⬢ GM Security — 2026-07-27: $88.0M across 27 incidents

Daily crypto security briefing

2026-07-27 08:00 UTC · last 72h · 27 items · $88.0M reported losses · 22 sources

📊 Trend tracker

7 new today · 20 developing
7-day: 124 incidents, $359.4M stolen (+80% vs prior week)
30-day: 403 incidents, $4.78B stolen
7-day vectors: bridge exploit (17), flash-loan attack (5), private-key compromise (4)
Repeat targets (30d): bitcoin (23), trump (11), russia (9), ethereum (9), coinbase (8)
Active actors (30d): Lazarus Group (DPRK) (3)

Last 24 hours

[EXPLOIT · DEVELOPING · day 12] SummerFi to Wind Down After Seven Years, Citing Exploit (The Defiant)
[OTHER · DEVELOPING · day 24] eToro Takes Strategic Stake in Onchain Derivatives Exchange Extended, Plans Zengo Tie-Up (The Defiant)
[EXPLOIT · NEW] Garden Finance takes app offline after independent solver database compromise (crypto.news)
[EXPLOIT · NEW] Triple A says it can meet all liabilities after treasury wallet exploit (crypto.news)
[EXPLOIT · NEW] WEMIX freezes bridges after owner-key breach mints 5.23M WEMIX$ — ~$724K (crypto.news)
[OTHER · NEW] Triple-A hot wallet losses climb to $11.8 million as new deposits keep being swept: report — ~$11.8M (The Block)
[EXPLOIT · NEW] WEMIX — exploit — $6.3M (SlowMist Hacked DB)
[EXPLOIT · NEW] Garden Finance — exploit — $450K (SlowMist Hacked DB)
also: DeFiLlama Hacks DB

Earlier · 24–72h

[SCAM · DEVELOPING · day 2] Binance tests staff monthly with fake phishing attacks (crypto.news)
[ENFORCEMENT · DEVELOPING · day 2] EU adds HTX to Russia sanctions list, barring transactions starting Aug. 23 (The Block)
[ADVISORY · DEVELOPING · day 2] Ripple bought a bank in pieces. Here is the $4 billion audit (crypto.news)
[ENFORCEMENT · DEVELOPING · day 2] North Korea arrests hackers accused of laundering stolen funds from country's bank via crypto (CoinDesk)
also: crypto.news
[OTHER · DEVELOPING · day 4] ARK Invest buys $251K of BitMine, Solana ETF (crypto.news)
[SCAM · DEVELOPING · day 2] Bankrbot — exploit — $480K (SlowMist Hacked DB)
[EXPLOIT · DEVELOPING · day 2] Triple-A hot wallets lose $9.7M in suspected exploit — ~$9.7M (crypto.news)
[EXPLOIT · DEVELOPING · day 2] Across Protocol relayer loses under $4M in Solana attack — ~$41.7M (crypto.news)
[EXPLOIT · DEVELOPING · day 3] Perp DEX Dango to Wind Down, Will Halt Trading July 29 — ~$1.9M (The Defiant)
[OTHER · DEVELOPING · day 3] Ex-Sushi CTO Joseph DeLong to Launch Order Book DEX on Robinhood Chain (The Defiant)
[ENFORCEMENT · DEVELOPING · day 3] The EU’s 21st Russia Sanctions Package Targets Crypto Platforms for Sanctions Evasion, Introduces Third-Country Ban Mechanism (Chainalysis)
also: TRM Labs
[OTHER · DEVELOPING · day 3] Poolin, Once One of Bitcoin's Biggest Mining Pools, Files for Bankruptcy (Decrypt)
[ENFORCEMENT · DEVELOPING · day 3] OCC Denies Wise's US National Trust Bank Charter (The Defiant)
[ADVISORY · DEVELOPING · day 3] Axis Coordinate V2 Contracts Audit (OpenZeppelin)
[EXPLOIT · DEVELOPING · day 3] Morning Minute: Bitcoin's New $15M Quantum Defense Fund — ~$15.0M (Decrypt)
[ENFORCEMENT · DEVELOPING · day 3] EU hits Russia with massive 21st sanctions package targeting $120B crypto network (CoinDesk)
[EXPLOIT · DEVELOPING · day 3] Crypto market maker B2C2 held sale talks with multiple potential buyers (CoinDesk)

🧠 Deep reads

💡 Security thought-spark

Phishing decays fast: send your own team a benign fake "wallet approval" and measure click-through. Awareness is a metric, not a one-time training.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.