Today’s Field Note

Two former Robinhood engineers were charged with front-running the exchange’s own token listings, allegedly netting over $50,000 each by buying Hyperliquid perpetuals ahead of announcements. It is a small dollar figure but a clean reminder that “pre-listing information leak” is a real, prosecutable threat model, and that perp venues are where insiders now express it. Separately, CVE-2026-5430, a critical (CVSS 9.8) JWT signature-verification bypass in WSO2 API Manager, is under active exploitation, letting unauthenticated attackers forge admin tokens for account takeover. If any part of your stack (custody, exchange, or internal tooling) fronts WSO2, treat this as live. Both stories point the same direction: the soft target is identity and access, not the chain.

Today’s Move

  • Patch WSO2 API Manager now for CVE-2026-5430, then hunt logs for forged admin JWTs and anomalous token issuance dating back weeks, not days.
  • If you run WooCommerce Wholesale Lead Capture, pull it or update immediately; unauthenticated file upload to PHP web shell is being exploited across 6,000+ installs.
  • Builders listing tokens: lock down pre-announcement access, watch for related-party positions on Hyperliquid and other perp venues around your listing windows.
  • Update Pixel devices to the September 2026 patch (CVE-2026-58704 modem flaw is under limited targeted exploitation); rotate any keys held on affected phones.
  • Ignore the Clarity Act price noise. Nothing structural changed; do not let a $570M liquidation cascade drive your key management decisions.

Resources

  • https://www.coindesk.com/business/2026/09/16/two-robinhood-engineers-charged-with-insider-trading-using-hyperliquid-perpetuals
  • https://thehackernews.com/2026/09/active-exploitation-attempts-target.html
  • https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html
  • https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.