Top stories today
Security
Four Governments Trace 30,000 Infected Developer PCs to Fake Job Interviews
Security
Most of the 11.7 Million XRP in the D'CENT Drain Left After the Warning
Security
225,000 Empty Rounds Since MultiversX Last Produced a Block
Policy
Tokenize a Treasury at DTCC and It Stops Counting as Collateral
More this week
AI × Crypto
408.5 Million NTX Came Out of NuNet's Own Minting Key
Fetch.ai says signing keys were stolen; the converter that paid out first checks a signature and almost nothing else.
Policy
S&P Global Is Buying the Auditor Behind $37 Trillion in Transfers
The ratings agency is acquiring OpenZeppelin, whose contract libraries sit under a large share of tokenized value.
Security
A Second gossipsub Package Has the Same Unguarded Check and No Advisory
The advisory covers one package name. The published tarball of a second carries the same missing check.
Security
Since 2022, a Bitcoin Core Wallet Name Could Carry a Shell Command
A wallet name could carry a shell command into the walletnotify hook. The fix rode in on a quiet backport.
Policy
Two Robinhood Engineers' Hyperliquid Wallets Led Back to Exchange Accounts in Their Names
Prosecutors say the pseudonymous wallets moved money to and from exchange accounts the two engineers registered themselves.
Security
2,882 rsETH Went Back to the Safe's Owner 30 Hours After an MEV Bot Took It
An MEV bot took the tokens through a Safe module. Thirty hours later they went back.
Policy
Tillis Voted No to Keep a Second CLARITY Vote Possible
The bill lost 49 to 50. One Republican no kept the route to a second vote open.
Policy
Fifteen Months From Tether's Freeze to a Forfeiture Filing
Tether locked the ten wallets in mid-2025. The public case arrived this month.
Infrastructure
Who Watches Balancer's Pools After October 30?
One date ends the protocol's operation and its bug bounty. Some pools keep trading.
Security
25 Fixes Core Lightning Kept Sealed for Two Weeks
The embargo lifted and the changelog finally said what had been patched.
Security
Revolut Gave Passports and Bitcoin Histories to a Fake Official
A forged request on a real government channel. Italy has now opened a case.
Security
$736,442 Left Chainflip Through Refunds for Swaps That Already Paid
Refunds paid out on Tron swaps that had already been settled.
Security
Ether.fi's Old Queue Could Only Rob Smart Wallets
A deprecated withdrawal queue whose flaw only reached smart-contract wallets.
Security
Hemi's Empty Claim Contract Still Says It Holds 124.5 Million Tokens
A drained claim contract whose own ledger still reports a full balance.
Policy
Three Clauses Now Decide What Counts as Decentralized
The CLARITY text's test for when a protocol counts as controlled.
Infrastructure
Mysten Rewrote a Sui Verifier for a Feature No Chain Has Turned On
A verifier rewrite for a feature no network has enabled yet.
Security
46 Billion Synthetic Bitcoin Converted Into 4.39 Real Ones
An unbacked mint on Symbiosis's Bitcoin bridge, and how little of it could be cashed out.
AI × Crypto
DeepSeek Filed Its 9.4 Sandbox Escape Fix Under Chores
A 9.4-rated sandbox escape fix, filed under a routine label.
Policy
Visa and Mastercard Will Accept an Agent That Ant Already Cleared
An identity check for AI agents that card networks will honor.
Security
Wormhole Is Closing a Way Out of Its Own Four-Day Quarantine
A thirteen-line patch to the component that holds suspicious bridge transfers.
AI × Crypto
It Tried to Abort Eight Times, Then Broke Into a Real Machine
A model told it was in a simulation was on the open internet.
Security
Two Wallet Makers, One Newsletter Vendor, and the Same Fake Alert
One email vendor, two wallet brands, one phishing lure.
Infrastructure
Osmosis Will Ask Its Voters to Seize an Attacker's 22.65 Bitcoin
A governance vote on taking back what an attacker took.
