~$36M Lost: Summer.fi, Bonzo Lend & More | BlockSec Weekly

This weekly security report covers 3 notable incidents from July 6 to 12, 2026, with total losses of approximately $36.29M across Ethereum, Solana, and Hedera. The highlighted Summer.fi incident ($6.04M) demonstrates how an incompletely offboarded vault component still counted in total assets can be weaponized for share price inflation, and Bonzo Lend ($9.05M) was compromised through a BLS signature verification bypass in the Supra oracle. Both incidents include background, vulnerability details, step-by-step attack breakdown, and actionable security recommendations.

Trace AI: Track Stolen Crypto With an AI Agent | BlockSec

Coming soon — a consumer-facing on-chain investigation agent that turns a single conversation into a complete fund-tracing report.

~$800K Lost: Hinkal Double-Spend | BlockSec Weekly

This weekly security report covers 1 notable incident from June 29 to July 5, 2026, with approximately $800K in total losses on Ethereum. The Hinkal shielded-pool protocol was drained through a double-spend attack that likely exploited a flaw in the legacy note format, allowing the attacker to derive multiple nullifiers from a single deposit. The report analyzes the probable circuit-level vulnerability, the attack flow, and broader implications for nullifier-based privacy protocols.

Crypto Payment Security & Compliance: The Controls to Confirm Before Going Live

BlockSec and NOWPayments built a Crypto Payment Security & Compliance Checklist covering the controls every payment operator should confirm before going live.

Newsletter - June 2026

This monthly report covers the three largest security incidents in June 2026, totaling approximately $22M in confirmed losses. A sophisticated honeypot attack drained ~$15M from JaredFromSubway's MEV bot by exploiting unchecked token allowances. Two legacy Aztec rollup deployments lost ~$4.35M through proof-settlement boundary gaps. SecondFi's Ed25519 implementation flaw exposed wallet private keys, resulting in ~$2.4M drained from 374 wallets. All three incidents share a common pattern: security guarantees that appeared intact on the surface but were never actually enforced.

~$4.1M Lost: Taiko, SecondFi Exploits | BlockSec Weekly

This weekly blockchain security report covers two notable incidents from June 22-28, 2026, with approximately $4.1M in confirmed losses across Ethereum and Cardano. The Taiko bridge exploit combined an exposed SGX enclave signing key with an incomplete attestation policy that failed to reject debug enclaves, allowing the attacker to register a malicious prover and forge L2 state proofs on Ethereum. The SecondFi wallet vulnerability stemmed from a cryptographic implementation flaw in Ed25519 nonce derivation that removed the secret input, enabling offline private key recovery from public Cardano transaction data.

Australia VASP Framework: What Institutions Must Prepare

Australia replaces its DCE regime with the broader VASP framework. Here's what the new AML/CTF rules, deadlines, and technical requirements mean for crypto institutions.

OFAC Sanctions ISIS Tron Addresses in Terror-Financing Trail

OFAC sanctioned an ISIS financial facilitator, including two Tron addresses. BlockSec traced the on-chain funds linking them to a Hamas-affiliated exchange entity.

~$18M Lost: jaredFromSubway, Aztec & More | BlockSec Weekly

This weekly blockchain security report covers June 15 to June 21, 2026, with 3 notable incidents across Ethereum and BNB Chain totaling approximately $18.3M in losses. Two incidents are analyzed in detail. Based on on-chain analysis, the highlighted jaredFromSubway incident reveals a reversed approval attack pattern: unlike traditional exploits where attackers abuse vulnerabilities in trusted DeFi contracts to drain user-approved assets, this MEV bot proactively approved its own assets to untrusted third-party contracts for arbitrage. The attacker constructed fake wrapper tokens and swap pools that emitted real events but never consumed the granted allowances, with reported total losses of ~$15M. The report also covers Aztec's second exploit in three days, where a missing equality constraint between two witnesses for `old_data_root` in the escape hatch ZK circuit allowed the attacker to prove ownership of fabricated notes against a fake Merkle tree while passing on-chain root validation.

Web3 Companion: The Open-Source Secure Agentic Wallet

BlockSec open-sources Web3 Companion, a security-first agentic wallet that treats its own AI agent as untrusted and uses key isolation, hard policies, and Passkey to protect on-chain assets.

~$5.98M Lost: Aztec, Raydium & More | BlockSec Weekly

This weekly blockchain security report covers the period of June 8 to June 14, 2026, analyzing 4 notable incidents across Ethereum and Solana with total losses of approximately $5.98M. The highlighted events include Aztec Connect, where a missing input validation allowed the rollup's proof path and L1 settlement to reach inconsistent states, and Raydium, where a missing validation check on the legacy AMM v3 program allowed an attacker to manipulate the LP token redemption calculation and drain four pools. Both vulnerabilities had been live for years before exploitation. The report examines attack types including lack of input validation, integer overflow, and governance capture.

OFAC Sinaloa Cartel Sanctions: On-Chain Fund Tracing

OFAC sanctioned a Sinaloa Cartel network for laundering fentanyl proceeds. We traced the six sanctioned addresses on-chain with MetaSleuth, and the money runs almost entirely through centralized exchange deposit addresses.