The market spent the week celebrating a Treasury liquidity trick as if it were a discovery, while the security side quietly cleaned up after a hardware wallet that could not generate a random number, three chains that halted mid-exploit, and a bridge that minted money out of nothing. As usual, the drains were the interesting part and the candles were the loud part. When your cold storage vendor tells you to regenerate every seed, that is not a patch note, that is a confession.
The headline number belongs to Coldcard. Coinkite shipped firmware after what CoinDesk pegged at a $114 million bitcoin theft (Decrypt rounded it to $130 million), rooted in weak seed generation. The new firmware forces users to add their own entropy when generating wallet seeds, and Coinkite’s warning was blunt: existing vulnerable seeds remain unsafe, so regenerate. A three-week review turned up additional bugs, with AI credited for finding some of them. If your keys came out of an affected device, the exploit is not theoretical and the fix is not automatic. Move your coins.
The Sandbox contained a bridge exploit that minted unbacked SAND on Base and BSC. The studio halted bridging on both chains and says Ethereum, the chain it claims was unaffected, was where Upbit and Bithumb still froze SAND transfers under South Korea’s user-protection law. Unbacked mint events are the purest form of DeFi loss: no key was stolen, the contract simply printed collateral that did not exist.
BounceBit is winding the whole chain down. After a $3 million exploit in which the attacker moved roughly 286.5 million BB across nine wallets before block production was halted, the team decided the answer was to sunset its blockchain entirely and migrate to BNB Chain. Halting block production to stop a drain is becoming a genre.
MANTRA, the Dubai-licensed RWA Layer 1, has been frozen since Thursday evening and blames the Cosmos EVM module. It says the incident touched two wallets it controls and that no user funds were taken, but it has notably declined to say whether anything actually left those wallets. Absence of a stated loss is not the same as absence of a loss.
No named state crew took a bow this week, but the tooling story is the story. TRM Labs reports AI adoption in crypto crime rose 40% over the past year, with attackers using models to surface overlooked vulnerabilities and infiltrate IT firms. That is not a forecast, it is already in the loss numbers, and Coldcard’s own three-week review used AI to find bugs on the same premise. The Decrypt piece on a 20-odd developer red team scanning the Bitcoin ecosystem for AI-discoverable flaws is the defensive mirror of the same trend: cheap models handed attackers reach, so someone has to scan first.
On the commodity end, ToxicPanda Android malware now targets 349 apps and supports 167 remote commands, abusing VPN permissions to block Google Play. A supply-chain campaign is infecting Android car head units built by DoFun via their built-in updaters (flagged by Kaspersky), enlisting them into a proxy botnet for ad fraud. SynkLoader is riding Microsoft Teams phishing with a fake lock screen, and 14 trojanized npm packages are dropping the AI-assisted RedC2 4.0 Linux backdoor. The through-line: attackers no longer need originality, just distribution and an updater someone trusts.
Bitcoin posted its best week since 2023, and the honest reporting credited the plumbing, not the Fed. A Treasury buyback tweak that CoinDesk carefully labeled “not QE or YCC” injected liquidity, pushed yields down, and sent BTC roughly 25% higher to test $80,000, before slipping back to $77,000. Roughly $1.2 billion in shorts were liquidated on the way up. Strategy swung from a $13 billion paper loss to a $1.4 billion unrealized gain as its holdings crossed back above cost basis. XRP led an altcoin rally to its biggest weekly gain in 21 months, HYPE ran nearly 40%, and Zcash hit an eight-year high near $850 on Grayscale’s ETF push and roughly $10 billion in daily futures volume, most of it derivatives rather than spot. Read that composition carefully.
On the board that actually matters: Nomura-backed Laser Digital won Japan’s first crypto exchange approval in four years. Washington kept theater running, with Trump pushing the Clarity Act and the CFTC threatening to write its own rules if Congress stalls, even as CoinDesk ran an opinion arguing the Clarity Act is functionally anti-crypto. MiCA is now eyeing DeFi lending vaults, where deciding who to regulate is the hard part. BitMart is weighing a partial restart and creditor payouts while users report withdrawals stuck on “Processing,” which is the more informative data point.
