security

According to Bitcoin News, the Chief Technology Officer of BlueWallet stated that they screened 904 iOS applications labeled as non-custodial cryptocurrency wallets in the App Store and analyzed 494 of them, ultimately marking 45 as potentially having serious or high-risk security issues, with 23 being of potential serious risk and 22 being high risk.The issues mainly include suspected uploading of mnemonic phrases or private keys to servers, insufficient randomness in generated wallets, storing keys on the server side, using hard-coded encryption keys, and loading unsigned JavaScript code that can interact with sensitive wallet data. The Chief Technology Officer of BlueWallet cautioned that the analysis results may contain false positives, and applications not appearing on the list are not necessarily safe. When it comes to storing large amounts of Bitcoin, merely passing the App Store review and the application's reputation are not sufficient grounds to trust the software.

Electrum has released version 4.8.2, which includes multiple security fixes and enhances the security of the Bitcoin wallet codebase. The related fixes are based on reports from researchers such as Bitcoin Red Team, Calle, l0rinc, haoxucu, and m0wer.This version addresses a critical backup issue affecting some Lightning wallets that use non-deterministic keys and anchored channels. Previously, the channel backups and full wallet backups of affected wallets may have lacked the keys necessary to transfer funds on-chain after a remote force close request; affected users will receive a warning when starting Electrum and should export a new backup, as the old backup cannot correctly restore funds in this scenario.This version also strengthens Lightning HTLC verification, rejects previously acceptable format errors in xpub/xprv keys, expands the scope of codebase security enhancements, and prevents the Android QR code scanner from reading screenshots. This is the third security-focused version release of Electrum since July, following versions 4.8.0 and 4.8.1.

Solana Mobile posted on platform X that its third-party marketing email service provider Brevo experienced a security incident affecting some customer accounts, including Solana Mobile. The team discovered unauthorized access to its Brevo account, has disabled the account, and is working with Brevo to understand the extent of the accessed information.Solana Mobile stated that, as far as they know, no emails have been sent from their account, but they are continuing to verify. They also remind users that Solana Mobile will not ask for mnemonic phrases, private keys, or wallet recovery information.

According to SlowMist monitoring, the BSC chain project BeatXswap suffered a price manipulation attack, resulting in a loss of approximately 2.985 million BTX (about $77,500).The attacker borrowed 6 million BTX through a flash loan and sold it into the Uniswap V3 pool to lower the price. They then exploited a vulnerability in the contract that used only the V3 pool's instant price as the sole pricing basis (without TWAP protection and without deviation limits), depositing USDT in two transactions to trigger liquidity mining and withdrew BTX from the LP position.

The blockchain project Quantus announced the launch of its PoW mainnet using post-quantum cryptography, which incorporates the ML-DSA-65 and ML-DSA-87 digital signature mechanisms. The total supply limit of the native token QTC is 21 million, and PoW mining has been open since the launch.

NVIDIA co-founder and CEO Jensen Huang stated on Thursday at the Goldman Sachs Technology Conference in San Francisco that cybersecurity is likely to become the next major use case for artificial intelligence.Huang mentioned that cybersecurity is the next big market for artificial intelligence, and advancements in this technology will disrupt an industry aimed at protecting computer systems.

Bitcoin ZK Rollup Citrea posted that after a comprehensive review, ctUSD, USDC, USDT, WBTC, and CTR cross-chain services have been restored, and some Solver-based routing is still being gradually restored.Previously, a security incident occurred with the third-party application Zentra Finance, and the team has confirmed the root cause and suspended the relevant contracts. Citrea stated that its protocol and cross-chain bridge contracts were not affected and will disclose the impact of the incident on ecological projects such as ctUSD Earn Vault and depositors separately.

According to Bloomberg, cryptocurrency hardware wallet manufacturer Ledger SAS announced the appointment of Oded Blatman as Chief Information Officer (CIO) and Chief Security Officer (CSO), integrating internal technology systems and security functions under the same executive management.Blatman previously worked at the blockchain company Fireblocks and will be fully responsible for network and infrastructure security, product security, physical and workplace security, internal IT, and enterprise risk management.

Osmosis posted on platform X that due to a security incident with the Nomic nBTC cross-chain bridge, Osmosis has suspended the minting and redemption of BTC Alloyed assets, and deposits and withdrawals have been simultaneously suspended.The BTC on Osmosis is backed by 30% nBTC. The team will soon release a complete post-mortem analysis and recovery plan. BTC in the pool is still tradable, and users are reminded to be aware of the risks.

According to Cointelegraph, the Attorney General's Office of the State of Mexico (FGJEM) reported that two suspects, Diego Sebastián and Gerardo, were arrested for allegedly murdering Jonathan Meléndez, the keyboardist of the rock band Camilo Séptimo, along with his pregnant wife, daughter, and an employee. The family's golden retriever was also killed.The suspects are accused of committing the crime to obtain a cold wallet that allegedly contained millions of dollars in Bitcoin, with one of the suspects being a business partner of the victim, using that relationship to gain access to the victim's home. The two will appear in court on Wednesday, where the judge will decide if there is enough evidence to continue the criminal proceedings. If convicted, each suspect could face a prison sentence of 25 to 70 years corresponding to each victim.Such violent robberies targeting cryptocurrency holders (known as "ransom attacks") are on the rise. According to CertiK data, there were 52 reported ransom attack incidents globally in the first half of 2026, a year-on-year increase of 33.3%; among them, there were 20 home invasions targeting cryptocurrency holders, compared to only 1 during the same period last year.Chainalysis estimates that in the first half of 2026, criminals stole over 30 million dollars in cryptocurrency through ransom attacks. In 2025, global ransom attack incidents increased by 75% to 72 cases, with France leading with 19 cases, accounting for about 40% of the total attacks in Europe.

