16 crypto-security item(s) in the window with ~$18.6M in reported losses The largest is "Bonzo Lend Loses $9M on Hedera in Supra Oracle Exploit" (~$9.1M). Dominant vectors: oracle manipulation, private-key compromise, supply-chain attack, governance attack.

• 🧊 On-chain — Tether USDT freezes (7d): 16 addresses (2026-07-13). Source: Dune
• oracle manipulation activity observed (2 item(s))
• private-key compromise activity observed (1 item(s))
• supply-chain attack activity observed (1 item(s))

• eToro Takes Strategic Stake in Onchain Derivatives Exchange Extended, Plans Zengo Tie-Up
  eToro has become a strategic investor in Extended, an onchain perpetual futures exchange, and said the round begins a partnership with Zengo, the self-custody wallet eToro acquired earlier this year. Neither company disclosed the investment size.
  The Defiant · Tue, 14 Jul 2026 08:00:05 GMT
• U.S. government moves $288 million in seized bitcoin, ether to Coinbase Prime
  Coins from the Farace and BTC-e seizures moved through fresh wallets before landing on the exchange, despite president Donald Trump's previous no-sell reserve order.
  CoinDesk · Tue, 14 Jul 2026 06:28:43 GMT
• Why did the U.S. move $297M in Bitcoin and Ether to Coinbase Prime?
  U.S. wallets moved $297M in seized Bitcoin and Ether to Coinbase Prime, raising reserve questions but no asset sale has been confirmed so far.
  crypto.news · Tue, 14 Jul 2026 04:49:56 GMT
• Threat Intelligence | Injective SDK Compromised, Crypto Wallet Private Keys Stolen
  Background This investigation began with what appeared to be a routine development workflow: a developer installs the official Injective SDK, generates a wallet, imports a mnemonic phrase, or passes an existing private key to an SDK interface. Everything appears normal during installation, and wallet operations may return the expected results. At the same time, however, an additional network request — one that is not part of the intended application logic — is silently sent in the background. Recently, security research firm Socket identified anomalous behavior in version 1.20.21 of the npm p…
  SlowMist · private-key compromise, supply-chain attack · Tue, 14 Jul 2026 03:50:35 GMT
• OFAC Sanctions FirstVPN and Ransomware Enablers Behind Attacks on Americans | TRM Labs
  On July 13, 2026, OFAC sanctioned the FirstVPN Service (1VPNS), its administrator Dmytro Rashevskyi, and cryptor vendor Yevgeniy Silayev — targeting the anonymity and malware-obfuscation services ransomware groups rely on rather than a ransomware group itself, with TRM data showing operators paying the service directly on-chain.
  TRM Labs · Mon, 13 Jul 2026 20:56:00 GMT
• Bonzo Lend Loses $9M on Hedera in Supra Oracle Exploit
  ~$9.1M · A single manipulated price feed let an attacker turn 250 SAUCE tokens worth a few dollars into $9.05 million in borrowed USDC and wrapped HBAR in eight seconds.
  The Defiant · oracle manipulation · Mon, 13 Jul 2026 19:48:08 GMT
• Strategy Sells $467M in MSTR Shares, Bitcoin Stack Steady
  The bitcoin treasury company's cash reserve climbed to $3 billion even as its 843,775 BTC holdings stayed frozen for a second straight week.
  The Defiant · Mon, 13 Jul 2026 17:25:00 GMT
• BlueMove’s $500K SUI loss raises insider job suspicions
  Around $500K worth of SUI tokens was drained from BlueMove DEX's locked pools last weekend, leading to rumours of an inside job. The post BlueMove’s $500K SUI loss raises insider job suspicions appeared first on Protos.
  Protos · Mon, 13 Jul 2026 16:51:56 GMT
• Trump triggers $20B crypto wipeout with Strait of Hormuz takeover claim
  Bitcoin and the broader crypto market have lost more than $20 billion in value after President Donald Trump’s latest remarks on the Strait of Hormuz pushed oil prices higher and accelerated risk-off selling. Trump’s comments have intensified pressure across global…
  crypto.news · governance attack · Mon, 13 Jul 2026 16:09:23 GMT
• Courtroom-Ready Analytics: How Chainalysis Met the Daubert Standard
  Blockchain tracing tools like Chainalysis Reactor help investigators untangle the financial networks behind illicit activity: fraud, theft, sanctions evasion, cybercrime,… The post Courtroom-Ready Analytics: How Chainalysis Met the Daubert Standard appeared first on Chainalysis.
  Chainalysis · Mon, 13 Jul 2026 13:56:28 GMT
• Lumi Finance — exploit
  $270K · Attack method: Smart Contract Logic Vulnerability. Reported loss ~$270,000. The DeFi protocol Lumi Finance on Arbitrum suffered an exploit where attackers leveraged Sodium smart accounts that performed token approvals as a side effect during UserOp validation. This allowed a malicious Paymaster to gain allowances from multiple accounts and drain funds, resulting in approximately $270,000 in losses.
