Short, tactical, daily. The weekly Issues are the verdict — these are the ticks in between.
-
Polymarket bleeds $2.7M through a hijacked third-party script while a dozen Name.com-registered DeFi sites get frontend-swapped, and the Binance launderers are now borrowing ETH against stolen collateral.
-
North Korea drained $6.3B from Binance via a compromised dev laptop and an EIP-7702 delegation trick, while Chainalysis got breached and a tainted Trezor Safe 5 surfaced in the supply chain.
-
Binance lost $6.3B via a compromised DevOps laptop, withdrawals are paused, and the attacker is dumping low-liquidity tokens onchain.
-
An Ethereum client flaw tied to a compromised Indian cert firm sent devs scrambling, while a Wagyu leak deanonymized Monero swappers and an address-poisoning crew bagged $50K in USDT.
-
A Zilliqa bridge exploit, an Avalanche tranche vault drain, and a Bithumb internal breach define the day's real losses.
-
Keystone's device verification key is in attacker hands, SlowMist found address-swapping malware in Udesk scripts, and a Bloom trading bot bled $953K across 48 wallets.
-
A hardware wallet key theft, an Ethereum signing advisory, and a Bitcoin wallet bug all demand hands-on-keys action today.
-
The X100 governance takeover drained ~$4.85M and is laundering through ETH while Electrum patches a wallet flaw that already cost one user funds.
-
Initia halts its L1 and rollups after a mint exploit drains ~$2.6M, dragging AUSD and a bridge adapter into the blast radius.
-
Fake Rabby and OKX wallet extensions on Firefox harvested seed phrases, Swell paused swETH redemptions over a NAV problem, and an x402 SDK flaw let malicious APIs drain AI agent balances.
-
Railway secrets breach already costing crypto devs real money, while LiteLLM's poisoned release and three max-severity RCE bugs round out a brutal day for the supply chain.
-
The Drift exploiter is laundering through Tornado Cash in size, and there is a PHP RCE patch landing today that anyone running a node or backend should treat as urgent.
-
Live software supply-chain and wallet-key risks (OVHcloud CLI backdoor, Qubic seed recovery), plus a reminder that the Drift thief is still moving $295M of DPRK loot.
-
Qubic halts its chain after a weak-seed attacker drains 1.4K wallets, while Cysic's bridge gets minted into oblivion for $727K.
-
Cysic's bridge minted 10M CYS out of thin air and some of it hit the market before anyone noticed.
-
A $3.8M NEAR Intents exploit, Ledger supply-chain implants from two more resellers, and an active npm shellcode loader are the day's real threats.
-
Two live chain exploits (Pirate Chain, Osmosis bOSMO) mint tokens out of thin air while holders are told to sit still.
-
Ledger confirms an organized wallet-tampering ring in Asia, and HashKey Chain admins hot-swapped a USDT contract via three-of-five multisig.
-
Ledger halts Asian resales over device tampering while a curl client-side RCE and an Ivanti zero-day hit the tooling builders actually run.
-
Ledger confirms an LTE spy chip in CryptoBilis-sold hardware wallets reads your seed off the screen during setup, roughly $86M suspected drained, and a THEO bridge exploit on Base cratered the token 92%.
-
Ledger's CryptoBilis supply-chain implant spreads to the EU, an XRP overflow bug nearly minted 18 trillion coins, and a maxed-out GitLab RCE lands.
-
Ledger confirms a hardware implant in a reseller device with losses past $86M, while Coldcard's X account spat out a seed-phrase phishing link.
-
Compromised Ledger devices from reseller CryptoBilis drained $72M to $86M, with funds now laundering through USDD and Tornado Cash.
-
Two fresh critical NetScaler RCE bugs and a GoBalance key-recovery flaw mean your remote-access and onion infrastructure is the soft target today.
-
Malicious Firefox wallet extensions and a compromised tensorlake npm package are actively stealing keys and secrets, while the 'bunker mode' panic is mostly noise.
-
Cardano hands token issuers freeze-and-seize powers, and a Tether freeze lawsuit shows what that looks like in practice.
-
ZachXBT fronted $349,700 to infiltrate a Chinese laundering network moving Lazarus funds, and two self-hosted tooling flaws (Atlassian, LibreOffice) give attackers quiet code and file access.
-
Treasury exposes a $2M Hamas crypto fundraising network, and a Citrix NetScaler zero-day is under active exploitation.
-
North Korea tied to the $387M Bitget hack as Near Intents claws back $3.8M via public threat.
