Exploit post-mortems, DeFi hacks, on-chain forensics, and protocol security.
Crypto Security is where we cover the exploits, hacks, and on-chain forensics behind the money. We publish original post-mortems of DeFi and bridge exploits, trace stolen funds across chains, and break down the vulnerability classes — reentrancy, reserve manipulation, deprecated contracts, oracle abuse — that keep draining protocols. Every incident is checked against block-explorer data and primary post-mortems before we publish, and we correct the record when the viral number is wrong.
A seed phrase has no reset button — lose it and the crypto is gone, with an estimated 2-4 million BTC already lost this way. Here's how to back up those words so they survive fire, theft, and the day you're not around.
As GTA 6 pre-orders open June 25, security firms report a surge of fake 'early access' sites taking irreversible crypto payments and pushing malware that drains wallets and intercepts 2FA codes. Rockstar is not selling early access -- here's how to tell the scams apart and protect your wallet.
Behind the 'wrong number' crypto-investment texts is a forced-labor industry: people lured by fake jobs, trafficked into Southeast Asian compounds, and made to run pig-butchering scams that cost victims an estimated $7.2B in 2025. Here's how it works -- and how to refuse it.
In 2026, ~65% of crypto's $11.36B in scam losses come from social engineering, not exploits — including ZachXBT-documented $91M and $282M cases. Here's how the manipulation works (fake support, panic plays, pig-butchering) and the hard rules that stop almost all of it.
Most crypto losses aren't exotic hacks — they're approvals you signed and forgot. Here's what a token allowance is, why 'unlimited' approvals are a standing liability, and exactly how to check and revoke them with Revoke.cash, Etherscan, or your wallet.
Public blockchains remember everything, so stolen funds leave a permanent trail. Here's how forensic firms follow the money, where mixers and bridges fall short, the choke points that enable freezes, and what actually gets recovered.
On-chain trackers say the UXLINK attacker swapped ~14.6M DAI for 8,298 ETH and funneled 8,340 ETH into Tornado Cash on June 17, 2026 — while ~$10.5M in stolen DAI still sits in the open. A look at the fund flows and why the mixer is back in play.
Most crypto losses aren't exotic — they repeat the same handful of failure modes we see in every post-mortem: blind approvals, dust left in dead protocols, registrar and phishing weak points, and chasing thin-liquidity tokens. Here is a practical, no-hype defense checklist drawn directly from the incidents we've reported.
From July 1, 2026, Russia's central bank will restrict non-qualified retail investors to just three digital assets — Bitcoin, Ethereum and USDT — with a ~$4,000 annual cap and mandatory risk testing. Everything else, including XRP and Solana, requires 'professional investor' status. It's an allowlist model for retail crypto, and other regulators are watching.
A DOJ-led public-private operation disabled more than 1.4 million Southeast Asian scam accounts and made 63 arrests — yet froze under $4 million in crypto. The viral '$3 billion frozen' figure is wrong, and the real gap between accounts taken down and money recovered is the actual lesson.
The US seized 127,271 bitcoin — about 0.64% of all the bitcoin ever mined — from Cambodia's Prince Group, the largest forfeiture in DOJ history. The coins sat untouched since 2020, yet were fully traced. Now the fight is over where $15 billion goes: a federal reserve, or the scam's victims.
DeFi project DIP Protocol was drained of roughly $111,000 on BNB Chain through a token-transfer bug that let an attacker double-count pool reserves. Here is the class of flaw involved and why it keeps reappearing.
An attacker exploited a settlement-boundary flaw in Aztec Connect's abandoned RollupProcessorV3 contract on June 14, 2026, draining roughly $2.19M in ETH and stablecoins. The privacy bridge was sunset in March 2023 and Aztec Labs holds no keys to pause it. The case is a reminder that "deprecated" is not "safe."