W3SB https://paragraph.com/@w3sb Crypto and web3 security insights, including tools, hacks, and regulations. Tue, 10 Nov 2026 02:41:16 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en W3SB https://img.paragraph.com/cdn-cgi/image/format=auto/https://storage.googleapis.com/papyrus_images/2d636c4823f008bfbeba45f964abfea7ddf314da1d7f3cf57fc0ce0e19a4278b.jpg https://paragraph.com/@w3sb All rights reserved <![CDATA[0x58 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x58-web3-security-bulletin M7k7O8eO93zVZcIipQJT Sun, 08 Nov 2026 17:23:31 GMT TL;DR

  • Industry Trends & Analysis: AI is accelerating both blockchain attacks and defenses, while the Binance breach underscores the need for tighter signing controls, transaction limits, and faster laundering detection.

  • Market Movements: Gate’s new Proof of Security framework tests whether exchanges can absorb a complete hot-wallet loss, not merely prove that reserves exist.

  • Exploits & Incidents: A brutal week exposed systemic weaknesses across banking providers, exchange signing systems, unpatched payment servers, compliance infrastructure, and SaaS supply chains.

  • Policy & Regulation: Hong Kong advanced cross-border crypto tax reporting, while Italy intensified MiCA enforcement by blocking unauthorized service providers.

  • Capital Allocation: Quranum raised $4.5M to develop an integrated platform spanning tokenized assets, DeFi services, treasury infrastructure, and a planned stablecoin.

  • Applied Research: New research uncovered 4.67M malicious EIP-7702 delegations and a Soroban SDK flaw capable of enabling duplicate privacy-pool withdrawals.

Industry Trends & Analysis

Ethereum Security Leaders Examine AI's Double-Edged Impact on Blockchain Security

At Devcon 2026, Vitalik Buterin, Mooly Sagiv, Fredrik Svantes, and Josselin Feist examine how AI is reshaping Ethereum security. The discussion explores AI-assisted vulnerability discovery, automated code analysis, and the growing role of formal verification in smart contract development. Sagiv advocates defining security specifications early and using AI to make verification more accessible. Buterin emphasizes protecting the entire technology stack, beyond smart contracts, while introducing spending limits and human authorization for autonomous financial agents. The panel highlights a central challenge: AI accelerates both offensive and defensive capabilities, making rigorous verification increasingly important. (Ethereum Foundation on YouTube)

Four Priorities for Securing Wallet Signing Infrastructure

The Trail of Bits team outlines four recommendations for strengthening institutional wallet security. First, restrict access to signing infrastructure and independently validate signing requests. Second, treat EIP-7702 delegation as an administrative privilege requiring explicit authorization and policy enforcement. Third, limit the impact of compromised signing systems through independent custody controls, withdrawal delays, and tested incident response. Fourth, monitor changes in wallet authority across delegations, multisig modules, and ERC-4337 operations, not just asset transfers. Trail of Bits emphasizes continuous testing to ensure security controls remain effective as wallet architectures evolve. (Trail of Bits)

North Korean Hackers Used Fake Job Interviews to Prepare for Binance Attack

Chainalysis team investigates how North Korean operators refined employment-themed social engineering techniques before the Binance breach. Attackers allegedly targeted a Binance employee through a fabricated recruitment process involving multiple interviews, turning a seemingly legitimate career opportunity into an initial-access mechanism. Chainalysis attributes more than $14.3M in losses over the preceding 18 months to similar operations, suggesting smaller attacks helped refine techniques subsequently deployed against larger targets. The findings connect cryptocurrency theft to North Korea's broader ecosystem of fraudulent employment, credential compromise, and illicit financial operations. (Chainalysis)

North Korea's Binance Laundering Operation Tests Blockchain Surveillance

Dr. Tom Robinson examines how North Korean operators are laundering cryptocurrency stolen during the reported $6.4 billion Binance breach. Elliptic's investigation follows the movement of stolen assets through blockchain infrastructure as attackers attempt to obscure their origins and convert proceeds into more accessible forms. The analysis illustrates the operational challenge facing exchanges, stablecoin issuers, and blockchain intelligence providers: identifying illicit funds quickly enough to interrupt laundering across multiple networks. The case also highlights the importance of coordinated attribution, transaction monitoring, and asset-freezing capabilities following major exchange compromises. (Elliptic)

Market Movements

Gate Introduces Proof of Security to Measure Exchange Resilience Against Hot Wallet Losses

Gate has introduced Proof of Security (PoSEC), a framework measuring whether an exchange's cold-storage assets could cover customer balances if its hot wallets were completely compromised. Unlike Proof of Reserves, which verifies asset sufficiency, PoSEC evaluates storage segregation and loss-absorption capacity. Qualifying assets must be held offline or with independent custodians, require multiparty authorization for access, and be independently verifiable. Gate reports 104.58% cold-storage coverage, calculated by comparing cold-storage and customer-asset shares from separate snapshots. Independent auditing remains underway, and PoSEC does not verify internal access controls or key-management security. (Gate)

Exploits & Incidents

SlowMist stats

2026 hacks: 358

Total amount lost in 2026: $8,721,078,114

Crédit Mutuel Arkéa Loses Up to $133M in Third-Party Provider Breach

French banking group Crédit Mutuel Arkéa confirmed a cyberattack in which attackers gained access through an unnamed third-party service provider, enabling fraudulent transfers from the bank’s own accounts. Blockchain investigator ZachXBT estimated losses exceeding $133 million, although the bank has not confirmed the final amount. Funds were subsequently routed through cryptocurrency exchanges and converted into ETH and other assets. Bitquery traced $126 million in associated USDC withdrawals across 17 wallets. Customer assets were unaffected, and some funds have been frozen. The incident highlights how compromised third-party infrastructure can expose core banking operations and facilitate large-scale financial theft. (Crédit Mutuel Arkéa, Bitquery)

Mercado Bitcoin Hack Exposes Multi-Chain Signing and Containment Failures

Gaurav Agarwal’s onchain investigation traces the theft of approximately $48.6M from Brazilian exchange Mercado Bitcoin across 11 blockchains on November 2. The attacker drained hot wallets and subsequently swept 36,042 Ethereum deposit addresses, continuing for hours after the exchange announced containment. The transactions suggest broad signing authority was compromised, although the initial attack vector remains unknown.

Chainalysis coordinated asset tracing and freezes with stablecoin issuers and law enforcement, while Mercado Bitcoin reports over $16 million blocked. The exchange has pledged to cover customer losses using its own funds and plans a phased reopening beginning November 9. (Bitquery)

BTCPay Server Attack Reuses Patched Vulnerability to Drain Hot Wallets

BTCPay Server reports that attackers exploited a previously patched vulnerability to drain Bitcoin and Litecoin hot wallets on self-hosted instances running version 2.4.1 or earlier. The same vulnerability was exploited in August to steal Lightning Network credentials, but attackers returned with a different method targeting onchain wallets. Bitquery traced approximately $1.63M in suspicious transfers, although BTCPay has not confirmed total losses. The incident highlights the risks of delayed patching and server-held private keys. BTCPay recommends rebuilding affected servers, rotating credentials, and migrating funds to new wallets, warning that software updates alone cannot reverse an existing compromise. (BTCPay)

Chainalysis Breach Exposes Customer Credentials and Disrupts Critical Compliance Services

Chainalysis team reports an ongoing cyberattack involving unauthorized access to internal systems and exposure of customer information. In its November 4 update, Chainalysis confirmed that usernames, password hashes, and live tokens for all users had been exposed. The company also detected suspicious activity affecting customer accounts and temporarily disabled Reactor, Data Solutions, KYT, and address-screening services. Chainalysis reports no evidence that investigation data was accessed or attribution data manipulated. The incident raises significant concerns about the security and availability of infrastructure underpinning cryptocurrency investigations and transaction monitoring. (Chainalysis)

AI-Assisted Attack on GitBook Exposes SaaS Supply Chain Weaknesses

Jose Antonio Lanz reports on a GitBook breach affecting a documentation platform widely used by crypto projects. GitBook’s postmortem traces the intrusion to an SSO vulnerability that enabled staff impersonation. The attacker then exploited a misconfigured GitHub App and stolen Cloudflare credentials to gain production access.

GitBook believes AI-driven automation accelerated the attack. Although the attacker targeted only one customer, they could access platform-wide secrets, API tokens, and customer data. GitBook shut down services for approximately 16 hours, rotated credentials, and revoked API tokens. Although no customer content modifications were identified, the incident highlights the risks of excessive privileges and interconnected SaaS infrastructure. (Decrypt) (GitBook)

Policy & Regulation

Hong Kong Passes Crypto-Asset Tax Reporting Law

Hong Kong’s Legislative Council passed legislation implementing the OECD’s Crypto-Asset Reporting Framework on November 4. Crypto-asset service providers will begin collecting prescribed customer and transaction information in 2027, allowing Hong Kong’s Inland Revenue Department to automatically exchange crypto tax information with partner jurisdictions from 2028. The legislation also implements an expanded Common Reporting Standard covering additional digital financial products. The measure brings Hong Kong into the emerging international framework for automatic cross-border reporting of crypto holdings and transactions. (Inland Revenue Department)

Italy Blocks Ten Unauthorized Crypto-Service Websites

CONSOB ordered internet service providers to block ten websites unlawfully offering crypto-asset services in Italy on November 5, alongside seven websites providing unauthorized traditional investment services. The action uses CONSOB’s MiCA-related supervisory powers to restrict firms providing crypto services without required authorization. The regulator’s continued website-blocking campaign illustrates how MiCA enforcement is moving from licensing and transitional implementation toward active policing of unauthorized providers at the national level. (CONSOB)

Capital Allocation

Quranum Protocol Secures $4.5M to Build Integrated Onchain Financial Infrastructure

Quranum Protocol announced $4.5 million in strategic funding from Archer Capital, Tidal Capital, and Astra Capital. Incubated by Colorado-based Atlas Global Foundation, the project aims to connect tokenized real-world assets, capital management, and decentralized financial services through a unified infrastructure platform.

The funding will support protocol development, treasury management, liquidity systems, and international expansion. Quranum's proposed architecture separates protocol-owned capital from reserves backing customer-facing financial products, including its planned qUSD stablecoin. The platform intends to deploy on BNB Smart Chain, with several core components still under development. (Chainwire)

Applied Research

EIP-7702 Research Identifies 4.6 Million Malicious Wallet Delegations

Ziwei Li and colleagues investigate how attackers exploit EIP-7702 to install malicious sweeper contracts that automatically redirect incoming ETH. Their SweeperHunter framework identified 4.67 million malicious delegations, 20,443 attack transactions, and 508 sweeper contracts on Ethereum. Approximately 70% of observed delegations pointed to ETH sweepers, while more than 600,000 accounts failed to promptly revoke or replace malicious delegations. The findings demonstrate how compromised delegation authority can create persistent wallet exposure, even after an initial attack. (arXiv)

Soroban SDK Vulnerability Could Allow Double Withdrawals From Privacy Pools

Lilian Cariou examines CVE-2026-32322, a vulnerability in Stellar's Soroban SDK affecting cryptographic field-element comparisons. The SDK could treat mathematically equivalent values as different, allowing applications to accept previously used withdrawal proofs under altered representations. Certora reproduced the issue locally using a privacy-pool example and demonstrated how a simple formal verification property detects the inconsistency. No deployed exploitation was identified. Developers using affected SDK versions must rebuild and upgrade their contracts because updating the development dependency alone does not repair deployed code. (Certora)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) hacks web3 security cybersecurity regulations crypto <![CDATA[0x57 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x57-web3-security-bulletin Wlwsimv75g9yYkZbnsCB Fri, 30 Oct 2026 15:55:51 GMT TL;DR

  • Industry Trends & Analysis: The custody perimeter is expanding: compromised developer tooling can drain treasuries without breaking smart contracts. Meanwhile, AI-crypto headlines are outrunning the evidence, Solana audits keep exposing authorization flaws, and quantum-resistant wallets remain a migration problem, not just a cryptography problem.

  • Exploits & Incidents: Binance lost an estimated $6.3B through compromised signing infrastructure, malicious JavaScript drained Polymarket users, retired CoinDCX wallets leaked another $16M, and a MoveVM cache bug created unbacked assets on Initia.

  • Policy & Regulation: Regulators are moving tokenization into the mainstream. The SEC is making it an examination priority, the CFTC is exploring 24/7 derivatives trading, the Bank of England is opening the door to tokenized collateral, and France wants tougher EU-wide crypto supervision.

  • Capital Allocation: Predicate raised $8M to make compliance programmable by embedding sanctions, identity, and transaction controls directly into tokenized assets.

  • Applied Research: EIP-7702 can turn one malicious signature into persistent wallet control, DEX hooks are hiding millions in trading charges, and new benchmarks reveal when AI security agents are merely replaying known exploits.

Subscribe

Industry Trends & Analysis

Crypto Supply-Chain Attacks Turn Developer Infrastructure Into Treasury Risk

Gabi Urrutia examines how compromised npm and PyPI packages, developer workstations, and CI/CD pipelines can bypass otherwise secure cryptocurrency custody controls. Drawing on the Bybit breach, Ledger Connect Kit compromise, and malicious GitHub Actions incidents, Halborn demonstrates how attackers manipulate transaction interfaces, steal signing credentials, and compromise deployment infrastructure without exploiting smart contracts. The analysis recommends deterministic dependencies, short-lived OIDC credentials, isolated build environments, and independent transaction verification. The central argument is that software delivery infrastructure belongs inside the custody security perimeter because compromised code can directly authorize irreversible financial transfers. (Halborn)

AI Crypto Security Headlines Blur the Line Between Discovery and Speculation

Rekt examines recent claims about AI's ability to compromise cryptographic systems, distinguishing demonstrated research from speculative forecasts. Justin Drake's warning that AI could eventually break ECDSA remains hypothetical, while Anthropic's discovery of historical NIST elliptic-curve seed-generation methods did not reveal a cryptographic weakness. Separately, an OpenAI research model spent unauthorized Sepolia testnet funds after deriving an account from a known developer recovery phrase. That incident demonstrated a permission failure, not broken cryptography. The analysis highlights how exaggerated security claims can distort threat assessments and encourage poorly informed defensive decisions. (Rekt)

Solana Smart Contract Audits Expose Authorization and Accounting Vulnerabilities

Tigran Piliposyan examines security weaknesses in Solana programs, where transaction-supplied accounts must be independently validated for ownership, authority, and expected state. Certora's audits identified missing signer checks that enabled referral-fee manipulation, incorrect Token-2022 transfer handling, stale oracle validation, and share-pricing vulnerabilities. Additional findings demonstrate how cross-program interactions and accounting inconsistencies can produce unexpected asset movements or prevent withdrawals. The research emphasizes that Solana security requires validating relationships between accounts and maintaining financial invariants across transaction sequences rather than reviewing individual instructions in isolation. (Certora)

Bitcoin and Ethereum Pursue Different Paths to Quantum-Resistant Wallets

The Defiant examines how Bitcoin and Ethereum are approaching the transition to post-quantum cryptography as advances in quantum computing threaten existing digital-signature schemes. Ethereum's smart contract architecture already supports verification of alternative quantum-resistant signatures, although securing existing accounts requires changes beyond simply adding a new signing method. Bitcoin is pursuing a different approach through proposals such as Pay-to-Merkle-Root (P2MR), which would introduce greater flexibility for future spending conditions but does not itself provide quantum-resistant signatures. Both ecosystems face significant challenges involving backward compatibility, wallet migration, and protecting funds associated with exposed public keys. The research highlights that quantum resistance requires coordinated changes to wallet infrastructure, transaction authorization, and potentially blockchain consensus rules, rather than simply replacing cryptographic algorithms. (The Defiant)

Exploits & Incidents

SlowMist stats

2026 hacks: 342

Total amount lost in 2026: $8,491,465,176

Binance Suffers Record $6.3B Breach as Attackers Hijack Wallet Signing Infrastructure

On October 29, Binance suffered what appears to be the largest cryptocurrency security breach on record, with an estimated $6.3B in assets affected across multiple blockchains. The attack targeted the exchange's hot-wallet infrastructure, exploiting unauthorized transaction signing and Ethereum's EIP-7702 account delegation mechanism to redirect funds into attacker-controlled wallets.

View X Post (2116089661408108712)

Onchain investigations identified suspicious transfers across Ethereum, Bitcoin, Tron, Arbitrum, Avalanche, Optimism, and other networks. Approximately $3B in affected assets has been frozen through coordinated intervention by stablecoin issuers and blockchain infrastructure providers.

Blockaid's investigation identified a particularly sophisticated technique involving Binance 14, one of the exchange's busiest Ethereum hot wallets. The attacker submitted a transaction containing 50 EIP-7702 authorizations, each targeting a different account nonce. Because the wallet was continuously processing withdrawals, the attacker could not reliably predict its current nonce.

View X Post (2115910280140276155)

One authorization matched, enabling the wallet to delegate execution to an attacker-controlled smart contract. Within minutes, the malicious contract transferred approximately 167,464 ETH, 1.615 billion USDT, and dozens of other tokens from the wallet. The delegation remained active after the initial transaction, allowing the attacker to sweep additional deposits without obtaining another authorization.

Circle froze more than 800 million USDC. Tether froze more than 1.567 billion USDT. Ripple paused a wallet still holding about 40.5 million RLUSD after about 48 million had already left. Paxos froze 1,906.67 PAXG. ETH cannot be frozen. BNB dropped 6.3 percent in twenty minutes, from $738 to $691. Aave froze its V3 and V4 markets.

EIP-7702 is an important part of the story, but not necessarily the underlying vulnerability. Introduced through Ethereum's Pectra upgrade, the standard allows externally owned accounts to delegate execution to smart contract code, enabling capabilities such as transaction batching, gas sponsorship, and programmable wallets. However, an unauthorized delegation can effectively transform a conventional wallet into an attacker-controlled programmable account. The Binance incident demonstrates how compromised signing authority can turn a legitimate account-abstraction feature into a persistent mechanism for draining assets.

Binance's preliminary investigation points to a DevOps engineer’s compromised laptop that may have enabled unauthorized access to an internal service container and withdrawal infrastructure. The exchange says it has found no evidence that wallet private keys were extracted, suggesting the attackers may have abused existing signing systems rather than directly stolen cryptographic keys. Binance temporarily suspended deposits and withdrawals, revoked affected authorizations, and committed to covering losses through its SAFU fund and corporate reserves. A full technical postmortem remains pending.

The incident highlights a critical distinction between protecting private keys and securing the systems authorized to use them. Even sophisticated custody architectures can fail when compromised infrastructure can initiate legitimate-looking transactions or authorize changes to wallet execution logic. For exchanges and institutional custodians, the implications extend beyond key management to independent transaction-policy enforcement, EIP-7702 delegation monitoring, signing-infrastructure isolation, and the ability to detect and revoke malicious authorizations before funds are irreversibly transferred. The investigation is ongoing.

Sources:

Binance $6.3B Hack: Using Advanced AI Models, Blockaid Detects the Biggest Theft in Crypto History | Blockaid Blog

On October 29, 2026, an attacker took control of Binance's signing service and used an EIP-7702 delegation to drain about $6.3B from Binance across multiple chains, the largest crypto theft on record. Blockaid's AI detection flagged the drain in under two minutes, and Cosigner and Onchain Monitoring give exchanges the signing controls and real-time detection to stop a signing service attack before it becomes a sweep.

https://blockaid.io
Binance $6.3B Hack: Using Advanced AI Models, Blockaid Detects the Biggest Theft in Crypto History | Blockaid Blog
Binance Hack: $6.3B Drained on 9 Chains, $2.7B Frozen - Bitquery

Binance hack: $6.3B left Binance's hot wallets on nine chains in under four hours. $2.7B is frozen. We traced where the rest of the money sits.

https://bitquery.io
Binance Hack: $6.3B Drained on 9 Chains, $2.7B Frozen - Bitquery
View X Post (2115970461263651107)

Polymarket Loses $2.7M as Compromised Third-Party Script Drains Hundreds of Traders

Polymarket suffered an estimated $2.7M exploit on October 29 after attackers compromised a third-party website monitoring provider, identified by researchers as DebugBear, and distributed malicious JavaScript through the prediction market's frontend. The injected code reportedly hijacked authenticated user sessions, liquidated trading positions, and initiated unauthorized withdrawals using Polymarket's existing transaction infrastructure. Bitquery traced approximately $2.73M stolen from 737 accounts within an hour, with proceeds converted into POL and distributed across multiple wallets.

