BlockThreat - Week 41, 2026

This week brought another round of AI FUD after Justin Drake’s call to prepare for "bunker mode", warning that AI could break ECC in the coming months. All of this came after OpenAI published a batch of impressive math papers which made no new breakthroughs in cryptography. Naturally, the internet lost its mind with everyone sharing their takes on how many days we have left and tips on the most reckless way to lose all money in your wallet.

BlockThreat has been sharing what actually keeps breaking this year after AI became an integral part of bug hunting:

• Wallets generating predictable keys (e.g. Coldcard, XRPH, DCENT, SecondFi, Zilliqa, and others).
• Endless signature verification hacks in bridges and blockchains who just don't know how to apply cryptography properly.
• Other broken cryptography implementations like THORChain's TSS which leaked private keys.

No hardness assumptions broken, no new algorithm for breaking ECC or any other cipher. Just good ole' code failing.

The biggest irony is that while everyone was stuck in the latest AI induced hysteria, Ledger was trying to figure out why a bunch of its users in Asia are losing funds. It later confirmed an unauthorized hardware implant was embedded in devices purchased from on authorized reseller. Backdoored Ledgers included extra hardware that read recovery words from the display connection and sent them out over a cellular network. Once again the secure chip was intact, cryptography wasn't broken, just someone running a highly sophisticated supply chain attack by subverting a trusted authorized reseller.

While you are busy cracking open your Ledger to look for aftermarket accessories, just remember to only purchase hardware wallets, security tokens, and other secure devices directly from manufacturers. Fewer hands in the supply chain means fewer opportunities for unwanted surprises.

Speaking of ledgers and panic, this week’s disclosures suggest we narrowly dodged a chain-killer event on Ripple. A decade-old integer overflow allowed attackers to mint unlimited XRP. The bug was found using …drum roll… AI agent and responsibly disclosed with an emergency fix already shipped in September. No evidence of exploitation was found.

The reward for responsibly reporting this money printer? $250K! A nice payday for a whitehat researcher (and a free advertisement for the company) and a remarkably small incentive for someone in the grey area. Aren’t you glad the good guys found this one first? If only we made it easier for them to do that work instead of giving them increasingly restrictive guardrails and charging bounty submission fees.

Enjoyed the XRP bug breakdown above? Each week, I manually curate vulnerability writeups, practical bug hunting tips, defender tools, and coverage of every publicly reported hack. You can spend 30+ hours weekly digging through X posts, repos, and incident reports to figure out what matters or just read BlockThreat. Subscribe to unlock the rest of this issue and get the full selection every week.

Let’s dive into the news!