The reflexivity study of the week comes from the Cleveland Fed: crypto investors are driven by beliefs and easily swayed by past returns. Nobody who watched money chase a Treasury buyback headline this week will find that surprising. It was already priced in.
More: Issues · Field Notes · RTFM
New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.
]]>The threat model quietly moved from your seed phrase to your front door. Between Trezor, SafePal, a French tax breach, and Israel’s largest exchange, the week’s real exploit was logistics metadata, not smart contracts. Meanwhile a president got a bank charter and Bitcoin slid under $63K, which is to say the board rearranged itself exactly as leverage said it would.
The headline number came from self-custody, not an exchange. Cointelegraph’s Crypto Biz logged a $116 million Bitcoin wallet exploit, and Galaxy Research separately estimated that Coldcard-related thefts could top $150 million, with the recent lull suggesting vulnerable holders either migrated or were already emptied. Neither of these is a protocol failure in the DeFi sense. They are the slow, grinding harvest of poorly secured keys, and the money does not come back.
The rest of the week’s damage was data, which converts into money later. Trezor confirmed roughly 14,000 customers exposed through its shipping provider ShipMonk: names, emails, phone numbers, and for many, physical shipping addresses. Days later SafePal disclosed a breach hitting nearly 40,000 customers’ order information, same attack vector, same lesson ignored. Both firms will tell you their devices and backups were never touched. True, and beside the point. The leak links a confirmed hardware wallet purchase to a real-world identity and location, which is the exact input a wrench attack requires.
Add the largest crypto exchange in Israel, Bits of Gold, where customer identification details and deposit addresses were reportedly compromised, and the French tax breach exposing nearly 678,000 taxpayers and businesses, now on pace to make 2026 France’s worst year ever for violent crimes targeting crypto holders. The exploit surface this week was a spreadsheet of who owns what and where they sleep.
The DPRK-flavored social engineering playbook keeps working because it targets people, not code. Singapore attributed $11.8 million in losses to fake LinkedIn crypto job scams, where malware planted during a bogus coding assessment harvested a session token and bypassed multi-factor authentication to reach a code repository. Stolen tokens, not stolen passwords, remain the path of least resistance.
New malware to note: AmnesiaStealer, a macOS info-stealer spreading via ClickFix lures, ships a streaming module letting attackers interactively drive the victim’s browser in real time. Session hijacking is graduating from token theft to live remote control. Elsewhere, the ShinyHunters crew exposed 1.6 million RingCentral accounts, and Clop claimed 89GB from Shell, reminders that the extortion supply chain feeding future crypto-targeting lists never sleeps.
The through-line: every leaked customer database this week is raw material for the next wave of phishing, coercion, and wrench attacks. The threat actors do not need to break your wallet if a courier’s database tells them where to knock.
The biggest regulatory move was also the most predictable. The OCC granted conditional approval for World Liberty Trust Company, the Trump-linked venture, to operate as a national trust bank and take over issuance of the USD1 stablecoin from BitGo. Senator Elizabeth Warren called it the most brazen self-dealing in financial history. Priced in or not, the precedent is set: the family issuing the currency now also runs the bank.
The legislative track went the other way. Galaxy cut CLARITY Act odds to 10%, citing unresolved ethics, stablecoin yield, and developer protection issues plus a narrow September Senate window. The SEC promptly shelved a crypto rule meeting after the Senate recessed without a vote. Structure over sentiment, again.
