BlockThreat - Week 40, 2026

Eight smart contract and bridge exploits this week. That's a welcome break from last week's combined $405M, but we're still a long way from any real peace on the frontier. On the bright side, we got a rare success story where the attacker behind the NEAR Intents HOT Bridge exploit was quickly identified as a likely security researcher familiar with bug bounty process:

Faced with a 48 hour ultimatum, the attacker responded within hours and returned the funds in full along with this on-chain apology:

We've returned all the funds, we were in the wrong. Thank you to the Near team for being respectful, constructive, and cordial during the return process. Remember to always use bug bounties!

What bothers me is that the attacker showed no sign of planning to return anything until they were caught red-handed and even tried Euler-style misdirection by sending funds to DPRK. NEAR runs a bug bounty program with rewards of up to $1M with the added benefit of not having to look over your shoulder. So why not take it? If this really was a security researcher, how far has their moral compass drifted and what bug bounty horror stories pushed it there? And what message does this send to researchers tempted to go rogue? At worst, you return the funds and apologize on-chain with no legal or financial consequences from the team. The rewards seem to far outweigh the risks untill the FBI takes an interest in your case.

This week's paid section covers fresh vulnerability research from Hexens and Core Lightning, new phishing and social engineering patterns to brief your team on, five new papers including an equivocation attack, and a full AI research stack: agentic zero-day infrastructure, evidence-first bounty prompts, Trail of Bits' bug-finding workflow, and an open-weights model built for security research. If you hunt, audit, or defend, this is the part you'll actually use.

Let’s dive into the news!