Hypernative is heading to Solana Breakpoint in London, November 15 to 17 🇬🇧 Breakpoint comes to London for the first time this year, with stablecoins, tokenized assets and payments at the center of the agenda. As more institutional capital moves onto Solana, the security layer has to keep pace. Meet the team: → Ernesto Daset, DeFi Director → Arya Torabi, Business Development If you are attending, we'd love to meet, drop us a note to set up a time. #Breakpoint2026# #Solana# #Hypernative# #OnchainSecurity#

Two days at Digital Asset Summit London. Our team kept count: the Binance hack came up roughly once every 90 seconds. It's a clear reminder that onchain security needs to be in place before an incident, not after. A few observations from our conversations with institutions, protocols and builders: 🔹 Institutional adoption is accelerating, and security expectations are rising with it 🔹 Real-time monitoring and proactive risk management are becoming core infrastructure 🔹 The focus is shifting from responding to incidents to preventing them Thank you to everyone we've met over the last two days. If we haven't connected yet, we're excited to meet you tonight at our cocktail hours event. #DASLondon# #DigitalAssets# #OnchainSecurity#

The Onchain Security Roundup tracked 1 material incident last week with over $7.9M in losses Coinsbuy: $7.9M-$8.07M. The crypto payment processor's hot TRON and Ethereum wallets were drained on August 9th. At this time, it’s unclear how the attackers got in, but some have theorized the theft was due to compromised private keys or a vulnerability in how Coinsbuy managed its multi-chain wallet infrastructure. Once the attack was detected, Coinsbuy paused deposits and withdrawals. They have since restored services and refilled the affected wallets. With the help of the ChangeNOW exchange, a six-figure portion of stolen funds was also frozen. For teams holding or processing onchain capital, this is a reminder that the loss path is not always a contract bug. Hot-wallet controls, signer access, operational response, and exchange or off-ramp dependencies can matter as much as protocol code. Nexus Mutual works with builders to assess these risks and more. If you’re looking for expert help in protecting your protocol and its users, get in touch with us. You’re Covered with Nexus Mutual

The Onchain Security Roundup tracked three incidents last week with $122M+ in reported losses Coldcard / Coinkite: ~$114M. A five-year-old firmware defect in Coldcard hardware wallets routed seed generation through a weak software randomiser (instead of the hardware RNG), allowing an attacker to reconstruct victims' private keys entirely offline and sweep their bitcoin. There have been 3 confirmed waves of losses with a potential 4th one ongoing. Coinkite published an advisory on July 30 and shipped emergency firmware on July 31, but installing it doesn't repair a previously generated seed. CryptoDAO PRO (BNB Chain): ~$7.56M–$8.2M. The function that pays out PRO rewards was open for anyone to call, with no permission check and no limits. The attacker called it repeatedly, dumping 2.8M PRO into PancakeSwap and driving the price down 32%. @HypernativeLabs identifies the fault with CryptoDAO's own distributor contract rather than PancakeSwap. LULA (BNB Chain): ~$578.1K. LULA's token contract had a privileged function that could pull tokens out of its own PancakeSwap trading pool, skipping the usual transfer checks, and then tell the pool to treat the reduced balance as correct. The attacker staged helper contracts 12 days earlier, then used a $237M flash loan to load the pool with USDT, drained the LULA side until each remaining token looked enormously valuable, and sold a small amount back at the skewed rate. Onchain risk expands beyond smart contracts to firmware and signer design around the protocol layer Key generation, privileged token mechanics, and operational dependencies can all turn into loss vectors Evaluating all of the different risks your capital is exposed to can be a difficult task, but Nexus Mutual is here to help You’re Covered with Nexus Mutual

The Onchain Security Roundup tracked 6 major incidents last week, with over $28.3M in reported losses As smart contract security improves, attackers are going after the underlying economic assumptions (oracles, liquidity depth, mark prices) rather than the contracts themselves Ostium: 23.75M USDC drained from its LP vault after offchain price-feed infrastructure was compromised. @blockaid_ reported that a registered PriceUpKeep forwarder and future-dated authorized oracle reports were used to create artificial trading profits to extract funds from the OLP vault. Trading remains paused, with investigation and LP recovery details pending Allbridge Core: $1.65M lost from a flash-loan-assisted manipulation of Allbridge's StableSwap-style automated market maker, where the attacker exploited the same-asset swap accounting divergence. The protocol paused and asked LPs in affected pools to withdraw while the investigation continues Cascade CLS Vault: $1.3M lost after thin-liquidity markets and manipulated mark prices triggered liquidations against the CLS vault. Trading and withdrawals remain paused BarnBridge SMART Yield cUSDC: $776K drained from a dormant protocol after a governance takeover allowed the attacker to use legacy USDC approvals DeFiTuna: $570K lost from a Solana lending-pool issue involving a highly illiquid TUNA/USDC pool, Jupiter routing, and a rounding/solvency-check flaw. DeFiTuna said the vector was identified and mitigated, with investigation and recovery ongoing Lumi Finance / Sodium Smart Accounts: approximately $270K drained after a design flaw in smart-account validation logic allowed an attacker to gain unintended token approvals These are the exact sorts of risk that Nexus Mutual can cover: oracle failures, oracle manipulation, governance takeovers, and smart contract exploits Whether you’re a protocol, investor, or fund looking for protection against the changing risks in DeFi, Nexus Mutual is there to help

The future is onchain. The SEC’s Innovation Exemption clears a path for tokenized equities where the onchain security is the actual share. “A defined U.S. route for trading real tokenized stocks on public blockchains.” @CoinDesk on what changes:

David on why quantum computers are a bigger threat to onchain privacy than onchain security: "Our world runs on encryption. There's obviously always risk the moment that there's data, but this is not something that I would consider a high risk." "Right now we have demos built to show how you do that. You use an ephemeral key. So you generate some sort of signature with your local key, like your passkey or your YubiKey, and then you use that in order to create an ephemeral key that is the encryption or decryption key for storing the user share." "So unless someone has access to the passkey or the YubiKey, they won't be able to decrypt it, just like you're not able to decrypt anything today in the world." "Then we can talk about quantum computing and what risk that poses for things that are encrypted onchain, but that's a whole other conversation. This is a security encryption, it's not a privacy encryption. With privacy, what you do is you harvest now and you decrypt later." "But with security, the moment that there's an actual quantum risk, then it doesn't matter that you have the old key, because it doesn't mean anything." FT @d3h3d_

If you want to learn about how @safe is thinking about defending multisigs from offensive AI with onchain security markets, come to my talk tomorrow. I will be presenting Safenet. Thu Nov 5, 10:30 – 10:55, Lotus Stage 2 (L3)

Researchers built a fake DeFi startup and hired North Korea's operatives just to watch how they work. It's one of five onchain security stories @kain and @tayvano_ get into this week on Uneasy Money, live today Wednesday 4pm ET.