Markets did what leverage told them to. Bitcoin slipped below $63,000, then toward $62.5K, ignoring cooperative US inflation while Binance longs faced a cleanout in open interest. The institutional bid, however, kept building underneath: UBS grew Bitcoin ETF call options 24-fold, Morgan Stanley raised IBIT holdings 23%, JPMorgan boosted its BTC ETF position 25% and quadrupled its ETH position, and Paul Tudor Jones’ firm bought back in after a year of selling. CoinDesk declared the “long bitcoin, short the bankers” era officially over. The bankers won by buying the ETF.
On the plumbing: Israel’s Bank Leumi tapped Galaxy to offer BTC, ETH, and SOL trading from early 2027, Ethereum devs are narrowing 66 proposals for the privacy-focused Hegotá upgrade, and Solana proposed a fee overhaul to make resource hogs pay while burning more SOL. Tether finally cleared a first KPMG audit, ending its longest-running criticism, though it still declines to publish the statements. Meanwhile the ECB found crypto payment acceptance below 1% in the euro area, a quiet reminder that after all this, almost nobody is paying for coffee with it.
The board shifted toward banks, ETFs, and charters. The risk shifted toward your doorstep. Neither was a surprise if you were reading the explorer instead of the timeline.
More: Issues · Field Notes · RTFM
New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.
]]>The call is coming from inside the house: this was the week Bitcoin’s own tooling, from Coldcard to BTCPay Server to Lightning nodes, became the attack surface instead of the fiat rails everyone worries about. Meanwhile the DOJ proposed handing a majority of $225M in verified scam-victim funds to the scammers, which is the kind of settlement you cannot even short. As ever, by the time the alert hits your feed, someone else’s node was already swept hours earlier.
The headline event is BTCPay Server. The open-source Bitcoin payment processor warned of an actively exploited vulnerability that could drain funds, urging operators to update to version 2.4.2 and rotate credentials. Hardware wallet maker Foundation and the Bitcoin zine Citadel21 both confirmed their Lightning nodes were swept, in some cases hours before the public alert landed. BTCPay was explicit that the flaw under attack was not the one disclosed in its changelog, which is a polite way of saying the attackers were ahead of the disclosure. Total losses and the number of affected operators remain unknown, which is the usual fog around self-hosted infrastructure.
Second, Polymarket. CoinDesk detailed how a five-second timing trick let traders drain millions, a reminder that prediction-market oracles and settlement windows are exploitable long before the CFTC gets around to worrying about “moneyline” odds.
The Coldcard exploit from the prior week continued to metastasize, less a single incident than an ongoing war bulletin, driving bitcoiners toward dice-roll entropy for seed generation. Blockaid’s CEO framed it as crypto’s “original sin” of private keys meeting AI-accelerated bug discovery.
Lazarus Group and North Korea are back in the docket, not the wild: a US court granted Bybit expedited discovery to trace funds from the $1.5B hack, letting the exchange pull account identities and balances from platforms with US operations. Discovery is not recovery, but it is the first crack in the mixer fog.
Wallet-draining crews stayed busy at the endpoint. ClickFix attacks are delivering a Go-based macOS stealer that lifts crypto wallets, Keychain data, and cached credentials. Hackers are abusing BNB Chain to host malware instructions behind fake CAPTCHAs, per Microsoft, turning the blockchain into a resilient command channel. Nearly 800 malicious npm packages shipped a cross-platform RAT and infostealer under AI-generated typo-squat names. And a Trezor phishing site reportedly took a user’s life savings, the low-tech classic that never goes out of style. On the enterprise side, UNC6671 vishing and Microsoft 365 AitM campaigns continue targeting finance workflows.
On sanctions, OFAC designated two Iran-linked crypto exchanges under the “Economic Fury” campaign, tracing over $3M between Shelbit and IRGC-linked wallets.
The week’s most cynical development came from Washington, not a mempool. The DOJ filed a proposed settlement handing a majority of $225M in verifiable pig-butchering victim funds to Infiniweb, a Philippine POGO tied to the Prince Group, and backed a protective order shielding the syndicate. Context: FBI IC3 pegged 2025 crypto investment-fraud losses at $7.2B, part of $11.37B in crypto-linked crime. The rail design is boring and effective: mule accounts, card on-ramps, and exchange accounts opened in the victim’s own KYC.
