Bitget lost about $387.5 million to forged withdrawals from its wallet system, more than half of September's $742 million in crypto thefts. Most of Liquid Network's loss was handed back, so what stayed stolen sits mainly with one exchange's withdrawal infrastructure.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+8
- Incentives
- Insufficient
- Confidence55
Blockstream paused the Liquid bridge after roughly 4,000 BTC left the federation wallet, and the people holding it will send most of it back only once the flaw is fixed, which puts the patch timetable in their hands.
Perspective Coverage
7 publishers
- Builder
- Builder 26%
- Operator
- Operator 41%
- Investor
- Investor 33%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence70
Zscaler found Ledger phishing ads running under a verified Google advertiser, with Vercel redirect domains rotating every 15 to 20 minutes. The ad displayed google.com and the pages sat on Google and Vercel hosting, so domain reputation and the verified badge gave defenders little to catch.
Reality
- Evidence65
- Adoption
- Insufficient
- Hype gap+20
- Incentives55
- Confidence65
Ondo Finance is selling three BlackRock-modelled portfolio tokens issued by a British Virgin Islands entity that alone owes holders anything. A buyer paying for the BlackRock name holds Ondo's paper, and BlackRock's part is limited to designing the allocation.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+35
- Incentives72
- Confidence55
The wallets held. The customer list did not: 39,798 names, phone numbers and shipping addresses, taken through commerce plumbing nobody threat-models.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 55%
- Investor
- Investor 17%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+10
- Incentives55
- Confidence70
Roughly 40,000 SafePal customers had names, addresses and payment methods exposed, according to Crypto Briefing; the air-gapped device held, the shipping list did not.
Perspective Coverage
4 publishers
- Builder
- Builder 24%
- Operator
- Operator 55%
- Investor
- Investor 21%
Reality
- Evidence75
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence70
The records that expanded Trezor's breach were US orders from 2019 to 2021, held years past the 90-day deletion window its fulfillment partner had promised, which puts the failure in the contract rather than the device.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+15
- Incentives60
- Confidence58
Check Point's deobfuscation of 23 compiled V8 bytecode samples shows JSCeal replaying stolen cookies inside the victim's own browser profile, then stuffing local credentials at any password prompt until it holds a fresh OAuth token.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+18
- Incentives45
- Confidence63
The withdrawal cleared every control the Liquid Federation actually operates, which is why an 11-of-15 quorum released the bitcoin in 23 minutes. Recovery now depends on whoever holds the coins answering an email address.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+20
- Incentives55
- Confidence55
The attackers who drained 4,000 BTC from Liquid handed back 3,400 after the patch and kept 598.5. Blockstream puts about $47 million on that hold and says it will trace the coins instead of paying.
Perspective Coverage
10 publishers
- Builder
- Builder 29%
- Operator
- Operator 39%
- Investor
- Investor 32%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+12
- Incentives58
- Confidence68
Kaspersky says a new MacSync variant hides its payload commands in public iCloud calendar events and downloads the next stage from iCloud. Both the instructions and the download ride trusted Apple domains, past defenses that block known-bad hosts.
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence68
Head of cryptography Yehuda Lindell says hash-based post-quantum signatures may not split across parties. So Coinbase is researching threshold decryption plus a programmable HSM for the $250 billion it custodies.
Reality
- Evidence46
- Adoption18
- Hype gap+24
- Incentives62
- Confidence52
Blockchain security firm SlowMist says an active exploit chain walks from a Safari page to kernel access and the iOS Keychain on everything from iOS 13 to 26.5, while Apple's patches, by the same account, reach 26.3.
Reality
- Evidence30
- Adoption22
- Hype gap+38
- Incentives66
- Confidence34
Greenberg Traurig says an intruder took client documents and posted them on the dark web. The doubling behind that story is nearly 60 law-firm matters inside BakerHostetler's 1,250-incident book for 2025.
Reality
- Evidence52
- Adoption63
- Hype gap+22
- Incentives62
- Confidence55
The email telling Trezor owners their recovery phrases might lack entropy came from a real trezor.io address and passed DKIM, SPF and DMARC, and it described a defect close to the one that took 1,778.84 BTC from Coldcard users.
Reality
- Evidence42
- Adoption55
- Hype gap+22
- Incentives58
- Confidence45
Blockstream's federation signers behaved correctly and still released roughly 4,000 bitcoin, because the software that decides what counts as a real L-BTC is a different system from the keys guarding the peg.
Reality
- Evidence58
- Adoption45
- Hype gap+12
- Incentives66
- Confidence55
Both wallet makers say AI is shortening the distance between finding a bug and using one, which makes the pace of their own coordinated disclosure the number worth pricing, and the only loss they cite belongs to a rival vendor.
Reality
- Evidence34
- Adoption22
- Hype gap+33
- Incentives82
- Confidence33
Socket says the operators bought their way onto tens of thousands of machines and delivered the payload in a routine update. Cleanup means rotating passwords and moving crypto to fresh wallets, user by user.
Reality
- Evidence52
- Adoption34
- Hype gap+12
- Incentives62
- Confidence50
An extension allowlist pins an ID, and the ID survives a sale. The operators behind Superior bought or seeded trust that users had already granted, then spent it in an automatic update that stripped page CSP on the way through.
Reality
- Evidence55
- Adoption40
- Hype gap+12
- Incentives55
- Confidence50
Ledger's CTO says the Ethereum clear-signing fix shipped two weeks before disclosure. The public release record cannot confirm that, and an autonomous scanner chose the publication date.
Reality
- Evidence38
- Adoption
- Insufficient
- Hype gap+24
- Incentives72
- Confidence36