security

According to official news, OKX, in collaboration with Elliptic, SlowMist, and OttoSec, has released the "Web3 Security and Risk Control Report for the First Half of 2026." The report points out that the focus of Web3 attacks is gradually shifting from smart contract code to more complex scenarios such as signature processes, user devices, operational infrastructure, and AI Agents.Data shows that in the first half of 2026, the OKX risk control system intercepted over 5.7 million high-risk transactions, including approximately 2.41 million transactions related to hacking and theft, about 1.48 million transactions related to phishing, and around 990,000 transactions related to fraud. The OKX Web3 on-chain intelligence label library currently has over 1 billion labels, covering more than 420 chains, and has integrated capabilities such as address screening, transaction monitoring, and sanction address control into infrastructures like DEX and Exchange OS.In addition, in terms of user protection, OKX has intercepted over 7 million visits to risky websites, completed over 200,000 device risk assessments, identified over 60,000 high-risk apps, and intercepted or alerted on over 4 million high-risk signature operations. The report also introduces the "risk control pre-positioning" design in scenarios such as Exchange OS, Outcomes, RWA, and Agentic Wallet.

Nine financial institutions and Bitcoin companies announced the joint establishment of the Bitcoin Security Alliance, with founding members including Anchorage Digital, ARK Invest, BlackRock, Block, Blockstream, Coinbase, Fidelity, Galaxy, and Strategy, covering the entire chain of institutions such as custody, trading, infrastructure, payments, and asset management.The alliance commits to providing a total of $15 million in funding over the next three years to support developers and researchers in the field of Bitcoin security, including long-term work to prepare Bitcoin for the future era of quantum computing. Each member independently decides which developers, researchers, or organizations to direct their funding towards. The daily operations of the alliance are coordinated on a voluntary basis by Brink Executive Director Mike Schmidt, with Brink being a nonprofit organization that funds Bitcoin open-source developers.The alliance clearly states that it does not formulate or direct Bitcoin protocols, does not express opinions on specific protocol changes, and does not represent Bitcoin or its developers—Bitcoin development continues to be carried out by a globally decentralized community of contributors. Its positioning is to emulate the model of industry organizations that have long supported open-source software, providing resources and attention to developers without controlling the underlying work.Strategy CEO Phong Le stated, "As long-term holders, ensuring the security of Bitcoin for generations is our greatest incentive"; BlackRock's Global Head of Digital Assets Robert Mitchnick pointed out that the work of Bitcoin core developers is "extremely important," and this commitment will provide "significant additional funding" for Bitcoin's long-term security needs. The alliance will also serve as a reliable source of information for investors, the public, and the media in the field of Bitcoin security, with plans to publish and continuously update materials related to Bitcoin security in the coming months.

Web3 security company CertiK released the "2026 First Half Wrench Attack Report." The report shows that in the first half of 2026, a total of 52 publicly verified wrench attack incidents were recorded globally, an increase of 33.3% year-on-year; related losses amounted to approximately $124 million, an increase of about 11.8 times compared to the same period last year.The report points out that attackers are shifting from exploiting technical vulnerabilities to targeting asset holders and their real-world relationship networks, with home invasion incidents rising from 1 in the first half of 2025 to 20, accounting for 41% of the total incidents during the same period. Europe has become a high-frequency attack region, with 33 incidents occurring in France, accounting for 63.5% of global cases.CertiK states that as real-world risks become a significant challenge for digital asset security, businesses and high-value individuals need to establish a more comprehensive protection system. CertiK has launched operational security services to help identify risks related to the exposure of information such as identity, home, residence, and travel trajectory; at the same time, through CertiK Security Workspace, it correlates off-chain intelligence, on-chain transactions, and AML risk signals to support institutions in tracking and analyzing cybercrime activities.In addition, CertiK is strengthening cooperation with international law enforcement agencies such as Interpol and Europol to provide technical support for cross-border attack investigations and security policy research.

