A Twitter discussion notes that CoinGecko recorded 245 smart contract exploits from early 2025 through July 2026, with approximately 60% of exploited projects having undergone third-party audits. The post emphasizes that while audits provide a layer of security, they do not protect against all vulnerabilities such as leaked private keys, phishing attacks on staff, frontend compromises, or admin permission issues.
An investigation reveals that Dataflow Security, an Italian cyberweapons company founded in 2019 by hacker Luca Todesco, has developed close ties with Israel's intelligence establishment. Since late 2025, the company's Israeli subsidiaries have been led by Eyal Tsir Cohen, a former senior Mossad official who was previously shortlisted to lead Shin Bet, raising questions about the independence of these operations.
GoPlus Security challenges THORChain's decentralization claims, arguing the protocol could block DPRK-linked illicit funds using existing emergency mechanisms. A developer built NOCK, a risk detection tool for DeFi that monitors unusual capital flows across lending platforms and vaults, demonstrating early detection of contagion risks like the Kelp bridge exploit.
A crypto analyst argues that smart contract audits provide false security, as most 2026 exploits ($823.7M total) stem from compromised infrastructure and operational failures rather than code flaws. Major incidents like the Bitget hack ($351.6M) exploited backend vulnerabilities and key management weaknesses, while physical attacks and bridge exploits add further risk, shifting focus from protocol audits to custody and infrastructure security.
A blockchain security analyst argues that smart contract audits provide false security, citing $823.7 million in exploits in September 2026 where most losses stemmed from compromised infrastructure and key management failures rather than code vulnerabilities. The post warns institutions to prioritize custody risk assessment and hardware-enforced security over audited protocols, while predicting capital rotation toward decentralized execution environments like Solana and Base.
A social media post lists 12 cryptocurrency platforms and waitlists available in September 2026, followed by analysis of crypto security breaches totaling $823.7 million. The author argues that smart contract audits provide false security, with major exploits stemming from infrastructure vulnerabilities, key management failures, and physical attacks rather than code flaws.
ZKX Wallet discusses a Field Manual on security defenses against exploits, covering practices like verification, signature review, and flash loan protection. The post emphasizes applying these habits in practice and previews remaining topics including oracle trust, bridge research, and MEV protection.
A crypto wallet service explains that individual users don't need to understand flash loan exploit mechanics to protect themselves, as the defense must occur at the protocol level through oracle design and testing rather than personal practices. The key strategy is selecting trustworthy protocols rather than attempting direct mechanism defense.
A detailed post explains how crypto wallet approvals—permissions granted to smart contracts to move tokens and NFTs—pose ongoing security risks because they rarely expire and persist even after apps shut down. The author documents multiple real incidents across DeFi and NFT platforms where attackers exploited forgotten approvals to drain millions in assets, and advises users to regularly revoke these permissions.
A Twitter discussion thread documents major smart contract exploits and approval vulnerabilities in crypto. Examples include the $351.6M Bitget exchange breach, Magic Eden NFT marketplace drains via forgotten approvals, and multiple DeFi protocol hacks (SushiSwap, Li.Fi, BarnBridge) where users lost funds through infinite token approvals that were never revoked.
A weekly DeFi incident report covering multiple security breaches and hacks across blockchain protocols in September 2026, including smart contract exploits at Balancer, Safe, Nomic, ChainFlip, Ether Fi, and Yam Finance, plus a major phishing campaign via compromised Trezor email infrastructure that reached 347k addresses.
A retired Microsoft engineer explains how a Grok AI wallet transferred 3 billion tokens via a tweet encoded in Morse code, exploiting the wallet's agentic design that lacked human confirmation steps. The incident demonstrates 'authority laundering'—where untrusted input passes through multiple systems and appears trusted by the time it reaches execution, similar to SQL injection or prompt injection attacks.