Weekly Deep Dive
Long-form research on one major wallet security story each week: timeline, attack mechanics, victim patterns, and the defenses that would have stopped it.
8 articles
2026-10-12The Tampered Device: Inside the CryptoBilis Case and What It Proves About Self-CustodyA hardware-wallet vendor confirmed that a device it made, sold through a Southeast Asian reseller, contained an unauthorized implant — and analysts put the suspected losses above $86 million. This deep dive separates what is confirmed from what is estimated, explains how a compromised display can defeat a secure element, and sets out the one habit that closes the door.2026-10-05Inside MetaMask's $1.4B Validator Exit: What 0.36 ETH Proved About Non-Custodial StakingAn attacker reached the infrastructure behind MetaMask's staking service and diverted 0.36 ETH of block rewards — and the response was to exit 17,000 Ethereum validators holding about $1.4B of staked ETH. This deep dive walks the two-key architecture that kept the principal unreachable, the reward-routing layer that did not, the 45-day cost of caution, and what the week's other authorization failures confirm about the same boundary.2026-09-28How a Backend Compromise Drained $387.5M From Bitget Without Touching a Private KeyAt 18:31 UTC on September 24, 2026, unauthorized transfers began moving assets out of Bitget's hot and warm wallets. The exchange's private keys were secure and its cold storage untouched — the attacker had compromised the backend system that assembles and authorizes transactions, and made it authorize the transfers itself. This deep dive reconstructs the four-day timeline, explains why the authorization pipeline rather than the key was the real wallet boundary, profiles who was actually exposed, and reads the week's other failures against the same line.2026-09-21How a Wallet App's Signing Flaw Emptied 1,552 XRP Ledger WalletsBetween 16:29 and 18:34 UTC on September 15, an automated drain emptied 1,552 XRP Ledger wallets holding 2,009,321 XRP. The flaw was in a phone app's signing path, and the company's own exposure criteria describe a class of user rather than a class of transaction. This deep dive reconstructs the two-wave timeline, explains why the recovery phrase rather than the device sets the blast radius, profiles who was actually exposed, and reads the week's three other failures against the same boundary.2026-09-14One Deposit, Two Receipts: How a Wrapper's Double-Spend Left 36% of Osmosis's Bitcoin UnbackedOn September 9, Osmosis disclosed that 39.84 fake nBTC — roughly 36% of its alloyed bitcoin token's backing — had been sitting inside the pool since June, created by a flaw in Nomic's deposit-forwarding code that credited one deposit twice. This deep dive reconstructs the timeline from origination to disclosure, explains why a counterfeit receipt passed every check, profiles who was actually holding the hole, and reads the week's second unbacking at Symbiosis against the same boundary.2026-09-07Liquid Network: How $320M Left a Federation Wallet and What It Means for Wallet UsersA long-form look at the September 6 withdrawal of roughly 3,996 BTC from Liquid Network's federation wallet: how a peg-out works, where it appeared to break, why the actors call themselves white hats, and what holders of federated and bridged assets should do with the exposure.2026-08-31When Seeds Aren't Random: The $5.69M Predictable-Seed Problem and the Entropy Crisis in Wallet SecurityA structured teardown of the week's defining story: Coinspect's finding that five wallet apps generated predictable recovery phrases — costing users $5.69M — read against the Zilliqa nonce post-mortem and the Coldcard seed-generation failure, and what the entropy crisis means for every wallet user.2026-08-25Inside Drainer-as-a-Service: What the $550,000 Hyperliquid Phishing Case Teaches Every Wallet UserA structured teardown of the August 2026 fake-Hyperliquid phishing theft: how a rented Inferno-class drainer kit, a paid Google ad and one approval signature turned $550,000 of USDC into an 80/15/5 revenue split — and the defense stack that beats it.