Exploits, audits, bridge attacks, key compromises, and post-mortems. The state of crypto security and the auditors trying to keep up.
On Sunday, the official X account of Bitcoin hardware wallet maker Coldcard published a fake 'security migration' alert pushing users to a phishing site. The company deleted it, says its account has used offline 2FA since 2017, and reportedly found no login or session record explaining the post. It has asked X to look at the platform side.
A 2015-era integer overflow in the XRP Ledger's payment engine let one transaction create spendable XRP beyond the fixed 100 billion supply, at the cost of a few hundred XRP in refundable reserves plus fees. Cayden Liao and Veria AI reported it on Sept. 22, xrpld 3.4.1 quietly fixed it on Sept. 25, and the full disclosure only landed on Oct. 9. No exploitation has been found.
Ledger has ordered its official Southeast Asian reseller, CryptoBilis, to halt all sales and shipments while it investigates wallet drains that on-chain investigator Specter puts above $86 million across Bitcoin, Ethereum and Tron. Anyone who bought from the reseller in the last 90 days is being told not to initialize their device, and anyone who already did should move to a new signer with a new seed.
An attacker pulled about 1,783 wstETH, worth over $6 million, out of a vault on Base on October 4. The vault was controlled by a 3-of-7 Safe multisig with seven unidentified signers. No protocol has claimed it, the root cause is unconfirmed, and around $31.7 million was reportedly still at risk when the incident was disclosed.
On September 30 an attacker swapped the fee-recipient address on MetaMask-operated Lido validators and redirected about 0.36 ETH in block tips to a Tornado Cash-funded wallet. The theft was under $1,000. The response: roughly 17,000 validators holding about 523,000 ETH, worth around $1.4 billion, are being exited by October 7. Ethereum's exit queue is at a nine-month high, and Lido says the full exit and re-entry cycle could take up to 45 days.
An onchain investigation by analyst Wazz ties 53 Robinhood Chain memecoin launches, between July 10 and September 21, to a single operation that pulled out at least $18.43 million. The group used bundles of 70 to 200 wallets, got its own wallets exempted from the launchpad's anti-sniping tax, grabbed 82-86% of supply within seconds of launch, and used each rug's proceeds to fund the next one. Robinhood's new chain is less than three months old.
Five months after 116,500 rsETH was stolen through a forged cross-chain message, KelpDAO's developer has sued LayerZero Labs and co-founder Bryan Pellegrino personally in British Columbia for negligence, negligent misrepresentation and defamation. Kelp says LayerZero reviewed and endorsed its 1-of-1 verifier config in writing. LayerZero says that config was the single point of failure and calls the suit 'meritless.' Here's what the case is really about, and why every bridge integration team should be paying attention.
At 18:31 UTC on September 24, Bitget detected unauthorized transfers from its hot and warm wallets. The final count was $351.6 million, the biggest crypto hack of 2026 so far. The CEO says no private keys leaked. The attackers got into a third-party tool Bitget uses every day, forged transfer instructions, and let Bitget's own signing system approve them. It's the same basic approach as the $1.5B Bybit heist. Here's what was taken, where it went, and why it matters for anyone working in exchange security.
One of the original DeFi AMMs is proposing to pause every pool, fire itself, and hand the treasury to anyone willing to burn their BAL. Revenue is $30K a month against $150K in costs, ten months after a rounding error drained $128 million. The vote runs September 25 to 29.
No malware. No exploit. A fraudulent data request from a genuine government agency mailbox passed Revolut's checks, and the bank handed over ID scans, selfies, IBANs and full Bitcoin transaction records for a 'limited' set of customers. ZachXBT says it looks targeted at whales. Mark Karpelès says he got the notification.
100+ researchers from the Ethereum Foundation, StarkWare and Trail of Bits ran an open bounty where AI coding agents ground down the quantum circuit that breaks secp256k1. The score fell from 10.75 billion to 1.5 billion — below Google's benchmark. The paper hit arXiv yesterday.
Someone submitted 4,000 L-BTC that was never backed by anything. Twenty-three minutes later the Liquid Federation released 3,996 real Bitcoin. Then the recipient carved 'we are whitehats' into the blockchain and asked for a patch.
AI threatens crypto; $1.32B stolen in hacks. 7,254 jobs cut, yet security roles soar.
August's exploit wave barely involved code bugs. Hijacked bridge permissions, unauthorized minting, a compromised exchange. The attack surface moved to config, and almost nobody is auditing config.
