certik

The cybersecurity company CertiK recommends that cryptocurrency exchanges set a hard dollar limit on hot wallet holdings, rather than relying solely on cold storage ratios to measure security. This recommendation comes at a time when several exchanges have recently disclosed their cold wallet holdings ratios to reassure customers, following a record hack of Binance's hot wallet. Gate reports that 88.26% of its total assets are stored in cold storage, while Coinbase states that over 99% of customer assets are kept offline.The CertiK research team told Cointelegraph that cold storage is an effective indicator of online risk exposure, but it is not an independent security rating. Currently, South Korea requires crypto service providers to store at least 80% of the value of customer crypto assets in cold storage, Singapore's guidelines require at least 90%, Japan's framework requires at least 95%, and the benchmark for licensed crypto trading platforms in Hong Kong is 98%. CertiK points out that higher levels of cold storage generally reduce online risk exposure, but at extremely high levels, the returns diminish, and a rigid storage ratio may slow down withdrawals, force hasty transfers, and concentrate risks in the key management system.CertiK suggests that exchanges set hot wallet limits for each asset and blockchain based on the most stringent of three restrictions: the percentage of customer liabilities, estimated withdrawal demand, and an absolute loss limit based on the exchange's financial resources and recovery capabilities. Additionally, Binance stated last week that it has replenished about 98% of the affected tokens after the hack and absorbed the losses itself, with the remaining tokens having lower liquidity and longer acquisition times. Elliptic reported that hackers linked to North Korea laundered money by issuing memecoins, transferring about $430,000 through six newly issued tokens on NEAR.

According to The Defiant, the real-time data dashboard of the blockchain security auditing firm CertiK shows that the cumulative losses in the cryptocurrency industry reached a record $9.2 billion in 2026.Data indicates that in October, $3.03 billion in assets were frozen or recovered, bringing the adjusted losses for the month down to $3.47 billion.

According to Cointelegraph, blockchain security company CertiK stated that although Google, Apple, and Microsoft have blocked 8 affected certificates issued by the Indian digital certificate authority eMudhra, cryptocurrency trading bots and exchange applications may still be exposed to related vulnerability risks, and browser fixes may not cover software that uses independent security systems.Peiyu Wang, Senior Director of Digital Asset Security at CertiK, pointed out that attackers could exploit the compromised certificates to impersonate exchanges, wallet interfaces, and APIs, replace deposit addresses, or induce users to approve malicious transactions. However, such attacks also require intercepting or redirecting network traffic, and the compromised certificate authority keys alone cannot expose wallet private keys. Cryptocurrency service operators should update software and certificate trust stores and ensure that applications reject affected certificates.

Three men from Bristol, England, broke into a man's home in the early hours of May 15, assaulted the victim, and demanded a large amount of cryptocurrency. The victim sustained head injuries and was hospitalized, while the three men failed to obtain any cryptocurrency. Terroll Paul, Mohamed Samagassi, and Pierre Madzou all pleaded guilty to aggravated burglary and were sentenced at Bristol Crown Court on October 15. Paul was sentenced to 6 years, Madzou to 5 and a half years, and Samagassi to 5 years.The victim's underage sister called the police, and the three were subsequently arrested at the scene. The police did not disclose the amount of cryptocurrency demanded by the three men. The case falls under "ransom attacks," where criminals use violence or threats to force cryptocurrency holders to hand over digital assets. Data from blockchain security company CertiK shows that in the first six months of 2026, such attacks globally resulted in losses of $124 million, a 12-fold increase year-on-year.

Security company CertiK's analysis shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker taking away 200 ETH, worth over $500,000. CertiK stated that the root cause was the lack of access control for the 0x8804d1de function in the keeper implementation contract.This contract was involved in the "Black Thursday" liquidation crisis in March 2020, when it won ETH with zero bids, with four transactions of 50 ETH each remaining unsettled. The attacker took this batch of funds and transferred them out in amounts of 10 ETH each via Tornado Cash. Although this contract is not currently a core part of the Sky ecosystem, old contracts with remaining funds may still become targets for attacks.

