Topic
Practices and vulnerabilities in safeguarding crypto holdings, covering wallet custody, private keys, and attack vectors like malicious plug-ins or exploits.
SEC and five US partner organizations warned on Oct. 5 about scammers posing as friends, advisers or regulators, with AI making the fakes harder to spot. The agency's newest such case involves more than $15.3 million, set against losses put in the billions a year.
Reality
Ethereum's draft EIP-7906 would let a transaction check its own results with three new opcodes and revert if they break rules the user set in advance. Aimed at the 2027 Hegotá upgrade, it puts enforcement in the protocol and leaves rule-writing to users and the tools built on top.
Reality
MetaMask is exiting its Ethereum validators in the Lido protocol by October 7, 2026, as a precaution during an infrastructure incident it has not explained. Lido expects lost rewards and possible downtime penalties, a cost incurred before MetaMask has said what was affected.
Reality
SlowMist says its evidence for the iPhone Safari attack on crypto wallet keys covers iOS 18.4 to 18.6.2 and that it has confirmed no theft victim. The firm calls this week's iOS 13 to 26.5 warnings preliminary and still tells iPhone users to install security updates.
Reality
BagOS 3.0.0 stops reading .env from the working directory after a review found a repo's config could make its login tool sign a wallet drain. Its preview-and-confirm gate covered write tools only, and login was never classed as one.
Reality
Blockchain security firm SlowMist says an active exploit chain walks from a Safari page to kernel access and the iOS Keychain on everything from iOS 13 to 26.5, while Apple's patches, by the same account, reach 26.3.
Reality
HP tracked the campaign from April to June 2026, in which a fake AI crypto trading agent shipped a genuine Microsoft utility to satisfy Windows reputation checks before the DLL loaded beside it stole browser wallet passwords.
Reality