The liquid staking protocol Volo, a prominent player within the Sui blockchain ecosystem, has reported a significant security breach resulting in the theft of approximately $1.5 million in digital assets. Following the d…

Unlock the multi-chain future with Cross-Chain Bridges crypto. Understand major risks, and learn from notorious bridge hacks blockchain.

  InjectiveLabs/SDK-TS, a widely used package, was briefly published on Node Package Manager (npm) as a malicious version after attackers gained access to a legitimate contributor's GitHub account, exposing developers to the theft of cryptocurrency wallet credentials. Several security researchers from Socket, Ox Security, and StepSecurity identified the supply chain attack as targeting Injective Labs' TypeScript/JavaScript SDK, which is used to develop applications based on Injective's blockchain. The SDK is widely adopted by developers who create cryptocurrency wallets, decentralized finance (DeFi) applications, decentralized exchanges, trading bots, and payment platforms, with approximately 50,000 downloads per week on NPM.  A significant security issue is the responsibility of the SDK when it comes to creating and importing cryptocurrency wallets, as it occupies a critical position in the development process. Developers and end users alike are particularly vulnerable to any compromise of the SDK because the wallet creation functions are crucial to the handling of users' mnemonic recovery phrases and private keys.  Researchers have determined that hackers gained access to a legitimate contributor's GitHub account on June 8 and introduced malicious code, which was later released as version 1.20.21 for the @injectivelabs/sdk-ts package. Additionally, 17 additional Injective-related packages were referenced by the compromised release, resulting in a significant impact on downstream projects. According to security researchers, attackers compromised a legitimate maintainer's account after exploiting the trust-worthy GitHub publishing workflow of the project.  As opposed to stealing an NPM publishing token or creating a fake package, the malicious version was distributed through the repository's normal release process, making the compromise appear genuine. Package maintainers detected the malicious activity within minutes, reverting the unauthorized changes and releasing a version that is free of malicious activity, 1.20.23.  Nevertheless, systems that downloaded or updated the compromised package during the brief exposure window may still have been affected. In contrast to conventional malware that is executed during installation, the injected code is activated when developers create or import cryptocurrency wallets using SDK functions.  When this was achieved, the malware captured private wallet keys and mnemonic seed sentences, encoded the information, and sent it via HTTP POST request to what appeared to be an official Injective Labs infrastructure endpoint in order to blend into normal network traffic. As a method of minimizing detection, the malware disguised its outbound communication as legitimate injective network traffic in order to prevent detection.  By capturing multiple wallet secrets temporarily, encoding them, and transmitting them as a single request, the malicious activity was able to blend in with blockchain-related communications, avoiding detection. The malware, according to StepSecurity researchers, collected wallet secrets for approximately two seconds before bundling them into a single request to minimize suspicion while maximizing the amount of data stolen.  In a recent report, Socket reported that 310 malicious packages had been downloaded before they were deprecated, but there is reportedly still availability of the associated malicious GitHub release artifacts. As a consequence of Ox Security's warning, the compromised SDK is dependent on 87 direct NPM packages, accounting for more than 112,000 cumulative downloads, illustrating the risk to a larger supply chain. Researchers noted that even though the malicious payload was contained within @injectivelabs/sdk-ts, the compromised release affected 17 additional injective packages that depended on the infected SDK version. This could have resulted in developers installing the backdoored package unknowingly through normal project dependencies, thereby significantly expanding the attack's impact.  It is advised that developers who suspect they may have installed the affected version transfer cryptocurrency assets immediately into new wallets, replace compromised private keys and seed phrases, and rotate any sensitive credentials stored within their development environment immediately. The incident underlines the growing threat posed by software supply chain attacks, particularly within the cryptocurrency ecosystem where a compromised development dependency may result in a significant financial loss to both developers and end users. Due to the increasing sophistication of software supply chain attacks, organizations and developers must strengthen dependency verification, monitor package integrity, and respond quickly to compromised components so that credential theft and downstream compromise can be reduced.

Balancer reports on its $128M exploit. Learn how a rounding error in batch swaps caused the incident.

Catch up on crypto: Bitcoin's $100k test, Balancer hack, stablecoin de-pegs, and Ethereum's record TPS.

The decentralized finance (DeFi) protocol Ampleforth (AMPL) is currently facing a significant governance threat following a suspicious proposal aimed at the project's treasury. On September 12, 2026, a newly activated Ex…

Another protocol halts after losing $75 million, proving DeFi risk isn't always about bugs; sometimes it’s just bad collateral pricing on illiquid assets. Our analysis shows how oracle manipulation exposed a systemic weakness in low-liquidity token valuation across lending platforms.

By now you’ve probably heard that yet another attacker has hacked the largest zkLend protocol, withdrawing 3,300 ETH worth $5 million. Starknet’s decentralised lending protocol zkLend was hacked for $...

The decentralized exchange RetoSwap has experienced a significant security breach resulting in the loss of approximately 7,000 XMR, valued at roughly $2.7 million. The incident, which occurred on May 20, 2026, was trigge…

Security monitoring firm PeckShield has reported a significant security breach resulting in the loss of approximately 1 million USD by a single cryptocurrency investor. The incident, which occurred on April 29, 2026, inv…

The NEAR ecosystem has experienced a significant security breach involving the DeFi protocol Rhea Finance. On April 16, 2026, blockchain security firm CertiK reported that the platform fell victim to a sophisticated atta…

A flaw in Symbiosis BridgeV2 let an attacker mint unbacked syBTC with a notional value of $46.1 billion, but the real cashout was only about $336,000 in WBTC.

The decentralized finance (DeFi) protocol Notional Finance has reportedly fallen victim to a security breach targeting its custody contract. According to data provided by blockchain security firm PeckShield on September …

Shibburn has issued a security warning to the Shiba Inu community, urging SHIB holders to carefully review all wallet permission requests before signing and never share seed phrases or private keys. Meanwhile, over 2.6 million SHIB tokens were burned in the past 24 hours.

The Drips Network, a decentralized protocol designed for recurring payments and subscriptions, has suffered a financial loss due to a technical flaw in its smart contract architecture. On July 15, 2026, security research…

The Edge of the Blockchain