INSIGHTS
Expert analysis of the latest vulnerabilities, security news, threat intelligence, and the evolving attack surface.
Security DD for Web3 acquisitions: key management practices, incident history, people risk, compliance status and integration security planning.
Read ArticleValidator key management, emergency pause procedures, cross-chain monitoring and the operational failures behind the biggest bridge hacks.
Read ArticleAWS and GCP hardening for blockchain operations: IAM misconfiguration risks, secrets management, cloud key management and audit logging.
Read ArticleHow to build security behaviour in decentralised crypto teams through security champions, psychological safety, incentives and leadership commitment.
Read ArticleWho speaks, what to disclose, how to sequence regulatory vs public notifications, and how to manage community trust after a security incident.
Read ArticleMost crypto security programmes measure the wrong things, or measure nothing at all. This guide covers board-level security metrics, operational KPIs including MTTD and MTTR, crypto-specific indicators such as key rotation frequency and multisig signer health, and how to build a board reporting pack.
Read the security metrics guide →Most crypto firms implement technical access controls without a written policy, leaving no baseline to audit against and no evidence of control for regulators. This guide covers RBAC design, least privilege enforcement, privileged account controls for signing keys and cloud credentials, and the quarterly access review process.
Read the access control guide →Understanding MiCA and DORA obligations is not enough: you need an operational process to detect, classify and submit regulatory reports within the 4-hour initial notification window. This guide covers MiCA major incident notification, the DORA three-stage ICT reporting process, and how to design the internal workflow that makes compliance possible under pressure.
Read the regulatory reporting guide →Most DeFi protocols have an audit report and a bug bounty but no operational security function. This guide covers on-chain monitoring, incident detection with Forta bots, protocol pause mechanisms, war room procedures for the first 60 minutes of an active exploit, and fund recovery operations, with lessons from Euler Finance and Curve.
Read the DeFi security ops guide →The Bybit breach did not break multisig cryptography. It broke the human process around verifying what the multisig was being asked to sign. This guide covers quorum design, signer key management, Safe operational procedures, blind signing and UI spoofing defences, transaction governance, and emergency signer recovery.
Read the multisig security guide →Managing external security audits in Web3 requires more than choosing a vendor. This guide covers the full lifecycle from vendor qualification and engagement scoping through to remediation tracking, re-testing and audit programme governance.
Read the audit management guide →Traditional SIEMs miss on-chain event sources, node log formats, and HSM key-usage audit trails. This guide covers blockchain-native log sources, on-chain alert logic, Forta Network integration, and the incident response handoff for Web3 security operations teams.
Read the SIEM guide →Generic phishing tests fail crypto teams because they miss the attack scenarios that actually land: fake hardware wallet updates, multisig co-signer requests, Lazarus-style VC outreach, and Safe{Wallet} spoofing. This guide covers crypto-specific simulation design, metrics, and remediation workflows.
Read the phishing simulation guide →The most sophisticated cryptographic scheme is worthless if the HSM used in the key ceremony was physically compromised. This guide covers key ceremony room design, HSM tamper evidence, cold storage vault specifications, TEMPEST considerations, and data centre access controls for validator infrastructure.
Read the physical security guide →The 3CX breach, XZ Utils backdoor, and npm event-stream attack all exploited the software supply chain rather than the target directly. This guide covers dependency governance, SBOM, secrets management in CI/CD, and signing infrastructure protection for Web3 development teams.
Read the supply chain security guide →Taiko says it has reopened bridge transfers and made users whole after a $1.7M exploit. This report summarises the leaked-SGX-key attack path, confirmed attacker addresses, affected contracts, and what is known vs pending.
Read the Taiko report →Most Web3 firms focus on smart contract security while ignoring the human vector. This guide covers pre-employment vetting, crypto-specific background checks, ongoing insider threat monitoring, and the North Korean IT worker threat that has cost the industry billions.
Build your vetting programme →Hardware security modules are the foundation of institutional key custody, but the surrounding operational processes are where most firms fall short. This guide covers HSM selection, key ceremony design, dual-control procedures, and what to do when an HSM is lost or compromised.
