Weekly curated blockchain and Web3 job listings in engineering, product, research, and operations. Updated by Blockchain and Web3 Insights.

The Avalanche ecosystem has experienced a targeted security breach involving the Tranche Vault, resulting in the theft of approximately $10,000 (0.01 million) in digital assets. According to real-time monitoring data pro…

The decentralized finance (DeFi) protocol Ampleforth (AMPL) is currently facing a significant governance threat following a suspicious proposal aimed at the project's treasury. On September 12, 2026, a newly activated Ex…

A flaw in Symbiosis BridgeV2 let an attacker mint unbacked syBTC with a notional value of $46.1 billion, but the real cashout was only about $336,000 in WBTC.

The decentralized finance (DeFi) protocol Notional Finance has reportedly fallen victim to a security breach targeting its custody contract. According to data provided by blockchain security firm PeckShield on September …

Another protocol halts after losing $75 million, proving DeFi risk isn't always about bugs; sometimes it’s just bad collateral pricing on illiquid assets. Our analysis shows how oracle manipulation exposed a systemic weakness in low-liquidity token valuation across lending platforms.

The Edge of the Blockchain

With over 621,000 BTC under management, BlackRock now sits just below Satoshi Nakamoto as the largest Bitcoin holder

  InjectiveLabs/SDK-TS, a widely used package, was briefly published on Node Package Manager (npm) as a malicious version after attackers gained access to a legitimate contributor's GitHub account, exposing developers to the theft of cryptocurrency wallet credentials. Several security researchers from Socket, Ox Security, and StepSecurity identified the supply chain attack as targeting Injective Labs' TypeScript/JavaScript SDK, which is used to develop applications based on Injective's blockchain. The SDK is widely adopted by developers who create cryptocurrency wallets, decentralized finance (DeFi) applications, decentralized exchanges, trading bots, and payment platforms, with approximately 50,000 downloads per week on NPM.  A significant security issue is the responsibility of the SDK when it comes to creating and importing cryptocurrency wallets, as it occupies a critical position in the development process. Developers and end users alike are particularly vulnerable to any compromise of the SDK because the wallet creation functions are crucial to the handling of users' mnemonic recovery phrases and private keys.  Researchers have determined that hackers gained access to a legitimate contributor's GitHub account on June 8 and introduced malicious code, which was later released as version 1.20.21 for the @injectivelabs/sdk-ts package. Additionally, 17 additional Injective-related packages were referenced by the compromised release, resulting in a significant impact on downstream projects. According to security researchers, attackers compromised a legitimate maintainer's account after exploiting the trust-worthy GitHub publishing workflow of the project.  As opposed to stealing an NPM publishing token or creating a fake package, the malicious version was distributed through the repository's normal release process, making the compromise appear genuine. Package maintainers detected the malicious activity within minutes, reverting the unauthorized changes and releasing a version that is free of malicious activity, 1.20.23.  Nevertheless, systems that downloaded or updated the compromised package during the brief exposure window may still have been affected. In contrast to conventional malware that is executed during installation, the injected code is activated when developers create or import cryptocurrency wallets using SDK functions.  When this was achieved, the malware captured private wallet keys and mnemonic seed sentences, encoded the information, and sent it via HTTP POST request to what appeared to be an official Injective Labs infrastructure endpoint in order to blend into normal network traffic. As a method of minimizing detection, the malware disguised its outbound communication as legitimate injective network traffic in order to prevent detection.  By capturing multiple wallet secrets temporarily, encoding them, and transmitting them as a single request, the malicious activity was able to blend in with blockchain-related communications, avoiding detection. The malware, according to StepSecurity researchers, collected wallet secrets for approximately two seconds before bundling them into a single request to minimize suspicion while maximizing the amount of data stolen.  In a recent report, Socket reported that 310 malicious packages had been downloaded before they were deprecated, but there is reportedly still availability of the associated malicious GitHub release artifacts. As a consequence of Ox Security's warning, the compromised SDK is dependent on 87 direct NPM packages, accounting for more than 112,000 cumulative downloads, illustrating the risk to a larger supply chain. Researchers noted that even though the malicious payload was contained within @injectivelabs/sdk-ts, the compromised release affected 17 additional injective packages that depended on the infected SDK version. This could have resulted in developers installing the backdoored package unknowingly through normal project dependencies, thereby significantly expanding the attack's impact.  It is advised that developers who suspect they may have installed the affected version transfer cryptocurrency assets immediately into new wallets, replace compromised private keys and seed phrases, and rotate any sensitive credentials stored within their development environment immediately. The incident underlines the growing threat posed by software supply chain attacks, particularly within the cryptocurrency ecosystem where a compromised development dependency may result in a significant financial loss to both developers and end users. Due to the increasing sophistication of software supply chain attacks, organizations and developers must strengthen dependency verification, monitor package integrity, and respond quickly to compromised components so that credential theft and downstream compromise can be reduced.

Critical Solana-web3.js vulnerability led to $155,000 theft! Hackers exploited a backdoor to steal private keys. Secure your wallets—patch released. Learn more and protect yourself. #Solana #Web3Security #DeFi #Cryptocurrency #BlockchainSecurity 2024-12-16

By now you’ve probably heard that yet another attacker has hacked the largest zkLend protocol, withdrawing 3,300 ETH worth $5 million. Starknet’s decentralised lending protocol zkLend was hacked for $...