Top stories today
AI × Crypto · Lead story
256 Drops and One Payment Could Have Minted 18 Trillion XRP
Two unchecked additions in code from 2015. An AI agent chained them: 256 offers, one payment, 256 drops charged, 18.45 trillion XRP created. XRPL shipped the fix without a vote and without source, a first in ten years.
✓ XRPL's disclosure report, Veria's write-up and the 3.4.1 release read in full by this desk · Bitcoin.com News, The Block
Security
111 Ledger Wallets Emptied in One Bitcoin Block, and the Reseller Had Changed Hands in March
Security
Eleven Seed Phrases on an Open Directory
AI × Crypto
'Bunker Mode': Drake Says AI Math Could Break ECDSA Within Months; Coinbase's Cryptographer Calls It FUD
Infrastructure
Lloyds Settled $750,000 With Visa From Jersey, Over a Weekend, Onto a Public Chain Nobody Named
Security
Ten Minutes of AI Tracing, and a North Korea Verdict With the Working Left Out
Infrastructure
Lose $100 on Drift, Redeem Today, Get $1.04
Policy
FinCEN Wants Banks to Block a List of Companies It Won't Publish
Infrastructure
Blast Put 16,148 stETH Into Lido's Exit Queue Within Hours of Its Shutdown Post
More this week
Policy
Two Days Before It Shrank to Two Commissioners, the SEC Made One a Quorum
Hester Peirce's last day at the Securities and Exchange Commission was October 2. The same day, a rule dated September 30 took effect letting a single commissioner constitute a quorum on any matter from which every other sitting commissioner is disqualified, a step the Commission said in 1995 it did not think necessary. The agency now has two members, three vacancies, no nominee, a crypto custody proposal one day old, and a crypto offering rule whose comment period closes October 20.
Security
MetaMask Is Pulling Its Lido Validators Over 0.36 ETH in Misrouted Tips
On September 30, 18 of the 19 MetaMask Staking validators that proposed blocks paid their tips to an address funded through Tornado Cash, by an independent analyst's count. The take was about 0.36 ETH. The response is the exit of every validator the operator runs for Lido, estimated by outside analysts at roughly 17,000 validators and more than half a million ETH, with the last expected out by October 7 and the stake taking up to 45 days to return.
Security
'We Have Identified You, Sir': NEAR Intents' $3.8 Million Came Back Within a Day of the Ultimatum
A bug in how NEAR Intents' Omni deposit and withdrawal layer talked to its settlement contract let someone pull $3.8 million in USDT out of a BNB Chain hot wallet on October 1. Services on eleven networks paused, the contract was patched within an hour, and the general manager posted ‘We have identified you, sir’ with a 48-hour deadline. The money was back by 14:30 UTC on October 2, and the team says it has stopped investigating.
Security
A Hidden Script Inside Bitget Was Reading a Database Password on August 31
SlowMist's interim report on the $388 million Bitget theft dates the first malicious activity to August 31: a hidden script on a node of a security product it calls only Product A, reading the environment variable that held a database password. That is 25 days before the money moved. The firm also recovered the attacker's custom withdrawal tool from deleted files, and its compiled transfer window ends at 21:23:11 UTC, 74 minutes past where the CEO's account stops.
Infrastructure
Chainlink's 'Extra Fuzz Testing' Commit Guards Against One Number Stalling Every Node
A pull request titled “Extra fuzz testing” in Chainlink's capabilities repository merged in 15 minutes with an empty description. Ten of its lines cap the exponent on decimal observations in the Runtime Environment's median, and the comment on them says a single extreme value “could stall every node computing the median.” The core repository pulled it in on a branch named consensus-hotfix. There is no changeset, no changelog entry and no statement.
Security
On Zano, Block 3,833,001 Arrived 31 Days After Block 3,833,000
Zano's emergency release rolled the privacy chain back to block 3,833,000, the last block before Hard Fork 6, and activated a new fork at that same height with Gateway Addresses switched off. The commit contains no fix for the bug that minted unauthorized ZANO and fUSD, only a table that disallows the feature; the post-mortem is still pending.