Hardware wallet manufacturers Ledger and Trezor are calling on security researchers to adopt a more responsible approach to vulnerability disclosure. Ledger's Chief Technology Officer Charles Guillemet stated on the X platform that artificial intelligence has made vulnerabilities easier to discover and exploit, but some researchers disclose details before a fix is released, which he termed "exploiting others' risks for attention."Guillemet urged researchers to report vulnerabilities privately first and to agree on a timeline for fixes before disclosing details publicly, suggesting 90 days as a common default period, while also indicating that this could be adjusted flexibly based on the severity of the vulnerability and the amount of work required for the fix. Trezor's Security Chief Jan Komárek told Cointelegraph that 90 days is a commitment to vendors, not just an obligation for researchers. He suggested that researchers first contact vendors to agree on a timeline, and if the vendor fails to complete the fix within that period, they may choose to disclose publicly.The context of this statement is the recent close attention to hardware wallet security: the Coldcard theft incident involved over $100 million, and a data breach at Trezor's logistics provider also affected the personal information of tens of thousands of customers.

According to The Block, the Ethereum Foundation's protocol team has released the priority list for the Hegotá upgrade EIP, setting the target date for achieving "quantum safety" on Ethereum's layer one in terms of execution, consensus, and data to December 2029.In terms of the consensus layer, FOCIL (EIP-7805) is listed as S-level "must launch," enhancing censorship resistance by mandating the inclusion of public mempool transactions; in terms of the execution layer, Frame Transactions (EIP-8141) is also a "must launch," laying the groundwork for native account abstraction and custom signatures, gas payment, etc., by splitting transactions into programmable "frames" for validation, gas payment, and execution, thereby improving post-quantum safety readiness. The protocol team stated that starting from the "Glamsterdam" fork in Q4 2026, subsequent forks need to be completed in an average of about 7.2 months to ensure the achievement of the minimum viable post-quantum safety milestone before "Q-day" around 2030.

The Ukrainian police and the Security Service of Ukraine (SBU) recently dismantled a scam network that used a fake investment platform to steal cryptocurrency. This network disguised itself as an investment platform website, luring users to connect their main cryptocurrency wallets and approve a small test transaction when withdrawing funds. Subsequently, it used a "wallet stealer" hidden within the website to automatically transfer user funds to wallets controlled by the operators, kicking victims off the platform. Investigators have currently confirmed 62 victims, with over 46 Ukrainian citizens involved, and the network could steal up to $1 million per month.The police stated that the false profits displayed on the platform are part of the scam, with operators manually creating transactions and adjusting user account balances to create the illusion of investment growth. In addition to cryptocurrency, the platform also collected victims' passport information, phone numbers, email addresses, login credentials, and photos during the registration and identity verification process. The main organizer of the network is a 25-year-old IT expert who recruited over 46 Ukrainian citizens and operated multiple offices in Kyiv and surrounding areas, with members responsible for building and maintaining fake websites, contacting potential victims, and providing security.Victims come from multiple countries, including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel. The police traced the gang's server equipment located in the Netherlands and obtained a database stored there, which included a list of victims, cryptocurrency wallet addresses, suspected stolen amounts, internal communications, and platform operation information. The Ukrainian police and SBU subsequently executed 34 searches in Kyiv and surrounding areas, seizing over 100 computers, more than 100 mobile phones, 79 SIM cards, documents, cash, and 15 vehicles.

a16z Charts compiled recent data indicating that since January 2025, tech recruitment has shown a clear preference for years of experience, while the requirements for the number of skills have decreased, with a change of about 5% to 10%.The charts show that companies are lowering the weight of skill lists when screening positions, and are instead placing more emphasis on candidates' accumulated experience. This change is related to the skill gaps brought about by AI, which is rewriting the safety and employment landscape.

According to the official X account of ZKsync (@zksync), ZKsync announced a security upgrade for its EraVM chain. The core measures include: introducing an instant upgrade framework, extending the execution delay from 3 hours to 24 hours, and developing a second prover, EraBender, to guard against AI-driven vulnerability attacks.In the next 6 months, all Boojum/EraVM chains will gradually phase out the old execution environment, and each chain will formulate and announce its own transition timetable. Users holding funds directly in EOA do not need to take any action; users holding funds through multi-signature, smart accounts, DEX, lending protocols, and other smart contracts need to take action as required after the transition plans of each chain are determined. The ZKsync Atlas chain is not affected by this upgrade.

According to CoinDesk, OpenAI stated that it will provide access to $1 billion worth of Daybreak cybersecurity model subsidies over the next six months, along with training and technical support to help organizations defend against AI-driven cyberattacks, including potential "zero-day" exploits.Daybreak is divided into two tiers, Blue and Red, which are used for routine defense and more sensitive cybersecurity tasks, respectively. Currently, about 2,000 organizations are using it. OpenAI previously disclosed that its new model Astra can discover unknown software vulnerabilities and generate attack plans with less human intervention, raising concerns in the crypto industry about the security capabilities of open-source blockchain software.