Read the HSM guide →Flash loan voting, delegate manipulation, and timelock exploitation have drained hundreds of millions from DeFi protocols. This playbook covers the operational governance design principles that defend against these attacks, with lessons from Beanstalk, Tornado Cash, and Compound.
Read the governance playbook →Most Web3 firms have a business continuity plan but no tested disaster recovery plan. This guide covers the distinction that matters in a crisis: key recovery procedures, multi-sig restoration, signing infrastructure rebuilds, and regulatory notification obligations.
Read the DRP guide →Seed-stage and Series A crypto teams face real security threats but rarely have the budget or headcount of established firms. This guide covers the minimum viable security programme for Web3 startups: key management, access controls, vendor risk, and who to hire first.
Read the startup security guide →Cold storage security depends on policy, not just hardware. This guide covers asset tiering, key ceremony design, multi-sig quorum governance, physical custody, seed phrase backup, and the authorisation workflow that prevents unauthorised withdrawals.
Read the guide →A compromised deployment pipeline can inject malicious code into a protocol upgrade or exfiltrate signing keys without triggering any on-chain detection. This guide covers secrets management, dependency scanning, GitHub Actions hardening, and signing key protection for Web3 teams.
Read the guide →Generic corporate security training does not address the specific threats facing crypto organisations: fake job offer attacks, SIM swap targeting key holders, and seed phrase social engineering. This guide covers role-based training tiers, phishing simulation, insider threat detection, and regulatory requirements.
Read the guide →Panama's virtual asset framework under Law 23 of 2015 is administered by the SSF and UAF. This guide covers corporate requirements, AML/CFT operational obligations, the FATF grey-listing history, and what regulators inspect when examining whether a firm's programme is genuine.
Read the guide →Brazil's Banco Central do Brasil (BCB) regulates virtual asset service providers under Law 14.478/2022 and the CNAD registry. This guide covers AML/CFT operational requirements, BCB cybersecurity obligations, the supervisory examination process, and what distinguishes firms that pass from those that fail.
Read the guide →Lithuania has issued more crypto licences than almost any other EU state, but requirements have tightened significantly. This guide covers FNTT registration, the €125,000 capital requirement, AML obligations, cybersecurity expectations, and the MiCA transition pathway.
Read the guide →Poland's DKWN register is one of the more accessible EU crypto licensing routes, but the AML and operational requirements are substantial. This guide covers the GIIF registration process, fit and proper requirements, transaction monitoring obligations, and what MiCA changes for Polish VASPs.
Read the guide →Estonia tightened its crypto licensing regime dramatically in 2022, raising capital requirements to €100,000 and requiring genuine local substance. This guide covers the FIU registration process, AML obligations, cybersecurity requirements, and what the MiCA transition means for Estonian VASPs.
Read the guide →The largest exchange losses in history were operational failures, not cryptographic ones. This guide covers the full operational security framework for a CEX: hot and cold wallet ratios, staff access controls, multi-signature governance, monitoring, and the lessons from Mt. Gox, Binance, and FTX.
Read the guide →A sybil attack is a governance and identity verification failure, not merely a cryptographic problem. This guide covers proof of personhood systems, on-chain reputation, economic sybil resistance, airdrop design due diligence, and how to detect coordinated sybil behaviour before it manipulates your protocol.
Read the guide →Most crypto firms respond to attacks after the fact. A structured threat intelligence programme gives your security team the ability to detect and act before an attack lands. This guide covers on-chain and off-chain sources, Lazarus Group TTPs, and how to operationalise intelligence.
Read the guide →A treasury breach is irreversible. This guide covers the operational security disciplines every Web3 firm needs: tiered storage architecture, multi-sig quorum design, HSM integration, custodian selection, and approval workflows that hold up under adversarial pressure.
Read the guide →The majority of crypto fraud is internal or enabled by insider access. This guide covers the fraud triangle, dual controls, separation of duties, transaction monitoring, BEC defence, and the regulatory obligations around fraud prevention for crypto firms.
Read the guide →ISO 27001, SOC 2, CREST, CCSS: security certifications are becoming a barrier to institutional partnerships and regulatory approval. This guide explains what each certification covers, how to prioritise for your firm type, and what certifications cannot replace.
Read the guide →Hot wallets are necessary for operations but represent the highest-risk point in a Web3 firm's security architecture. This guide covers approval workflows, HSM integration, access controls, transaction monitoring, and incident response for hot wallet compromise.