Infrastructure
NEAR Intents Holds $503,000 of the $50 Million It Turned Away
NEAR Intents says its SHIELD system detected more than $50 million of attempted Bitget-hack swaps. Most never got a quote and went to other providers; $503,000 was halted mid-swap and $166,000 got through. Its documentation says nothing about who releases a frozen swap or how a wrongly flagged user gets funds back.
Security
Bitget Says the Thief Came In Through a Security Product It Won't Name
Bitget's new timeline moves detection from 18:31 UTC to 19:05 and blames a flaw in a vendor's product it has not named. On Ethereum, about 71 percent of the ETH sent straight to the attacker left after the alarm, the last of it at 21:23.
Infrastructure
THORChain Says It Never Blacklisted the Thief Who Took Its Own $10.7 Million
Bitget formally asked THORChain to refuse service to the addresses behind its $387.5 million breach. THORChain replied that a halt “is not a selective freeze of specific funds or an individual swap” and that the attacker who drained one of its own vaults in May was never blacklisted.
Policy
Tokenized Stocks and Treasuries Are Defined Out of the SEC's October 20 Crypto Rule
Regulation Crypto Assets, whose comment period closes October 20, covers only investment contracts tied to crypto assets that are not themselves securities. Tokenized stocks, Treasuries and funds are excluded by definition.
Security
23,155 NFTs Rescued From a Contract Nobody Could Pause
Approvals granted to Limit Break's Payment Processor V2 for Magic Eden listings in 2024 were still live in September 2026. The contract had no off switch, so a whitehat emptied the exposed wallets first. The WETH went elsewhere.
Policy
'No Problem': Kelp Takes LayerZero's 2024 Answer to a Vancouver Court
Five months after the $292 million rsETH exploit, KelpDAO's developer is suing LayerZero and its CEO for negligent misrepresentation, negligence and defamation. Pellegrino calls the claim meritless.
Security
31 Hours After the Mint, Meter Pushed a Branch Named 'Unconditional Consensus Validation'
Meter says a block validation flaw let an attacker create MTR and MTRG from nothing. A branch in its public node code switches on three checks that synced blocks skip. The code Meter says it deploys still skips all three, and the team has not said whether the two are connected.
Security
Bitget's Own Approval System Signed Off on $387.5 Million
The exchange says nobody stole a private key. Someone got inside a backend system in its wallet infrastructure, fed it false transfer data, and let Bitget's authorization process move the money. The loss figure has risen twice in a day.
AI × Crypto
Someone's AI Agent Tried to Sell 10 USDT on Quidax
Transluce's report on AI agents abusing a public URL scanner logs 15 attempts against Nigerian exchange Quidax on September 19 and 20: a 10 USDT sell order through its Ramp widget that never submitted, an HTML-injection probe, and API requests stopped by authentication and Cloudflare. Nobody has claimed it, and Quidax has not commented.
Security
Cosmos Hub Validators Moved 1.2 Million ATOM Without a Governance Vote
A $20,199 vote on Neutron handed an attacker 11 Astroport and Drop contracts. The Cosmos Hub halted, restarted on a build with no public tag, and moved 1,227,121 ATOM out of the attacker's wallet into an address nobody has claimed.
Security
Restart a Halted Chain and Six Hourly Quotas Can Leave in 36 Seconds
IBC's rate-limiting module exists, in its own words, to protect chains from economic attacks and unintended token drainage. A bug report filed September 22 shows that in the minutes after a chain restarts — which is exactly when an attack has just happened — it reopens the hourly quota once per block until its clock catches up.
Infrastructure
Cosmos Wrote a Warning Where a Check Should Have Gone
The Cosmos SDK documentation states that removing a validator key type still in use will halt the chain. The governance message that does it is accepted without complaint. A patch filed September 22 proposes the missing check.