View X Post (2115945195791667644)

No smart contract vulnerability was identified. Polymarket temporarily suspended trading and relayer operations, then restored service and pledged to fully reimburse affected users. The incident, which follows another third-party breach in June, demonstrates how compromised frontend dependencies can bypass otherwise secure smart contracts by abusing trusted browser sessions and legitimate transaction workflows. (Bitquery)

CoinDCX Loses $16M Through Retired Wallets After Initially Denying Breach

Zack Abrams reports that Indian cryptocurrency exchange CoinDCX confirmed a $15.99M USDT loss after an automated wallet-sweeping service failed, allowing customer deposits to accumulate in vulnerable addresses compromised during a $44M hack in July 2025. CEO Sumit Gupta initially dismissed reports of suspicious transactions as a false alarm, but onchain investigator ZachXBT challenged the exchange's account, identifying continued activity involving the supposedly retired wallets. CoinDCX subsequently acknowledged the loss, stating it would absorb the costs and that customer balances and active trading infrastructure remained unaffected. The incident highlights the security risks of incomplete wallet decommissioning, failed operational controls, and inadequate monitoring of legacy infrastructure. (The Block)

Initia Loses $2.73M After MoveVM Cache Bug Creates Unbacked Assets

Rekt reconstructs the October 23 Initia exploit, in which a MoveVM script-caching vulnerability allowed attackers to create unbacked token balances without increasing recorded token supplies. A published local reproduction suggests the virtual machine reused previously verified code assumptions after the underlying module changed. Attackers converted the forged balances into approximately $2.73 million in real assets through LayerZero and Circle's CCTP before Initia halted its network. The Initia Foundation has approved funding to restore affected reserves, although transfers remain subject to reconciliation. The incident exposes how stale execution assumptions can compromise cross-chain asset integrity. (Rekt)

Policy & Regulation

SEC Makes Tokenization a 2027 Examination Priority

The U.S. Securities and Exchange Commission published its fiscal year 2027 examination priorities on October 23, identifying tokenization and evolving market infrastructure as areas requiring heightened supervisory attention. Examiners will assess risks arising from tokenized securities alongside cybersecurity, operational resilience, emerging technologies, and investor protection. The priorities apply to regulated entities, including investment advisers, broker-dealers, exchanges, and clearing agencies. The announcement introduces no new rules but signals that tokenized securities infrastructure will receive increased scrutiny as blockchain-based financial markets develop. (SEC)

CFTC Explores Round-the-Clock Derivatives Trading

The Commodity Futures Trading Commission announced on October 28 that it will hold an industry roundtable on December 15 examining the transition toward 24/7 derivatives trading. Discussions will address tokenization, market infrastructure, operational resilience, staffing, and the challenges of continuous trading. The initiative builds on the CFTC's earlier request for public comment and reflects growing pressure to modernize traditional derivatives infrastructure as cryptocurrency markets operate continuously. The roundtable is a policy-development exercise rather than a proposed rule, with no new regulatory obligations announced. (CFTC)

Bank of England Opens Regulatory Path for Tokenized Collateral

The Bank of England launched a consultation on October 29 clarifying how central counterparties can accept tokenized versions of eligible collateral. The proposed supervisory framework addresses legal enforceability, valuation, transferability, liquidity, and the ability to realize collateral during market stress. The central bank concluded that existing regulations do not inherently prevent tokenized collateral arrangements, provided they satisfy established clearing standards. The initiative could accelerate institutional adoption of blockchain-based collateral management without introducing a separate regulatory regime. Consultation closes February 12, 2027. (Bank of England)

France Pushes MiCA Toward Stablecoins, DeFi, and Stronger EU Supervision

The French Treasury, AMF, Banque de France, and ACPR propose a substantial MiCA overhaul covering stablecoins, DeFi, and crypto supervision. The authorities want stronger ESMA oversight of major crypto firms, an explicit ban on services involving non-compliant stablecoins, and clearer rules for multi-issued stablecoins, staking, lending, and borrowing. They also support regulated DeFi with defined intermediary responsibilities, due diligence, and protocol certification, while promoting euro stablecoins and tokenized deposits as part of Europe’s financial sovereignty strategy. (AMF)

Capital Allocation

Predicate Raises $8M to Embed Compliance Into Tokenized Assets

Ryan Lawler reports that Predicate raised an $8M Series A led by Blockchain Capital, with participation from Paxos, 1kx, and Tribe Capital. Predicate embeds compliance controls directly into digital assets, allowing issuers to enforce sanctions, identity, and other transaction policies before transfers execute. The company says it has screened more than $1B in transaction volume and blocked over 100,000 non-compliant transactions, positioning its infrastructure as a compliance layer for regulated assets moving onto public blockchains. (Axios)

Applied Research

EIP-7702 Turns One Malicious Signature Into Persistent Wallet Control

Minfeng Qi and colleagues show how EIP-7702 creates a new phishing primitive: a victim can sign one authorization that delegates persistent control of an EOA to attacker-controlled code, enabling future asset drainage without additional approvals. Analyzing more than 150,000 authorization and execution events across 26,000 addresses, the researchers find significant malicious adoption and real-world theft. The findings are particularly relevant after attackers used EIP-7702 delegation in the Binance breach, underscoring how delegated execution expands the consequences of compromised signing authority. (arXiv)

Uniswap v4 Hooks Introduce Millions in Undisclosed Trading Charges

Kai Ma and colleagues investigate hidden settlement deductions in hook-based decentralized exchanges, analyzing 7,873 Hook deployments, 50,011 pools, and 296 million events across Uniswap v4 and PancakeSwap Infinity. Their findings show that 24.3% of Hooks can impose charges not reflected in standard fee displays, with deductions occurring in 59.23% of analyzed swaps involving those Hooks. The researchers identify $3.97 million in recorded charges where token pricing data was available, exposing a significant transparency gap between displayed trading fees and actual settlement costs. (arXiv)

Smart Contract Security Benchmarks Expose AI Agents That Memorize Exploits

Zifan Peng and colleagues introduce CONSTRAINTDIAL, a framework for generating evolving smart contract security benchmarks that resist answer memorization. Existing evaluations can reward AI agents for reproducing publicly available exploit transactions rather than discovering vulnerabilities independently. CONSTRAINTDIAL reconstructs vulnerable contracts and mutates protocol constraints while preserving exploitability and normal functionality. Using 203 real-world security incidents, the researchers generate 3,045 detection, exploitation, and patching tasks. Their approach reduces success from copied public answers by 10.9 percentage points, providing a more rigorous foundation for evaluating autonomous smart-contract security tools. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 cybersecurity hacks crypto regulations <![CDATA[0x56 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x56-web3-security-bulletin bYwpMbRhV7mYK8ndUszD Sat, 24 Oct 2026 15:31:47 GMT Black October? — A Rough Week for Cyber Defenders

  • GitLab — A Perfect 10 for Supply Chain Risk: A maximum-severity vulnerability (CVE-2026-110264, CVSS 10.0) enables unauthenticated remote code execution on vulnerable self-managed GitLab servers.

  • LiteLLM — Poisoned AI Dependency Steals Credentials: Attackers compromised LiteLLM's release pipeline, distributing credential-stealing malware and a backdoor through PyPI and Docker images.

  • OpenCode — AI Coding Platform Breach Exposes API Keys: Attackers breached OpenCode Console, potentially exposing third-party AI provider keys belonging to 1.4% of its users. Some victims reported unauthorized charges exceeding $1,700.

  • eMudhra — Broken Certificate Trust Threatens Crypto Communications: Eight eMudhra intermediate certificate authority keys were found to have insufficient cryptographic randomness, making their private keys recoverable. Attackers could potentially forge trusted HTTPS certificates and impersonate valid services.

TL;DR

  • Industry Trends & Analysis: Custody security is more than cryptography. MPC, multisig, and HSMs all protect keys differently, but compromised signing workflows, weak governance, and poor operational controls remain the real Achilles' heel. AI agents discover the crypto mixing business. Flash Mixer introduces an MCP interface for autonomous Bitcoin mixing, opening a new frontier in automated money laundering and compliance challenges.

  • Market Movements: Matter Labs launches Prividium Commander, bringing identity, policy enforcement, token administration, and audit controls together to help banks move tokenization projects into production.

  • Exploits & Incidents: NGRAVE loses $2.65M without a hardware wallet hack. Attackers weaponize trusted app notifications to steal recovery phrases, then move funds across six blockchains. The weakest link wasn't the hardware; it was the interface. And predictable wallet seeds compromise 1,404 Qubic accounts, resulting in $1.3M in losses.

  • Policy & Regulation: Washington puts stablecoin rules into motion. The OCC finalizes GENIUS Act regulations covering reserves, redemption, and supervision, while offering existing issuers a potential 12-month compliance lifeline ahead of January 2027.

  • Capital Allocation: Visa eyes Fireblocks, but Fireblocks says otherwise. A reported $2.5B acquisition would represent a sharp discount from Fireblocks' former $8B valuation. The company denies the talks, but the story underscores traditional finance's interest in stablecoin infrastructure.

  • Applied Research: Bitcoin's shrinking block rewards reshape mining economics. New research models whether declining subsidies could trigger periods of miner inactivity, finding that capital costs may help prevent prolonged mining gaps. Additionally, researchers find that trusted execution environments can reduce transaction-ordering and censorship risks with relatively little performance overhead, offering a practical path toward stronger rollup security.

Industry Trends & Analysis

MPC, Multisig, and HSMs Shift Risk Rather Than Eliminate It

Justin Fang compares three institutional custody architectures, examining how each distributes trust, authorization, and operational risk. Hardware security modules protect private keys but depend on the applications controlling signing requests. Multi-signature wallets provide transparent onchain authorization but remain vulnerable to compromised signing interfaces. Multi-party computation distributes key material across independent participants but introduces protocol implementation and operational complexity. Halborn argues that custody security ultimately depends on transaction authorization, governance, infrastructure isolation, and recovery procedures rather than cryptographic architecture alone. (Halborn)

Canton Smart Contract Audits Reveal Hidden Authorization and Privacy Risks

Tigran Piliposyan examines security weaknesses in Canton Network applications written in Daml, where authorization and transaction visibility depend on distributed contract relationships. Certora's audits identified redemption workflows that verified a caller's permissions without confirming ownership of the referenced assets. Additional risks involve stale contract references, improperly enforced locks, inconsistent accounting, and unintended information disclosure through observers. The findings demonstrate that institutional blockchain security requires validating authorization, privacy, and asset integrity across entire business workflows rather than individual contracts. (Certora)

Crypto Mixers Enter the Age of Autonomous AI Agents

Elliptic identifies Flash Mixer as the first Bitcoin mixing service it has discovered offering a Model Context Protocol (MCP) interface for AI agents. The integration allows autonomous software to incorporate transaction mixing into automated workflows without manual interaction. Unlike conventional laundering scripts, AI agents can dynamically adjust transaction timing, amounts, and execution paths, potentially making suspicious activity harder to detect. The development introduces new compliance challenges as legitimate agentic payment privacy and automated money laundering increasingly rely on similar infrastructure. (Elliptic)

Market Movements

Matter Labs Turns Institutional Crypto Operations Into a Control Plane

Matter Labs introduced Prividium Commander, a control plane designed to move institutional digital asset projects from pilots into production. The platform centralizes token administration, identity-based access, transaction policy enforcement, audit trails, and integrations with existing systems such as Okta and Hyperledger Besu. The bigger play is reducing the custom operational software that banks must build around tokenized deposits, securities, and payments. Commander could make regulated onchain products faster and cheaper to launch at scale. (Prividium)

Exploits & Incidents

SlowMist stats

2026 hacks: 327

Total amount lost in 2026: $2,168,305,048

NGRAVE Phishing Attack Drains $2.65M Across Six Blockchains

Gaurav Agarwal traces a phishing attack against NGRAVE's LIQUID companion app that resulted in an estimated $2.65M stolen from 84 wallets across six blockchains. Attackers hijacked app notifications to direct users to a fake security page that requested recovery phrases, effectively bypassing the hardware wallet's offline key protection. Stolen assets were routed through Chainflip and cross-chain bridges into 39 Hyperliquid accounts, where $2.16M was converted into XMR1, a Monero-linked token. The incident highlights how compromised trusted interfaces can undermine hardware wallet security without directly compromising the devices themselves. (Bitquery)

Weak Wallet Seeds Trigger $1.3M Qubic Hack and Network Shutdown

Estefano Gomez reports that Qubic halted its mainnet after attackers exploited predictable wallet seeds to drain 1,404 accounts, stealing approximately $1.3M in QU tokens. The vulnerability originated in insecure random-number generation affecting Apple devices and the Safari browser, rather than the blockchain protocol itself. Validators halted the network, freezing 87.1% of stolen funds, while MEXC froze the remainder.

Qubic subsequently patched the vulnerability, restarted its network, and opened a recovery process. The incident exposes two critical risks: insecure cryptographic key generation and the governance trade-offs of coordinated blockchain shutdowns. (CryptoBriefing)

Policy & Regulation

OCC Finalizes Federal Stablecoin Rules Under GENIUS Act

The Office of the Comptroller of the Currency (OCC) finalized regulations implementing the GENIUS Act, establishing federal requirements for payment stablecoin issuers and certain custodial activities. Effective January 18, 2027, the framework introduces standards for reserve backing, redemption, risk management, and regulatory supervision. Anti-money laundering and sanctions requirements will follow through separate Treasury-coordinated rulemaking.

The decision moves U.S. stablecoins toward a formal federal regulatory framework, giving banks and nonbank issuers clearer operating rules while bringing stablecoin issuance under structured oversight. (OCC)

OCC Opens a Compliance Lifeline for Existing Stablecoin Issuers

The OCC clarified licensing and waiver procedures ahead of the GENIUS Act's January 18, 2027, implementation deadline. Existing stablecoin issuers with substantially complete applications pending may request temporary exemptions from prior-approval requirements, potentially extending operations for up to 12 months while regulators review applications. Waivers are discretionary, and the OCC generally does not expect to extend the same flexibility to new entrants. The guidance aims to prevent market disruption while requiring issuers to demonstrate adequate reserves, risk management, governance, and compliance controls. Operating without authorization after the deadline could carry criminal penalties. (OCC)

Wall Street and Crypto Industry Push Back on SEC's Digital Asset Rules

Sarah Wynn reports that the SEC received more than 100 comments on its proposed Regulation Crypto Assets framework, which would exempt certain token offerings from securities registration requirements. The proposal includes exemptions for startups raising up to $5M and fundraising rounds of up to $75M.

Hyperliquid Policy Center pushed for clearer treatment of airdrops, while AIMA and SIFMA called for stronger investor disclosures and safeguards around tokenized securities trading. The debate highlights the challenge of balancing regulatory flexibility for onchain innovation with investor protection as traditional finance moves toward tokenization. (The Block)

UK FCA Clarifies Crypto Rules, Carving Out DeFi Technical Services

The UK's Financial Conduct Authority (FCA) opened consultation CP26/36 to clarify which crypto asset activities fall outside its upcoming regulatory framework. Proposed guidance addresses exemptions for technical services providing access to decentralized protocols, proprietary trading, market-making, temporary stablecoin holdings, and settlement arrangements. The FCA also offered limited regulatory flexibility for firms affected by uncertainty over authorization requirements. The clarification matters for DeFi infrastructure providers and intermediaries seeking to avoid unnecessary licensing obligations while maintaining compliance. The new regime takes effect October 25, 2027, with consultation responses due November 18, 2026. (FCA)

Capital Allocation

Visa's Reported $2.5B Fireblocks Acquisition Meets a Swift Denial

Lucinda Shen reports that Visa is in late-stage talks to acquire Fireblocks, the institutional digital asset custody and stablecoin infrastructure provider, for approximately $2.5B. Fireblocks disputed the report, calling the claims untrue, while Visa declined to comment. The reported acquisition price represents a steep discount to Fireblocks' $8B valuation in 2022. Although no deal is confirmed, the reported interest highlights growing competition among traditional payment networks to control stablecoin infrastructure, where custody, secure transaction execution, and settlement capabilities are becoming strategically important. (Axios)

Applied Research

Bitcoin's Declining Block Subsidies Could Create New Mining Security Dynamics

Hasan Selçuk Kılıç and Nail Akar investigate mining gaps, periods when proof-of-work miners temporarily stop mining while waiting for transaction fees to accumulate. Their mathematical model examines how declining block subsidies, transaction demand, electricity costs, and capital expenditures influence miner participation. The researchers find that capital costs constrain equilibrium hash-power and prevent mining gaps from consuming entire block intervals under their model. The findings offer new insight into Bitcoin's long-term security economics as transaction fees increasingly replace block subsidies. (arXiv)

Trusted Execution Environments Offer a Practical Defense Against Centralized Rollup Sequencers

Claudiu-Nicu Bărbieru and colleagues evaluate trusted execution environments (TEEs) as a security mechanism for Ethereum rollup sequencers. Centralized sequencers can censor transactions, manipulate ordering, and extract MEV, creating trust dependencies within otherwise decentralized systems. The researchers compare monolithic TEE-based sequencers against proposer-builder separation architectures, finding that hardware-enforced execution introduces relatively little performance overhead. Separating proposer and builder functions can also improve throughput through specialized implementations. The findings position TEEs as a practical architectural option for strengthening rollup execution integrity. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 hacks regulations security cybersecurity <![CDATA[0x55 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x55-web3-security-bulletin 1VbEXuwGf6fC7Y60R9Vg Fri, 16 Oct 2026 14:27:57 GMT

TL;DR

  • Industry Trends & Analysis: Bitcoin’s oldest address types have an overlooked quantum-defense advantage: unused addresses keep public keys hidden until they spend. Meanwhile, Balancer is winding down after its $128M exploit, law enforcement is increasingly using onchain intelligence to dismantle scam networks, and a U.S. appeals court just strengthened blockchain analytics’ standing as forensic evidence.

  • Market Movements: Fireblocks is pushing deeper into crypto banking infrastructure with Business Accounts, giving platforms segregated wallets, granular signer permissions, approval policies, and programmable controls for corporate stablecoin payments and tokenized assets. Think digital-asset business banking with policy enforcement built into the wallet layer.

  • Exploits & Incidents: 2026 has already seen 321 hacks and $2.16B lost. This week’s incidents show just how varied the attack surface has become: Payy lost $1.92M to forged ZK proofs, Papertrade effectively paid an attacker to manipulate its oracle, and Ledger’s implant investigation suggests hardware-wallet supply-chain tampering may extend well beyond one reseller or region.

  • Policy & Regulation: Crypto regulation is shifting from piecemeal rules toward full market structure. The CFTC is proposing a federal framework for leveraged retail crypto, the EU is centralizing oversight of its largest crypto firms, USDC became MiCA’s first significant e-money token, and the FSB is warning that stablecoins increasingly create cross-border financial-stability problems rather than purely crypto-native ones.

  • Applied Research: Researchers are attacking the stack from three directions: making gas pricing itself a defense against resource exhaustion, cataloging 830 verification flaws across 36 cross-chain bridges, and showing that even audited smart contracts can fail when compilers silently change program semantics. The Soliduzz fuzzer uncovered 24 compiler bugs across Solidity, Vyper, and Solx.

Industry Trends & Analysis

Unused Bitcoin Addresses Can Reduce the Attack Surface

Fireblocks walks through Justin Drake’s “bunker” advice for Bitcoin P2PKH and P2WPKH addresses. Those address types do not put the public key on-chain at first. The address is a hash of the public key, and the key itself only appears when that address spends. That creates two situations. If coins sit at an address that has never signed, an attacker who can crack ECDSA still only has the hash to work with, so recovering the private key from a published public key does not apply yet.

If the address has already signed once, the public key is public forever, and any later break of the curve, whether through classical or quantum methods, can target whatever value is still left there. Fireblocks’ practical version is fresh deposit addresses, sweeping funds off spent addresses, and sending change to a new address instead of back to a permanent one. That does not change Bitcoin consensus; it only reduces how much sits behind already-exposed keys. But, of course, as many have pointed out, if ECDSA is cracked, we have a lot more to worry about than just Bitcoin. (Fireblocks)

Balancer Votes to Shut Down Following $128M Exploit

Rekt examines Balancer's decision to wind down operations eleven months after a $128M exploit undermined the protocol's finances and recovery efforts. Governance approved the shutdown with 99.2% support, scheduling pools to transition toward withdrawals-only operations beginning October 30. The investigation highlights unresolved discrepancies in reported losses, reimbursement conditions requiring liability waivers, and governance voting defects that temporarily prevented some holders from overriding delegated votes. The case illustrates how major security incidents can create prolonged operational, financial, and governance consequences beyond the initial exploit. (Rekt)

Operation Blackout Targets Crypto-Enabled Scam Networks Across Africa

Elliptic details its participation in an international law-enforcement operation targeting West African scam networks. Coordinated by the FBI and UK's National Crime Agency, the initiative resulted in 28 arrests, identification of 117 trafficking victims, and approximately $11M in potentially freezable assets. Elliptic connected scam-related cryptocurrency wallets, websites, and exchange accounts, enabling investigators to identify laundering infrastructure and support account restrictions. The operation reflects growing cooperation between blockchain intelligence providers, exchanges, and law enforcement to disrupt industrial-scale cryptocurrency fraud. (Elliptic)

Federal Appeals Court Upholds Blockchain Analytics Evidence

Chainalysis Team reports that the U.S. Court of Appeals for the D.C. Circuit upheld the admissibility of blockchain analytics evidence used in the Bitcoin Fog money-laundering prosecution. The court rejected challenges to Chainalysis Reactor's reliability under the Daubert standard, citing its address-clustering methodology, validation practices, and established investigative use. The decision reinforces the legal standing of blockchain transaction analysis as forensic evidence while highlighting the importance of transparent, defensible attribution methods as AI increasingly automates cryptocurrency investigations. (Chainalysis)

Market Movements

Fireblocks Adds Business Accounts

Fireblocks released Business Accounts so a platform can give each business customer its own digital-asset account. This includes wallets across EVM, Solana, and Bitcoin, with roles, policies, and approvals. The business keeps control of funds and balances are not commingled. Managing an account is separate from signing: an ops lead can run the account without send rights, and a payments specialist can sign on one wallet only. Platforms set baseline Policy Engine rules; each business sets its own on top, including named or m-of-n approvals and expiring signer access. Human and API signers share the same rules, so scheduled payroll or vendor payouts hit the same gates. The example given is a logistics firm paying suppliers in USDC: an allowlist plus a $5,000 dual-approval rule prevents an off-list $50,000 attempt from reaching an approver. Business Accounts are a fit for merchant accounts, cross-border payment rails, business banking that adds stablecoin accounts, and institutional desks holding tokenized assets. Policies are attested in TEEs; wallets use TSS-MPC. (Fireblocks)

Exploits & Incidents

SlowMist Stats

2026 hacks: 321

Total amount lost in 2026: $2,165,678,439

Payy Loses $1.92M After Zero-Knowledge Verifier Accepts Forged Proofs

Lilian Cariou reconstructs the Payy exploit, where attackers submitted forged zero-knowledge proofs authorizing withdrawals without corresponding deposits. The vulnerability originated in Barretenberg's proof-verification logic, which failed to enforce an initial zero value in a running-sum calculation. Although Aztec released a fix 73 days before the attack, Payy continued using an outdated version. Certora demonstrates the missing constraint using a Lean formal model, highlighting the security risks of outdated cryptographic dependencies and inadequate verification of proof-system invariants. (Certora)

Turning Oracle Manipulation Into a Winning Trading Strategy

GoPlus Security examines how an attacker exploited Papertrade’s incentive structure just eight hours after the platform's launch. Papertrade created a payoff function where an attacker could rationally spend money in Market A to extract a larger amount from Market B. The attack demonstrates a mechanism-design failure where manipulating the reference market became economically rational.

The attacker built hundreds of millions of dollars in leveraged synthetic exposure, then used real trades on Hyperliquid to move ETH’s best bid/offer (BBO) by roughly 10–14 basis points. Papertrade accepted that instantaneous price without a TWAP or deviation cap, while 1,000× leverage amplified the small move into outsized PnL paid by its LP.

The attacker found that the cost of manipulating Hyperliquid’s BBO was smaller than the payoff Papertrade would award from that manipulated price. Given the protocol’s rules, exploiting the oracle became the economically rational strategy. That is an incentive-compatibility failure: the mechanism rewarded adversarial behavior instead of making manipulation unprofitable. (GoPlus Security on X)

Ledger Implant Investigation Expands Beyond Southeast Asia

Mark Karpelès catalogs publicly reported tampered and counterfeit Ledger wallets as the investigation into hardware-wallet supply-chain attacks widens. The database currently tracks 15 devices from nine named sellers across Asia and Europe, including Russia, spanning Nano X, Flex, Stax, and Nano S Plus models.

