Security
Every Security read CryptoBloggers has picked: 828 so far, 722 in the last 30 days, strongest first under “Start here” and newest first below.
Security picks in the 6:30 email
The day’s five best crypto reads, plus AI agents doing real things on-chain. Free, every morning at 6:30 a.m. Central.
Every Security card
newest first · page 21 of 28- 1
Trump Touts Crypto Scam Crackdown as DOJ Reports $938 Million Restrained
DOJ reports $938 million restrained in a nationwide crypto scam prosecution push, touted by Trump and AG Blanche.
- 2
Trump didn‘t mention ‘crypto’ once in White House cybercrime roundtable
Trump's White House cybercrime roundtable referenced scams but never mentioned crypto by name, only cybercurrency.
- 3
13 JPMD Lookalikes Emerge Amid JPMorgan’s Ethereum Launch
Thirteen lookalike JPMD tokens appeared; JPMorgan's genuine Ethereum token shows zero supply and holders, so check addresses.
- 4
Self-hosting the mempool explorer? Its backend image still bundles Node 24.13.0, from before the Oct 20 Node security release
Practical warning that the published mempool backend images still bundle a Node.js version predating the October security release, so self-hosters should check.
- 5
Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course
OpenAI says its models found the PHP2Shell bug and led a coalition to fix it; it is a duplicate of the PHP story, so keep only the stronger version.
- 6
Can You Slop Out High-Assurance Cryptography?
A short essay questioning whether AI-generated code can produce high-assurance cryptography; the snippet shows little beyond a Hacker News thread with 7 points.
- 7
Remotely exploitable PHP bug found on 70% of world’s websites
AI found two remotely exploitable PHP bugs that PHP is now patching, affecting a large share of websites.
- 8
Privacy Pools v2 Goes Live With Bigger Feature Suite
Privacy Pools v2 launched with payments, yield and swaps built around compliance.
- 9
Eclair Patches Lightning Bugs That Could Let Peers Steal Funds
Eclair released a second Lightning security patch in five days fixing bugs that could let peers steal funds.
- 10
Rent a car, launder crypto: Italian police bust $76M mafia scheme
Italian police busted a $76M crypto laundering scheme run through a Milan car rental firm tied to mafia groups.
- 11
PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out
Two critical PHP bugs let attackers take over web servers without passwords; patches exist and attacks began early.
- 12
President Trump to Highlight Crackdown on Overseas Crypto Scams
Trump will highlight seizures of overseas crypto scam sites at a White House cybercrime event, as FBI data shows $11.3 billion in US crypto fraud losses in 2025.
- 13
Polkadot Warns Fearless Wallet Users to Move Funds After Private-Key Leak
Polkadot urges Fearless Wallet users to move funds and create fresh keys after a private-key leak affected a Chrome extension version with 6,000 users.
- 14
Big Tech’s eMudhra fixes may leave crypto bots exposed, CertiK warns
CertiK warns that browser fixes for the eMudhra certificate flaw may not protect crypto trading bots and exchange applications that remain exposed.
- 15
Drift exploiter sends $109M in Ether to Tornado Cash in 2 days
Wallets tied to the $295M Drift hack moved $109M in Ether to Tornado Cash in two days, with $138M still held.
- 16
Bitcoin’s 21 Million Limit Doesn’t Enforce Itself. A Bitcoin model matched Core across 100,000 test executions. The gap that remains reveals what it really takes to protect Bitcoin’s most important promise.
A Bitcoin model matched Bitcoin Core across 100,000 test executions and examines what still must be done to enforce the 21 million cap through independent node validation.
- 17
SlowMist Urges Crypto Platforms to Prepare for Critical PHP Fixes
SlowMist urges crypto platforms to prepare for critical PHP patches due October 21, since affected versions and details come with the release. A practical heads-up for exchange and platform security teams.
- 18
Tech giants rush to block 8 eMudhra certs that could enable fake sites
A key generation flaw in eMudhra certificates let anyone guess private keys and forge HTTPS certificates, prompting browser and tech giants to block them. Important security news for anyone relying on web trust.
- 19
Token Approvals in DeFi: The Risk That Often Goes Unnoticed
Explainer on how unlimited or long-lived token approvals create hidden wallet risk and why users should review them.
- 20
A company that vouches for websites had secret keys so weak that 8 of them were cracked
Eight secret keys at eMudhra, an Indian certificate authority, were cracked because they were weak, forcing browser and software makers to rush fixes.
- 21
Qubic restarts blockchain, opens recovery claims after $1.4M hack
Qubic validators approved a recovery plan after a $1.4M hack, restarting the chain and opening claims until May 1, 2027. Useful for affected holders, though the snippet gives few details.
- 22
Liquid Network Announces Final Stages of Recovery Following Massive Hack
Liquid Network has resumed operations a month after hackers took 4,000 BTC; the snippet gives few details beyond the recovery status.
- 23
Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash
A wallet tied to the North Korea-linked Drift exploit moved $61M in ETH to Tornado Cash and still controls about $198M.
- 24
Erick Cestari, Adam Gibson - Bitcoin Optech Newsletter #427 Recap Podcast
Podcast recap of Bitcoin Optech newsletter covering disclosed Eclair DoS vulnerabilities and offchain contracts in Lightning channels.
- 25
Check who your x402 agent is paying, before it signs
A pay guard for x402 agents checks payTo addresses against OFAC and seller track records; the post demonstrates it blocking a Lazarus wallet payTo.
- 26
The Coinbase allegations expose Bitcoin's corporate governance gap
Argues bitcoin corporate adoption will stall until companies can prove who controls, approves and holds their bitcoin.
- 27
Project Eleven Teams With Crypto Insurer Relm to Study Quantum Risk in Underwriting
Project Eleven and insurer Relm announced an exploratory deal to study quantum risk in underwriting for the Strongpoint custody product. Neither company has changed pricing yet.
- 28
ZachXBT Flags $20M XMR Laundering Ring on Hyperliquid
ZachXBT traces over $20M from hacks and ransomware through FreedomXMR, a Monero swap service on Hyperliquid where 87% of inflows are illicit.
- 29
ERC-TBA: Agent Default Registry
Draft registry where lenders record agent loan defaults so they are visible across lenders.
- 30
Issuer Blacklists Recovered Nothing in 60 Crypto Exploits, Blockaid Finds
Blockaid data shows issuer blacklists recovered only $9.8M of $1.18B traced across 60 exploits, with recoveries coming only via governance or validators.