⬢ GM Security — 2026-07-29: $2.14B across 19 incidents

Daily crypto security briefing

2026-07-29 08:00 UTC · last 72h · 19 items · $2.14B reported losses · 22 sources

📊 Trend tracker

10 new today · 9 developing
7-day: 118 incidents, $2.47B stolen (+1390% vs prior week)
30-day: 405 incidents, $6.91B stolen
7-day vectors: bridge exploit (18), access-control flaw (4), private-key compromise (3)
Repeat targets (30d): bitcoin (24), trump (11), russia (9), ethereum (9), ostium (8)
Active actors (30d): Lazarus Group (DPRK) (3)

Last 24 hours

[EXPLOIT · DEVELOPING · day 14] SummerFi to Wind Down After Seven Years, Citing Exploit (The Defiant)
[OTHER · DEVELOPING · day 26] eToro Takes Strategic Stake in Onchain Derivatives Exchange Extended, Plans Zengo Tie-Up (The Defiant)
[OTHER · NEW] Myanmar crypto scam bill clears parliament (crypto.news)
[EXPLOIT · NEW] Crypto security losses hit $1.1B in H1 2026: Blockaid report — ~$1.10B (crypto.news)
[EXPLOIT · NEW] Crypto hacks hit record high in H1 2026 as losses top $1 billion, Blockaid says — ~$1.00B (The Block)
[EXPLOIT · NEW] Zcash Activates Ironwood Upgrade After Counterfeiting Scare (Decrypt)
[ADVISORY · NEW] 1inch Aqua and SwapVM MVP v1.0 Audit (OpenZeppelin)
[ENFORCEMENT · NEW] Clear Creek reveals $15M Bitcoin, crypto ETF portfolio (crypto.news)
[ENFORCEMENT · NEW] Apple kept fake bitcoin wallet on App Store after $875,000 theft report, lawsuit alleges — ~$875K (CoinDesk)
[EXPLOIT · NEW] ChatGPT’s Hugging Face breach shows why AI containment matters more than ever (crypto.news)
[OTHER · NEW] Myanmar Approves Death Penalty for Forced Scam Labor, Life for Crypto Fraud (Decrypt)

Earlier · 24–72h

[EXPLOIT · NEW] Crypto DAO — exploit — $8.2M (DeFiLlama Hacks DB)
[OTHER · DEVELOPING · day 2] NY Attorney General Letitia James warns Clarity Act would ‘dilute’ states’ ability to go after fraud as pressure mounts (The Block)
[OTHER · DEVELOPING · day 2] SparkKitty Malware Found in App Stores Targets Crypto Wallet Seed Phrases (Decrypt)
[EXPLOIT · DEVELOPING · day 2] AFX Trade - Rekt — $24.1M (rekt.news Leaderboard)
[EXPLOIT · DEVELOPING · day 3] WEMIX — exploit — $6.3M (SlowMist Hacked DB)
[EXPLOIT · DEVELOPING · day 3] Garden Finance — exploit — $450K (SlowMist Hacked DB)

🧠 Deep reads

💡 Security thought-spark

Signature security: are you checking for replay (nonce + chainId + deadline) and malleability on every signed message? EIP-712 done halfway is still exploitable.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.