Confirmed implants contain additional circuitry and antennas capable of reading recovery phrases from the device display, while other cases involve outright counterfeit hardware. The catalog does not prove every named retailer is compromised, but suggests the potential distribution footprint extends beyond the original CryptoBilis cases. (Karpelès on Github)

Policy & Regulation

Regulators Push AI Accountability and Revise Crypto Oversight

David Carlisle reviews regulatory developments spanning AI governance, cryptocurrency market oversight, and financial privacy. The CFTC initiated rulemaking aimed at cryptoasset trading and market-abuse controls, while FinCEN withdrew longstanding proposals targeting unhosted wallets and cryptocurrency mixers. Meanwhile, financial regulators in the UK, Europe, and Singapore emphasized human oversight, cybersecurity resilience, and accountability for autonomous AI systems. The developments illustrate how regulators are reassessing compliance obligations as digital assets, automated payments, and AI-driven financial infrastructure become increasingly interconnected. (Elliptic)

CFTC Moves to Build a Federal Market Structure for Retail Crypto

The CFTC is seeking comment on a framework that could bring certain retail crypto trading under a unified federal regime. “Regulation CTX” would define when leveraged, margined, or financed crypto transactions fall under CFTC jurisdiction, while “Regulation CAM” would create a tailored exchange category with rules for custody, leverage, surveillance, clearing, and customer protection. Importantly, even fully paid trades could remain regulated when an account offers leverage until users take “actual delivery,” potentially meaning control of the private keys. The CFTC is attempting to replace fragmented state oversight with federal rules for crypto markets without waiting for new legislation. (Federal Register)

EU Designates USDC Its First Significant Stablecoin Under MiCA

The European Banking Authority classified USDC as the EU's first significant e-money token under MiCA on October 14. Beginning November 12, the EBA will directly supervise capital, reserves, liquidity and redemption planning for the European issuer, while France's ACPR retains governance oversight. USDC is the first of 45 notified e-money tokens to receive the designation. The EBA also signed a cooperation agreement with New York's financial regulator to support cross-border stablecoin supervision. (European Banking Authority) (The Block)

EU Agrees to Centralize Supervision of Major Crypto Firms

The Council of the European Union agreed on October 9 to expand ESMA's direct supervisory authority over the largest cross-border crypto-asset service providers. The compromise would transfer oversight of 10–15 major firms from national regulators to ESMA, while smaller providers would remain under national supervision. The package also expands the EU's DLT Pilot Regime, allowing greater experimentation with tokenized financial infrastructure. The agreement establishes the Council's negotiating position and still requires negotiations with the European Parliament. (Council of the EU)

Financial Stability Board Warns of Cross-Border Stablecoin Risks

The Financial Stability Board published a report to the G20 on October 12 examining financial stability risks associated with global stablecoin arrangements. The analysis focuses on vulnerabilities that can spread across jurisdictions, regulatory fragmentation and limitations in available monitoring data. It identifies opportunities to improve cross-border supervisory cooperation, information sharing and financial stability monitoring. The report supports implementation of the FSB's existing global stablecoin recommendations rather than introducing new binding requirements. (Financial Stability Board)

Applied Research

Ethereum Gas Pricing Research Targets Economically Unsustainable Network Usage

Ben Berger, Edward W. Felten, and Robin Fritsch examine whether EIP-1559 gas-pricing mechanisms can economically discourage excessive blockchain resource consumption. Their framework identifies the cheapest transaction-usage patterns capable of exceeding network capacity thresholds, then derives pricing parameters that make such behavior prohibitively expensive. The analysis covers Ethereum's exponential fee mechanism and variants used by Arbitrum and Robinhood Chain. The findings offer a mathematical foundation for balancing transaction costs, network throughput, and long-term state growth, strengthening economic defenses against resource exhaustion. (arXiv)

Cross-Chain Bridge Study Finds 830 Verification Vulnerabilities Across 36 Projects

Yuying Wang and colleagues examine 588 security audit reports covering 36 cross-chain bridge projects, identifying 830 verification vulnerability instances across 786 contract files. The researchers classify 11 recurring vulnerability patterns into five categories involving failures to authenticate external-chain data, messages, and authorization evidence. Existing security tools demonstrate limited coverage, while the best evaluated LLM achieves just 51.2% Macro-F1 in vulnerability-pattern classification. The findings highlight a persistent security gap: traditional smart-contract auditing tools struggle to reason about the cross-chain trust assumptions that have contributed to major bridge exploits. (arXiv)

Soliduzz Discovers 24 Compiler Bugs That Could Undermine Smart Contract Security

Alexander Stromberger, Christoph Hochrainer, Valentin Wüstholz, and Maria Christakis introduce Soliduzz, a testing framework designed to detect incorrect compilation of EVM smart contracts. Unlike conventional fuzzers, Soliduzz generates semantically equivalent programs and checks whether compiled bytecode preserves their intended behavior. Testing Solidity, Vyper, and Solx compilers uncovered 24 compiler bugs, including six miscompilations, 17 internal compiler errors, and one hang, alongside five analysis-tool bugs. The research exposes a critical security assumption: even correctly written and audited smart contracts can behave unexpectedly when their compiler silently changes program semantics. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity hacks regulations crypto <![CDATA[0x54 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x54-web3-security-bulletin iyrWCTkdjfI0bjhlPbcB Mon, 12 Oct 2026 10:04:39 GMT TL;DR

  • Industry Trends & Analysis: AI isn't breaking cryptography, yet. It's accelerating the hunt for weaknesses. Meanwhile, smart contract security remains a team sport: audits, fuzzing, and formal verification each catch what the others miss.

  • Market Movements: Quantum readiness moves from theory to product as Project Eleven launches post-quantum custody infrastructure. LayerZero adds Blockaid's threat intelligence to cross-chain message verification, bringing another security checkpoint to interoperability.

  • Exploits & Incidents: Hardware wallets, exchange infrastructure, and bridges all took hits. An $84.8M Ledger-linked wallet drain raises questions about supply-chain security. While further analysis of Bitget's $387.5M breach exposes failures in transaction authorization and incident containment.

  • Policy & Regulation: Regulators are pulling in different directions. ESMA tightens the screws on non-compliant stablecoins, FinCEN withdraws its controversial crypto-mixer reporting proposal, and US community banks challenge federal trust charters for crypto firms.

  • Capital Allocation: Privacy infrastructure attracts fresh capital as Soda Labs raises $3M to bring encrypted transactions and selective disclosure to public blockchains. The bet: institutions want blockchain transparency without exposing every balance, counterparty, and transaction detail.

  • Applied Research: Privacy and control come with trade-offs. Encrypted mempools could suppress harmful MEV while eliminating beneficial opportunities, wallet recovery shifts trust rather than eliminating it, and curator-managed DeFi vaults introduce risks that smart contract audits alone cannot resolve.

Industry Trends & Analysis

AI Isn’t Breaking Cryptography Yet...

Stanford cryptographer Dan Boneh, a16z’s Eddy Lazzarin, and Georgetown professor Justin Thaler separate the recent AI-cryptography alarm from what has actually been demonstrated. Today’s frontier models have not broken elliptic-curve cryptography or weakened any widely deployed cryptographic assumption. The bigger shift is speed: AI could compress years of cryptanalysis into weeks, helping researchers discover weak assumptions and implementation flaws much earlier. AI may strengthen new cryptography through faster scrutiny while also probing post-quantum systems for weaknesses. The practical defense is crypto-agility: hybrid schemes, upgradeable primitives, and architectures that can rapidly migrate if an assumption fails. (a16zcrypto on Youtube)


Why Audits, Fuzzing, and Formal Verification Are Complementary

Nisarg Patel compares three approaches to smart contract security and their respective limitations. Manual audits identify implementation and design weaknesses, fuzzing explores unexpected execution paths, and formal verification mathematically checks specified properties across modeled states. Drawing on incidents involving Solana Stake Pool, Suilend, and other protocols, the analysis demonstrates how each technique uncovers vulnerabilities the others may miss. The research also emphasizes that infrastructure compromises, privileged access, and operational failures remain outside the protection offered by code-focused security assessments. (Certora)

Market Movements

Project Eleven Launches Strongpoint

Project Eleven introduces Strongpoint its custody platform built for post-quantum cryptography. Strongpoint provides a consistent control layer for securing and managing digital assets while allowing cryptographic standards to change as needed. The Zcash Foundation is the first development partner. Project Eleven notes, of the 20 largest L1 chains, only 10 have published plans for migrating to to post-quantum cryptography. The published plans rely on at least six different signature schemes. Project Eleven's pitch is that Strongpoint will help ease the transition while supporting strong operational rails. (Chainwire)

Blockaid Checks LayerZero Messages Before Settlement

LayerZero added Blockaid's Bridge Sentinel as a decentralized verifier. When required by an asset issuer, each cross-chain message is checked against Blockaid's threat-intelligence feed before it can complete. Screening checks for malicious counterparties, stolen funds, or a message with no real source event. (LayerZero)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 317

Total amount lost in 2026: $2,147,954,439

The Ledger Wallet Fallout: $84.8M Gone in an Hour

Monolit traces an $84.8M drain of 277 wallets whose owners reported a Ledger compromise. The sweep ran about an hour from after seven weeks of planning. Monolit concludes that the attacker possessed the private keys. Ledger has not confirmed an exploit. None of the drained wallets appear to have been long-term cold storage.

Based on Monolit's analysis 277 wallets were breached, but they have determined that 1 owner was holding 29 of those wallets. The attackers has moved at least $9.1M into USDD, which Tether cannot freeze. Another $11.45M in USDT on Tron remained potentially freezeable. (Monolit on X)

Ledger Nano X Implants Turn the Screen Bus Into a Seed-Stealing Side Channel

Tibane Labs documents three generations of hardware implants hidden inside genuine Ledger Nano X wallets that steal recovery phrases without compromising the secure element. The implants tap the unencrypted SPI connection between the secure element and OLED display, reconstruct the 24 recovery words from screen data, then exfiltrate them through an independent cellular modem and SIM.

The newest version uses a custom, color-matched flex PCB, scraped component markings, an untouched original battery, and a purpose-built antenna. These changes Tibane says point toward repeatable, potentially mass-scale installation. Because the underlying Ledger hardware remains genuine, device attestation still passes. The report arrives as Ledger investigates stolen funds associated with devices sold through Southeast Asian reseller CryptoBilis, although Tibane emphasizes that no link between those losses and the implants has been established.

The attack exposes a critical hardware-wallet assumption: protecting keys inside a secure element does not protect sensitive data once it leaves that chip for display. (Tibane Labs)

Bitget's $387.5M Hack Exposes Critical Failures in Wallet Security Controls

Gabi Urrutia reconstructs the Bitget breach from a CISO’s perspective and finds that approximately 61% of stolen funds left after the exchange's first security alert. Attackers compromised third-party security appliances, gained access to production wallet infrastructure, and forged withdrawal requests that Bitget's legitimate signing service authorized. The investigation highlights failures in transaction authorization, behavioral monitoring, and emergency containment. Notably, the signing service remained operational for 2 hours and 39 minutes after the initial alert, allowing attackers to continue draining hot and warm wallets. (Halborn)

Duelbits Suffers Another $6M Hot Wallet Breach

Rekt investigates approximately $6.1M in unauthorized transfers from Duelbits-linked hot wallets across Ethereum, BNB Chain, Tron, Bitcoin, and Solana. Investigators suspect private-key compromise, although the initial access method remains unconfirmed. The incident is particularly concerning because one affected wallet had been publicly designated as a replacement following Duelbits' $4.6M breach in 2024.

Despite reopening services, Duelbits has not provided a complete technical explanation. (Rekt)

Symbiosis Bridge Mints Unbacked Bitcoin After Signature Validation Failure

QuillAudits examines the Symbiosis Bitcoin Bridge exploit, where an attacker submitted a signed message claiming a Bitcoin deposit that never occurred. The BridgeV2 contract accepted the message and minted an enormous quantity of unbacked syBTC. Limited exit liquidity restricted realized losses to approximately $336K. The exploit illustrates a recurring bridge-security failure: validating a message's signature without independently verifying the underlying asset transfer. The analysis recommends source-chain deposit verification, supply reconciliation, and continuous monitoring of abnormal minting activity. (Quill Audits)

Policy & Regulation

ESMA Wants Services in non-MiCA Approved Stablecoins Shut Off

The European Securities and Markets Authority (ESMA) says an authorized firm should not offer services in an asset-referenced token or e-money token (aka stablecoins) that do not comply with the requirements of MiCA. The guidance covers trading, custody, transfers, investment advice and other regulated services. Firms must implement technical and organizational controls preventing customers from acquiring additional exposure. Existing holdings should be remediated within three months, with remaining services limited to activities such as liquidation, conversion, withdrawal and safekeeping. (ESMA)

FinCEN Abandons Proposed Crypto-Mixer Reporting Requirements

FinCEN withdrew its October 2023 proposal to designate international cryptocurrency mixing as a class of transactions of primary money-laundering concern. The proposed Section 311 special measure would have imposed enhanced reporting and record-keeping requirements on financial institutions handling transactions involving mixing services. FinCEN cited concerns that its expansive definition could discourage legitimate privacy-preserving activity and create excessive compliance burdens. The agency emphasized that mixers remain relevant to illicit-finance investigations and that it may pursue future measures. (Federal Register)

Community Banks Challenge Federal Crypto Banking Charters

Pete Schroeder reports that the Independent Community Bankers of America filed a lawsuit on October 2 challenging the Office of the Comptroller of the Currency over its national trust bank charter framework for cryptocurrency companies. The banking association argues that the OCC exceeded its statutory authority by allowing crypto firms to obtain federal charters without safeguards equivalent to those imposed on traditional banks. The dispute could affect the regulatory pathway for digital-asset custody, settlement, and federally chartered crypto infrastructure providers. (Reuters)

Capital Allocation

Soda Labs Lands a $3M Seed Round

Soda Labs closed a $3M seed round led by NextBlock. Public blockchains expose balances and transaction activity and Soda Labs says this is why regulated firms still keep most activity off them. Their product Bubble encrypts counterparties and transaction data on the chain. Issuers, counterparties, auditors, and regulators see only the fields they are authorized to access.

No single party, including Soda Labs, can view the full transaction. Bubble is built on patented garbled-circuit multiparty computation, running AES and SHA-256 on ordinary cloud CPUs. It is live on Ethereum, Arbitrum, Polygon, and Base. Solana is planned. The $3M seed round will fund additional chain integrations, issuer adoption, and hiring. (Chainwire)

Applied Research

Encrypted Mempools may Eliminate Useful MEV Along with the Toxic Kind

Jonathan Passerat-Palmbach surveys encrypted mempool designs including Shutter and Ferveo and argues that hiding transactions until ordering is fixed solves only part of Ethereum’s MEV problem. Blind ordering can suppress front-running and censorship, but it also prevents same-block auctions that return MEV to users and support decentralized block building. The paper instead advocates programmable privacy, where trusted code, using TEEs today or potentially fully homomorphic encryption (FHE) later, can safely act on encrypted transactions before plaintext is revealed. (SoK: Encrypted Mempools Through the MEV Lens)

Wallet Recovery Is a Security Boundary, Not Just a Backup Feature

Francisco Javier Becerra Sanchez, Antonio Ken Iannillo, and Radu State review 77 key-recovery systems across wallets, custody, smart accounts, identity, and secure hardware. Their central finding is that recovery rarely eliminates trust; it redistributes it to guardians, providers, devices, or institutional processes. Mechanisms that improve recoverability can also introduce coercion, collusion, phishing, and insider-abuse, while post-recovery cleanup and metadata protection remain common blind spots. (Cryptographic Key Recovery for Cryptoasset Custody and Financial Technologies)

DeFi Vault Research Exposes the Risks of Curator-Controlled Strategies

Davide Mancino and Luca Pennella examine the growing security implications of curator-managed DeFi vaults. As vaults evolve from simple yield aggregators into actively managed financial systems, curators increasingly control strategy selection, risk parameters, and operational execution. The researchers introduce a unified framework for analyzing vault accounting, governance authority, strategy dependencies, and failure modes. The work show how security risks can emerge from delegated operational control even when the underlying smart contracts function as intended. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity hacks regulations research <![CDATA[0x53 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x53-web3-security-bulletin WI5disSmusKkcbLcWYBq Fri, 02 Oct 2026 14:01:15 GMT TL;DR

  • Security failures are moving off-chain. Morpho vault research and Dedaub’s incident data point in the same direction: audits alone aren’t enough. Oracle dependencies, privileged access, signing workflows, CI/CD, infrastructure, and treasury operations increasingly define the real attack surface.

  • Bitget is becoming 2026’s defining infrastructure breach. Attackers reportedly lurked for weeks, compromised third-party security systems, forged withdrawal requests, and ultimately drained roughly $387.5M—without compromising Bitget’s private keys or cold wallets. Elliptic assesses the operation as highly likely DPRK-linked, pushing suspected North Korean crypto theft above $1B this year.

  • Not every blockchain failure is a consensus failure. Zellic found that rejected Zcash blocks could poison Zebra’s synchronization state, potentially leaving nodes behind the canonical chain. The lesson: perfectly valid consensus logic can still be undermined by caching and state-management bugs.

  • AI-powered blockchain investigations are moving to the front line. Elliptic’s new Pulse product gives ordinary law-enforcement officers rapid crypto-address triage, bringing capabilities once reserved for specialist blockchain investigators directly into operational workflows.

  • Ostium is rebuilding after its $23.75M exploit. Its recovery plan provides full Phase 1 reimbursement to roughly 90% of affected wallets, while larger claims depend on additional asset recoveries and future protocol revenue.

  • NEAR Intents contained a $3.8M exploit quickly. A BSC USDT deposit/withdrawal bug triggered abnormal activity, but the service was paused and patched within an hour. Affected users are expected to be fully compensated, with the broader NEAR protocol unaffected.

  • Crypto regulation is getting more operational. The SEC is considering broader custody options for advisers, ESMA wants rules around firms that front or route users into DeFi, and the UK has opened its full crypto authorization gateway ahead of its October 2027 regime.

  • Post-quantum security is attracting capital. Project Eleven acquired Riva Labs, bringing in expertise spanning post-quantum signatures, MPC, hardware signing, wallets, and account abstraction as the industry starts preparing for cryptographic migration.

Industry Trends & Analysis

Morpho Vault Security Extends Beyond Smart Contract Audits

Roman Semko explains why Morpho vault security depends on more than correct contract code. Risk can emerge from ERC-4626 share accounting, oracle manipulation, liquidity constraints, adapters, privileged roles, and compromised signing workflows. Using the Venus wUSDM donation attack and Bybit theft as examples, the article shows how failures often occur between components rather than within them. Vault operators should validate deployment-specific assumptions, independently verify privileged transactions, separate operational authority, and rehearse incident response. (Halborn)

Bitget Attack Pushes DPRK-Linked Crypto Theft Above $1B in 2026

Elliptic assesses the $350M+ Bitget breach as highly likely to be linked to North Korean operators. Attackers compromised backend wallet infrastructure and spoofed transaction data rather than stealing private keys; draining assets across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. Elliptic identified infrastructure overlaps with previous DPRK activity, pushing its tracked total of suspected North Korean crypto theft above $1B for 2026. (Elliptic)

Operational Failures Account for Two-Thirds of Web3 Losses

Giorgio Bonuccelli analyzed 135 major Web3 incidents since 2024 representing roughly $4.9B in reported losses. He classified operational compromises, stolen keys, phishing, malware and privileged-access abuse, as 32.6% of incidents but 66.9% of losses. The findings support a security model extending beyond contract audits into multisig operations, treasury controls, incident response, CI/CD, infrastructure, DNS and identity controls. Dedaub is augmenting smart contract audits with assessments against the SEAL Certification Framework. (Dedaub)

Rejected Zcash Blocks Could Poison Node Sync State

Gunhee describes vulnerabilities Zellic discovered in Zebra, the Rust implementation of a Zcash node. A malicious peer could send an invalid block that Zebra correctly rejected while leaving its hash recorded in surrounding synchronization state. If the legitimate block later arrived with the same hash, the node could suppress it and falls behind the canonical chain. The finding highlights a subtle blockchain security boundary: consensus validation can be correct while caching and synchronization logic still undermine node availability. (Zellic)

Market Movements

AI Crypto Triage Moves to Frontline Law Enforcement

Elliptic launches Pulse, an AI-assisted system designed to let law-enforcement officers rapidly assess cryptocurrency addresses without specialist blockchain expertise. Investigators can enter addresses found on devices, scam-ATM receipts, searches or crime scenes and receive summarized financial intelligence to help prioritize further investigation. The product reflects a broader shift in blockchain investigations: AI is increasingly being used to put previously specialist onchain analysis directly into operational investigative workflows. (Elliptic)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 306

Total amount lost in 2026: $2,134,361,725

Bitget Hackers Lurked for Weeks Before Draining $387.5M

SlowMist’s incident response team reconstructs the Bitget breach as a multi-stage infrastructure compromise rather than a private-key theft. The earliest malicious activity dates to August 31, when attackers exploited a zero-day in an unnamed third-party security product, “Product A,” ran a hidden script, extracted a database password from an environment variable, and accessed its backend.

Weeks later, the attackers reached a second security platform using an internal employee identity, attempted command injection, and deployed malicious files. Investigators recovered a deleted, purpose-built withdrawal tool that forged Bitget’s risk-control parameters, constructed fraudulent withdrawal requests, and invoked the wallet system’s legitimate withdrawal process.

The resulting theft drained roughly $387.5M across multiple blockchains during a nearly three-hour window. Attackers later manipulated withdrawal records and attempted additional BTC withdrawals. Bitget says private keys and cold wallets were not compromised. SlowMist continues investigating how the attackers moved between the compromised security systems and wallet infrastructure. (SlowMist on GitHub)

Ostium Recovery Plan Covers 90% of Wallets After $23.75M Exploit

Ostium outlines its recovery plan following the July 15 attack that compromised off-chain pricing and signing infrastructure and drained roughly $23.75M from the OLP vault. The protocol says evidence points to a possible nation-state actor and that 649,967 USDC has been recovered, while remaining vault assets are worth about 30% of pre-incident positions. Of 3,666 affected wallets, 3,321 qualify for full Phase 1 reimbursement. Larger claims can enter a proportional Phase 2 funded by further asset recoveries and a share of future protocol revenue. (Ostium on X)

NEAR Intents Lost $3.8M to a BSC USDT Deposit Bug

Illia, a NEAR co-founder, says NEAR Intents was exploited for $3.8M on Oct 1st. SHIELD flagged outlier behavior and the service was paused. Affected users will be compensated in full, he says. The bug was in the Omni deposit and withdrawal path into the NEAR Intents contract, limited to USDT on BNB Smart Chain. The team identified the flaw and patched it within an hour. NEAR Intents and near.com are back online except on a few chains. The NEAR protocol, the NEAR token, and other NEAR applications were not affected. (Near on X)

Wash Trading Price Manipulation on Nostra Finance

Rob Behnke explains how an attacker spent months accumulating NSTR before creating a thin NSTR/SolvBTC pool and wash-trading the token from roughly $0.006 to $49.50. A price aggregator selected the manipulated pool as its reference, allowing the attacker to use grossly overvalued NSTR as collateral and borrow about $3.5 million in ETH, STRK, stablecoins, WBTC, and DAI. Around $1.92 million was bridged to Ethereum before Nostra froze its money market, with protocol TVL falling from roughly $4M to $710,000. (Halborn)

Policy & Regulation

SEC Proposal Would Expand Crypto Custody Options for Advisers

SEC Commissioner Hester M. Peirce outlines proposed amendments that would broaden how registered investment advisers and regulated funds can custody crypto assets. The proposal would permit adviser “self-custody” in limited cases when no eligible custodian is available, subject to initial and quarterly determinations, and would allow qualifying state trust companies to serve as crypto custodians after due diligence. Peirce argues the changes could resolve limitations created by the SEC’s 2023 proposal, which she says made compliant crypto custody difficult for advisers. (SEC)

ESMA Wants Licensing Requirements for Firms that Front DeFi

ESMA wants a regulated service for a firm that gives clients an interface to a decentralized protocol or routes them. The firm would disclose risks, check the protocols, show its routing, handle conflicts, and keep cybersecurity controls, in proportion to its control. Self-custody stays out. Staking by an authorized firm gets disclosure rules, including slashing and lock-ups, and is not classed as lending. Lending needs written consent, not a new license. Firms would be barred from MiCA services in unauthorized stablecoins. ESMA also wants binding opinions on token classification. (ESMA)

UK Opens Its Full Crypto Authorization Gateway

The Financial Conduct Authority opened applications on September 30 for firms seeking authorization under the UK’s incoming crypto regulatory regime. For the first time, crypto businesses will enter the FCA’s broader regulatory framework covering consumer protection, safeguarding, market integrity and financial resilience. Firms intending to continue operating in the UK should apply by February 28, 2027, ahead of the regime taking effect on October 25, 2027. Authorization will require firms to demonstrate compliance rather than simply register. (FCA)

Capital Allocation

Project Eleven Acquires Riva Labs to Build Post-Quantum Crypto Security

David Okoya reports that Project Eleven acquired Riva Labs, adding specialized cryptography talent, technology and intellectual property to its blockchain-security stack. Riva’s work spans post-quantum signatures, MPC, wallet infrastructure, hardware signing and account abstraction across Ethereum and other public blockchains. The team will join Project Eleven’s broader effort to protect digital assets as blockchain networks prepare to migrate away from cryptography vulnerable to future quantum computers. Financial terms were not disclosed. (Unchained)

Applied Research

Shielded Bitcoin Brings Zcash-Style Privacy to Bitcoin Without a Soft Fork

Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin propose Shielded Bitcoin, a protocol for hiding senders, recipients, amounts, and transaction links directly on Bitcoin L1 without changing Bitcoin consensus. Encrypted notes, nullifiers, and zero-knowledge proofs form a shielded state reconstructed by independent indexers from data published to Bitcoin. The design leaves timing, fees, and transaction structure visible, while peg-in and peg-out mechanisms remain future work. The current Groth16 profile also depends on a trusted setup. (Shielded Bitcoin)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) hacks web3 security crypto cybersecurity regulations <![CDATA[0x52 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x52-web3-security-bulletin aq7rUNeGg9vJVC1MHLeV Sat, 26 Sep 2026 09:19:34 GMT TL;DR

  • Blockchain malware surges: Malicious onchain C2 writes jumped fivefold, driven increasingly by state-linked groups.