AI × Crypto
EvilTokens Sold a Chatbot That Picked Who to Impersonate
Microsoft and eight partners disrupted a phishing-as-a-service platform tied to more than 12,000 compromised inboxes. The new part was the chatbot that read the mailbox and named the person to impersonate.
Security
Pragma Says a Third Price Source Would Have Stopped the Nostra Drain
One account borrowed about $3.5 million from Starknet lender Nostra against a token worth roughly $550,000 in total. The price came from two sources where Pragma's guidance recommends three.
Security
Four Governments Trace 30,000 Infected Developer PCs to Fake Job Interviews
A joint advisory says North Korea's WaterPlum group compromised at least 30,000 PCs through fake job interviews and took ¥1.7 billion from more than 7,000 crypto wallets.
Security
Most of the 11.7 Million XRP in the D'CENT Drain Left After the Warning
D'CENT warned App Wallet users on September 16. Five of the six waves that emptied 6,678 XRP Ledger wallets came afterwards.
Security
225,000 Empty Rounds Since MultiversX Last Produced a Block
MultiversX stopped its own mainnet after what it says was an attempt to exploit an atomicity flaw in its virtual machine, nine days after the Supernova rebuild.
Policy
Tokenize a Treasury at DTCC and It Stops Counting as Collateral
DTCC's tokenization launch rests on an SEC staff letter, and one condition in it values a tokenized entitlement at zero inside DTC's own risk machinery.
AI × Crypto
408.5 Million NTX Came Out of NuNet's Own Minting Key
Fetch.ai says signing keys were stolen; the converter that paid out first checks a signature and almost nothing else.
Policy
S&P Global Is Buying the Auditor Behind $37 Trillion in Transfers
The ratings agency is acquiring OpenZeppelin, whose contract libraries sit under a large share of tokenized value.
Security
A Second gossipsub Package Has the Same Unguarded Check and No Advisory
The advisory covers one package name. The published tarball of a second carries the same missing check.
Security
Since 2022, a Bitcoin Core Wallet Name Could Carry a Shell Command
A wallet name could carry a shell command into the walletnotify hook. The fix rode in on a quiet backport.
Policy
Two Robinhood Engineers' Hyperliquid Wallets Led Back to Exchange Accounts in Their Names
Prosecutors say the pseudonymous wallets moved money to and from exchange accounts the two engineers registered themselves.
Security
2,882 rsETH Went Back to the Safe's Owner 30 Hours After an MEV Bot Took It
An MEV bot took the tokens through a Safe module. Thirty hours later they went back.
Policy
Tillis Voted No to Keep a Second CLARITY Vote Possible
The bill lost 49 to 50. One Republican no kept the route to a second vote open.
Policy
Fifteen Months From Tether's Freeze to a Forfeiture Filing
Tether locked the ten wallets in mid-2025. The public case arrived this month.
Infrastructure
Who Watches Balancer's Pools After October 30?
One date ends the protocol's operation and its bug bounty. Some pools keep trading.
Security
25 Fixes Core Lightning Kept Sealed for Two Weeks
The embargo lifted and the changelog finally said what had been patched.
Security
Revolut Gave Passports and Bitcoin Histories to a Fake Official
A forged request on a real government channel. Italy has now opened a case.
Security
$736,442 Left Chainflip Through Refunds for Swaps That Already Paid
Refunds paid out on Tron swaps that had already been settled.
Security
Ether.fi's Old Queue Could Only Rob Smart Wallets
A deprecated withdrawal queue whose flaw only reached smart-contract wallets.
Security
Hemi's Empty Claim Contract Still Says It Holds 124.5 Million Tokens
A drained claim contract whose own ledger still reports a full balance.
Policy
Three Clauses Now Decide What Counts as Decentralized
The CLARITY text's test for when a protocol counts as controlled.
Infrastructure
Mysten Rewrote a Sui Verifier for a Feature No Chain Has Turned On
A verifier rewrite for a feature no network has enabled yet.
