⬢ GM Security — 2026-07-22: $33.5M across 25 incidents

Daily crypto security briefing

2026-07-22 08:00 UTC · last 72h · 25 items · $33.5M reported losses · 22 sources

📊 Trend tracker

• 14 new today · 11 developing
• 7-day: 103 incidents, $203.2M stolen (-83% vs prior week)
• 30-day: 426 incidents, $5.37B stolen
• 7-day vectors: oracle manipulation (10), bridge exploit (6), flash-loan attack (6)
• Repeat targets (30d): bitcoin (21), trump (11), coinbase (9), ostium (8), ethereum (8)
• Active actors (30d): Lazarus Group (DPRK) (2)

Last 24 hours

• [EXPLOIT · DEVELOPING · day 7] SummerFi to Wind Down After Seven Years, Citing Exploit (The Defiant)
• [ENFORCEMENT · NEW] US seeks forfeiture of $25 million in crypto tied to global fraud investigations (The Block)
• [EXPLOIT · NEW] AI models escaped OpenAI’s sandbox and hit Hugging Face. Crypto is where that gets dangerous (CoinDesk)
• [ENFORCEMENT · NEW] HTX keeps changing wallets after UK sanctions, TRM Labs says (crypto.news)
  also: The Block
• [EXPLOIT · NEW] BlockThreat - Week 29, 2026 (BlockThreat)
• [EXPLOIT · NEW] Can Solana price break past $80 resistance this week? (crypto.news)
• [OTHER · NEW] AI firm ORO says North Korean hacker stole $600K worth of crypto — ~$630K (Protos)
• [OTHER · NEW] Galaxy sets up $5 million fund to help shield Bitcoin against quantum computing threats (CoinDesk)
• [ENFORCEMENT · NEW] Russia’s parliament passes crypto market law with $3,800 annual cap for retail investors (CoinDesk)
• [ENFORCEMENT · NEW] Russia is legalizing crypto for everyone except Russians (crypto.news)
• [EXPLOIT · NEW] FlashTrade — exploit — $98K (SlowMist Hacked DB)
• [EXPLOIT · NEW] Ostium - Rekt — $23.8M (rekt.news Leaderboard)
• [EXPLOIT · NEW] Siemens Opcenter X (CISA Cybersecurity Advisories)
• [ADVISORY · NEW] CMTAT Confidential Audit (OpenZeppelin)
• [ENFORCEMENT · NEW] Pakistan Launches Crypto Investigation Unit to Fight Money Laundering (Decrypt)
  also: crypto.news

Earlier · 24–72h

• [ENFORCEMENT · DEVELOPING · day 2] Crypto AML Software for Detecting Money Laundering: A Buyer's Guide | TRM Labs (TRM Labs)
• [ENFORCEMENT · DEVELOPING · day 2] Russia's First Comprehensive Crypto Law Is Two Votes Away From Passing (Decrypt)
• [EXPLOIT · DEVELOPING · day 2] Consensys Halted MetaMask Releases Over North Korea-Linked Contractor (The Defiant)
• [EXPLOIT · DEVELOPING · day 2] Allbridge Halts Core Bridge After $1.65M Flash Loan Exploit — ~$1.6M (The Defiant)
  also: Decrypt
• [EXPLOIT · DEVELOPING · day 2] Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week — ~$5.7M (Protos)
• [SCAM · DEVELOPING · day 2] MetaMask hired suspected North Korean dev flagged months earlier (Protos)
• [EXPLOIT · DEVELOPING · day 2] Zilliqa asks exchanges to pause ZIL transfers after suspected cold wallet theft (Cointelegraph (Security))
• [EXPLOIT · DEVELOPING · day 2] Allbridge Core — exploit — $1.6M (SlowMist Hacked DB)

🧠 Deep reads

• Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension (SlowMist)
• eToro Takes Strategic Stake in Onchain Derivatives Exchange Extended, Plans Zengo Tie-Up (The Defiant)

💡 Security thought-spark

Supply-chain check: pin and hash-lock every npm dependency. A compromised build tool ships a drainer to every user's browser, no contract bug needed.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.