The seed-randomness flaw had lurked in firmware since March 2021 and went unnoticed for years, exposing the practical ceiling of single-device self-custody for serious BTC holders.
Galaxy mapped the July 30 sweep to 1,196 wallets and 1,082 BTC drained in 41 minutes via a seed-generation bug that collapsed the keyspace to a few billion options.
Nearly 1,200 addresses and 1,000 BTC later, the incident has crossed from isolated phishing to a coordinated drain, putting self-custody users on notice about supply-chain risk in hardware wallets.
Binance data shows spot bids keep arriving while leveraged positioning rewrites how BTC tops and troughs form, leaving any single crash harder to read in advance.
Nearly 600 BTC were stolen from a flaw in Coldcard's firmware that let attackers reconstruct wallet seeds, reopening the case that institutional products like BlackRock's IBIT now make more sense for…
The protocol fix is live and verifiable, but ZEC still trades below the $500 area Ironwood was supposed to put back on the map, leaving the supply repair in technical hands and the price repair in…
DPRK alone siphoned nearly $600M. The headline number is bad, but the forward-looking warning on AI-driven exploits is the piece security teams and on-chain risk teams should be reading.
A formally verified pool that reuses a patched circuit is the bridge, not the destination: Zcash's ecosystem is rebuilding trust after the Orchard disclosure wiped out more than half of ZEC's price.
A 27% wick on a HIP-3-listed Korean stock perp exposed the liquidity fragility of permissionless listing: any staker can launch a market, but depth on entry is anything but guaranteed.
The 5,280 ETH is already in motion, but the lasting damage from a wallet exploit is rarely the theft itself, with secondary fallout that can stretch for months after the coins leave.
The newly disclosed bugs hit the payment primitive powering AI-agent micropayments, with attackers able to drain wallets or shop for free on most live integrations.
A seven-year-old flaw in XRP Ledger's signature library would have let an attacker derive a private key from as few as five signed transactions, putting wallets at risk before maintainers patched it.
Active RWA use in DeFi has bounced back to roughly $3.77B, close to pre-April levels, but the recovery masks thin depth: private credit and a handful of CLO products still dominate.
A second attacker drained the bridge using the identical contract and entry path as the May exploit, meaning the patch either shipped late or did not actually close the vulnerability class.
The pattern is the story: four protocols fell in 24 hours to the same failure mode, compromised keys and permissions, not broken cryptography, and AI tooling is now lowering the cost of finding those…
The attacker bridged the stolen stablecoin to Ethereum and swapped into 12,467 ETH before the team could respond, a textbook cross-chain drain pattern.
The flaw lets private keys be recovered from any affected onchain signature; EVM transactions and SDKs are unaffected, narrowing the blast radius.
A nonce-reuse bug in the Zilliqa Ledger app let attackers reconstruct private keys from roughly five native signatures, and Upbit's cautionary-asset designation now puts ZIL trading support itself in…
The breach, which drained 16.1M ADA from 374 wallets, was a flaw in transaction signing software, not in the Cardano protocol itself, but it killed the wallet service outright.
The attacker netted under $1M, but the mechanism (an unguarded oracle write with no liquidation delay) is the real warning for every BTC-collateralized lending book.
CoinDesk
TheBlock
CryptoSlate
WuBlockchain