Read the guide →Insider threats in crypto are observable before they execute. Most go unreported because no safe channel exists. This guide covers how to build an effective anonymous reporting programme for Web3 organisations.
Read whistleblower policy guide →Node security is the most neglected layer of Web3 infrastructure. This guide covers validator key management, RPC endpoint hardening, multi-client diversity, and the operational controls required to protect consensus-critical infrastructure.
Read node security guide →Point-in-time audits cannot keep pace with a Web3 protocol's evolving attack surface. This guide covers how to build a continuous attack surface management programme across on-chain contracts, off-chain infrastructure, and supply chain dependencies.
Read CASM guide →A well-structured bug bounty programme is one of the most cost-effective security controls available to crypto protocols. This guide covers scope, reward tiers, triage processes, legal safe harbour, and how to choose between Immunefi and self-hosted programmes.
Read bug bounty guide →Most infrastructure attacks exploit known vulnerabilities with available patches. This guide covers the five-layer patching attack surface for Web3 firms: node software, smart contract dependencies, off-chain services, CI/CD tooling, and cloud infrastructure.
Read patch management guide →Most crypto firms treat KYC/AML as a one-time onboarding step. This guide covers how to build a genuine AML operations programme covering CDD, transaction monitoring, the FATF Travel Rule, and SAR filing.
Read AML operations guide →Crypto firms without proper logging and monitoring cannot detect insider threats or infrastructure breaches in time to respond. This guide covers what to log, how long to retain it, and how to build a Web3 SIEM programme.
Read logging and monitoring guide →The LastPass breach led to over $35M in crypto losses. The root cause was not a cryptographic failure but a chain of operational security failures. Here is what every crypto firm must learn and implement before the same attack vector reaches them.
Read LastPass breach analysis →A smart contract audit only covers one layer of the attack surface. This guide explains every type of penetration testing relevant to Web3 organisations and how to prioritise them based on your firm's risk profile.
Read penetration testing guide →Most Web3 treasury losses result from governance and operational failures, not code exploits. This guide covers multi-sig design, HSM integration, approval workflows, and the controls that prevent treasury compromise.
Read treasury security guide →On 14 June 2026 a deprecated, immutable Aztec Connect RollupProcessor contract that still held residual user funds was drained of about $2.19M in a single transaction. This analysis covers the on-chain evidence, the two-phase attack path, and the reported ZK public-input versus L1 settlement gap. Not the current Aztec network or AZTEC token.
Read the Aztec Connect analysis →Passkeys and hardware security keys both eliminate phishing, but they serve different roles in a crypto firm's security stack. This guide explains when to use each and where each has limits.
Read authentication guide →Security due diligence in crypto covers far more than a smart contract audit. This checklist covers all ten operational security domains investors and acquirers must assess before deploying capital.
Read due diligence checklist →DORA mandates threat-led penetration testing for significant financial entities, including crypto-asset service providers. This guide explains what TLPT involves and how to prepare your firm.
Read TLPT guide →Security governance defines who owns security decisions, how risks are escalated, and how accountability flows from board level to engineer. Most Web3 firms have no governance framework at all.
Read governance guide →Crypto insurance is a critical but misunderstood layer of operational risk management. This guide covers what it protects, what voids coverage, and how to procure it through the Lloyd's market.
Read insurance guide →When an employee or contractor leaves a crypto firm, their lingering access to wallets, keys, and cloud infrastructure is a critical and irreversible risk. This guide covers key revocation, hardware wallet recovery, access removal procedures, and emergency offboarding for hostile departures.
Build your offboarding programme →Physical security is a critical and underappreciated operational control in crypto. This guide covers office access controls, hardware wallet storage, key ceremony security, travel safety for executives, and physical penetration testing for Web3 firms.
Assess your physical security →Network segmentation contains breaches by preventing lateral movement from a compromised device to key management systems and wallets. This guide covers zone architecture, HSM isolation, validator node segmentation, and zero trust principles for crypto infrastructure.
Segment your crypto network →SOC 2 is increasingly required by institutional clients, enterprise partners, and investors in the crypto space. This guide covers the Trust Services Criteria, Type I vs Type II, the full audit process, and the controls that matter most for Web3 service providers.
