Trust Inversion
The pattern where the safeguard becomes the attack surface — verification layers, governance votes, and recovery vehicles turned into the vulnerability.
Your AI Agent's Plumbing Can Steal Your Crypto
Researchers from UC Santa Barbara, UC San Diego, blockchain security firm Fuzzland, and World Liberty Financial published a paper documenting a class of attacks on LLM routers — the services that sit between users and…
Fake Ledger App Drained $9.5M From Apple's App Store
A counterfeit version of Ledger Live operated on Apple's Mac App Store from April 7 to April 13, 2026, draining approximately $9.5 million from more than 50 victims before Apple removed it.
UNC1069 Is Deepfaking CEOs on Zoom to Drain Crypto Wallets
On April 15, 2026, crypto wallet provider Zerion disclosed that approximately $100,000 was stolen from its hot wallets through an AI-enabled social engineering attack that compromised employee sessions, credentials, and…
Drift Hack Began With Months of In-Person DPRK Social Engineering
On Wednesday, April 29, TRM Labs and Chainalysis published detailed analyses of the April 1 Drift Protocol breach: North Korean state-backed operators began the campaign in fall 2025 with in-person meetings between…
Sui Validators Reversed a $223M DEX Exploit by Vote
On May 22, 2025, an attacker exploited an integer overflow bug in an open-source math library used by Cetus Protocol, the dominant concentrated-liquidity DEX on the Sui blockchain, and drained approximately $223 million…
Trafficking Victims Unpaid as 127,000 BTC Sit in Reserve
In October 2025, the DOJ seized 127,271 Bitcoin from Prince Group founder Chen Zhi, the largest cryptocurrency forfeiture in US history.
Four Years Undetected: Zcash Patches Orchard Counterfeit Bug
On June 5, Shielded Labs and Zcash Open Development Lab disclosed that a critical vulnerability in Zcash's Orchard shielded pool, present since May 2022, allowed unlimited undetectable ZEC counterfeiting for…
AudiA6 Takedown Hits $389M Wash for 20 Ransomware Groups
On June 10, 2026, an international coalition led by the US Secret Service, IRS Criminal Investigation, and Polish Police dismantled AudiA6, a cryptocurrency laundering service that processed more than €336 million for…
FTX Repays Bitcoin Creditors at $16,871 Petition-Date Price
June 16, 2026 is the record date for the fifth FTX creditor distribution, with payments to commence July 31.
$1.7 Million Drained Through a Single Forged Proof on Taiko
On June 22, 2026, an attacker forged source-signal proofs on Taiko's Ethereum L2 bridge and drained $1.7 million from an ERC-20 vault for withdrawals with no matching deposits on the source chain.
Hinkal Lost $820,000 After Its Privacy Proof Verification Failed to Verify Anything
An attacker drained roughly $820,000, nearly the protocol's entire total value locked, from Hinkal, a zero-knowledge privacy protocol, on July 3, 2026, by submitting a deposit that skipped the required cryptographic…
BonkDAO Lost $20 Million to a Governance Vote No Exploit Was Needed to Win
An attacker spent $4.4 million buying BONK tokens on the exchanges Bybit and Binance, then used that stake to pass a treasury-transfer proposal through BonkDAO's on-chain governance system, draining roughly $20 million…
Supra's Verifier Accepted a Zeroed Signature and Bonzo Lend Lost $9 Million
An attacker fed a Supra oracle contract on Hedera a fake price for the SAUCE token early on July 11, inflating its recorded value by roughly 12 orders of magnitude, then borrowed $9.05 million from lending protocol…
Across Went 5 Clean Years Without an Attack. The First One Hit Its Safety Layer
Across Protocol confirmed an attack on its Solana deployment early Friday, the first security incident the cross-chain bridge has disclosed since launching in 2021 with more than $34 billion in bridged volume.
