Coldcard hardware wallet theft passes $130M as a fifth wave hits
Firmware shipped from March 2021 generated wallet seeds from a deterministic pseudo-random generator instead of the hardware RNG, making thousands of Coinkite Coldcard seeds derivable offline.
The worst class of failure there is: cold storage, correct user behaviour, silent compromise. Any KWIZERANA treasury seed created on affected firmware must be rotated, not audited.
Term Finance governance takeover confirms the DAO attack pattern
$8.5M seized through legitimate proposals passed by an attacker holding a majority of an illiquid governance token.
Nothing was hacked. Every transaction was valid. That is precisely why the mitigations are political, not technical.
SafePal plug-in flaw exposes 39,798 customers' names and addresses
An authorization flaw in an order-tracking plug-in leaked names, emails, shipping addresses, phone numbers and purchase history for roughly forty thousand hardware wallet buyers.
A shipping list of confirmed hardware-wallet owners is a targeting list. Expect physical-coercion and phishing attempts against those names for months.