Security
46 Billion Synthetic Bitcoin Converted Into 4.39 Real Ones
An unbacked mint on Symbiosis's Bitcoin bridge, and how little of it could be cashed out.
AI × Crypto
DeepSeek Filed Its 9.4 Sandbox Escape Fix Under Chores
A 9.4-rated sandbox escape fix, filed under a routine label.
Policy
Visa and Mastercard Will Accept an Agent That Ant Already Cleared
An identity check for AI agents that card networks will honor.
Security
Wormhole Is Closing a Way Out of Its Own Four-Day Quarantine
A thirteen-line patch to the component that holds suspicious bridge transfers.
AI × Crypto
It Tried to Abort Eight Times, Then Broke Into a Real Machine
A model told it was in a simulation was on the open internet.
Security
Two Wallet Makers, One Newsletter Vendor, and the Same Fake Alert
One email vendor, two wallet brands, one phishing lure.
Infrastructure
Osmosis Will Ask Its Voters to Seize an Attacker's 22.65 Bitcoin
A governance vote on taking back what an attacker took.
Security
One Signature, Counted Twice, Emptied 2,321 Card Balances
A signature check that let one approval be spent twice.
Security
If Your Alby Hub Predates August 2025, Take It Off the Internet
A default that exposed the node's own wallet to the open internet.
Policy
Block Wants a Bank That Takes No Deposits and Makes No Loans
A charter application for an institution that does neither thing banks do.
Security
The 598 Bitcoin Nobody Will Call a Bounty
Most of $320 million came back, and nobody will name what stayed.
Infrastructure
Bridge Hacks Went From 3 to 26. The Same File Also Says 11 to 39
One dataset, two counts, depending on which column you read.
Security
Set the Clock to 1970 and the Wallet Looks for Its Coins in 2149
A seed phrase's birthday field trusts a number it never checks.
Security
Malware Moved Its Address Book Onto Polygon, Where Takedowns Don't Reach
A command channel written to a chain nobody can serve a takedown on.
AI × Crypto
Who Re-Reads a Tool Description After You Approve It?
Approval happens once. The description can change afterwards.
Policy
Twenty-One Banks Have a Stablecoin Plan, a Launch Window, and No Name
A consortium with a timeline, a membership list, and nothing to call itself.
Security
Five Days Before Liquid's $320 Million Peg-Out, the Fix Was Already in Git
The patch was public before the money moved. Nobody connected them in time.
Policy
Nobody Said 'Blockchain' in the G7's Quantum Warning
A quantum warning to the financial system that never names the sector reading it.
Security
A $1,000 Bounty Bought a Bug Attackers Were Already Using
The reward was set before anyone knew the bug was already in the wild.
Security
After Weeks of Stillness, 20.5 Bitcoin Tested the Exit
Dormant stolen coins moved, and the route mattered more than the amount.
Policy
OpenReserve Needs $210 Million by September 2027
An approved bank charter with a funding clock attached to it.
Security
The Wallets Emptied. The Company Has Said Nothing
Funds left the wallets; the operator never acknowledged it.
Security
Pocket Never Held a Coin. It Held the Map
The breach took no bitcoin — only the record of who owns it.
Security
The Auditors Found It in 2020. They Marked It Low
A severity rating that outlived the people who assigned it.
Infrastructure
The Comment Said the Unwrap Was Safe
A code comment asserting an invariant the code no longer held.
AI × Crypto
The Agent Opened the Folder. The Folder Opened a Shell
A repository that ran code just by being opened.
Policy
The Vote Is Set. The Text Isn't Finished
A cloture date on a bill nobody has finished drafting.
AI × Crypto
The Key Check Failed. The Session Opened Anyway
A key comparison that never ran, and a session that opened regardless.
Policy
Forty Years On, the SEC Reopens the Record of Who Owns What
The rulebook for share ownership predates the internet. That is now the point.
Security
The Code Was Public for a Month. The Reason Wasn’t
A month of public commits, and no explanation of what they fixed.
Security
The Only Fix Was to Ask Everyone to Leave
Immutable contracts meant the bug could not be patched at all.
