Web3 Security Weekly Intelligence — October 5–11, 2026
The seed phrase was read off the screen before the buyer ever used the device, and the stolen dollars pivoted to the one stablecoin that has no kill switch — the week's two facts…
Structured weekly research answering five fixed questions about the Web3 security landscape.
The seed phrase was read off the screen before the buyer ever used the device, and the stolen dollars pivoted to the one stablecoin that has no kill switch — the week's two facts…
Every dollar lost this week sat in the glue — an allowlist, a Safe module, a hook, a deposit rail — and for the first time in this column's coverage, a public ultimatum brought…
The week's losses came from the layer above the keys: an exchange backend that could forge transactions, a governance process that could reassign contract admins, and a rollup…
The week's largest loss needed no exploit at all: a list of keys, an app that kept signing with them, and six days in which nobody stopped it. The rest of the damage came from an…
A quiet dollar week with a structural alarm: three wrapper backing failures in six days, and a freeze pipeline operating at nearly eight times the week's crime total.
The week's theme is trust in computed verdicts: cached proofs, collided identifiers and forged claims all let a protocol accept something it should have checked.
Price manipulation is August's method, consensus-level rollback is the new containment tool, and the ecosystem's response to thin-collateral lending has not caught up.
Governance becomes an attack surface, a shared-infrastructure bug spreads across six chains, and a silent patch process turns a known bug into a countdown timer.