Web3 Security Weekly News Review — October 5–11, 2026
A hardware wallet's distribution channel — not its chip — leaked the seed phrases of hundreds of users for the better part of $90M, and the stolen stablecoins went straight for…
#Custody
Articles tagged Custody
Web3 Security Weekly Data Report — October 5–11, 2026
The week's number was one incident: a reseller channel that leaked seed phrases for the better part of $86M. Strip it out and the other five events total under $14M — the same…
Web3 Security Weekly Intelligence — October 5–11, 2026
The seed phrase was read off the screen before the buyer ever used the device, and the stolen dollars pivoted to the one stablecoin that has no kill switch — the week's two facts…
Web3 Security Weekly Recovery & Enforcement Update — October 5–11, 2026
A ~$10M freeze met a same-day escape hatch, the DOJ put a nine-figure forfeiture on paper, and a payments firm asked a federal court who actually controls a stablecoin — the week…
Deep Analysis: The Seed Phrase That Never Reached the Internet — the Ledger Reseller Supply-Chain Drain, a Full-Chain Review
The wallets were never hacked — they were shipped compromised. A chip behind the screen read the words as they appeared, and the one precaution that matters in self-custody…
Web3 Security Weekly News Review — September 28–October 4, 2026
A vault with no named owner lost $6M to a whitelist entry, a swap protocol got its $3.8M back in 36 hours with a public ultimatum, and the exchange breached for $387.5M finished…
Web3 Security Weekly Data Report — September 28–October 4, 2026
The series snapped back 40x after the Bitget week — and every dollar of it sat in the glue: an allowlist, a Safe module, a hook's shared unlock, a deposit rail. Not one core…
Web3 Security Weekly Intelligence — September 28–October 4, 2026
Every dollar lost this week sat in the glue — an allowlist, a Safe module, a hook, a deposit rail — and for the first time in this column's coverage, a public ultimatum brought…
Web3 Security Weekly Recovery & Enforcement Update — September 28–October 4, 2026
The first complete recovery this column has recorded — identification, publicity and a 48-hour clock — alongside a compensation market that now has its own tradable claim tokens…
Deep Analysis: The $6M Vault Nobody Owns — the Base wstETH Whitelist Takeover, a Full-Chain Review
Nothing was hacked — a permission list was edited, correctly, by whoever holds the keys. The vault's math was fine; the answer to 'who can change who can borrow' was 'seven people…
Web3 Security Weekly News Review — September 21–27, 2026
A $20K governance vote took over a chain's applications, an exchange lost $387.5M without a single private key being stolen, and the costliest month of 2026 got that way in seven…
Web3 Security Weekly Data Report — September 21–27, 2026
One exchange breach carries 95% of the largest weekly loss this site has recorded — and the same week produced the cheapest large theft yet: a $20K governance vote.
Web3 Security Weekly Intelligence — September 21–27, 2026
The week's losses came from the layer above the keys: an exchange backend that could forge transactions, a governance process that could reassign contract admins, and a rollup…
Web3 Security Weekly Recovery & Enforcement Update — September 21–27, 2026
The freeze lever caught 0.08% of the year's largest theft, a chain halt caught $2.2M the same week, and the KelpDAO–LayerZero dispute moved from the timeline to a courtroom.
Web3 Security Weekly News Review — September 14–20, 2026
Two signing keys drove the week's damage — a prepared list worked for six days, and a bridge minted from a compromised key — while the other failures shared one shape, a check…
Web3 Security Weekly Data Report — September 14–20, 2026
Losses rose 8.8x on five events, three quarters of it running on signing keys — a six-day wallet drain and a bridge minted from a compromised key — while a separate ~$4.3M of…
Web3 Security Weekly Intelligence — September 14–20, 2026
The week's largest loss needed no exploit at all: a list of keys, an app that kept signing with them, and six days in which nobody stopped it. The rest of the damage came from an…
Web3 Security Weekly Recovery & Enforcement Update — September 14–20, 2026
Enforcement stayed small and unattributed, the largest loss of the week left 1.44M XRP (~$2.05M) sitting in the operator's own wallets, and the containment ledger shows what…
Deep Analysis: The Safe Module Authorization Exploit and the MEV Race — A Full-Chain Review
The wallet's cryptography was never broken. A module the owner had already whitelisted accepted instructions from anyone, moved a $7.7M position, and then lost the proceeds to a…
Web3 Security Weekly News Review — September 7–13, 2026
A quiet dollar week with a loud pattern: three unbacked-mint failures on Bitcoin wrappers in six days, two settlement-layer checks that were never made, plus Tether's $39.27M…
Web3 Security Weekly News Review — August 31–September 6, 2026
The largest Bitcoin-sidechain incident of the year defines the week: 3,998.5 unbacked L-BTC minted via a cache-key collision, pegged out within minutes, mostly returned on-chain…
Web3 Security Weekly Data Report — August 31–September 6, 2026
A dual-basis report: the largest single event of the year ($320M gross, ~$272M returned) sits on top of a busy protocol tail (~$11.6M).
Web3 Security Weekly Intelligence — August 31–September 6, 2026
The week's theme is trust in computed verdicts: cached proofs, collided identifiers and forged claims all let a protocol accept something it should have checked.
Web3 Security Weekly News Review — August 24–30, 2026
10 events; ~$33.8M realized; two price-manipulation lending attacks define the week and the month — plus a chain rollback that reversed $111.2M.
Web3 Security Weekly Data Report — August 24–30, 2026
~$33.8M realized losses across 9 loss events (plus one data breach tracked separately), up 52% week-over-week; price manipulation dominates and a rollback changed what the…
Web3 Security Weekly Intelligence — August 24–30, 2026
Price manipulation is August's method, consensus-level rollback is the new containment tool, and the ecosystem's response to thin-collateral lending has not caught up.
Web3 Security Weekly Recovery & Enforcement Update — August 24–30, 2026
The week's biggest recovery story was a rollback, not a return: consensus-level containment reversed $111.2M of the Tectonic borrow, while a card protocol promised full refunds to…
Latest across columns
- Web3 Security Weekly News Review — October 5–11, 2026 · Weekly News Review · 2026-10-12
- Web3 Security Weekly Data Report — October 5–11, 2026 · Weekly Data Report · 2026-10-12
- Web3 Security Weekly Intelligence — October 5–11, 2026 · Weekly Intelligence · 2026-10-12
- Web3 Security Weekly Recovery & Enforcement Update — October 5–11, 2026 · Security Market Intelligence · 2026-10-12