17+ hour, 27+ min ago   (1756+ words) Since September 11, 2026, anyone offering a wallet commercially in the EU must report an actively exploited vulnerability within 24 hours and inform the affected users. What Article 14 of the EU Cyber Resilience Act requires, where the limit of interpretation lies, and what…...

17+ hour, 34+ min ago   (1831+ words) An attacker drained 736,442 USDT through Chainflip's Tron rail on September 12, 2026, and trading has been at a standstill ever since. On September 13 we measured for ourselves which functions of the protocol are switched off and which are still running. Chainflip is…...

23+ hour, 16+ min ago   (1795+ words) Since the Ironwood upgrade of July 28, 2026, Zcash's old Orchard pool has been sealed, and every shielded balance has to cross into the new pool individually through a turnstile. At the end of August, 470,000 ZEC were still in the old pool....

1+ day, 11+ hour ago   (1834+ words) An attacker minted billions of unbacked syBTC on the cross-chain bridge Symbiosis and pulled out roughly $336,000. We checked for ourselves on September 12 which routes are still running: the way into the bridge is suspended, the way out is open. Symbiosis…...

4+ day, 2+ hour ago   (1796+ words) An alleged security warning to wallet customers travelled through the manufacturer's genuine sending channel and passed every technical authenticity check. The test that still holds costs you four minutes. This article explains how to recognise a forged security warning when…...

4+ day, 6+ hour ago   (1808+ words) Trezor users received a fake STM32 entropy warning sent from a real Trezor address. Here is what happened and what to do if you clicked. The company confirmed on Wednesday that attackers had gotten into its email infrastructure and used it…...

4+ day, 11+ hour ago   (1792+ words) Cronos discarded 10,961 blocks, almost two hours of chain history, to claw back $111.2 million from the Tectonic attack. We show you exactly which time window is affected, how to check your own transaction and what a rollback cannot retrieve. On September…...

6+ day, 8+ hour ago   (1789+ words) A withdrawal whitelist lets balances leave only to addresses approved in advance, and it works even when password and second factor are compromised. On September 8, 2026 we checked which of thirteen providers document the function publicly. Definition in one sentence: a…...

6+ day, 8+ hour ago   (1661+ words) After $322 million in losses in a single September week, the question is who replaces stolen coins. On September 8, 2026 we retrieved the security and legal pages of twelve providers and evaluated what is promised there. Germany has two statutory safety nets…...

6+ day, 8+ hour ago   (1769+ words) A little more than half of all Tether dollars sit on a chain whose token contract is steered by a multisig address with a threshold of two out of three. We queried the structure on-chain ourselves on September 8, 2026, and show…...