Security
Every Security read CryptoBloggers has picked: 828 so far, 722 in the last 30 days, strongest first under “Start here” and newest first below.
Security picks in the 6:30 email
The day’s five best crypto reads, plus AI agents doing real things on-chain. Free, every morning at 6:30 a.m. Central.
Every Security card
newest first · page 18 of 28- 1
S&P Global Closes OpenZeppelin Acquisition
S&P Global closed its OpenZeppelin acquisition, with OpenZeppelin staying a separate unit under Demian Brener.
- 2
Malicious Electrum Servers Steal Bitcoin by Baiting Users Into Fee Bumps
Malicious Electrum servers baited users into fee-bump actions that stole bitcoin; users on versions before 4.8.3 should upgrade.
- 3
Keystone Says Intruder Took Customer Names and Addresses From Its Website
Keystone says an intruder exposed customer names and addresses from its website, with no payment data or recovery phrases taken; its shipping-data retention policies conflict.
- 4
Blast Reaches Withdrawal Interface Deadline With $40 Million Still in Bridge
Blast passed its withdrawal interface deadline with about $40M still in the bridge; exit guides explain the proof, wait and DAI steps.
- 5
Consensys Warns Ethereum Operators of eMudhra Signing Risks
Consensys warns Ethereum node operators about eMudhra signing exposure; Web3Signer deployments may need immediate access-control changes.
- 6
Passport Wallet Maker Foundation Traces Phishing Emails to Backend Breach, Promises Report
Foundation traces phishing emails to a backend breach, with a report promised; its explanations have shifted so far.
- 7
TIL: receipt.status != "complete" is always true in web3.py, and it shipped in a major agent toolkit
A widely used agent wallet toolkit had a web3.py status check that always failed, so successful Permit2 approvals were reported as failures and agents could re-approve.
- 8
What I learned testing agents that pay for things (all bugs below are fixed or public)
A test harness builder reports recurring payment bugs in agent payment flows, like lost replies causing double payments, across about 30 projects on test tokens.
- 9
India's largest crypto exchange absorbs $16 million loss from internal process failure tied to retired wallet
An Indian exchange absorbed a $16 million loss from an internal process failure tied to a retired wallet after first dismissing outflow alerts.
- 10
Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments
A Bitcoin wallet flaw let rogue servers swap in fake transactions and raise fees, and at least one user lost bitcoin before a patch.
- 11
Foundation Links Passport Phishing Emails to Compromised Cloudflare API Keys
Foundation traced Passport phishing emails to compromised Cloudflare API keys, with the company saying hardware wallets and funds were not affected.
- 12
I think Foundation servers got hacked, don’t click the links in their email from today
Users report Foundation wallet customers receiving phishing emails after a possible breach; treat links in such emails with caution.
- 13
Keystone says website breach exposed hardware wallet buyers’ addresses
Keystone's website breach exposed hardware wallet buyers' shipping details, raising risks of targeted scams and physical attacks.
- 14
CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a ‘false alarm’
CoinDCX confirmed a $16 million loss from retired wallets, days after its CEO dismissed breach reports as a false alarm.
- 15
How to Check a Software Wallet—and What the Checks Cannot Prove
A practical guide to verifying software wallets, covering fake Firefox extensions stealing recovery phrases and an Electrum signing flaw.
- 16
Keystone customers say breach exposed data the hardware wallet maker promised to delete
Keystone customers say a breach exposed data the hardware wallet maker said it deletes after 180 days, casting doubt on its privacy claims.
- 17
Draft ERC: Agent Safety Framework (ASF) — a registry of versioned safety specifications and of the scoped, attributable adoption relations that bind agents to them
Draft ERC proposing a registry of safety specifications and attributable relations binding AI agents that hold credentials or move funds.
- 18
Warning: phishing email campaign from people pretending to be Trust wallet.
Warning about a phishing campaign impersonating Trust Wallet with a fake malicious update link; useful security alert for wallet users.
- 19
Your AI agent remembers everything. Can it prove any of it?
Engram is a hackathon project giving agent memory a git-style history, signed snapshots on Walrus and Sui, and provable forgetting. It is a build with a demo, not a reported real-world task.
- 20
Critical Security Exploit in Electrum. Upgrade to version 4.8.3 before signing any transactions
A security advisory: Electrum has a critical exploit, and users should upgrade to 4.8.3 before signing any transactions.
- 21
X100 Exploit Proceeds Split Into Four 400-ETH Wallets
Proceeds from the X100 exploit were split into four 400-ETH wallets, with the first exploiter swapping about 4.75M USDT into ether.
- 22
I gave an agent its own wallet and let it trade with real money. Here’s what it took before I’d trust it.
A builder describes the guardrails for an agent with its own funded wallet trading on a sports prediction market: policy caps in code, trade previews, and minimum fills. It is design advice from a product builder, with no trading results yet.
- 23
Keystone Website Breach Exposes Customer Addresses and Order Details
Keystone says a website breach exposed customer addresses and order details, but not payment data, recovery phrases or private keys, and the flaw is fixed.
- 24
Electrum Patches Wallet Flaw Exploited Through Malicious Servers
Electrum users can be tricked by malicious servers that substitute fake payments and raise fees before signing, and one user reportedly lost money.
- 25
Third X100 Exploit Transaction Pulls 550,000 X From Uniswap Pool
A third X100 exploit transaction drained about 550,000 X from a Uniswap pool that held under 200 USDT.
- 26
X100 Exploit Nets 4.85 Million USDT After Governance Takeover
An X100 governance takeover let an attacker convert treasury assets to 4.85M USDT on Ethereum.
- 27
Shaw Publishes Daos.fun Reconstruction, Claims Critical Flaw
Shaw published a rebuild of Daos.fun's binaries and claims a critical flaw; existing tokens remain tradable.
- 28
API Key Rotation: What Revocation and Redeployment Actually Change
Explains why key overlap during rotation becomes a security decision when exposure is suspected.
- 29
Initia Has No Restart Date After Attacker Mints Tokens and Bridges Out $2.7 Million
An attacker minted tokens on Initia and bridged out $2.7M, with a suspected MoveVM flaw and the chain halted with no restart date.
- 30
Austin Griffith Demonstrates How Fast Bots Can Drain Weak Ethereum Keys
Austin Griffith's demo put about $1 behind a weak Ethereum key, and bots swept it within seconds, a vivid security lesson.