One Signature, 4 Transactions, 8 Minutes: Wanchain's Cardano Bridge Loses 515 Million NIGHT
Wanchain's bridge between Cardano and BNB Chain was drained of roughly 515 million NIGHT tokens, worth about $9 to $10 million, in 4 transactions over an 8 minute window.
The Verus Bridge Got Its Money Back in May. A New Attacker Just Used the Same Hole
3 cross-chain protocols lost a combined $35.55 million in roughly 6 hours between July 22 and 23: AFX Trade on Arbitrum, the Verus-Ethereum bridge, and Bitcoin layer 2 B2 Network.
594 BTC Swept in 25 Minutes: Coldcard's Mk3 Seed Flaw Turns the Hardware Wallet Inside Out
An attacker swept roughly 594.5 BTC, about $38 million, from some 500 single-signature addresses in a 25-minute window on July 30.
A Fake Recruiter, a Poisoned Repo, and 5 Validator Keys: How AFX's Bridge Lost $24 Million
AFX Trade's post-mortem traces its $24.15 million July 22 bridge drain to a fake recruiter, a poisoned Git repository, and a compromised build server.
The Coldcard Sweep Hits $88.6 Million, and the 'Not Affected' Models Join the Advisory
A suspected third wave pushed the Coldcard sweeps to 1,367 BTC, about $88.6 million, across 4,585 addresses, and Coinkite expanded its advisory on August 1: seeds generated on pre-fix Mk4, Mk5, and Q firmware carry…
Coinkite Thinks an AI Found the Coldcard Flaw. A Hobbyist Just Reproduced the Discovery in 8 Minutes
Coinkite says the attacker who swept $88.6 million from weak Coldcard seeds likely used AI to find the 5-year-old flaw, and concedes its own AI audit of the same code found nothing weeks earlier.
Phishers Are Now Hunting Coldcard Refugees, and the Vendor's Own Email List Is the Map
As Coinkite emails every customer address it can reach about the Coldcard flaw, Proofpoint has documented a phishing campaign impersonating exactly that outreach: a fake 'coordinated hardware audit' that installs…
Ill Bloom's Root Cause Named: A 12-Year-Old CryptoJS Function Fed Weak Randomness to 5 Wallet Apps
Security firm Coinspect has named the root cause of the Ill Bloom wallet drains: CryptoJS.lib.WordArray.random(), a function in one of the most widely used JavaScript cryptography libraries, fed weak entropy into the…
The Patch Is Not the Fix: BTCPay's Leaked Macaroons Keep Working After You Update
BTCPay Server confirmed on August 7 that attackers are actively exploiting a critical flaw to steal LND credential files and drain connected Lightning nodes, and it shipped version 2.4.2 as an emergency patch.
Trezor's Shipping Partner Leaked 13,689 Home Addresses. The Devices Are Fine. The Owners Are the Target
Trezor confirmed that its fulfillment partner ShipMonk was breached through a zero-day flaw in the analytics platform Metabase, exposing names, home addresses, emails, and phone numbers for 13,689 recent hardware wallet…
SafePal's Order Tracker Leaked 39,798 Customer Records. The Seller's Proof Is SafePal's Own Breach Checker
SafePal disclosed that an authorization flaw in a 3rd-party order-tracking plugin exposed names, home addresses, phone numbers, and purchase details for 39,798 customers.
Maya Protocol's Theft Alarm Paid the Thief: 6 Chained Bugs Became a $1.7 Million Exploit
An attacker chained 6 bugs in a single 23-message transaction on August 18, tricking MAYAChain's theft-compensation routine into crediting a pool with 49 million CACAO that did not exist.
Moonwell's Oracle Trusted a Spot Price. The $8.7 Million Exploit Cost More Than a Year of Protocol Revenue
A lending protocol on Base lost roughly $8.7 million on August 27 after an attacker pumped the illiquid MAMO token and Moonwell's spot-price oracle accepted the inflated value as loan collateral.