2026 is on pace to be the costliest year for crypto theft on record. Look at where the money actually left from and a pattern shows up that should terrify anyone still auditing only Solidity.
Cronos didn't negotiate with the attacker who took $75M from Tectonic. It rewound the entire chain — and deleted every unrelated transaction from the last two hours along with the theft.
Air-gapped. Cold storage. Seed on steel. And 1,816 BTC walked out the door anyway — because the device stopped rolling real dice in March 2021 and nobody noticed for five years.
A new class action claims Ledger's leaked customer list is still draining wallets years later. The device worked perfectly. The spreadsheet with your name and address is what got people robbed.
Blockchain Security Researchers in 2026 earn up to $300,000. Explore the crypto job market's trends and salaries.
Explore Blockchain Security Researcher salaries in 2026, ranging from $90,000 to $300,000. Discover what crypto protocols are paying.
From a $70B Aptos bug to AI trading on Robinhood's new blockchain, here's your weekly crypto job market impact.
Summer.fi's LazyVault protocol was drained of $6 million in DAI after an attacker exploited a share-accounting flaw — using a $65.4M flash loan to execute the entire heist in a single transaction.
A governance attack on BonkDAO drained $20M in BONK tokens from the Solana DAO's treasury using the project's own voting system. No smart contract hack required.
Security firm Hexens found a type-confusion bug in Aptos's Move VM that let a $3,000 server break a core safety guarantee with 90%+ success rate — putting $70B at systemic risk. The patch dropped within hours. No funds lost. But the close call exposed a fault line under every Move-based chain.
Hinkal, an on-chain privacy protocol, was completely drained of $820K in USDC today via a 'proofless deposit' exploit. The attacker laundered the funds through sanctioned mixer Tornado Cash. The irony is staggering.
Polymarket hacked for $3.1M. Ethereum cuts 54 jobs. Crypto roles shift as markets shake.
A supply chain attack on a third-party frontend vendor drained $3.1 million in PUSD from 11 Polymarket wallets. Users never touched a phishing link. They just visited the site. Now the CFTC has opened an investigation into the company for deceptive marketing.
Resupply, a stablecoin lending protocol backed by Convex and Yearn Finance, was drained of $9.5 million via a donation attack on a freshly deployed vault. The attacker started with a $4,000 flash loan and used 1 wei as collateral to borrow 10 million stablecoins.
World leaders at the Évian G7 summit officially classified DPRK crypto heists as a weapons-financing threat. Seven nations. $6.75 billion stolen. Zero arrests.
Worldcoin rival Humanity Protocol lost $32M after a private key compromise tanked $H by 90%. On-chain investigator ZachXBT says the evidence looks like an inside job.
A 4-year-old bug in Zcash's Orchard privacy pool let anyone mint unlimited counterfeit ZEC undetected. Claude Opus 4.8 found it. An emergency hard fork fixed it. But due to Zcash's own privacy guarantees, it's cryptographically impossible to prove it was never exploited.
Security experts warn that nation-states are quietly harvesting encrypted institutional crypto data today — planning to decrypt it once quantum computers arrive. Bitcoin has no plan. Ethereum does. 6.9 million BTC hangs in the balance.
Gravity Bridge, the cross-chain protocol linking Ethereum to Cosmos, was drained of $5.4 million in a suspected signing key compromise. May 2026 is now the worst month for bridge exploits on record, with $328M stolen.
StablR, a MiCA-regulated European stablecoin issuer, was drained by an attacker who exploited a single compromised key to mint 13.5 million in unbacked USDR and EURR tokens. Both stablecoins are now frozen.
ZachXBT flagged suspicious drains from Polymarket's UMA CTF Adapter on Polygon. The culprit: a forgotten six-year-old private key still tied to live operations.
Echo Protocol on Monad was exploited via a compromised admin key — minting 1,000 fake eBTC worth $76.7M. The attacker could only cash out $816K before the team burned the rest. Here's what actually happened.
THORChain was drained across Bitcoin, Ethereum, BNB Chain, and Base simultaneously on May 15. RUNE dropped 12%, all trading and signing was halted, and the team still hasn't explained the attack vector.
The Ethereum Foundation, Ledger, MetaMask, Trezor, Fireblocks and WalletConnect just launched Clear Signing — an open standard that replaces the hex garbage users blindly approve with human-readable transaction descriptions. Bybit's $1.5B hack started with a blind signing. So did most of yours.
