⬢ GM Security — 2026-07-28: $32.6M across 19 incidents

Daily crypto security briefing

2026-07-28 08:00 UTC · last 72h · 19 items · $32.6M reported losses · 22 sources

📊 Trend tracker

11 new today · 8 developing
7-day: 119 incidents, $376.2M stolen (+129% vs prior week)
30-day: 408 incidents, $4.81B stolen
7-day vectors: bridge exploit (19), flash-loan attack (4), access-control flaw (4)
Repeat targets (30d): bitcoin (23), trump (11), russia (9), ethereum (9), ostium (8)
Active actors (30d): Lazarus Group (DPRK) (3)

Last 24 hours

[EXPLOIT · DEVELOPING · day 13] SummerFi to Wind Down After Seven Years, Citing Exploit (The Defiant)
[OTHER · DEVELOPING · day 25] eToro Takes Strategic Stake in Onchain Derivatives Exchange Extended, Plans Zengo Tie-Up (The Defiant)
[OTHER · NEW] Psalion launches $50M blockchain venture fund (crypto.news)
[ENFORCEMENT · DEVELOPING · day 3] CLARITY Act would weaken state fraud powers, James warns (crypto.news)
[OTHER · NEW] NY Attorney General Letitia James warns Clarity Act would ‘dilute’ states’ ability to go after fraud as pressure mounts (The Block)
[OTHER · NEW] SparkKitty Malware Found in App Stores Targets Crypto Wallet Seed Phrases (Decrypt)
also: The Block
[OTHER · NEW] BMNR stock rises over 10% as BitMine adds 9,946 ETH (crypto.news)
[ADVISORY · NEW] Who actually runs Hyperliquid? The governance audit (crypto.news)
[OTHER · NEW] PUMP price breaks $0.002 as BOOST fuels rally (crypto.news)
[OTHER · NEW] Circle buys nearly 1,000 blockchain patents from IBM (CoinDesk)
[OTHER · NEW] SparkKitty turns phone photos into a crypto wallet security risk (crypto.news)
[EXPLOIT · NEW] AFX Trade - Rekt — $24.1M (rekt.news Leaderboard)

Earlier · 24–72h

[EXPLOIT · DEVELOPING · day 2] WEMIX — exploit — $6.3M (SlowMist Hacked DB)
[EXPLOIT · DEVELOPING · day 2] Garden Finance — exploit — $450K (SlowMist Hacked DB)
[EXPLOIT · NEW] WEMIX — exploit — $730K (DeFiLlama Hacks DB)
[SCAM · DEVELOPING · day 3] Bankrbot — exploit — $480K (SlowMist Hacked DB)
[EXPLOIT · NEW] Projekt — exploit — $560K (SlowMist Hacked DB)

🧠 Deep reads

💡 Security thought-spark

LLM triage prompt: "Here is a transaction trace — explain in plain English what it did, then flag anything that looks like value leaving the protocol unexpectedly."

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.