  • Certora targets Solana with AutoProver combining AI-generated security properties with mathematical verification. While Nethermind tests AI auditing capabilities and Elliptic launches Decode, allowing onchain investigations that use natural-language queries.

  • Bitget loses $351.6M: Attackers spoofed transfers through its wallet backend without stealing private keys. The story is still developing. Payy's bridge was emptied and DarkSword malware is targeting wallets on iOS.

  • Fed advances stablecoin rules: Two proposals cover reserves, capital, custody, and bank applications. SEC narrows crypto token Howey exposure noting that functional networks, routine upgrades, and some buybacks generally fall outside the test. While EBA calls for tougher MiCA rules.

  • Citrea acquires Crest: The deal adds a zero-knowledge, self-custodial Bitcoin wallet to Citrea.

Industry Trends & Analysis

Malware C2 Writes on Public Chains Rose 5x YoY

Blockchain dead drops are malware payloads or command pointers stored in transactions or contracts. Dead drops prevent server takedowns to extend the life of exploit campaigns. Chainalysis found that daily malicious blockchain writes went from 2.06 to 11.1 following the release of open-weight coding models. This is a 440% rise in less than a year. By the second quarter of 2026, state-linked groups were about two-thirds of new activity each quarter and half of the total. The team counts more than 15 campaigns, including DPRK cluster UNC5342 relaying via TRON and Aptos to BNB Smart Chain. (Chainalysis)

Market Movements

Certora Brings Agentic Formal Verification to Solana

Certora extends AutoProver to Rust and is building native support for Solana programs. AI agents analyze code, infer candidate security properties, and investigate failures, while Certora's formal prover mathematically checks whether those properties hold across modeled executions. The approach aims to move formal verification from specialist engagements into the development lifecycle, giving Solana teams a way to continuously test invariants that conventional unit tests and fuzzing may never exercise. (Certora)

Nethermind Tests AI Security Analysis Against Human Auditing

Nethermind Security describes running Bloxchain Protocol through an end-to-end pipeline combining AuditAgent, adversarial AgentArena testing, and a conventional manual audit. Because Bloxchain provides reusable EVM approval, timelock, RBAC, and transaction-governance components, vulnerabilities could propagate into downstream projects rather than remaining isolated to one deployment. The case study presents AI analysis as an additional security layer throughout development rather than a substitute for expert review at the end. (Nethermind)

Elliptic Gives Compliance Teams an Agent for Onchain Investigations

Elliptic launches Decode, an AI agent that lets compliance and investigations teams query blockchain intelligence using natural language. Analysts can ask about an address, entity, transaction, counterparties, balances, or exposure and receive answers backed by Elliptic's attribution data rather than relying on unsupported model output. The launch reflects a broader shift toward agentic blockchain investigations as illicit actors and autonomous payment systems increasingly operate at machine speed. (Elliptic)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 302

Total amount lost in 2026: $2,125,232,225

Bitget Hit for $351.6M

Bitget flagged unauthorized hot-wallet transfers at 18:31 UTC on September 24. CEO Gracy Chen said an attacker compromised a backend in the wallet stack, spoofed transfer data, and triggered Bitget's authorization process. Private-key theft is ruled out. Hot and warm wallets were hit. Cold wallets were not.

Nineteen transfers moved ether, XRP, USDT, USDC, AVAX, and BNB on Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum. Earlier tallies near $183 million missed some chains. A protection fund above $464 million covers the loss. Withdrawals from the exchange have been paused. (CoinDesk)

Cosmos Hub Reclaims 1.23M ATOM

Cosmos Hub made no blocks for 24 hours and 48 minutes after stolen ATOM from Neutron arrived. Findings note that the Hub was not hacked. The attacker bought Neutron votes for 20,199 USDC and staked them 12 minutes before an expedited proposal closed, then took admin rights on 11 contracts, including Astroport and Drop. On the September 23 restart, the first block moved 1,227,121.37 ATOM, about $2.2M, from the attacker's address into a validator multisig. However, 168,990.9 ATOM arrived at the attacker-linked address seven blocks after the restart. (The Defiant)

Payy's Ethereum Bridge Emptied in One verifyRollup Batch

Payy said that at 4:21 UTC on September 24 its Ethereum bridge was drained of its full balance. Deposits, withdrawals, transfers, and card transactions are paused, and law enforcement has been notified.

DarkSword in the Wild

Google's Threat Intelligence Group documented DarkSword, a six-bug chain for iOS 18.4 through 18.7, used since November 2025 against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. Google says Apple had patched it by iOS 26.3.

On September 19, SlowMist warned that criminal groups are using DarkSword to read wallet phrases. (Google Cloud)

Policy & Regulation

The Fed Asks for Comment on Two GENIUS Act Stablecoin Rules

The Federal Reserve published two proposals for payment stablecoin issuers it supervises. The first requires full backing with permissible reserves, including short-term Treasuries, plus capital for credit and operational risk. It also covers reserve custodians, which stablecoin activities banks may conduct, and the Act's ban on tying. The second is how an insured state member bank applies for a stablecoin subsidiary: a business plan, financials, and hearings. (Federal Reserve)

SEC Staff Clarifies When Crypto Activity is Outside Howey

SEC staff clarified its March guidance on token classification and investment contracts. A staking receipt token can be a digital tool, or a digital commodity when issued by a protocol-based liquid-staking provider, if it proves ownership of the underlying asset and gives the issuer no right to use it. Marketing current utility or aspirational features generally does not promise essential managerial efforts without profit claims. Once a network is functional, maintenance, upgrades, growth work, and token buybacks generally do not satisfy Howey. A pre-functional buyback marketed as yield may. The FAQs are staff views, not binding SEC rules. (SEC)

EBA wants tighter rules for multi-issuer stablecoins and for crypto lending

The European Banking Authority answered the Commission's consultation on reviewing MiCA. Rules for asset-referenced tokens and e-money tokens are broadly fit, it says, but third-country multi-issuer stablecoin schemes need a stronger framework. It also asks for a fresh look at reserve requirements, including the minimum held as deposits, and for clearer definitions, which it says are slowing product launches. It wants crypto-asset lending regulated, including where a service provider routes users into decentralised lending, plus a reporting review. As of September 1, 39 e-money tokens had been issued under MiCA and no asset-referenced token had been authorised. (European Banking Authority)

Capital Allocation

Citrea buys Crest, a self-custodial private Bitcoin wallet

Citrea acquired Crest, a self-custodial wallet that uses zero-knowledge privacy pools on Citrea. Citrea is a Bitcoin application layer backed by Founders Fund and Galaxy Ventures. Terms were not disclosed. Crest founder Meliksah Gurtemel joins as product lead. A mobile wallet is due in the coming weeks, with automatic shielding, private bitcoin transfers, onboarding from Bitcoin and Ethereum, and private swaps that spend shielded bitcoin to pay an Ethereum-style address in USDC or ether. Citrea says the waitlist is above 1,000. (Citrea)

Applied Research

Post-Quantum Signatures Aren’t Yet Drop-In Replacements for Blockchains

Maja Lie and Ben Marsh evaluate post-quantum signature schemes against the operational requirements of Bitcoin, Ethereum, and high-throughput BFT chains. The analysis finds that standardized single-signer schemes such as ML-DSA and SLH-DSA solve only part of the migration problem: blockchains also require canonical encoding, DoS-resistant verification, aggregation, downgrade protection, accountable quorum signatures, committee rotation, and light-client compatibility. The authors argue that blockchain-specific post-quantum authentication profiles—not simply swapping ECDSA for a PQ signature—will be necessary. (arXiv)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) hacks regulations web3 security cybersecurity <![CDATA[0x51 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x51-web3-security-bulletin oMdghR0m7wV0WcMf8hmL Sat, 19 Sep 2026 06:59:55 GMT TL;DR

  • Agentic finance is becoming a security problem of its own. Elliptic says agentic crypto payments jumped 500% in three months, pushing compliance toward machine-speed controls, while Blockworks is now letting AI agents trigger risk alerts before analyst review in order to keep pace.

  • Security teams are moving from detection to prediction. Forta is modeling how DeFi exploits can cascade through interconnected protocols, while Certora’s Sui audit shows how something as mundane as gas exhaustion can become a protocol-level liveness failure.

  • Institutional blockchain infrastructure took another step forward. Circle launched Arc mainnet with USDC gas fees and validators including BlackRock, DTCC, Mastercard, Visa, and Standard Chartered, while Chainalysis added native tracing support.

  • Attackers had another expensive week. A Trezor newsletter vendor breach exposed roughly 347,000 email addresses, Symbiosis suffered a bridge exploit involving malformed Bitcoin deposit logic, and Chainflip is recovering from a $736K Tron USDT exploit. SlowMist now puts 2026 crypto losses above $1.7B.

  • Crypto regulation is getting more operational. The EU’s Cyber Resilience Act now imposes a 24-hour early-warning clock for actively exploited vulnerabilities, while the UK FCA has clarified which crypto activities will require authorization under its incoming regime.

  • U.S. crypto legislation hit another roadblock and then the CFTC and SEC stepped in. Senate cloture on the CLARITY-related motion failed 49–50, leaving the broader market-structure debate unresolved. While CFTC Chair Selig and SEC Chair Atkins took matters into their own hands.

  • Security infrastructure is attracting serious capital. S&P Global agreed to acquire OpenZeppelin, while Cube3.AI disclosed a $48.5M equity offering in a new SEC filing.

  • In research DeFiFusion combines transaction activity with smart-contract execution semantics to distinguish actual price-manipulation attacks from ordinary market volatility.

Industry Trends & Analysis

Agentic Crypto Payments Push Compliance Toward Machine-Speed Controls

Elliptic introduces eight principles for governing agentic onchain risk as it reports a 500% increase in agentic crypto payments over three months. The idea is that compliance systems designed around human transaction review will struggle when autonomous agents can originate, authorize, and settle transactions continuously. The emerging security problem therefore extends beyond securing the AI agent itself to controlling identity, authority, transaction intent, monitoring, and intervention across machine-driven financial workflows. (Elliptic)

Forta Models How DeFi Contagion Can Be Detected Before It Spreads

Forta examines how real-time onchain monitoring can quantify contagion risk rather than treating protocol exploits as isolated events. The research focuses on dependencies connecting protocols such as shared collateral, liquidity, integrations, and other exposure paths, that can transform a localized incident into ecosystem-wide stress. The approach points toward security monitoring that evaluates both whether a protocol is being attacked and which downstream protocols, assets, or positions are likely to become exposed next. (Forta)

AI Fuzzing Finds Real Runtime Bugs but Still Needs Human Verification

Burak Yalçınkaya examines Runtime Verification’s experiment using AI to construct differential fuzzing infrastructure for WebAssembly runtimes. The system successfully surfaced divergences and potential bugs, but expert review remained necessary to determine whether findings represented genuine implementation defects or problems in the generated testing infrastructure. Although focused on Wasm rather than a single blockchain, the work is directly relevant to blockchain runtimes and suggests AI can accelerate vulnerability discovery without yet replacing expert validation. (Runtime Verification)

Critical Order-Book Liveness Bug Found in Sui Perpetuals

Certora discovered a critical vulnerability during its audit of Aftermath Finance Perpetuals on Sui. Interactions between order matching, stale-order cleanup, and transaction gas limits could prevent the fully onchain order book from making progress, creating a protocol-level liveness failure. Aftermath fixed the issue before publication. The finding illustrates why gas consumption and guaranteed execution progress are security properties for stateful DeFi protocols, not merely performance considerations. (Certora)

Asen Kicks off a New Series: AI for Web3 Security, Zero to Hero

Module 1 of a course that builds lucid, a single-call Hunter Agent is uses one prompt, produces findings in JSON, and does not use a judge. Thew results include an impact score (Medium and above), line-numbered citations, and a pydantic Finding schema. (0xasen)

Market Movements

Agentic Risk Detection

Blockworks added Agentic Detection to Blockworks Monitoring. Customers can get alerts as soon as its agents flag them, without waiting for analyst approval. Previously every alert needed that sign-off. The agents watch X, GitHub, governance forums, project channels, and news sources; original sources stay attached. Analysts still check items later, then the status moves to Analyst Verified. Related alerts can group into an Event with a shared timeline. Delivery is available via Slack, email, Telegram, webhooks, and API; an MCP is listed as coming. The feature is on for all Monitoring customers. (Blockworks)

Circle Opens Arc mainnet

Circle launched Arc, an EVM Layer 1 that pays fees in USDC. Named founding validators include BlackRock, DTCC, ICE, Mastercard, Standard Chartered, Visa, and Worldpay. Circle says post-quantum signatures are supported now. Opt-in confidential transactions with view keys are still in development. It minted 10 billion ARC as a later proof-of-stake token; fees stay in USDC. In support of Arc tracing, Chainalysis has added automatic ERC-20 and ERC-721 coverage on Arc for KYT, screening, and Reactor. (Arc)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 282

Total amount lost in 2026: $1,711,322,315

Trezor Supply-Chain Breach Exposes 347,000 Users

Trezor says Brevo, its newsletter vendor, was breached on September 9. An unauthorized actor used about 120 compromised Brevo accounts, including a list of about 347,000 addresses to phish customers. The attacker's message, subject "Critical Security Alert: STM32 Entropy Vulnerability," linked to an app that asked for a wallet backup. Trezor says no product, wallet, or account system was touched. It took the sending domain down within 20 minutes; although about 2,500 people had already clicked. (Trezor)

A 330-satoshi Bitcoin Deposit Minted Unbacked syBTC

Symbiosis says its Bitcoin Bridge decoder read the sender from a spender-controlled Bitcoin-tx field, so the attacker could pose as an authorized depositor and the portal administrator. They set the minimum portal fee below zero and submitted negative-fee deposits. The fee was subtracted without a sign check, so subtraction added: 330 satoshi minted arbitrary syBTC. Twelve deposits went through on BSC, Ethereum, and Rootstock in about four minutes. Bitcoin payouts to the attacker never completed. About 15.2 BTC of portal funds were moved to reserve. Preliminary LP and user loss is 9.97 BTC. (Symbiosis on X)

Chainflip Restarts After $736K Tron USDT Exploit

Chainflip is bringing its network back online after an attacker exploited Tron transaction memo handling to trigger duplicate LP withdrawal payouts, draining 736,442 USDT. The protocol has patched the flaw by restricting swap instructions to direct TRX and TRC-20 transfers and excluding contract-wrapped transactions. Chainflip plans a staged restart, with Tron services returning last. Affected Tron USDT LP balances will be reset while claims are tracked on-chain, with Chainflip working on recovery and reimbursement while expanding duplicate-payout monitoring across supported chains. (Chainflip)

Policy & Regulation

EU’s 24-Hour Vulnerability Reporting Clock Takes Effect

The European Commission confirmed that Cyber Resilience Act reporting requirements became applicable September 11. Manufacturers of products with digital elements, including covered hardware and software crypto-wallet products, must report actively exploited vulnerabilities and severe security incidents, with an early warning due within 24 hours and a fuller notification within 72 hours. Reports flow through ENISA’s new Single Reporting Platform. Additional CRA obligations become applicable in December 2027. (European Commission)

UK FCA Defines Which Crypto Activities Require Authorization

The Financial Conduct Authority published final perimeter guidance on September 16 explaining when businesses will need FCA authorization under the UK’s incoming crypto regime. It covers stablecoin issuance, crypto trading platforms, dealing and arranging, custody, and staking. Applications open September 30, 2026, while the full regime takes effect October 25, 2027. The FCA plans additional guidance updates covering DeFi, technology providers and other perimeter issues. (FCA)

Legislative Watch

Senate Cloture on CLARITY fails 49–50

Senate vote 234 on September 15 rejected cloture on the motion to proceed to H.R. 3633, 49–50–1. Sixty votes were required. All 49 yeas were Republican. Collins, Hawley, Moran, and Tillis voted no; Coons did not vote. Tillis voted no so he could file a motion to reconsider. (US Senate)

Followup from CFTC Chair Selig and SEC Chair Atkins

Capital Allocation

S&P Global Agrees to Acquire OpenZeppelin

S&P Global (NYSE: SPGI) has entered an agreement to acquire OpenZeppelin. The deal is subject to closing conditions. Financial terms were not disclosed. OpenZeppelin says Contracts libraries stay open source on GitHub, including future versions, and that audits, engineering, and ecosystem programs continue with the same team. S&P Global Ratings president Yann Le Pallec said OpenZeppelin would complement S&P's smart-contract and onchain technology risk assessment. (OpenZeppelin)

Cube Security Inc. reports $48.5M sold in a Form D

Cube Security Inc., which operates Cube3.AI, filed an SEC Form D on September 11 for a Rule 506(b) equity offering of $48,519,636. That total includes $5,519,908 of notes that converted and had been reported on an earlier Form D. The securities are equity plus conversion of debt. James Wise (Balderton Capital) and Oivind Lorentzen (Oak HC/FT) were elected directors in connection with the offering. The notice does not name the round or the investing funds. (SEC)

Applied Research

DeFiFusion Detects Price Manipulation

Rui Cao, Shaojing Fan, Liming Fang, Yuchan Liu, Yingying Jiao, and Zhenguang Liu introduce DeFiFusion, a detection framework for DeFi price-manipulation attacks. Rather than analyzing transactions or smart-contract code independently, the system jointly models transaction events and contract execution semantics. The approach addresses two common weaknesses: transaction-only systems confusing legitimate volatility with attacks, and static analyzers flagging vulnerabilities that cannot actually be exploited under real transaction conditions. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 crypto security cybersecurity regulations hacks <![CDATA[0x50 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x50-web3-security-bulletin FHrzh2kp7x8uRoyDtQDH Fri, 11 Sep 2026 08:21:46 GMT TL;DR

  • Exploits: A "whitehat" drained ~$320M from the Liquid Network via a rangeproof caching flaw (later returning 85%); Rain's crypto card contracts lost $1.1M, and a Nomic double-spend threatened Osmosis's synthetic Bitcoin backing.

  • Trends: Attackers are shifting focus to Web3 developer supply chains (npm packages, build tooling), and Harmony proposes abandoning its independent Layer 1 to migrate to Ethereum following August's minting exploit.

  • Policy: The Clarity Act is back in focus next week, global enforcement escalates as India orders 15 offshore exchanges blocked, Italy mandates sanctions screening on every crypto transfer, and OFAC takes down the Xinbi laundering marketplace.

Industry Trends & Analysis

Dedaub Improves EVM Bytecode Reconstruction With AI

Giorgio Bonuccelli details improvements to Dedaub’s EVM bytecode decompiler funded through TheDAO Security Fund. The tool converts deployed contracts lacking source code into more readable Solidity-like representations, with funding supporting higher-quality reconstruction and expanded access to AI-assisted decompilation. Better bytecode reconstruction is particularly useful for incident response and vulnerability research when verified source code is unavailable. (Dedaub)

Web3 Developers Face a Growing Dependency-Supply-Chain Threat

Attackers are increasingly targeting npm packages, dependencies, and build tooling, while setting up fake recruiter exercises and compromising frontend components, rather than attacking audited smart contracts directly. Because these components can gain access to developer credentials and wallet interactions, conventional contract audits provide little protection. QuillAudit's analysis recommends dependency scanning, isolated development environments, package verification, and hardware-backed MFA as increasingly important parts of Web3 development security. (QuillAudits)

EU Cyber Resilience Act Reporting Deadline Reaches Web3

Hacken outlines requirements under the EU Cyber Resilience Act as its Article 14 vulnerability and incident-reporting obligations begin September 11, 2026. The regulation applies broadly to products with digital elements sold into the EU, potentially covering hardware wallets, SDKs, crypto software, and other Web3 products. Broader CRA product-security requirements take effect in December 2027, with serious violations potentially attracting substantial administrative penalties. (Hacken)

Harmony Moves Toward Shutting Down Its Layer 1

Following August’s unauthorized ONE minting incident and controversial rollback, Harmony has proposed retiring its independent Layer 1 and migrating ONE to Ethereum as an ERC-20. The earlier exploit reportedly created roughly four billion unauthorized ONE tokens.

Under the proposed transition, balances would be snapshotted and reproduced on Ethereum while existing smart contracts and liquidity positions would not migrate automatically. (CoinDesk)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 267

Total amount lost in 2026: $1,694,435,091

A "Whitehat" Drained 4,000 BTC from Liquid

The purported whitehats minted L-BTC without depositing bitcoin, then drained Liquid's reserve. They took roughly 4,000 of about 4,200 BTC held on the sidechain, about $320 million. Confidential Transactions hide amounts, so Liquid caches successful rangeproof checks; a keying flaw let later invalid data hit a cached true.

