MetaMask code was open to a North Korea-linked contractor for a month
A DPRK-linked contractor hired via a third party had access to MetaMask's core and mobile codebase for ~a month before Consensys froze all releases; no malicious code shipped, no user data or assets lost.
Why it matters: crypto's most-used self-custody wallet came within one code review of a supply-chain catastrophe — DPRK IT-worker infiltration now outranks contract bugs as a threat.
Bitcoin's quantum problem gets a ZK recovery tool — but not for Satoshi's 1.1M coins
Project Eleven released a zero-knowledge proof system letting owners of quantum-vulnerable bitcoin prove ownership and recover coins under BIP-361's proposed freeze — proofs generate in 243ms on a laptop.
Why it matters: ZK cryptography is maturing into practical tooling for crypto's looming quantum migration, one of the biggest long-term custody risks.
Crypto loses over $20M in a week as Ostium, Across and Cascade get hacked
The Jul 12–19 week saw a compromised oracle signer (Ostium), a $1.34M locked-vault drain at Polychain-backed Cascade, a Solana lending deficit at DeFiTuna, and Across's first-ever attack.
Why it matters: four unrelated incidents via four different vectors — oracle key, locked vault, lending logic, relayer — show attackers probing every layer of the stack at once.