Cryptocurrency financial services company Galaxy Digital announced the establishment of a $5 million Bitcoin Quantum Readiness Initiative, funding developers to research solutions to address future quantum computing threats. The program is open for applications starting today, with funding directions including quantum-resistant signature algorithms, wallet migration tools, and security audits.Galaxy stated that it hopes to attract more institutions to jointly invest and research, accelerating Bitcoin's transition to quantum-resistant cryptography. According to CryptoQuant data, if future quantum computers have the capability to crack Bitcoin's existing cryptographic algorithms, approximately 6.9 million BTC (equivalent to about $46.1 billion at current prices) may face the risk of theft. Although the industry generally believes that quantum computing does not pose an immediate threat to the Bitcoin network, related preparations should be initiated as early as possible due to the need for long-term collaboration among developers, wallets, exchanges, and users for protocol upgrades.

According to South Korean media Maeil Business, data from the Financial Supervisory Service of Korea shows that during the first phase of the CBDC pilot project led by the Bank of Korea, financial authorities did not conduct any independent security verification, and only the participating banks conducted their own pre-security reviews.Before the project launched, only an IT vulnerability self-assessment was conducted for the participating banks, executed by the Financial Security Institute, SK Shields, and self-inspection teams from Woori Bank and NongHyup Bank, forming an evaluation model of "self-check by the regulated entities." The central bank acknowledged external doubts about the security of the deposit tokens in the pilot result report and responded that the pre-review was sufficient, but critics pointed out that this explanation was a self-assessment and not an independent third-party verification.

According to official news, the ENS DAO has approved the proposal to activate a new security committee, with a term of two years. The committee consists of eight members and has veto power, allowing it to cancel proposals during the waiting period after malicious proposals are passed but before execution. The committee's authority is limited to canceling transactions within the time lock and cannot access treasury funds, submit proposals, or rewrite approved proposals.The committee can only exercise its power under emergency conditions specified in its charter. ENS points out that governance itself may become an attack surface—voting rights can be borrowed to initiate attacks, proposal codes can hide malicious behavior, and credential leaks can be used to push harmful transactions. The new committee adopts a 5-of-8 multi-signature, requiring at least five members' agreement to cancel a proposal, and must seek DAO voting for extension after the two-year term.

According to GlobeNewswire, AI security startup Neo announced the completion of a $100 million financing round, led by venture capital firms Andreessen Horowitz (a16z) and Bessemer Venture Partners, with participation from Craft Ventures and Merlin Ventures.It is reported that the company positions itself as an "Agentic Software Control" company, dedicated to building a real-time control layer for enterprises, helping security operations teams (SecOps) manage and protect the rapidly proliferating AI agents, AI applications, browsers, identity systems, and intelligent capabilities in traditional software. The new funds will be used to expand the engineering and marketing teams and accelerate the expansion of enterprise customers.

According to Bits.media, Kaspersky security researchers have discovered new malware OkoBot, which steals cryptocurrency wallet recovery phrases and credentials through about 20 modules. Attackers use ClickFix social engineering techniques to trick users into executing malicious commands and spread the malware through GitHub repositories disguised as legitimate tools like SQL Server Management Studio.OkoBot's modules include: SeedHunter, which injects into hardware wallets like Trezor and Ledger, displaying a fake interface when recovering recovery phrases; MC Keylogger, which records keyboard and clipboard activity; and OkoSpyware, which tracks wallet passwords and records window videos.Once attackers obtain the recovery phrases, they can gain complete control over the victim's cryptocurrency assets, making it nearly impossible to recover the funds. Kaspersky stated that OkoBot has been active for over a year, with most victims located in Brazil, Vietnam, Canada, Mexico, and Turkey. Attackers have also implemented geographical blocking on IP addresses from Russia and CIS countries.

The founder of Slow Fog, Yu Xian, retweeted a tweet on the X platform regarding the potential poisoning attack risks of Claude Code and published an analysis of the poisoning attack details targeting Grok Build CLI and Claude Code CLI.It pointed out that the security mechanisms of Grok Build CLI are not unified, with different code paths having different trust assumptions, creating gaps that serve as channels for attackers. Attackers may execute arbitrary commands through malicious project configuration files without the user's knowledge, thereby stealing API keys, cloud credentials, or controlling local devices.Researchers constructed a testing environment and found that on Mac systems, if Claude Code is affected, executing specific test commands can trigger the local calculator to launch, proving the existence of potential command execution risks.If the attack is successful, attackers may further steal API keys from AI services like Claude and OpenAI, resulting in account cost losses, gain access to servers and data by obtaining cloud service credentials from AWS, Alibaba Cloud, Tencent Cloud, modify code repositories to implant backdoors, and use local devices as jump points to attack corporate internal networks. It is reported that the related vulnerabilities have existed for a year.

