The Onchain Security Roundup tracked three incidents last week with $122M+ in reported losses Coldcard / Coinkite: ~$114M. A five-year-old firmware defect in Coldcard hardware wallets routed seed generation through a weak software randomiser (instead of the hardware RNG), allowing an attacker to reconstruct victims' private keys entirely offline and sweep their bitcoin. There have been 3 confirmed waves of losses with a potential 4th one ongoing. Coinkite published an advisory on July 30 and shipped emergency firmware on July 31, but installing it doesn't repair a previously generated seed. CryptoDAO PRO (BNB Chain): ~$7.56M–$8.2M. The function that pays out PRO rewards was open for anyone to call, with no permission check and no limits. The attacker called it repeatedly, dumping 2.8M PRO into PancakeSwap and driving the price down 32%. @HypernativeLabs identifies the fault with CryptoDAO's own distributor contract rather than PancakeSwap. LULA (BNB Chain): ~$578.1K. LULA's token contract had a privileged function that could pull tokens out of its own PancakeSwap trading pool, skipping the usual transfer checks, and then tell the pool to treat the reduced balance as correct. The attacker staged helper contracts 12 days earlier, then used a $237M flash loan to load the pool with USDT, drained the LULA side until each remaining token looked enormously valuable, and sold a small amount back at the skewed rate. Onchain risk expands beyond smart contracts to firmware and signer design around the protocol layer Key generation, privileged token mechanics, and operational dependencies can all turn into loss vectors Evaluating all of the different risks your capital is exposed to can be a difficult task, but Nexus Mutual is here to help You’re Covered with Nexus Mutual