Arc 🤝 Turnkey @turnkeyhq is delivering secure, programmable key management infrastructure for developers building on Arc Testnet. This gives teams the control and reliability needed to build production-grade applications with more secure wallet and transaction flows. → API-first wallet and signing infrastructure → Fine-grained permissions and policy controls → Secure and verifiable backend infrastructure designed to scale Arc is production-ready. Built for applications that need to move with confidence.

Last week had over $53 million in onchain losses, with 10 major incidents spanning key management, signer/validator control, upgrade authority, and more AFX (Anti-Fragile Exchange): $24.15M USDC. AFX is a Layer 1 chain running a perpetuals exchange with an onchain orderbook. Compromised validator hot keys reportedly met the quorum with enough signatures to clear the threshold. AFX suspended the bridge and said trading infrastructure and mainnet were untouched; a 70% white-hat offer went unanswered. Triple-A: estimated $9.7M to $11.8M. Triple-A is a Singapore payments processor that lets merchants accept crypto and get paid in fiat. Attackers took control of operational and treasury wallets across at least four chains. Triple-A says client funds weren't touched, and the Singapore Police Force is involved. VerusCoin Ethereum Bridge: $7.54M. VerusCoin is a blockchain that lets people launch their own interoperable chains. This is the bridge’s second loss in two months, after the attacker abused submitImports to trigger Ethereum-side payouts unbacked on the Verus source chain. @blockaid_ calls it the same entry point and bug class as the $11.58M May loss. Wanchain Cardano-BNB Bridge / NIGHT: $9M to $13M (depending on NIGHT's price, 515.2M taken in nine minutes). Wanchain operates cross-chain bridges. NIGHT is the token of Midnight, a privacy sidechain on Cardano. BlockSec's early read blames non-injective signed-message encoding in the Cardano-side TreasuryCheck validator, which let an approval for ~3,110 NIGHT on BNB Chain be reused to pull 203M. Wanchain took the bridge offline and acknowledged unauthorised withdrawals, the Midnight Foundation called it contained, and exchanges added precautions. B² Network B2 staking: $3.86M (~$3.01M to $3.11M realised after ~$850K of slippage). B² Network is a Bitcoin Layer 2 and a staking service on BNB Chain. The draining address had held the staking contract's upgrade authority since 2025 and only lost it after the transfer, so this was likely a compromised or insider key rather than a seizure, though B² hasn't disclosed which. B² suspended staking, promised full compensation, and offered the hacker a white-hat bounty. WEMIX: $5.22M (only ~$724K realised as the token collapsed from $1 to ~$0.0008). The attacker compromised owner authority on a WEMIX$-related contract (WEMIX is the blockchain arm of Korean game publisher Wemade), and minted 5.2M tokens outside DIOS, the stabiliser that only mints against incoming USDC, so the new supply had no reserve behind it. WEMIX suspended bridges, paused the WEMIX$ Module and PNIX DEX, withdrew foundation liquidity, requested exchange and issuer freezes, and has a contract-wide audit underway. 42DAO / Balance Protocol: $914K (plus ~$3.5M of nominal BLC erased as the token fell from $0.9954 to ~$0.0014). 42DAO is a MakerDAO fork on BNB Chain, critically missing the original’s Oracle Security Module. The attacker manipulated the BTCB feed through the Spotter/VAT liquidation path, which lacked TWAP, bounds, floor, drawdown and delay controls. Lien Finance: $542K USDC. An attacker exploited this options protocol via a logic exploit that allowed for price manipulation in their OTC pools. SlowMist blames exchangeEquivalentBonds in BondMakerCollateralizedEth, which lacked multiset integrity checks and minted BondTokens without consuming collateral, while Defimon and ExVul trace the drain through GeneralizedDotc OTC pools. These are the original Lien BondMaker contracts, and the bug class matches the September 2020 whitehat rescue of ~$10M. Garden Finance: $450K USDT across Ethereum, Base, Arbitrum and BNB Chain. Garden Finance is a Bitcoin bridge where solvers compete to fill cross-chain swaps. The bridge suffered an exploit after an offchain database breach let the solver release funds for unfunded swaps, its second such compromise in nine months after a ~$11M loss. Garden took the app offline, said nobody lost funds, and is investigating with zeroShadow, Quantstamp and Blockaid. Guru-fund Lotus deployments: $96K to $101K (~$61.5K realised after slippage). The fund management protocol suffered a loss after an attacker exploited a legacy, never-verified P2P adapter that was left enabled in the protocol registry and could grant arbitrary token allowances through the delegatecall function during normal deposits. The Guru-fund team paused the protocol and announced the protocol will be winding down in the wake of this hack. With the variety of attack vectors and pace of exploits, it’s clear that attackers are constantly looking for any way in. Whether you’re a protocol, investor, or fund looking for protection against these risks and more, get in touch with our team today. You’re Covered with Nexus Mutual

