⬢ GM Security — 2026-06-26: $50.0M across 30 incidents

Daily crypto security briefing

2026-06-26 13:10 UTC · last 72h · 30 items · $50.0M reported losses · 49 sources

📊 Trend tracker

• 18 new today · 12 developing
• 7-day: 127 incidents, $880.8M stolen (+377% vs prior week)
• 30-day: 208 incidents, $1.07B stolen
• 7-day vectors: smart-contract bug (21), social engineering (15), supply-chain attack (6)
• Repeat targets (30d): certik (6), bitcoin (6), tornadocash (5), thetanuts (5), coinbase (4)

Last 24 hours

• [ADVISORY · NEW] South Korea revises debt relief rules to include crypto assets (crypto.news)
• [ADVISORY · NEW] @GoPlusSecurity: 🧵1/3 (@GoPlusSecurity)
• [OTHER · NEW] Ark Invest buys Coinbase, Robinhood, Circle and Bullish on market dip (crypto.news)
• [EXPLOIT · NEW] @GoPlusSecurity: 🚨GoPlus Security Alert: — ~$3.0M (@GoPlusSecurity)
  also: @GoPlusSecurity · @PeckShieldAlert
• [EXPLOIT · NEW] Coinbase-backed Base returns after 2-hour consensus halt (crypto.news)
  also: CoinDesk
• [ADVISORY · DEVELOPING · day 2] @SlowMist_Team: 🚨 SlowMist TI Alert 🚨 (@SlowMist_Team)
  also: @SlowMist_Team
• [OTHER · NEW] 21Shares slashes crypto forecasts despite rising institutional demand (crypto.news)
• [OTHER · DEVELOPING · day 3] Michael Saylor built a flywheel for a bull market. It is now spinning in reverse (crypto.news)
• [EXPLOIT · NEW] Polymarket to Refund Users After Scammers Swipe Millions in Website Exploit (Decrypt)
• [ADVISORY · NEW] @HalbornSecurity: AI agents move funds on-chain at machine speed. One compromised compliance oracle can push them into a sanctions violat… (@HalbornSecurity)
• [ENFORCEMENT · DEVELOPING · day 2] CoinEx Denies 'Knowledge' of Aiding Sanctioned Iran Crypto Market in $3.8 Billion Disconnect (Decrypt)
• [EXPLOIT · NEW] @PeckShieldAlert: #PeckShieldAlert @apyx_fi's $apxUSD has dropped below $0.8. https://t.co/YUYPIEuRDF (@PeckShieldAlert)
• [OTHER · NEW] Kraken in talks to buy 15% stake in DeFi lender Aave at $385 million valuation (CoinDesk)
• [OTHER · NEW] @spreekaway: the good news: this makes slightly more sense than SBF's bet (@spreekaway)
• [OTHER · NEW] @spreekaway: Even the DAO extractoooors are capitulating https://t.co/vjTvQSRcjb (@spreekaway)
• [OTHER · NEW] @tayvano_: Genuinely what the fuck do you want the govt to do about this? (@tayvano_)
• [OTHER · NEW] @tayvano_: Completely insane to let the fucking government control your product, release processes, and, ultimately, your profits. (@tayvano_)
• [OTHER · NEW] @tayvano_: One of my 4am tweets mentions nonce reuse. I was speaking casually bc I was flabbergasted by just how fucking stupid th… (@tayvano_)

Earlier · 24–72h

• [SCAM · DEVELOPING · day 2] @PeckShieldAlert: #PeckShieldAlert Our community member has reported that @gnosis_ 's X account has been compromised. Do *Not* interact w… (@PeckShieldAlert)
• [ADVISORY · DEVELOPING · day 2] @tayvano_: To be clear: these guys rolled their own crypto so fucking hard that anyone could get your private key from public info… (@tayvano_)
• [ADVISORY · DEVELOPING · day 2] @CertiK: Most RWAs are Treasuries. @XDCNetwork is different. — ~$860.0M (CertiK)
• [ENFORCEMENT · DEVELOPING · day 2] $47M in Crypto Frozen in Global Infostealer Takedown: Europol — ~$47.0M (Decrypt)
• [EXPLOIT · NEW] OHIF Viewers DICOM (CISA Cybersecurity Advisories)
• [ADVISORY · DEVELOPING · day 7] @Phalcon_xyz: 🗓 Weekly Web3 Security Roundup | Jun 15 - Jun 21 — ~$18.3M (@Phalcon_xyz)
• [EXPLOIT · DEVELOPING · day 2] @CertiKAlert: #CertiKInsight 🚨 — ~$47.0M (@CertiKAlert)
  also: @CertiKAlert · @CertiKAlert
• [EXPLOIT · DEVELOPING · day 2] @pcaversaccio: the latest tornado cash proposal 67 is _malicious_: https://bafybeie5hxovqc4ifcnrnhvmjbefxgeix6oqvzaspyytdxiyscji22v5pu… (pcaversaccio)
  also: pcaversaccio · Protos
• [OTHER · DEVELOPING · day 2] @tayvano_: They did it. They actually did it. (@tayvano_)
• [OTHER · DEVELOPING · day 2] @PeckShieldAlert: #PeckShieldAlert $MIM has dropped -36% to 0.5 (@PeckShieldAlert)

🧠 Deep reads

• Wallet Screening Best Practices for Compliance Teams | TRM Labs (TRM Labs)
• a16z-backed crypto firm rebrands, shifts focus to solving AI’s global copyright headache (CoinDesk)

💡 Security thought-spark

Regulatory changes like South Korea's crypto asset inclusion in debt relief could drive complex liquidation cascades; review your protocol's oracle and debt position handling for non-standard collateral types.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.