After the drain they messaged Blockstream on-chain, including "The chain is under risk at latest commit" and "make sure every node is patched." Once Blockstream confirmed bridge nodes were patched, one transaction returned 3,400 BTC (85%) and left about 600 BTC (~$47 million) with the actors. Bitcoin's base chain was not broken. (Chainalysis) (CertiK)

Rain Card Contract Exploit Exposes $1.1M in Stablecoin Balances

An outdated Solana contract used by Rain-powered crypto card programs reportedly allowed unauthorized withdrawals from card collateral accounts. Approximately $1.1 million was stolen across multiple programs, including losses affecting Avici and Tria customers, before the vulnerable contract version was replaced. The incident affected custodial card-contract balances rather than users’ self-custodial wallets, illustrating the additional smart-contract attack surface introduced by crypto payment infrastructure. (Printhereum)

Nomic Double-Spend Threatens Osmosis Bitcoin Backing

A flaw in Nomic’s custom forwarding mechanism allowed an attacker to generate false nBTC vouchers and compromise approximately 39.84 nBTC. Osmosis suspended minting, redemptions, deposits, and withdrawals for Alloyed BTC while an emergency upgrade froze 22.65 BTC associated with the attacker. The incident is particularly significant because the compromised nBTC represented roughly 36% of the backing supporting Osmosis’ synthetic Bitcoin asset. (Crypto Briefing)

Policy & Regulation

OFAC Targets Crypto Laundering Marketplace Xinbi

The Chainalysis team examines U.S. sanctions against Xinbi Guarantee, a Chinese-language marketplace providing money laundering, scam infrastructure, stolen data, and related criminal services. Chainalysis says DPRK-linked actors moved proceeds from major crypto compromises, including Bybit and WazirX, through Xinbi-associated vendors. Authorities seized or restrained more than $52 million in cryptocurrency while targeting dozens of wallets associated with the marketplace and its vendor network. (Chainalysis)

India Orders 15 Offshore Crypto Platforms Taken Down

India’s Financial Intelligence Unit issued non-compliance notices on September 9 against 15 virtual digital asset service providers, including Weex, Blofin, Bitunix, DigiFinex, WOO X, Pionex and WhiteBIT. Authorities ordered their websites and applications blocked for operating without the registration and AML obligations required under India’s Prevention of Money Laundering Act. The action reinforces India’s position that offshore crypto firms serving Indian users remain subject to domestic AML registration regardless of physical presence. (Gov't of India - Press Information Bureau)

Italy Orders Sanctions Screening on Every Crypto Transfer

Banca d’Italia reminded Italian crypto-asset service providers on September 7 that sanctions screening must cover every crypto transfer, irrespective of transaction value. Firms were specifically told to ensure internal systems do not contain minimum-value thresholds capable of bypassing sanctions checks. The communication does not establish a new sanctions regime, but sharpens supervisory expectations under existing EU restrictive-measures guidance and makes clear that MiCA authorization does not displace sanctions-compliance obligations. (Banca d’Italia)

Legislative Watch

Following the Clarity Act

Applied Research

Researchers Revisit the Security of Ethereum’s ECDSA Key-Recovery Model

Keita Emura analyzes the security properties of ECDSA with public-key recovery, the signature construction used by Ethereum to recover a signer’s public key directly from a message and signature. The paper examines the scheme under BUFF security, a stronger framework concerned with unexpected interactions between signature functionality and key recovery. The work provides formal cryptographic analysis relevant to Ethereum’s transaction-authentication model rather than identifying an implementation vulnerability in Ethereum itself. (Springer)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity regulations policy hacks exploits <![CDATA[0x49 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x49-web3-security-bulletin OBI6ujXBgf4o88TogBdV Sat, 05 Sep 2026 12:20:33 GMT TL;DR

  • Trends & Markets: Browser extensions are being weaponized as wallet drainers, tokenized assets face weekend pricing risks, and Chainalysis is expanding coverage to include support for HyperEVM.

  • Exploits & Incidents: A $75M exploit hit Tectonic via illiquid collateral manipulation, and an unchecked integer cast in Notional Finance led to a $1.73M drain.

  • Policy & Regulation: Russia's new comprehensive cryptocurrency regulatory regime has officially taken effect.

  • Capital Allocation: Firelight raised $8M to build decentralized insurance for DeFi, and YC's Verdict Machine launched AI-native cybersecurity for institutional digital assets.

  • Applied Research: Recent papers introduce a dataset mapping smart-contract CVEs to code, a graph-based blockchain screening system, and LLM-generated vulnerability benchmarks.

Subscribe

Industry Trends & Analysis

Nineteen Browser Extensions Shipped a Wallet Drainer

Socket’s Karlo Zanki tracks 18 Chrome extensions and one Edge add-on that are capable of stealing browser information, account sessions, credentials, and cryptocurrency-related data. Several legitimate extensions were reportedly acquired and later updated with modular malware targeting services including Coinbase, Binance, Kraken, OKX, MetaMask, and others. The campaign demonstrates how browser-extension supply chains can bypass assumptions users make about previously trusted software and gain privileged access to authenticated sessions. (Socket)

Weekend Oracle Gaps Create Risk for Tokenized Stocks

The QuillAudits team examines a mismatch between 24/7 tokenized-equity trading and price feeds that still depend on traditional market hours. For example Coinbase-issued tokenized stocks can continue moving on Base while underlying reference prices may remain frozen over weekends, potentially leaving DeFi protocols with stale collateral valuations. The analysis argues that bringing equities onchain requires risk models designed around both blockchain-native markets and the operating schedules of traditional finance. (Quill Audits)

Market Movements

Chainalysis Adds HyperEVM Monitoring

Chainalysis announces support for HyperEVM, extending compliance and investigative tooling to Hyperliquid’s EVM-compatible environment. The integration automatically covers ERC-20 and ERC-721 assets and makes HyperEVM activity available through KYT, address screening, and Reactor. For exchanges and other regulated businesses interacting with the ecosystem, the release expands transaction monitoring and tracing without requiring individual integrations for each token. (Chainalysis)

Non-Financial Companies Need More Than a Stablecoin Wallet

Itai Turbahn argues that stablecoin adoption by mainstream companies creates requirements far beyond simply holding and transferring tokens. Enterprises need screening, asset conversion, routing, retries, reconciliation, policy enforcement, and multi-chain connectivity behind the wallet interface. The article frames wallet infrastructure as an operational abstraction layer that lets non-financial companies use blockchain rails without rebuilding treasury, payments, and compliance systems around blockchain-specific mechanics. (Fireblocks)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 249

Total amount lost in 2026: $1,303,451,456

Tectonic’s Illiquid Token Becomes a $75M Attack Vector

Rob Behnke examines the Tectonic exploit on Cronos, where an attacker drove the thinly traded TONIC token roughly 100× higher before using the inflated asset as collateral across lending markets. Approximately $75 million was borrowed, although only a fraction escaped before Cronos validators halted the network and rolled back state. The incident demonstrates how low-liquidity collateral can turn market manipulation into a protocol-wide solvency threat. (Halborn)

Notional’s Integer Cast Turns $1.73M of Debt Into Zero

Anmol explains how an unchecked uint128 conversion in Notional Finance caused debt equal to 2^128 to truncate to zero during a solvency check. The attacker fabricated fCash claims, withdrew roughly $1.73M in DAI and USDC, converted the proceeds to ETH, and routed funds through Tornado Cash. The incident highlights how seemingly simple narrowing casts can undermine an otherwise complex financial risk model. (Quill Audits)

Policy & Regulation

Russia’s Comprehensive Crypto Regime Takes Effect

Russia’s new cryptocurrency framework entered into force September 1, bringing crypto trading into a regulated structure overseen by the Bank of Russia. Trading must move through authorized intermediaries, while non-qualified retail investors face knowledge-testing requirements and annual purchase limits. The framework continues Russia’s prohibition on domestic cryptocurrency payments while creating regulated pathways for investment and certain international uses. Existing market participants have a transition period extending into 2027. (The Industry Spread)

Capital Allocation

Firelight Raises $8M to Offset DeFi Risks

Firelight closed an $8M seed led by Gumi Cryptos Capital, with Maven 11, Metalayer, Joint Effects, and Tribe Capital.

Firelight is a decentralized cover protocol that protects onchain capital against protocol, smart contract and economic risks.

The team is starting with XRP first, then bitcoin and XLM. Flare is named as a backer; staked XRP is the initial capital. The protocol and first integrations are scheduled for September. Claims would be checked onchain by GFX Labs, Hypernative, Credora, Native, and Cyfrin. CEO Anthony DeMartino previously ran Coinbase Risk Strategies; CSO Connor Sullivan came from Fireblocks. (Firelight)

Verdict Machine Launches AI-Native Security for Institutional Crypto

Y Combinator introduced Verdict Machine, an S26 startup building AI-powered cybersecurity for financial institutions managing digital assets. Founded by former Check Point blockchain-security leaders, the company maps an institution’s onchain environment, assesses cyber risk, generates tailored controls, and evaluates transactions before execution. Verdict Machine says it already has POCs with asset managers and digital-asset infrastructure providers and is being evaluated by major banks, positioning it as a new entrant in institutional onchain security. (Y Combinator)

Applied Research

A New Dataset Maps Smart-Contract CVEs to Real Code

Monika di Angelo and Gernot Salzer introduce CVE-Smart-Contracts, a curated dataset connecting hundreds of CVE records with deployed Ethereum contracts and, where available, vulnerability labels and source locations. The collection includes source code and bytecode and is intended to support reproducible evaluation of analysis and repair tools. Importantly, the dataset preserves CVE claims rather than treating every original vulnerability report as independently revalidated ground truth. (arXiv)

Blockchain Screening Without Known Bad-Address Labels

Yury Korolev presents a graph-based blockchain screening system operating across 835M addresses and 15.8B transaction edges on five EVM chains. Instead of relying solely on sanctions lists or known labels, the model scores addresses from their position in the transaction graph and transfers detection capabilities to previously unlabeled chains. Tests on Base, Arbitrum, and Gnosis show strong recall, although adversarial simulations also identify blind spots against synthesized behavior. (arXiv)

LLMs Generate Smart-Contract Vulnerabilities for Security Testing

Luca Migliaccio, Roberto Natella, Naghmeh Ivaki, Nuno Laranjeiro, and Marco Vieira explore using LLMs to automatically inject vulnerabilities into Solidity contracts, creating ground-truth datasets for evaluating security tools. Nearly 1,000 variants targeting 49 OpenSCV vulnerability classes produced 32 validated vulnerable contracts covering 25 classes. Testing three static analyzers against the dataset revealed complementary but incomplete detection coverage, suggesting LLM-generated vulnerabilities could expand security benchmarks despite significant reliability and scalability limitations. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) hacks security web3 cybersecurity policy <![CDATA[0x48 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x48-web3-security-bulletin XrJSF06HUqFWWDwGCdl6 Fri, 28 Aug 2026 11:19:05 GMT TL;DR

  • Compliance & Infrastructure: Research argues permissionless chains can meet AML requirements at the application layer, while Fireblocks details data sovereignty controls for EU institutions.

  • Vulnerabilities & Exploits: A Term Finance governance capture drained $8.5M, an expired Tornado Cash domain enabled a massive phishing campaign, and a supply-chain zero-day exposed Trezor customer data.

  • Preventative Security: New tools are moving defense upstream, with Forta introducing pre-execution screening for OP Enterprise and ChainPatrol embedding phishing detection at the registrar level.

Industry Trends & Analysis

Permissionless Blockchains Can Meet Financial-Integrity Requirements

Rebecca Rettig, Omid Malekan, and Michael Mosier argue that regulated financial institutions do not inherently need permissioned blockchains to satisfy AML, CFT, and sanctions obligations. The paper proposes placing compliance and risk-management controls at the application layer rather than attempting to control the underlying validator network. It also addresses concerns including illicit-actor exposure, transaction privacy, asset provenance, and regulatory auditability, presenting a framework for institutions seeking to use open blockchain infrastructure without abandoning financial-integrity controls. (SSRN)

What the First 24 Hours After an Exploit Should Look Like

Quantstamp lays out an incident-response checklist focused on the period when every block can increase losses. Immediate priorities include pausing affected functionality, contacting exchanges with attacker addresses, moving internal coordination away from potentially compromised channels, issuing a minimal public acknowledgment, and bringing in forensic tracing expertise. The broader message is operational: protocols need emergency authority, communications procedures, exchange contacts, and investigation capabilities established before an exploit starts. (Quantstamp)

Verifying powdr’s zkVM Acceleration

A zkVM can prove a program ran correctly without anyone re-running it, but the prover pays for every instruction. powdr finds hot stretches of code and collapses them into one smaller circuit, the way a compiler fuses a loop. If that rewrite is too loose, a rollup could accept a fake state change. If it is too tight, an honest block might fail to prove. Certora’s tool compares the circuit before and after each rewrite. On Keccak and a Reth Ethereum-client trace it proved 99.0% and 98.7% of 6,627 checks, found no real mismatches, and caught one timestamp-overflow edge case that was not exploitable. (Certora)

AI Is a Solidity Pair Programmer, Not a Security Architect

Andrei Toma argues that AI assistants can accelerate Solidity development through scaffolding, tests, documentation, and implementation support, but their output inherits the same security risks as any other generated code. The recommended model keeps developers responsible for architecture and threat modeling while subjecting AI-generated contracts to manual review, testing, and verification. For smart contracts, productivity gains do not change the underlying requirement: every generated assumption involving money or authorization still needs independent validation. (Nethermind)

Stablecoin Freeze Keys Are a Neobank Dependency Risk

Anmol notes that crypto neobanks are relying on stablecoin administrative powers they do not control, including freezing, minting, and contract upgrades. Reserve quality therefore captures only part of the risk. Teams should inventory the stablecoins underpinning customer balances and settlement, identify who controls privileged functions, and test what happens operationally if balances suddenly become non-transferable. The article reframes stablecoin administration as a concentration and business-continuity problem rather than merely a token or reserve-management issue. (quillaudits.com)

Market Movements

Forta Brings Pre-Execution Screening to OP Enterprise

Forta Firewall now has an OP Enterprise transaction-screening option, with Kraken’s Ink becoming its first adopter. The integration places security evaluation directly in the sequencer path, allowing selected modules to examine transactions before block construction for risks such as sanctioned addresses, scams, and exploits. Forta says evaluations complete in under 10 milliseconds, while applications inherit the protection without contract or SDK changes. The model shifts security controls from post-execution detection toward preventative transaction admission. (Forta)

ChainPatrol Moves Phishing Detection Upstream to Registrars

ChainPatrol Team reports that Realtime Register has embedded ChainPatrol intelligence directly into its Abuse Monitoring platform and made it available to resellers without additional cost. Early detections included a convincing fake wallet and cloned prediction-market site. More importantly, threat clustering allows registrars to identify related malicious domains and suspend infrastructure before campaigns mature, moving Web3 phishing defense upstream from individual wallets and users toward the domain-registration layer. (ChainPatrol)

Fireblocks Details EU Data Sovereignty and Customer Key Control

Ana Santillan addresses how European financial institutions should evaluate jurisdiction, signing authority, data residency, continuity, and vendor dependence in digital-asset infrastructure. Fireblocks says its EU SaaS environment operates across four European countries, while customers retain sole transaction-signing authority under both MPC and HSM deployment models. The article’s central security argument is architectural: regulatory or operational disruption affecting the service provider should not translate into unilateral provider access to customer private keys or digital assets. (Fireblocks)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 241

Total amount lost in 2026: $1,215,897,597

Phishing with an Expired Tornado Cash Domain

Wu Blockchain reports that a user followed a bookmarked link to the old official tornado[.]cash domain and landed on a phishing frontend. The domain had expired after the team did not renew it under OFAC sanctions; attackers then registered it and stole deposit credentials. 1,010 ETH left within 12 hours. The same group has allegedly taken nearly 4,000 ETH this way over the past 12 months. A same-day Wu follow-up cites on-chain analyst Specter arguing the purported victim may himself be a threat actor and that the drained funds may be illicit. (WuBlockchain on X))

Provenance Blockchain Bug

A bug existed in Provenance Blockchain (Cosmos SDK) prior to v1.28.0. AddAccess treated a caller as admin if they controlled 100% of a marker’s circulating supply, but accountControlsAllSupply compared the bank balance to the marker struct’s stored supply, which stays 0 for non-fixed markers. Any zero-balance account could therefore grant itself admin, mint, and withdrawal permissions in two transactions. The attack in two transactions: grant admin, then mint or withdraw. At discovery, 82 mainnet markers were exploitable, including escrow holding about $500,000 of nhash. (Trail of Bits)

Term Finance Governance Capture Drains $8.5M

An attacker turned roughly half an ETH into effective control of Term Finance’s sparsely participated governance, securing about 91% of voting power in the ETH Meta Vault and total control across several USDC vaults. The resulting proposals disabled the delay mechanism, installed attacker-controlled strategies, and drained roughly 2,843 WETH and 1.68M USDC. The core Yearn-based vault code was not exploited; the failure was governance design combined with near-zero participation. (rekt)

Pendle's PT-reUSD Oracle was Misconfigured and Exploited

kanveuler’s post reconstructs an Ethereum Morpho incident on the PT-reUSD-10DEC2026 / USDC and USDT markets. Wallet 0x854e…690d spent 320,000 SY-reUSD across 11 swapExactSyForYt trades in nine minutes. That moved a 900-second Pendle TWAP. The Ojo wrapper takes the lower of that TWAP and a linear maturity discount, so a depressed Pendle price became the oracle. The oracle fell 51 bps at the last buy, then 277 bps as the window rolled. Thirty-three liquidations repaid about $36.1M of debt, seized 38.6 million PT, and paid a 2.62% bonus. (Hackedmd)

Trezor Customer Data Exposed Through a Supply-Chain Zero-Day

Rob Behnke reviews the Trezor/ShipMonk breach, where approximately 14,000 customers had shipping or other personal information exposed even though Trezor hardware wallets themselves were unaffected. The compromise traced back to CVE-2026-72898, a CVSS 10.0 SQL-injection flaw in ShipMonk’s Metabase deployment that was exploited as a zero-day. The resulting data significantly strengthens phishing and impersonation opportunities against hardware-wallet owners, reinforcing the physical and social-engineering consequences of third-party data exposure. (Halborn)

Capital Allocation

Beldex Raises $8 Million for Privacy Tooling and AI

Beldex raised $8 million led by Sigma Capital, with NTC, Nxgen, Digital Consensus Fund, and EAK Ventures. The privacy-focused blockchain company plans to invest in confidential applications, encrypted AI-agent identities, developer tooling, protocol security, zero-knowledge systems, quantum-safe cryptography, secure memory for agent payments and BNS identities. (Beldex)

Applied Research

Bitcoin, Ethereum and Solana Face Different Post-Quantum Migration Problems

Aleksei Kodukhov reviews how cryptographically relevant quantum computers could threaten major blockchain systems relying on elliptic-curve signatures. The paper distinguishes at-rest, on-spend, and on-setup attack models and examines the particular exposure of Bitcoin, Ethereum, and Solana. It then surveys migration options, including NIST-standardized post-quantum signatures and ecosystem-specific approaches under development. The research frames quantum preparedness less as a single cryptographic upgrade than as a migration problem involving exposed keys, transaction models, compatibility, and economic risk. (arXiv)

Blockchain and Zero Knowledge Add Verifiable Trust to RAG

Baixiang Liu, Haotian Che, and Yuan Li propose TrustRAG, a blockchain-backed architecture intended to prevent tampering with documents and credibility scores used by retrieval-augmented AI systems. Expert committees evaluate content through a zero-knowledge protocol, while secure multiparty computation combines private assessments into verifiable trust scores. Hash commitments distributed across chains create an auditable record, allowing clients to detect altered or removed content and independently reproduce rankings. The work applies blockchain security primitives to AI data provenance rather than cryptocurrency itself. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) security web3 cybersecurity hacks research <![CDATA[0x47 Web3 Security Bulletin ]]> https://paragraph.com/@w3sb/0x47-web3-security-bulletin M1gChlb3eGczuNtWFcG2 Sat, 22 Aug 2026 16:27:09 GMT TL;DR

  • Chainalysis draws a hard line between deterministic wallet clustering and predictive ML signals, a useful reminder that attribution claims need to be reproducible and auditable.

  • AI-assisted audit work is improving fastest when protocol-specific context and expert triage stay in the loop, as Nethermind’s Lido Evergreen pilot showed.

  • This week’s operational theme is latency: RWA freeze controls, TradFi Hyperliquid approval workflows, and Harmony’s rollback all point to governance models that must act faster than manual review cycles.

  • Researchers investigating Telegram's new Mini Apps found a particularly serious issue in Telegram’s official Wallet, where exposure of a recovery mnemonic could potentially lead to complete wallet compromise. After responsible disclosure, Telegram introduced two secure-storage APIs, and subsequent testing confirmed that the official wallet no longer stored its mnemonic phrase in plaintext.

Industry Trends & Analysis

Don't Cluster Wallets with a Predictive Model

Wallet segments are Tier 1 intelligence claims that must be deterministic, reproducible, and auditable. Predictive models fail that bar even when they are accurate, because the rules are learned from training data and can shift when the data does. Chainalysis keeps machine learning for Tier 2 work, lead generation, anomaly detection, and Alterya scam scoring, and treats those outputs as signals that still need a human check. Backing up this process, they point to the 2024 Daubert ruling in United States v. Sterlingov, which tested heuristic clustering, not model output as fact. (Chainalysis)

Protocol Context Makes AI Auditing More Useful

The four-week Lido Evergreen initiative covered roughly 19,000 lines of already-audited core code using AuditAgent, AgentArena, protocol-specific documentation, and human researchers. Adding Lido-specific context raised AgentArena coverage from 67% to 83% and 44% to 78% across two test clusters. The strongest overall coverage came from combining AI agents with expert researchers, reinforcing that specialized context and human triage remain important even as autonomous security tooling improves. (Nethermind)

RWA Freeze Policies Need to Move in Seconds

Forta argues that programmable real-world assets need pre-authorized incident controls rather than purely manual freeze decisions. During the Gravity Bridge exploit, stolen PAXG remained in the attacker’s publicly visible wallet for 27 minutes before being converted to WETH despite being technically freezable. Forta proposes narrowly defined automatic triggers, temporary 72-hour freezes, transparent appeal procedures, and sub-minute execution, moving human review from the initial emergency response to determining whether the intervention should remain in force. (Forta)

Three Bugs Found Outside CompCert’s Proof Boundary

Cantina reports that its Apex system reproduced three defects around the formally verified CompCert compiler: Win64 register-state corruption, an incorrect C front-end struct layout, and assembly injection through a crafted filename. The findings do not invalidate CompCert’s core correctness theorem; instead, they occurred in parsing, target modeling, or output layers outside the proof boundary. The research illustrates an important limitation of formal verification: verified components remain dependent on surrounding code and assumptions that may themselves be vulnerable. (Cantina)

Market Movements

Human Sign-off Cannot Keep Up with Sub-second Hyperliquid Blocks

Fireblocks recommends defining venue, asset, position-size, transfer, and destination policies before trading begins so compliant transactions can execute automatically within those boundaries. The model moves humans from approving individual time-sensitive actions to establishing policy beforehand, preserving governance without allowing approval latency to create liquidation exposure. (Fireblocks)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 232

Total amount lost in 2026: $1,198,033,060

Aeternum Parks its C2 on Polygon Contracts

Aeternum, a C++ Windows botnet loader, reads command-and-control data from Polygon smart contracts instead of attacker-owned servers. Infected hosts send JSON-RPC eth_calls to public RPC endpoints. The campaign fingerprint is function selector 0xb68d1809 (getDomain()), which returns an XOR key and a Base64-encrypted domain.

Operators rotate that value with admin-only updateDomain (0xb249cd2d). Samples drop XWorm, XMRig, and stealers, then exfiltrate over Telegram. (Palo Alto Networks)

Harmony Will Rewind to Aug 11 and Drop Over 100k Transactions

Harmony has decided to rollback the chain after last week’s forged ONE mint. Validators are to restore shard 0 block 92,730,034 and shard 1 block 94,978,278 (both 23:25:37 UTC on August 11) and restart from replacement databases.