Security
The Cause Is Still Unknown. The Label Went Up Anyway
A root cause was published before anyone had established one.
Policy
The Two Firms That Count Crypto Crime Are Suing Each Other
The industry's two main sources of crime statistics are now in court.
Security
In Ten Days, Silence Becomes a Reportable Event
The EU's 24-hour incident clock starts running on software makers this month.
Security
Efficiency Mode Did Exactly What It Was Built to Do
A lending setting behaved correctly and still cleared the way for the loss.
Infrastructure
Ontology Stopped the Chain on a Suspicion
The chain went down before anyone had confirmed there was anything to stop.
Security
The Contracts Held. The Prices Didn't
August's losses came from oracles and governance, not from broken contracts.
Security
$951 Bought the Votes. The Vaults Did the Rest
A governance stake bought for pocket change was enough to steer the vaults.
Security
To Keep the Rest, Cronos Turned the Blockchain Off
Halting the chain was the cheapest way to stop an exploit already in progress.
Infrastructure
The Signature Was Valid. The Key Behind It Wasn't
An oracle update carried a correct signature from a key that should never have been trusted.
Security
The Chain Was Fine. The Foundation Wasn't
The validators never missed a beat; the organisation around them did.
Security
The Chains Learned From the Attacker First
A quiet backport reached operators before the advisory did, and the reasoning was defensible.
Policy
California Wrote a Meme Coin Ban It Can Only Half Enforce
The prohibition is clear. The mechanism for reaching anonymous issuers is not.
Policy
The Ninth Circuit Read Kalshi's Marketing Back to It
A prediction market's own promotional copy became the evidence against its federal preemption claim.
Infrastructure
Solana's First Real Vote Came Down to Two Firms Changing Their Minds
A stake-weighted vote turned on a handful of large validators reversing position late.
Security
Nothing Was Hacked. Moonwell Still Lost $8.7 Million
A collateral token's price was moved in a shallow pool, and the lending market believed it.
Security
Two Machines Found the Same Bug. Then the Humans Started Arguing
Duplicate machine-found disclosures arrived hours apart, and the payout rules had no answer.
Security
The Machines Found Real Bugs: Core Lightning's Embargoed Emergency
An embargoed fix, two independent machine-found bugs, and a disclosure window that held.
Policy
The Bank of England Gets a Second Job: Making Stablecoins Work
A central bank asked to make a private payment instrument work, not just to keep it from breaking things.
Security
The Vault Got Robbed: Inside the $116M Coldcard Exploit
A five-year-old firmware flaw, a weak entropy fallback, and the third-largest crypto theft of the year.
AI × Crypto
The $500,000 Isn't in the Paper
A study of 428 AI API routers found nine quietly rewriting what agents do — and one draining a wallet.
Security
Your Patch Deadline Was Set by a Machine
CISA gave agencies until Sunday to patch a Linux kernel flaw — because roughly 700 agents found the public exploit and escaped their test lab.
Security · Contributed
The Safest Place in Crypto Just Got Robbed
What the cold-storage failure actually teaches — and the habits that survive it.
Security
SafePal Breach Doxxes 39,798 Hardware-Wallet Buyers
No coins touched; none needed. A verified list of cold-storage owners with home addresses is a phishing campaign waiting to happen.
AI × Crypto
"Pennies" Compared to What's Coming: Industry Leaders Warn on AI-Agent Attacks
TRM logs a 40% YoY rise in AI adoption across crypto crime. What needed a skilled attacker now runs as software against everyone at once.
Infrastructure
LayerZero Delegate Hijack Mints Unbacked SAND on Base
Compromised delegate permissions, hundreds of automated transactions — a bridge-trust failure, not a token bug.
Custody
MetaMask's Agent Wallet: Guardrails for Letting an AI Touch Your Money
Spending limits, allowed networks, allowed protocols. The design question of the decade: how much of a wallet does an agent get?
