Security

Ledger says it is looking into reports of lost funds from Southeast Asian customers who bought through the reseller, and has confirmed neither an amount nor a cause. Two independent researchers put the losses at more than $72 million and more than $86 million, figures that may not cover the same addresses.

He named ML-DSA and fully homomorphic encryption as the new risk, and said Ethereum's lean roadmap has spent a year moving to hash-based schemes for that reason. His advice to holders was caution about migrating rather than haste: botched migrations have cost him more than every hack combined.

His stated trigger is an OpenAI release of machine-generated mathematics that the company itself describes as unevenly verified. In June he put the odds of a quantum break by 2032 at 50% and named 2029 as a good migration target.

The protocol halted services, patched the contract-side flaw and promised to compensate users in full, naming eleven networks whose deposits and withdrawals would stay down for another 12 hours. Investigators who traced the outflows do not agree on where the money went.

The fake alert claimed an STM32 entropy flaw in about one in four devices, a lure that lands harder six weeks after a real entropy bug drained 594 bitcoin from Coldcard wallets. BitBox users received near-identical mail the same day.

The 2003-vintage botnet spent its final eight years swapping copied bitcoin and ether addresses for the operator's own, and took about $150,000 doing it. There was never a command server to seize.

Cosmos Labs cleared the underflow in April after testers could not reproduce it on live configurations. The fix finally shipped on 19 August, under a release note that named nothing, and validators had twenty hours.

Avici's card-issuing partner Rain traced the theft to an outdated version of its Solana contract. The attacker registered himself as an administrator on 1,685 collateral accounts; every one of them will be refunded in full.

A race condition in versions before 1.22.2 let a malicious dapp swap the payload the device signed for the one the user approved. Ledger fixed it quietly two weeks before a researcher went public.

The upgrade also lifts testnet throughput from 1,237 to 2,324 transactions per second and tightens the rules on how validator keys are retired.

PeckShield traced the $7.9 million through ChangeNOW, FixedFloat and BingX before conversions into Monero closed the paper trail. ChangeNOW froze a six-figure amount.

Foundation and Citadel21 confirmed their Lightning nodes were drained before v2.4.2 landed. Updating alone does not revoke credentials already stolen.

The third sweep, spanning Friday to Saturday, split roughly 208 BTC across 293 separate P2WSH vaults — a shape change that made it far harder to trace than the first two.

A 2021 firmware bug quietly gutted seed entropy on Mk3 devices, and an attacker who noticed swept the lot before dawn. Coinkite says Mk4, Q and Mk5 look safe on early analysis.

The security firm Hexens published the details of an Aptos Move virtual machine flaw on 4 July. Its simulation showed a 90 per cent success rate at compromising the network with commodity hardware, and about $70 billion in bridge, stablecoin and exchange balances sat within the blast radius.

An attacker minted roughly 1,000 unbacked eBTC worth $76.7 million on Echo Protocol's Monad deployment by compromising a single admin key, though the realised loss was around $816,000 after the team regained control and burned the remaining tokens.

Binance launched Withdraw Protection on May 4, letting users freeze their account against on-chain withdrawals for up to seven days. A stricter lockdown mode disables early unlocking entirely. The feature exists because verified physical coercion attacks against crypto holders rose 75 per cent last year.

A vulnerability in Litecoin's MimbleWimble Extension Block allowed attackers to forge invalid peg-out transactions and attempt double-spends, triggering the deepest chain reorganisation in the network's history. GitHub commits show developers had a fix weeks before the exploit landed.

Giancarlo Lelli used a variant of Shor's algorithm on publicly accessible quantum hardware to derive a private key from its public counterpart, claiming Project Eleven's Q-Day Prize and advancing the timeline for practical quantum attacks on cryptographic systems.

Crypto protocols have lost $606 million to exploits in the first 18 days of April, driven by two enormous bridge attacks attributed to North Korea's Lazarus Group, making it the worst month for crypto security since the Bybit breach in February 2025.

The hardware wallet maker appointed Ian Rogers as its first 'Chief Human Agency Officer' and unveiled a phased AI security roadmap — a bet that autonomous crypto agents will need physical hardware to keep humans in the loop.

The foundation's new subsidy programme covers up to 30 per cent of audit costs for any Ethereum mainnet team, with more than 20 firms including Certora, Quantstamp and Spearbit ready to take on the work.

A counterfeit Ledger Live application bypassed Apple's review process, stole seed phrases from more than 50 victims across five blockchains, and funnelled the proceeds through KuCoin deposit addresses before being removed.

The 2025 Nobel laureate and Qolab co-founder warns that elliptic curve cryptography — the backbone of Bitcoin's security — is among the easiest targets for a sufficiently powerful quantum computer, giving the network a five-to-ten-year window to prepare.

A joint enforcement initiative led by the US Secret Service and UK National Crime Agency targets organised crypto fraud schemes that have drained billions through approval phishing since 2021.

The Solana Foundation and Asymmetric Research have unveiled a tiered DeFi security framework offering foundation-funded monitoring for protocols above $10 million TVL and formal verification for those exceeding $100 million.

Charles Guillemet says artificial intelligence is fundamentally transforming the threat landscape for digital asset security, making vulnerability discovery and exploitation accessible to a far wider pool of attackers.

Drift Protocol reveals its $285 million exploit was the culmination of a six-month social engineering campaign by a DPRK-linked group that posed as a quantitative trading firm.

Armstrong pledges direct oversight of a new industry coalition to make Bitcoin quantum-resistant, with Coinbase planning to launch quantum-proof custody services for institutional clients by late 2026.

A sophisticated attacker exploited Solana's durable nonce feature to hijack governance controls at Drift Protocol, draining $285 million in assets in under 12 minutes before bridging funds to Ethereum.