Malicious pull requests targeted Vizor and Zingo wallet repos with instructions to make AI reviewers ignore secret uploads; none merged, a useful supply-chain security warning.
Summary written by AI. Read the source before acting on anything.
The top five, plus AI agents doing real things on-chain, at 6:30 a.m. Central. Free.
Initia halted its L1 after a $605,000 USDC outflow, which the team traces to compromised rollup infrastructure keys.
Binance halts MEXC withdrawals after FinCEN cut MEXC off from the US financial system over $16 billion in suspicious flows.
An iOS vulnerability lets malicious apps read other apps' local files, exposing seed phrases and private keys; users should audit sideloaded apps and move funds if exposed.
Bots flagged an 11-year-old Ethereum wallet from the 2015 launch within minutes of it moving and planted lookalike addresses, but the owner sent $4.6M to the correct address.
Anza's draft to remove Solana durable nonces would bar activation before May 5, 2027, putting custodians on a six-month clock after Drift's $295.7M exploit.
Elliptic traced North Korean hackers laundering about 117,000 NEAR (~$430,000) from the $6.3B Binance hack through six homemade memecoins.
LNbits is urging all server operators to shut down after attacks, with patches expected in 24 to 48 hours; a security-critical event for Lightning operators.
A clear layman explainer of how weak randomness in the Coldcard seed generation enabled a roughly $130m Bitcoin theft, with lessons for self-custody.
Binance warns of an unpatched iOS sandbox escape that could expose wallet seed phrases to other apps, a security alert wallet users should see.
Glamsterdam stalls with no testnet date while auditors check whether gas changes could break live Ethereum contracts.