Bitcoin Core quietly patched its first-ever memory safety bug in late 2024, disguising the fix as a logging improvement. The vulnerability — now public — let miners remotely crash nodes running versions 0.14.0 through 28.x. Nearly half the network is still exposed.
A single obfuscated tweet tricked xAI's Grok into executing a $175K on-chain transfer — no private keys stolen, no smart contract exploit. Just a chatbot doing what it was told.
A coordinated attacker swept over 500 long-dormant Ethereum addresses, stealing ~$800K and routing funds through ThorChain. The compromise vector is still unknown — and your old wallets may not be safe.
April 2026 was the worst month in crypto hack history: 30 attacks, $625M drained, North Korea behind 76% of it. Now a developer is claiming DPRK trained an AI to autonomously exploit DeFi — and the Wasabi Protocol's $5M multi-chain drain may be its latest hit.
DeFi United drops its technical rescue blueprint today, with Consensys, Aave, Compound, the Solana Foundation and 14 other protocols pledging $300M+ in ETH to re-collateralize rsETH after the $292M Lazarus-linked KelpDAO exploit. This is the most coordinated cross-protocol rescue in DeFi history.
A zero-day exploit in Litecoin's MimbleWimble privacy layer triggered a 13-block chain reorg, wiping three hours of transactions. Litecoin denied it was a zero-day. GitHub commits say otherwise.
Lazarus Group's new 'Mach-O Man' macOS malware is targeting crypto and fintech executives with convincing fake meeting invites, stealing keychain data and wallet credentials before erasing itself completely.
April 2026 is already the worst month for crypto hacks since February 2025. $606 million gone in 18 days. 3.7x the entire first quarter. Today, Congress is holding hearings. Here's what broke.
Hackers breached Vercel — the hosting backbone for thousands of DeFi apps — by exploiting a compromised third-party AI platform. API keys, tokens, and source code are on sale for $2M on BreachForums.
Kelp DAO's rsETH bridge was drained in minutes after an attacker forged LayerZero cross-chain messages. Bad debt cascaded across Aave, Compound, and Euler. It's 2026's biggest DeFi hack — so far.
Operation Atlantic, a joint US-UK-Canada law enforcement strike, froze $12M and traced $45M in crypto approval phishing fraud across 30+ countries. Here's what that means for the industry.
41 violent crypto kidnappings in 2026. France now has the worst crypto ransom attack rate in the world, and the interior ministry just admitted they've lost control.
Grinex — the sanctions-dodging successor to Russia's notorious Garantex — shut down after a $13M hack and blamed 'Western special services.' The irony is too rich.
A new 'canary address' proposal would only freeze 6.5 million vulnerable BTC — including Satoshi's coins — if a quantum computer actually proves it can break Bitcoin first. Adam Back says there's a better way.
Tether is bailing out Drift Protocol with $148M after North Korea's $285M heist — but the real play is quietly replacing Circle's USDC as Solana DeFi's settlement currency.
A fraudulent Ledger Live app slipped through Apple's review process, stayed live for roughly two weeks, and drained $9.5 million from 50+ victims before ZachXBT blew the whistle.
A forged cross-chain proof let an attacker mint 1,000,000,000 fake DOT tokens on Ethereum in a single transaction. Thin liquidity saved Polkadot. Twelve days earlier, Hyperbridge had posted an April Fools' joke about exactly this.
Drift Protocol confirmed today that the April 1 exploit wasn't opportunistic — DPRK-linked hackers spent six months attending crypto conferences, building real relationships, and depositing real money before draining $270M.
ZachXBT just published a damning thread showing Circle had the power to freeze $232M in stolen Drift Protocol funds — during business hours, over 6 hours — and chose not to. It's part of a pattern spanning $420M across 15 cases since 2022.
Drift Protocol, Solana's leading perpetuals DEX, was drained of up to $285M in a still-unconfirmed exploit on April 1 — and the attacker is still moving funds right now.
Google says breaking Bitcoin may need 20x fewer qubits than thought. 6.9M BTC already exposed. The race to hire post-quantum crypto engineers starts now.
512K lines of TypeScript and 44 feature flags exposed via npm. If your crypto team uses AI coding tools, your threat model just changed.
The Axios supply chain attack dropped a crypto-wallet-stealing RAT on 100M weekly installs. What happened, why AI missed it, and the security roles crypto needs now.