-
Arbitrum hits the emergency brake on Stylus, Blast schedules its own funeral, and NK is still winning.
-
Core Lightning nodes under active attack, FortiMail zero-day exploited in the wild, and a NEAR Intents drainer gets a 48-hour clock.
-
MetaMask's infrastructure compromise is spooking DeFi while Bitget confirms a third-party zero-day drained $387.5M.
-
Bitget's $387.5M breach traces to an August 31 zero-day in third-party security tooling, and the launderers are now feeding funds through Zcash's shielded pool.
-
A drainer-fund story, an MCP OAuth flaw, and a HSM impersonation attack are the only things worth your attention today.
-
Fake GIWA bridge drains 766 ETH, a Robinhood Chain rug nets $18.4M, and Zano rolled back a month of chain history after a Gateway Address exploit.
-
Two Citrix NetScaler zero-days are under active exploitation with no patch, and a compromised GitHub Actions supply-chain payload is still live.
-
Bitget bleeds $387.5M to a suspected Lazarus operation, and legacy Magic Eden approvals become an active drain vector.
-
Bitget bled $351.6M from hot wallets to a suspected DPRK crew, and an old Limit Break contract is being drained of NFTs live on Ethereum.
-
Nothing on-chain today rises above phishing sentencing and market noise, but a WordPress RCE under mass exploitation and a placeholder-domain ClickFix trap are the real operational threats to crypto builders.
-
North Korea's WaterPlum crew drains $11M via fake job interviews, a malicious App Store app steals $580K, and Zcash's NU7 upgrade threatens to strand legacy Sprout funds.
-
A Coldcard exploit is still live, white hats scrambled 52 BTC into a recovery trust, and a stealthy npm package is targeting builders' machines.
-
A Fetch.ai/NuNet $2M exploit, a WaterPlum developer-malware campaign, and live npm supply-chain abuse all point at the same target this week: builders.
-
A live iOS full-chain exploit is draining wallet keys from Safari, and North Korea's WaterPlum moved $10.7M in stolen crypto.
-
A self-inflicted drainer campaign, a stablecoin depeg with a tranche wipeout, and a custody-provider breach dominate the day.
-
DPRK-linked npm stealers and a hijacked IOG YouTube channel are the day's live threats, both aimed at builder machines and Cardano holders.
-
Revolut breach turns on-chain wealth into a targeting list, while DPRK and Iran industrialize blockchain as malware infrastructure.
-
Robinhood insiders front-ran token listings via Hyperliquid perps, and a WSO2 JWT bypass is being actively exploited for admin takeover.
-
Cisco email gateway zero-day and a critical VMware vCenter RCE are both under active exploitation, while CoinEx announces an orderly shutdown with withdrawals open until December.
-
Symbiosis bridge exploit mints 46.1B syBTC from thin air, and Revolut's breach hands attackers passports and selfies now being leaked daily.
-
Revolut coughed up passports and full Bitcoin transaction histories to a fraudster spoofing a government email domain, and ZachXBT thinks HNW users were the target.
-
Blockstream refuses ransom on the Liquid exploit, GitLab ships a CVSS 10 file-read bug already being probed, and JFrog Artifactory flaws are being chained for backdoors.
-
Trezor confirms 347K subscribers phished via a Brevo breach, and Blockstream refuses ransom on 600 BTC still held from the Liquid exploit.
-
Trezor's email vendor got popped and is now spraying 'STM32 Entropy Vulnerability' phishing from Trezor's real domain, while OFAC sanctions the Xinbi laundering marketplace.
-
A self-hosted Lightning wallet flaw and an active Chrome zero-day are the only things worth your attention today.
-
Cronos rolled back its own chain to reverse a $111M Tectonic exploit, Liquid whitehats returned $270M in BTC, and Adobe patched an actively exploited Magento 10.0.
-
Liquid Network paused after a $320M 'white hat' withdrawal via an Elements bug, while the Coldcard third-wave thief starts laundering 1,779 BTC.
-
EtherHiding on BSC, a Trezor customer data leak, and a $7M custody gap at Orionx are today's real signals.
-
A live Citrix NetScaler auth bypass and a PaperCut RCE chain are both being exploited in the wild while a Postgres replication-role flaw sits waiting to be found.
-
Trezor's shipping vendor breach widens by 67,000 US customers while a Chrome V8 zero-day is under active exploitation, both feeding straight into wallet-draining workflows.
-
Coldcard thief launders BTC through THORChain while Lazarus runs $30M through Hyperliquid, and Shai-Hulud's npm worm now scans 469 credential paths.
