BlockThreat - Week 32, 2026
$15M stolen across 14 incidents. Bitcoin under attack. Who is winning the AI race?
Three Bitcoin infrastructure incidents in five days:
2026-08-03 - Boltz exploited with an undisclosed vector. Swap services suspended indefinitely. No user funds at risk; losses were Boltz's own.
2026-08-05 - Zeus Wallet exploited with an undisclosed vector. Infrastructure taken offline; contained within hours, no customer funds lost.
2026-08-07 - BTCPay Server hacked with unauthenticated LND credential disclosure. Multiple Lightning nodes drained.
The newly founded Bitcoin Red Team has been hunting with multiple frontier models (Kimi K3, GPT Sol, Fable, Opus, GLM5.2) at Bitcoin codebases and has filed 4,962 findings across 390 repos, 85 rated critical and 635 high. However, it's not clear how many of those are real bugs.
There is now a race between defenders hunting for flaws and attackers exploiting them. Boltz withdrew from it voluntarily, unable to deploy fixes faster than what it called "multiple resourceful groups" could iterate. As I noted in last week's monthly report, the Bitcoin ecosystem is not the only one being targeted.
Most of the protocols hacked this week fell to familiar attack vectors like a missing return statement here, an unmonitored governance module there, and a bond nobody bothered to challenge. The most damaging incidents, including Panther ($5.12M) and Coinsbuy ($8M), came from configuration and key-management failures rather than smart contract bugs.
This week features full write-ups and attack vectors on all 14 incidents (Coinsbuy, Panther, USM, RISEx, Strong Block, Atomic, NEX, Nereus, and others), critical vulnerability disclosures from TrustSec, 0xSimao, SecLat_Security, and Coinspect, bug-hunting methodology from @dimulskiatanas and @mnedelchev_, latest DPRK tactics, supply chain attacks to watch, and more plus fresh tracing and offensive tooling.
In total, 40+ manually curated news items, research articles, disclosures, and tools that matter, so you don’t have to spend 30+ hours a week digging through the noise yourself. Seven years, every week, with no sponsor or vendor deciding which incident or finding is critical or not. That independence is funded by subscribers like you. Don't let attackers be the only ones with sustainable funding.
Let’s dive into the news!