AML Banking: A Compliance Checklist for Banks

AML banking checklist: onboarding KYC, transaction monitoring, suspicious activity reports, and a risk-based approach banks must operate at exam speed.

AML in Finance: How Traditional Institutions Fight Money Laundering

AML in finance spans customer due diligence, transaction monitoring, and suspicious reporting for banks, brokerages, and asset managers in every regime.

Blockchain Security Software: Attack Prevention, Compliance Monitoring, and the Overlap

Blockchain security software spans attack prevention and compliance monitoring: where the two overlap, what each covers, and how a combined stack works.

Blockchain Forensics Software: What Investigation Teams Should Expect

Blockchain forensics software for investigation teams: path reconstruction, entity attribution, evidence quality, and how the capability tiers differ.

OFAC Sanctions Monitoring for Crypto: What Changes After Designation

OFAC sanctions crypto news is an operational event: every designation updates the SDN list and can flip already-onboarded wallets from clean to risky overnight.

SAR Form: What a Suspicious Activity Report Contains

SAR form: what a suspicious activity report contains. See the key fields, jurisdictional format differences, and how a KYT tool exports the draft for review.

Stablecoin Regulation: A Global Framework Overview

Stablecoin regulation spans the US GENIUS Act, EU MiCA, and Hong Kong and Singapore rules. See how frameworks converge on reserves, redemption, and licensing.

What Is a SAR? Suspicious Activity Reports in Crypto Compliance

A SAR (Suspicious Activity Report) flags suspicious transactions to regulators. Learn what a SAR is, how it differs from an STR, and who must file it.

~$320M Lost: Liquid Network, Symbiosis Exploits | BlockSec

This report, covering 2026/09/07 - 2026/09/13, examines two security incidents that caused approximately $320M in losses, including the Liquid Network exploit of 2026/09/06 that the previous report did not cover. The larger was that Liquid Network exploit, where the rangeproof validation cache in Elements derived its key by hashing four fields — two of them variable in length — concatenated with nothing marking the boundaries between them, so a verdict recorded for one output was returned for another whose proof was never examined, letting the attacker create 4,000 unbacked L-BTC and peg out nearly all of them as bitcoin. On the Bitcoin route of the Symbiosis cross-chain bridge, spanning BNB Smart Chain, Ethereum and Rootstock, off-chain code that reads Bitcoin deposits took the depositor's identity from a field the depositor controls and then subtracted its fee from the deposit without checking whether the fee itself was negative, letting a 330-satoshi deposit mint `46,116,860,184.27388234 syBTC`; the pools it had to be sold through held only 11.26 syBTC, so the loss to liquidity providers and users came to an estimated 9.97 BTC (~$770K).

~$9.4M Lost: Injective, Aquifer Exploits | BlockSec Weekly

During the past week (2026/08/31 - 2026/09/06), four security incidents caused approximately $9.4M in losses across Injective, Solana, Ethereum, and Flow EVM. The largest was the Injective exploit, where an insurance fund identifier collided with a binary options market identifier and the settlement path never compared their denominations, draining about $4.8M; Aquifer on Solana lost about $2.47M because its swap path invoked an unvalidated caller-supplied Token Program, and Notional Finance V1 on Ethereum lost about $1.73M to an unchecked `uint128` cast that valued a debt at zero. Ankr FLOW on Flow EVM closed out the week with about $410K drained through a staking entry point that skipped its pause guard and minted against a stale ratio.

From Incidents to Regulation: Why Crypto Institutions Need Blockchain Penetration Testing

Exchanges, payment firms, custodians, and wallet providers now lose the most money beyond the smart contract—in signing, custody, keys, people, and supply chains. Code-level audit and transaction-level monitoring each leave a gap, and traditional penetration tests may miss crypto's signing and fund semantics. This article opens our blockchain penetration testing series with the two legs of the case for institutions in scope: where the risk actually comes from, and how NYDFS, DORA, VARA, SFC, and MAS treat adversarial testing across five jurisdictions.

What Is Blockchain Penetration Testing? Definitions and Boundaries

No widely accepted definition of blockchain penetration testing exists, and many proposed ones tangle it with audit, scanning, and bug bounty. This article sets out a working definition—an adversarial, hands-on assessment of a running system, under agreed scope and rules of engagement, that validates exploitable paths and control chains—and what web3 adds: a money-handling threat model whose defining composition gap is the off-chain-to-on-chain handoff. It then maps the five testable capabilities of that chain and routes nearby objectives to code audit, wallet security audit, web3 security testing, scanning, and bug bounty.