-
Tether froze $42.4M USDT months before any US warrant, and a Thai pig-butchering crew is suing over it, a reminder of what 'your keys' doesn't cover.
-
A $74M price-manipulation exploit on Cronos-based Tectonic halted a whole chain, while Lazarus-linked wallets openly launder $30M through Hyperliquid.
-
Cronos halted its entire chain after a $75M Tectonic exploit, while More Markets bled $9.3M through an Ankr LST and E-mode borrow trick.
-
Two Cosmos-adjacent disasters in one day: a $5.7M six-chain hack Cosmos Labs wrongly cleared, and Fogo halting mainnet after an attacker got 10% of circulating supply.
-
A known-vulnerable Cosmos EVM module got exploited across six chains, and an outdated Rain contract cost Solana neobank users half a million dollars.
-
Nineteen malicious browser extensions drained wallets while the real Fed news was Warsh refusing to blink on rate cuts.
-
Moonwell bled $8.7M to a MAMO oracle manipulation on Base, and Lightning node operators face an emergency patch cycle after AI-found bugs.
-
Active exploitation of a critical Gitea RCE (CVE-2026-60004) and a second unsafe-deserialization pair in Kaltura's mwEmbed threaten the self-hosted infrastructure crypto teams quietly run.
-
Galaxy pegs Coldcard hack at 1,789 BTC, and a max-severity Oracle WebLogic bug is under active exploitation.
-
Term Finance bled $8.5M when an attacker bought governance power and drained the Meta Vaults, a reminder that on-chain votes are an attack surface.
-
The Sandbox bridge got hit, minting unbacked SAND on Base and BSC while Korean exchanges slammed the doors.
-
A $3M BounceBit exploit kills a chain, MANTRA freezes after a Cosmos EVM fault, and Coldcard patches a $130M-class seed flaw.
-
MANTRA halts its chain after a Cosmos EVM exploit, and Coldcard tells users their existing seeds may already be compromised.
-
Two live wallet-drainer campaigns (40 malicious Firefox extensions and a Rapid7-tracked SMS phishing operation) are actively hunting seed phrases while everyone watches the short squeeze.
-
MAYAChain halted after six chained bugs let a 23-message transaction drain the pools, and 200K Bits of Gold customers had their data leaked.
-
BitBox and SafePal both cough up hardware wallet trouble on the same day, one firmware, one data leak.
-
SafePal wallet breach exposes 39,798 customers to physical and phishing risk while Harmony floats another chain rollback after the ONE exploit.
-
Two data leaks tie real names to real crypto stacks, and a fake DefiLlama app on Apple's own store was draining wallets.
-
A Privy security incident hits Kraken-linked wallets, Coldcard-related BTC thefts near $150M, and a French tax breach exposes 678,000 people as physical attacks climb.
-
Neutrl halts NUSD redemptions over an undisclosed reserve problem, and Tether's KPMG audit ships without the actual statements.
-
Harmony ONE cracks 40% on an alleged 4B-token mint, Trezor buyer data leaks via a shipping partner, and a SharePoint auth bypass is now under active exploitation.
-
Harmony's ONE minted into oblivion, Ravencoin faces a 51% reorg, and a small XRP bridge got fooled by fake deposits.
-
A Ravencoin block flaw, a drained BTCPay server, and a possibly insolvent BitMart converge on the same lesson: your funds are only as safe as the code and custodians holding them.
-
Coinsbuy loses $8M in a coordinated two-chain hit, and a malicious 'Solidity Pro' VS Code extension is draining dev wallets and keys.
-
Attackers are draining BTCPay Server Lightning nodes via remote access, and the Coldcard exploit is still pulling institutional money into ETFs.
-
BTCPay Server has a live, actively exploited flaw draining Lightning nodes, and a macOS ClickFix stealer is emptying crypto wallets.
-
The Coldcard exploit has moved from disclosure to on-chain reality, with 210,000 BTC fleeing old wallets and a French tax leak turning holder lists into physical threats.
-
A twelve-year-old weak RNG in CryptoJS drained $5.7M from five wallet apps, while the Coldcard thieves start washing 64 BTC and 200 ETH through mixers.
-
A Coldcard entropy flaw put roughly $120M and every seed generated on affected units in play, while a Gitea file-read bug and CISA's Langflow RCE round out a rough day for anyone running their own stack.
-
The Coldcard sweep is live, losses past $100M and climbing, and phishing operators are already surfing the panic with fake 'hardware audit' emails.
