DeFi
Articles tagged DeFi
2026-10-12Wallet Safety Weekly Review — October 5–11, 2026A curated review of the 10 most important wallet security stories for October 5–11, 2026: Ledger confirming a hardware implant inside a reseller-sold device as drains are estimated at $72M–$94.5M, a five-year-old MakerDAO keeper auction drained of 200 ETH, a trader's $4M wallet sweep at TOKEN2049, the U.S. government moving over $1B of forfeited bitcoin, and the week the supply chain — not the cryptography — turned out to be the weakest link.2026-10-12Wallet Security Data Report — Week of October 5–11, 2026The week of October 5–11, 2026 in wallet-security numbers: about $4.58M in confirmed direct losses across four incidents — including a 200 ETH drain from a five-year-old MakerDAO keeper — set against $72M–$94.5M in suspected but unconfirmed user losses tied to Ledger devices sold by one reseller, where Ledger has confirmed a hardware implant in a single device and no loss figure at all.2026-10-12Wallet Safety Intelligence Briefing — Week of October 5–11, 2026The week of October 5–11, 2026 in five fixed questions: how much was lost (about $4.58M confirmed, plus $72M–$94.5M estimated), the pattern (the supply chain became the attack surface), what enforcement did (a stablecoin deadline, a commodities proposal, a mixer retreat, a live prosecution), the one operational change worth making, and what the calendar holds next.2026-10-05Wallet Safety Weekly Review — September 28–October 4, 2026A curated review of the 10 most important wallet security stories for September 28–October 4, 2026: MetaMask exiting 17,000 validators over 0.36 ETH of diverted rewards, Gravity Bridge drained of $5.4M through its signing keys, a $3.865M exploit at NEAR Intents returned in full within a day, Bitget naming a third-party zero-day as the breach vector, and the week the defensive machinery — for once — outperformed the attackers.2026-10-05Weekly Wallet Security Data Report — September 28–October 4, 2026The numbers for September 28–October 4, 2026: roughly $9.6M in gross direct losses across four quantified incidents — about 2.3% of the prior week's total — one full recovery of $3.865M inside 24 hours, and the cheapest week this ledger has printed since the week of September 7–13.2026-10-05Weekly Safety Intelligence — Week of September 28–October 4, 2026Our five standing intelligence questions for September 28–October 4, 2026, answered: a week in which losses collapsed to ~$9.6M, a full recovery landed inside 24 hours, a $1.4B defensive withdrawal contained an infrastructure breach to 0.36 ETH, and the regulator's custody proposal read like the incident ledger converted into rule text.2026-10-05Wallet Safety Market Update — September 28–October 4, 2026Market-side intelligence for September 28–October 4, 2026: TRON one-hour rental quotes held the 20–38 SUN band with TRX near $0.336, ETF flows cooled from $2.39B to $241M as macro prints whipsawed bitcoin through an $82,600–$87,200 range, Bitget finished restoring withdrawals and pledged to refill its fund, and the SEC's custody proposal turned two-person key authorization into proposed rule text.2026-10-05Inside MetaMask's $1.4B Validator Exit: What 0.36 ETH Proved About Non-Custodial StakingAn attacker reached the infrastructure behind MetaMask's staking service and diverted 0.36 ETH of block rewards — and the response was to exit 17,000 Ethereum validators holding about $1.4B of staked ETH. This deep dive walks the two-key architecture that kept the principal unreachable, the reward-routing layer that did not, the 45-day cost of caution, and what the week's other authorization failures confirm about the same boundary.2026-09-28Wallet Safety Weekly Review — September 21–27, 2026A curated review of the 10 most important wallet security stories for September 21–27, 2026: a backend compromise that moved $387.5M out of Bitget's hot and warm wallets, a day on which three platforms lost $11M, a $20,199 governance proposal that took over two protocols on Neutron, a cross-chain key leak that drained 145 addresses, and the week the market absorbed all of it anyway.2026-09-28Weekly Wallet Security Data Report — September 