News
Analysis: What the Coldcard Flaw Means for What a Hardware Wallet Actually Guarantees
A hardware wallet makes three promises. The Coldcard entropy failure broke the one nobody thought to verify — and the one a…
Published work
News
Analysis: Key Compromise Has Overtaken Contract Exploits as Crypto’s Main Loss Driver
Wallets and key infrastructure accounted for 54% of July's losses. Across our own 25-record tracker, key compromise is already the largest attack…
News
July 2026 Crypto Losses Reach $210m Across 30 Incidents, Nearly Triple June
Monthly loss tallies put July 2026 at roughly $210m across 30 major incidents, up 177% on June. Wallets and key infrastructure —…
News
Coldcard RNG Flaw: Coinkite Discloses Five-Year Entropy Failure After Mass Bitcoin Theft
A 2021 firmware change routed Coldcard seed generation through a software pseudorandom generator instead of the hardware RNG, cutting entropy from 128…
News
Oracle Manipulation Hits AFX, Ostium and Bonzo in Clustered July Attacks
More than $57m was reported lost across three protocols to price-feed manipulation in July — the same failure mode, three times, in…
News
BonkDAO Governance Bypass Reported at $21.2m
A governance bypass at BonkDAO was reported to have moved $21.2m — the fourth governance-path failure in our records, and the same…
News
Bridge Validation Failures at Wanchain and Verus Reported at $20.5m
Two more cross-chain bridges failed on message validation in July, taking a reported $20.5m combined — the fifth and sixth bridge validation…
Signing interface compromise
Bybit Cold Wallet Compromise, February 2025: What Happened & What to Check
Around $1.5 billion in ETH was moved out of a Bybit cold wallet on 21 February 2025 during a routine transfer. The…
Key compromise
Radiant Capital Signing Compromise, October 2024: What Happened & What to Check
Malware on three developers' devices produced hardware-wallet approvals that looked legitimate, taking roughly $50m.
Key compromise
WazirX Multisig Compromise, July 2024: What Happened & What to Check
Approximately $234.9m was taken from a WazirX multi-signature wallet held under a third-party custody arrangement.