Zilliqa’s Ledger app has been leaking users’ private keys for seven years.

Since 2019, the app contained a critical bug in its signature process. Instead of generating a fresh random nonce for every signature (as required for security), it copied the wrong bytes — leaving part of the nonce fixed at zero.

That small, predictable flaw was enough. Every transaction you signed leaked a little more information about your private key. After roughly five signatures, an attacker could recover the full key in seconds on a regular laptop.

The bug existed in every version of the app and went completely unnoticed until last week, when wallets started getting drained.

The damage is permanent. Those flawed signatures are immutably recorded on the blockchain. Affected users can’t safely move their funds — the attacker already has the key and will almost certainly win any race.

A hardware wallet app quietly exposed private keys in public for nearly a decade.

All the red is my current loss positions for pretty significant amounts of money (for normal people)

I've been in the cryptosphere since 2018 but I never put serious money or hold it properly for long term. All I did was occasionally trading meme coin with $100 or $200 but nothing above $400. With the rising usage of AI and my job being at risk (Software Engineer) I feel like now is the perfect time to buy and hodl for the future because the future doesn't look very good with AI around. Now that I have a proper job and proper saving, I have decided to buy a cold wallet and put some of my life saving into cryptocurrency and keep it in my safe and DCA from this time onward. Here's what I invested:

- $3000 on Bitcoin

- $1000 in Ethereum

- $1000 in Solana

The most trust I have between these 3 is Bitcoin because it seems to be the one who's doing well the most in term of long time period. Excited to join the hodl family and cheer!

Interesting read. Gives you something real to think about.
4 million BTC ($40B) already lost forever. Your crypto might be next - and most people still have zero plan.

1. No major exchange (Coinbase, Binance, Kraken) lets you name a beneficiary. Your heirs will have to go through probate court and then customer support while the market does whatever it wants.
2. You don’t inherit the coins - you inherit the private key. If your family can’t reconstruct it, the crypto stays visible on the blockchain forever but completely unspendable.
3. The good news: you can fix this today. Make a simple inventory (no keys), write a plain-language letter of instruction, never put the seed in your will, and for serious money use Shamir shares or a time-delayed multisig (Casa / Nunchuk / Unchained).

Full article: https://coin.space/what-happens-to-your-crypto-when-you-die-2026-guide-to-crypto-inheritance/

Proof that the regulated perimeter does not equal the secure perimeter. been seeing a lot of "just wait until everything's regulated, then it'll be safe" takes in defi/stablecoin threads lately, so this felt worth sharing.

hacken released its q2 security and compliance report, and in this era of regulation boom, this case is worth sharing.

so, stablr (usdr/eurr) is mica-authorized lost $2.8M this quarter because one of its three mint keys got compromised

what makes this specific case interesting is that key/mint-authority management is exactly the kind of operational control mica's underlying framework (dora) is supposed to require issuers to have locked down. it's not a gap in the rules on paper. it's that authorization checks whether you have a security policy document and pass a point-in-time pentest, not whether your actual key management setup survives a real attempt. the loss happened inside the regulated perimeter, after full authorization, not from some unlicensed fly-by-night issuer.

not saying mica is pointless, but "licensed" not always mean "operationally secure"

Infographic taken from: https://beincrypto.com/clarity-act-text-is-out-what-does-it-say/

Incident 1: I copied a Gemini BNB Smart Chain deposit address and withdrew BNB from Kraken. Gemini later confirmed that the destination was not associated with Gemini. This was done on a Firefox browser through Gemini and Kraken's website.

Incident 2: Six months later I copied a Kraken USDC/Arbitrum One deposit address and sent from MetaMask. It again went to the exact same unrelated address. This was done through an Opera browser via MetaMask extension.

Both were performed on the same Windows computer, using different browsers. The first incident did not involve MetaMask. I have successfully copied many other crypto addresses without this happening.

Has anyone encountered malware or a clipboard utility that selectively replaces only EVM addresses or triggers only inside crypto transaction forms? What diagnostic tools and persistence locations should I inspect?

Many people hold stablecoins for trading, but fewer use them for actual purchases. As payment systems evolve, stablecoins could become a practical way to move value without the volatility of traditional crypto assets.

Would you feel comfortable using stablecoins for everyday purchases? Why or why not?

When selling crypto on a p2p platform, what’s to stop me from receiving their payment and then not releasing the crypto ?

I’d never do this of course, just really curious, but I recently got into crypto trading and I noticed what seems like a glaring issue. When I sell crypto, I receive the persons payment before I’ve released the crypto. Whats to stop me from taking the payment and just never releasing the crypto? I know escrow is involved where the crypto is kept or something but I’m not really sure how that works. What if I just tell the crypto platform I never received the payment and they release my crypto back to me?

Again, would never do this, just very curious.

I've been on an app called white bit and what I can say is that I can easily call it the best one for trading and investments with I think the highest APY I've seen so far esp. for stable coins.

Now that they separate it into two versions ( one just for Europeans ) I have to send my money somewhere else, though I have no idea which service to use.

I'm doing both investments and trading so if you guys have some advice for some services that has somewhat low fees for trading and good APY, I'll be grateful.

Thanks.