Web3 Security Weekly Intelligence — October 5–11, 2026
The seed phrase was read off the screen before the buyer ever used the device, and the stolen dollars pivoted to the one stablecoin that has no kill switch — the week's two facts…
#OpSec
Articles tagged OpSec
Deep Analysis: The Seed Phrase That Never Reached the Internet — the Ledger Reseller Supply-Chain Drain, a Full-Chain Review
The wallets were never hacked — they were shipped compromised. A chip behind the screen read the words as they appeared, and the one precaution that matters in self-custody…
Web3 Security Weekly Intelligence — September 28–October 4, 2026
Every dollar lost this week sat in the glue — an allowlist, a Safe module, a hook, a deposit rail — and for the first time in this column's coverage, a public ultimatum brought…
Deep Analysis: The $6M Vault Nobody Owns — the Base wstETH Whitelist Takeover, a Full-Chain Review
Nothing was hacked — a permission list was edited, correctly, by whoever holds the keys. The vault's math was fine; the answer to 'who can change who can borrow' was 'seven people…
Web3 Security Weekly Intelligence — September 21–27, 2026
The week's losses came from the layer above the keys: an exchange backend that could forge transactions, a governance process that could reassign contract admins, and a rollup…
Deep Analysis: The Neutron Governance Takeover and the $9.3M Vote — A Full-Chain Review
Nothing was hacked. A governance proposal did exactly what governance proposals can do — and that was the vulnerability. The contracts worked as written; the vote was the attack.
Web3 Security Weekly Intelligence — September 14–20, 2026
The week's largest loss needed no exploit at all: a list of keys, an app that kept signing with them, and six days in which nobody stopped it. The rest of the damage came from an…
Web3 Security Weekly Intelligence — September 7–13, 2026
A quiet dollar week with a structural alarm: three wrapper backing failures in six days, and a freeze pipeline operating at nearly eight times the week's crime total.
Web3 Security Weekly Intelligence — August 31–September 6, 2026
The week's theme is trust in computed verdicts: cached proofs, collided identifiers and forged claims all let a protocol accept something it should have checked.
Deep Analysis: The Liquid Network Rangeproof Cache Collision — A Full-Chain Review
The largest Bitcoin-sidechain incident of the year traces to a performance optimization from 2016 — cache keys built without length prefixes turned a speedup into a minting press.
Web3 Security Weekly Intelligence — August 24–30, 2026
Price manipulation is August's method, consensus-level rollback is the new containment tool, and the ecosystem's response to thin-collateral lending has not caught up.
Web3 Security Weekly Intelligence — August 17–23, 2026
Governance becomes an attack surface, a shared-infrastructure bug spreads across six chains, and a silent patch process turns a known bug into a countdown timer.
Web3 Security Weekly Recovery & Enforcement Update — August 17–23, 2026
A quiet enforcement week; the expensive decision was procedural — a known bug reported in April shipped as a silent patch in August and was exploited within 20 hours.
Deep Analysis: The Term Finance Governance Takeover — A Full-Chain Review
No code bug, no oracle game, no key leak: six Term Finance vaults were drained through their own governance after an attacker bought a near-empty electorate for roughly 0.5 ETH.
Latest across columns
- Web3 Security Weekly News Review — October 5–11, 2026 · Weekly News Review · 2026-10-12
- Web3 Security Weekly Data Report — October 5–11, 2026 · Weekly Data Report · 2026-10-12
- Web3 Security Weekly Intelligence — October 5–11, 2026 · Weekly Intelligence · 2026-10-12
- Web3 Security Weekly Recovery & Enforcement Update — October 5–11, 2026 · Security Market Intelligence · 2026-10-12