⬢ GM Security — 2026-06-27: $25.7M across 30 incidents

Daily crypto security briefing

2026-06-27 08:00 UTC · last 72h · 30 items · $25.7M reported losses · 49 sources

📊 Trend tracker

• 13 new today · 17 developing
• 7-day: 140 incidents, $903.5M stolen (+389% vs prior week)
• 30-day: 221 incidents, $1.09B stolen
• 7-day vectors: smart-contract bug (21), social engineering (15), private-key compromise (7)
• Repeat targets (30d): certik (6), bitcoin (6), coinbase (5), tornadocash (5), thetanuts (5)

Last 24 hours

• [EXPLOIT · NEW] @Beosin_com: 🔍A 32-byte omission. A multi-million-dollar lesson. (@Beosin_com)
• [SCAM · NEW] @chainalysis: Ethereum’s most notorious sandwich attacker just lost $7.5 million to a honeypot. Read our latest research explaining t… — ~$7.5M (@Chainalysis)
• [OTHER · NEW] Base Resumes Block Production After Roughly Two-Hour Mainnet Halt (The Defiant)
• [ADVISORY · NEW] Uniswap Flashtestations Audit (OpenZeppelin)
• [ADVISORY · NEW] Mystery deepens over Cardano wallet’s $18.5M white hat hacker (Protos)
• [EXPLOIT · NEW] Secret Network - Rekt — $4.7M (rekt.news Leaderboard)
• [OTHER · DEVELOPING · day 2] South Korea revises debt relief rules to include crypto assets (crypto.news)
• [OTHER · NEW] @tayvano_: Sam: “Okay team. We all agree the Mythos name alone was begging to be drone stiked by the USG. We need names for these… (@tayvano_)
• [OTHER · NEW] @tayvano_: dear god why (@tayvano_)
• [OTHER · NEW] @spreekaway: nontechnical vibecoder chain https://t.co/3ZuduAszU0 (@spreekaway)

Earlier · 24–72h

• [EXPLOIT · DEVELOPING · day 2] @GoPlusSecurity: 🧵1/3 (@GoPlusSecurity)
• [OTHER · DEVELOPING · day 2] Ark Invest buys Coinbase, Robinhood, Circle and Bullish on market dip (crypto.news)
• [EXPLOIT · DEVELOPING · day 2] @GoPlusSecurity: 🚨GoPlus Security Alert: — ~$3.0M (@GoPlusSecurity)
  also: @GoPlusSecurity
• [EXPLOIT · DEVELOPING · day 3] @SlowMist_Team: 🚨 SlowMist TI Alert 🚨 (@SlowMist_Team)
  also: @SlowMist_Team
• [EXPLOIT · DEVELOPING · day 2] Polymarket to Refund Users After Scammers Swipe Millions in Website Exploit (Decrypt)
• [ENFORCEMENT · DEVELOPING · day 2] @HalbornSecurity: AI agents move funds on-chain at machine speed. One compromised compliance oracle can push them into a sanctions violat… (@HalbornSecurity)
• [ENFORCEMENT · DEVELOPING · day 3] CoinEx Denies 'Knowledge' of Aiding Sanctioned Iran Crypto Market in $3.8 Billion Disconnect (Decrypt)
• [OTHER · NEW] Coinbase's Base blockchain resumes after two-hour outage disrupted network (CoinDesk)
• [EXPLOIT · NEW] Tornado Cash DAO faces ‘malicious’ governance attack, researchers warn (Protos)
• [EXPLOIT · NEW] Polymarket users lose $3 million after frontend hack — ~$3.0M (Protos)
• [OTHER · DEVELOPING · day 2] @PeckShieldAlert: #PeckShieldAlert @apyx_fi's $apxUSD has dropped below $0.8. https://t.co/YUYPIEuRDF (@PeckShieldAlert)
• [EXPLOIT · DEVELOPING · day 2] Kraken in talks to buy 15% stake in DeFi lender Aave at $385 million valuation (CoinDesk)
• [ADVISORY · DEVELOPING · day 2] a16z-backed crypto firm rebrands, shifts focus to solving AI’s global copyright headache (CoinDesk)
• [OTHER · DEVELOPING · day 2] @spreekaway: the good news: this makes slightly more sense than SBF's bet (@spreekaway)
• [OTHER · DEVELOPING · day 2] @spreekaway: Even the DAO extractoooors are capitulating https://t.co/vjTvQSRcjb (@spreekaway)
• [OTHER · DEVELOPING · day 2] @tayvano_: Genuinely what the fuck do you want the govt to do about this? (@tayvano_)
• [OTHER · DEVELOPING · day 2] @tayvano_: Completely insane to let the fucking government control your product, release processes, and, ultimately, your profits. (@tayvano_)
• [OTHER · DEVELOPING · day 2] @tayvano_: One of my 4am tweets mentions nonce reuse. I was speaking casually bc I was flabbergasted by just how fucking stupid th… (@tayvano_)

🧠 Deep reads

• Inside a Sandwich Attack: Lessons From the $7.5 Million Heist Against JaredfromSubway.eth (Chainalysis)
• Wallet Screening Best Practices for Compliance Teams | TRM Labs (TRM Labs)

💡 Security thought-spark

Oracle check: are you reading a spot price or a TWAP? A spot price on a low-liquidity pool is a standing invitation to a flash-loan attack.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.