Audits
Study: 94% of Losses at Audited DeFi Victims Fell Outside Their Audit Scopes
A preprint from ack3-affiliated researchers and Czech Technical University examined 135 DeFi incidents from H1 2026 ($939.86M in losses) and found that where audits existed, 94.4% of reported losses came from attack paths outside every identified audit scope — though two large incidents dominate the figure.
Security Digest: The Assurance Boundary — September 18
Beyond Lazarus: Researchers Split North Korea's Crypto-Hunting Apparatus Into Six Clusters
Latest News
Chainflip's $736K TRON Exploit Was a Memo Problem, Not a Bridge Break
Chainflip lost 736,442.17 USDT after an attacker attached new memos to already-signed TRON transfers, tricking the protocol into paying twice against single deposits. The September 12 incident, confirmed by the protocol itself, exposed an instruction channel most chains never use — and the network is still paused.
Fake Cloudflare Checks Push Malware to Meme Coin Traders — One Reports $600K Loss
Phishing pages impersonating Cloudflare verification screens are being planted in token metadata fields on aggregator listings, then instructing victims to run a payload with administrator privileges on Windows. One trader reported losing about $600,000. The campaign skips wallet approvals entirely — it asks for code execution instead.
Security Digest: Attackers Are Routing Around On-Chain Defenses — September 17
Today's two research stories share one theme: campaigns that never touch a wallet approval. Plus the status board — Liquid at day 12 with 598.5 BTC still held, the Kelp freeze window expired with no announced resolution, Chainflip still paused, and follow-up reporting puts the Revolut breach at about 680 high-value accounts.
TRM Labs: Fake AI Trading Bot Tutorials Turn Victims Into Their Own Drainer Operators
Nine near-identical YouTube tutorials promising a Claude-built arbitrage bot walked 224 victims into deploying and funding malicious contracts themselves — 274.60 ETH, about $517,000, drained between February and August 2026. No phishing link, no spoofed domain, no approval prompt: wallet defenses never fire.
DOJ Charges Two Former Robinhood Engineers Over Alleged Listing Front-Running on Hyperliquid
Federal prosecutors in Manhattan say Hefu Chai and Huaisong Xiang misappropriated confidential information about upcoming Robinhood Crypto listings and traded perpetual futures ahead of public announcements. The case is a reminder that listing calendars are among an exchange's most sensitive security assets — and that trading-venue integrity now reaches into DeFi.
Attacker Drains $7.8M in rsETH From Ethereum Safe — and an MEV Bot Takes It First
A leveraged rsETH position was drained from a Gnosis Safe through an over-permissioned custom module routed into an attacker-controlled Uniswap v4 pool. A generalized MEV bot front-ran the exploit in the same block and captured the tokens, and Kelp DAO froze the receiving address. Security firms are unanimous: this was module-authorization abuse, not a flaw in Safe core.
The rsETH Theft Is the Latest Warning About Smart-Wallet Modules
The $7.8M loss reconstructed by Blockaid, SlowMist and BlockSec came down to one over-permissioned helper contract the Safe owner had whitelisted. The pattern — attacks moving to the edges around well-reviewed core contracts — has been visible since Bybit, and it has specific implications for how modules should be reviewed, scoped and monitored.
Security Digest: The Ongoing-Incident Tracker for September 16
One lead story — the rsETH Safe-module theft front-run by an MEV bot — plus a consolidated status board for every major security incident still in motion: Liquid Network peg-outs frozen, Symbiosis hunting its attacker, Swiss Bitcoin Pay offline, the Revolut extortion, and the Kelp DAO freeze watch.
DOJ Moves to Forfeit $61M in Crypto Tied to Alleged Iranian Oil Laundering Through Binance
Prosecutors in Manhattan filed a civil forfeiture complaint against nearly $61 million in cryptocurrency they allege is proceeds of black-market sales of sanctioned Iranian oil, moved through Binance accounts by two China-based companies as part of a network that handled over $1.5 billion.