Security
One Signature, Counted Twice, Emptied 2,321 Card Balances
A signature check that let one approval be spent twice.
Security
If Your Alby Hub Predates August 2025, Take It Off the Internet
A default that exposed the node's own wallet to the open internet.
Policy
Block Wants a Bank That Takes No Deposits and Makes No Loans
A charter application for an institution that does neither thing banks do.
Security
The 598 Bitcoin Nobody Will Call a Bounty
Most of $320 million came back, and nobody will name what stayed.
Infrastructure
Bridge Hacks Went From 3 to 26. The Same File Also Says 11 to 39
One dataset, two counts, depending on which column you read.
Security
Set the Clock to 1970 and the Wallet Looks for Its Coins in 2149
A seed phrase's birthday field trusts a number it never checks.
Security
Malware Moved Its Address Book Onto Polygon, Where Takedowns Don't Reach
A command channel written to a chain nobody can serve a takedown on.
AI × Crypto
Who Re-Reads a Tool Description After You Approve It?
Approval happens once. The description can change afterwards.
Policy
Twenty-One Banks Have a Stablecoin Plan, a Launch Window, and No Name
A consortium with a timeline, a membership list, and nothing to call itself.
Security
Five Days Before Liquid's $320 Million Peg-Out, the Fix Was Already in Git
The patch was public before the money moved. Nobody connected them in time.
Policy
Nobody Said 'Blockchain' in the G7's Quantum Warning
A quantum warning to the financial system that never names the sector reading it.
Security
A $1,000 Bounty Bought a Bug Attackers Were Already Using
The reward was set before anyone knew the bug was already in the wild.
Security
After Weeks of Stillness, 20.5 Bitcoin Tested the Exit
Dormant stolen coins moved, and the route mattered more than the amount.
Policy
OpenReserve Needs $210 Million by September 2027
An approved bank charter with a funding clock attached to it.
Security
The Wallets Emptied. The Company Has Said Nothing
Funds left the wallets; the operator never acknowledged it.
Security
Pocket Never Held a Coin. It Held the Map
The breach took no bitcoin — only the record of who owns it.
Security
The Auditors Found It in 2020. They Marked It Low
A severity rating that outlived the people who assigned it.
Infrastructure
The Comment Said the Unwrap Was Safe
A code comment asserting an invariant the code no longer held.
AI × Crypto
The Agent Opened the Folder. The Folder Opened a Shell
A repository that ran code just by being opened.
Policy
The Vote Is Set. The Text Isn't Finished
A cloture date on a bill nobody has finished drafting.
AI × Crypto
The Key Check Failed. The Session Opened Anyway
A key comparison that never ran, and a session that opened regardless.
Policy
Forty Years On, the SEC Reopens the Record of Who Owns What
The rulebook for share ownership predates the internet. That is now the point.
Security
The Code Was Public for a Month. The Reason Wasn’t
A month of public commits, and no explanation of what they fixed.
Security
The Only Fix Was to Ask Everyone to Leave
Immutable contracts meant the bug could not be patched at all.
Security
The Cause Is Still Unknown. The Label Went Up Anyway
A root cause was published before anyone had established one.
Policy
The Two Firms That Count Crypto Crime Are Suing Each Other
The industry's two main sources of crime statistics are now in court.
Security
In Ten Days, Silence Becomes a Reportable Event
The EU's 24-hour incident clock starts running on software makers this month.
Security
Efficiency Mode Did Exactly What It Was Built to Do
A lending setting behaved correctly and still cleared the way for the loss.
Infrastructure
Ontology Stopped the Chain on a Suspicion
The chain went down before anyone had confirmed there was anything to stop.
Security
The Contracts Held. The Prices Didn't
August's losses came from oracles and governance, not from broken contracts.
Security
$951 Bought the Votes. The Vaults Did the Rest
A governance stake bought for pocket change was enough to steer the vaults.
Security
To Keep the Rest, Cronos Turned the Blockchain Off
Halting the chain was the cheapest way to stop an exploit already in progress.
