Web3 Security
How the attacks actually work: threat actors, techniques, exploits and what to do about them.
-
I audited 18 carriers on SIM swap protection. Here is the method, and the first numbers
2026-10-01 · Web3 Security Federal rules have required every US wireless provider to offer a free SIM-change and port-out lock since 2024, and nobody publishes whether…
-
The free carrier lock the FCC made mandatory, and how to switch it on
2026-10-01 · Web3 Security Since 2024 every US wireless provider, including every prepaid brand and reseller, has been required to offer customers a free lock that…
-
SIM swapping: the attack that does not happen to you
2026-10-01 · Web3 Security A SIM swap moves your phone number to a stranger’s device by convincing your carrier to do it, and every authentication code…
-
Contagious Interview: the job offer that installs the malware
2026-08-01 · Web3 Security Since December 2022, North Korean operators have been running fake hiring processes against people who work in crypto, and the payload lands…
-
The package supply chain as an attack surface: axios, PolinRider, and the developer machine
2026-08-01 · Web3 Security On 31 March 2026 two versions of axios, a library downloaded 101 million times in the preceding week, shipped a dependency that…
-
The tx bridge drain: what the XRP Ledger actually records
2026-08-12 · Web3 Security The XRP Ledger account behind the tx bridge sent 94 payments totaling 199,916.3 XRP on 9 August 2026, every one of them…
-
Five security claims you can check yourself in one command
2026-08-01 · Web3 Security Most crypto security writing asks you to accept a firm’s summary of what it found. A narrow slice of that material sits…
-
Drainer-as-a-service: the affiliate model behind crypto phishing
The person who writes a wallet drainer and the person who finds you are almost never the same person, and a smart contract pays them both…
-
Blind signing: what your wallet shows you, and what you actually sign
Every signature a wallet produces commits to a 32-byte digest, and whether the wallet can turn that digest back into a readable sentence is decided by…
-
Approval phishing and the drainer economy
An ERC-20 approval is a standing permission to take tokens out of a wallet later, and it is a separate thing from a transfer.
-
Bybit: the largest theft in the asset class, and the signing interface behind it
On 21 February 2025 roughly $1.46 billion left one of Bybit’s Ethereum cold wallets in a single transaction carrying three valid signatures from the wallet’s own…
-
Clipper Malware: The Invisible Threat Hijacking Crypto Transactions
A form of malware threatens cryptocurrency users worldwide. It has caused major financial losses with a simple, deceptive trick.