Crypto Security and Self-Custody: Incidents and Lessons

Exploits, custody failures and the self-custody debate — what was lost, how, and what the incident actually demonstrated about the tooling involved.

18 published analyses · all topics

• Aug 16, 2026Three Firms Counted Crypto's H1 Thefts and Got Three Different Answers

  Immunefi put the first half of 2026 at $972 million across a record 207 incidents; Blockaid put it above $1 billion with North Korean groups taking nearly $600 million; CertiK reported April alone above $650 million in DeFi losses. The spread is a disclosure problem rather than an arithmetic one - July showed why, when a $47 million exchange loss from 2021 entered the record only because a regulator filed over it. The one series with a stated year-over-year multiple was attacks on people.

• Aug 16, 2026Coin Bureau Spent the Week on What Stands Between a Holder and the Asset

  Bitcoin dominated the week's conversation across the voices we track and the tone on it was bearish; Coin Bureau's seven uploads kept returning to a different subject - the layer that sits between a holder and the thing they believe they own. Preferred securities that never mature, tokens backed by shares that are not ownership, reserve income claimed by distribution partners, open positions liquidated on an exchange's final day, and a firmware bug that handed over the keys.

• Aug 8, 2026Glassnode Published Two Big Bitcoin Numbers and Disclaimed Both Readings

  Two Bitcoin readings that would normally carry a directional story arrived on 6 August with caveats attached by the firm that published them: upside implied volatility at an all-time low of 23%, which Glassnode said reflects nobody paying for upside rather than anyone paying for protection, and active addresses at 0.98 million, which the same firm called an operational security response to the Coldcard exploit and not a change in market conviction. A second data source put one-month implied volatility above realized and closed with a question rather than a verdict. The analyst voices we track argued direction anyway.

• Aug 8, 2026890,000 Bitcoin Moved in Seven Days. One Firm Called It a Possible Bottom; an Exchange Called It “the Flip Side of FTX.”

  Bitcoin's seven-day active supply reached its highest level of 2026 — more than 890,000 BTC moved — and two named readings of that flow point opposite ways: K33 told The Block the spike resembles ones that have historically coincided with local turning points, while OKX said the Coldcard exploit is driving “record levels of inflows” to centralized exchanges and called it “the flip side of FTX.” The price did neither: Glassnode's note opened on “a theft the market slept through.”

• Aug 5, 2026Money-Market Funds and the S&P 500 Moved Onto Crypto Rails. The Same Day, Self-Custody's Loss Count Passed $100 Million.

  The day's tokenization launches loaded non-crypto assets onto public blockchains - money-market funds, S&P 500 stocks, bank deposits and 15 million school certificates - while Galaxy Research put losses from the Coldcard exploit above $100 million. Of the six financial-institution destinations named that day, one is a self-custody wallet; the rest are custodians, permissioned networks or an issuer's own chain. Kaiko put crypto's own trading volume last week at roughly $15 billion, the lowest of the year.

• Aug 5, 2026Source Spotlight - CrediBULL Crypto, Week of July 28: A Week About Liquidity, Just Not the Central Bank Kind

  While the week's headline conversation ran on sovereign liquidity - a Fed that made "no changes to rates", a 30-year Treasury yield at its highest since 2007, a joint US-Japan yen intervention - this feed spent all seven days on liquidity at a completely different scale: unfilled orders under a chart, a Curve pool's incentives, and whether you can withdraw from an exchange at all. A measured sweep of all seventeen of its posts found no mention of the Fed, bond yields, the dollar or the yen.

• Aug 5, 2026Strategy Sold Bitcoin to Pay a Dividend, and Saylor Separated His Coins From the Company's

  Bitcoin's documented movements on 3 August were funding decisions rather than price decisions: an SEC filing showed Strategy sold 1,638 BTC with roughly half the proceeds paying preferred dividends and the rest repurchasing its own preferred shares, while a second company sold coin and borrowed against more of it to build an AI data centre. Michael Saylor answered on his personal account by drawing a line between the coins he holds and the ones the company manages. Accumulation did continue in the window - in staked ether and in mined bitcoin, not in purchased bitcoin.

• Aug 3, 2026Market Pulse - August 2: Bitcoin's Active Address Count Jumped Toward a Million, and the Coldcard Fix Looks Exactly Like a Panic On-Chain

  The published remedy for the Coldcard firmware flaw is to generate a new seed and move funds, which is also what a rush for the exit looks like on-chain - and on Sunday bitcoin's active address count jumped from 645,000 toward a million. The count cannot separate the two, and three days on neither the migration nor the drain is finished. Three of the movements the day recorded were transfers rather than sales, and the sale that was announced had not been executed.

• Aug 3, 2026Market Pulse - August 1: A Patch Reaches the Firmware, Not the Keys It Already Made. Two Other Stories Saturday Worked the Same Way.

  Three unrelated Saturday stories turned on the same property: the outcome arrives without the holder's agreement. The Coldcard remedy is not a patch but a migration only the owner can perform; tether held on Revolut across the European Economic Area and Switzerland is converted to fiat on 31 August "whether the user authorized the sale or not", under a regime that deliberately does not touch self-custody; and a bitcoin signaling schedule begins rejecting the blocks that do not signal. The day's directional voices spent it arguing about something else.

