Independent weekly threat intelligence on crypto security. Exploits, vulnerabilities, tools, and the shifting attack surface. By @iphelix
Joined December 2020
- Tweets271
- Following2
- Followers5.6K
- Likes35
Pinned Tweet
BlockThreat Enterprise Tier gives security teams organization-specific threat intelligence reports, monthly briefings, priority access, and optional tailored feeds based on the exploits, threat actors, techniques, and trends I track every day across Web3.
So who’s next for a $100M+ hack?
The way in won’t surprise you. What happens after it will, and it changes how fast you need to respond.
Full breakdown, Top 10 attack vectors, and what to fix now 👇
blockthreat.com/blockthreat-…
The long tail is where it gets interesting:
- Wallets failing at the one job that matters
- Obscure chains picked apart at the consensus layer
- A $320M lesson in why a fix sitting in main isn’t a fix
Plus: an ex-NCA officer ordered to repay $2.4M for bitcoin he stole when it was worth $77K, 5 new whitepapers, and Chase for Sui Move.
Full edition 👇
blockthreat.com/blockthreat-…
AI research:
🤖 Anthropic on the spread of advanced cyber capabilities
🛠 @trailofbits on finding bugs with /goal
🧠 @cantinasecurity Apex Flash, an open-weights security model
📚 A dataset of 23,625 audit findings
🎓 @asen_sec course on building your first bug-hunting agent
Also this week:
🔓 @hexens Wasmer sandbox escape to RCE
⚡ Core Lightning warns of node attacks
🎣 LinkedIn job scams and Gmail-to-fake-support social engineering
🍎 A new MacSync stealer hunting crypto devs
💸 A Robinhood Chain rug factory moving $9M+ in 30 days
The attacker's parting words: "Remember to always use bug bounties!" There are seemingly few consequences for a blackhat hack. Unless the FBI gets involved and you join a growing list of ex-SRs in jail.
🤠 "We have identified you, sir"
A bug between NEAR's Omni layer and the Intents contract let an attacker drain $3.8M from the HOT Bridge hot wallet.
A day later, NEAR's GM: "We have identified you, sir." 48-hour deadline. Every dollar came back, with an on-chain apology.
BlockThreat - Week 40, 2026
This week in blockchain security: 8 exploits, a $3.8M hack that came back in full within a day, a Wasm sandbox escape, and a new open-weights model built for security research.
80 hand-picked reads, 15 whitepapers, 6 tools, 13 incidents.
Attackers are reading the same papers every week. For ~$3/edition, you'll know everything they know.
blockthreat.com/blockthreat-…
Also inside this week's edition is Vitalik on why AI hacking doesn't doom security, Trail of Bits on auditing with "good enough" models, a hands-on course for building your own bug-hunting harness, and Coinspect's new tool for hunting weak wallet key generation.
🎯 AI hunters are feasting
Attackers are targeting more and more obscure protocols, blockchains, and wallets. Security by Obscurity doesn't really buy you time anymore.
🔑 SingularityNET
A single compromised bridged exposed signing keys to at least four other projects triggering a mass compromise event. Attackers cashed out about $2.3M.
🤠 Yoink
An attacker found a vulnerable Safe module router then broadcast the exploit to the public mempool. A MEV bot named Yoink frontran the transaction and took the whole haul first.
BlockThreat - Week 38, 2026
This week in blockchain security a hacker lost $7.8M to a faster bot, one stolen keyring hit five projects, and AI bug hunters found chains nobody was watching.
The most concerning trend in August wasn't attackers finding novel bugs.
It was attackers reading our patches. Cosmos: six networks, $12M, after a critical bug was quietly fixed and with a hope nobody would notice.
Risky strategy in the age of LLM exploit development.
BlockThreat - August, 2026
Attackers spent August moving up the difficulty curve.
62 incidents. $210M gone.
Four trends from the August edition of BlockThreat 🧵
More details in the latest edition:
blockthreat.com/blockthreat-…
