Security
Every Security read CryptoBloggers has picked: 829 so far, 721 in the last 30 days, strongest first under “Start here” and newest first below.
Security picks in the 6:30 email
The day’s five best crypto reads, plus AI agents doing real things on-chain. Free, every morning at 6:30 a.m. Central.
Every Security card
newest first · page 28 of 28- 1
I stopped trusting hardware wallets, so I decided to build my own.
A builder open-sources a passive NFC tag that stores keys in a secure element as a DIY cold wallet, as an alternative to hardware wallets.
- 2
Liquid Bitcoin Redemptions Remain Frozen With 85.8% Reserve Coverage
Liquid's bitcoin redemptions remain frozen at 85.8% reserve coverage, a 603 BTC gap, until full backing and security reviews are complete.
- 3
PeckShield Traces $3.89 Million in Ledger Theft Funds to Binance Deposits
PeckShield traced $3.89M in Ledger theft funds to Binance deposits on Tron, though intermediary wallets complicate attribution.
- 4
XRP Ledger Discloses Decade-Old Bug That Could Mint Trillions
A decade-old XRP Ledger overflow bug could have minted trillions of XRP; it was fixed in xrpld 3.4.1 and no exploitation was found.
- 5
How Zcash Plans to Hide Your Keys From AI and Quantum Attacks
Zakura, a Zcash node developer, expects hash-based signatures to ship in January and is releasing a tool to rotate transparent addresses. The goal is protection against AI and quantum attacks on keys.
- 6
Coldcard says it’s investigating how phishing link appeared on its X account
Coldcard's X account posted a phishing link; the company warns users not to click and promises updates.
- 7
AI discovers XRP Ledger flaw that could mint 18 trillion tokens and put $94 billion market at risk
An AI tool found a serious XRP Ledger flaw that could have minted 18 trillion tokens, putting a $94B market at risk; a notable security story on AI-driven auditing.
- 8
COLDCARD Warns of Phishing Post on Its Official X Account
COLDCARD warns of a phishing post on its X account; the fake migration site was built to harvest wallet recovery phrases.
- 9
Ledger confirms unauthorized hardware implant, says losses may exceed $86M
Ledger confirmed an unauthorized hardware implant in devices via one reseller, with losses possibly above $86M.
- 10
Why Constant-Time Crypto?
Technical essay on why cryptographic code must run in constant time to resist side-channel attacks; solid reference for developers.
- 11
Papertrade Faces Oracle-Manipulation Allegation as House Pool Shows $3.14 Million
An oracle-manipulation allegation against Papertrade cites a wallet with $1.73M in realized gains, with unpaid winnings queued if the pool runs short.
- 12
Ledger Says Affected User’s Device Contained Hardware Implant
Ledger says an affected user's device had a hardware implant, and CryptoBilis has halted all hardware wallet sales pending investigation.
- 13
Justin Sun says Tron’s post-quantum cryptography has gone live on testnet
Justin Sun says Tron's post-quantum cryptography is live on testnet and ready for mainnet, a notable security roadmap claim with limited detail.
- 14
Wallet Linked to CryptoBilis Thefts Routes 464 ETH to Tornado Cash
Onchain tracing links a wallet tied to the CryptoBilis thefts to 464 ETH sent through Tornado Cash, with the source address still holding about 700 ETH.
- 15
XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing
Researchers showed an XRP Ledger bug allowing spendable XRP without funding, and an emergency patch was released.
- 16
$3.55 Million in Unclaimed Bridge Funds Moved via EIP-7702
BlockSec reports $3.55M in unclaimed bridge funds moved via EIP-7702 authorizations, with unclear owner consent.
- 17
Ledger Theft Funds Shift Into USDD, Beyond Tether’s Freeze Controls
Funds from a Ledger theft moved into USDD, which Tether's freeze controls did not cover, per Tron records and Bitquery.
- 18
Lobstar Wilde: a Solana trading agent sent away about $441K of tokens by mistake
Nik Pash's Solana trading agent sent 52.4 million tokens instead of 4 SOL, apparently from a decimal error, emptying its holdings and about $441K of value.
- 19
Freysa: a player talked an AI agent guarding a prize pool into paying out $47,316
An AI agent told never to release its prize pool was beaten by p0pular.eth, who convinced it that its transfer function handled incoming payments; it paid out $47,316.