Legislatively, Majority Leader Thune filed cloture on the CLARITY Act, setting a September 15 Senate vote that still needs at least seven non-Republican votes. OKX’s Rafique already warned that passage optimism is priced into bitcoin, which is the entire thesis of this newsletter in one quote.
Markets stayed structurally soft under the headlines. US spot Bitcoin ETFs drew roughly $1.1B in their best week since April, with IBIT taking the bulk, and Bloomberg’s Balchunas tied the inflows partly to the Coldcard hack driving self-custody refugees into funds. Bitcoin tagged $65.3K after a surprise 23,000-job July payrolls miss cut rate-hike odds, yet remains in a death cross with volatility near vanishing. Elsewhere: Trump Media unwound its Crypto.com CRO treasury deal, leaving CRO holders holding the unburned bag; over 100 crypto projects folded in 2026’s dot-com-style shakeout; and Brazil’s central bank ordered up-to-24-hour holds on large cross-border transfers. The board keeps shifting toward tokenized RWAs, tripling to $7.4B, while DeFi spot volume fell roughly 70%. Growth, just not where the hype pointed.
More: Issues · Field Notes · RTFM
New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.
]]>The safest wallet in Bitcoin turned out to have shipped with a broken random number generator in March 2021, and it took five years and 41 minutes for someone to collect. The lesson is not that self-custody is dead; it is that “air-gapped” means nothing when the entropy was compromised before the device ever touched your desk. Everything else this week (Iran’s $4 billion laundry, a supply-chain clipboard swap, another DeFi oracle shortfall) was already priced into the threat model. Coldcard just made people read it.
The week belongs to Coldcard. On July 30 an attacker swept 1,196 Bitcoin addresses in 41 minutes, taking roughly 1,082 BTC worth about $70 million at the time, per Galaxy Research; CoinDesk and others put the running total near $89 million as the sweep expanded to some 4,500 addresses. The root cause is not glamorous: a March 2021 firmware integration error routed seed generation on the Coldcard MK3 to a deterministic software PRNG, producing low-entropy keys that were trivially guessable. The device was never touched. The seeds were doomed the day they were generated. CryptoQuant flagged the aftermath as the largest sub-1 BTC movement since FTX, as spooked holders shuffled coins in a hurry. Do not expect recovery; the stolen BTC is already a candidate for Monero and L-BTC laundering paths.
Separately, MetronomeDAO disclosed a $15.7 million synth shortfall (6,367 msETH and 4.57 million msUSD unbacked), blaming years of accumulated “unbacked float” from Chainlink price-feed latency in its swap module. The treasury staged $34 million in defensive positions to close the gap. Oracle lag is not a hack, but it drains just the same.
No confirmed attribution on the Coldcard sweep yet, though the speed and the immediate pivot toward privacy-chain laundering suggest a prepared, professional operation rather than an opportunist. Predictably, the timeline is already spawning conspiracy theories about the vendor; ignore them until someone shows the block explorer.
The state-actor side stayed busy. Reuters, via The Block, detailed Dubai-based Shelbit moving over $4 billion since May 2024 through a network tied to Iranian gambling sites, the central bank, and the IRGC, including $676 million to Binance in an alleged sanctions-evasion operation. Separately, OFAC sanctioned two Iranian firms, including Hormuz Safe, for accepting Bitcoin as payment for Strait of Hormuz passage. Elsewhere, Storm-2945 (an operational sub-cluster of Midnight Blizzard) ran the CaptiveCrunch campaign, pushing fake browser updates over hijacked hotel Wi-Fi to deliver the CornFlake RAT. The AI-assisted attack trend also matured: a Chinese-speaking actor wired DeepSeek to the open-source Hermes Agent for autonomous attacks on exposed servers, and ESET logged a broader rise in AI-assisted malware.