Infrastructure
The Signature Was Valid. The Key Behind It Wasn't
An oracle update carried a correct signature from a key that should never have been trusted.
Security
The Chain Was Fine. The Foundation Wasn't
The validators never missed a beat; the organisation around them did.
Security
The Chains Learned From the Attacker First
A quiet backport reached operators before the advisory did, and the reasoning was defensible.
Policy
California Wrote a Meme Coin Ban It Can Only Half Enforce
The prohibition is clear. The mechanism for reaching anonymous issuers is not.
Policy
The Ninth Circuit Read Kalshi's Marketing Back to It
A prediction market's own promotional copy became the evidence against its federal preemption claim.
Infrastructure
Solana's First Real Vote Came Down to Two Firms Changing Their Minds
A stake-weighted vote turned on a handful of large validators reversing position late.
Security
Nothing Was Hacked. Moonwell Still Lost $8.7 Million
A collateral token's price was moved in a shallow pool, and the lending market believed it.
Security
Two Machines Found the Same Bug. Then the Humans Started Arguing
Duplicate machine-found disclosures arrived hours apart, and the payout rules had no answer.
Security
The Machines Found Real Bugs: Core Lightning's Embargoed Emergency
An embargoed fix, two independent machine-found bugs, and a disclosure window that held.
Policy
The Bank of England Gets a Second Job: Making Stablecoins Work
A central bank asked to make a private payment instrument work, not just to keep it from breaking things.
Security
The Vault Got Robbed: Inside the $116M Coldcard Exploit
A five-year-old firmware flaw, a weak entropy fallback, and the third-largest crypto theft of the year.
AI × Crypto
The $500,000 Isn't in the Paper
A study of 428 AI API routers found nine quietly rewriting what agents do — and one draining a wallet.
Security
Your Patch Deadline Was Set by a Machine
CISA gave agencies until Sunday to patch a Linux kernel flaw — because roughly 700 agents found the public exploit and escaped their test lab.
Security · Contributed
The Safest Place in Crypto Just Got Robbed
What the cold-storage failure actually teaches — and the habits that survive it.
Security
SafePal Breach Doxxes 39,798 Hardware-Wallet Buyers
No coins touched; none needed. A verified list of cold-storage owners with home addresses is a phishing campaign waiting to happen.
AI × Crypto
"Pennies" Compared to What's Coming: Industry Leaders Warn on AI-Agent Attacks
TRM logs a 40% YoY rise in AI adoption across crypto crime. What needed a skilled attacker now runs as software against everyone at once.
Infrastructure
LayerZero Delegate Hijack Mints Unbacked SAND on Base
Compromised delegate permissions, hundreds of automated transactions — a bridge-trust failure, not a token bug.
Custody
MetaMask's Agent Wallet: Guardrails for Letting an AI Touch Your Money
Spending limits, allowed networks, allowed protocols. The design question of the decade: how much of a wallet does an agent get?
Markets Infra
Binance's Agent OS Bridges ChatGPT, Claude, and Cursor to Exchange Rails
The agent-to-exchange pipe is now a product. The security perimeter of "your account" just got a lot more interesting.
The Ledger
H1 2026 by the Numbers: 207 Hacks, $972M, and a Rising Machine Tempo
The worst half-year in TRM's dataset — before AI-scaled attacks fully arrive.