Layer 1 blockchain Sui announced that its programmable off-chain channels processed over 40 million transactions per second during a real-time stress test aimed at high-frequency activities for AI agents, breaking the record set in July of this year. The test was conducted on Wednesday at the Sui Basecamp in Singapore, peaking at 40,614,180 TPS, surpassing the approximately 6.1 million TPS level of similar tests in July.During the test, transactions were processed through Sui's off-chain channels, which settle to the Sui mainnet when closed. Sui stated that over 10,000 channels were opened on the mainnet during the test, covering scenarios such as payments, gaming, and chat applications. These channels are designed to handle high-frequency activities, including interactions between AI agents, without requiring each transaction to be processed directly on-chain.Adeniyi Abiodun, co-founder and Chief Product Officer of Sui's original contributor Mysten Labs, stated that Sui is built for the moment when millions of AI agents transact daily, noting that no market in the world needs 6 million transactions per second, let alone 40 million; humans cannot move that fast, but agents can. Security company CertiK served as an independent auditor during the demonstration, reviewing the test data, with a report expected to be released in the coming days.

The CertiK security data dashboard shows that a total of 247 security incidents occurred in the third quarter of 2026, an increase of 12.8% compared to the previous quarter; the total loss was approximately 1.26 billion USD, an increase of 53.9% from 819.4 million USD in the second quarter.

The Ethereum client Besu has fixed five security vulnerabilities discovered by the blockchain security company CertiK in version 26.7.1 released on July 27, and published four detailed security announcements on August 14. The details of the vulnerabilities were disclosed later to allow node operators to complete the upgrade deployment.Jialiang Chang, CertiK's Director of Security Engineering and Senior Audit Partner, stated that the arrangement of releasing patches first and details later provides an 18-day buffer period, allowing node operators to identify affected deployments, test the new version, and coordinate with validators or consortium participants to complete the upgrade. The relevant vulnerabilities involve block broadcasting processing, future height consensus proposal caching, WebSocket subscription limits, and JSON-RPC filter creation. If not fixed, attackers could exhaust node memory or thread resources, affecting node availability and consensus processing.CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network using the Chain Scan method, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand around-the-clock multi-node testing for public chain networks.

According to CertiK monitoring, Term Labs suffered a governance attack, resulting in a loss of approximately 8.5 million dollars in assets. Currently, the attacker's address holds 2,843 ETH (approximately 7.1 million dollars) and about 1.6 million DAI.

Web3 security company CertiK released the report "Intel3D: PSAV and Brazil's New Security Standards." The article points out that as the deadline for authorization applications set by the Central Bank of Brazil (October 30 of this year) approaches, local virtual asset service providers (PSAV) are facing a round of concentrated compliance adjustments, and compliance and security certifications issued by independent third parties are transitioning from industry best practices to important requirements for market access.According to the report, CertiK is currently conducting independent external audits based on the Central Bank of Brazil's Normative Instruction No. 701. As one of the markets with the highest adoption of crypto assets globally, the impact of this regulatory transformation in Brazil may far exceed the local market. The report shows that Brazil currently ranks fifth in the world for actual crypto asset adoption rates. From June 2024 to June 2025, the on-chain asset value received by Brazil reached $318.8 billion, accounting for nearly one-third of on-chain activity in South America during the same period. Stablecoins have become an important infrastructure in the local digital asset market, accounting for about 80% of the trading volume in crypto asset transactions reported to the Federal Revenue of Brazil.

CertiK stated that its monitoring system detected two transactions of 200 ETH each being transferred to Tornado Cash, and the related funds are associated with the ongoing Coldcard Wallet attack incident.The aforementioned funds were previously transferred from BTC to an Ethereum address via THORChain, and then subsequently transferred to Tornado Cash.

Web3 security company CertiK released the "2026 First Half Wrench Attack Report." The report shows that in the first half of 2026, a total of 52 publicly verified wrench attack incidents were recorded globally, an increase of 33.3% year-on-year; related losses amounted to approximately $124 million, an increase of about 11.8 times compared to the same period last year.The report points out that attackers are shifting from exploiting technical vulnerabilities to targeting asset holders and their real-world relationship networks, with home invasion incidents rising from 1 in the first half of 2025 to 20, accounting for 41% of the total incidents during the same period. Europe has become a high-frequency attack region, with 33 incidents occurring in France, accounting for 63.5% of global cases.CertiK states that as real-world risks become a significant challenge for digital asset security, businesses and high-value individuals need to establish a more comprehensive protection system. CertiK has launched operational security services to help identify risks related to the exposure of information such as identity, home, residence, and travel trajectory; at the same time, through CertiK Security Workspace, it correlates off-chain intelligence, on-chain transactions, and AML risk signals to support institutions in tracking and analyzing cybercrime activities.In addition, CertiK is strengthening cooperation with international law enforcement agencies such as Interpol and Europol to provide technical support for cross-border attack investigations and security policy research.