Revolut Attackers Reportedly Demand 10,000 BTC as Customer Data Leaks Continue
The actors behind the fraudulent government data request have escalated to extortion, reportedly demanding roughly $780 million in Bitcoin and threatening daily data dumps. Revolut has not confirmed the demand or authenticated the leaked files.
Security Digest: Solana Mobile Confirms Brevo Account Access, Liquid Peg-Outs Enter Week Two, Symbiosis Hunt Goes On
The day's smaller security stories in brief: Solana Mobile is the second big crypto name confirmed in the Brevo SSO breach, the Liquid Network begins its second week with peg-outs still frozen, and Symbiosis shifts from white-hat bounty to informant reward. Plus a status board on the Revolut extortion.
Swiss Bitcoin Pay Takes All Servers Offline After Suspected Intrusion
The Swiss non-custodial Bitcoin payment processor detected likely unauthorized access to its internal systems and shut down its entire infrastructure as a precaution. Emails, Bitcoin addresses, IBANs, transaction histories and hashed passwords may have been exposed; the company says funds and private keys are unaffected.
EU Cyber Resilience Act Puts Crypto Wallet Makers on a 24-Hour Exploit Disclosure Clock
The Cyber Resilience Act's vulnerability and incident reporting obligations took effect September 11, 2026. Wallet manufacturers selling into the EU must now warn ENISA within 24 hours of learning a flaw is being actively exploited — a legal deadline that would have reshaped this year's Coldcard, Trezor and Liquid disclosures.
Security Digest: Symbiosis White-Hat Window Closes, Revolut Attackers Begin Leaking, Liquid Marks One Week With Peg-Outs Frozen
The day's smaller security stories in brief: Symbiosis's 20% bounty offer to its bridge attacker expired without a reported return, the Revolut extortion campaign has started publishing customer files, and the Liquid Network resumes life with peg-outs still disabled. Plus: the EU's 24-hour disclosure clock starts ticking for wallet makers.
CoinGecko Tally: $3.63 Billion Lost to Hacks in 19 Months — 88% of It From Audited Platforms
A CoinGecko report covering January 2025 through July 2026 counts 245 incidents and $3.63 billion in losses. Roughly 88% of stolen funds came from platforms that had completed independent security audits, because most attacks hit what audits do not cover.
Revolut Handed Customer Passports and Bitcoin Records to a Fake Government Request
Revolut disclosed that a fraudulent emergency data request sent from a legitimate government agency email domain led to the release of identity documents, IBANs and full Bitcoin transaction histories. No funds were lost, but the disclosure hands criminals everything needed for targeted impersonation.
Security Digest — September 13, 2026: Hacken Scores Tether's Key Management 3.3/10; Cascade Shuts Down After CLS Vault Exploit
Sunday digest: a Hacken review finds roughly $91 billion of USDT on Tron sits behind a 2-of-3 signing arrangement with no timelock, even as Bluechip upgrades Tether's corporate grade; and Cascade winds down five months after its July vault exploit.
Symbiosis White-Hat Bounty Window Closes Today — 20% Reward, Then the Informant Rate
The cross-chain protocol's deadline for the syBTC mint attacker to return funds expires September 13. About 15 BTC has been recovered so far; after the window, the 20% reward is redirected to anyone providing information leading to recovery.
Blockstream Refuses Ransom for Remaining 598 BTC as Liquid Hackers Demand a 10% 'Bounty'
Blockstream has ended negotiations with the party holding 598.5 BTC from the Liquid Network breach, calling the withdrawal 'theft, not white-hat activity.' A volunteer red team separately claims it warned Blockstream before the incident — a claim the company's former CSO disputes.
Hemi's Genesis Drop Post-Mortem: A Decade-Old Reentrancy Bug Drained 124.5 Million Tokens for $255,000
Hemi Network's post-mortem confirms a reentrancy flaw in its MerkleBox claim contract let an attacker drain 124.5 million HEMI tokens via a flash-loan-powered recursive loop. The realized loss was small — about $255,000 — but Upbit pulled the token's listing days before launch, and the immutable contract could not be patched.