BlockThreat - Week 26, 2026

Another brutal week, with no sign of the hacks slowing down. If we are ever going to turn the tide and bring these numbers down, we have to step back from individual incidents and look at where the industry keeps making the same mistakes.

Next week, I will publish a detailed monthly update on the Top 10 DeFi Attack Vectors. That said, there is one trend that is already too significant to ignore and deserves immediate attention from both defenders and auditors: signature verification failures.

In 2026 alone signature verification bugs have contributed to 19 hacks and more than $45 million in losses. This attack class was not even among the Top 10 DeFi attack vectors over the past five years. It is now the fastest-growing category I track.

Auditors should make signature validation, signer authorization, replay protection, domain separation, nonce handling, and cross-chain message verification a much more prominent part of their review process. Defenders should revisit existing contracts and infrastructure rather than assume that previously audited signing logic is safe. Do not wait for the next big hack to make this the latest “hot” vulnerability to add to your repertoire.

In this week’s edition, we cover an attempted governance attack targeting Tornado Cash, yet another LastPass data breach, a serious wallet RNG vulnerability, and a large collection of practical tools for contract comparison, transaction decoding, monitoring, security analysis, etc. There are also several excellent pieces on AI security agents, where they continue to fail, and how researchers are building better harnesses to uncover vulnerabilities across thousands of codebases.

Let’s dive into the news!