The Coldcard fallout has a market signature: CoinDesk notes investors are sending BTC back to exchanges, and the incident is being framed as a possible tailwind for ETFs. That is the quiet story. Every self-custody catastrophe is a custody-product marketing budget. Spot Bitcoin ETFs closed July with $172.4 million in inflows but remain $5.3 billion negative year to date, so the funnel is real but not yet a flood.
Macro stayed heavy. Bitcoin slipped to two-week lows as the Fed’s fifth straight hold and 3.7% PCE shut the door on near-term cuts, and the BoJ intervened to defend the yen near 160. Tether posted a $1.5 billion Q2 operating profit even as its excess reserve buffer fell by more than $4 billion. Coinbase missed on Q2 and split Wall Street, while Base sequencer revenue fell despite record volume, a reminder that L2 throughput and L2 profit are different columns.
On the regulatory board, Circle stacked a NYDFS trust charter on top of its federal OCC approval, tightening USDC’s oversight footprint. Minnesota’s crypto ATM ban took effect after roughly $1 million in reported kiosk scam losses, largely from seniors. And the Bank of Italy poured cold water on the stablecoin remittance narrative, finding fiat conversion and payment infrastructure, not blockchain fees, drive most cost and settlement differences. The rails are still the rails, even when you tokenize them.
By the time it is news, it is already priced in. The Coldcard seeds were priced in five years ago. The rest of us just found out this week.
More: Issues · Field Notes · RTFM
New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.
]]>The malware this week did not arrive as a file; it arrived as instructions and let your browser do the assembly. Meanwhile the CeFi graveyard added another headstone, DPRK ran both sides of the crime (stealing funds, then arresting the launderers), and the market spent its energy debating quantum roadmaps instead of reading the withdrawal queues. As always, by the time the token cratered 59%, the exit was already priced in.
The headline number belongs to two Ethereum bridges that lost a combined $31.7 million within hours of each other, with a third protocol halting staking as the contagion spread. Bridges remain the softest target in the stack, and nothing about that has changed in three years.
Elsewhere, crypto payments firm Triple-A was drained for $9.7 million in a wallet compromise. And the slow-motion breach nobody labels a breach continued: BitMart announced it will wind down after nine years, its BMX token cratering roughly 59% in 24 hours while users reported withdrawal delays. The global CEO says he learned of the closure when it went public and was told his employment was ending on July 24. When the people running the exchange find out from the press, the depositors were never going to be first in line.
BitMEX joined the wind-down list with its own legal tail: Arthur Hayes, Samuel Reed, and Benjamin Delo face a proposed class action alleging an “Insider Trading Desk” and deliberate server freezes tied to 623 BTC in liquidation claims. Old allegations, new courtroom, same collateral.
North Korea worked both ends of the table. BlueNoroff was found running an active phishing kit that impersonates Zoom and Microsoft Teams via typosquatted domains, profiling victims’ crypto wallets before delivering malware in ClickFix-style social engineering. At the same time, Daily NK reports the DPRK arrested former state cyber operators accused of hacking two of its own state banks and laundering the proceeds through crypto. The regime tolerates crimes committed for the state, not against it.
Golden Chickens resurfaced with four new malware families (TinyEgg, ChonkyChicken and a modular variant, plus a browser credential stealer), proving that public disclosure inconveniences these operations without ending them.
On the AI-abuse front, a threat actor pointed the open-source Hermes AI agent in unattended “YOLO” mode at Thailand’s Ministry of Finance, letting it hunt for root and traverse the network autonomously. This is the automation of post-exploitation, and it is no longer theoretical.
And a reminder that social engineering, not clever cryptography, is the primary attack surface: Binance now red-teams its own staff monthly against exactly this. They are not being paranoid.