Venture capital firm Andreessen Horowitz (a16z) announced an investment in AI Agent security startup Runta, which aims to help businesses manage and constrain AI agents like "raising children." The specific investment amount has not been disclosed.Runta founder Guanlan Dai previously worked on the technical team at Cloudflare and was a founding engineer at API connection startup Kong. He stated that AI agents share similarities with growing children: they have the ability to perform tasks autonomously but also require boundaries, supervision, and permission management. Dai believes that just as parents provide home safety protection for children and limit their access to credit cards, businesses also need to restrict the important documents that AI agents can access, the range of operations they are allowed to perform, and the amount of disposable funds available at one time.Runta is developing a set of "AI Agent guardianship" infrastructure to help businesses manage AI agents' permissions, security risks, and behavioral boundaries, preventing autonomous AI systems from causing data leaks, erroneous operations, or financial losses during task execution. As businesses increasingly deploy AI agents with autonomous decision-making capabilities, establishing a trustworthy and secure agent management system is becoming a new infrastructure requirement. Runta aims to become the "parental control layer" of the AI Agent era, providing capabilities such as agent identity management, permission control, risk limitation, and operational supervision for businesses. Industry insiders believe that as AI agents evolve from simple assistants to autonomous entities capable of operating business systems, handling transactions, and executing complex tasks, the infrastructure market surrounding agent security, governance, and compliance may experience rapid growth.

Elon Musk stated that after completing the security vulnerability review, X will open source all code repositories without exception. In addition, X will invite third-party auditors to verify the actual operating system to confirm its consistency with the publicly available source code.

The governance company of Cardano, Intersect, stated on the X platform that EMURGO is unable to allocate the necessary resources to execute the Token2049 event due to its recent focus on handling the SecondFi security incident. After discussions among three parties, the responsibility for the event has officially been transferred to the Cardano Foundation.EMURGO submitted a transfer request to Intersect, which received agreement from all parties after discussions with the Cardano Foundation. Intersect stated that this decision was based on the urgency of the event timeline and the need to avoid delivery uncertainties. The Cardano Foundation has agreed to deliver the event within the approved scope, and both EMURGO and Intersect recognize its past execution capabilities. The delivery work for Token2049 has now officially been handed over, and the event is still scheduled to take place in October.Previously, in June, it was reported that SecondFi disclosed a security incident affecting approximately 16 million ADA (around 2.42 million USD at the time); however, SlowMist indicated that user losses from SecondFi could exceed 20 million USD.

The ENS DAO has initiated a proposal to establish a new Security Council based on the election results of EP 6.50, with a term of two years, ending on July 16, 2028.According to the proposal description, the new Security Council will inherit existing responsibilities and continue to be responsible for canceling malicious proposals within the ENS DAO, without the authority to initiate, modify, or actively promote governance proposals. The proposal will be configured by granting the corresponding permissions to the DAO's TimelockController.The proposal also indicates that after the two-year term, if the DAO does not pass a new proposal for an extension, any address may call the relevant function to revoke its cancellation proposal authority.

According to an announcement from Qubic's official X account (@Qubic), a security incident occurred in the Qubic GitHub organization on July 13, where a compromised account accessed the code repository and extracted sensitive information. The official team has intervened to address the situation.The official team recommends that the following users take immediate action: Network Guardians should immediately rotate their seeds; Web wallet users who unlocked their wallets between 03:00 and 10:00 UTC on that day should migrate to a new identity; if unsure of the last unlock time, migration is also advised; developers should pause pulling or deploying code from the Qubic code repository until the official audit is confirmed to be completed.The official team stated that complete details and subsequent updates will be released on the official Discord channel, reminding users not to trust information from unofficial channels, and warning that no one should request user seeds for any reason. A post-incident report will be published after the situation is resolved.

