⬢ GM Security — 2026-07-21: $19.6M across 23 incidents

Daily crypto security briefing

2026-07-21 08:00 UTC · last 72h · 23 items · $19.6M reported losses · 22 sources

📊 Trend tracker

• 19 new today · 4 developing
• 7-day: 102 incidents, $208.1M stolen (-92% vs prior week)
• 30-day: 426 incidents, $5.35B stolen
• 7-day vectors: oracle manipulation (11), flash-loan attack (6), bridge exploit (5)
• Repeat targets (30d): bitcoin (22), trump (11), coinbase (9), ethereum (8), polymarket (8)
• Active actors (30d): Lazarus Group (DPRK) (2)

Last 24 hours

• [EXPLOIT · DEVELOPING · day 6] SummerFi to Wind Down After Seven Years, Citing Exploit (The Defiant)
• [EXPLOIT · NEW] Wanchain Cardano bridge exploit drains 515M NIGHT worth $9M — ~$9.0M (crypto.news)
• [OTHER · NEW] ENS DAO activates two-year veto council after $20M BonkDAO attack (crypto.news)
• [ENFORCEMENT · NEW] SEC charges Florida man and company in alleged $22 million crypto mining fraud scheme (The Block)
• [ENFORCEMENT · NEW] Crypto AML Software for Detecting Money Laundering: A Buyer's Guide | TRM Labs (TRM Labs)
• [ENFORCEMENT · NEW] Russia's First Comprehensive Crypto Law Is Two Votes Away From Passing (Decrypt)
• [EXPLOIT · NEW] Consensys Halted MetaMask Releases Over North Korea-Linked Contractor (The Defiant)
• [EXPLOIT · NEW] Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — ~$1.6M (The Defiant)
  also: Decrypt
• [OTHER · NEW] AI-assisted hacking is outpacing traditional code reviews, NEAR co-founder says (The Block)
• [OTHER · NEW] Hackers hijack Kenyan president’s website, demand 5 Bitcoin (crypto.news)
• [EXPLOIT · NEW] Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week — ~$5.7M (Protos)
• [ENFORCEMENT · NEW] SEC targets Mining Automatic over alleged $22M crypto mining fraud (crypto.news)
• [EXPLOIT · DEVELOPING · day 4] Solana price stalls below $80 as exploits test fragile recovery (crypto.news)
• [EXPLOIT · NEW] Zilliqa halts ZIL transfers after exchange cold wallet theft (crypto.news)
• [ADVISORY · NEW] Crypto security audits lose trust as institutions demand live monitoring (crypto.news)
• [SCAM · NEW] MetaMask hired suspected North Korean dev flagged months earlier (Protos)
• [EXPLOIT · NEW] Zilliqa asks exchanges to pause ZIL transfers after suspected cold wallet theft (Cointelegraph (Security))
• [ENFORCEMENT · NEW] Brazil’s securities regulator sets up task force with 60-day deadline for tokenization proposal (CoinDesk)
• [ADVISORY · NEW] Crypto institutions look beyond audits as trust signals falter: Hacken (Cointelegraph (Security))
• [EXPLOIT · NEW] Cross-chain protocol Allbridge halts after $1.65 million flash loan exploit — ~$1.6M (CoinDesk)

Earlier · 24–72h

• [EXPLOIT · NEW] Allbridge Core — exploit — $1.6M (SlowMist Hacked DB)
  also: DeFiLlama Hacks DB

🧠 Deep reads

• Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension (SlowMist)
• eToro Takes Strategic Stake in Onchain Derivatives Exchange Extended, Plans Zengo Tie-Up (The Defiant)

💡 Security thought-spark

Incident-runbook drill: the first time you run your exploit playbook should NOT be during a live exploit. Tabletop it this quarter.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.