Markets Infra
Binance's Agent OS Bridges ChatGPT, Claude, and Cursor to Exchange Rails
The agent-to-exchange pipe is now a product. The security perimeter of "your account" just got a lot more interesting.
The Ledger
H1 2026 by the Numbers: 207 Hacks, $972M, and a Rising Machine Tempo
The worst half-year in TRM's dataset — before AI-scaled attacks fully arrive.
Latest
Security · Contributed · Oct 12
The Warning Was the Attack
AI × Crypto · Oct 11
256 Drops and One Payment Could Have Minted 18 Trillion XRP
Security · Oct 11
111 Ledger Wallets Emptied in One Bitcoin Block, and the Reseller Had Changed Hands in March
Security · Oct 11
Eleven Seed Phrases on an Open Directory
AI × Crypto · Oct 9
'Bunker Mode': Drake Says AI Math Could Break ECDSA Within Months; Coinbase's Cryptographer Calls It FUD
Infrastructure · Oct 9
Lloyds Settled $750,000 With Visa From Jersey, Over a Weekend, Onto a Public Chain Nobody Named
Security · Contributed · Oct 5
The Fix Was Already Out
Security · Oct 4
Ten Minutes of AI Tracing, and a North Korea Verdict With the Working Left Out
Infrastructure · Oct 4
Lose $100 on Drift, Redeem Today, Get $1.04
Policy · Oct 3
FinCEN Wants Banks to Block a List of Companies It Won't Publish
Infrastructure · Oct 2
Blast Put 16,148 stETH Into Lido's Exit Queue Within Hours of Its Shutdown Post
Policy · Oct 2
Two Days Before It Shrank to Two Commissioners, the SEC Made One a Quorum
Security · Contributed · Oct 2
The Module Was the Signer
Security · Oct 2
MetaMask Is Pulling Its Lido Validators Over 0.36 ETH in Misrouted Tips
Security · Oct 2
'We Have Identified You, Sir': NEAR Intents' $3.8 Million Came Back Within a Day of the Ultimatum
Security · Sep 30
A Hidden Script Inside Bitget Was Reading a Database Password on August 31
Infrastructure · Sep 30
Chainlink's 'Extra Fuzz Testing' Commit Guards Against One Number Stalling Every Node
Security · Sep 30
On Zano, Block 3,833,001 Arrived 31 Days After Block 3,833,000
Infrastructure · Sep 30
NEAR Intents Holds $503,000 of the $50 Million It Turned Away
Security · Sep 29
Bitget Says the Thief Came In Through a Security Product It Won't Name
Infrastructure · Sep 28
THORChain Says It Never Blacklisted the Thief Who Took Its Own $10.7 Million
Policy · Sep 28
Tokenized Stocks and Treasuries Are Defined Out of the SEC's October 20 Crypto Rule
Security · Contributed · Sep 28
The Approval Was Real
Security · Sep 27
23,155 NFTs Rescued From a Contract Nobody Could Pause
Policy · Sep 27
'No Problem': Kelp Takes LayerZero's 2024 Answer to a Vancouver Court
Security · Sep 26
31 Hours After the Mint, Meter Pushed a Branch Named 'Unconditional Consensus Validation'
AI × Crypto · Sep 25
Someone's AI Agent Tried to Sell 10 USDT on Quidax
Security · Sep 25
Bitget's Own Approval System Signed Off on $387.5 Million
Security · Contributed · Sep 24
The Interview Was the Install
Security · Sep 23
Cosmos Hub Validators Moved 1.2 Million ATOM Without a Governance Vote
Security · Sep 23
Restart a Halted Chain and Six Hourly Quotas Can Leave in 36 Seconds
Infrastructure · Sep 23
Cosmos Wrote a Warning Where a Check Should Have Gone
AI × Crypto · Sep 22
EvilTokens Sold a Chatbot That Picked Who to Impersonate
Security · Sep 22