Web3 security company CertiK released the "Hack3D: First Half of 2026 Report." The report shows that in the first half of 2026, the Web3 ecosystem experienced a total of 344 security incidents, with cumulative losses of approximately $1.32 billion. Although this figure represents a 46.8% decrease compared to the same period last year, if we exclude the impact of the $1.45 billion security incident encountered by Bybit, the loss scale in the first half of this year has actually increased by about 28% year-on-year, indicating that the overall security environment in the industry has not seen substantial improvement.The report points out that wallet theft has become the largest type of attack causing financial losses, resulting in approximately $450 million in losses in the first half of the year; meanwhile, although the number of phishing attacks has decreased by over 50% year-on-year, the amount of losses has only decreased by about 10.8%, reflecting that attackers are increasingly targeting high-net-worth individuals and institutional targets, implementing more focused high-value attacks.In addition, code vulnerabilities remain the most frequently occurring type of attack, with related incidents reaching 204. CertiK believes that attackers are increasingly targeting long-running and outdated smart contracts that lack re-auditing.The report also shows that large-scale attack incidents continue to dominate industry losses, with the Kelp DAO and Drift Protocol incidents collectively causing approximately $577 million in losses, accounting for 44% of the total losses in the first half of the year. From the perspective of incident quantity, the impact of single attacks, and changes in attack patterns, the Web3 industry is facing increasingly complex and continuously escalating security challenges.

According to CertiK monitoring, the decentralized privacy protocol Hinkal Protocol has experienced suspicious transactions. The address (0xbB3...fc20) executed multiple "Transact" transactions after initiating a "Proofless Deposit," withdrawing approximately 800,000 USDC from the Hinkal contract.

According to monitoring by CertiK, the Edel Finance lending market was attacked. The attacker engaged in unauthorized borrowing by manipulating the collateral price of wGOOGLx (which depends on its GOOGLx balance), resulting in a loss of approximately $204,000 for the protocol. The relevant attack transactions have been flagged, and security agencies remind users to be aware of the risks.

According to the latest data from CertiK Skynet, Websea has maintained a security rating of over 80 in the A-grade high score range after completing its third round of professional penetration testing, with its overall ranking showing a steady upward trend, continuing to rank among the top in the global exchange security list.This assessment covers core dimensions such as smart contract security, system architecture stability, risk control mechanisms, and asset protection capabilities. The comprehensive assessment results further confirm that Websea has a highly mature and robust security system, with overall security performance at a high level within the industry. As a mainstream third-party security organization in the industry, CertiK's continuous audit and penetration testing results further strengthen Websea's long-term industry endorsement in terms of security transparency and credibility among global exchanges, and also enhance market recognition of Websea's security and credibility.

According to security agency CertiK's monitoring, a suspicious transaction was transferred from the Aztec Router contract on Ethereum, involving approximately 2.19 million dollars in assets.The transaction exhibited unusual outflow characteristics, and CertiK reminds the community to remain vigilant.

Blockchain security company CertiK's latest data shows that in May 2026, losses in the crypto industry due to hacking, exploitation of vulnerabilities, and fraud amounted to approximately $68.3 million, a decrease of nearly 90% compared to over $650 million in losses in April, making it the third month this year with losses below $100 million.CertiK stated that approximately $2.6 million in losses during May came from phishing attacks. In contrast, in April, significant attacks on Drift Protocol and KelpDAO's infrastructure resulted in losses of approximately $285 million and $292 million, respectively, with these two incidents accounting for about 95% of the total losses for that month, making April one of the worst months for losses since March 2022.Despite the reduction in large-scale attacks at the protocol level, CertiK warns that risks such as phishing attacks, social engineering scams, deepfakes, and credential leaks continue to grow. Researchers point out that an increasing number of attackers are targeting employees, operational systems