Encryption is only as strong as its keys. Explore the public beta of Vault Kubernetes key management for centralized encryption at rest. Learn more ➡️

🚨 Abstract due Mon 3 Aug Call for Papers: NEDO Challenge 2 × CSS 2026/BWS Security of blockchain systems in the quantum era: papers on evaluation criteria, PQC migration, key management & testbed design.

Weekend mode activated ⚡ While the markets sleep, agents don’t. This week we shipped: ✅ $50k Bug Bounty live ✅ New security layers for agent key management ✅ Fresh partnership energy with @BellaProtocol Now it’s your turn. Drop into Discord, test the testnet, or just vibe with other builders. Who’s shipping something agentic this weekend? Join → SVP Rewards → #SVPChain# #AgenticFinance# #AIAgents# #BuildInPublic# #Web3#

The smart contracts are getting better. The ops around them aren't. @gbvpzffd2r, CTO of Hypernative, said it plainly on The Cap Room: the industry has matured on the code side with better audits, more experienced developers, more secure contract design. The gap now is in operations. AWS configurations, admin access controls, key management, jump servers: the Web 2 hygiene that enterprise security teams treat as table stakes. Hypernative came to Web3 from Web2, and that background shaped what the company built. A classic CSO walking into a DeFi team today would find a lot that looks foreign. That gap is where attackers are operating now. Learn more at

Qubitor $QBT is a Base-launched post-quantum security ecosystem built around the next migration in crypto security. CA: 0x24D621B1f5f1CF295313C88dC331012140e52D54 The first focus is the account and operations layer: wallets, smart accounts, bridge controls, admin keys, sequencer/operator keys, governance, and upgrade authority. Qubitor Network is developing a post-quantum execution layer track with PQ-native accounts, ML-DSA verification, and no-default-EOA architecture. Quanta Wallet is the official wallet/account layer owned and maintained by Qubitor, built for smart accounts, safer key management, hybrid signing paths, recovery, and future post-quantum upgrades. Quantum resistance is not a single switch. It is a full-stack migration. Liquidity Lock: - Liquidity is locked for 365 days and will be extended 3 months before unlock. Qubitor Foundation: - 3.33% supply locked for 3 months. This allocation is reserved for Tier 1 CEX listing preparation. - 3.33% supply locked for 6 months. This allocation is reserved for ecosystem expansion after launch. Qubitor's direction goes beyond the first market phase, with focus on account-layer security, stronger wallet infrastructure, safer signer models, recovery systems, key rotation, and future post-quantum readiness. This work needs room to grow properly. It involves development, testing, integrations, audits, infrastructure support, and long-term planning. - 3.33% supply locked for 1 year. This is Qubitor's long-term strategic reserve. It is reserved for bigger growth phases such as major partnerships, exchange expansion, market-making support, ecosystem incentives, audits, product development, wallet infrastructure, marketing, grants, and future integrations. The lock keeps this allocation out of early circulation while giving Qubitor room to support larger opportunities when the ecosystem is ready.

Important Announcement Trading on THORChain is currently halted after a vault was compromised. Initial indications are user funds are safe and only protocol owned funds are affected. The network automatically detected abnormal behavior and halted signing activity, which alerted the broader community and prevented further outbound transactions. The investigation is still ongoing to determine the root cause. Contributors are actively working on the issue and we will report updates as we progress toward a solution. What we currently know: * One of the six Asgard vaults appears to have been compromised. * Current estimates place the loss at approximately $10.7m USD * The network automatically detected the abnormal behavior and halted signing activity, preventing further outbound activity. * Nodes securing the vault were subject to their bonded RUNE being slashed as a result of the unauthorized outbound transactions. * Churn activity has been paused while the investigation and remediation efforts are ongoing. * Onboarding additional chains and operations requiring churns will be delayed until the network is stabilized. * Initial indications show no individual user swaps were affected. We are asking all node operators to immediately review their infrastructure, hosts, key management systems, and operational security for any signs of compromise or abnormal behavior, and to report anything suspicious in Discord. Node operators participating in the affected vault are requested to securely provide Bifrost logs to the dev team for analysis using 'make relay' .