Latest
Security · Contributed · Sep 24
The Interview Was the Install
Security · Sep 23
Cosmos Hub Validators Moved 1.2 Million ATOM Without a Governance Vote
Security · Sep 23
Restart a Halted Chain and Six Hourly Quotas Can Leave in 36 Seconds
Infrastructure · Sep 23
Cosmos Wrote a Warning Where a Check Should Have Gone
AI × Crypto · Sep 22
EvilTokens Sold a Chatbot That Picked Who to Impersonate
Security · Sep 22
Pragma Says a Third Price Source Would Have Stopped the Nostra Drain
Security · Sep 21
Four Governments Trace 30,000 Infected Developer PCs to Fake Job Interviews
Security · Contributed · Sep 21
A Patch Can't Take Back a Key
Security · Sep 21
Most of the 11.7 Million XRP in the D'CENT Drain Left After the Warning
Security · Sep 20
225,000 Empty Rounds Since MultiversX Last Produced a Block
Policy · Sep 20
Tokenize a Treasury at DTCC and It Stops Counting as Collateral
AI × Crypto · Sep 20
408.5 Million NTX Came Out of NuNet's Own Minting Key
Policy · Sep 20
S&P Global Is Buying the Auditor Behind $37 Trillion in Transfers
Security · Sep 17
A Second gossipsub Package Has the Same Unguarded Check and No Advisory
Security · Contributed · Sep 17
The Name Became the Command
Security · Contributed · Sep 7
Every Signature Was Legitimate
Security · Contributed · Sep 14
The Request Came from the Right Address
Security · Contributed · Sep 10
Reading Leaves No Trace
Security · Contributed · Sep 1
Nobody Sent the Warning
Security
Since 2022, a Bitcoin Core Wallet Name Could Carry a Shell Command
Sep 17
Policy
Two Robinhood Engineers' Hyperliquid Wallets Led Back to Exchange Accounts in Their Names
Sep 16
Security
2,882 rsETH Went Back to the Safe's Owner 30 Hours After an MEV Bot Took It
Sep 16
Policy
Tillis Voted No to Keep a Second CLARITY Vote Possible
Sep 15
Policy
Fifteen Months From Tether's Freeze to a Forfeiture Filing
Sep 15
Infrastructure
Who Watches Balancer's Pools After October 30?
Sep 15
Security
25 Fixes Core Lightning Kept Sealed for Two Weeks
Sep 14
Security
Revolut Gave Passports and Bitcoin Histories to a Fake Official
Sep 14
Security
$736,442 Left Chainflip Through Refunds for Swaps That Already Paid
Sep 13
Security
Ether.fi's Old Queue Could Only Rob Smart Wallets
Sep 13
Security
Hemi's Empty Claim Contract Still Says It Holds 124.5 Million Tokens
Sep 12
Policy
Three Clauses Now Decide What Counts as Decentralized
Sep 12
Infrastructure
Mysten Rewrote a Sui Verifier for a Feature No Chain Has Turned On
Sep 12
Security
46 Billion Synthetic Bitcoin Converted Into 4.39 Real Ones
Sep 12
AI × Crypto
DeepSeek Filed Its 9.4 Sandbox Escape Fix Under Chores
Sep 11
Policy
Visa and Mastercard Will Accept an Agent That Ant Already Cleared
Sep 11
Security
Wormhole Is Closing a Way Out of Its Own Four-Day Quarantine
Sep 10
AI × Crypto
It Tried to Abort Eight Times, Then Broke Into a Real Machine
Sep 10
Security
Two Wallet Makers, One Newsletter Vendor, and the Same Fake Alert
Sep 10
Infrastructure
Osmosis Will Ask Its Voters to Seize an Attacker's 22.65 Bitcoin
Sep 9
Security
If Your Alby Hub Predates August 2025, Take It Off the Internet
Sep 9
Security
One Signature, Counted Twice, Emptied 2,321 Card Balances
Sep 9
Policy
Block Wants a Bank That Takes No Deposits and Makes No Loans
Sep 9
Security
The 598 Bitcoin Nobody Will Call a Bounty
Sep 8
Infrastructure
Bridge Hacks Went From 3 to 26. The Same File Also Says 11 to 39
Sep 8
Security
Set the Clock to 1970 and the Wallet Looks for Its Coins in 2149
Sep 8
Security
Malware Moved Its Address Book Onto Polygon, Where Takedowns Don't Reach
Sep 8
AI × Crypto
Who Re-Reads a Tool Description After You Approve It?