The board is tilting toward real-world assets. On Hyperliquid, tokenized RWAs (stocks, commodities, indices) became the largest trading category for the first time, more than half of weekly volume, prompting ARK to declare a regime change. CoinDesk noted the institutional influx has quietly killed the memecoin craze. In Brazil, farmers tokenized dairy cows to collateralize loans on B3, ten cows backing a $19,600 credit, which is either the future of RWA lending or the most literal bull market on record.
On the regulatory front, the CLARITY Act is on the ropes: Galaxy cut its passage odds to 30% as Senate Majority Leader John Thune signaled it likely misses the August recess, with Democrats rejecting the GOP ethics language. The EU dropped its 21st Russia sanctions package, targeting a claimed $120B crypto network and adding HTX, EXMO, Rapira, and others to a transaction ban starting August 23, while Chainalysis flagged the new third-country ban mechanism. Meanwhile the OCC denied Wise’s national trust charter over AML/CFT concerns, an unusual rejection amid a wave of approvals; Wise plans to refile under the GENIUS Act.
The infrastructure keeps quietly rotting and rebuilding at the edges: Poolin, once Bitcoin’s biggest mining pool, filed for bankruptcy, still owing 11,700 users. Odos and Dango are shutting down. And Samsung Wallet will add stablecoin support including Circle’s USDC, which puts stablecoins on hundreds of millions of phones with no timeline attached. That last one, if it ships, matters more than any price chart this week.
More: Issues · Field Notes · RTFM
New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.
]]>The threat this week did not knock on the door, it filled out an onboarding form. Consensys paid a North Korean developer to work on MetaMask, which is either a hiring failure or a preview of every remote-first company’s next incident report. The exploits that mattered were quiet, the supply chain was busy, and Bitcoin obligingly sold off into a Fed meeting nobody expects to be dovish.
The headline number this week is a recovery, not a loss. The attacker behind the May 7 TrustedVolumes exploit (an RFQ market maker used by 1inch Fusion, drained of roughly $5.87M to $6.7M in WETH, USDT, WBTC, and USDC via a bug in its custom RFQ swap proxy) sent back 1,122.12 ETH, about $2.07M, on July 17. This is the same operator responsible for the March 2025 1inch Fusion V1 exploit. Partial restitution from a repeat offender is not redemption, it is inventory management.
Elsewhere, Dunamu, operator of Upbit, drew a sanctions process from South Korean regulators over a roughly $36M hack, a case complicated by the fact that the Virtual Asset User Protection Act contains no explicit penalty provisions for system breaches. Regulators want to punish something the law forgot to define. A fake exchange also drained over $240K from hundreds of retail victims, the kind of loss that never trends but always recurs.
The DPRK headline is Consensys unknowingly outsourcing developer work on MetaMask to a North Korean operative introduced via a “reputable third-party service provider.” The vetting chain broke exactly where it always does, at the trusted intermediary. In parallel, North Korean actors tied to the Contagious Interview campaign are hiding four-stage OTTERCOOKIE-aligned payloads (a browser-credential and crypto-wallet stealer, plus a file stealer) inside SVG flag images delivered through fake coding tests. The lure is a job, the payoff is your seed phrase.
Supply-chain crews stayed busy. Checkmarx flagged seven malicious Vite npm packages (ViteVenom, an expansion of ChainVeil) using blockchain-based C2 spanning Tron and other chains. SlowMist documented macOS malware that hijacks Telegram sessions and decrypts crypto wallets or phishes recovery phrases via fake apps, while Kaspersky identified a separate framework targeting investors through trojanized GitHub apps. Microsoft meanwhile warns of surging ACR Stealer activity using ClickFix lures to lift browser tokens and Microsoft 365 files. Also billed this week: the Scattered Spider-linked pair sentenced in the UK over a $115M ransom scheme.