  SlowMist Hacked DB · smart-contract bug · Mon, 13 Jul 2026 12:00:00 GMT
• Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing…
  Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware Abstract On July 8, 2026, Bruce Xu (@brucexu_eth) reported a phishing link disguised as a BuilDAO / Builder community application page. The attackers hosted the page on Google Sites, leveraging the trusted appearance of sites.google.com to lower users’ guard. The first part of the page mimicked a community application form, prompting users to provide information such as their location, identity, project links, and reasons for joining the community. Instead of proceeding to a legitimate re…
  SlowMist · phishing / wallet drainer · Mon, 13 Jul 2026 10:48:25 GMT
• Chinese Prosecutors Float Treating Crypto Mixer, Privacy Coin Use as Sign of Money Laundering
  An article in the top prosecutors' paper urges new blockchain evidence rules, presumptions of intent, and a state platform to sell seized coins.
  Decrypt · Mon, 13 Jul 2026 10:43:13 GMT
• Bank of Thailand targets stablecoin transactions in latest probe
  Thailand has begun auditing high-value stablecoin transactions after authorities flagged suspicious transfers that may have bypassed normal financial reporting systems. According to local news outlet Thansettakij, the Bank of Thailand (BOT) and the country’s Securities and Exchange Commission (SEC) have…
  crypto.news · Mon, 13 Jul 2026 09:37:30 GMT
• Lumi Finance — exploit
  $270K · Technique: Protocol Logic / Silent Auto-Approval Hack. Chain: Arbitrum. Target: DeFi Protocol. Reported loss ~$270,000.
  DeFiLlama Hacks DB · Mon, 13 Jul 2026 00:00:00 GMT
• Bonzo Lend — exploit
  $9.1M · Attack method: Oracle Price Manipulation. Reported loss ~$9,050,000. Bonzo Lend on Hedera was exploited through a third-party oracle (Supra) vulnerability. An attacker submitted a massively manipulated SAUCE price, allowing them to borrow approximately $9.05 million in assets with minimal collateral. The borrowed funds were subsequently swapped on SaucerSwap and bridged to Ethereum via LayerZero (over $5M tracked on-chain). Bonzo Lend paused the protocol shortly after detecting abnormal activity.
  SlowMist Hacked DB · oracle manipulation · Sat, 11 Jul 2026 12:00:00 GMT

Sources unavailable: CertiK (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); ConsenSys Diligence (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); Cantina / Spearbit (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); pcaversaccio (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); Chainabuse (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); Arkham Intelligence (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @PeckShieldAlert (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @CertiKAlert (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @CyversAlerts (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @BlockSecTeam (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @AnciliaInc (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @Phalcon_xyz (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @zachxbt (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @SlowMist_Team (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @MistTrack_io (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @realScamSniffer (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @samczsun (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @tayvano_ (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @spreekaway (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @_SEAL_Org (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @hypernative (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @HalbornSecurity (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @Beosin_com (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @GoPlusSecurity (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @Quantstamp (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @Chainalysis (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); @TrugardLabs (HTTP 402: {"detail":"credits depleted","status":402,"title":"Payment Required","type":"https://api.x.com/2/problems/credits-depleted"}); Immunefi (Invalid character in tag name Line: 36 Column: 49 Char: @); Immunefi Audit Reports (source deadline 45000ms exceeded)

📸 Share image for socials — 1200×630

⬇ Download PNG

Generated by GM Security · automated digest, verify before acting.