-
Coldcard hardware wallet drains near $114M and enter a suspected fourth sweep, five days in.
-
A 2021 Coldcard firmware bug crippled seed entropy, and someone spent it, sweeping ~1,082 BTC (~$70M, now near $89M) from 4,500 addresses in minutes.
-
Coldcard drain hits $70M via a supply-chain style exploit that never touched the devices, plus Metronome's $15.7M oracle-lag shortfall and the Adform clipboard-swap campaign.
-
A weak-RNG flaw in Coldcard Mk3 firmware drained 594 BTC ($38M) from ~500 addresses in a 25-minute sweep, and the vendor confirms it.
-
Ostium's $24M off-chain breach and a fake Flare staking site draining $8.5M in XRP prove the perimeter is you, not the contract.
-
Two live software supply-chain compromises plus an Apple-listed fake wallet that drained $1.8M, all pointing at the same failure mode: trusting the store.
-
A fake Sparrow Wallet on Apple's App Store drained $1.8M in BTC, while BitMart and BitMEX wind-downs leave user withdrawals in limbo.
-
SparkKitty photo-scraping malware and a fresh n8n sandbox escape land the same day Triple-A eats an $11.8M treasury breach, while BitMart withdrawals stall on the way out the door.
-
Two Ethereum bridges bled $31.7M in hours while a browser-built malware campaign impersonates Solana and TradingView to drain retail traders.
-
A North Korean phishing kit fingerprints your wallet before it drops malware, while Fastjson 1.x eats unauthenticated RCE with no patch in sight.
-
Odos is winding down with a hard July 30 withdrawal deadline, and a fresh batch of exploitable flaws (Redis RCE PoCs, NodeBB, ChatGPT AgentForger) landed the same day.
-
Two bridge exploits drained $35M across Bitcoin and Ethereum, with Verus hit through the same flaw class it ignored in May.
-
Zilliqa's Ledger app leaked private keys onchain since 2019, and a Wanchain bridge breach hit Cardano's Midnight token.
-
A hijacked npm package, live PAN-OS and ServiceNow exploitation, and WordPress wp2shell mean the machines your keys live on are the actual attack surface today.
-
Allbridge halts after a $1.65M flash loan exploit, and Zilliqa freezes ZIL exchange-wide over a compromised partner cold wallet.
-
Two live RCE flaws with public exploits and a stealer surge mean the threat this week is your machine, not your chart.
-
Two live supply-chain campaigns (ViteVenom npm, OtterCookie SVG fake-interview lures) are hunting crypto wallets on developer machines right now.
-
A macOS Telegram-session stealer targets crypto wallets while ClickFix ACR Stealer harvests browser tokens, both trading on human clicks rather than broken cryptography.
-
Ostium's oracle signer key got stolen and drained up to $18M, the second oracle/keeper exploit in a week after SummerFi.
-
Two live zero-days at SonicWall and a Cursor RCE that runs code the moment you open a repo, plus a poisoned @asyncapi npm chain.
-
Humanity Protocol loses $36M to social engineering as researchers show 85 wallet extensions leak your addresses.
-
CISA flags two 10.0-severity Joomla zero-days under active exploitation while three Microsoft 365 phishing kits surface, a bad week for anyone with credentials worth stealing.
-
A $9M oracle exploit gutted Hedera's Bonzo Lend while a poisoned jscrambler npm release quietly shipped an infostealer to every install.
-
Injective Labs' npm SDK was backdoored to steal wallet keys, Bonzo Lend lost $9M to a Supra oracle exploit on Hedera, and a Solana whale lost 181K SOL.
-
Two live wallet-drain stories today: the Coinspect 'Ill Bloom' weak-entropy seed flaw, actively swept, and a Ledger-disclosed laser attack on Tangem cards.
-
A $999,999 USDT approval-phishing drain and a Hong Kong regulatory mandate both point at the same weak spot: signature hygiene.
-
A signed-commit forgery in GitHub's 'Verified' badge and a batch of actively exploited max-severity flaws (ColdFusion, Langflow, UniFi) are the real hazards today; the market noise is just oil.
-
A governance attacker turned $4.4M into $21.2M by buying enough BONK to pass a malicious treasury proposal, while a trader ate a $2M same-block backrun on a route they never checked.
-
Summer.fi's Lazy Summer vaults drained for $6M via a flash loan redemption exploit, and a max-severity ColdFusion bug is under active attack.
-
A fake Maccy clipboard app ships PamStealer on macOS, and Moonbeam is forcing GLMR holders to bridge off Polkadot to Base by July 31.