21–27, 2026The numbers for September 21–27, 2026: roughly $412.3M in gross direct losses across eight quantified incidents — about $24.8M excluding the Bitget breach — one coordinated validator sweep that contained $2.2M, and a month that closed as the costliest of 2026.2026-09-28Weekly Safety Intelligence — Week of September 21–27, 2026Our five standing intelligence questions for September 21–27, 2026, answered: a week in which $412.3M left wallets and exchanges through systems that authorized correctly, a $20,199 governance vote took over two protocols, the costliest month of 2026 closed, and the effective defense shifted from key hygiene to the trust boundary itself.2026-09-28Wallet Safety Market Update — September 21–27, 2026Market-side intelligence for September 21–27, 2026: TRON one-hour rental quotes unchanged at a 20–38 SUN band against a 6.5 TRX burn baseline, TronZap's own documentation now corroborating the 65,000/131,000 energy figures, a record $2.39B ETF week absorbed the year's costliest security month, and the Bitget breach put the exchange insurance fund's headroom on every operator's dashboard.2026-09-28How a Backend Compromise Drained $387.5M From Bitget Without Touching a Private KeyAt 18:31 UTC on September 24, 2026, unauthorized transfers began moving assets out of Bitget's hot and warm wallets. The exchange's private keys were secure and its cold storage untouched — the attacker had compromised the backend system that assembles and authorizes transactions, and made it authorize the transfers itself. This deep dive reconstructs the four-day timeline, explains why the authorization pipeline rather than the key was the real wallet boundary, profiles who was actually exposed, and reads the week's other failures against the same line.2026-09-21Wallet Safety Weekly Review — September 14–20, 2026A curated review of the 10 most important wallet security stories for September 14–20, 2026: an app wallet signing flaw that swept 1,552 XRP Ledger wallets, a $7.8M Safe-wallet drain that a bot front-ran, a stolen bridge key that minted 2.3 billion AI tokens, a ransom demand aimed at Revolut's customer files, and the advisory that names the recruiters stealing seed phrases.2026-09-21Weekly Wallet Security Data Report — September 14–20, 2026The numbers for September 14–20, 2026: roughly $20.9M in confirmed direct losses across nine quantified incidents, a week with no in-window recoveries, and a loss profile where every dollar traces to keys, authorization checks or oracle inputs rather than to code on a chain.2026-09-21Wallet Safety Market Update — September 14–20, 2026Market-side intelligence for September 14–20, 2026: TRON one-hour rentals quoted from 20 SUN by the cheapest operator against 29–30 SUN-per-day 30-day terms, JustLend's own documentation now confirming the 64,000/130,000 energy figures that most fee guides still understate, a bitcoin week that survived a rate hike and a failed bill, and the venue failures that left users without an exit.2026-09-21How a Wallet App's Signing Flaw Emptied 1,552 XRP Ledger WalletsBetween 16:29 and 18:34 UTC on September 15, an automated drain emptied 1,552 XRP Ledger wallets holding 2,009,321 XRP. The flaw was in a phone app's signing path, and the company's own exposure criteria describe a class of user rather than a class of transaction. This deep dive reconstructs the two-wave timeline, explains why the recovery phrase rather than the device sets the blast radius, profiles who was actually exposed, and reads the week's three other failures against the same boundary.2026-09-14Wallet Safety Weekly Review — September 7–13, 2026A curated review of the 10 most important wallet security stories for September 7–13, 2026: 3,400 BTC returned to the Liquid federation, a $24B laundering marketplace struck by US enforcement, two more bitcoin-wrapper unbackings at Nomic and Symbiosis, a UBI protocol's reserves drained, and an old Balancer deadline that lapsed quietly.2026-09-14Weekly Wallet Security Data Report — September 7–13, 2026The numbers for September 7–13, 2026: roughly $3.7M compromised across four confirmed incidents, ~$1.9M net after frozen assets, tracked losses down more