⬢ GM Security — 2026-06-28: $35.6M across 30 incidents

Daily crypto security briefing

2026-06-28 08:00 UTC · last 72h · 30 items · $35.6M reported losses · 49 sources

📊 Trend tracker

• 4 new today · 26 developing
• 7-day: 146 incidents, $913.4M stolen (+394% vs prior week)
• 30-day: 227 incidents, $1.10B stolen
• 7-day vectors: smart-contract bug (21), social engineering (15), private-key compromise (7)
• Repeat targets (30d): coinbase (6), certik (6), bitcoin (6), polymarket (5), tornadocash (5)

Last 24 hours

• [EXPLOIT · NEW] SecondFi maps recovery path after $2.4 million Cardano wallet exploit, aims to return funds within two weeks — ~$2.4M (The Block)
• [ADVISORY · DEVELOPING · day 2] @ConsensysAudits: New on @MetaMask: Chonky, our AI-powered audit framework, and its core method - vulnerability mining. (ConsenSys Diligence)
• [OTHER · DEVELOPING · day 2] Cathie Wood snaps up $25.5M in Coinbase, SpaceX and Circle shares (crypto.news)
• [OTHER · NEW] @_SEAL_Org: We’re proud to welcome @HyperFND as our newest Platinum Donor. (@_SEAL_Org)

Earlier · 24–72h

• [EXPLOIT · DEVELOPING · day 3] @Beosin_com: 🔍A 32-byte omission. A multi-million-dollar lesson. (@Beosin_com)
• [SCAM · DEVELOPING · day 2] @chainalysis: Ethereum’s most notorious sandwich attacker just lost $7.5 million to a honeypot. Read our latest research explaining t… — ~$7.5M (@Chainalysis)
• [EXPLOIT · NEW] @CertiKAlert: #CertiKInsight 🚨 — ~$7.5M (@CertiKAlert)
• [OTHER · DEVELOPING · day 3] Base Resumes Block Production After Roughly Two-Hour Mainnet Halt (The Defiant)
• [ADVISORY · DEVELOPING · day 3] Uniswap Flashtestations Audit (OpenZeppelin)
• [ADVISORY · DEVELOPING · day 3] Mystery deepens over Cardano wallet’s $18.5M white hat hacker (Protos)
• [EXPLOIT · DEVELOPING · day 3] Secret Network - Rekt — $4.7M (rekt.news Leaderboard)
• [EXPLOIT · DEVELOPING · day 4] @GoPlusSecurity: 🧵1/3 (@GoPlusSecurity)
• [EXPLOIT · DEVELOPING · day 4] @GoPlusSecurity: 🚨GoPlus Security Alert: — ~$3.0M (@GoPlusSecurity)
  also: @GoPlusSecurity
• [EXPLOIT · DEVELOPING · day 5] @SlowMist_Team: 🚨 SlowMist TI Alert 🚨 (@SlowMist_Team)
  also: @SlowMist_Team
• [EXPLOIT · DEVELOPING · day 4] Polymarket to Refund Users After Scammers Swipe Millions in Website Exploit (Decrypt)
• [ENFORCEMENT · DEVELOPING · day 4] @HalbornSecurity: AI agents move funds on-chain at machine speed. One compromised compliance oracle can push them into a sanctions violat… (@HalbornSecurity)
• [ENFORCEMENT · DEVELOPING · day 5] CoinEx Denies 'Knowledge' of Aiding Sanctioned Iran Crypto Market in $3.8 Billion Disconnect (Decrypt)
• [EXPLOIT · DEVELOPING · day 2] Tornado Cash DAO faces ‘malicious’ governance attack, researchers warn (Protos)
• [ENFORCEMENT · DEVELOPING · day 4] Wallet Screening Best Practices for Compliance Teams | TRM Labs (TRM Labs)
• [EXPLOIT · DEVELOPING · day 2] Polymarket users lose $3 million after frontend hack — ~$3.0M (Protos)
• [OTHER · DEVELOPING · day 3] @tayvano_: Sam: “Okay team. We all agree the Mythos name alone was begging to be drone stiked by the USG. We need names for these… (@tayvano_)
• [OTHER · DEVELOPING · day 3] @tayvano_: dear god why (@tayvano_)
• [OTHER · DEVELOPING · day 3] @spreekaway: nontechnical vibecoder chain https://t.co/3ZuduAszU0 (@spreekaway)
• [OTHER · DEVELOPING · day 4] @spreekaway: the good news: this makes slightly more sense than SBF's bet (@spreekaway)
• [OTHER · DEVELOPING · day 4] @spreekaway: Even the DAO extractoooors are capitulating https://t.co/vjTvQSRcjb (@spreekaway)
• [OTHER · DEVELOPING · day 4] @tayvano_: Genuinely what the fuck do you want the govt to do about this? (@tayvano_)
• [OTHER · DEVELOPING · day 4] @tayvano_: Completely insane to let the fucking government control your product, release processes, and, ultimately, your profits. (@tayvano_)
• [OTHER · DEVELOPING · day 4] @tayvano_: One of my 4am tweets mentions nonce reuse. I was speaking casually bc I was flabbergasted by just how fucking stupid th… (@tayvano_)

🧠 Deep reads

• AMLBot Puts Polymarket Phishing Toll at $3.1M Across 11 Wallets, Funds Traced to Ethereum (The Defiant)
• Inside a Sandwich Attack: Lessons From the $7.5 Million Heist Against JaredfromSubway.eth (Chainalysis)

💡 Security thought-spark

Run `slither .` and `aderyn` on every PR. Free static analysis catches reentrancy, unchecked returns, and access-control gaps before an auditor (or attacker) does.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.