BlockThreat - Week 3, 2026
France | FTC | Telegram Scams | DeadLock
Greetings!
The first week in awhile with no major incidents (that we know of) this week. This will be a great time to catch up on all of the great research, sharpen the saw, before we are once again thrown into battle. Be careful out there!
Let’s dive into the news!
News
- Vitalik Buterin condemns criminalization of code in appeal for Tornado Cash developer.
- Mempool bots battle over compromised BTC.
- 2026 Crypto Crime Report Key Insights: TRM Identifies Record USD 158 Billion in Illicit Crypto Flows in 2025, Reversing a Multi-year Decline.
- Crypto crime topped $150 billion in 2025 as state-backed actors scaled onchain.
Crime
- Another Day, Another Crypto Wrench Attack in France.
- No release for French tax agent who gave crypto investor details to gangs.
- US lawmakers press SEC over paused Justin Sun enforcement case.
Policy
- The FTC announced in December it intends to sue @nomadxyz_ for the 2022 hack of their bridge.
- Zcash Foundation Says SEC Ends Investigation With No Enforcement Action.
- Manhattan DA Pushes Criminal Penalties for Unlicensed Crypto Operators.
Phishing
- Common Telegram Scams in Crypto and How to Stay Safe: A Founder’s Guide by Preetam (QuillAudits).
Malware
- Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages.
- ‘Imagination the limit’: DeadLock ransomware gang using smart contracts to hide their work.
Research
- A Web2.5 Vulnerability Story: Between Backend and Onchain by Bogdan Kondratev (Decurity).
- CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild by Yuval Avrahami, Nir Ohfeld (Wiz).
- Lack of isolation in agentic browsers resurfaces old vulnerabilities by Lucas Bourtoule (Trail of Bits).
- Proving an Aptos Vault Correct with the Move Prover by Ahmad Khan(Nirlin) (Adevar Labs).
- Wake Debugging Guide by Naoki Yoshida (Ackee).
Tools
- Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows.
Hacks
Yo Yield Compromise
Date: January 12, 2026
Attack Vector: Misconfiguration
Impact: $3,730,000
Chain: Ethereum
References:
- https://x.com/PeckShieldAlert/status/2011069662377980147
- https://x.com/quillaudits_ai/status/2011034696168460782
- https://x.com/Phalcon_xyz/status/2011079910186783040
- https://www.yo.xyz/blog/post/youusd-incident-postmortem-automated-harvest-swap-jan-12-2026
- https://rekt.news/yo-protocols-slippage-bomb
Exploit: