadline. Binance said on X it will minimize user disruption and argued HCMC had not signaled noncompliance.

The case tests whether the EU can force the world's largest exchange out of the bloc or push activity offshore. (Reuters)

NYDFS and EBA Sign Stablecoin Supervisory Cooperation MoU

NYDFS and the European Banking Authority signed a non-binding memorandum of understanding on stablecoin supervision, effective after signatures by Acting Superintendent Kaitlin Asrow on April 27, 2026 and EBA Chair François-Louis Michaud on May 13, 2026. Under MiCA Article 126, the pact lets regulators share confidential data on issuers active in both jurisdictions, including reserve composition, holder counts, qualifying shareholders, ICT incidents, and material infringements, with quarterly standing exchanges. Authorities may join each other's on-site inspections and coordinate crisis responses. NYDFS may onward-share with the Fed, OCC, and FDIC; EBA may share with EU MiCA and AML supervisors. EBA judged NYDFS professional-secrecy standards equivalent to MiCA. Stablecoin supervision is becoming cross-border by design; issuers active in multiple jurisdictions should expect reserve, holder, incident, and governance data to move between regulators. (New York State Department of Financial Services)

Coinbase Expands Licensed Brokerage and Derivatives Footprint

Coinbase's June 16 system update pushes deeper into regulated markets. U.S. stocks and stock options run through Coinbase Capital Markets Corp, a FINRA/SIPC member with APEX Clearing custody. U.S. futures, crypto options, and prediction markets sit under NFA member Coinbase Financial Markets. Coinbase says it is the first CFTC-approved venue offering global regulated crypto derivatives, including options, to Americans. Coinbase Advisor rolls out as an SEC-registered RIA and NFA-registered CTA for Coinbase One members. Tokenized stocks with 1:1 equity rights launch next month for non-U.S. customers only. The Developer Platform cites 80 regulatory licenses for a custodial offering aimed at partners such as Klarna and Webull. Coinbase is positioning itself less like a crypto exchange and more like a regulated financial platform that can bundle spot, derivatives, equities, advisory, custody, and tokenization. (Coinbase)

Legislative Watch

(Polymarket)

Applied Research

Audit Findings and Exploit Losses Measure Different Risks

Stefan Beyer's June 13 paper pairs 23,818 public audit findings from 22 firms with 218 Rekt-documented exploits totaling about $7.76B from January 2022 through March 27, 2026. Audit output stayed stable: Critical-plus-High findings held in a 15–17% band, and logic, access control, and input validation dominated reports. Losses shifted after 2022: human-vector attacks (key theft, phishing, supply chain, governance) took 49.6% of dollar damage but almost no audit share. Access control was the only top category on both sides. Eight incidents drove 50.6% of losses. Beyer concludes code audits and operational-security reviews are complementary, not interchangeable. The paper gives data to something security teams already feel: smart-contract audits reduce code risk, but they do not cover the operational failures driving a large share of losses. (arXiv)

Web3 Security’s Blind Spot: Off-Chain Failures and Audit Gaps

Tarkan Yavas and Arslan Brömme argue that Web3 security research still over-focuses on smart contracts while real losses often come from off-chain systems, key management, governance, and human workflows; their incident-based study maps major breaches to Web2 security frameworks and calls for blockchain-specific information security management systems controls. Web3 security programs need to look more like full information-security programs, with controls for people, keys, vendors, governance, and operations, not just Solidity review. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity regulations hacks exploits tools <![CDATA[0x37 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x37-web3-security-bulletin JapE79lMct5Jk5qIkKgh Fri, 12 Jun 2026 10:34:45 GMT TL;DR

  • Pashov’s Solidity Auditor v3 is the most interesting AI-security signal this week: it reportedly found 14 of 17 documented high and medium findings in a cross-chain DEX contest in under 20 minutes. That is capability validation, not a reason to replace expert review.

  • Humanity Protocol is the cleanest operational lesson: the incident was not a smart-contract bug, but exposed private keys, compromised Safe control, and bridge/admin risk. Web3 still breaks at key management and governance.

  • Chainalysis flagged roughly $36.7M stolen from unverified smart contracts across Truebit, Trusted Volumes, Aperture Finance, and Ekubo. Closed-source bytecode is not a security boundary when attackers can decompile, diff, and reason through deployed contracts.

  • Visa and Mastercard both moved deeper into agentic and machine-driven payments, with stablecoins, tokenized credentials, fraud signals, and multi-rail settlement becoming part of the payment stack. The agent-commerce story is moving from demo layer to infrastructure layer.

  • Joe Lubin said Ethereum could become a fully zero-knowledge-proof-based protocol within three to five years, with ZK work improving both Layer 1 performance and composability across Layer 2s. The practical security question is whether real-time proving, atomic execution, and cross-L2 liquidity can mature without creating new trust, governance, or implementation risks.

  • Regulators kept tightening the perimeter around crypto markets, stablecoins, prediction markets, sanctions, and platform obligations. The practical takeaway for builders is that compliance design is becoming part of product architecture, not a legal afterthought.

  • In research, Alireza Kavousi, István András Seres, and Zhipeng Wang propose Proof of Source of Funds, a zero-knowledge framework for proving cryptoasset provenance without exposing a user’s full transaction graph, counterparties, or source addresses. The important shift is from platform-side surveillance to user-side proof: protocols can verify that funds came from compliant sources with constant-time checks, while users preserve more financial privacy.

Industry Trends & Analysis

Joe Lubin Sees ZK-based Ethereum

The Block interviewed Consensys CEO Joseph Lubin, who said Ethereum could become a fully zero-knowledge-proof-based protocol within three to five years as Lean Ethereum work and real-time ZK proving on Layer 2s mature. Lubin defended the rollup-centric roadmap as an exploration phase that will converge through synchronous ZK composition across networks like Linea and Gnosis, potentially unifying liquidity without traditional bridges. (The Block)

Pashov Releases Solidity Auditor v3

Pashov Audit Group published Solidity Auditor v3, an AI security skill for smart contract review, reporting that it caught 14 of 17 documented high and medium findings (82.4% recall) in the eight-day cross-chain DEX contest in under 20 minutes. This was against five highs and twelve mediums found by roughly 100 human researchers over the contest window. The v3 update adds shared Feynman, Socratic, and inversion reasoning steps plus three “gap hunter” agents. (Pashov)

Market Movements

Visa Pushes Agentic Commerce, Tokens, and Stablecoins

Visa announced at Visa Payments Forum 2026 in San Francisco a bundle of AI, token, and stablecoin capabilities for programmable commerce. Chief Product & Strategy Officer Jack Forestell framed AI as reshaping transaction initiation and stablecoins as modernizing settlement. New pieces include Agent Score (with New Generation) for merchant agent-readiness, an Agentic Directory of verified agents and merchants, an OpenAI partnership for agentic payments, and a Large Transaction Model trained on billions of transactions for fraud and authorization. Visa also detailed token context and assurance signals, bank tokenized-deposit infrastructure, expanded stablecoin settlement (about $7 billion annualized on VisaNet as of March 2026), and 160-plus stablecoin-linked card programs live or in development. (Business Wire)

Mastercard Launches Agent Pay for Machines

Mastercard said on June 10 that it introduced Agent Pay for Machines (AP4M), extending its 2025 Agent Pay program to permission, orchestrate, and settle continuous micro- and machine-driven payments at low latency across its network. The service covers credentialing via Verifiable Intent, programmatic spending limits, high-frequency transacting among verified participants, and guaranteed multi-rail settlement across cards, bank accounts, and stablecoins. Chief product officer Jorn Lambert framed the launch as infrastructure for agent-to-agent commerce at volumes and ticket sizes traditional checkout rails were not built for. More than 30 partners, including Adyen, Coinbase, Stripe, Cloudflare, OKX, Polygon Labs, and the Solana Foundation, are supporting adoption, with broader access planned later in 2026. (Mastercard)

Exploits & Incidents

Humanity Protocol Loses Over $30M

Humanity Protocol’s incident update on June 9 describes coordinated attacks on June 8–9 across Ethereum and BSC after malware on a colleague’s machine exposed seven private keys. An admin hot wallet lost 6.05M H; three compromised ETH Safe keys transferred bridge ProxyAdmin to an attacker who upgraded the bridge and swept ~141.2M H; three separate BSC Safe keys enabled a malicious implementation and three 100M H mints, inflating BSC supply from ~141M to ~441M. The team said no smart-contract bug was involved, only stolen signing keys, and that BSC ProxyAdmin remains attacker-controlled with further mints possible. ETH H token and the Arbitrum bridge were unaffected; a victim recovery program and external forensics are underway.

Key Management Was the Failure Mode

Chainalysis Flags $36.7M Stolen from Unverified Smart Contracts

Chainalysis reports attackers drained about $36.7M from four DeFi protocols whose production contracts were never verified on block explorers: Truebit ($26.2M), Trusted Volumes ($5.9M), Aperture Finance ($3.2M), and Ekubo ($1.4M). Closed-source bytecode no longer deters skilled attackers when decompilers and LLMs can triage vulnerabilities at scale, and unverified code often sits outside bug bounty scopes. The firm advises verifying implementations (including proxy backends), extending bounty coverage, and adding real-time on-chain monitoring when source is withheld. (Chainalysis)

Halborn Dissects Syscoin Bridge SPV Parsing Failure

Halborn's postmortem on the Syscoin bridge hack explains that an attacker minted roughly 5B SYS (~$10M) on the UTXO side without a matching burn on NEVM. The flaw was not broken SPV cryptography but a parsing error in the bridge relay that treated a malformed proof as valid for a nonexistent burn. Halborn compares the pattern to the 2022 Nomad bridge incident: implementation logic, not the underlying proof system, failed. (Halborn)

SlowMist stats this week

2026 hacks: 162

Total amount lost in 2026: $927,702,808

Policy & Regulation

NYDFS Proposes GENIUS Act-aligned Stablecoin Regulation

Acting Superintendent Kaitlin Asrow of the New York Department, proposed a formal stablecoin rule building on DFS’s June 2022 guidance and aligning with federal requirements under the GENIUS Act. The proposal keeps prior dollar-stablecoin standards on backing, redeemability, permissible reserves, and independent audits, and adds Treasury-aligned provisions such as caps on reserves held with any single custodian and mandatory risk-management programs covering internal controls, information security, insider transactions, and service-provider arrangements. A 10-day pre-proposal comment period opened June 9, followed by a 60-day period after State Register publication. The final rule would take effect with the GENIUS Act, with a one-year transition for existing New York-licensed issuers; until then, DFS stablecoin guidance remains in force. (NY Department of Financial Services)

CFTC Proposes Prediction-market Contract Boundaries

The CFTC released a 267-page proposed rule distinguishing permissible event contracts, including sports, from restricted event contracts like terrorism, assassination, and war markets. Chair Michael Selig said additional rule makings are coming. (CFTC)

SEC Crypto Task Force Continues Receiving Industry Input

As recently as June 5th the SEC's Crypto Task Force was still accepting written input from industry stakeholders, including submissions on privacy-preserving verification for autonomous systems. These efforts reflect an ongoing open-door policy under Chairman Paul Atkins, a sharp departure from the enforcement-first posture of the prior administration. (SEC)

EU Proposes 21st Russia Sanctions Package

European Commission President Ursula von der Leyen said that the EU’s 21st Russia sanctions package extends transaction bans to 31 additional Russian banks and 20 third-country banks, crypto platforms, and oil traders accused of serving sanctioned Russians or circumventing EU measures. For the first time, Brussels would gain authority to impose a full third-country ban on crypto-asset services from jurisdictions hosting platforms that help Russia evade sanctions. Vice President Kaja Kallas said the package also bans transactions on 11 crypto platforms. Member states must approve the measures before they take effect. (European Commission)

Legislative Watch

House Crypto Tax Hearing Shows Partisan Split

The Block covered a June 9 House hearing on digital-asset taxation where lawmakers disagreed on how quickly to move on standalone crypto tax bills, versus waiting for broader market-structure legislation such as the CLARITY Act. (The Block)

(Polymarket)

Capital Allocation

Helius Acquires Light Protocol to Build Solana Privacy Layer

Helius announced that it is acquiring Light Protocol, the Solana privacy team behind original ZK syscalls (sol_poseidon, alt_bn128 operations) and ZK Compression, which the company says can cut onchain state costs by up to 1000x. Light engineers will join Helius to ship a programmable onchain privacy layer for Solana covering encrypted balances, payments, and markets with auditability and selective disclosure for institutions. CEO Jorrit Palfner said joining Helius provides the engineering depth and distribution to make privacy the default. Helius framed privacy as a prerequisite for Solana to host traditional-finance workloads rather than surveillance-scale transparency alone. (Helius)

Applied Research

Proof of Source of Funds for Onchain Asset Provenance

Researchers propose Proof of Source of Funds (PoSoF), a cryptographic framework that lets users prove deposits come only from compliant sources via zero-knowledge proofs instead of relying on inclusion lists or centralized chain analytics. Platforms verify admission in constant time, about 1.5 ms (~800k gas) on an Ethereum-compatible prototype, while the user’s intermediate transaction graph stays private. The design models UTXO and account ledgers as a unified temporal DAG, extracts a compliant sub-DAG, and uses Incrementally Verifiable Computation so proofs update in roughly 1.8 seconds per new transaction. The authors argue this moves monitoring burden off DeFi and privacy protocols onto user-side provenance with formal security properties. (arXiv)

GiAnt Corpus for Automated Smart Contract Auditing

Authors introduce GiAnt (GPT-assisted Auditing Dataset Construction), a framework that distills structured vulnerability data from real-world audit reports to overcome manual curation limits and weak granularity in existing benchmarks. GiAnt applies divide-and-conquer extraction with chain-of-thought parsing on Code4rena reports, then uses an LLM-as-judge step for quality control. Running on 388 reports produced the GiAnt Corpus with 7,711 findings across five severity levels. The team benchmarks four LLMs on vulnerability detection, code summarization, mitigation recommendation, and gas optimization to set baselines for automated auditing research. (arXiv)

Web3 Security Failures Aren't On-Chain — They're Human

Tarkan Yavas and Arslan Brömme argue in this incident-based analysis that the dominant security failures in Web3 originate not from smart contract bugs, but from off-chain systems and organizational processes. Examining high-profile breaches including Bybit (2025, ~$1.5B), Ronin Network (2022), and DMM Bitcoin (2024, ~$300M), the authors map failure patterns to OWASP and ISMS frameworks. Their key finding: existing generic security control catalogues fail to address cryptographic key management, signer governance, and human-in-the-loop risks specific to blockchain environments. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity regulations hacks crypto <![CDATA[0x36 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x36-web3-security-bulletin eU1M48DnKiUIlPMQ9JDF Fri, 05 Jun 2026 11:30:51 GMT TL;DR

  • Zcash had the nightmare bug: A critical Orchard circuit flaw could have allowed unlimited undetectable counterfeit ZEC since 2022. The emergency fork is done, but privacy means the chain cannot prove whether it was exploited.

  • Privacy wrappers met issuer reality: Circle froze, and then a court unfroze, roughly $12.5M in Zama’s cUSDC contract. The lesson: confidential balances still inherit stablecoin issuer, court-order, and pooled-contract risk.

  • Agentic payments are no longer theoretical: x402 payments on Base crossed 100M transactions in nine months, while new research highlights x402 risks, including payment-proof substitution, race conditions, and resource leakage.

  • May’s exploit pattern shifted toward trust layers: NOMINIS tracked $124.9M stolen across 11 major incidents, with bridges, admin keys, operational wallets, and access controls doing more damage than classic smart-contract bugs.

  • Gravity Bridge is the headline bridge failure: A poisoned denom registry mapping let attackers drain about $5.4M without compromising validator keys, proving again that bridge metadata and claim paths need the same scrutiny as signatures.

  • Regulators are compressing the calendar: Europe is debating stablecoin competitiveness, Australia has a June 30 AFSL deadline, the UK is moving toward September 2026 crypto authorization, and U.S. market-structure politics are back on the clock.

  • Privacy infrastructure is attracting capital and scrutiny: SOL Strategies bought HoudiniSwap for $18M, while Zcash, Zama, Houdini, and quantum-risk research all point to the same tension: privacy is becoming investable, regulated, and much harder to threat-model.

Industry Trends & Analysis

Zooko Discloses Critical Orchard Counterfeiting Bug in Zcash

Zooko Wilcox, Jason McGee, and Taylor Hornby said in a June 4 X article that Taylor Hornby found a critical soundness flaw in Zcash’s Orchard circuit on May 29 while auditing for Shielded Labs, using Anthropic’s Opus 4.8 alongside traditional review. The under-constrained elliptic-curve check could have minted unlimited undetectable counterfeit ZEC inside Orchard since the pool went live in May 2022. Hornby built a working exploit in regtest; ZODL coordinated an emergency soft fork on June 2 and NU6.2 on June 3 to disable then re-enable Orchard with a fixed verifying key. Privacy means cryptography cannot prove whether mainnet was exploited before the fix. Shielded Labs argues prior abuse is unlikely but proposes a follow-on upgrade with turnstile accounting to let anyone verify supply integrity. $ZEC is down ~30% on the news, shedding ~$4B of market cap.

USDC Freeze, Then Reversal

Circle Freezes $12.6M in Zama’s cUSDC Contract

The Block reported that a federal judge ordered Circle to blacklist Zama’s confidential USDC wrapper on May 30, freezing about $12.6M in a pooled contract tied to an Overnight Finance treasury dispute. Plaintiffs including Patagon Management alleged founder Maxim Ermilov moved more than $15M ahead of an OVN holder vote to liquidate the treasury. Zama CEO Rand Hindi said the pool was collateral damage and paused cUSDC, cUSDT, and cWETH contracts while investigating. (The Block)

Paolo Caversaccio Critiques Zama Privacy Tradeoffs

Security researcher Paolo Caversaccio posted on X after Circle blacklisted Zama’s confidential USDC contract, questioning how much privacy the cUSDC wrapper provides when issuer-level freezes can immobilize an entire pooled contract. The thread feeds the debate over whether confidential balances on public chains reduce traceability without shifting trust to stablecoin issuers and court orders. (Paolo Caversaccio on X)

US Court Lifts Circle Freeze on Zama's $12.5M cUSDC Contract

A federal judge in California's Northern District reversed the temporary restraining order that had pushed Circle to blacklist Zama's confidential USDC (cUSDC) wrapper. The underlying fraud suit continues; only the blanket contract freeze was lifted. The Defiant frames this as the first court-ordered Circle contract-level blacklist in a private civil dispute to be unwound through litigation, and notes that contract owners and innocent depositors can be heard quickly when a pooled freeze sweeps in third parties. Zama pledged "transitive compliance" so future Circle freezes on a specific USDC address propagate only to that address's cUSDC balance, plus a compliance council, KYT vendor integrations, and industry-group participation. (The Defiant)

Market Movements

Nine Months in: 100 million x402 Agentic Payments on Base

Chainalysis reported that agentic payments on Base crossed 100 million transactions in roughly three quarters, surging from near-zero in Q3 2025 before cooling in early 2026. The post treats x402 as a machine-to-machine settlement rail and a monitoring surface for unauthorized agent spend. Security teams should watch HTTP-native payment flows alongside traditional wallet screening as volume scales. (Chainalysis)

Exploits & Incidents

May’s Crypto Exploits Shift From Megahacks to Bridges and Keys

NOMINIS’ latest monthly report tallies $124.9 million stolen across 11 major incidents in May, a 79% drop from April’s roughly $585.6 million but still heavily DeFi‑driven. Cross-chain bridges accounted for 42% of top attacks, while compromised admin keys, operational wallets, and broken access controls produced the largest single losses. The report warns that attackers are pivoting from classic contract bugs to the trust layers—bridges, signers, and privileged infrastructure—that bind ecosystems together. (NOMINIS)

Gravity Bridge Drained via Poisoned Denom Registry Mapping

Rekt News explains how Gravity Bridge lost about $5.4M on May 29 without compromising validator keys. The attacker minted worthless tokens on Osmosis, IBC-transferred them to Gravity chain, then called permissionless deployERC20() on Ethereum with fabricated cosmosDenom strings that embedded real custody contract addresses. Validators signed withdrawal batches that mapped through a poisoned registry to genuine USDC, USDT, WETH, and PAXG in bridge custody. Rekt attributes the failure to missing collision checks in handleErc20Deployed; a lookup existed elsewhere in the codebase but was not invoked on the claim path, plus predictable IBC denom metadata that satisfied validation. Proceeds moved through Tornado Cash. The bridge was halted May 30. (Rekt)

Alephium Bridge Drained via Forged Guardian Messages

BeInCrypto reported that Alephium’s Wormhole-fork TokenBridge lost about $815,000 in seven minutes on May 30 when an attacker submitted malicious cross-chain messages that guardians signed. The team said private keys were not compromised and that the flaw was in message validation before signing. Blockaid and SEAL_911 assisted the response. The bridge remains offline. (BeInCrypto)

SlowMist stats this week

Total 2026 hack events: 151

Total amount lost this year: $905,221,838

(SlowMist)

Policy & Regulation

ECB’s Schnabel Pushes Digital Euro as Stablecoin Counterweight

ECB executive board member Isabel Schnabel’s June 1 speech in Seoul warned that stablecoins pose monetary-policy and dollar-dominance risks, with nearly $300 billion in circulation concentrated in USDT and USDC. Schnabel argued central banks should regulate stablecoins and offer retail CBDCs such as the digital euro. The digital euro is targeted for potential issuance around 2029. (The Block)

Coinbase Urges MiCA Tweaks for Euro Stablecoins

Katie Harries argued that the European Commission should adjust the European Commission to adjust MiCA implementation so euro-denominated stablecoins can compete with dollar tokens. Specifically she argues the Commission should loosen reserve rules (less concentration in commercial bank deposits), allow non-interest rewards (cashback, loyalty), and improve the multi-issuance model for global liquidity. Compliance teams should read it alongside the July 1 licensing cliff and the Commission’s broader MiCA review. (Coinbase)

UK FCA's Crypto Consultation Closed June 3

On June 3, the UK's Financial Conduct Authority concluded its consultation on the regulatory perimeter for crypto asset activities, covering stablecoin issuance, trading platforms, custody, and staking. The FCA confirmed final rules will be published this summer, with full regulatory authorization for crypto firms opening in September 2026 ahead of a formal regime launch in October 2027. (FCA)

CFTC Clears Coinbase to Offer Deribit Perps as Foreign Futures

The CFTC Market Participants Division issued an interpretive letter and no-action relief on May 29 in response to Coinbase Financial Markets (CFM). Staff confirmed Deribit perpetuals may be categorized as foreign futures under Regulation 30.1, leaning on the same-day Kalshi BTC PERP order for domestic bitcoin perpetuals. Subject to nine conditions, staff will not recommend enforcement if CFM posts customer-owned digital commodities and payment stablecoins with Bermuda affiliate Coinbase Bermuda to margin foreign futures and options on Deribit FZE, including when the broker re-uses collateral for Deribit margin. The relief is staff-only, not Commission rulemaking, and is limited to perpetuals structured like Deribit’s on digital commodities with active spot markets. (CFTC)

Senator Lummis Warns Delayed Clarity Act Could Push Regulation to 2030

Senator Cynthia Lummis argues that failure to pass the Clarity market-structure bill now could defer comprehensive U.S. crypto regulation until 2030, intensifying lobbying from industry groups ahead of Senate Banking Committee action.

Australia's June 30 AFSL Deadline Looms for ~400 Crypto Platforms

With just weeks remaining, Australia's Corporations Amendment (Digital Assets Framework) Bill, passed April, now requires crypto platform operators to obtain an Australian Financial Services License by June 30, 2026. An estimated 400 platforms face the compliance deadline, making it one of the most consequential near-term enforcement triggers in the APAC region. (Coca)

Legislative Watch

(Polymarket)

Capital Allocation

SOL Strategies Closes $18M Acquisition of Privacy Swap Platform Houdini

SOL Strategies completed its acquisition of HoudiniSwap LLC on June 1, 2026, a non-custodial, privacy-focused cross-chain swap aggregator, for a total of USD $18 million in a mix of cash and common shares. The deal marks a significant strategic move for SOL Strategies as it expands its crypto infrastructure footprint into the privacy and cross-chain space. That puts SOL Strategies deeper into two areas attracting growing attention from both regulators and security researchers: privacy and cross-chain infrastructure. (SOL Strategies)

Applied Research

Researchers Formalize Logic Flaws in x402 Payment Systems

Ling, Huang, Chen, Zhou, Wu, and Wang submitted the first comprehensive security analysis of the x402 ecosystem. The paper defines five security invariants and shows failures in transactional atomicity and cryptographic context binding, including cross-resource substitution of payment proofs and race conditions that duplicate paid services. On production middleware they measured resource leakage ratios up to 100% against dynamic authorization schemes. (arXiv)

Securing Elliptic Curve Cryptocurrencies Against Quantum Threats

The paper examines how Shor's algorithm could threaten ECDSA-protected assets on Bitcoin and Ethereum. The study notes Bitcoin's base layer is relatively resilient, but highlights that scaling solutions like Ethereum's Data Availability Sampling and certain privacy mechanisms introduce new quantum-attack surfaces that urgently need post-quantum cryptographic upgrades. (arXiv)



]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security hacks regulations crypto cybersecurity <![CDATA[0x35 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x35-web3-security-bulletin nm2r0YUnYQFnfkNGanp4 Fri, 29 May 2026 09:11:52 GMT TL;DR

  • DeFi’s AI-security anxiety is getting louder: OpenZeppelin co-founder Manuel Aráoz said he now treats all of DeFi as unsafe because coding agents are getting very good at finding smart-contract bugs. OpenZeppelin pushed back, and others noted recent losses still look more like operational failures than novel contract logic.

  • Compliance is becoming an engineering problem: Chainalysis and Elliptic both point to the same gap: crypto firms still over-focus on direct wallet hits while under-investing in counterparty risk, sanctions refresh cadence, travel-rule data quality, and alert triage.

  • Stablecoins keep moving toward the TradFi banking stack: SoFi launched SoFiUSD on Ethereum and Solana, while the FDIC proposed BSA and sanctions compliance rules for permitted payment stablecoin issuers under the GENIUS Act.

  • Tokenized assets are getting more institutional: Aptos and Archax are bringing 100+ tokenized real-world assets onchain. The hard part will not be chain throughput; it will be issuance, redemption, oracle integrity, and permissioned transfer controls.

  • Echo Protocol is the headline loss: A compromised admin key was used to mint about $76.7M in unbacked eBTC, then swap and bridge it out. Once again, the exploit reads less like a clever DeFi primitive bug and more like failed mint-authority control.

  • The week’s smaller incidents: RetoSwap lost about $2.7M through Haveno multisig ACK spoofing, StablR depegged after a suspected $2.8M+ mint exploit, and Polymarket lost roughly $573K-$700K from an internal operational wallet tied to an old private key.

  • Capital is flowing into trust infrastructure: Didit raised $7.5M for identity and fraud APIs, Squid raised $6M for cross-chain routing, Blocknative joined Deloitte, and Zama acquired TokenOps for confidential token distributions and vesting.

  • The research corner gets darker: New work on deniable covert asset transfers shows how staged MEV can hide value movement inside ordinary-looking DeFi activity; while smart-contract security research keeps pushing beyond detection toward semantics, repair, robustness, and real-time monitoring.

Current Outlook

The story has become less about any single exploit and more about the shape of the system around it. The incidents still matter, but the patterns match the need for holistic security. Web3 is becoming a control-design problem across protocols, wallets, agents, stablecoins, compliance systems, and operational infrastructure. It has moved out of the narrow “smart contract bug” frame and into a broader problem set.

The exploit data still matters. Wasabi, Ekubo, TAC, Verus, THORChain, Transit, TrustedVolumes, Echo Protocol, RetoSwap, StablR, and Polymarket all point to the same operational reality: losses are not coming from one failure class. They are coming from admin keys, bridge logic, deprecated contracts, wallet setup flows, mint authority, authorization checks, third-party dependencies, and weak separation between operational funds and user funds. SlowMist’s 2026 figures show the industry has incurred roughly $80M additional losses over the past four weeks. This follows April 2026 losses of over $600M, which pointed toward the largest losses ever in a single month for DeFi.

AI is making that problem harder, not simpler. MCP risk, AI-assisted scanners, prompt-injection attacks against agents, ExploitGym, ExploitBench, and Manuel Aráoz’s warning that coding agents are unusually good at finding smart-contract bugs all land on the same point: the asymmetry is getting worse. Defenders need comprehensive coverage. Attackers need one viable path. Vitalik’s formal verification argument offers the more constructive answer: AI does not make trustless systems impossible, but it raises the bar for smaller verified cores, better specifications, sandboxed edge systems, and continuous monitoring around the parts that cannot be fully proven.

Regulation is also getting more operational. Veda’s custody argument, CLARITY Act movement, Consensys’ GENIUS Act pushback, FDIC stablecoin rulemaking, Chainalysis compliance benchmarks, and Elliptic’s screening-layer argument all show the market moving from broad policy slogans into implementation detail. The practical question is no longer whether Web3 gets regulated. It is whether firms can prove they understand indirect exposure, sanctions refresh cadence, travel-rule data quality, mint authority, reserve attestations, and counterparty risk before those gaps become either enforcement issues or exploit narratives.

Capital is moving toward the same set of problems. MoonPay bought Sodot for key management. Elliptic raised $120M for on-chain intelligence. Fireblocks is pushing agentic payments. SoFi launched SoFiUSD. Aptos and Archax are bringing tokenized assets onchain. Didit raised for identity and fraud infrastructure, Zama acquired TokenOps for confidential token operations, and Blocknative joined Deloitte for transaction orchestration. Taken together, the market is funding trust infrastructure: identity, monitoring, payments, key management, regulated tokenization, and the operational plumbing around digital assets.

Meanwhile, crypto neobanks raising $200M with no CISOs remains the warning shot. The money is arriving faster than the security operating model.

Web3 security requires continuous control design across protocols, wallets, agents, stablecoins, bridges, compliance systems, and capital flows. The required security posture must be able to prove, programmatically, who can mint, who can move funds, what an agent can touch, how compliance alerts are triaged, where operational wallets are separated, and how the system behaves when one dependency fails.

Industry Trends & Analysis

OpenZeppelin Co-founder Manuel Aráoz Calls DeFi Unsafe

Manuel Aráoz, co-founder of OpenZeppelin, posted on X that he now treats all of DeFi as unsafe. Coding agents, he argues, are unusually good at finding smart-contract bugs, while defenders must patch every flaw and attackers need only one path to move funds.

OpenZeppelin was quick with its own take noting that Aráoz’s left as CTO in 2019.

The Block reported the post landed the same week as key-compromise hits on Stake DAO and Polymarket. Marc Zeller and banteg pushed back, noting most recent losses trace to operational security and parameter mistakes rather than novel contract logic. (The Block)

Chainalysis Benchmarks Crypto Compliance Blind Spots

Chainalysis released its Crypto Compliance Programs in 2026 report on how exchanges and VASPs detect indirect exposure to illicit flows. Many programs still over-index on direct wallet hits and under-invest in counterparty clustering, travel-rule data quality, and sanctions-screening refresh cadence. For security teams, the report maps where compliance tooling fails before an on-chain incident reaches public exploit trackers. (Chainalysis)

Screening, Not Headcount, Should Absorb Most Crypto Alerts

Elliptic explains that about 95% of crypto transaction monitoring alerts are operational triage, not full-blown investigations, and argues they should be resolved at the screening layer using tools like Elliptic Lens rather than pushed into expensive forensic workflows by default. By surfacing risk graphs, customer context, and AI-assisted summaries directly in the screening view, teams can clear routine alerts quickly, reserve deep investigations for complex laundering or recovery cases, and scale monitoring without linearly scaling staff costs. (Elliptic)

Market Movements

SoFi Launches SoFiUSD on Ethereum and Solana

SoFi became the first U.S. nationally chartered bank to issue a member-facing stablecoin, SoFiUSD, on Ethereum and Solana. The launch follows the GENIUS Act stablecoin framework and puts SoFi in the same race as other bank and fintech issuers building on-chain dollar rails. Reviewers should watch reserve attestation, mint/burn key custody, and bridge representations as the token leaves SoFi’s app. (Crypto Briefing)

Aptos and Archax Bring 100+ Tokenized Assets Onchain

Aptos Foundation and FCA-regulated exchange Archax said more than 100 tokenized real-world assets will trade through Archax’s engine on Aptos. CryptoBriefing framed it as regulated tokenization infrastructure on a high-throughput L1. Issuance and redemption workflows, oracle feeds, and permissioned transfer rules will matter as much as chain TPS for institutional adopters. (Crypto Briefing)

Exploits & Incidents

Echo Protocol Loses $76.7M

BeInCrypto’s autopsy describes how Echo Protocol’s admin key was used to mint about $76.7M of unbacked eBTC, then swap and bridge it out. The loss reads as operational key control failure, not a novel DeFi primitive bug. Restaking and synthetic BTC wrappers stay high-value targets whenever one key can inflate supply. (Be In Crypto)

Halborn Explains RetoSwap’s Haveno multisig ACK Spoof

Halborn’s May 25 post walks through the RetoSwap hack that drained about $2.7M in Monero from users of the Haveno-based swap interface. The attacker spoofed ACK messages in Haveno’s 2-of-3 multisig trade flow, registered as an arbitrator, and redirected settlement. The flaw sits in third-party wallet setup, not RetoSwap’s own contracts. Projects bundling external wallet stacks should treat message-authentication gaps as supply-chain risk. (Halborn)

StablR EURR and USDR Depeg After Suspected $2.8M Exploit

MiCA-compliant stablecoin issuer StablR lost more than $2.8M when attackers exploited a contract weakness to mint unbacked EURR and USDR, triggering a sharp depeg.

ZachXBT and other researchers flagged the flow on-chain. Compliance branding does not substitute for mint-authority hardening and on-chain reserve proofing. (Crypto Briefing)

Polymarket Internal Top-up Wallet Drained

Polymarket’s internal operational wallet, note not user trading balances, lost roughly $573K–$700K in a private-key compromise on Polygon. ZachXBT linked suspicious flows involving Polymarket’s UMA adapter contract. Polymarket said customer funds were unaffected.

Prediction-market operators still need strict separation between hot operational wallets and user escrow. (decrypt)

SlowMist stats this week

Total 2026 hack events: 125

The total amount of money lost this year: $883,882,604

(SlowMist)

Policy & Regulation

FDIC Proposes Bank Secrecy Act for Stablecoin Issuers

The FDIC board approved a notice of proposed rulemaking on May 22, 2026, to implement Bank Secrecy Act and sanctions compliance standards for FDIC-supervised permitted payment stablecoin issuers under the GENIUS Act. The proposal would require those issuers to follow FinCEN and OFAC AML/CFT, sanctions, and reporting rules, with supervision and enforcement aligned to FinCEN. The issuers targeted are subsidiaries of FDIC-insured state nonmember banks and state savings associations approved to mint payment stablecoins. Comments are due 60 days after Federal Register publication. (FDIC)

Legislative Watch

(Polymarket)

Capital Allocation

Didit Closes $7.5M Seed for Unified Identity and Fraud API

Didit announced on May 26, 2026 that it raised $6M in a new round, bringing total funding to $7.5M, with Y Combinator, Pioneer Fund, Orange Collective, and others participating. The company pitches a single API covering KYC, KYB, transaction monitoring, and wallet screening, aimed at crypto exchanges and fintechs that otherwise stitch separate identity and fraud vendors together. Didit claims profitability, 30%+ month-over-month growth, and more than 2,000 customers, and highlights agent-driven integration via MCP-style workflows. Spain’s Treasury, CNMV, and SEPBLAC are cited as having assessed its verification tech against in-person standards. (Didit)

Squid Raises $6M from Ripple and North Island Ventures

The Block reports on cross-chain router Squid closed $6M in strategic funding from Ripple and North Island Ventures, bringing total raise to $13.5M ahead of a consumer-facing product. Bridge and routing startups keep getting funded even as exploit losses mount elsewhere. (The Block)

Blocknative Joins Deloitte

Blocknative announced its team has joined Deloitte to work on Web3 and agentic-AI infrastructure at enterprise scale. Founder Matt Cutler said the company spent nearly a decade on mempool visibility, gas estimation, transaction orchestration, and MEV-related tooling used by wallets, L2s, and DeFi teams. Production customers should plan migration now: Blocknative API services and Gas Network will keep running through June 19, 2026, then stop responding. Blocknative Corporation is winding down operations; the site notes it has not been fully updated to reflect the transition. (Blocknative)

Zama Acquires TokenOps for Confidential Token Vesting

Zama announced on May 20, 2026 that it acquired TokenOps, a token lifecycle platform that has handled more than $2B in distributions, vesting, and compliance workflows. The deal folds TokenOps into Zama’s Fully Homomorphic Encryption (FHE) stack via the ERC-7984 confidential token standard so vesting schedules, airdrops, and recipient data can stay encrypted onchain, while issuers retain audit paths for regulators. Zama cited prior deployments including $KAIO’s institutional RWA distributions and planned confidential $ZAMA vesting on Ethereum. TokenOps will keep operating as an independent brand for issuers across chains. (Zama)

Applied Research

Extending Blockchain Untraceability with Plausible Deniability

Researchers propose deniable covert asset transfers via staged MEV. Park et al.’s asks whether blockchain transfers can hide inside ordinary DeFi activity, not just anonymity sets like mixers. They define Deniable Covert Asset Transfer (DCAT): staged sandwich and arbitrage flows where the sender looks like a routine MEV loser and the receiver like a routine winner. Prototypes on Ethereum and Arbitrum passed standard MEV detectors and unlinked sender/receiver in tested forensic setups. Because extreme losses follow power laws in the wild, the authors add a multivariate statistical triage method to rank suspicious cases for manual review rather than rely on fixed thresholds. (arXiv)

Smart Contract Security Beyond Detection

Tamer Abdelaziz frames smart contract security and research agenda beyond vulnerability scanners. He groups four active directions: foundation-model semantic reasoning, automated repair with formal validation, adversarially robust ML detectors, and real-time transaction-level exploit monitoring at chain scale. The paper ties those themes to recent work on where analyzers systematically fail and on scalable malicious-Ethereum-transaction detection (TxLens). It cites CertiK’s 2025 tally of 630 Web3 incidents and about $3.35B in losses to argue detection alone is insufficient without semantics, repair, robustness, and streaming deployment constraints. (arXiv)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity hacks exploits regulations <![CDATA[0x34 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x34-web3-security-bulletin UkV3rGnQ3oufhTdHPM7x Fri, 22 May 2026 16:28:35 GMT TL;DR

  • Zero CISOs at the wheel: Six crypto neobanks raised $200M this quarter, yet none have hired security leadership.

  • AI for Formal Verification: Vitalik argues that AI-assisted bug finding doesn't kill trustless systems; it makes formal verification cheap enough to secure core logic.

  • Major Drains: Over $23M lost across the Verus-Ethereum bridge ($11.58M) and THORChain ($11M), plus a $440k prompt injection attack on Bankr's AI agent.

  • Policy Pushback: Consensys formally challenged the FDIC’s GENIUS Act stablecoin draft, arguing against broad bans on yield and broker-dealer treatment for self-hosted wallets.

  • AI Exploitation Benchmarks: New research (ExploitGym, ExploitBench) shows models like GPT-5.5 successfully chaining exploits for arbitrary code execution on real browser engines and kernels.

Industry Trends & Analysis

Six Crypto Neobanks Raised $200M in 90 Days None Have a CISO

QuillAudits reports that six crypto neobanks collectively raised $200M in under 90 days in early 2026, yet none has appointed a Chief Information Security Officer. The piece argues that security leadership is being treated as optional infrastructure at the precise moment these platforms are accumulating the largest attack surfaces in Web3's history. (QuillAudits)

Vitalik Buterin on AI-assisted Formal Verification for Ethereum

Vitalik Buterin’s May 18 essay treats formal verification as machine-checkable mathematical proofs, often written in Lean alongside low-level implementations such as the evm-asm RISC-V EVM project. He argues AI lowers the cost of generating code and proofs together, which makes end-to-end verification more practical for STARKs, ZK-EVMs, post-quantum signatures, and consensus. The post rejects the idea that better AI bug-finding makes trustless systems impossible, but stresses limits: wrong specifications, partly unverified components, and hardware side channels. His model is a small, heavily verified secure core with sandboxed, higher-risk edge software around it.

Runtime Verification: The Risk of Open Source Code and What History Still Teaches

Runtime Verification revisits historical open source vulnerabilities to argue that lessons from well-known past incidents remain underapplied in modern Web3 development. The piece contends that dependency risk and supply chain exposure are systemic properties of open source ecosystems, not one-off events, and that formal verification offers a structural answer to a structural problem. (runtime verification)

Stacy Muur Expands On Practical Web3 Security Tooling

Stacy Muur quoted Faycy_crypto's “50+ security tools” list and added her own stack: Safe multisig, Etherscan’s approval checker, Tenderly simulation, Token Sniffer, ishoneypot, GoPlus, Chainabuse, DeFi scanner, Blockaid, and Blowfish (now part of Phantom). (Stacy Muur on X)

ChainPatrol: 10 Essential Security Practices for Web3 Users in 2026

Umar Ahmed of ChainPatrol catalogues 10 security practices Web3 users should adopt in 2026, covering wallet hygiene, phishing recognition, hardware key use, approval management, and the emerging threat of AI-assisted social engineering. The piece is framed around the observation that attacks on crypto users have matured into a structured industry with tooling, playbooks, and measurable returns on investment for attackers. (ChainPatrol)

Market Movements

Fireblocks Powers Agentic Payments Future for PSPs and Fintechs

Fireblocks' product update introduces an Agentic Payments Suite designed for payment service providers and fintechs. The announcement reflects the company's view that AI agents are already transacting on users' behalf across real financial rails, and that infrastructure for autonomous wallet-connected agents must be purpose-built rather than adapted from existing custody tools. (Fireblocks)

Elliptic Integrates With Kaia to Reach 250 Million Users Across Asia

Elliptic announced on May 20 an integration with Kaia — the blockchain powering KakaoTalk and LINE's Web3 applications — bringing Elliptic's transaction monitoring and compliance tooling to a network that serves approximately 250 million users across Asia. The partnership extends Elliptic's footprint into a consumer blockchain segment that has historically operated with limited compliance infrastructure. (Elliptic)

Exploits & Incidents

LayerZero Publishes KelpDAO Post-mortem with Mandiant and CrowdStrike

LayerZero completed a post-mortem on the April 18 KelpDAO rsETH incident with Mandiant and CrowdStrike, publishing an executive summary and full report. The company describes working with hundreds of partners over four weeks to review DVN and RPC posture, attributes the operation to DPRK-linked TraderTraitor (UNC4899), and argues the core protocol was not exploited while 1-of-1 DVN setups created unacceptable risk. (LayerZero)

Community Pushback on LayerZero's Report

Kelp and researchers dispute that 1-of-1 DVN was Kelp’s reckless choice alone; LZ previously admitted fault for allowing its DVN as sole verifier for high-value apps; ~47% of OApps reportedly shared 1-of-1 DVN; open question whether Kelp downgraded from 2-of-2. (CoinDesk, LayerZero, OAK)

Bankr AI Agent Drained via Prompt Injection on Base

The AI-powered crypto trading platform Bankr on Base suffered a social engineering attack via prompt injection, using malicious Morse code inputs to trick the Grok-powered agent into executing unauthorized transactions. Fourteen user wallets were compromised, with approximately $440,000 stolen. Bankr suspended affected functionality and pledged full reimbursement from its treasury. (SlowMist)

Verus–Ethereum Bridge Drained for $11.58M

Blockaid said its exploit detection system flagged an ongoing drain on the Verus–Ethereum bridge at roughly $11.58M. PeckShield sized the take at 103.6 tBTC, 1,625 ETH, and 147,000 USDC swapped into about 5,402 ETH sitting in 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9. PeckShield also flagged abnormal outflows to Verus from bridge contract 0x71518580f36FeCEFfE0721F06bA4703218cD7F63. Investigators describe a source–destination economic binding gap: exports can commit to payout data without matching reserves, in the same class as Wormhole and Nomad-style failures. Blockaid has pointed to missing source-amount validation in checkCCEValues as a fix. (Blockaid on X)

THORChain Pauses After $11M Asgard Vault Drain

TRM Labs reported that an attacker drained more than $11M from THORChain in a single coordinated event across at least nine chains: Bitcoin, Ethereum, BSC, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP. That figure is slightly higher than the ~$10.7M–$10.8M cited elsewhere because TRM counts additional native-chain outflows, not only the BTC/ETH/BNB/Base bundle ZachXBT and PeckShield highlighted first. (TRM)

TrustedVolumes Loses $5.87M to Broken Authorization Check

A permissionless signer function and broken authorization check in TrustedVolumes' closed-source RFQ swap proxy contract allowed an attacker to drain $5.87 million in a single transaction. The team had not posted publicly in over a year prior to the incident. 1inch confirmed its protocol and user funds were unaffected. A bug bounty line remains open. (Rekt)

Transit Finance Loses $1.88M via Deprecated 2022 TRON Contract

Official Follow Up from Transit

SlowMist Stats this Week

Total 2026 hack events: 115

The total amount of money lost this year: $865,071,984

(SlowMist)

Policy & Regulation

Consensys Urges FDIC to Narrow GENIUS Act Stablecoin Rules

Consensys filed its formal FDIC comment on payment stablecoin rules under the GENIUS Act, alongside earlier OCC and Treasury filings on state “substantial similarity.” Bill Hughes’s team argues the draft overreaches on yield: a rebuttable presumption against “related third parties” would ban ordinary distribution and brand deals Congress left out of the statute, and Consensys proposes a four-part agency test instead. The letter asks the FDIC to keep non-custodial wallets outside broker-dealer treatment when users earn DeFi protocol yield on their own, preserve supervisory discretion (including multi-brand issuance) rather than cliff-edge mandatory penalties like the OCC draft, and use technology-neutral definitions for ledgers and smart contracts while judging cross-chain stablecoins by the holder’s legal claim, not the bridge mechanism. Consensys frames the comment as the opening move in a decade-long federal stablecoin framework.

Legislative Watch

(Polymarket)

Capital Allocation

Foundation Devices Raises $6.4M for Passport Prime and AI Authorization

Foundation closed $6.4 million led by Fulgur Ventures with Arche Capital, bringing total funding to $16.5 million, and opened general sales for Passport Prime plus wider KeyOS SDK access. The pitch is hardware-enforced “human authority” for high-stakes decisions, including AI agent authorization, beyond Bitcoin custody alone. (Foundation)

Cycles Raises $6.4M Seed for Private Crypto Clearing

Cycles raised $6.4 million led by Blockchange Ventures, with Coinbase Ventures, Compound VC, and Primitive Ventures, to net obligations across venues before settlement. The pitch is collateral stuck across exchanges and OTC desks. Security work shifts toward clearing membership, surveillance, and settlement finality rather than on-chain bridge logic alone. (Cycles)

Applied Research

ExploitGym Tests Whether Agents Can Turn PoVs into Working Exploits

The ExploitGym gives agents proof-of-vulnerability inputs and asks for flag-capturing exploits across 898 real-world instances in userspace, Google's V8 JavaScript engine, and the Linux kernel. With standard defenses off, Claude Mythos Preview with Claude Code solved 157 instances and GPT-5.5 with Codex CLI solved 120 within two hours; turning defenses on cut rates but did not eliminate wins. (arXiv)

ExploitBench Ranks LLMs on Browser-engine Exploitation

ExploitBench scores models on a ladder from crashing WebAssembly bugs through arbitrary code execution on V8-class targets. Only GPT-5.5 reached full arbitrary code execution on one public Wasm bug under the primary setup; a non-public Mythos Preview reference hit that bar on 18 of 41 bugs. Wasm type-confusion progress is ahead of JIT compiler cases, a useful split when prioritizing which engine bug classes still resist automated chaining. (arXiv)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 crypto security cybersecurity regulations <![CDATA[0x33 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x33-web3-security-bulletin eIJR7ponlqY2gtQnIqYy Fri, 15 May 2026 09:56:53 GMT TL;DR

  • Nethermind breaks down frontrunning, MEV, and sandwich attacks with the kind of practical detail builders can actually use.

  • Arkham’s research team adds the investigator lens with a guide to crypto crime patterns, from pig-butchering to ransomware and exchange hacks.

  • The Enterprise Ethereum Alliance Privacy Working Group published its first enterprise privacy map for Ethereum, giving security architects a cleaner view of ZK, TEE, garbled circuits, and modular privacy options.

  • The Ethereum Foundation also launched Clear Signing, a serious push to make wallet approvals readable before users hand over the keys.

  • Lido’s Network Expansion Committee explained why Chainlink CCIP is becoming the official cross-chain rail for wstETH, with rate limits, verifier sets, mint caps, and emergency levers doing the heavy lifting.

  • Notable Capital’s Rising in Cyber 2026 map is worth a look too, especially as more tradsec companies start showing up in web3-adjacent workflows like Oligo and Endor Labs.

  • Quantstamp’s April 2026 Security Beat is grim but useful: $635M lost across 28 crypto incidents, with Web2 supply-chain problems bleeding directly into Web3 risk. The Axios npm compromise, Vercel third-party breach, and active CVEs are a reminder that protocol security does not stop at the smart contract boundary.

  • The Senate Banking Committee published a draft of the CLARITY Act ahead of committee review. The draft passed with a vote of 15–9 to advance to the full Senate. Next up, is the real test of whether Congress can turn “regulatory clarity” from a slogan into operating rules.

  • Elliptic raised a $120M Series D at a $670M valuation, a strong signal that enterprise on-chain intelligence is becoming core infrastructure for banks, exchanges, payments firms, and government teams.

  • In research, Tamer Abdelaziz’s Smart Contract Security Beyond Detection on arXiv argues the field has to move past “find the bug” tooling. The next frontier is semantic reasoning, automated repair with formal guarantees, adversarially robust detectors, and real-time exploit monitoring at blockchain scale.

Insightful

Frontrunning in Web3 and Understanding MEV

Nethermind published a practical breakdown of frontrunning, MEV, and sandwich attacks in AMMs. The post shows how bots exploit mempool visibility and weak slippage controls, with concrete code examples and developer fixes. It serves as both an educational reference and a remediation guide for teams building or auditing AMM integrations. (Nethermind)

Arkham Publishes a Guide to Crypto Crime

Arkham’s research team published a guide that walks through how pig-butchering scams, rug pulls, ransomware, and exchange hacks tend to look on-chain, and how investigators trace money after the fact. It is a great read and provides practical methods you can implement to upgrade your analysis framework based on the search patterns top teams use when deciding whether an alert is worth escalating.

Spiral and Block introduce Loupe: AI-assisted Scanner

Spiral describes Loupe as scanning-as-a-service for FOSS Bitcoin repositories: Block and Spiral run early scans, disclose findings to maintainers, then widen coverage as communication paths mature. The authors say they will only ship reports backed by demonstrable test cases to avoid drowning maintainers in noise, and they expect projects to bring their own model keys once the workflow stabilizes. Named early participants include Bitcoin Core, BDK, LDK, rust-bitcoin, Cashu, Blockstream Jade, bitcoinj, and SRI. (Loupe on GitHub)

EEA Privacy Working Group Ships its First Enterprise Privacy Map for Ethereum

The Enterprise Ethereum Alliance announced a report titled “State of Privacy on Ethereum for Enterprise,” built with seven member organizations and presented as a single map of how enterprises handle confidentiality on public Ethereum.

For security architects, it is a rare attempt to line up vendor stacks, legal constraints, and on-chain privacy techniques in one place instead of scattered blog posts. (EEA)

The Breaking Point of Ethical Security Research

BlockThreat examines a growing tension in the blockchain industry: years of investment in cultivating a community of skilled security researchers, followed by systematic undervaluation of their work and compensation. Peter Kacherginsky argues that the current model is unsustainable and risks driving the most capable defenders out of the ecosystem at exactly the wrong time. (BlockThreat)

AI Is Making Software Harder to Secure, Not Easier

Runtime Verification notes that the proliferation of AI-generated code is systematically degrading software security posture. Their post examines how AI coding tools produce code that passes surface-level tests while introducing subtle logical vulnerabilities that evade standard review and why formal methods are becoming more necessary, not less, in an AI-assisted development environment. (runtime verification)

Ethereum Foundation Launches Clear Signing to Reduce Blind-signing risk

The Ethereum Foundation announced Clear Signing, a push to replace opaque calldata approvals with structured, human-readable descriptions of assets in motion, counterparties, and permissions. Public write-ups tie the effort to ERC-7730-style transaction descriptors, an attestation layer for descriptor integrity, and a public registry reviewed by security researchers, with several major wallets and custody vendors listed as collaborators. (Ethereum Foundation)

Companies in the news

Lido Explains Why They Chose Chainlink CCIP

The Network Expansion Committee is making Chainlink CCIP plus the Cross-Chain Token standard the official cross-chain rail for wstETH, migrating supported chains in stages while keeping Direct Staking from existing L2s on the same infrastructure instead of bolting on yet another one-off adapter per network. Prior to this most multichain wstETH sat on DAO-recognized canonical bridges, so every destination had its own wiring, its own monitoring load, and (where exits were optimistic) roughly a week to pull liquidity back to Ethereum mainnet. With the move to CCIP Lido contributors emphasize protocol-level properties they are able to access by default, including: sixteen-plus independent verifiers per lane, per-lane rate limits that act like circuit breakers, lanes that only bridge between mainnet and a single destination instead of a meshed graph, issuer-owned mint caps and emergency levers, and off-chain monitoring. (Lido)

Notable Capital Drops its 2026 “Rising in Cyber” Map

Leaning into the tradsec toolkit here, but worth a mention as web3 goes more mainstream. Rising in Cyber is Notable Capital’s annual microsite for 30 private cybersecurity startups the firm is highlighting as especially worth watching. The list is chosen with input from roughly 150 CISOs and senior security operators and grouped by funding stage (early $1M–$35M, mid $35M–$100M, late $100M+, with figures described as Q1 2026). Amongst this list, companies like Oligo and Endor Labs are already tapping into the web3 space. Also see the linked “Rising in Cyber 2026” report, which turns down the hype and focuses on the data. (Rising Cyber)

Gimme the loot

April 2026 Security Beat: Same Actors, New Targets

Quantstamp's monthly security roundup for April 2026 tallies $635M lost across 28 crypto incidents in the month. Highlights include the compromise of the Axios npm package exposing an estimated 600,000 installs in three hours, a Vercel breach through a third party, and three major CVEs under active exploitation. The write up shows a continued blending of Web2 supply chain risk with Web3 protocol exposure. (Quantstamp)

TAC Cross-Chain Layer Exploited for $2.8M on TON Side

SlowMist reports that TAC's cross-chain layer suffered an exploit on the TON side by an external attacker, resulting in a loss of approximately $2.8M across USDT, BLUM, and tsTON. The TAC token, TON, and all ERC-20 tokens bridged from Ethereum are unaffected.

The bridge has been paused while forensic analysis and remediation continue, with the team working with law enforcement and pledging to make users whole. (SlowMist)

SlowMist stats this week

Total 2026 hack events: 102

The total amount of money lost this year: $825,293,017

We must have regulations

CLARITY on the Move

Senate Banking Committee Published the Draft CLARITY Act Ahead of a Key Review this Week

The bill is the most comprehensive US crypto market-structure package this far along, aimed at ending SEC vs. CFTC limbo by defining what counts as a commodity vs. a security and what exchanges, brokers, and custodians must do, with explicit carve-outs for non-custodial builders and validators on money-transmitter risk.

(Congress.gov)

The Senate Banking Committee reviewed the CLARITY Act on Thursday May 14th, the bill that would define SEC and CFTC jurisdiction over digital assets and establish a legal operating framework for US crypto markets. Banking groups pushed back on the compromise text on May 9. The next stage shapes the bill's trajectory toward Senate floor consideration and the White House's July 4 passage target.

(Polymarket)

Senate Banking Clears CLARITY

The Senate Banking Committee voted 15–9 to advance the Digital Asset Market Clarity Act to the full Senate. But the act isn't over the hill yet. The committee's text still has to merge with the Senate Agriculture companion from January and Democrats want ethics language tied to crypto holdings that didn’t make Thursday’s committee text. Clearing with 60-votes in the Senate still looks like a real fight. (Defiant)

Consensys Counsel Flags a DeFi Securities Gap

On X, Bill Hughes argued that a narrower securities question for DeFi is still under-discussed even while the industry cheers new SEC interpretive guidance on token taxonomy and Trading and Markets staff guidance on neutral crypto self-custody user interfaces. He points readers to a Consensys comment letter that asks the Commission for a safe harbor for certain self-custody software providers, which is directly relevant to wallet and trading-interface teams operating in the U.S. (Bill Hughes on X)

VCs & funding

Elliptic Closes $120M Series D at $670M valuation

Elliptic announced a $120M Series D led by One Peak, with Nasdaq Ventures, Deutsche Bank, and the British Business Bank joining. The company is now marked at a $670M valuation and the round will fund enterprise on-chain analytics for banks, payments firms, exchanges, and government users. Elliptic reports screening more than one billion transactions weekly for 700-plus customers in 30 countries, with asset and entity coverage across 65-plus blockchains and AI-assisted triage layered on that dataset. (Elliptic)

TheDAO Security Fund

EtherWorld described a Giveth-hosted quadratic funding round backed by a 500 ETH matching pool from TheDAO Security Fund, aimed at audits, tooling, and defensive research across Ethereum. The format matters because small security teams that rarely clear venture diligence can still earn matching weight if their work is broadly valued by contributors. (EtherWorld)

AmericanFortress Closes an $8M Seed for Quantum-resistant Transaction Security

AmericanFortress raised $8M to harden transaction signing against long-run quantum threats to classical elliptic-curve assumptions, including patent filings around alternative signing paths.

Near-term exploit risk from quantum hardware is still remote, but custody and bridge architects use rounds like this to budget for trust-anchor rotations that take years, not weeks. (Hackernoon)

Research corner

UniDetect Uses LLM Summaries to Flag Fraud

The UniDetect preprint sketches a pipeline that turns raw transactions into short natural-language summaries plus graph features, then trains detectors on top; the authors report strong cross-chain zero-shot fraud metrics on benchmark datasets. Incident-response teams get an example of where LLMs might replace bespoke parsers for new bridges or rollup variants. (arXiv)

Smart Contract Security Beyond Detection

Tamer Abdelaziz outlines a maturing research agenda for smart contract security that pushes far beyond simple vulnerability detection. The paper maps four key directions: foundation-model-based semantic reasoning, automated repair with formal guarantees, adversarial robustness of learned detectors, and real-time exploit monitoring at blockchain scale. (arXiv)

LLMs as Smart Contract Auditors: Promising but Unreliable

Susan Ștefan-Claudiu, Arusoaie Andrei, and Lucanu Dorel benchmark 15 large language models against a paired smart contract vulnerability dataset to assess whether AI can replace, or only complement, traditional static analysis tools like Slither. Their findings are sobering: LLMs suffer from significant lexical bias, inflated false positive rates, and inconsistent behavior under varied prompting strategies. The study concludes that hybrid LLM-plus-static-analysis pipelines are the most viable near-term path for secure Ethereum contract development. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity hacks blockchain crypto regulations <![CDATA[0x32 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x32-web3-security-bulletin 2CSipWSNVhPYJB6cbqUM Fri, 08 May 2026 12:13:32 GMT TL;DR

  • Does ZachXBT ever sleep? This week he teamed up with Tether, Binance, OKX and US law enforcement for a coordinated shutdown of BG Wealth Sharing Ponzi scheme.

  • Connect everything with MCP right? Maybe not, "MCP executes local commands before verifying whether those commands are legitimate." Rekt dives in on the protocol's shaky history and known flaws.

  • KelpDAO is out with their own post incident analysis. Hey it's just a $300M loss no need to point fingers right? Wrong, and Kelp wants to set the record straight.

  • Admin key compromise results in Wasabi protocol losing $5.9M. Multisig? Nah...we got this!

  • Probably a good time to dig into Veda's proposal which argues that non-custodial smart-contract vaults can satisfy SEC qualified custody rules and CFTC segregation requirements, if guardrails like "robust security and operational controls" are in place.

  • MoonPay has acquired Sodot, a crypto key management firm that secured over $50 billion in transactions and safeguarded 10+ million wallets. The deal forms the backbone of MoonPay Institutional, a new offering.

  • Your LLM just needs a little guidance, the paper "Tailored Prompts, Targeted Protection: Vulnerability-Specific LLM Analysis for Smart Contracts," outlines an approach using precise AST-based context extraction and vulnerability-specific prompt design to instantiate customized detectors for 13 prevalent vulnerability categories.

Insightful

ZachXBT Helps Bring Down the BG Wealth Sharing Ponzi

ZachXBT reports the DSJ Exchange (DSJEX) / BG Wealth Sharing Ponzi scheme collapsed and claims $92M+ was laundered cross-chain from April 27 to May 3. His thread notes a joint effort with Tether, exchange security teams, and US law enforcement froze $41.5M+, and includes a screenshot describing a TRON USDT freeze action and impacted addresses.

The AI Protocol Stack Nobody Audited

Rekt News examines the security exposure introduced by the Model Context Protocol (MCP), an AI integration layer increasingly wired into crypto and any AI-first organization. The protocol has been exploited more than a dozen times since 2025, with one attacker reportedly using Claude to breach nine Mexican government agencies. The piece warns that crypto firms running MCP connections may be unknowingly exposing on-chain operations and internal communications to adversaries. (Rekt)

Cyfrin Launches Cygent BattleMode for Adversarial Smart Contract Testing

Travis Montgomery at Cyfrin outlines Cygent's BattleMode feature, which runs adversarial simulations against smart contracts to determine which flagged vulnerabilities are actually exploitable. The post positions BattleMode as a shift away from traditional PDF-based audit reports toward continuous, evidence-based security engineering integrated directly into development workflows. (Cyfrin)

QuillAudits: Deployer Wallets Are Zero-Day Vulnerabilities

QuillAudits published a security advisory on April 29, 2026, arguing that deployer wallets used by Web3 founders represent persistent, unmitigated attack surfaces. The post outlines how a compromised deployer wallet can enable contract upgrades, fund drains, and full protocol takeovers, and presents concrete mitigations including wallet rotation, hardware signer enforcement, and post-deployment privilege revocation. (QuillAudits)

Companies in the news

Kelp Challenges LayerZero’s Post-Incident Claims

Kelp published a post about an April 18 incident it attributes to LayerZero Labs infrastructure, claiming $300M+ in losses across protocols and saying it blocked additional forged transactions after pausing contracts. It disputes LayerZero’s claim that a KelpDAO misconfiguration was the root cause, and points to the response timeline and third-party analysis.

Gimme the loot

Wasabi Protocol Loses $5.9M in Admin Key Exploit

Rekt News reports that Wasabi Protocol's admin key was compromised, enabling UUPS contract upgrades across over a dozen vaults on four chains, all without a multisig or timelock in place. The attack drained $5.9 million before users received any alert, capping what the publication calls DeFi's worst month on record. April 2026 saw a cascading series of exploits that exposed the industry's persistent governance gaps. (Rekt)

Ekubo Protocol Suffers $1.4M Callback Exploit on Ethereum

An attack on Ekubo Protocol's custom Ethereum extension contract on May 5, 2026. A flaw in the IPayer[.]pay callback allowed attackers to exploit prior ERC-20 approvals by routing through the Core locking mechanism, designating any approved user as the payer. Approximately $1.4 million was drained; users who had not granted token approvals to the V2 contract were unaffected.

SlowMist stats this week

Total 2026 hack events: 91

The total amount of money lost this year: $805,554,514

We must have regulations

Veda Urges SEC & CFTC to Recognize Vaults as Compliant Custody

Veda Tech Labs Inc. submitted written input to the Joint SEC-CFTC Harmonization Initiative arguing that non-custodial smart-contract vaults can satisfy SEC qualified custody rules and CFTC segregation requirements, provided they eliminate unilateral withdrawal authority, embed programmatic redemption rights, and cryptographically segregate client assets. The firm proposes a seven-condition "guardrail" compliance pathway, including constrained governance and independent audits, and recommends coordinated rule making under the 2026 MOU to establish a unified vault-based custody standard across both agencies. (SEC)

US Treasury Proposal for Stablecoin Issuers

A summary write-up covers a proposed US Treasury rule that would treat certain stablecoin issuers more like Bank Secrecy Act financial institutions. If enacted as described, teams should expect tighter requirements around KYC/AML controls, monitoring, and cooperation, especially at issuance and redemption choke points. (Money Laundering Watch)

Chainalysis Breaks Down Crypto Sanctions and Illicit Payment Rails

Chainalysis’ sanctions chapter in its 2026 Crypto Crime Report ties sanctions evasion to concrete patterns: which rails get used, what stablecoins show up, and where compliance pressure is likely to land (issuers, on/off-ramps, and service providers).

It reads like a threat-model document for policy-driven fraud and laundering, with links out to the underlying events it references. (Chainalysis)

FCA Issues Operational Guidance for Firms Preparing for the UK Crypto Regime

A practical checklist-style overview of what firms should do while preparing for the UK crypto-asset regime, including governance and authorization posture. Even if the content is non-technical, it drives the work that security and compliance teams end up doing: controls, documentation, and operational readiness. (FCA)

And We Have CLARITY?

Big spike in the odds this week.

(Polymarket)

VCs, deals & funding

MoonPay Acquires Sodot to Launch Institutional Digital Asset Infrastructure

MoonPay has acquired Sodot, a crypto key management firm that secured over $50 billion in transactions and safeguarded 10+ million wallets for clients including eToro, BitGo, and Exodus. The deal forms the backbone of MoonPay Institutional, a new platform offering self-hosted MPC key management, NYDFS-regulated custody, cross-chain liquidity across 200+ networks, and stablecoin infrastructure for banks, asset managers, and trading firms. Former acting CFTC Chairman Caroline D. Pham will lead the business. (Moonpay)

Research corner

Smart Contract Analysis with Vulnerability-Specific Prompting

The authors propose “prompting by vulnerability class” for LLM-based smart contract analysis, aiming to improve detection signals compared to generic audit prompts. Their approach uses precise AST-based context extraction and vulnerability-specific prompt design to instantiate customized detectors for 13 prevalent vulnerability categories. The work is most applicable for teams building triage tooling or running structured scans across a fixed vulnerability taxonomy. (arXiv)

V2E: Exploit Generation Based Confirmation

V2E automates the exploit generation process through a novel combination of PoC generation, validation, and refinement. Speed to execution for audit teams is improved by workflows that separate theoretical findings from those that can be triggered and monetized. (arXiv)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 cybersecurity hacks regulations <![CDATA[0x31 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x31-web3-security-bulletin DM00qKjoDBR5jbSMb7aw Fri, 01 May 2026 08:03:36 GMT TL;DR

  • Trail of Bits keeps innovating, check out Trailmark which turns source code into a queryable call graph with semantic metadata.

  • Nethermind's fine tuned AuditAgent shows 67% post-validation recall, outperforming Claude Opus 4.6 at 47% and GPT-5.2 at 38%.

  • Using AI agents in production with security-sensitive workloads? Check out Hacken's post on securing OpenClaw.

  • The news flow on the $290M KelpDAO keeps coming, as always great analysis from Rekt. Metrika also covers how real-time on-chain monitoring fits into the security controls required in DeFi.

  • Not your crypto: sanctions get real. The U.S. Department of the Treasury’s Office of Foreign Assets Control blocks $344M in Iran-linked assets, while the EU cracks down on Russia.

  • ILITY Network announced a $2M strategic round for a privacy-preserving cross-chain verification and ZK data interoperability stack.

  • In research, check out CONFETTY, an open-source web application that enforces data confidentiality in public blockchain environments without sacrificing transparency.

Insightful

Trailmark Turns Code into Graphs

Trail of Bits released Trailmark, a library that turns source code into a queryable call graph with semantic metadata. It supports Solidity and other languages, and is aimed at questions like “can untrusted input reach this function?” and “what calls into this code path?” For smart contract auditors, it is another option for repeatable reachability checks and code-structure queries without wiring up a custom analysis pipeline. (Trail of Bits)

AuditAgent on EVMBench: 67% Recall vs. 47% for Claude Opus 4.6

Nethermind ran its AuditAgent AI security tool across all 40 EVMBench repositories and published results showing 67% post-validation recall, outperforming Claude Opus 4.6 at 47% and GPT-5.2 at 38%. The post argues that recall-only benchmarking is insufficient and examines what the data reveals about the current state of AI-augmented security tooling. (Nethermind)

Hardening OpenClaw AI Agents on Aleph Cloud: A Step-by-Step Defense Guide

Hacken published a tiered security hardening guide for deploying OpenClaw AI agents on Aleph Cloud. Drawing on its LLM red teaming and prompt injection research, the guide covers private VPS binding, filesystem allowlisting, credential encryption, MCP server supply chain hygiene, and monthly red team exercises. If you are using AI agents in production with security-sensitive workloads it's worth a read. (Hacken)

The Kelp–Aave Incident Shows how Bridge Risk Becomes Lending Risk

Metrika’s write-up tracks how a failure in rsETH issuance and cross-chain verification flowed into Aave V3 through collateral deposits and fast borrowing. Aave’s contracts behaved as designed; the weak point was the trust boundary around bridged collateral. The post is details the on-chain timeline of events (drain → distribution → deposits → borrowing), the operational outcomes (freezes, utilization spikes, and governance-driven loss allocation) and how real-time on-chain monitoring fits into the security controls required in DeFi. (Metrika)

European Police Dismantle €50M Crypto Investment Fraud Ring

Austrian and Albanian authorities dismantled a criminal network running a large-scale cryptocurrency investment fraud operation that caused estimated losses exceeding €50M ($58.5M) to victims worldwide. The coordinated operation resulted in multiple arrests across both countries. (Bleeping Computer)

Gimme the loot

Rekt Covers the KelpDAO Bridge Attack

DPRK-linked hackers poisoned LayerZero's DVN infrastructure by compromising RPC nodes, forging a bridge message, and releasing ~$290M in rsETH from KelpDAO in a single transaction without breaking a single line of code. Aave was left with hundreds of millions in bad debt. LayerZero has since decommissioned all affected nodes and confirmed DVN recovery. (Rekt)

Volo Protocol Loses $3.5M to Compromised Admin Key on Sui

A private key compromise, likely via social engineering, enabled an attacker to drain approximately $3.5M from Volo's WBTC, XAUm, and USDC vaults on Sui. Volo detected the breach swiftly, froze all vaults, and coordinated with the Sui Foundation to recover nearly all funds, resulting in a net loss of just $60K, a notable case of effective incident response. (Rekt)

SlowMist stats this week

Total 2026 hack events: 71

The total amount of money lost this year: $777,004,028

We must have regulations

UK FCA Disrupts Suspected Illegal P2P Crypto Trading

The FCA says it targeted eight London locations in a joint operation with HMRC and SWROCU to disrupt suspected unregistered peer-to-peer crypto trading. It issued cease-and-desist letters and gathered evidence for ongoing criminal investigations, describing unregistered P2P activity as a financial-crime risk under UK AML rules. The message is straightforward: OTC-style “informal” trading venues are squarely in scope for enforcement. (FCA)

ESMA Sets Expectations for MiCA’s July 1, 2026 Deadline

The European Securities and Markets Authority’s statement clarifies supervisory expectations as MiCA transitional periods end across the EU on July 1, 2026. It expects unauthorized CASPs to have implemented wind-down plans by that date, including client off-boarding and asset transfers to authorized providers or self-hosted wallets. It also reiterates limits on third-country provision of MiCA services outside narrow reverse-solicitation cases. (ESMA)

Record OFAC Action Blocks $344M in Iran-Linked Crypto Assets

Chainalysis reports on the U.S. Department of the Treasury’s Office of Foreign Assets Control update on April 24 designation targeting a network of wallets and entities linked to the Central Bank of Iran and IRGC-affiliated actors. The action blocked approximately $344M in digital assets and named shipping firms and tanker vessels used as vehicles for sanctions evasion via cryptocurrency. (Chainalysis)

EU's 20th Sanctions Package Targets the Infrastructure of Crypto Evasion

Elliptic examines how the EU's 20th Russia sanctions package goes beyond prior measures by directly targeting the underlying architecture of crypto-enabled sanctions evasion, naming specific exchange typologies and obfuscation methodologies for the first time. (Elliptic)

Seeking CLARITY

(Polymarket)

VCs & funding

ILITY Network Raises $2M for ZK Data Interoperability

ILITY Network announced a $2M strategic round for a privacy-preserving cross-chain verification and ZK data interoperability stack. If the project delivers, it would sit in the same “security plumbing” category as other attempts to reduce trust assumptions across cross-chain data paths. The announcement is clean example of funding flowing to privacy/security-adjacent infrastructure rather than apps.

Research corner

CONFETTY Brings Data Confidentiality to Public Blockchain Process Execution

Researchers present CONFETTY, an open-source web application that enforces data confidentiality in public blockchain environments without sacrificing transparency. The platform uses smart contracts for public interaction enforcement alongside attribute-based encryption for fine-grained access control, bridging the gap between private permissioned chains and fully transparent public ledgers. (arXiv)

Blockchain and AI Security Synthesis Proposes Unified Evaluation Blueprint

The paper synthesizes fragmented research on blockchain-AI security for intelligent networks into three lanes: (i) a taxonomy of blockchain-AI security for intelligent networks, (ii) integration patterns for verifiable and adaptive security workflows, and (iii) the Blockchain-AI Security Evaluation Blueprint (BASE), a reporting checklist spanning AI quality, ledger behavior, end-to-end service levels, privacy, energy, and reproducibility. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security hacks tools regulation cybersecurity ai agents <![CDATA[0x30 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x30-web3-security-bulletin dFHRmlbYuxfgCClXbCml Fri, 24 Apr 2026 10:30:32 GMT TL;DR

  • North Korea's Lazarus Group exploited KelpDAO's LayerZero bridge on April 18, stealing $292M.

  • Equally as shocking and being intensely debated: Arbitrum Security Council's emergency freeze of 30,766 ETH from the KelpDAO hacker.

  • Bybit CEO Ben Zhou discuses lessons learned and web3 incident response stemming from the 2025 $1.5B hack.

  • Did you order a hardware wallet to keep your funds safe? A Brazilian security researcher discloses a sophisticated counterfeit Ledger Nano S+ operation.

  • Inco announced a $5M strategic round and described "Inco Lightning" as a TEE-backed confidentiality layer. The funding round was led by Andreessen Horowitz Crypto Startup Accelerator (a16z CSX).

  • Mirage announced a seed round and a closed alpha for a privacy protocol that avoids shared mixer pools by using transaction-specific escrow and coordinated settlement. The round was led by Seed Club Ventures and Kyber Knight.

  • Dr. Kelly Coulter of Elliptic provides a practical guide for UK crypto firms preparing for FSMA authorization. She notes that firms using AI in compliance controls must be able to explain algorithmic outputs to regulators.

  • In research, AI-Powered Smart Certificates, Stefan Behfar and Jon Crowcroft propose AI-powered "smart certificates" as programmable, continuously learning trust artifacts that blend on-chain verifiability with off-chain ML signals.

Insightful

Code is Law? Decentralized Protocols and DAOs?

The Arbitrum Security Council's emergency freeze of 30,766 ETH from the KelpDAO hacker has ignited one of the most active "code is law" debates in years. Here's a breakdown of where the debate is hottest and who is saying what.

What makes this debate unusually sharp is the mechanism Arbitrum used. Rather than simply freezing an address, the Security Council reportedly without possessing the hacker's private key, executed a transaction in the hacker's name, essentially impersonating the attacker to move the funds to a governance-controlled wallet. This means the debate isn't just about fund freezes — it's about whether a council can unilaterally rewrite chain state and issue transactions from any address. (TechFlow)


Camp

Core Argument

Pro-freeze

Emergency safeguards are a feature, not a bug. If the capability exists and isn't used to stop a nation-state theft, the chain fails its users. Hybrid security is the mature model.

Anti-freeze

The moment a council can move funds without a private key, permissionlessness is dead. Today it's a hacker; tomorrow it could be anyone. The precedent is more dangerous than the hack.


Lessons Learned from the $1.5B ByBit Hack and Web3 Incident Response

Fake Ledger Nano S+ Found Exfiltrating Seeds

Past_Computer2901, a Brazilian security researcher and founder of High Code, discloses a sophisticated counterfeit Ledger Nano S+ operation sourced from a Chinese marketplace. The fake device uses an ESP32-S3 chip (with sanded markings) instead of Ledger's genuine ST33 Secure Element, runs non-existent firmware version "V2.1," stores seeds and PINs in plain text, and beacons to a C2 server at kkkhhhnnn[.]com — immediately exfiltrating any entered seed across ~20 supported blockchains. The operation spans five vectors: counterfeit hardware, a malicious Android APK signed with a debug certificate, a Windows .EXE, a macOS .DMG resembling AMOS/JandiInstaller campaigns, and an iOS TestFlight build. (Reddit)

Ledger Official Link
#StopTheScammers

Ongoing phishing campaigns

Certora Hardens 1inch's Cross-Chain Commit-Reveal Swap Mechanism

Ilya Leybovich of Certora describes the firm's security review of 1inch's cross-chain swap infrastructure, which uses a commit-reveal design to eliminate reliance on centralized bridges or complex oracle systems. Certora's review focused on timing window integrity, safety deposit alignment, and fee configuration accuracy, areas where small misalignments can result in stuck funds or broken incentives. The engagement highlights that protocol security is an ongoing discipline rather than a pre-launch checkbox. (Certora)

Five Crypto Risk Typologies Every Financial Institution Must Know

Elliptic outlines five key crypto financial crime categories that financial institutions face: drug-related money laundering, fraud and social engineering (including pig-butchering and AI deepfake scams), obfuscation via cross-chain laundering, sanctions evasion, and state-sponsored cyber theft. With over $21.8 billion laundered cross-chain since 2023, single-chain monitoring is no longer sufficient. Blockchain analytics covering multi-chain tracing, wallet screening, and indirect exposure detection is positioned as baseline compliance infrastructure for any FI engaging with digital assets. (Elliptic)

Hexens: Gröbner Bases in Cryptanalysis — Attacking Poseidon (Part 2)

The Hexens team publishes Part 2 of their Gröbner basis cryptanalysis series, demonstrating an attack on a reduced-round Poseidon hash instance by recovering a preimage from its digest. Building on the algebraic machinery introduced in Part 1, the post walks through a practical polynomial system construction and shows how Buchberger's algorithm can be applied to break cryptographic hash functions under reduced-round assumptions. The work has direct relevance to ZK proof systems that rely on Poseidon for hashing. (Hexens)

Wonderland CTF 2026: Fixed Deposits Challenge Results

Runtime Verification announces the results of the Wonderland CTF 2026 Fixed Deposits challenge, a community competition designed to stress-test formal verification skills. The post covers the challenge outcomes and continues RV's pattern of using CTF events to surface rare bugs and advance formal methods tooling, including Kontrol and Simbolik, among the broader developer community. (runtime verification)

Checkout the Wonderland CFT Leaderboard and Solutions

Companies in the news

Certora Releases Prover Version 8.11.3

Shane Runquist announces the release of Certora Prover Version 8.11.3, which includes a set of new features for the formal verification toolchain. The update continues Certora's regular cadence of improvements to its flagship Prover product, used to formally verify smart contracts across Ethereum, Solana, and Stellar. (Certora)

Gimme the loot

Lazarus Group's $292M KelpDAO Bridge Exploit Dissected

The Chainalysis Team details how North Korea's Lazarus Group exploited KelpDAO's LayerZero bridge on April 18, stealing ~$292 million in rsETH — not through a smart contract bug, but by compromising off-chain RPC nodes and DDoSing external validators to forge a phantom token burn. A 1-of-1 DVN configuration gave attackers a single point of failure. Rapid contract pausing and the Arbitrum Security Council's freeze of 30,766 ETH limited further damage. The incident underscores that cross-chain invariant monitoring, not just transaction-level scanning, is essential for bridge security. (Chainalysis)

SlowMist stats this week

Total 2026 hack events: 67

The total amount of money lost this year: $762,115,414

We must have regulations

UK Publishes Draft Amendments to the 2026 Cryptoassets Regulations

The UK government published a policy note for a draft statutory instrument amending the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. The note describes changes intended to smooth stablecoin payment services authorization and perimeter issues while broader payments reforms roll out, while keeping lending/borrowing activities in scope for FCA rulemaking. (GOV.UK)

UK FCA's New Cryptoasset Regime: What Your AML Framework Needs Now

Dr. Kelly Coulter provides a practical guide for UK crypto firms preparing for FSMA authorization, which opens September 30, 2026. The FCA's expectations are a qualified Money Laundering Reporting Officer (MLRO), a structured Business-Wide Risk Assessment (BWRA), a Customer Risk Assessment aligned to that BWRA, and explainable transaction monitoring. These requirements are already enforced under current MLR registration and will carry forward. Firms using AI in compliance controls must be able to explain algorithmic outputs to regulators. Authorization windows open in September, leaving only months to shore up common weaknesses. (Elliptic)

CLARITY Tracker Down!

(Polymarket)

VCs & funding

Inco Bets on TEEs Now and FHE Later for Confidential Onchain Apps

Inco announced a $5M strategic round and described "Inco Lightning" as a TEE-backed confidentiality layer for existing chains, starting with Ethereum/Base. The release ties confidentiality to compliant payments and "private DeFi," and lists ecosystem work around confidential token standards and industry groups (including OpenZeppelin and Zama). The funding round was led by Andreessen Horowitz Crypto Startup Accelerator (a16z CSX). (Blockchain Wire)

Mirage Seed Round for "Pool-less" Private Stablecoin Transfers

Mirage announced a seed round and a closed alpha for a privacy protocol that avoids shared mixer pools by using transaction-specific escrow and coordinated settlement. The pitch is "privacy without the stigma" of obvious privacy-system interactions, with settlement claims under two minutes on Ethereum mainnet and seconds on faster EVM networks. The team says it targets payroll and B2B transfers as much as retail payments. The seed round was led by Seed Club Ventures and Kyber Knight and others. (Chainwire)

Research corner

AI-Powered Smart Certificates: Toward Adaptive Web3 Security

Stefan Behfar and Jon Crowcroft argue that static, tool-centric defenses like MythX and PhishTank are structurally insufficient against today's cross-layer Web3 threats, from reentrancy exploits on Ethereum to large-scale DeFi manipulation. Their position paper, updated on arXiv this month, proposes AI-powered "smart certificates" as programmable, continuously learning trust artifacts that blend on-chain verifiability with off-chain ML signals across wallet, application, and smart contract layers. The framework targets phishing, Sybil attacks, API exploits, and smart contract vulnerabilities with real-time, automated response, a meaningful evolution beyond isolated auditing tools. (arXiv)

MEV-ACE: Identity-Authenticated Fair Ordering for Proposer-Controlled MEV Mitigation

MEV-ACE proposes a single-slot commit/open ordering protocol that binds participants to registered economic identities and uses threshold receipts plus VDF-delayed randomness. The paper argues this reduces unilateral proposer discretion for front-running, sandwiching, and censorship against admitted transactions under explicit cryptographic and economic assumptions, without requiring threshold decryption committees. (arXiv)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity hacks exploits regulations