The best of crypto, tech and the open web. Curated by humans.
It's state-sponsored military cyber warfare against normal engineers working from home. Crypto spent billions building multisigs, KMS enclaves, and MPC clusters, but the adversary isn't trying to crack prime numbers. They find one tired DevOps dev on LinkedIn, send a poisoned PDF, and walk straight through the front door with full sudo rights. You can audit your smart contracts fifty times, but the human endpoint is always running zero-day vulnerabilities. Damn, Lazarus is good at breaking people.
@SG2Trader @SpecterAnalyst Likely Lazarus Group (DPRK)
CryptoBilis update We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do: Already using it? Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Not set up yet? Don’t set it up, and never enter your existing wallet backup on it. We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives. On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far. NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it. If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://trezor.io/support#open-chat We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else. For more information, visit our blog: https://trezor.io/blog/news/implant-repo…
By design, a Morpho Blue market can't protect its users: it can't freeze the market to mitigate risk, act on the interest rate curve or implement rate limiting, and it has no Umbrella junior tranche to protect deposits. When an isolated market breaks, its lenders take 100% of the loss. If you're a Morpho user facing an adverse event, they will just tweet and let you sink, as they did during the dozens of vault blowups that led to dire user losses. Ask anyone who was in a curator vault during Stream/Elixir. Users won't trust an infra with real size if it doesn't care about them or support them. That's why, even with infinite VC funding, deployed incentives, a competitor that lost its best contributors and paid partnerships, Morpho only added a pathetic +$2.15B in active loans this year. For comparison, I did as much in one week at the Plasma launch.
A difficult day for the industry. Thinking of everyone affected and the teams working around the clock. For onchain credit, moments like these are a reminder of why market structure matters, especially how risk is managed, shaped and contained. Morpho was intentionally built th…
Picked by the Kiwi community's upvotes. No spam, unsubscribe anytime. What's in it?
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: - temporarily suspended deposits and withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. https://www.binance.com/en/support/annou…
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: https://www.chainalysis.com/blog/binance…
BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen: • $1.45 billion $BTC • $875 million $ETH • $234 million $TRX • $50 million $XAUT • $1.57 billion $USDT • $823 million $USDC • $75 million $WBETH • $88.5 million $RLUSD + $447.5 million additional cryptocurrencies This is the largest hack in crypto history.
Smoking gun. Attacker confirmed as North Korea.
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents. The Bitget exploit was attributed to DPRK-linked Traide…
By the way, in case anyone was still wondering whether they are completely useless, Binance holds SOC 2 Type 2, ISO 27001, and several other certifications.
Seeing rumors blaming EIP7702 for the Binance hack. From what I can see EIP7702 was just used to preform the hack efficiently but was NOT the root cause.
INTEL: Binance incident escalates from an EIP-7702 delegation exploit to a potential compromise of Binance 16 signing key
🚨995 Polymarket accounts just got drained through Polymarket's own website. Let me explain how, because this one should scare everyone in crypto. No fake link. No shady airdrop. These people were on the real Polymarket dot com on Thursday. Polymarket's site loaded a script from DebugBear, a tool whose only job is measuring how fast the page loads. Somebody poisoned it. Once it was running in your browser, it grabbed your logged-in trading session and started dumping every open position you had, first at 3% under market, then at half price, then at the lowest price possible. Then it swapped the whole balance into POL and shipped it to the attacker. Stablecoins can be frozen. POL can't. It even reported back after every hit. Your wallet, your country, your portfolio size, whether the transfer went through. All of it sent home through DebugBear's own data endpoints. The attacker's wallet went from empty to $2M in about 45 minutes. Conor Grogan's final count was $2.65M. One trader said he lost $800K and watched every position get sold. His friend got hit for $600K. Polymarket flipped the exchange to cancel-only, paused the relayer and says everyone will be made whole. Credit where it's due. But this is the third time this year. About $700K in May. About $3M in June, through a hacked third-party script, same as now. I've been phished. I've been drained. Stay in crypto long enough and it happens to you. But the people on Thursday did nothing wrong. They opened the right website. Not one of these three hacks touched a smart contract. We spent ten years making the blockchain unbreakable and then let a page speed tracker sit right next to people's money.
