Bitget lost about $387.5 million to forged withdrawals from its wallet system, more than half of September's $742 million in crypto thefts. Most of Liquid Network's loss was handed back, so what stayed stolen sits mainly with one exchange's withdrawal infrastructure.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+8
- Incentives
- Insufficient
- Confidence55
Peter Todd, co-author of Bitcoin's replace-by-fee standard, now leads MARA's Slipstream, a private channel that moved over 9,000 BTC from vulnerable wallets. With two documented uses on record, both where public relay was risky or failed, the evidence that private routing is becoming a routine miner fee business is still thin.
Reality
- Evidence40
- Adoption25
- Hype gap+30
- Incentives55
- Confidence40
Coinkite's Coldcard firmware skipped its hardware random number generator, letting attackers brute-force seeds and drain over $100 million in bitcoin. Liquid's later $320 million drain adds node software to the code a bitcoin holder has to trust.
Reality
- Evidence38
- Adoption
- Insufficient
- Hype gap+30
- Incentives
- Insufficient
- Confidence42
The wallets held. The customer list did not: 39,798 names, phone numbers and shipping addresses, taken through commerce plumbing nobody threat-models.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 55%
- Investor
- Investor 17%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+10
- Incentives55
- Confidence70
The Crypto Recovery Trust, a Wyoming entity advised by Steptoe LLP, now controls coins worth about $3.5m at the exploit's implied price, against more than $100m that COLDCARD holders lost from July 30, 2026.
Reality
- Evidence28
- Adoption22
- Hype gap+34
- Incentives62
- Confidence34
Core Lightning says the machine-written reports found real flaws in its payments software. It is holding the count and severity for at least two weeks, leaving node operators to decide what to do with a hazard whose size is still private.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 52%
- Investor
- Investor 20%
Reality
- Evidence60
- Adoption40
- Hype gap+25
- Incentives68
- Confidence62
Harmony blames state actors and AI agents for shutting the layer-1 it launched in 2019, and the money set aside to pay validators to power down is worth more than everything left locked on the chain it closes.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 38%
- Investor
- Investor 32%
Reality
- Evidence55
- Adoption20
- Hype gap+45
- Incentives75
- Confidence60
The email telling Trezor owners their recovery phrases might lack entropy came from a real trezor.io address and passed DKIM, SPF and DMARC, and it described a defect close to the one that took 1,778.84 BTC from Coldcard users.
Reality
- Evidence42
- Adoption55
- Hype gap+22
- Incentives58
- Confidence45
Both wallet makers say AI is shortening the distance between finding a bug and using one, which makes the pace of their own coordinated disclosure the number worth pricing, and the only loss they cite belongs to a rival vendor.
Reality
- Evidence34
- Adoption22
- Hype gap+33
- Incentives82
- Confidence33
Apple says AI-generated submissions are flooding its review pipeline, so it capped open vulnerability reports and added a 30-day cool-down. The one blocked researcher named so far had filed 13 reports across two years.
Reality
- Evidence40
- Adoption45
- Hype gap+38
- Incentives62
- Confidence45
Decade-dormant coins are moving at an unusual clip while Warsh talks the Fed hawkish, so the tempting read is old supply against ETF demand. Divide the two flows and one side is ninety-six times the other.
Reality
- Evidence38
- Adoption55
- Hype gap+26
- Incentives52
- Confidence44
A volunteer group says it has swept almost all of Bitcoin's open-source ecosystem for AI-assisted exploits, and that American models' refusals made Chinese ones the default tool.
Reality
- Evidence28
- Adoption32
- Hype gap+34
- Incentives66
- Confidence44
A 2021 seed flaw cut entropy from 128 bits to about 40, so no attacker needed to touch the hardware. Every seed generated before July 2026 now has to be replaced.
Reality
- Evidence62
- Adoption54
- Hype gap+14
- Incentives66
- Confidence58
Malwarebytes says fake crypto AML screening sites are draining wallets. The defence is unglamorous: a real basic check needs only a public address, so a connect prompt is the tell.
Reality
- Evidence57
- Adoption41
- Hype gap+12
- Incentives62
- Confidence60