Security

The wallet maker says a flaw in an order-tracking plug-in leaked names, phone numbers and shipping addresses over 14 months. A seller is now advertising the file.

ShipMonk incident exposed names and contact details of recent customers in seven countries; Trezor says its devices and systems were not compromised.

A firmware bug that shipped in 2021 made Coldcard seeds guessable, and attackers have drained more than 1,800 BTC since Thursday. The latest sweep can still be outbid in the mempool, giving some victims a window to rescue their coins.

A contractor brought in through a third-party provider worked on MetaMask code from March until Consensys cut off access in April and paused product releases. The company says it found no stolen assets, exposed data or malicious code.

Thai police made two arrests as Interpol's 97-country sweep logged 5,811 arrests and $293 million in intercepted assets.

Web3 security incidents cost the industry more than $1.31 billion across 344 events in the first half of 2026, according to CertiK's Hack3D H1 2026 Report, published Monday. Net losses stood near $1.2 billion after frozen and recovered funds, the blockchain security firm said. Headline totals show…

THORChain developers announced that one of six Asgard vaults was compromised, resulting in approximately $7.4M in unauthorized outbound transactions before the network halted signing activity.

LayerZero Labs acknowledged a Lazarus Group attack on internal RPCs and a multisig signer's unauthorized personal trade, impacting 0.36% of assets on the protocol.

The Security Council has been in the spotlight in recent weeks after its decision to freeze over 30K ETH connected to the Kelp bridge exploit.

Analysis of 2,665 LayerZero OApp contracts shows nearly half rely on single-validator security configurations, the same setup that exposed KelpDAO's rsETH to exploitation.