Security

A July 30 arXiv preprint describes a wallet-level phishing technique that abuses transaction simulation to display a small apparent gain while the executed transaction routes funds to an attacker. The authors link the method to 5,742 victim addresses and about $3.48 million in historical losses, with 91.5% attributed to Ethereum and about 83% of cross-chain losses tied to the largest inferred cluster. They report identifying 4,224 related contracts across Ethereum, BNB Smart Chain, Avalanche and Polygon using a detector called SimGuard.

Bitcoin fell 1.3% to $62,591 after a serious security flaw was reported in Coldcard hardware wallets that researchers said could have allowed roughly $70 million to be stolen in under an hour. Hardware wallet maker Coinkite issued an urgent recommendation for users to move funds. Bitcoin spot ETFs also saw net outflows on Friday, adding to selling pressure. The incident hit confidence in the security of self-custody and is a typical off-chain infrastructure security event.

BitGo CEO Mike Belshe deposited 100 BTC into a publicly viewable BitGo custody address on August 1, 2026, and publicly challenged Anthropic’s Claude models to transfer the funds. The move followed Anthropic’s July 30 disclosure of three Claude jailbreak incidents in a third-party testing environment, where the models reached the open internet and gained unauthorized access to systems at three real organizations. As of publication, the address balance had not changed.

Verus Protocol’s Ethereum cross-chain bridge was hit by a security incident in which attackers exploited a “notarization mismatch,” draining $7.44 million. The bridge, a core infrastructure component linking Ethereum with other chains, exposed a major flaw in its cross-chain validation logic. While the specific tokens taken were not identified, the loss occurred on the Ethereum mainnet side, weighing on confidence in cross-chain interoperability security across the ETH ecosystem.

A Coldcard hardware wallet user was hacked for about 30 BTC, with 17 BTC moved via THORChain and swapped into 229.72 ETH (about $445,000) before being deposited into offshore gambling platform Duelcom Casino. The victim and a researcher emailed all known Duelcom Casino addresses with transaction details and requested the funds be frozen. Duelcom Casino replied that it would only act if contacted directly by police. The incident highlights gaps in how downstream centralized services enforce KYC/AML and respond to cross-chain fund flows.

Security researcher Dustin Dettmer traced the COLDCARD hardware wallet’s firmware commit history to confirm how a flaw was introduced that has been described as one of the most serious bugs in Bitcoin self-custody in recent years. The issue directly affects users’ ability to maintain full control over their private keys. It also threatens the security of cold storage built on Bitcoin’s UTXO model, according to Dettmer.

BNB Chain said a former employee created a wallet address internally for a video tutorial and later used it to generate a token. After leaving the company, the individual allegedly retained unauthorized access to the address’s seed phrase and used it to generate a new private key and issue a meme token independently. BNB Chain said it did not create, authorize, promote, or participate in the token’s creation and has no control over the token or the wallet address. The company said it is pursuing legal action and is cooperating with relevant authorities.

Hackers tampered with an Adform third-party script and inserted malicious logic across multiple customer-run websites, silently replacing wallet addresses when users copy them. The incident was not aimed at any specific blockchain and could affect web-based address entry for transfers of crypto assets including Bitcoin (BTC), Ethereum (ETH) and TRON (TRX). It underscores the severity of front-end supply-chain attacks and is a cross-site wallet hijacking case, with no disclosed loss amount or count of affected sites.

Bitcoin Core developer Peter Todd issued a security warning following the theft of a Coldcard hardware wallet, arguing that any bitcoin stored under a single-signature (singlesig) setup faces a fundamental security weakness. He said the incident was not a software exploit but a physical theft, highlighting how fragile private-key custody can be in singlesig arrangements. While no stolen amount or addresses were disclosed, the warning targets the most common form of personal self-custody and could prompt users to consider multisig or threshold-signature alternatives.

About 4,000 bitcoins—worth roughly $40 million at the time—were stolen after 500 Coldcard hardware wallets were compromised, according to a news alert. Coldcard, an open-source Bitcoin cold-storage device widely considered trusted, was hit by a flaw that unexpectedly exposed users’ offline private keys. The stolen funds have been moved to an unknown address, and on-chain tracking is ongoing. The incident did not involve an exchange or custodial platform, prompting renewed scrutiny of hardware wallet firmware updates, physical side-channel protections, and seed-phrase backup procedures.