• Aug 3, 2026Market Pulse - July 31: Bitcoin's Trustless Device Failed at Making a Secret. An Insured Custodian Named That Night Came With a Bank Charter.

  A random-number flaw in a hardware wallet drained $38 million in bitcoin, and the maker said an attacker likely used AI to find it by reading previous versions of its own open-source firmware. Over fourteen hours the publicly named list of affected devices went from one model, with three others called unaffected, to a range, to four families. What the voices we track offered in response was not less bitcoin but more custody architecture - a 25th word, a multisig quorum, an insured custodian whose own pitch names a US chartered national trust bank. The tape declined to price any of it: asked outright whether the exploit was bearish, one analyst answered that he did not care about it "a single percent", and bitcoin drifted back to $62.6K with call-heavy positioning and one-week implied volatility near 34%.

• Jul 29, 2026Sector Rotation - Week of July 21: Crypto's Venue Layer Emptied and Refilled in the Same Seven Days

  Crypto's venue layer changed hands rather than shrank this week: BitMEX, Movement Labs, Poolin and BitMart have all folded or filed in July, while in the same seven days fifteen new providers joined Europe's MiCA register, a state lender announced a crypto desk of its own and a commercial bank plugged into J.P. Morgan's chain. Attention rotated out of stablecoin policy into the venue-and-counterparty complex, and the sectors whose tone turned negative were the three that describe where a trade is custodied, cleared and leveraged.

• Jul 29, 2026Market Pulse - July 28: Two Tokens Offered Their Holders Equity. The Same Day, Wall Street Listed Two New Ways to Own Tokens.

  Two separate tokens in the day's coverage stopped being tokens: Across Protocol's ACX holders were pointed at a token-to-equity buyout as Coinbase disabled trading, and Storj's Chapter 11 proposes equity for STORJ holders behind creditors. Traffic ran the other way on the same day, with Morgan Stanley listing Ethereum and Solana products on the NYSE - the ether vehicle passing through most of its staking rewards. The wallets that specialise in pricing tokens showed no visible conviction in the equity offer.

• Jul 24, 2026Market Pulse — July 23: The Venue That Invented the 100x Perpetual Is Closing. The Perpetual Never Left.

  BitMEX — which pioneered the 100x perpetual swap in 2014 — will shut down on September 23, and the coverage read like an obituary for the leverage era. The cross-source tell cuts the other way: on the same day the perpetual was standing infrastructure at a Bermuda-licensed Coinbase entity, an on-chain book that cleared $4B in two weeks, and the venue where the day's largest identifiable fund shorts sat. The day's bearish derivatives tone was about stretched positioning and one dying venue — not the instrument, which is migrating onto licensed and on-chain rails even as a record run of bridge exploits met a new institutional security push.

• Jul 14, 2026MoonWire Crypto Security Tracker (2026): Losses Fell Below $1 Billion Even as Incidents Hit a Record - and the Threat Moved From Stolen Keys to Manipulated Logic

  A running, descriptive record of 2026's notable crypto exploits and failures, organized by attack surface. The year's paradox: total losses fell below $1B through H1 even as the count of distinct incidents hit a record, and the defining attacks shifted from stolen keys to manipulated logic - bad oracle prices, revalued vaults, and governance votes turned into withdrawal mechanisms.

• Jul 8, 2026Breaking Brief — July 8: Three Regulators Moved, and Every One of Them Was About the Border

  The fight stopped being about whether crypto is legal and became about whose law reaches it. Brussels extended its rulebook to stablecoin issuers outside the EU on the same day Russia's parliament committee wrote court protection for crypto ownership into a bill and cleared brokers to trade abroad — while India's central bank pushed a prohibition-leaning policy and its own tax officials conceded that offshore trading complicates enforcement. Nothing is enacted yet, and the market priced it accordingly: tone drained to neutral, ETF intake continued.

• Jul 8, 2026Market Pulse — July 8: The Builders Stepped Back, and the Balance Sheets Stepped In

  Crypto's own institutions spent the day withdrawing — a governance body resigning after an exploit, a seven-year-old app winding down, a treasury merger terminated, a crypto venture firm raising $1.2 billion for AI and robotics — while outside balance sheets quietly bought the assets they were leaving. Bitcoin dominated the conversation, but the tone across the voices we track drained from bullish to neutral. The consensus read was bottom-building; the dissent came from the ETF desk, and it pointed at the stock market.

• Jul 6, 2026Breaking Brief - July 6: A Green Day for Price, a Bad Day for the Stack - Wallets, DeFi, and a DAO Treasury All Breached

  As Bitcoin's price bounced, the day's real damage was in the code: a cross-chain key-generation flaw exposed thousands of wallet seeds, a DeFi yield protocol lost about $6 million to a flash-loan attack, and a DAO treasury was drained of roughly $20 million through a governance takeover - three different layers of the stack breached in a single session, even as regulators on two continents leaned further in.

• Jun 22, 2026Market Pulse — June 18-22: Capital Climbed the Quality Ladder While DeFi Took a Beating

  Money climbed the quality ladder even as it fled the bottom rung: large-cap treasuries (Strategy, El Salvador, BitMine) kept accumulating and payments names backed Solana, while DeFi turned defensive under a cluster of bridge and MEV exploits and a stablecoin-vault wind-down — all as Bitcoin's own ETF flows and mining economics quietly weakened beneath a bullish desk tone.