Regulators missed their own deadline: US agencies blew past the GENIUS Act one-year mark, issuing 10 proposed rules instead of final ones, with the Jan. 18, 2027 effective date unmoved and the implementation window now compressed. Add USDT facing a two-year countdown on US platforms and OKX Europe offering voluntary USDT-to-USDC conversion under MiCA, and Tether’s regulatory runway keeps shortening. France, for its part, ordered ISPs to geoblock Polymarket on gambling grounds, timed to the World Cup third-place match.
Markets did what macro told them. Bitcoin slid toward $63,000, with the Coinbase premium negative for a record 60 straight days and roughly two-thirds of exchange inflows coming from long-term holders selling at a loss. The proximate trigger was an AI-driven chip rout after Moonshot’s Kimi K3 beat Western frontier models on key benchmarks, dragging risk assets down together. Meanwhile the money kept coming from Wall Street’s side: Citadel Securities put $400M into Crypto.com at a $20B valuation, and ZachXBT picked a fight with Trezor over hardware wallet safety. On the debate about who moves markets, note DOJ is reportedly dropping charges against an alleged $722M Ponzi operator, which tells you more about enforcement priorities than any rule ever will.
More: Issues · Field Notes · RTFM
New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.
]]>The interesting money this week did not move on price, it moved on code that should never have shipped: a Supra oracle that trusted a fabricated update, and two package registries serving malware to anyone who typed npm install. Everyone else spent the week arguing about whether Bitcoin is in the second half of a bear market. Meanwhile the supply chain quietly turned into the attack surface, again.
Bonzo Lend, a lending protocol on Hedera, lost roughly $9 million when an attacker inflated the value of SAUCE collateral and borrowed against it. The root cause was not Bonzo’s contracts but Supra’s on-chain oracle verifier, which accepted a manipulated price update as legitimate. A second wallet borrowed another ~$1 million through the same flaw, then self-identified as a white hat and said it would return the funds. The protocol shed 77% of its total value locked as everyone else did the sensible thing and left. When your solvency depends on a third party’s verifier logic, that verifier is your smart contract whether you audited it or not.
Separately, a long-time Solana holder had 181,000 SOL (about $14.2 million) drained, per ZachXBT. The funds were sold, bridged to Ethereum, and converted into roughly 7,918 ETH, the standard laundering choreography. Billed as the largest single-individual crypto theft on record, though the more useful lesson is the boring one: bridged-and-swapped means the window to freeze anything closed before the news did.
preinstall hook, with builds for Windows, macOS, and Linux. Socket flagged it six minutes after publication, which is fast, and still not fast enough if your CI pulled it in that window.@injectivelabs/sdk-ts@1.20.21 to npm, with fake telemetry that exfiltrated wallet private keys and seed phrases. Two crypto-adjacent supply chain hits in one week is not a coincidence, it is a pattern..env secrets into code. As the industry bolts AI agents onto everything, the attack surface follows.No named nation-state crew claimed this week’s crypto thefts, but the tradecraft speaks for itself. The jscrambler and Injective Labs compromises follow the now-familiar developer-targeting playbook: poison a trusted package, wait for the install hook, harvest keys. This is the same category of attack that has kept DPRK-aligned actors funded, whether or not attribution lands here.
Elsewhere, O-UNC-066 (tracked by Okta) is running voice-phishing that pushes Microsoft 365 users into enrolling attacker-controlled Entra passkeys for data extortion, a reminder that passkeys move the weak link to enrollment, not eliminate it. China-linked Silver Fox deployed a new Rust RAT, MODBEACON, using gRPC streaming for encrypted C2. And on the enforcement side, a Ryuk ransomware operator pleaded guilty in the US facing 15 years, while a jailed launderer was charged with moving $290,000 in court-forfeited crypto from a Kraken account while behind bars. The crypto never sleeps, even when its custodian is incarcerated.
The board shifted on regulation and custody more than on price. Circle won final OCC approval for a national trust bank (First National Digital Currency Bank), eventually to hold USDC reserves under direct federal supervision; the stock popped over 10%. A CBDC ban became US law via the 21st Century ROAD to Housing Act, which Trump declined to sign but did not veto, blocking a Fed digital dollar through 2030.