Prepare your SOC 2 audit →The NIST CSF 2.0 is the most widely adopted cybersecurity framework globally and maps directly onto the People, Process, and Technology controls that Web3 firms need. This guide covers all six functions with crypto-specific implementation guidance and regulatory alignment with DORA and MiCA.
Implement the NIST framework →Fresh 13 June reporting on the Quantstamp investigation links the ~$36M Humanity Protocol $H exploit to North Korea-linked tactics. This was a private-key, endpoint, and privileged-access failure that exposed bridge and admin authority across Ethereum and BNB Chain, not a smart contract bug.
Read the Humanity Protocol analysis →Separation of duties prevents any single person from controlling critical crypto operations from initiation to approval. This guide covers dual authorisation, multisig governance, treasury controls, and how to implement SoD in a small Web3 team.
Implement separation of duties →Exchange APIs, oracle endpoints, and RPC interfaces are high-value attack targets in Web3. This guide covers authentication, rate limiting, RPC endpoint hardening, oracle manipulation risks, and API monitoring for crypto firms.
Secure your APIs and RPC endpoints →The devices where crypto keys are held and transactions are signed are the primary target for advanced threat actors. This guide covers EDR deployment, crypto-specific threat detection, privileged access workstations, and alert triage for Web3 security teams.
Protect your key management devices →DevSecOps embeds security into every stage of the Web3 development lifecycle rather than adding it at audit time. This guide covers secret scanning, dependency supply chain controls, CI/CD pipeline hardening, and deployment approval workflows for crypto engineering teams.
Secure your development pipeline →Most crypto infrastructure runs on AWS, GCP, or Azure, and cloud misconfigurations are among the leading causes of Web3 breaches. This guide covers IAM hardening, cloud key management, CI/CD pipeline security, and CSPM for crypto and blockchain organisations.
Secure your cloud infrastructure →Business continuity planning ensures your crypto firm keeps operating through hacks, outages, and crises. This guide covers BCP frameworks, recovery objectives, key management continuity, and DORA compliance requirements.
Build your continuity plan →Data loss prevention stops private keys, seed phrases, and sensitive data from leaving your organisation. This guide covers DLP controls for insider threats, accidental exposure, and supply chain attacks in crypto and Web3 firms.
Implement DLP controls →Cyber threat intelligence gives crypto firms early warning of nation-state actors, organised criminal groups, and opportunistic attackers. This guide covers CTI sources, dark web monitoring, and how to operationalise intelligence for Web3 defenders.
Operationalise your threat intelligence →Identity and access management governs who can access which systems, wallets, keys, and infrastructure in your crypto firm. This guide covers IAM frameworks, SSO, MFA, RBAC, and zero-trust identity principles for Web3 teams.
Review your IAM controls →Security awareness training is the foundational operational control that reduces human error, the leading cause of crypto losses. This guide covers phishing simulations, crypto-specific threat awareness, and how to measure training effectiveness.
Build your awareness programme →Most Web3 security failures trace back to culture, not code. This guide covers how to build a security-first culture in a crypto firm, from leadership behaviour and hiring to phishing simulations and blameless incident reviews.
Build your security culture →Penetration testing costs vary widely, from £3,000 for a basic web app assessment to over £200,000 for DORA threat-led testing. This guide breaks down the price drivers, cost ranges by test type, and how to evaluate proposals without cutting corners on quality.
Understand penetration testing costs →Red team and blue team exercises expose the operational gaps that standard audits miss. This guide covers what crypto red teams actually test, how blue teams detect and respond, and when to commission a purple team engagement under DORA TLPT requirements.
Explore adversarial testing →ISO 27001:2022 certification gives crypto firms a structured framework for managing information security risk across people, processes, and technology. This guide covers the eight-step certification process, DORA alignment, and the most common failure points firms encounter.
Start your ISO 27001 journey →Operational risk management applies Basel II/III taxonomy to the unique threat environment facing crypto and Web3 organisations. This guide covers the ORM cycle, building a risk register, setting risk appetite, and defining key risk indicators across people, process, and technology.
