RESEARCH
We review public security incidents and turn them into defenses blockchain teams can put in place right away. Defense only, no attack walkthroughs.
RSS feed ↗
Chainalysis disclosed a breach on October 30. A November 4 update confirmed that password hashes and live tokens for all users were exposed, and KYT and address screening were taken offline. What dependence on compliance and risk vendors means for a blockchain team of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
Options trading terminal SignalPlus was attacked on November 4 after a compromised vendor Telegram account sent a fake meeting invite, affecting a small number of accounts without IP whitelisting. The risk of handing exchange API keys to third-party tools, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 29, Synology warned that attackers are exploiting a vulnerability patched in late 2024 to target NAS devices on outdated DSM, encrypting data and demanding ransom. What this means for the office NAS at a blockchain team of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On November 2, docs hosting platform GitBook detected unauthorized access to parts of its infrastructure, affecting a number of customers. A perpetual futures platform reported unauthorized activity on its docs, and a DEX moved its docs off GitBook. How blockchain teams of 10 to 50 people should manage third-party hosted docs, viewed through process, risk and privileges, with five steps to take now.
Read article →
On November 2, Brazilian exchange Mercado Bitcoin detected a security incident and suspended all transactions. The exchange says about $38M is involved and about $11M has been frozen. Funds left more than a dozen chains, and according to researchers most transfers happened within roughly 34 minutes. How blockchain teams of 10 to 50 people should manage hot wallets across many chains, viewed through process, risk and privileges, with five steps to take now.
Read article →
On November 1, BTCPay Server warned that hot wallets on multiple self-hosted instances were being swept and asked operators to shut down. Reports involve versions older than 2.4.2, where the attacker logged in as an administrator. How blockchain teams of 10 to 50 people should run payment servers and hot wallets, viewed through process, risk and privileges, with five steps to take now.
Read article →
Starting October 30, 15 customer domains registered with Name.com were redirected without authorization, sending visitors of DeFi sites such as Flap and Kintsu to pages serving a wallet drainer. Independent estimates put losses at roughly $140K to $200K. How blockchain teams of 10 to 50 people should protect domains, DNS and registrar accounts, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 29, a tampered Claude Code extension (v2.1.313) was listed on the Cursor extension marketplace for about 11 hours, reaching up to 5,000 users. It added an attacker's SSH key and installed a persistent startup script. How blockchain teams of 10 to 50 people should manage editor extensions and AI coding tools on developer machines, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 30, researchers found funds stolen from Binance and from this month's Bitget hack moving into the same address, and TRM Labs and Chainalysis assess both as the work of North Korea-linked TraderTraitor. Binance added that a compromised employee laptop was only the starting point. How blockchain teams of 10 to 50 people can stop attacks that start on an employee laptop, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 30, Binance said its initial investigation suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of a private key leak and an estimated total impact of about $6.3B. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 29 (UTC), a Binance hot wallet was given an EIP-7702 delegation and swept of more than 60 assets in one transaction, with outflow estimates of $2.8B to $3.5B. Binance says $2.54B is verified frozen and it will cover all losses. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 28, the Singapore Police Force warned that Ledger hardware wallets sold by local retailers contained malicious hardware able to capture recovery phrases, with at least two cases and about S$3.5M in losses. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with four steps to take now.
Read article →
Between October 24 and 28, outsiders took governance control at X100, Yapeswap and Hifi Finance: flash-loaned seats, a zero quorum, and a last-minute vote on a proposal that mints tokens and moves user collateral. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 27, prediction market Predict.fun reported about 400,000 USDT in unauthorized transfers, pointing to a compromise of its third-party-hosted API docs site. The same day, security researchers disclosed malicious code in Udesk support scripts that swaps exchange deposit addresses. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 26, hardware wallet maker Keystone published a full statement: an attacker escalated privileges through a vulnerability in a third-party data monitoring tool on its website, taking about 26,000 buyer records and the device authentication key, which allows counterfeits that pass the official check. Keystone will destroy 18,835 inventory units and has paused shipping. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 24, Electrum published a high-severity advisory: versions before 4.8.3 do not verify signatures on unconfirmed transactions supplied by the server, so a malicious server can swap the destination address and trick users into signing a fee bump that pays the attacker. Attacks have been seen in the wild. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 22, about $16M was flagged leaving addresses linked to CoinDCX. The exchange says the keys for these deposit addresses were exposed in its July 2025 incident and the addresses were retired, yet users kept depositing and a sweep process failed for a period. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 21, cloud deployment platform Railway disclosed unauthorized access to the systems that store customer environment variables. According to security researchers, about $371K was then swept from more than 200 addresses. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
On October 21, GitLab shipped a critical patch for CVE-2026-110264, a CVSS 10.0 flaw that allows unauthenticated remote code execution on self-managed instances from version 7.0 onward. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
PHP says it will ship a security release at 14:00 UTC on October 21 to fix two remote code execution flaws rated CVSS 9.2 (CVE-2026-109618, CVE-2026-109619). What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
Qubic says 1,404 wallets, about 2.94 trillion QU, were drained because some wallet seeds were generated with insufficient randomness. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
SlowMist has disclosed DarkSword, a trojan infrastructure targeting iPhones that steals crypto wallets, keychain data and messaging accounts. What it means for blockchain teams, with seven prioritized defenses and a mobile security architecture.
Read article →
A batch of Ledger devices sold through a Southeast Asian reseller carried a seed-stealing hardware implant, and scammers are now sending fake "urgent firmware update" emails. Where small teams are exposed, and five defenses to put in place now.
Read article →
A timeline of the roughly $387.5 million theft from Bitget's hot and warm wallets and five takeaways: the entry point was a zero-day in a third-party security product, while private keys and contracts stayed intact. Includes a five-point self-check for smaller teams.
Read article →INCIDENT RESPONSE · ASSESSMENT
Reply within 24 business hours · [email protected]
CONTACT
Leave your contact details and needs and we will get back to you soon. You can also reach us on WeChat.