On flows, US spot Bitcoin ETFs just closed their worst month on record with roughly $4.5 billion of June outflows, and combined BTC/ETH ETFs snapped an eight-week outflow streak with a modest $282 million inflow, recovering about 3% of the $9.46 billion bled over the prior two months. More telling: Bitcoin exchange reserves sit near a seven-year low, and coins leaving the ETF wrapper are not landing on Coinbase or Binance, they are moving to self-custody. Binance’s co-CEO says 70% of EU withdrawals post-MiCA went to self-custody rather than licensed platforms. A custody-preference signal, and given this week’s EU DAC8 registry concerns (France’s tax-clerk-to-kidnapping-gang leak being the cautionary tale), you can see why people prefer keys they hold. Which brings us back to the top of the issue: keys you hold are keys you can also lose to a laser, a poisoned package, or a bad oracle. Pick your counterparty risk carefully, because you never actually escape it.
Security is the one edge the market keeps mispricing. A protocol trades on its TVL and its narrative right up until the afternoon a signer key leaks or a rounding error in a lending contract turns into an eight-figure withdrawal. Then the discount arrives all at once. This publication is built around that gap.
Three things, every week, on a fixed cadence.
Issues land weekly. The roundup: the exploits that drained real money, the wallets and contracts worth watching, and the market or regulatory moves that actually shift the board. If it did not move funds or change the rules, it does not make the cut.
Field Notes land daily. One thing. A theft in progress, an address worth flagging, or a habit that keeps your keys yours. Short enough to read before your coffee cools.
RTFM lands on Wednesdays. Long-form and technical. How custody actually works, how funds actually get stolen, and what the people who do not get drained do differently.
Every claim here is meant to be checkable. Thefts and exploits link to block explorers and incident trackers. Tokens resolve to canonical market-data pages. No screenshots as evidence, no anonymous alpha, no price targets. If we cannot source it, we do not run it.
We do not tell you what to buy. We tell you where the money went and why.
First Issue proper drops next week.
]]>Markets spent 2026 pricing the upside: more ETFs, a friendlier SEC, a White House that does not want to tax your coffee-money bitcoin. The other half of the board, where North Korea drains the better part of a billion dollars a year, is not in any chart. This week handed us both at once, plus a rare reminder that the good ending exists. It is just the exception.
June’s largest single loss was Humanity Protocol, over $30 million. The contracts held. The private keys did not: they had been backed up to a developer machine already carrying malware. Quantstamp flags tooling consistent with North Korean crews, the proceeds moved across Bitcoin, Solana, Hyperliquid, and BNB Chain, and researchers see possible overlap with the Kelp attacker. Your custody is only as strong as the laptop your backups touched.
The month around it, per PeckShield: $75.87 million across 40 incidents, down 7.13% from May’s $81.7 million. The rest of the ledger read like every month before it. Syscoin Bridge for roughly $10 million, a JaredFromSubway MEV bot for $7.5 million, Secret Network for $4.67 million. Bridges, contracts, and stolen keys, in that order, forever.
Chainalysis attributes roughly 76% of 2026 hack losses to state-backed actors, most tracing to Lazarus. Two April jobs set the year’s tone. Kelp DAO lost about $290 million through a LayerZero-based bridge. Drift, Solana’s largest perpetual-futures venue, lost about $285 million in twelve minutes, after a six-month, in-person social-engineering campaign bought the crew admin access. Bridges and people keep breaking faster than cryptography does.
The SEC is signaling a “neutral” posture on crypto ETFs, its investment-management leadership publicly conceding it handled them poorly and lost industry trust. Filings are up to roughly 1,800 this year, about 50% more than last. The President has come out against capital-gains tax on bitcoin used as payment. The access story is being priced in aggressively. The security story is not being priced at all. By the time a breach is news, the discount has already arrived. The keys get priced first.