Build your ORM framework →Blockchain forensics applies on-chain analysis to trace stolen funds, attribute attacks to threat actors, and support legal recovery. This guide covers the full investigation workflow, attacker obfuscation techniques, and when to engage a specialist firm.
Read the blockchain forensics guide →Web3 organisations have uniquely complex attack surfaces spanning deployed contracts, RPC endpoints, bridge infrastructure, admin keys, and the personal devices of privileged users. This guide covers how to discover, inventory, and continuously reduce your exposure.
Read the attack surface management guide →A security operations centre provides the continuous monitoring, detection, and response capability that crypto firms need to catch attacks before funds leave the protocol. This guide covers SOC design, tooling, and build-vs-outsource decisions for Web3 organisations.
Read the crypto SOC guide →Vulnerability management is a continuous process of discovery, assessment, prioritisation, and remediation across your entire technology stack. This post adapts the five-stage VM cycle for the specific challenges of crypto and Web3 infrastructure.
Read the vulnerability management guide →Hardware security modules generate, store, and use cryptographic keys in tamper-resistant hardware, ensuring private keys never exist in plaintext outside the device. For crypto firms managing high-value signing keys, HSMs are the baseline control.
Read the HSM for crypto guide →Nation-state actors and criminal groups target crypto firms through spear phishing, fake job applications, and vishing campaigns. This guide covers the full social engineering threat landscape and the operational controls that stop it.
Read the social engineering defence guide →Most Web3 exploits involve a compromised third party: bridge operators, oracle providers, custody partners, or infrastructure suppliers. This post sets out a practical vendor risk management framework for crypto firms.
Read the vendor risk management guide →Traditional IT incident response plans fail in Web3 because on-chain transactions are irreversible and losses occur in blocks, not hours. This guide adapts the five IR phases for crypto and DeFi organisations.
Read the crypto IR planning guide →The perimeter-based security model fails for remote-first crypto teams with distributed infrastructure. Zero trust treats identity as the new perimeter and applies continuous verification across every user, device and connection.
Read the zero trust security guide →Privileged access failures are behind some of the largest crypto losses on record. This guide covers what PAM means for crypto organisations, core controls including JIT access and session recording, and how to implement it without disrupting operations.
Read the PAM for crypto guide →Lazarus Group has stolen over $3 billion in crypto — not primarily through code exploits, but through operational failures, social engineering, and human targeting. A deep dive into their full kill chain and how to build an OpSec programme that can withstand nation-state threats.
Read Lazarus Group OpSec analysis →Most blockchain security audits only look at smart contract code. The real risk is the full stack: People, Process, and Technology. Here’s what a complete audit covers, what it costs, and the red flags in every audit report you need to watch for.
Read the blockchain security audit guide →Security tokens are regulated digital representations of real-world assets — and their security model is fundamentally different from utility tokens. From STOs to ERC-1400 to MiCA classification, this is the guide institutions need before issuing or investing.
Read the security token guide →MITM attacks are the most underappreciated operational threat in blockchain. From RPC endpoint poisoning to BGP hijacking and clipboard address replacement — a complete breakdown of how attackers intercept crypto transactions and how to stop them.
Read the MITM attacks in crypto guide →An active exploit hit Gnosis Pay’s delay module. Zodiac disclosed the flaw affected Roles Modifier v2 and Delay Modifier v1.1.0: a signature check discarded the call success flag and compared returndata to the EIP-1271 magic value, enabling forged contract signatures. Safe core was unaffected; 99%+ of users restored by 7 June.
Read Gnosis Pay Zodiac Module exploit analysis →An attacker registered a minimal validator, minted fake tokens on Osmosis, then used permissionless deployERC20() with fabricated _cosmosDenom strings embedding real custody token addresses. With no collision check, the poisoned registry released ~$4.3M USDC, 274 WETH, $434K USDT, and 14.16 PAXG before validators halted the bridge.
Read Gravity Bridge denom poisoning exploit analysis →A fabricated LOG7 event tricked Alephium’s guardians into signing valid VAAs over a forged Wormhole message, draining ~$305K of backed collateral and minting 13.76M unbacked wALPH. Guardians later burned 96.4% via a TokenBridge upgrade. Official on-chain report published 2 June; fuller postmortem pending.
