BlockThreat - Week 33, 2026

Harmony suffered another major hack this week after an attacker minted roughly 4B ONE tokens by exploiting a broken quorum check in the chain's consensus. Instead of validating how many validators signed a transaction, Harmony just counted public keys listed in the signature mask, so even forged all-zero signature would pass the check. By the time the mint was public most of the stolen tokens had reached exchange deposit wallets or been sold. As a reminder, the Harmony Horizon bridge was hacked by DPRK-linked actors for about $100M in 2022.

Speaking of chain consensus failures, the mass hunt for bitcoin bugs has spilled out to other forked assets like Ravencoin which suffered an extremely rare consensus failure where miners accepted blocks without ANY ProgPow mining work behind them. The damage appears to be mostly in relative minor coinbase theft; however, the chain is now planning to roll back 4 days worth of blocks.

A more concerning trend was a rapid increase in PII leaks due to 3rd party provider dependencies. Just as Coldcard victims fled to other hardware wallets, Trezor and SafePal both announced large data leaks for recent customers. Kraken and Privy were also exposed to the leak involving Metabase, a support and analytics platform. Things are not helpful after French Tax authority also announced data breach where once again identities of crypto investors will make it into the hands of the criminals.

The more concerning trend this week was a cluster of PII leaks hitting crypto users from three directions at once. Just as Coldcard holders were moving funds to another hardware wallet, Trezor disclosed that a breach at its fulfillment provider ShipMonk exposed order data for about 14K customers including PII such as name, email, phone number, shipping address. SafePal followed days later with another leak exposing roughly 40K customers. If that wasn't enough, France's tax authority confirmed an intrusion affecting 678K individuals and businesses, including reference tax income and withholding rates.

In other news: a Zoom vulnerability with a zero-click RCE on every other participant. A White House policy unleashing the security industry to go on offense. Lazarus IT workers exposed in a fake DeFi startup operation. Plus 19 frontier models benchmarked across 19 cyber evals, a dataset of 135 DeFi incidents, and a large collection of new research, whitepapers, and tooling for auditors and defenders.

40+ items carefully curated so you don't spend 30+ hours a week filtering the noise yourself. Funded by subscribers such as yourself.

Let’s dive into the news!