than 99% from the Liquid-inflated prior week — plus a recovery ledger that includes 3,400 BTC returned to the Liquid federation.2026-09-14Weekly Safety Intelligence — Week of September 7–13, 2026Our five standing intelligence questions for September 7–13, 2026, answered: a week shaped by three bitcoin-wrapper unbackings in five weeks, the return of 3,400 BTC to Liquid, a $24B laundering marketplace taken apart by enforcement, and a baseline of roughly $2M per week in confirmed direct losses.2026-09-14One Deposit, Two Receipts: How a Wrapper's Double-Spend Left 36% of Osmosis's Bitcoin UnbackedOn September 9, Osmosis disclosed that 39.84 fake nBTC — roughly 36% of its alloyed bitcoin token's backing — had been sitting inside the pool since June, created by a flaw in Nomic's deposit-forwarding code that credited one deposit twice. This deep dive reconstructs the timeline from origination to disclosure, explains why a counterfeit receipt passed every check, profiles who was actually holding the hole, and reads the week's second unbacking at Symbiosis against the same boundary.2026-09-07Wallet Safety Weekly Review — August 31 – September 6, 2026A curated review of the 12 most important wallet security stories for August 31 – September 6, 2026: a $320M settlement-layer withdrawal, the Coldcard attacker moving funds again, a $1.73M legacy-contract overflow, a hardware-wallet shipping breach tripling in size, a cross-border drainer ring dismantled, and a clipboard-hijacking botnet taken down.2026-09-07Wallet Security Data Report — August 31 – September 6, 2026The weekly numbers for August 31 – September 6, 2026: ~$321.8M in tracked direct losses, with one settlement-layer incident accounting for about 99.5% of the total, a $1.73M legacy-contract overflow second, and the non-Liquid remainder falling 77% week over week.2026-09-07Wallet Safety Intelligence — Week of August 31 – September 6, 2026The five fixed questions for the week of August 31 – September 6, 2026: risk migrating to the layers around the key, a $320M settlement-layer withdrawal, social engineering that borrows trusted identities, the operations that matter now, and what to watch in September.2026-09-07Liquid Network: How $320M Left a Federation Wallet and What It Means for Wallet UsersA long-form look at the September 6 withdrawal of roughly 3,996 BTC from Liquid Network's federation wallet: how a peg-out works, where it appeared to break, why the actors call themselves white hats, and what holders of federated and bridged assets should do with the exposure.2026-08-31Wallet Safety Weekly Review — August 24–30, 2026A curated review of the 12 most important wallet security stories for August 24–30, 2026: an entropy crisis worth $5.69M, the Inferno drainer network attributed, a $9.4M TRON poisoning tally, a Solana neobank breach and refund pledge, and AI-found bugs forcing emergency lockdowns.2026-08-31Wallet Security Data Report — August 24–30, 2026The weekly numbers for August 24–30, 2026: ~$7.7M in tracked direct losses — a second consecutive weekly decline — led by a $5.72M Cosmos EVM bug, with the Salus drainer attribution and the $9.4M TRON poisoning tally adding the attribution layer.2026-08-25Inside Drainer-as-a-Service: What the $550,000 Hyperliquid Phishing Case Teaches Every Wallet UserA structured teardown of the August 2026 fake-Hyperliquid phishing theft: how a rented Inferno-class drainer kit, a paid Google ad and one approval signature turned $550,000 of USDC into an 80/15/5 revenue split — and the defense stack that beats it.2026-08-25Wallet Security Data Report — August 17–23, 2026The weekly numbers for August 17–23, 2026: two major protocol incidents worth ~$10.3M, ~$2M in tracked user-side theft, a sharp week-over-week decline from the Aug 9–15 spike, and governance capture as the week's dominant loss class.2026-08-24Wallet Safety Weekly Review — August 17–23, 2026A curated review of the 10 most important wallet security stories for August 17–23, 2026: a governance-keyed vault drain, a cross-chain bridge exploit, address poisoning on TRON, the Inferno drainer-as-a-service investigation, and the operational habits that would have stopped each loss.