News linked to both this project and an event.
According to the quarterly Security and Compliance Report by Hacken, 67 security incidents in the Web3 space resulted in losses of $763.9 million in Q2 2026, making it the most severe quarter since Q2 2025. Compromised keys and infrastructure accounted for 88.3% of the stolen funds, approximately $674.5 million. Smart contract vulnerabilities remained the most common type of attack, linked to 44 out of the 67 incidents, but corresponding losses represented only about 11% of the total. Approximately 75.5% of the losses stemmed from two incidents attributed to North Korean threat actors, and 14 audited protocols were breached during the quarter. Leo Fan, founder of Cysic, stated that an audit is a point-in-time assessment of a specific codebase and does not automatically cover signature devices, cloud infrastructure, operational permissions, subsequent upgrades, third-party dependencies, or old contracts that remain callable. Samuel Videau, CTO of Genius, pointed out that nearly 90% of losses came from compromised keys, signers, and infrastructure. Multiple security leaders noted that Web3 security requires layered defenses including real-time monitoring, key management, multi-party authorization, and bug bounty programs. Leo Fan expects that operational access control attacks will continue to dominate losses in the second half of 2026, including social engineering, credential theft, compromised signers, cloud or CI/CD intrusions, and attacks on off-chain validator infrastructure.
Odaily AI-driven anti-fraud infrastructure provider InfoHawk has announced the completion of a $2.25 million Pre-Seed funding round, led by Moonshots Capital, with participation from former U.S. Federal Trade Commission Chairman Jon Leibowitz, AppNexus founder Brian O'Kelley, former Meta advertising executive Rob Goldman, GitHub CTO Vlad Fedorov, and others. The new funds will be used to support the company's application of AI content recognition and deep infrastructure analysis technology to help enterprises detect, analyze, and combat large-scale online fraud, phishing sites, brand impersonation, and Deepfake attacks. (PRNewswire)
Ledger Chief Technology Officer Charles Guillemet pointed out that the development of post-quantum cryptography has entered a critical stage. Although the timeline for a practical quantum computer remains unclear, a full-scale migration of the encryption systems across the industry is an inevitable trend. Led by NIST, the traditional sector plans to phase out high-risk algorithms by 2030 and completely ban them by 2035, with government and enterprise institutions expected to complete their migration layouts by 2029. Encryption and key exchange will adopt ML-KEM to defend against quantum decryption attacks on harvested data, with digital signatures becoming the core of blockchain transformation. The traditional industry prefers ML-DSA hybrid schemes, while the blockchain sector favors the more secure and robust SLH-DSA hash-based signature. Both schemes have their respective advantages and disadvantages. The compatibility challenges of post-quantum algorithms with MPC and threshold signatures remain a key risk that the industry urgently needs to address.
According to Cointelegraph, the widespread adoption of AI is driving up the number of submissions to cryptocurrency industry bug bounty programs—but a flood of low-quality “AI spam” reports has also emerged, placing a heavy burden on protocol teams for triaging. Barry Plunkett, Co-CEO of Cosmos Labs, stated that submission volume to its platform surged 900% year-on-year, with 20–50 reports received daily; Kadan Stadelmann, CTO of Komodo Platform, likewise noted a marked rise in low-quality and false-positive reports, attributing the root cause primarily to AI’s drastic reduction in the cost of generating reports. Daniel Stenberg, creator of the open-source tool curl, has already shut down his bug bounty program outright due to being overwhelmed. In response, industry insiders recommend that teams deploy defensive AI systems to automatically triage reports and adopt stricter submission criteria—reducing the volume of invalid reports and ensuring genuine vulnerabilities receive timely attention.