SEC revives the crypto custody rule the previous administration could not land
The Commission is bringing back a custody rulemaking that stalled under the prior administration, arriving alongside the proposed "Regulation Crypto Assets" offering regime under Chairman Atkins' Project Crypto.
Custody is where self-sovereignty and regulation actually collide. This rule, not the offering regime, decides whether a DAO treasury can sit in its own multisig or must move to a qualified custodian.
The Sandbox SAND exploited on Base — LayerZero delegate permissions hijacked
Attackers seized LayerZero delegate permissions for the SAND token on Base and minted unbacked supply across hundreds of transactions before the exploit was flagged.
Another permissions failure, not a code failure. Cross-chain messaging delegates are an admin surface most treasuries never inventory. If KWIZERANA ever bridges a token, the delegate key is the asset.
Coldcard losses pass $130M as forensics confirm a five-year-old entropy bug
A build-configuration error caused seed generation to fall back to a weak software RNG instead of the hardware entropy source. Over 5,200 addresses drained since July 30, roughly 1,816 BTC. Laundering remains limited — one 64.9 BTC Wasabi deposit and 200 ETH through Tornado Cash.
Third-largest hack of 2026 and the funds are still barely moving. A patient, well-resourced attacker. Any treasury key generated on affected Coldcard firmware must be rotated, not reviewed.