Pragma Says a Third Price Source Would Have Stopped the Nostra Drain
Security · Sep 21
Four Governments Trace 30,000 Infected Developer PCs to Fake Job Interviews
Security · Contributed · Sep 21
A Patch Can't Take Back a Key
Security · Sep 21
Most of the 11.7 Million XRP in the D'CENT Drain Left After the Warning
Security · Sep 20
225,000 Empty Rounds Since MultiversX Last Produced a Block
Policy · Sep 20
Tokenize a Treasury at DTCC and It Stops Counting as Collateral
AI × Crypto · Sep 20
408.5 Million NTX Came Out of NuNet's Own Minting Key
Policy · Sep 20
S&P Global Is Buying the Auditor Behind $37 Trillion in Transfers
Security · Sep 17
A Second gossipsub Package Has the Same Unguarded Check and No Advisory
Security · Contributed · Sep 17
The Name Became the Command
Security · Contributed · Sep 7
Every Signature Was Legitimate
Security · Contributed · Sep 14
The Request Came from the Right Address
Security · Contributed · Sep 10
Reading Leaves No Trace
Security · Contributed · Sep 1
Nobody Sent the Warning
Security
Since 2022, a Bitcoin Core Wallet Name Could Carry a Shell Command
Sep 17
Policy
Two Robinhood Engineers' Hyperliquid Wallets Led Back to Exchange Accounts in Their Names
Sep 16
Security
2,882 rsETH Went Back to the Safe's Owner 30 Hours After an MEV Bot Took It
Sep 16
Policy
Tillis Voted No to Keep a Second CLARITY Vote Possible
Sep 15
Policy
Fifteen Months From Tether's Freeze to a Forfeiture Filing
Sep 15
Infrastructure
Who Watches Balancer's Pools After October 30?
Sep 15
Security
25 Fixes Core Lightning Kept Sealed for Two Weeks
Sep 14
Security
Revolut Gave Passports and Bitcoin Histories to a Fake Official
Sep 14
Security
$736,442 Left Chainflip Through Refunds for Swaps That Already Paid
Sep 13
Security
Ether.fi's Old Queue Could Only Rob Smart Wallets
Sep 13
Security
Hemi's Empty Claim Contract Still Says It Holds 124.5 Million Tokens
Sep 12
Policy
Three Clauses Now Decide What Counts as Decentralized
Sep 12
Infrastructure
Mysten Rewrote a Sui Verifier for a Feature No Chain Has Turned On
Sep 12
Security
46 Billion Synthetic Bitcoin Converted Into 4.39 Real Ones
Sep 12
AI × Crypto
DeepSeek Filed Its 9.4 Sandbox Escape Fix Under Chores
Sep 11
Policy
Visa and Mastercard Will Accept an Agent That Ant Already Cleared
Sep 11
Security
Wormhole Is Closing a Way Out of Its Own Four-Day Quarantine
Sep 10
AI × Crypto
It Tried to Abort Eight Times, Then Broke Into a Real Machine
Sep 10
Security
Two Wallet Makers, One Newsletter Vendor, and the Same Fake Alert
Sep 10
Infrastructure
Osmosis Will Ask Its Voters to Seize an Attacker's 22.65 Bitcoin
Sep 9
Security
If Your Alby Hub Predates August 2025, Take It Off the Internet
Sep 9
Security
One Signature, Counted Twice, Emptied 2,321 Card Balances
Sep 9
Policy
Block Wants a Bank That Takes No Deposits and Makes No Loans
Sep 9
Security
The 598 Bitcoin Nobody Will Call a Bounty
Sep 8
Infrastructure
Bridge Hacks Went From 3 to 26. The Same File Also Says 11 to 39
Sep 8
Security
Set the Clock to 1970 and the Wallet Looks for Its Coins in 2149
Sep 8
Security
Malware Moved Its Address Book Onto Polygon, Where Takedowns Don't Reach
Sep 8
AI × Crypto
Who Re-Reads a Tool Description After You Approve It?