Sep 7
Policy
Twenty-One Banks Have a Stablecoin Plan, a Launch Window, and No Name
Sep 7
Security
Five Days Before Liquid's $320 Million Peg-Out, the Fix Was Already in Git
Sep 7
Policy
Nobody Said 'Blockchain' in the G7's Quantum Warning
Sep 6
Security
A $1,000 Bounty Bought a Bug Attackers Were Already Using
Sep 6
Security
After Weeks of Stillness, 20.5 Bitcoin Tested the Exit
Sep 6
Policy
OpenReserve Needs $210 Million by September 2027 to Open Its Approved Bank
Sep 6
Security
The Wallets Emptied. The Company Has Said Nothing
Sep 5
Security
Pocket Never Held a Coin. It Held the Map
Sep 5
Security
The Auditors Found It in 2020. They Marked It Low
Sep 5
Infrastructure
The Comment Said the Unwrap Was Safe
Sep 5
Security
The Vendor Nobody Chose: How a Dashboard Bug Leaked Hardware-Wallet Buyers
Sep 5
AI × Crypto · Sep 3
The Agent Opened the Folder. The Folder Opened a Shell
Policy · Sep 3
The Vote Is Set. The Text Isn't Finished
AI × Crypto · Sep 2
The Key Check Failed. The Session Opened Anyway
Policy · Sep 2
Forty Years On, the SEC Reopens the Record of Who Owns What
Security · Sep 2
The Code Was Public for a Month. The Reason Wasn’t
Security · Sep 1
The Only Fix Was to Ask Everyone to Leave
Security · Sep 1
The Cause Is Still Unknown. The Label Went Up Anyway
Policy · Sep 1
The Two Firms That Count Crypto Crime Are Suing Each Other
Security · Sep 1
In Ten Days, Silence Becomes a Reportable Event
Security · Aug 31
Efficiency Mode Did Exactly What It Was Built to Do
Infrastructure · Aug 31
Ontology Stopped the Chain on a Suspicion
Security · Aug 31
The Contracts Held. The Prices Didn't
Security · Aug 31
$951 Bought the Votes. The Vaults Did the Rest
Security · Aug 30
To Keep the Rest, Cronos Turned the Blockchain Off
Infrastructure · Aug 30
The Signature Was Valid. The Key Behind It Wasn't
Security · Aug 30
The Chain Was Fine. The Foundation Wasn't
Security · Aug 29
The Chains Learned From the Attacker First
Policy · Aug 29
California Wrote a Meme Coin Ban It Can Only Half Enforce
Policy · Aug 29
The Ninth Circuit Read Kalshi's Marketing Back to It
Infrastructure · Aug 29
Solana's First Real Vote Came Down to Two Firms Changing Their Minds
Security · Aug 28
Nothing Was Hacked. Moonwell Still Lost $8.7 Million
Security · Aug 28
Two Machines Found the Same Bug. Then the Humans Started Arguing
Security · Aug 28
Your Patch Deadline Was Set by a Machine
AI × Crypto · Aug 28
The $500,000 Isn't in the Paper
Security · Contributed · Aug 28
The Safest Place in Crypto Just Got Robbed
Security · Aug 28
The Machines Found Real Bugs: Inside Core Lightning's Embargoed Emergency
Policy · Aug 28
The Bank of England Gets a Second Job: Making Stablecoins Work
Security · Aug 27
The Vault Got Robbed: What the $116M Coldcard Exploit Says About Everyone's Cold Storage
Security · Aug 27
No Coins Were Touched. That's Not Good News.
AI × Crypto · Aug 27
“Pennies”: Why Security Leaders Think the Billion-Dollar Hacks Are the Warm-Up
Infrastructure · Aug 27
Minting Out of Thin Air: The LayerZero Delegate Hijack, Explained
AI × Crypto · Aug 27
Guardrails for the Robot Hand: MetaMask's Agent Wallet Goes Public
AI × Crypto · Aug 27
The Agent-to-Exchange Pipe Is Now a Product
Policy · Aug 27
The Half-Year Ledger: 207 Hacks, $972M, and a Rising Machine Tempo