Coinspect Security

You Build. We Defend.
Since 2014 protecting critical decentralized systems: L1 nodes, smart contracts audits, wallets, web3 dApps, exchanges, bridges.

[sudo rm -rf --no-preserve-root / @pcaversaccio]

zcash is actually up, it's a node issue for many explorers (since not updated apparently); people should first verify before claiming a network is down

here to verify the latest block:

```
grpcurl -d '{}' https://t.co/xySW7cICIv cash.z.wallet.sdk.rpc.CompactTxStreamer/GetLatestTreeState
```

[Coinspect Security @coinspect]

Needed.
About "No composite scoring" (we ♥️ rankings): sounds neutral, but in the vertical interfaces we scroll every day, something always goes first.
Ordering can be hidden in UI defaults, or explicit with raw data, methodology, expert-voted weights, and adjustable by users.

[charles (csl) ᛋ @CharlieStLouis]

1/ The EF App Relations team is putting out an open RFP for a neutral DeFi risk intelligence aggregator.

Public good, open source, no composite scoring. If you're the team to build this, applications close June 15.

Apply here: https://t.co/vvbZiEBH4h

Here's how we got here 👇

[Coinspect Security @coinspect]

@Bookof_Eth @CharlieStLouis @ethereumfndn Weights can be voted on transparently, combined with AHP, pairwise voting and exposed as adjustable sliders so users can reflect their own priorities; while raw data always remains available.
We are developing a web app to make weight voting less tedious.

[Juliano Rizzo @julianor]

BOMB "... found myself back in 2012. That year, Juliano Rizzo and I discovered CRIME, a compression oracle that recovered cookies from compressed HTTP headers. I was at Google at the time, so I was asked to review the fix, ... I just re-read my notes from that review..."

[koeppelmann @koeppelmann]

Unfortunately, there is a hack related to @gnosispay and the "delay module".
Please be patient while we try to contain the damage. Rest assured, Gnosis will cover all user losses.

[Coinspect Security @coinspect]

Incident worth following:

[mrwildcat @mrwildcat7]

I'm certainly underestimating the amount stolen, given that addresses on the Bitcoin network were also drained.
The most likely cause is the use of a faulty mnemonic implementation that does not generate seeds with enough entropy to be secure.

[Coinspect Security @coinspect]

Thanks to @Giveth, @thedaofund, and the Ethereum community for backing our Wallet Security Ranking in the QF Round.
We're proud to be part of this ecosystem-wide effort.
We'll keep shipping transparent and open resources that help improve web3 end-user security — with more public goods to come.

[Blockchain Threat Intelligence @blockthreat]

BlockThreat - Week 21, 2026

$7.7M was stolen across 11 incidents this week.

10+ hacks a week is the new baseline.

This week’s BlockThreat focuses on three attack vectors DeFi projects and security auditors should prioritize immediately.

[Giveth @Giveth]

🛡️ The results for the @thedaofund’s Ethereum Security QF Round are LIVE!

This historic round is closing with a HUGE last minute contribution:

@wintermute_t has added $200K to the matching pool 🔥

Wintermute is a well known liquidity provider, and one of the leading supporters of Ethereum security, in fact exactly a year ago today they donated $1M to @_SEAL_Org.

This year they teamed up with TheDAO, @Quantstamp & several other community partners to allocate over $1.6M worth of funding to Ethereum Security Public Goods 👇

[Coinspect Security @coinspect]

"secure" has ingredients

[vitalik.eth @VitalikButerin]

In an ideal world all software and hardware would have "nutrition labels" that provide a full list of trust dependencies - what math and which actors' honest behavior (and on what time scale) the system is relying on to provide its core functionality and implied guarantees.

[Coinspect Security @coinspect]

👀 The new Wallet Security Ranking repo started to move
Wallet teams: if you've improved your app since our last review, open an issue!

[Coinspect Security @coinspect]

In wallets, the challenge is building features that are secure, respect privacy, and are usable at the same time.
A weak privacy feature can be worse than no privacy feature: it gives users confidence without giving them protection.

[Coinspect Security @coinspect]

Privacy was on the checklist when we started the Wallet Security Ranking.
We tested security first because security is what makes meaningful privacy possible.

[Coinspect Security @coinspect]

cc @MetaMask
@CBWalletUK
@ambire
@OneKeyHQ
@Rabby_io
@rainbowdotme
@zerion
@BinanceWallet
@phantom
@Ctrl_Wallet
@coin98_wallet
@exodus
@brave
@TrustWallet

[Coinspect Security @coinspect]

📢 Wallet Vendors:
Our Wallet Security Ranking is fully open & collaborative.
Spot a testing mistake?
Fixed an issue we flagged?
➡️ Let us know.
Just click "Report an issue with this check" on any wallet report (one-click GitHub issue template in our repo)

[Coinspect Security @coinspect]

@VitalikButerin @donnoh_eth @zklim5389 and dApp frontend privacy? many delivering obfuscated trackers that get your wallet address and more.

[Juliano Rizzo @julianor]

1/ From all the recent writeups, I pick a few to read carefully and enjoy while drinking 🧉 and eating chipa, the way I did before with every (yes) Bugtraq post.
This week:
Qualys ptrace LPE, CVE-2026-46333 — no AI
Linux PDF RCE, CVE-2026-46529 — human+AI
Both are worth reading:

[Juliano Rizzo @julianor]

🚨GitHub CONFIRMS breach of ~3,800 internal repositories.
Root cause: Poisoned VS Code extension on employee device.
Exfiltrated: GitHub Actions, Enterprise, Copilot, CodeQL, billing/auth platforms + more.
✅ No customer data impacted
Log analysis and secret rotation in progress.

[Juliano Rizzo @julianor]

TeamPCP post 4 hours ago:

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.