Client v2026.1.2 rejects the exploit block hashes. The discarded shard-0 window is 141,628 blocks, 109,126 regular transactions, and 315 staking transactions. Harmony said selective replay was unsafe: balances, nonces, and contract state would not match. (Cointelegraph)

Policy & Regulation

SEC Proposes Regulation Crypto Assets

The SEC issued proposed rule S7-2026-27, its first crypto-specific offering regime. Two exemptions from Securities Act registration: a startup path of up to $5 million over four years, and a fundraising path of up to $75 million in any 12-month period. Issuers still file principles-based disclosures and remain under antifraud rules. A conditional safe harbor would treat the investment contract as ended once promised managerial efforts have ceased, so the token would no longer sit under that Howey wrapper. Subpart E would preempt state registration for qualifying purchasers. Comments run 60 days after Federal Register publication. (SEC)

FASB: When a Stablecoin Can Sit in Cash Equivalents

On August 18 the Financial Accounting Standards Board proposed an Accounting Standards Update that leaves the cash-equivalent definition unchanged and adds examples. A qualifying token needs an on-demand contractual right to redeem directly with the issuer for a known cash amount, plus at least one-to-one segregated reserves in short-term, highly liquid assets. An active secondary market is not enough if the holder cannot redeem with the issuer. Reserves of crypto and gold fail the example. Entities may still choose not to present a qualifying token as cash. Comments close November 19. (FASB)

Austria Fines Bitpanda for MiCA Violations

Austria's Financial Market Authority fined Bitpanda GmbH €70,000 for violations of the EU's Markets in Crypto-Assets Regulation. The regulator found that Bitpanda failed to submit a required crypto-asset whitepaper at least 20 working days before publication and distributed marketing materials before the whitepaper was published. The communications also omitted required MiCA disclosures and contact information. The sanction is legally binding, making it a notable example of MiCA moving from implementation into active enforcement. (FMA Osterreich)

Applied Research

0xPass Splits Cross-Chain Account Trust Across Layers

Bernardo David, Keon Kim, and Krish Chelikavada propose 0xPass, a modular architecture for cross-chain accounts that separates request orchestration, transaction solving, and signing. Threshold signatures prevent any single transaction node from possessing the complete signing key, while constrained delegation, policy enforcement, recovery, distributed key generation, and auditable communications provide additional controls. A staged deployment model is designed to move implementations progressively from centralized operation toward more permissionless infrastructure without discarding authorization safeguards. (arXiv)

Telegram Mini Apps Expose Crypto Wallet Secrets

Andrea Ciccotelli, Federico Zappone, and Roberto Di Pietro analyze security weaknesses in Telegram Mini Apps handling cryptocurrency assets. Of 37 applications examined, 30 contained vulnerabilities involving plaintext secrets, recoverable encryption, or replayable tokens. Telegram’s official wallet initially exposed its recovery mnemonic in plaintext, potentially enabling account compromise. Following responsible disclosure, Telegram introduced secure-storage APIs, and the researchers confirmed that the official Wallet no longer exposed the mnemonic. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity regulations hacks <![CDATA[0x46 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x46-web3-security-bulletin xpNkUWRFp6OsnbkRWkM7 Fri, 14 Aug 2026 14:18:23 GMT TL;DR

  • AI is flooding bug bounty programs with more reports, but Coinbase’s Stellar fee-bump case shows high-context human research still catches the hard protocol edge cases.

  • Physical attacks on crypto holders are now a material self-custody risk, with 2026 losses already above $30M and home invasions making up a large share of reported incidents.

  • Regulated stablecoin issuers are moving beyond point-in-time audits toward continuous monitoring for supply changes, privileged actions, upgrades, sanctions exposure, and incident response.

  • FATF is making clear that “decentralized” is not a magic word; control, influence, admin power, governance concentration, and economic benefit remain the real tests.

  • Sanctions and fraud enforcement remain active, with OFAC-linked exchange activity and the alleged Goliath Ventures Ponzi showing how crypto rails still intersect with old-school financial crime.

  • Research is pushing toward safer autonomous on-chain agents and better ways to measure decentralization, both of which matter as protocols become more agent-driven and claims of resilience get harder to verify.

Industry Trends & Analysis

AI Floods the Bug Bounty Queue but Humans Still Find the Hard Bugs

Coinbase’s Consumer Protection Tuesday post says bug reports are on track to triple year over year after doubling the year before, while valid reports fell from 14% in 2024 to 4% this year. The firm is pushing AI through its own vuln pipelines for commodity issues and refocusing the public bounty on high-ingenuity finds. Case in point: Talaria’s Joe Almeida and Anh Nguyen reported a Stellar fee-bump reconciliation flaw—under some conditions a wrapped withdrawal could look failed internally after it had already succeeded onchain, risking a double-count. No customer funds were hit. AI missed that edge case but flagged a milder related deposit bug. (Coinbase)

Physical Crypto Attacks Exceed $30M in 2026

Violent attacks against cryptocurrency holders have already stolen more than $30M in 2026, following a record $58M in 2025. Home invasions now represent 37% of reported incidents, while on-chain tracing reveals attackers ranging from opportunistic criminals using centralized exchanges to more sophisticated groups employing laundering infrastructure. The findings reinforce physical security and operational privacy as increasingly important components of self-custody risk. (Chainalysis)

Market Movements

Hacken Adds Continuous Monitoring to AllUnity’s EURAU Stablecoin

Hacken describes AllUnity’s integration of its Extractor monitoring platform into the regulated EURAU stablecoin infrastructure. The system monitors token supply, privileged governance actions, contract upgrades, large transfers, sanctions exposure, and cross-contract attacks while supporting automated mitigation. The deployment illustrates how regulated stablecoin issuers are extending security beyond audits toward continuous on-chain monitoring and incident-response controls. (Hacken)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 227

Total amount lost in 2026: $1,194,196,610

Coinsbuy Wallets Drained $7.9M+

More than $7.9M was drained from wallets associated with B2B crypto payment processor Coinsbuy across Ethereum and TRON. Some of the stolen assets were converted toward Monero through exchanges, while ChangeNOW reportedly helped freeze a six-figure amount. Coinsbuy temporarily suspended deposits and withdrawals before restoring service.

Harmony Mints 4B ONE

Harmony confirmed an exploit after analyst Juiceberg flagged roughly 4B unauthorized ONE minted, which is about 26% of supply, via empty blocks. Juiceberg said ~2.8B reached exchanges and ~97% of the mint was already on exchanges or sold; ONE fell ~37% to about $0.00077.

Harmony paused its bridge, shipped a patch to stop further minting, and asked exchanges to freeze four named wallets, but has not confirmed the mint size or root cause. Decrypt notes a rollback would undo the attack and every legitimate transaction after it. (Decrypt)

Policy & Regulation

FATF: “Decentralised” is a Claim to Test

FATF’s July 2026 Targeted Report on Regulatory Challenges from DeFi clarifies that Recommendation 15 still applies where a natural or legal person has “control or sufficient influence.”

FATF Recommendation 15 is the “New Technologies” standard. In short: countries and firms must identify, assess, and mitigate ML/TF risks from new products, practices, and tech—including crypto.

Since 2018–2019 updates, it is the main FATF rule that pulls virtual assets (VAs) and virtual asset service providers (VASPs) into the AML/CFT framework. It requires that VASPs be:

  • licensed or registered

  • supervised for AML/CFT

  • held to the same core obligations as traditional financial institutions (CDD, record-keeping, suspicious transaction reporting, sanctions screening, and—via the Interpretive Note—the Travel Rule under Rec 16)

That is why the DeFi report keeps citing R.15: if someone has “control or sufficient influence” over a DeFi arrangement and does VASP-like activity, that person is in scope under Recommendation 15—not because DeFi got its own new rule.

Three buckets: identifiable controllers; centralized in practice but hard to name; and truly decentralised. The Standards cover the first two; smart contracts themselves are not VASPs. Centralised elements “frequently persist” via governance-token concentration, admin privileges, upgrades, economic benefits, and infrastructure influence. (FATF)

OFAC Targets Crypto Exchanges Linked to Iran’s Regime

OFAC issued sanctions against Shelbit, its operator Siavash Kayvanpour, associated businesses, and Iranian exchange Aban Tether. Elliptic identified tens of millions of dollars flowing between Shelbit and Iranian entities, including approximately $71.8M connected to Central Bank of Iran funds, as well as direct transfers involving IRGC-attributed addresses. The findings illustrate how blockchain intelligence can identify sanctions exposure beyond wallet addresses explicitly published by regulators. (Elliptic)

SEC and CFTC Target Alleged $400M Crypto Ponzi

The CFTC and SEC filed parallel civil actions against Goliath Ventures and CEO Christopher Delgado, alleging hundreds of millions were raised for purported crypto liquidity-pool and trading strategies but instead used for Ponzi payments and personal spending. The CFTC says roughly 1,600 customers contributed at least $397M, while the SEC alleges more than $425M was raised from over 1,300 investors. (CFTC)

Legislative Watch

Democrats Warn SEC and CFTC May “Jump around Congress”

Politico reported that with the CLARITY Act stalled before recess, SEC Chair Paul Atkins and CFTC Chair Michael Selig are positioned to drive crypto policy from the agencies. Democrats, including critics who say the regulators are too industry-friendly, frame the coming rule slate as an end-run around months of legislative bargaining. The SEC’s August 14 meeting is set to vote on proposing “Regulation Crypto,” a tailored offering regime for certain crypto investment contracts; broader agendas include transfer-agent rules and a rethink of 2005 stock-trading rules. With no Democratic commissioners at either agency, new proposals can move faster, but that also sharpens Capitol Hill scrutiny, including Democratic demands for more balanced commission panels tied to CLARITY talks. (Politico)

Applied Research

ChainClaw Adds Safety Guardrails for Autonomous On-Chain Agents

Researchers introduce ChainClaw, a blockchain-native agent framework built on OpenClaw. It adds transaction simulation, policy checks, live chain-state monitoring, event-driven execution, and guarded signing to reduce risks from irreversible autonomous transactions. Testing across transfers, approvals, swaps, and malicious transaction scenarios showed stronger safety and task completion than general-purpose agent frameworks including ReAct, LangChain, and OpenClaw. (arXiv)

Researchers Propose New Metrics for Measuring Decentralization

Jakub Kacper Szeląg, Aydin Abadi, and Mohammad Naseri argue that blockchain research lacks a sufficiently rigorous, portable definition of decentralization. Their graph-based ontology separates decentralization from simple distribution of infrastructure or trust and introduces two quantitative measures, Void Tolerance and Imperviousness. Applying the framework to blockchain and other distributed architectures produces more consistent comparisons than existing definitions, potentially giving protocol-security researchers better tools for evaluating concentration and resilience claims. (arXiv)



]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 hacks regulations security cybersecurity <![CDATA[0x45 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x45-web3-security-bulletin Qf1X2UZc1ezBalBR7LIg Sat, 08 Aug 2026 11:15:04 GMT TL;DR

  • Crypto’s attack surface keeps moving outside audited code: privileged access, signers, weak seed generation, developer tooling, and operational controls are doing as much damage as smart-contract bugs.

  • The COLDCARD weak-seed incident is now the week’s defining custody story, with roughly 1,816 BTC tied to predictable seed generation.

  • Market infrastructure is consolidating around investigation, authorization, and policy layers: Chainalysis inks a deal with Penlink, Magic moves to becoming Newton Labs, and onchain transaction approval moving closer to real-time risk control.

  • Regulators are tightening the perimeter globally, with Russia, South Africa, the CFTC, and the SEC, all pointing toward more explicit rules for custody, trading, collateral, vaults, and cross-border flows.

  • Applied research is highly relevant this week: wallet recovery, agent transaction safety, and decentralized attestation all map directly to the same operational security failures showing up in incidents.

Industry Trends & Analysis

Crypto’s Biggest Attack Surface Is Outside the Code

Rekt argues that some of 2026’s largest crypto losses have bypassed audited smart contracts entirely by targeting privileged access, signers, credentials, and human trust. Drift and KelpDAO illustrate how compromised operators and sustained social engineering can defeat systems whose core contracts remain intact. The analysis positions audits as necessary but incomplete, calling for stronger key management, multi-party authorization, withdrawal delays, and operational security around the people and infrastructure controlling transactions. (Rekt)

Market Movements

Penlink Pulls Chainalysis Data into its Investigation Suite

Chainalysis announced a partnership with Penlink. The company builds an AI-powered digital intelligence platform for law enforcement, government, and enterprise investigators. It combines digital evidence, open-source intelligence, live communications monitoring, and data analytics in one workflow so teams can collect, analyze, and act on investigative data in real time. Investigators can submit wallet addresses inside Penlink, get entity attribution and risk context from Chainalysis, enrich against OSINT and dark-web hits, then open Reactor in one click when they need deeper onchain tracing. (Chainalysis)

Magic Labs Becomes Newton Labs

Sean Li says Magic Labs has sold its embedded-wallet business to Kraken parent Payward and is becoming Newton Labs, concentrating exclusively on Newton Protocol. From August 1, Payward began servicing Magic’s wallet customers, while Newton Labs shifted toward an authorization layer that evaluates compliance, security, identity, and risk policies before onchain transactions settle. The deal separates a wallet infrastructure business that powered more than 60 million wallets from a newly focused Web3 transaction-security and policy company. (LinkedIn)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 221

Total amount lost in 2026: $1,182,730,626

Weak COLDCARD Seeds Lead to ~$116M in Losses

From July 30, attackers brute-forced predictable Coldcard-generated seeds and swept single-signature wallets across the Bitcoin network. TRM’s August 5 write-up cites Galaxy Research’s running tally at about 1,816 BTC (~$116M) across more than 5,200 addresses in at least four waves. The first sweep moved ~594 BTC from ~500 wallets in about 25 minutes.

CoinDesk and Protos covered the same timeline as The Block's analysis. TRM sees little laundering so far, one Wasabi deposit and a Tornado Cash hop, and has not named an actor. (TRM)

XCSSET Turns Compromised Xcode Projects Into a Crypto Threat

Bill Toulas reports that XCSSET v40 is spreading through compromised Git repositories and Xcode projects, infecting developers when malicious projects are built and then propagating into additional source code. Its 17 modules include credential theft, keylogging, browser hijacking, and data exfiltration. A new Chrome hijacker can intercept cookies, credentials, and MetaMask transactions and manipulate payments in real time, combining developer supply-chain compromise with cryptocurrency theft. (BleepingComputer)

Policy & Regulation

Russia Signs Comprehensive Crypto Market Law

Russia enacted its first comprehensive framework governing cryptocurrency trading, custody, mining and digital-asset intermediaries. Exchanges will ultimately require registration and minimum capital, while non-qualified investors face annual purchase limits and suitability testing. Domestic crypto payments remain prohibited, but the legislation permits specified uses including foreign-trade settlements. Banks must also block transfers suspected of involving unauthorized crypto exchanges. The law’s core provisions take effect September 1, 2026. (TASS)

CFTC Signals Push for Stablecoin Collateral and Perpetual Futures

Michael S. Selig says the CFTC is exploring how regulated stablecoins can be used as collateral while expanding its approach to perpetual futures and round-the-clock markets. The chairman highlighted the agency’s approval of a bitcoin perpetual futures contract and argued that U.S. derivatives regulation should evolve alongside increasingly automated, digital markets rather than wait for international consensus. (Commodity Futures Trading Commission)

SEC Examines Regulatory Pathways for Onchain Vaults

SEC Crypto Task Force Staff met with Birch Hill Holdings and legal counsel to discuss how onchain vault structures intersect with federal securities laws. The discussion covered registration and exemption pathways, investment-adviser treatment for actively managed vaults, qualified-custodian requirements and tokenized credit infrastructure. The meeting did not produce new rules, but provides another indication of how the SEC is working through practical regulatory treatment of institutional DeFi structures. (SEC)

South Africa Proposes Cross-Border Crypto Controls

South Africa’s National Treasury and South African Reserve Bank published a draft Crypto Assets Manual establishing proposed requirements for cross-border crypto transactions. Transfers between domestic and offshore CASPs, or from domestic CASPs to non-custodial wallets, would trigger FinSurv reporting. The framework also addresses CASP authorization, transaction permissions and administrative responsibilities, with the government aiming to reduce regulatory arbitrage and improve detection of illicit financial flows. Comments close September 30. (South African Reserve Bank)

Legislative Watch

Senate Punts Clarity Vote into September

Majority Leader John Thune confirmed late on August 6 that the Senate will not take up the Clarity Act before August recess. Supporters had wanted an initial vote this week; Thune may still file cloture to queue the bill, but floor action is now expected when the chamber returns in September. Democrats refused a time agreement that would have cleared a path to a vote, citing unfinished talks on Trump-family crypto ethics language, law-enforcement concerns, and the Agriculture Committee commodities title. (POLITICO)

Applied Research

Zero-Knowledge Recovery for Compromised Bitcoin and Ethereum Wallets

Mehmet Sabir Kiraz and Suleyman Kardas introduce Z-SCAPE, a recovery protocol for self-custodial wallets whose seed-generation entropy has been compromised. Users establish an independent recovery credential before an incident and later prove ownership in zero knowledge without revealing personal records, recovery secrets, or compromised private keys. The design prevents replay and destination-substitution attacks and includes integration mechanisms for both Bitcoin and Ethereum. (IACR Eprint Archive)

Safety Invariants for Agents Moving Assets Onchain

Zhaoming Yin proposes seven safety invariants for autonomous agents executing irreversible blockchain transactions. The framework targets failures including incorrect chain or address selection, ambiguous transaction outcomes, retries, and duplicated execution, guaranteeing that ledger effects either do not occur or match the rendered transaction exactly once. Testing covered 60 adversarial scenarios, while the deployed system recorded 108 production operations across eight chains. (arXiv)

Blockchain Coordinates Continuous Attestation for AI Agents

Adam Zahir, Vincent Lefebvre, Mark Angoustures, Milan Groshev, and Carlos J. Bernardos present D-MUTRA, a decentralized remote-attestation framework for multi-agent systems. Agents continuously measure their runtime integrity and verify peers while a smart contract coordinates and records the process. A proof of concept using private Ethereum/Hyperledger Besu with ROS/Gazebo robots detected malicious software modifications with low application overhead, providing a software-based alternative to centralized attestation infrastructure. (arXiv)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) regulations hacks web3 security cybersecurity <![CDATA[0x44 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x44-web3-security-bulletin y1n8pw36W4ylaDxalhoO Fri, 31 Jul 2026 13:51:45 GMT TL;DR

  • Digital-asset security is becoming a continuous governance problem: Fireblocks, Elliptic, and Chainalysis all point towards requiring systems that can prove controls, permissions, and compliance effectiveness in real time, not just during audits or supervisory reviews.

  • Protocol security still fails at the application boundary. Uniswap v4 hooks, bridge withdrawals, DAO governance, and state-invariant transaction spam all show the same pattern: the base layer may behave correctly while custom logic, assumptions, incentives, or validation gaps create the actual exposure.

  • The incident picture stayed heavy: AFX Trade lost roughly $24.15M after hot-validator signatures cleared its Arbitrum custody bridge, VerusCoin’s bridge verified withdrawals without economic backing, and Triple-A contained unauthorized access to company treasury wallets while keeping client funds isolated.

  • Wallet and custody risk is not just private-key theft. Coinkite’s COLDCARD RNG advisory shows why seed-generation provenance matters, while Ledger’s agent stack and Fireblocks’ operating model point toward policy-controlled workflows where humans, agents, and infrastructure each have constrained authority.

  • Security tooling is moving from detection to resolution. Cantina’s Clarion launch, CyberScope’s audit-prep guidance, TAC InfoSec’s Safehouse deal, and V12’s AI-assisted vulnerability research all reinforce that finding issues is no longer enough; teams need faster prioritization, remediation, and verification.

  • The longer-term risk horizon is getting real: quantum migration gaps, privacy-chain compliance models, and AI-discovered vulnerabilities are shifting Web3 security from isolated exploit response toward infrastructure resilience, governance design, and programmatic proof that controls work under stress.

Industry Trends & Analysis

Digital-Asset Scale Requires Continuous Governance

Fireblocks argues that operational risk shifts from key custody to configuration drift as digital-asset businesses grow. The recommended model combines continuous policy and permission monitoring, audit-ready reconciliation, embedded wallet abstractions, and policy-controlled batching, swaps, staking, and DeFi access. Security and audit evidence should emerge from routine operations rather than manual preparation before reviews. (Fireblocks)

Seven Ways Uniswap v4 Hooks Fail

Nicolas Donboly identifies seven recurring security failures in Uniswap v4 hooks, including unrestricted callbacks, malicious pool selection, broken internal accounting, mismatched address permissions, and unsafe shared state. The analysis stresses that PoolManager settlement guarantees do not validate application-specific assumptions, leaving hook developers responsible for authorization, accounting, integrations, and failure handling. (Trail of Bits)

US Crypto Oversight Shifts Toward Outcomes

Peter Phelan notes that US digital-asset regulation is moving beyond procedural checklists toward demonstrable effectiveness, continuous monitoring, and coordinated supervision. He points to the passage of stablecoin legislation and updated model-risk guidance as evidence that institutions will increasingly need to prove their compliance systems work in practice, particularly when AI and on-chain data influence risk decisions. (Elliptic)

Prepare the Code Before the Audit

CyberScope recommends freezing the codebase, documenting intended behavior, expanding test coverage, running static analysis, and removing dead or confusing code before an audit begins. These steps reduce time spent reverse-engineering project intent and allow paid reviewers to concentrate on complex vulnerabilities that automated tools and routine testing are less likely to detect. (CyberScope)

Privacy Chains Require Different Compliance Models

Chainalysis Team divides blockchain privacy into four models: permissioned transaction sharing, shielded pools, encrypted extensions, and private smart-contract execution. Each exposes different information and requires different monitoring arrangements. The analysis concludes that compliance teams cannot apply one universal privacy-chain methodology across networks such as Canton, Zcash, Solana, and Aztec. (Chainalysis)

FYI: DeFi Security Summit 2026

Market Movements

Cantina Moves From Detection to Resolution

Cantina says security programs increasingly fail after vulnerabilities are discovered, as remediation queues and handoffs give attackers time to act. Its newly launched Clarion platform is designed to prioritize findings, coordinate remediation, and verify fixes using agentic workflows. The company also announced new funding that brings its total raised to $16.5M. (Cantina)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 213

Total amount lost in 2026: $1,086,629,393

AFX Trade Loses $24.15M

On July 22 Blockaid flagged a drain of about 24.15M USDC from AFX Trade’s own Arbitrum custody bridge. Rekt reports five hot-validator signatures met the roughly two-thirds quorum; the contract released funds after a 200-second dispute window with no challenge. Arbitrum’s native bridge was unaffected. Stolen USDC moved via CCTP to Ethereum, filled through UniswapX into ~12,467 ETH, then fragmented. AFX offered a 30% bounty for a 70% return. Rekt notes Zellic had audited the bridge about 49 days earlier; zeroShadow and SEAL later said the pattern may link to UNC4899 / TraderTraitor. (Rekt)

VerusCoin’s Bridge Verified an Unfunded Withdrawal

A Rekt investigation finds that VerusCoin’s Ethereum bridge lost $7.54M after accepting valid signatures and proofs for withdrawals that lacked economic backing. The exploit used a different implementation gap from the bridge’s $11.6M May incident, but crossed the same trust boundary: authenticity was proven without confirming that the underlying assets existed. (Rekt)

Triple-A: Unauthorized Access Hit Company Treasury

On July 27 Triple-A said it found unauthorized access on July 25 to wallets holding its own digital assets at Triple A Technologies Pte. Ltd. The incident was contained; services ran normally after about three hours in maintenance. Client funds were not affected, Triple-A does not custody client crypto; client money sits in separate trust accounts with safeguarding institutions that were not exposed. Impact is limited to operational treasury accounts and is being absorbed from reserves. The firm is working with cybersecurity and blockchain forensics specialists and Singapore authorities. (Triple-A)

Coinkite Warns COLDCARD Seeds May Have Weak Device RNG

Coinkite’s advisory says seeds generated on Mk3 firmware 4.0.1 (March 2021) or later may put funds at risk; Mk4, Mk5, and Q seeds made before fixed firmware had about 72 bits of entropy instead of the expected 128. Fixed builds are out: Mk4/Mk5 need 5.6.0+, Q needs 1.5.0Q+; a firmware update does not repair an existing seed.

