Topic
Practices and vulnerabilities in safeguarding crypto holdings, covering wallet custody, private keys, and attack vectors like malicious plug-ins or exploits.
Security researcher Taylor Monahan says most fresh Ledger loss reports trace to owners who handed recovery phrases to scammers. Estimates of the episode's losses run $70 million to $100 million, and Ledger says every verified case traces to one reseller.
Reality
COLDCARD says its official X account posted a phishing link on October 11, despite offline two-factor protection the wallet maker has used since 2017. With no explanation yet from COLDCARD or X, a security alert seen on social media is worth acting on only once the maker's own website repeats it.
Perspective Coverage
5 publishersReality
Malaysian police are investigating unauthorized transfers of about $3.05 million in crypto from a Teluk Intan man's wallet. Officers have yet to name the attacker, the coins taken or how the attacker got in.
Reality
iVerify has disclosed P7 DarkSword, iPhone spyware that scans for crypto wallets and polls its operators for new orders every 15 seconds. It gets at wallet data through the phone's own stores, so protecting the device is now part of protecting the coins.
Reality
Zcash developers aim to add quantum-resistant, hash-based signatures in January for transparent payments, which hold about 70% of issued ZEC. Shielded funds, the remaining three in 10 coins, wait for separate safeguards.
Perspective Coverage
3 publishersReality
Vitalik Buterin said AI-driven mathematics has a good chance of seriously weakening lattice cryptography within two years. He offered no demonstrated attack, and for teams adopting post-quantum schemes the forecast argues for lattice deployments built to be replaced.
Perspective Coverage
4 publishersReality
Crypto trader Frogman lost about $4 million when his Solana wallets were drained at 4:14 a.m. as TOKEN2049 opened in Singapore. The attacker finished selling within nine minutes, hours before anyone noticed, and the route to his keys is still unknown.
Reality
SEC and five US partner organizations warned on Oct. 5 about scammers posing as friends, advisers or regulators, with AI making the fakes harder to spot. The agency's newest such case involves more than $15.3 million, set against losses put in the billions a year.
Reality
Ethereum's draft EIP-7906 would let a transaction check its own results with three new opcodes and revert if they break rules the user set in advance. Aimed at the 2027 Hegotá upgrade, it puts enforcement in the protocol and leaves rule-writing to users and the tools built on top.
Reality
MetaMask is exiting its Ethereum validators in the Lido protocol by October 7, 2026, as a precaution during an infrastructure incident it has not explained. Lido expects lost rewards and possible downtime penalties, a cost incurred before MetaMask has said what was affected.
Reality
SlowMist says its evidence for the iPhone Safari attack on crypto wallet keys covers iOS 18.4 to 18.6.2 and that it has confirmed no theft victim. The firm calls this week's iOS 13 to 26.5 warnings preliminary and still tells iPhone users to install security updates.
Reality
BagOS 3.0.0 stops reading .env from the working directory after a review found a repo's config could make its login tool sign a wallet drain. Its preview-and-confirm gate covered write tools only, and login was never classed as one.
Reality
Blockchain security firm SlowMist says an active exploit chain walks from a Safari page to kernel access and the iOS Keychain on everything from iOS 13 to 26.5, while Apple's patches, by the same account, reach 26.3.
Reality
HP tracked the campaign from April to June 2026, in which a fake AI crypto trading agent shipped a genuine Microsoft utility to satisfy Windows reputation checks before the DLL loaded beside it stole browser wallet passwords.
Reality