Security
Every Security read CryptoBloggers has picked: 829 so far, 721 in the last 30 days, strongest first under “Start here” and newest first below.
Security picks in the 6:30 email
The day’s five best crypto reads, plus AI agents doing real things on-chain. Free, every morning at 6:30 a.m. Central.
Every Security card
newest first · page 22 of 28- 1
Issuer Blacklists Recovered Nothing in 60 Crypto Exploits, Blockaid Finds
Blockaid data shows issuer blacklists recovered only $9.8M of $1.18B traced across 60 exploits, with recoveries coming only via governance or validators.
- 2
Liquid Says Bitcoin Swaps Are Restored While Peg-Outs Stay Frozen
Liquid restored Bitcoin swaps but peg-outs stay frozen; reserves cover about 85.8% of L-BTC, a roughly 603 BTC shortfall.
- 3
If your agent's limits live in the system prompt, last week's incidents say that's the wrong place
Recent incidents show AI agents reaching live systems and wallets via exposed credentials, so limits belong in enforced controls rather than system prompts.
- 4
Drift exploiter sends $61M ETH to Tornado Cash, holds $194M
The Drift exploiter sent $61M in ETH to Tornado Cash and holds $194M; Mandiant attributes the April 1 hack, about $295M in losses, to a North Korean group.
- 5
Bitget plans Thai crypto exchange acquisition weeks after $388M hack
Bitget is proposing to buy a locally licensed Thai exchange, weeks after a $388M hack, giving it a route into Thailand.
- 6
Drift-Linked Wallet Sends $54.8 Million in ETH to Tornado Cash
Wallets linked to the April Drift exploit sent $54.8M in ETH to Tornado Cash, while about 84,164 ETH remains in exploiter wallets.
- 7
SlowMist Says Qubic Wallet Keys Could Be Recovered From Six Network Samples
SlowMist says Qubic wallet keys could be recovered from six network samples; a patch separates new seeds but leaves header generation unchanged.
- 8
Lido Engineer Warns of Staking Deposit Hijack at Glamsterdam
A Lido engineer warns of a staking deposit hijack risk at Glamsterdam; the related consensus issue was closed as not planned.
- 9
Papertrade Keeps PAPER Non-Transferable, Citing Perp Attack Risks
Papertrade keeps its PAPER token non-transferable, citing perp attack risks, while holders who earned it through losses can stake for USDC. A useful design-tradeoff story.
- 10
Mastercard launches stablecoin risk screening for banks and payment providers
Mastercard's new service screens stablecoin transactions for banks using payment data and blockchain analytics before settlement.
- 11
Anyone else think seed phrases are kind of a ridiculous system?
Discussion of seed phrase usability and seedless wallet tradeoffs; a fair but common take.
- 12
Bitcoin payroll batching: what can employees see?
Explains that batched Bitcoin payroll transactions reveal amounts but not who is paid, a clear privacy insight.
- 13
Can you control your wallet if you sign in with just an email?
Question on whether email-login wallets are as secure as seed phrase wallets; a useful security framing.
- 14
Mastercard unveils Stablecoin Security tool to screen payments for fraud and sanctions risks
Mastercard launches a stablecoin risk screening tool for fraud and sanctions, rolling out in North America first.
- 15
Charles Hoskinson Reveals Work on a Cardano Programming Language Using Groth16 Proofs
Hoskinson is building a new Cardano smart contract language with Lucas Rosa using Groth16 proofs, but no name, code or timeline has been shared yet.
- 16
THORChain Keeps ZEC Swaps Halted After Bug Triggers Vault Slash
A THORChain bug slashed about 140 RUNE from 18 node accounts, and ZEC swaps stay halted until the v3.21 fix.
- 17
THORChain Targets Rujira Restart With v3.21 Exploit Fix
THORChain plans a v3.21 upgrade around Oct. 23 to fix an exploit and restart Rujira, with a proposed 24-hour liquidation grace period for borrowers.
- 18
Hackers Still Hold $287 Million in Stolen Crypto That Can’t Be Frozen, Blockaid Report Says
Blockaid data: $287M of $1.18B stolen this year is still held by hackers, who start moving funds a median 17 minutes after exploits.
- 19
EXCLUSIVE: How one hacker used AI agents and a few thousand dollars to break into scores of sites
Reuters exclusive on a hacker using AI agents and a few thousand dollars to break into many websites; a security incident rather than a crypto use case.
- 20
‘Terrifying Precedent’: Dutch Hand US Data From Seized Anti-Fascist Server
Dutch police seized an anti-fascist server under a 1981 treaty and handed US data over, a notable cross-border data precedent.
- 21
Sam Altman's World Takes Proof-of-Human IDs to Banks, Citing $40B AI Fraud Risk
World is selling proof-of-human IDs to banks, with design partners including Bain Capital, VanEck and Pantera, and delegation to AI agents.
- 22
Zcash Developer Zakura Proposes Fix to Stop Quantum Computers Linking Shielded Swaps
Zcash developer Zakura proposes a fix so a future quantum attacker cannot link all payments a shielded wallet has received.
- 23
Two agent incidents this week, same root cause: proposal and execution were one step
Essay arguing agent failures stem from letting model proposals execute without a deterministic authorization layer; useful design framing, though it reports incidents secondhand.
- 24
Zcash developers plan a fix to keep ZEC swaps private from future quantum computers
Zakura developers plan to give each NEAR Intents swap its own key so refund addresses on NEAR's public chain can't link to a user's wider payment history. It is a privacy design for a quantum-era threat.
- 25
XRP Ledger is set to fix its lending code before anyone can use it
XRP Ledger validators have a patch to fix a lending code bug going live Friday, but the lending system it repairs is still 10 votes short of approval.
- 26
Qubic freezes chain after attacker drains 1.4K wallets with weak seeds
Qubic halted its chain after an attacker drained 1,400 wallets with weak seeds; validators will vote on a recovery plan.
- 27
Bitcoin's Quantum Transition Won't Stop at Bitcoin
Argues that Bitcoin's move to post-quantum cryptography will extend beyond Bitcoin to other chains. Snippet is empty, so depth is unclear.
- 28
Cysic suspends bridge after attacker mints tokens and moves $727,000 to Ethereum
Cysic suspended its bridge after an attacker minted 10 million CYS and bridged about $727,000 to Ethereum via Mayan, deBridge and SWFT's Bridgers.
- 29
Qubic Halts Network After $1.3 Million Wallet Drain
Qubic halted its network after a $1.3 million wallet drain; 87.1% of the drained QU remains immobilized on-chain, and MEXC froze the account receiving the rest.
- 30
Crypto audits give investors false sense of security as Q3 hacks cost $1.18 billion, Hacken says
Hacken's Q3 review attributes 77% of the $1.18 billion in hack losses to compromised suppliers, delayed fixes, or systems outside recent audits, undermining reliance on audits alone.