Sep 7
Policy
Twenty-One Banks Have a Stablecoin Plan, a Launch Window, and No Name
Sep 7
Security
Five Days Before Liquid's $320 Million Peg-Out, the Fix Was Already in Git
Sep 7
Policy
Nobody Said 'Blockchain' in the G7's Quantum Warning
Sep 6
Security
A $1,000 Bounty Bought a Bug Attackers Were Already Using
Sep 6
Security
After Weeks of Stillness, 20.5 Bitcoin Tested the Exit
Sep 6
Policy
OpenReserve Needs $210 Million by September 2027 to Open Its Approved Bank
Sep 6
Security
The Wallets Emptied. The Company Has Said Nothing
Sep 5
Security
Pocket Never Held a Coin. It Held the Map
Sep 5
Security
The Auditors Found It in 2020. They Marked It Low
Sep 5
Infrastructure
The Comment Said the Unwrap Was Safe
Sep 5
Security
The Vendor Nobody Chose: How a Dashboard Bug Leaked Hardware-Wallet Buyers
Sep 5
AI × Crypto · Sep 3
The Agent Opened the Folder. The Folder Opened a Shell
Policy · Sep 3
The Vote Is Set. The Text Isn't Finished
AI × Crypto · Sep 2
The Key Check Failed. The Session Opened Anyway
Policy · Sep 2
Forty Years On, the SEC Reopens the Record of Who Owns What
Security · Sep 2
The Code Was Public for a Month. The Reason Wasn’t
Security · Sep 1
The Only Fix Was to Ask Everyone to Leave
Security · Sep 1
The Cause Is Still Unknown. The Label Went Up Anyway
Policy · Sep 1
The Two Firms That Count Crypto Crime Are Suing Each Other
Security · Sep 1
In Ten Days, Silence Becomes a Reportable Event
Security · Aug 31
Efficiency Mode Did Exactly What It Was Built to Do
Infrastructure · Aug 31
Ontology Stopped the Chain on a Suspicion
Security · Aug 31
The Contracts Held. The Prices Didn't
Security · Aug 31
$951 Bought the Votes. The Vaults Did the Rest
Security · Aug 30
To Keep the Rest, Cronos Turned the Blockchain Off
Infrastructure · Aug 30
The Signature Was Valid. The Key Behind It Wasn't
Security · Aug 30
The Chain Was Fine. The Foundation Wasn't
Security · Aug 29
The Chains Learned From the Attacker First
Policy · Aug 29
California Wrote a Meme Coin Ban It Can Only Half Enforce
Policy · Aug 29
The Ninth Circuit Read Kalshi's Marketing Back to It
Infrastructure · Aug 29
Solana's First Real Vote Came Down to Two Firms Changing Their Minds
Security · Aug 28
Nothing Was Hacked. Moonwell Still Lost $8.7 Million
Security · Aug 28
Two Machines Found the Same Bug. Then the Humans Started Arguing
Security · Aug 28
Your Patch Deadline Was Set by a Machine
AI × Crypto · Aug 28
The $500,000 Isn't in the Paper
Security · Contributed · Aug 28
The Safest Place in Crypto Just Got Robbed
Security · Aug 28
The Machines Found Real Bugs: Inside Core Lightning's Embargoed Emergency
Policy · Aug 28
The Bank of England Gets a Second Job: Making Stablecoins Work
Security · Aug 27
The Vault Got Robbed: What the $116M Coldcard Exploit Says About Everyone's Cold Storage
Security · Aug 27
No Coins Were Touched. That's Not Good News.
AI × Crypto · Aug 27
“Pennies”: Why Security Leaders Think the Billion-Dollar Hacks Are the Warm-Up
Infrastructure · Aug 27
Minting Out of Thin Air: The LayerZero Delegate Hijack, Explained
AI × Crypto · Aug 27
Guardrails for the Robot Hand: MetaMask's Agent Wallet Goes Public
AI × Crypto · Aug 27
The Agent-to-Exchange Pipe Is Now a Product
Policy · Aug 27
The Half-Year Ledger: 207 Hacks, $972M, and a Rising Machine Tempo