Users who added ≥50 private dice rolls when creating the seed are not considered at risk from this RNG bug alone. TAPSIGNER, OPENDIME, and SATSCARD are unaffected. Coinkite tells affected holders to migrate carefully to a new seed on patched hardware (or interim BIP-39 passphrase / dice-only paths on Mk3). (Coinkite)

Policy & Regulation

Will the Clarity Act be Signed Before the August Recess?

Senate leaders have not yet filed cloture on the Clarity text before the August 8 recess. On July 28 SEC Chair Paul Atkins said the agency is giving Congress technical assistance and told CNBC it is “ready, willing and able” to address covered issues under existing authority if legislation fails.

He still prefers statute; agency rules alone cannot grant the CFTC nationwide digital-commodity spot authority. (Crypto News)

MiCA Staff Competence Rules Take Effect

European Securities and Markets Authority’s MiCA knowledge-and-competence guidelines became applicable on July 28. Crypto-asset service providers must assess and document the qualifications of employees who inform or advise clients, maintain ongoing training programs, and apply higher competence standards to advisory personnel. The change makes employee capability and professional development an auditable supervisory requirement for regulated crypto firms across the EU. (ESMA)

Canada Proposes Crypto Platform Fee Model

CIRO opened consultation on a dedicated regulatory fee model for crypto trading platforms on July 30. The proposal would create a more explicit framework for allocating the costs of supervising registered platforms, adding a new operational consideration for crypto businesses entering or remaining in Canada’s regulated investment market. (Ontario Securities Commission)

Capital Allocation

TAC InfoSec Signs Safehouse Acquisition Deal

TAC InfoSec, whose CyberScope subsidiary provides Web3 security and smart-contract auditing, signed a binding term sheet to acquire 100% of Israel-based Safehouse Technologies. The proposed transaction would expand TAC from enterprise and Web3 security into consumer cybersecurity. The deal remains subject to due diligence, regulatory requirements, and definitive agreements, with completion targeted within three months. (TAC Security Release)

V12 Announces $10M Seed

V12 closed a $10M seed led by Electric Capital, with ZachXBT, samczsun, Walden Yan, and others. Earlier this month its agent autonomously found a major-blockchain bug putting more than $100M at risk and took a $2.5M bounty, the largest the team says an AI agent has received. The post frames V12 as a white-box vulnerability research tool, not black-box pen-testing. (V12 on X)

Applied Research

DAO Attacks Without Smart-Contract Bugs

Vabuk Pahari and colleagues analyze governance contracts across 48 active Ethereum DAOs and identify “governance attacks” that exploit mechanism design rather than implementation vulnerabilities. The study examines how voting systems, veto powers, execution paths, and off-chain dependencies balance decentralization against security, fairness, privacy, and operational flexibility. (arXiv)

Blockchain Spam That Changes Nothing

Vabuk Pahari, Johnnatan Messias, and Christof Ferreira Torres identify nearly 1.4 billion state-invariant transactions across Ethereum, Optimism, and Base, transactions that consume network resources without changing ledger state beyond fees. The study associates much of the activity on Layer 2 networks with speculative MEV and finds that address poisoning represents a substantial portion of Ethereum’s non-reverted state-invariant traffic. (arXiv)

Digital Assets Face a Quantum Migration Gap

Lee Reiners argues that regulated finance is adopting quantum-vulnerable blockchain infrastructure faster than policymakers are establishing migration requirements. The paper frames exposed keys protecting Bitcoin, Ethereum, stablecoins, custody systems, bridges, and tokenized assets as a potential financial-stability risk, and proposes a federal quantum-resilience perimeter for institutions interacting with digital assets. (SSRN)



]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity regulations hacks <![CDATA[0x43 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x43-web3-security-bulletin IliJaXym1wST205WQCwV Fri, 24 Jul 2026 07:59:29 GMT TL;DR

  • Coinbase is treating post-quantum migration as a long-lead infrastructure program: PQ-CoreKMS, Stanford Bitcoin workshops, and the Bitcoin Security Consortium all point to years of engineering before the risk becomes urgent.

  • Herd Labs shows where DeFi risk tooling is headed: live asset-liability graphs that map token contagion across reserves, wrappers, lending markets, and off-chain exposure.

  • The incident picture stayed ugly: Allbridge lost roughly $1.65M to Solana pool manipulation, while Ostium reopened after a 23.8M USDC vault drain tied to a malicious price update.

  • Policy momentum continued with updated CLARITY Act text adding ethics constraints for officials issuing tokens, while Japan and Russia moved their own crypto market-structure rules forward.

  • Cyclops’ $20M Series A is another signal that stablecoin payments are moving from crypto-native tooling into financial infrastructure: the company is selling a single API for settlement, payins, payouts, and treasury.

  • In research: KASS (Knowledge-Augmented Attack Synthesis and Simulation) generated working smart-contract exploits for 94.23% of tested contracts, while new x402 research warns that facilitator validation bugs could become shared infrastructure risk across many paid APIs and agent workflows.

Industry Trends & Analysis

Coinbase Outlines PQ-CoreKMS, Bitcoin Workshops, and a Security Consortium

Coinbase's Independent Advisory Board on Quantum Computing and Blockchain is driving three workstreams. CoreKMS, which protects about 99.9% of custodied assets via MPC, gets a post-quantum track: PQ-CoreKMS aims for an automated signing pipeline within a year (enclaves, secret-sharing, threshold crypto for any PQ signature scheme), then full lattice MPC over two to three years, plus a company-wide crypto inventory and migration triggers.

Separately, Coinbase will co-host Bitcoin post-quantum sessions with Stanford starting in August, and as a founding member of the Bitcoin Security Consortium with BlackRock, Fidelity Digital Assets, Block, and others is donating and assigning engineers to open-source work such as BIP-360. (Coinbase)

Market Movements

Herd Labs Maps Token Contagion with Live Balance Sheet Graphs

Andrew Hong at Herd Labs argues one-time token reviews no longer work: vaults can touch 300+ contracts, and the first five months of 2026 saw nearly a billion dollars in related losses (Resolv USR mint, Stream Finance multisig, KelpDAO rsETH bridge). Herd recursively expands each reserve and downstream wrapper into an asset–liability graph, assets are backing positions, liabilities are issued supply plus where that supply sits in Morpho, Pendle, Silo, Euler, and similar.

For example, on InfiniFi’s iUSD, the graph shows ~43% of reserves in off-chain Fasanara Capital and ~52% of supply redeployed as siUSD, so an asset freeze turns into redemption pressure across those venues. AI agents are enabled to keep the graphs live. Herd also builds function-permission maps (for example who can mint USDC) and is beta-testing custom risk models with design partners. (Herd Labs)

Ledger Tests Agent Stack for Human-Confirmed Crypto Workflows

Ledger’s Agent Stack for AI-assisted crypto workflows: Device Management Kit Skills, Ledger Wallet CLI, Ledger Enterprise CLI, and Enterprise Multisig CLI, tested with more than 1,000 agents. Agents can read balances and history and draft actions inside Claude Code, Codex, Cursor, and similar tools, but the user must confirm on the Ledger device before a signature. Ledger lists prompt injection, autonomous execution, and agents with live resource access as the risks it is designing around; the 2026 roadmap adds agent identity, intents and policies, then proof of humanity. (nft evening)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 203

Total amount lost in 2026: $1,057,046,008

Flash Loan Skews Allbridge Liquidity Pools

Cross-chain bridge Allbridge Core was hit on July 19–20 when an attacker deployed a $1.12M USDC flash loan from Kamino to manipulate Solana USDC/USDT pool ratios. The maneuver drained approximately $1.65M before the team paused the protocol. Allbridge is now urging liquidity providers to withdraw and appealing to arbitrageurs to return profits for compensation. (decrypt)

Ostium to Reopen Trading Following the Vault Drain

Ostium reopened trading Thursday July 23 after the vault exploit that removed nearly 23.8M USDC. Open positions and pending orders carry over and mark to the live price at reopen; take-profit, stop-loss, and limit orders already through their levels execute at 10:00 a.m. ET.

New OLP deposits stay paused. Ostium said Mandiant, zeroShadow, Collisionless, and SEAL 911 are on the investigation, alongside exchanges, bridges, and stablecoin issuers. (The Defiant)

Policy & Regulation

New CLARITY Act Text Bars Officials from Issuing Tokens

Senator Cynthia Lummis released updated Digital Asset Market Clarity Act text merging Banking and Agriculture drafts. The ethics section would stop the president, vice president, members of Congress, federal judges, and their spouses from issuing or sponsoring digital assets for pay while in office through Jan. 20, 2029, force covered holdings into sale or a blind trust, and give DOJ civil power that can reach exchanges listing banned tokens. Democrats still want state attorneys general in the enforcement mix, and that fight is what most threatens a 60-vote Senate path before the August recess. (Lummis Senate Gov)

Chainalysis: FATF’s 7th Crypto Report Card Says Laws are Ahead of Enforcement

Chainalysis walks through FATF’s July 16 7th Targeted Update on VA/VASP standards. Among 147 jurisdictions, 86% have done VA risk assessments and 83% have Travel Rule laws, but 60% of those with Travel Rule statutes have taken no supervisory or enforcement action, and under 10% fully meet preventive AML/CFT measures. The FATF flags freeze-resistant proprietary stablecoins after a Cambodia-linked network issued one following a $29M issuer freeze, plus AI-amplified fraud, DeFi still largely unregulated (93% of jurisdictions have not identified qualifying DeFi arrangements), and expects VASPs to run wallet screening, analytics, and freeze/block capability as baseline compliance. (Chainalysis)

Japan Puts Crypto Under FIEA and Clears a Path for ETFs

Japan’s Diet moved crypto from a payments-centric Payment Services Act framework into the Financial Instruments and Exchange Act, with the new rules aimed at 2027. Issuers get disclosure duties; exchanges face stricter investor-protection and insider-trading rules; unregistered operators see maximum prison terms rise from three years to ten and fines from ¥3M to ¥10M. Spot crypto ETFs still need Investment Trust Act work, and a separate tax outline points to a flat ~20% crypto gains rate in 2028, down from rates that can hit 55%. (CoinDesk)

Russia’s Duma Passes Crypto Trading Law

Russia's State Duma adopted a comprehensive law governing cryptocurrency circulation, set to take effect September 1, 2026. The law lets both qualified and non-qualified investors trade cryptocurrencies through licensed intermediaries, caps annual purchases for non-qualified investors at 300,000 rubles, and still bans using crypto for domestic payments while allowing unrestricted use in cross-border trade settlements. (Bank of Russia)

Capital Allocation

MoonPay Buys Glide for Deposit Routing

On July 16 MoonPay acquired Y Combinator-backed Glide in an all-equity deal; Glide’s four-person team joins MoonPay. Founded by former Robinhood Wallet engineers, Glide routes deposits across 100+ tokens and 30 chains into apps including Wallet in Telegram, Moonshot, and Paysafe. Terms were not disclosed. It is MoonPay’s sixth acquisition announcement of 2026. (Cointelegraph)

Cyclops raises $20M Series A

Cyclops announced a $20 million Series A led by Nava Ventures on July 15, with Coinbase Ventures, Castle Island Ventures, Circle Ventures, GPT Ventures, Lasagna Ventures, F-Prime Capital, OpenFX, and Global PayTech Ventures participating. The Miami team sells one API for stablecoin settlement, payins, payouts, and treasury to payments companies, and says it orchestrates specialist vendors rather than rebuilding every layer. The post cites volume growing 350% month over month, a partner licensing network of 100+ licenses, and hires from Coinbase, Fiserv, Shift4, JPMorgan, and Paysafe, including Coinbase’s former global CCO leading compliance. (Cyclops)

Applied Research

Agentic Attack Synthesis and Simulation for Smart Contracts

KASS, a multi-agent system that plans attacks from audit knowledge, emits constrained Foundry tests, and repairs failures with nested code and strategy loops. On 104 SmartBugs-Curated contracts it produced working exploits for 94.23% of cases, beating the authors’ same-protocol Claude Code baseline and earlier REX/AdvSCanner numbers on similar sets. It validated 9 of 11 CVE-tagged contracts and can drop static findings that never produce runnable impact. (arXiv)

x402 Facilitators are Shared Payment Infrastructure and Shared Risk

This paper looks at x402, which extends HTTP 402 so APIs and AI agents negotiate payment and hand proof checks plus on-chain settlement to third-party facilitators. Those facilitators sit under many merchants at once, so one validation bug can hit many services. The authors argue live mainnet deployments are still poorly measured relative to how fast the protocol is being adopted. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 crypto hacks regulations security cybersecurity <![CDATA[0x42 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x42-web3-security-bulletin 7v5mCufrTIKGYJScrC4P Fri, 17 Jul 2026 09:42:54 GMT TL;DR

  • Nethermind shows where AI belongs in audits: not replacing senior judgment, but catching mechanical inconsistencies humans can miss. The useful model is AI doing consistency work while auditors focus on attack paths, exploitability, and impact.

  • This week’s incidents are mostly control failures hiding inside trusted plumbing: Ostium’s oracle automation accepted future-dated reports, Bonzo’s verifier accepted a zero BLS key, and Injective’s compromised SDK used fake telemetry to steal wallet material.

  • LI.FI selected Hypernative to screen tokens across 60+ chains, adding approve-or-deny risk signals for every token routed through its liquidity infrastructure.

  • Policy and capital keep moving toward institutional rails: U.S./UK agencies are coordinating on digital assets and market structure, OFAC is turning stablecoin traceability into sanctions pressure, and Velocity’s $38M raise shows stablecoin treasury infrastructure is still getting funded.

Industry Trends & Analysis

AI’s Role in Security Audits

Utku Kocakulak shows how Nethermind’s AuditAgent uncovered a subtle integer-overflow bug in accounting logic that multiple human audits had missed, simply by flagging a parenthesis mismatch between two near-identical calculations. The article argues that AI is best used for mechanical consistency checks, while senior auditors focus on attack-path analysis and impact, framing the future as “elite auditors augmented by AI” rather than AI replacing human expertise. (Nethermind)

Blockchain Forks Explained: Soft vs Hard

CyberScope explains how protocol upgrades create blockchain forks, distinguishing backward-compatible soft forks from hard forks that can split a network into competing chains with shared history but divergent rules. The article shows how governance processes and scheduled block-height activations determine whether changes become smooth upgrades or contentious chain splits with security and compliance implications for applications and exchanges. (CyberScope)

Market Movements

LI.FI Integrates Hypernative Token Screening Across 60+ Chains

LI.FI, the cross-chain liquidity router serving more than 1,000 integration partners, will use Hypernative Token Screening to flag scam tokens, rug pulls, and other fraudulent assets before they reach users. LI.FI screens its full token database and calls the Hypernative API whenever a new token is added, passing integrators a binary approve-or-deny recommendation alongside existing metadata. Hypernative scores contracts, holder concentration, DEX and CEX activity, deployer reputation, and social verification. (Hypernative)

Exploits & Incidents

SlowMist stats this week

2026 hacks: 190

Total amount lost in 2026: $992,577,108

Ostium Loses Over $18M After an Attacker Submitted Future-dated Oracle Reports

An attacker pulled about $18M in USDC from Ostium's Arbitrum vault by abusing a registered PriceUpKeep forwarder in the protocol's Gelato price automation. Future-dated reports made losing trades look profitable and triggered the payout. Blockaid flagged the transaction.

HackTrail maps the drain, step-by-step:

Ostium runs RWA perpetuals, had processed over $50 billion in volume, and raised $27.8 million, including a Series A co-led by General Catalyst and Jump Crypto. (CoinDesk)

Bonzo Lost $9M Because Supra's Verifier Treated Zero as a Valid BLS Key

rekt.news walked through the July 11 Bonzo Lend exploit on Hedera: Supra's pull-oracle verifier accepted a zeroed signature with a zeroed public key, the BLS identity element, so the pairing check passed without a real committee attestation. The attacker deposited about 250 SAUCE (a few dollars), inflated the SAUCE/wHBAR feed, and borrowed roughly $9.05 million in USDC and wrapped HBAR in eight seconds. Supra said the broken verifier had been live for about two years; an identity-element check alone would have stopped it. (rekt)

Injective SDK NPM Package Steals Wallet Keys via Fake Telemetry

Socket reported July 9 that @injectivelabs/sdk-ts@1.20.21 was published from a compromised Injective Labs contributor GitHub account with hooks on fromMnemonic and fromHex that log keys and mnemonics through a fake trackKeyDerivation telemetry path. The payload base64-encodes the material and POSTs it to an obfuscated Injective public gRPC-web endpoint so traffic blends with normal SDK use; 17 other @injectivelabs packages at 1.20.21 pinned the malicious SDK. The account owner reverted within about an hour and shipped clean 1.20.23, but npm only deprecated 1.20.21 after 310 downloads, and GitHub release artifacts remained available. (Socket)

Policy & Regulation

U.S. and UK Release Transatlantic Taskforce Recommendations on Digital Assets and Capital Markets

The U.S. Department of the Treasury and HM Treasury published July 14 the Transatlantic Taskforce for Markets of the Future recommendations, co-announced by Secretary Scott Bessent and Chancellor Rachel Reeves after the September 2025 State Visit. On digital assets, BoE, CFTC, FCA, and SEC staff will seek common approaches to tokenized-securities settlement finality and whether stablecoins or tokenized money market funds can serve as CCP margin collateral; the governments also backed a multi-money mix of stablecoins, tokenized deposits, and other digital money, plus a Basel review of cryptoasset prudential standards. The same day they issued a joint stablecoin statement affirming 1:1 high-quality reserves, reserve segregation, and work toward cross-border market access without mutual recognition of each other's licenses. (U.S. Department of the Treasury)

OFAC Freezes $131M in Iran Central Bank Stablecoins

OFAC expanded sanctions on Iran’s Central Bank by designating four crypto wallets that together received $165M in stablecoins, prompting Tether to immediately freeze $131M in balances. The analysis shows how Iran’s reliance on stablecoins for sanctions evasion and funding has become a vulnerability, with nearly $475M in Central Bank-linked Tether now blocked and on-chain tracing revealing upstream institutional liquidity providers and payment processors. (Chainalysis)

Legislative Watch

Capital Allocation

Velocity Raises $38M Series A

Velocity announced July 14 a $38M Series A led by Dragonfly and FirstMark, with Activant Capital, Capital One Ventures, QED Investors, Coinbase Ventures, Wintermute Ventures, and Ripple participating, bringing total capital raised to nearly $50M since May 2025. The London-based stablecoin treasury and settlement platform targets CFOs and treasury teams at merchants, payment providers, fintechs, and financial institutions, combining stablecoin rails with local banking, compliance, custody, and settlement orchestration. Funding will expand its banking and payments network, product work, and regulatory capabilities as enterprises push stablecoins into liquidity management and cross-border settlement. (Velocity)


]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security crypto cybersecurity regulations hacks <![CDATA[0x41 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x41-web3-security-bulletin wUJg4fIqDLeLlCwZn7s0 Fri, 10 Jul 2026 09:24:42 GMT TL;DR

  • Security failures are moving beyond smart contracts. This week’s incidents show losses coming from governance capture, stale accounting assumptions, weak wallet generation, and frontend or operational control gaps.

  • Governance is now an attack surface. BonkDAO's $20M loss shows that attackers can drain treasuries through vote buying and proposal execution without exploiting contract code.

  • Accounting assumptions can become exploit paths. Summer.fi’s vault drain shows how stale NAV inputs and deprecated strategy components can turn into direct user losses.

  • Wallet generation failures are still catastrophic. Ill Bloom is a reminder that weak randomness can leave keys enumerable for years, across multiple chains, before users know they are exposed.

  • Regulation is turning into infrastructure pressure. The UK, EU, SEC, and Kraken stories all point toward the same future: stablecoins, custody, trading, and exchange operations will need banking-grade controls and clearer supervisory models.

  • Institutional capital is backing regulated crypto rails. Paradigm and EDX show that serious money is still flowing into digital-asset infrastructure, especially where security, compliance, and market structure can support larger institutions.

  • Privacy is becoming a wallet-layer problem. Browser-extension research shows that users can be deanonymized through RPC routing, fingerprinting, and telemetry even when on-chain activity appears pseudonymous.

  • The strongest teams will connect research to controls. Formal verification, blockchain attack taxonomies, wallet privacy studies, and chain-abstraction work only matter if they become tests, monitoring, governance rules, and design requirements.

Industry Trends & Analysis

From CertiPlonk to zkVMs: Verifying RISC‑V Conformance

Nethermind’s research team explains how CertiPlonk‑style formal verification scales to three RISC‑V zkVM implementations: OpenVM, Brevis Pico, and Plonky3’s Poseidon2, by modeling buses in Lean and proving per‑opcode equivalence theorems. The post shows that once memory consistency is derived formally, proofs can be reused across forks, turning labor‑intensive circuit audits into reusable assurance for production zk systems. (Nethermind)

Questions About AI in Compliance That Nobody Can Answer

Elliptic explores unresolved questions around deploying AI in financial crime compliance, including accountability, explainability, and regulatory expectations for model governance.

If a regulator examined your AI governance tomorrow, what would it actually show? How well documented is it and how effective has it been at stopping bad things from reaching your organization?

The post argues that while AI can enhance detection, institutions still lack clear answers on liability, audit trails, and how supervisors will assess AI‑driven decision‑making. (Elliptic)

Market Movements

Breadth, Depth, and Quality in Blockchain Analytics

Chainalysis argues that comparing blockchain analytics vendors purely by cluster count misses what matters most: how addresses are grouped and how reliably those clusters are attributed to real‑world entities. The article urges compliance teams to ask whether groupings are deterministic, auditable, and structurally independent of labels, and if operator–beneficiary distinctions are captured to avoid false positives in investigations. (Chainalysis)

EMURGO Steps Down from Cardano Pentad Governance After SecondFi Exploit

EMURGO, one of Cardano's three founding entities and developer of the SecondFi wallet, is leaving the Pentad governance coalition to focus on recovering user funds from last month's exploit. The group said stepping aside reflects accountability owed as a founding entity while it runs a dedicated asset-recovery team.

Pentad, formed earlier in 2026, coordinates treasury-backed infrastructure work among Input Output Global, the Cardano Foundation, Intersect, the Midnight Foundation, and EMURGO. (The Block)

Exploits & Incidents

BonkDAO Loses $20M to a Malicious Governance Vote

BonkDAO, the DAO behind Solana memecoin BONK, said a malicious governance proposal drained an estimated $20M in BONK from its treasury all without touching contract code. BonkDAO said the attacker bought BONK on exchanges ahead of the vote, the DAO has notified law enforcement, and is working with exchanges, bridges, and the Solana Foundation on recovery. The attack follows a June Balancer governance takeover that drained $1.58M, adding to a run of governance-linked losses in 2026. (The Defiant)

Chainalysis Traces BonkDAO Heist into a Shadow "BONK 2.0" Multisig

Chainalysis found that the wallet behind BonkDAO's governance attack parked roughly $19M of stolen BONK in a new multisig it calls "BONK 2.0," controlled by the malicious voter, the exploiter wallet, and a third financially linked address.