Cosmos Cleared This Bug in April. The Public Fix Showed Attackers How to Drain 6 Chains
Cosmos Labs published a post-mortem on August 28 admitting that a critical Cosmos EVM bug, reported through its bug bounty program on April 25, was wrongly assessed as posing no risk to live networks and quietly patched…
Cronos Stopped the Whole Chain to Trap a $75 Million Exploit. Your Exit Was Never Yours
Cronos, the blockchain backed by Crypto.com, halted all block production on August 30 after an attacker pumped Tectonic's thinly traded TONIC governance token roughly 100x and borrowed an estimated $75 million of harder…
Tether Froze $42 Million Before Any Warrant Existed. Your Stablecoin Is an IOU With a Switch
A pair of Thai businessmen sued Tether in the Southern District of New York on August 31, alleging the issuer blacklisted 10 Ethereum addresses holding $42.4 million in USDT on nothing more than a verbal request from a…
Every Liquid Key Held. The Federation Still Paid Out $320 Million for L-BTC That Never Existed
A peg-out transaction on Sunday pulled roughly 4,000 BTC, about $320 million, out of the 11-of-15 federation wallet that backs Blockstream's Liquid Network, leaving about 5% of the reserve.
Cronos Erased 10,961 Blocks to Recover $111 Million. Every Honest Transaction in Them Went Too
Cronos published its post-mortem on the August 30 Tectonic exploit late Monday: the attacker borrowed $120.4 million, not the $75 million first reported, and 33 invited validators recovered $111.2 million of it by…
The Sender Checks Passed. One Hacked Newsletter Vendor Sent Trezor, BitBox, and CoinTracking Users a Fake Seed Alert
Trezor, BitBox, and the portfolio tracker CoinTracking warned on Wednesday that phishing emails reached their newsletter subscribers from the companies' own sending domains, clearing the checks that catch spoofed mail,…
$20,000 of Governance Tokens Bought $9.4 Million. Then the Cosmos Hub Halted Itself to Contain It
On September 22 an attacker bought about 31.6 million NTRN roughly 11 minutes before a Neutron governance vote closed, passed a proposal granting itself admin rights over 10 Astroport and Drop contracts, and drained…
Bitget Lost $351.6 Million Without Losing a Key. The Target Was the System That Decides What to Sign
Bitget said Thursday that about $351.6 million left its hot and warm wallets after an attacker compromised a backend wallet service, fed it spoofed transaction data, and let the exchange's own authorization process…
Tether Froze $2.76 Million No Police Had Flagged. A Second Lawsuit in 5 Weeks Asks Who Runs the Switch
Conduit Technology, a Boston cross-border payments firm, sued 4 Tether entities in the Southern District of New York on October 5, alleging the issuer froze its entire $2.76 million USDT treasury wallet on September 24,…
Ledger Buyers Reported $86 Million Lost Through an Authorized Reseller. The Genuine Check Proves the Chip, Not the Box
Ledger said on Friday, October 9, that it is investigating reports of drained wallets among Southeast Asian customers of CryptoBilis, a reseller its own directory lists as authorized for Indonesia, Malaysia, and the…
Qubic Lost 1,404 Wallets to Math.random. SlowMist Rebuilt a Private Key From 6 Header Values
Qubic halted its network on Sunday, October 18, after an attacker emptied 1,404 wallets in 104 minutes, and restarted it this week with a claims site open until May 2027.
A Bug Minted 2 Million Unbacked AUSD on Initia. The Ethereum Bridge Verified the Burn, Not the Backing
Initia halted its layer 1 and every rollup on it at 15:41 UTC on Friday, October 23, after an attacker used what co-founder Zon calls a previously unknown bug in the chain's Move virtual machine to mint about 2 million…
EACH STEP IS A REAL REPORT FROM THE TRUST INVERSION SERIES, IN PUBLICATION ORDER — SEQUENCED AND LINKED, NOT INVENTED NARRATIVE. SUMMARIES ARE THE REPORTS' OWN.