Dragonfly partner Haseeb responded on Twitter to OpenZeppelin co-founder Manuel Aráoz's previous pessimistic view on DeFi security, stating that with models like GLM 5.2, Fable, and GPT 5.6 now online and actively used by attackers, DeFi has not experienced the anticipated "hacker apocalypse."Chart data shows that based on current year-to-date figures and operating rates, the annualized amount stolen in DeFi by 2026 is approximately $1.89 billion, with a cumulative theft of about $986 million this year, which is lower than the levels of 2025 and still within historical ranges.Haseeb believes that the deeper change currently is that while the number of hacker attacks has increased, the scale of individual attacks has decreased more rapidly, with attackers increasingly targeting smaller protocols and abandoned projects, while larger protocols have completed more security enhancements, thus the overall safety of funds has not significantly worsened.

Japan's largest securities token issuance and management platform, Progmat, has completed its migration to the Avalanche blockchain, transferring all managed tokenized assets worth over 452 billion yen (approximately 2.7 billion USD) from a Corda 5-based permissioned chain to a dedicated Avalanche Layer 1. This migration was announced in February this year and was completed as scheduled, without affecting the normal operations of financial institutions.Progmat stated that the new architecture no longer relies on a single blockchain and can support future multi-chain expansion. All smart contracts have been migrated to the EVM environment, and while maintaining the original functionality, the speed of asset rights transfer processing has increased by 3 to 5 times, with the final confirmation time for transactions reduced to under 2 seconds. Progmat was initially incubated by Japan's largest bank, Mitsubishi UFJ Trust and Banking Corporation (MUFG), and became an independent operation in 2023. It currently has the support of major Japanese financial institutions such as Mizuho Bank, Tokyo Stock Exchange, and SBI, holding a 53% market share in Japan's securities token market and accounting for 64.6% of the total issuance scale of securities tokens, covering most tokenized real estate and corporate bond projects.In addition, Progmat established a working group for the tokenization of Japanese government bonds and on-chain repurchase (Repo) in May this year, collaborating with asset management institutions, banks, and securities companies to research the tokenization of Japanese government bonds and explore application scenarios such as 24/7 trading and T+0 real-time settlement.

According to Bitcoin.com, Coinbase Chief Policy Officer Faryar Shirzad responded on X to U.S. Senator Elizabeth Warren's criticism of the CLARITY Act, stating that the bill will not undermine national security but rather bring digital asset platforms under stronger regulation. Elizabeth Warren previously stated that the current draft of the CLARITY Act could provide opportunities to evade sanctions.Faryar Shirzad stated that the bill will require crypto platforms to comply with stricter national security standards and allow platforms to freeze suspicious transactions at the request of law enforcement.U.S. Senator Cynthia Lummis previously stated that the CLARITY Act includes 16 illegal financial protection measures and warned that the bill may be the last major opportunity for Congress to pass comprehensive digital asset rules before 2030.

Founder of Strategy, Michael Saylor, stated that Bitcoin is a spontaneously evolved network system, where the influence of wallets is determined by the amount of satoshis held, the influence of nodes is determined by business activities, the influence of miners is determined by computing power, and capital, consensus, and network security together maintain a dynamic balance.

Injective's official account posted on the X platform, stating that recent media reports have covered news about "potential security risks involving the Injective npm package." This issue has been promptly identified and resolved. User funds have never been at risk and have not suffered any losses.The official statement indicated that its security monitoring system detected the issue immediately and quickly marked the affected package version as deprecated, while replacing it with a new version, thus blocking the risk before the malicious package could be downloaded.As a result, the download volume of the malicious package is zero, and it has not affected users; the security of user funds has also not been threatened. Injective's npm package is one of the most widely used SDKs in the cryptocurrency field, and the official team has now implemented optimization measures to ensure that such attack attempts cannot occur again.

According to PR Newswire, QIZ Security announced the completion of a $17 million seed round financing, led by Bessemer Venture Partners and Merlin Ventures, with participation from Evolution Equity Partners, Qbeat Ventures, Singtel Innov8, Qino Cyber Capital, and others.The company positions itself as a management platform for crypto assets and post-quantum cryptography (PQC), providing continuous crypto asset discovery, risk modeling, and governance, helping large clients in finance, telecommunications, healthcare, and critical infrastructure achieve "crypto agility" to address the risk of "Q-Day," when quantum computing capable of breaking existing encryption systems may emerge as early as 2029, and collaborates with Cisco, AWS, Google, CrowdStrike, Deloitte, EY, IBM, and others to promote enterprise quantum security migration planning.