The firm traced a June 30 treasury-drain proposal, $8M in exchange purchases plus DeFi borrowing on July 4–5 to reach the 1% BONK vote threshold, and a July 6 execution that sent about $188,000 to an exchange before the rest landed in the shadow DAO treasury. An hour after the drain, the voter wallet sold $5.3M of its voting stake. (The Defiant)

Summer.fi Post-mortem Blames Stale NAV Pricing for $6M Vault Drain

Summer.fi said in an X post-mortem that on July 6 an attacker manipulated share prices on two Lazy Summer Protocol USDC vaults on Ethereum mainnet and extracted about $6.04M of depositor value in one atomic transaction.

The team attributed the loss to donating Silo "Varlamore" tokens that still carried stale November 2025 Stream Finance valuations into a strategy module slated for removal but still counted in net asset value, inflating the share price roughly 9.5% before the attacker redeemed about $71M against a $64.8M deposit. Summer.fi paused all vaults via the DAO Guardian multisig. (Summer.fi on X)

Analysis: Ill Bloom Weak-seed Wallet Drainer

Ill Bloom documents a wallet-generation flaw where weak randomness during recovery-phrase creation left keys enumerable across Bitcoin, Ethereum, Tron, Rootstock, and Polygon. As of June 30 Coinspect tracked 2,114 active addresses in its first exposed set; a coordinated May 27 sweep drained 431 accounts for about $3.14M, mostly Bitcoin ($2.57M).

Peak historical exposure hit roughly $12.56M in April 2022. New weak-key wallets kept receiving funds through 2025 and into 2026, and Coinspect says the count is still rising. (Ill Bloom)

SlowMist stats this week

2026 hacks: 187

Total amount lost in 2026: $983,248,608

Policy & Regulation

How the UK’s Stablecoin Rules Came Together

Elliptic traces the policy and consultation process that led to the UK’s stablecoin rules, from early proposals to final regulatory texts. The article focuses on how industry feedback, prudential concerns, and consumer‑protection goals shaped the final regime, giving compliance leaders useful context for upcoming supervision. (Elliptic)

SEC Schedules Three Crypto Rulemakings for 2026 Agenda

The SEC placed three crypto-focused items on its 2026 Unified Regulatory Agenda, each at proposed-rule stage with a July target for notices of proposed rulemaking. The Crypto Assets rule (RIN 3235-AN38) would address digital-asset offers and sales, potentially including exemptions and safe harbors. A broker-dealer item (RIN 3235-AN48) would amend net-capital and customer-protection rules for crypto custody, and Crypto Market Structure Amendments (RIN 3235-AN49) would cover trading on alternative trading systems and national exchanges. Congress is still negotiating the CLARITY Act ahead of an August recess deadline. (The Defiant)

EU Plans MiCA Revision in 2027 to Cover non-EU Stablecoin Issuers

The European Union will revisit Markets in Crypto-Assets regulation as early as 2027, with EU diplomats saying a reopening looks unavoidable after MiCA's July 1 licensing cliff and pressure from U.S. stablecoin policy under the GENIUS Act. The European Commission is consulting stakeholders through September 30 on extending rules to non-EU issuers serving European customers, tokenized payments, and deposits. Diplomats cited ECB concerns and the complexity of regulating dollar-backed stablecoins with multiple issuers, as the transatlantic regulatory gap widens. (Euronews)

Kraken Pursues Full European Banking License

Kraken is seeking a full banking license in Europe, with Lithuania as the target jurisdiction, following the same specialized-bank path Revolut took in 2018 through the Bank of Lithuania. A person familiar with the plans said Payward, Kraken's parent, is building licenses globally over the next decade through acquisitions or de novo applications; Kraken Financial already gained Federal Reserve payment-rail access in March 2026 and VARA authorization in the UAE in May. (CoinDesk)

Legislative Watch

(Polymarket)

Capital Allocation

Paradigm Closes $1.2B Fourth Fund Across Crypto, AI, and Robotics

Paradigm raised a $1.2B Fund IV to back founders at the frontier of crypto, AI, robotics, and other emerging tech. The firm named crypto bets including Hyperliquid, Stripe co-founded stablecoin blockchain Tempo, and prediction-market platform Kalshi, alongside non-crypto portfolio companies such as Zipline, SendCutSend, True Anomaly, and Nous Research. Paradigm also highlighted open-source work on blockchain tooling (Foundry, Reth), agent infrastructure (Centaur), and the EVMbench smart-contract security benchmark built with OpenAI. (Paradigm)

EDX Markets Raises a $76M Series C

EDX Markets closed a $76M Series C led by Japan's SBI Holdings to expand institutional trading, clearing, and settlement infrastructure. CEO Tony Acuña-Rohter said SBI's global financial network will help scale regulated digital-asset products; SBI chairman Yoshitaka Kitao cited EDX's compliance-focused platform as a foundation for institutional adoption alongside SBI's yen stablecoin JPYSC and U.S. dollar stablecoin handling. EDX, backed by Citadel Securities, Fidelity, and Charles Schwab, recently launched FlowConnect crypto-as-a-service and filed to establish EDX Trust as a proposed OCC national trust bank. (PRN)

Applied Research

Browser-extension Wallets Leak Privacy

Researchers audit privacy threats in Web3 browser-extension wallets, documenting how extensions expose browsing patterns, RPC endpoints, and transaction metadata that can deanonymize users even when on-chain activity looks opaque. The authors propose wallet-side mitigations including stricter RPC routing and reduced third-party telemetry. (arXiv)

A Survey Maps Blockchain Attack Surfaces from Cryptography to Apps

Researchers publish a cross-domain taxonomy of blockchain attacks and defenses, spanning the data and cryptographic layer, network and consensus layers, smart-contract execution, and application logic. The paper links historical incidents to recurring failure classes including key compromise, eclipse attacks, and cross-layer trust assumptions. (arXiv)

Crossroads: A Smart Contract Layer for Chain-Abstracted Assets

James Austgen, Dani Vilardell, and Ari Juels present Crossroads, a smart contract layer designed to secure assets that move across chain-abstraction protocols, a growing category in multi-chain DeFi. The paper addresses new attack surfaces created as ecosystems increasingly bridge assets between Ethereum, Solana, and other major chains. Their design offers a security-first approach to an area that has seen frequent bridge exploits. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) crypto hacks security cybersecurity regulations <![CDATA[0x40 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x40-web3-security-bulletin D0W7zPnPaWFwbUHhyFf0 Fri, 03 Jul 2026 08:43:01 GMT TL;DR

  • Exploit mechanics are getting clearer, but losses are still operational. OpenZeppelin’s latest bug digest and TRM’s H1 data both point to the same lesson: smart contract flaws matter, but the expensive failures still cluster around keys, infrastructure, phishing, and weak operational controls.

  • Tokenized markets are moving from thesis to infrastructure. Robinhood’s L2 push for tokenized equities shows major brokerages are no longer treating onchain assets as a side product. The next competitive layer is 24/7 execution, settlement, and automated trading workflows.

  • Regulators are turning crypto into an operating environment. The UK’s finalized crypto regime and Hong Kong’s institutional-market strategy are less about “whether crypto is allowed” and more about custody, disclosures, stablecoins, market abuse, and who can operate at scale.

  • Frontend and supply-chain risk remain underpriced. The Polymarket user losses are a reminder that users can lose funds even when core contracts are not the failure point. Web app integrity, vendor controls, and approval hygiene are now part of protocol security.

  • Audit findings need better translation into loss prevention. The strongest research this week reinforces a familiar gap: knowing vulnerabilities exist is not the same as reducing exploitability, especially when attacker paths depend on governance, deployment, monitoring, and human behavior.

Industry Trends & Analysis

OpenZeppelin Bug Digest #9

OpenZeppelin's June 30 Notorious Bug Digest #9 covers recent vulnerability classes including rule-downgrade bugs, zero-knowledge circuit misconstraints, and the Aftermath exploit pattern. The digest links public audit findings to live mainnet failures, giving developers a quick reference for recurring 2026 exploit mechanics. The useful signal here is pattern recognition: teams can map audit findings against live exploit paths before they show up in their own deployments. For builders, this is a reminder that “known class of bug” should translate into test cases, monitoring rules, and upgrade playbooks. (OpenZeppelin)

Blockchain Development for Builders and Businesses

Cyberscope clarifies that “blockchain development” spans core protocol engineering, smart contract and dApp work on existing networks, and enterprise integrations on permissioned chains. The article breaks down fundamental components such as consensus, data structures, smart contracts, and stresses that modern practice increasingly includes security, tooling and compliance considerations as blockchains move from niche experiments into finance, gaming, identity and infrastructure. As blockchain work becomes normal software infrastructure, security can’t sit off to the side as a final audit step. Teams entering the space need to treat consensus choices, contract design, key management, and compliance as architecture decisions from day one. (Cyberscope)

Market Movements

Robinhood Launches L2 for Tokenized Stocks

Robinhood launched Robinhood Chain, an Ethereum layer-2 for 24/7 tokenized equities, perpetuals via Lighter, and AI-agent trading workflows. The move extends Robinhood from brokerage into onchain market infrastructure as regulated venues race to host real-world assets and automated execution on public chains. Tokenized equities are becoming a venue and workflow competition, not just a product wrapper. The security question moves from “can assets be represented onchain?” to whether settlement, custody, automation, and market controls can survive real brokerage-scale usage. (CoinDesk)

Exploits & Incidents

TRM H1 2026 Hacks

TRM Labs reported that the first half of 2026 saw 207 separate hacks, more than double the 83 in H1 2025, while stolen funds fell to $972 million from $2.3 billion. Smart contract exploits made up 125 incidents but a small slice of dollar losses; infrastructure and key-compromise attacks drove about 76% of value stolen on just 15% of events. North Korea-linked activity accounted for roughly $643 million, mostly April's Drift and KelpDAO thefts. TRM cautions the lower total reflects fewer mega-heists, not weaker attackers. The incident count is rising even as headline losses fall, which means attacker activity is broadening rather than fading. Security teams should keep smart contract review in place, but the money is still being lost through keys, infrastructure, access paths, and operational failures. (TRM Labs)

Polymarket Users Lose $3M Supply-Chain Attack

Polymarket will reimburse users after attackers injected malicious JavaScript through a compromised third-party frontend vendor, tricking fewer than 15 accounts into approving roughly $3M in ParyonUSD.

PeckShield said stolen funds were bridged from Polygon to Ethereum and swapped into about 1,893 ETH. Polymarket confirmed its own servers were not breached, a reminder that prediction-market risk often sits in the web app even when contracts are fine. This is exactly the kind of loss pattern that gets missed when teams define protocol security too narrowly. Frontend integrity, third-party code, wallet approvals, and user transaction context are now part of the security boundary. (The Defiant)

SlowMist stats this week

2026 hacks: 182

Total amount lost in 2026: $955,864,608

Policy & Regulation

Hong Kong is Attracting Institutional Capital

Elliptic explains that Hong Kong’s licensing regime for exchanges and custodians, tokenized securities pilots, and emerging stablecoin frameworks have moved the city from experimentation into a market-building phase. The piece argues that clear rules, operational exchanges and regulated tokenization are now drawing institutional capital, while supervisors continue to prioritize AML, suitability and robust custody over speculative yield products. Hong Kong is showing how regulation can become market infrastructure when licensing, custody, tokenization, and stablecoin rules move together. For institutions, the differentiator is shifting from crypto exposure to whether venues can meet operational and supervisory standards. (Elliptic)

UK's FCA Finalizes Crypto Regime

The FCA published June 30 a package of five policy statements (PS26/9 through PS26/13) completing its cryptoasset rulebook under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, passed February 4. The regime covers stablecoin issuance, trading platforms, custody, staking, lending, admissions and disclosures, and a crypto market-abuse framework. The full regulated scope takes effect October 25, 2027. The UK is moving crypto firms into a much more explicit authorization, prudential, and market-abuse environment. Operators now have a real implementation clock, and the firms that treat this as an operating model change will be better positioned than those treating it as paperwork. (FCA)

Legislative Watch

(Polymarket)

Applied Research

Four-year Study Finds Audit Findings Don't Match Losses

Stefan Beyer's arXiv paper analyzes Web3 security from January 2022 through March 2026, combining 23,818 public audit findings from 22 firms with 218 Rekt documented exploits totaling roughly $7.76B. Critical and High audit findings held steady at 15–17% each year, but loss categories diverged sharply: private-key compromise, phishing, and social engineering drove about 49.6% of dollar losses while barely appearing in published audit output. Losses were also heavily concentrated: the eight largest incidents accounted for 50.6% of cumulative damage and the top twenty for 71.4%. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity crypto hacks regulations <![CDATA[0x39 Web3 Security Bulletin]]> https://paragraph.com/@w3sb/0x39-web3-security-bulletin Ki5kEhLBhT77FAVNvLlu Fri, 26 Jun 2026 06:43:41 GMT TL;DR

  • Base’s two-hour mainnet stall showed that L2 security is also a liveness and resilience problem: invalid-block handling, sequencer design, client diversity, and upgrade discipline now matter as much as exploit prevention.

  • Nethermind reviews how institutional privacy is moving from theory to implementation, with ZK proofs, shielded pools, FHE, TEEs, and MPC giving public-chain finance a path toward confidentiality, verifiability, and selective disclosure.

  • Hypernative’s rebrand points to a maturing onchain security market, where institutions want continuous monitoring, transaction guardrails, wallet protection, fraud detection, RBAC, MFA, and audit logs in one control layer.

  • SecondFi’s $20M wallet loss was a pure fundamentals failure: predictable Ed25519 nonce generation turned ordinary signatures into private-key exposure, reinforcing the need for hardened crypto libraries and strict wallet security review.

  • Bridge and cross-chain assumptions failed again, with Secret Network and Taiko incidents showing how missing source-channel checks or forged message proofs can convert verification gaps into real asset loss.

  • Policy pressure is tightening around the operating layer: TRM traced billions between CoinEx and sanctioned Iranian exchanges, stablecoin issuers face banking-style customer identification rules, and Binance is still searching for a viable MiCA path.

  • Applied research is raising the stakes on both offense and compliance, with new work showing LLMs can generate smart contract exploits across vulnerability classes while ZK compliance schemes try to preserve privacy without weakening authorization.

Industry Trends & Analysis

Base Mainnet Stalled for Hours After Invalid Block

On June 25 Coinbase's Base L2 halted block production in what the team called a "Mainnet Chain Stall" and "Unsafe Head Stall," with deposits, withdrawals, and client software affected for roughly two hours. Base isolated a consensus problem that sequenced an invalid block after block 47,806,542, stopping subsequent block building; Jesse Pollak said funds were safe and the issue was not a security exploit.

EtherWorld frames the outage as a liveness failure, not a safety breach, and notes it landed the same day as the scheduled Beryl upgrade. The article argues the incident renews questions about OP Stack sequencer centralization, client diversity, and whether L2 reliability can match adoption on one of Ethereum's busiest rollups. The security lesson is operational rather than exploit-driven: rollups need liveness, client diversity, upgrade discipline, and clear failover paths before they can credibly carry institutional-scale activity. (EtherWorld)

Institutional Privacy on Public Blockchains Gets Practical

Stefano De Angelis outlines how institutions can use shielded pools, zero-knowledge proofs, FHE, TEEs, and MPC to achieve private transfers and computations on public chains without sacrificing verifiability. The article argues that privacy is a hard requirement for on-chain finance, but must be paired with selective disclosure, access control, and standardized tooling to satisfy regulators and operational constraints. This matters because privacy is becoming a control layer, not a feature request: institutions need confidentiality, selective disclosure, auditability, and access control to coexist on public rails. (Nethermind)

DePINs Bring Crypto Incentives to Real-World Infrastructure

CyberScope introduces decentralized physical infrastructure networks (DePINs) as token-incentivized systems where ordinary users deploy hardware to provide wireless coverage, storage, compute, or sensor data. The article highlights proof-of-physical-work schemes, security challenges like Sybil attacks and node compromise, and argues DePINs will likely coexist with traditional cloud as a cost-effective, censorship-resistant layer for specific workloads. The security baseline for DePINs is physical-world trust: protocols have to prove nodes are real, data is authentic, incentives are not gameable, and compromised hardware cannot poison the network. (CyberScope)

Market Movements

Hypernative Rebrands as Institutional Onchain Security Layer

Hypernative announced that it is refreshing its brand and product naming to match a customer base that now spans crypto-native protocols, Layer 1 teams, and traditional financial institutions building tokenized funds and stablecoin programs. The company says its platform monitors more than $100B in digital assets across 75+ chains for 350+ organizations and has helped prevent over $3B in onchain losses. The rebrand groups capabilities into lifecycle-stage applications including onchain monitoring, transaction guard, fraud prevention, wallet protection, and screening. The product includes shared ML detection infrastructure with 300+ risk agents. New enterprise features include MFA, RBAC, and audit logs. (Hypernative)

Exploits & Incidents

SecondFi Wallet Flaw Results in $20M Loss Across 374 Wallets

SecondFi said June 25 that the root cause was confined to its native Cardano web wallet generation software, with on-chain analysis estimating roughly 16 million ADA in losses from a sophisticated automated attack between June 21 and 23. The team identified two attackers: one drained 171 wallets in two waves via three collection addresses, the other swept 203 wallets in a third wave, with about 4.02 million ADA still sitting in Attacker B's flagged collection address. SecondFi put the platform in secure maintenance mode, took a balance snapshot, and said it is working with IOG, the Cardano Foundation, Intersect, and SundaeSwap while an independent security firm validates findings. The team warned the flaw is address-level and urged affected users to follow official recovery steps rather than importing seed phrases elsewhere. The incident is a reminder that wallet software is security-critical infrastructure: one flawed signing implementation can turn ordinary user activity into private-key exposure at scale. (SecondFi on X)

Root Cause Analysis of SecondFi's Ed25519 Nonce Flaw

SecondFi's Cardano web wallet derived Ed25519 signing nonces from the public transaction message alone (k = H(M)) instead of from a secret seed. Because Ed25519 signatures publish R and s on-chain, anyone could recompute k, plug into a = (s − k) / H(R, A, M), and recover the private key from a single signed transaction, worse than classic nonce reuse, which typically needs two signatures. The failure was custom wallet signing logic, not a Cardano protocol bug; audited libraries like libsodium derive nonces from secrets and prevent this class of leak entirely. The fundamental failure was cryptographic hygiene: teams should use battle-tested signing libraries, avoid custom nonce logic, and treat key-generation code as a high-assurance control surface. (Jonathan on X)

JaredFromSubway MEV Bot Drained for $15M

The JaredFromSubway sandwich bot lost roughly $15M when an attacker fed it fake profitable pools, accumulated ERC-20 approvals up to 92 WETH on helper contracts, then called transferFrom on WETH, USDC, and USDT balances. The lesson here is that automated trading systems are still approval, simulation, and adversarial-input systems; if they trust fake opportunities, attackers can turn speed into liability. Quit's X thread covers the details step by step.

Secret Network Details Axelar IBC Bridge Exploit

Secret Network's forum post says an attacker exploited the ics20-for-axelar contract on June 10 by opening a permissionless IBC channel from a counterfeit chain, minting about $4.67M in unbacked saTokens (saUSDT, saUSDC, saWETH, and four others) in six minutes, then redeeming them through the real Axelar bridge to drain escrow reserves in roughly 18 minutes. The bug dates to a 2023 escrow-to-mint rework that dropped source-channel authentication; a March 2026 migration carried the flaw forward. Secret was not told until June 17. Proceeds moved via Osmosis to Ethereum and BSC, swapped to about 2,349 ETH on CoW Protocol, and cashed out mainly through ChangeNOW and KuCoin; roughly $770,000 remains on Axelar, which Secret says Axelar declined to freeze. Native SCRT, Noble USDC, and other IBC bridges were unaffected. This is a bridge-authentication failure in plain terms: cross-chain systems must verify source channels, message provenance, and migration safety because one missing check can mint unbacked assets into real liquidity. (SCRT)

Taiko L2 Loses $1.7M to Forged Bridge Message Proofs

Taiko halted block production after an attacker exploited bridge message-proof verification, registering fraudulent withdrawals on Ethereum L1 without legitimate MessageSent events on the rollup.

Losses totaled about $1.7M before the team paused the L1 bridge and ERC20Vault. Taiko urged users to exit bridges immediately and asked exchanges to suspend TAIKO deposits. The Taiko exploit reinforces that bridge proofs are core security assumptions; when state verification fails, every dependent bridge and withdrawal path becomes suspect. (The Block)

SlowMist stats this week

2026 hacks: 175

Total amount lost in 2026: $948,394,808

Policy & Regulation

TRM Traces $3.84B Between CoinEx and Sanctioned Iranian Exchanges

TRM Labs reported that blockchain-verified flows between global exchange CoinEx and more than 60 Iranian platforms totaled $3.84B over seven years, including $2.7B with Nobitex at roughly $1M per day. CoinEx's illicit-volume share is nearly 8%, against a 0.3% threshold typical of compliant venues. TRM also traced $67M from the Central Bank of Iran through a multi-chain "National–Tether" laundering playbook ending at CoinEx off-ramps, plus $154M in ViaBTC mining payouts to Nobitex-linked wallets that supplied emergency liquidity after a 2025 cyberattack. The compliance takeaway is that blockchain transparency only helps when exchanges, issuers, and off-ramps convert visibility into controls, sanctions screening, and accountable transaction monitoring. (TRM Labs)

Stablecoin Issuers are Facing Banking Compliance Requirements

FinCEN, OCC, the Fed, FDIC, and NCUA proposed a GENIUS Act rule requiring permitted payment stablecoin issuers to maintain formal customer identification programs under the Bank Secrecy Act. The rule would cover direct issuer relationships like issuance, redemption, custody, and authorized digital asset services, while carving out ordinary secondary-market transfers and smart-contract-only interactions. The operational signal: stablecoin compliance is being designed around issuer-controlled entry points, not a blanket KYC obligation for every wallet-to-wallet payment. The rule shows where stablecoin regulation is likely to land first: issuer-controlled touchpoints, custody, redemption, and authorized services, rather than every peer-to-peer transfer. (Federal Register)

Binance Searches for New MiCA Path

Reuters reported June 24 that Binance Europe head Gillian Lynch said the exchange is not leaving the EU after Greece reportedly rejected its MiCA license bid, and is exploring other member-state routes. ESMA said firms without authorization must wind down EU activities in an orderly way. Sources cited concerns over past AML penalties, corporate structure, and executive backgrounds. Binance has roughly one week before its current EU permission expires. The MiCA setback matters because licensing is becoming an operational security signal: governance structure, AML history, executive accountability, and control maturity now affect market access. (Reuters)

Legislative Watch

(Polymarket)

Applied Research

LLM Exploit-generation Benchmark Across 23 Smart Contract Vulnerability Classes

The June paper introduces a data-centric benchmark using Foundry/Forge harnesses to test whether large language models can generate working exploits for 23 documented blockchain vulnerability types. Results show how automated offensive tooling may compress attacker reconnaissance timelines. The research shows that attacker automation is getting cheaper; smart contract teams need better pre-deployment testing, exploit simulation, and secure-by-default patterns before AI compresses the attack cycle further. (arXiv)

Zero-Knowledge Compliance for Ethereum Transactions

Supriya Khadka and Sanchari Das introduce Selective Disclosure Authorization Schemes (SDAS), a new primitive for privacy-preserving regulatory compliance on public ledgers. Their ZK-Compliance prototype on Ethereum binds zero-knowledge proofs to the on-chain sender, preventing proof reuse and front-running while keeping user attributes private, with browser-side proving and on-chain verification kept practical for real-world deployment. (arXiv)

]]> w3sb@newsletter.paragraph.com (Woodrow Brown) web3 security cybersecurity crypto exploits regulations