Read Alephium Bridge fake Wormhole exploit analysis →Reports indicate DxSale’s legacy liquidity locker contracts on BNB Chain were drained for approximately $7.3M from more than 1,400 LP positions. SlowMist classifies it as an Ownership Override Attack involving retained admin privileges, a custom drainer, and unlock timestamps backdated to 1970.
Read DxSale $7.3M BNB Chain locker drain analysis →El Salvador's CNAD has materially strengthened its supervisory posture. Applications that passed in 2023 would be returned today. Here is what the DASP licence requires across entity structure, AML/CFT, cybersecurity documentation, and ongoing obligations, and where most applicants fall short.
Read DASP compliance requirements guide →MiCA has been fully applicable since December 2024. The grandfathering period ended July 2026. Firms without authorisation are now in breach. Here is what CASP authorisation requires, what the cybersecurity obligations are under MiCA and DORA, and where most applications fall short.
Read MiCA compliance requirements guide →DORA has been in force since January 2025, applying to over 22,000 financial entities, including crypto-asset service providers. Here is what the five pillars require, who must comply, what the penalties are, and where most organisations fall short on documented evidence.
Read DORA compliance requirements guide →VARA issued substantive rulebook updates in June 2025. Threat-led penetration testing is now mandatory. AML/CFT risk assessments are quarterly. The FATF Travel Rule is a hard requirement. Here is what VASPs must demonstrate, and where most programmes fall short.
Read VARA compliance requirements guide →Reports indicate a multisig owner key was compromised, owners replaced, and EURR/USDR minted on Ethereum. Nominal mint ~$10.4M, realised loss reported at $2.8M+. Root cause pending official confirmation.
Read StablR EURR/USDR unauthorised minting exploit analysis →Polymarket investigated a Polygon incident affecting its UMA CTF Adapter admin wallet. Early reporting points to an internal operations private key compromise, with ~5,000 POL outflows every ~30 seconds and losses reported between ~$520K and ~$700K.
Read Polymarket UMA CTF Adapter incident analysis →
Discover the most common smart contract vulnerabilities in 2025, from reentrancy to oracle manipulation. Learn how teams can mitigate risks and harden their smart contract security posture with proven practices.
Read top 5 smart contract vulnerabilities 2025 →
Web3’s permissionless nature enables innovation, but also opens the door to complex security threats. We explore how on-chain forensics and investigation techniques trace rug pulls, MEV exploits, and actors lurking on the darknet.
Read rug pulls, MEV bots and darknet threat actor analysis →
How North Korea’s Lazarus Group pulled off the $1.5B Bybit attack, and what it means for the future of Web3 security.
Read inside the Bybit hack: full analysis →On April 18, 2026, a forged LayerZero packet released 116,500 rsETH from Kelp’s Ethereum adapter, no corresponding burn on the source chain. Postmortem vs on-chain evidence.
Read KelpDAO rsETH bridge exploit analysis →LayerZero Labs’ official report reveals the attack started on March 6 with social engineering and session-key harvesting, eventually producing a forged attestation that drained $292M.
Read LayerZero KelpDAO $292M rsETH exploit postmortem →The contract checked permissions against one address, then debited funds from a different one, bypassing the entire RFQ trust model in a single transaction on Ethereum.
Read TrustedVolumes RFQ authorisation mismatch exploit analysis →Butter Bridge v3.1 appears to have been exploited via a message retry validation flaw, enabling an attacker to mint ~1 quadrillion MAPO and extract liquidity. Early analysis, root cause pending.
Read MAP Protocol Butter Bridge exploit analysis →On May 15, 2026, THORChain suffered a multi-chain exploit across at least nine chains, with TRM Labs reporting $11M+ drained. Breaking analysis, official postmortem still pending.
Read THORChain $11M multi-chain drain exploit analysis →Reports cite 103.6 tBTC, 1,625 ETH, and ~147,000 USDC drained after the bridge accepted a forged import payload without validating equivalent source-side value.
Read Verus Ethereum Bridge $11.58M exploit analysis →An attacker minted 1,000 unbacked eBTC on Monad after gaining privileged access, nominal value $76.7M, realized loss ~$816K. Liquidity depth was the only thing limiting the damage.
Read Echo Protocol admin key compromise exploit analysis →