⬢ GM Security — 2026-06-27: $15.2M across 30 incidents

Daily crypto security briefing

2026-06-27 12:08 UTC · last 72h · 30 items · $15.2M reported losses · 49 sources

📊 Trend tracker

• 2 new today · 28 developing
• 7-day: 142 incidents, $903.5M stolen (+389% vs prior week)
• 30-day: 223 incidents, $1.09B stolen
• 7-day vectors: smart-contract bug (21), social engineering (15), private-key compromise (7)
• Repeat targets (30d): coinbase (6), certik (6), bitcoin (6), tornadocash (5), thetanuts (5)

Last 24 hours

• [OTHER · NEW] Cathie Wood snaps up $25.5M in Coinbase, SpaceX and Circle shares (crypto.news)
• [ADVISORY · NEW] @ConsensysAudits: New on @MetaMask: Chonky, our AI-powered audit framework, and its core method - vulnerability mining. (ConsenSys Diligence)
• [EXPLOIT · DEVELOPING · day 2] @Beosin_com: 🔍A 32-byte omission. A multi-million-dollar lesson. (@Beosin_com)
• [EXPLOIT · DEVELOPING · day 2] Base Resumes Block Production After Roughly Two-Hour Mainnet Halt (The Defiant)
  also: CoinDesk
• [ADVISORY · DEVELOPING · day 2] Uniswap Flashtestations Audit (OpenZeppelin)
• [OTHER · DEVELOPING · day 2] Mystery deepens over Cardano wallet’s $18.5M white hat hacker (Protos)
• [OTHER · DEVELOPING · day 2] @tayvano_: Sam: “Okay team. We all agree the Mythos name alone was begging to be drone stiked by the USG. We need names for these… (@tayvano_)
• [OTHER · DEVELOPING · day 2] @tayvano_: dear god why (@tayvano_)
• [OTHER · DEVELOPING · day 2] @spreekaway: nontechnical vibecoder chain https://t.co/3ZuduAszU0 (@spreekaway)

Earlier · 24–72h

• [EXPLOIT · DEVELOPING · day 2] Secret Network - Rekt — $4.7M (rekt.news Leaderboard)
• [ADVISORY · DEVELOPING · day 3] South Korea revises debt relief rules to include crypto assets (crypto.news)
• [ADVISORY · DEVELOPING · day 3] @GoPlusSecurity: 🧵1/3 (@GoPlusSecurity)
• [EXPLOIT · DEVELOPING · day 3] @GoPlusSecurity: 🚨GoPlus Security Alert: — ~$3.0M (@GoPlusSecurity)
  also: @GoPlusSecurity · @PeckShieldAlert
• [ADVISORY · DEVELOPING · day 4] @SlowMist_Team: 🚨 SlowMist TI Alert 🚨 (@SlowMist_Team)
  also: @SlowMist_Team
• [EXPLOIT · DEVELOPING · day 3] Polymarket to Refund Users After Scammers Swipe Millions in Website Exploit (Decrypt)
• [ADVISORY · DEVELOPING · day 3] @HalbornSecurity: AI agents move funds on-chain at machine speed. One compromised compliance oracle can push them into a sanctions violat… (@HalbornSecurity)
• [ENFORCEMENT · DEVELOPING · day 4] CoinEx Denies 'Knowledge' of Aiding Sanctioned Iran Crypto Market in $3.8 Billion Disconnect (Decrypt)
• [EXPLOIT · DEVELOPING · day 3] @PeckShieldAlert: #PeckShieldAlert @apyx_fi's $apxUSD has dropped below $0.8. https://t.co/YUYPIEuRDF (@PeckShieldAlert)
• [OTHER · DEVELOPING · day 3] Kraken in talks to buy 15% stake in DeFi lender Aave at $385 million valuation (CoinDesk)
• [OTHER · DEVELOPING · day 3] a16z-backed crypto firm rebrands, shifts focus to solving AI’s global copyright headache (CoinDesk)
• [ADVISORY · DEVELOPING · day 3] @CertiK: Most RWAs are Treasuries. @XDCNetwork is different. — ~$860.0M (CertiK)
• [ENFORCEMENT · DEVELOPING · day 3] $47M in Crypto Frozen in Global Infostealer Takedown: Europol — ~$47.0M (Decrypt)
• [OTHER · DEVELOPING · day 3] @spreekaway: the good news: this makes slightly more sense than SBF's bet (@spreekaway)
• [OTHER · DEVELOPING · day 3] @spreekaway: Even the DAO extractoooors are capitulating https://t.co/vjTvQSRcjb (@spreekaway)
• [OTHER · DEVELOPING · day 3] @tayvano_: Genuinely what the fuck do you want the govt to do about this? (@tayvano_)
• [OTHER · DEVELOPING · day 3] @tayvano_: Completely insane to let the fucking government control your product, release processes, and, ultimately, your profits. (@tayvano_)
• [OTHER · DEVELOPING · day 3] @tayvano_: One of my 4am tweets mentions nonce reuse. I was speaking casually bc I was flabbergasted by just how fucking stupid th… (@tayvano_)
• [EXPLOIT · DEVELOPING · day 3] @pcaversaccio: the latest tornado cash proposal 67 is _malicious_: https://bafybeie5hxovqc4ifcnrnhvmjbefxgeix6oqvzaspyytdxiyscji22v5pu… (pcaversaccio)
  also: Protos

🧠 Deep reads

• Inside a Sandwich Attack: Lessons From the $7.5 Million Heist Against JaredfromSubway.eth (Chainalysis)
• Wallet Screening Best Practices for Compliance Teams | TRM Labs (TRM Labs)

💡 Security thought-spark

A 32-byte omission costing millions highlights that subtle storage layout errors in Solidity, especially with struct packing and missing fields, remain a critical blind spot in manual and automated audits—immediately re-review state variable alignment in contracts touching high-value pools.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.