RESEARCH
We review public security incidents and turn them into defenses blockchain teams can put in place right away. Defense only, no attack walkthroughs.
RSS feed ↗
PHP says it will ship a security release at 14:00 UTC on October 21 to fix two remote code execution flaws rated CVSS 9.2 (CVE-2026-109618, CVE-2026-109619). What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
Qubic says 1,404 wallets, about 2.94 trillion QU, were drained because some wallet seeds were generated with insufficient randomness. What it means for blockchain teams of 10 to 50 people, viewed through process, risk and privileges, with five steps to take now.
Read article →
SlowMist has disclosed DarkSword, a trojan infrastructure targeting iPhones that steals crypto wallets, keychain data and messaging accounts. What it means for blockchain teams, with seven prioritized defenses and a mobile security architecture.
Read article →
A batch of Ledger devices sold through a Southeast Asian reseller carried a seed-stealing hardware implant, and scammers are now sending fake "urgent firmware update" emails. Where small teams are exposed, and five defenses to put in place now.
Read article →
A timeline of the roughly $387.5 million theft from Bitget's hot and warm wallets and five takeaways: the entry point was a zero-day in a third-party security product, while private keys and contracts stayed intact. Includes a five-point self-check for smaller teams.
Read article →INCIDENT RESPONSE · ASSESSMENT
Reply within 24 business hours · team@musesec.com
CONTACT
Leave your contact details and needs and we will get back to you soon. You can also reach us on WeChat.
