A company that specializes in on-chain forensics for exchanges and law enforcement got hacked itself. At first, it said the data involved was “non-sensitive customer data”; only later did it admit that password hashes and live tokens had also leaked. Chainalysis changed its story faster than it can analyze a suspicious transaction.

I’m following this story not because I’m gloating, but because it turns the industry’s trust structure upside down: you pay someone to audit others, then the auditor’s own tokens end up out in the open. So how can we trust this whole list of “who’s clean and who isn’t”? On the same day, Binance and Deribit revoked SignalPlus’s API key after a fake Teams invite, resulting in losses of less than $82,000; SignalPlus promised full reimbursement. Coinbase says more than 99% of customer assets are held offline, and Gate reports 88.26% in cold storage. Those numbers look pretty good, but none of them can answer this: who audits the person auditing the auditors? $BTC

I guess I’ll have to take “forensics firms” and “security firms” off my trust whitelist. These days, everyone says they’re clean; it’s only after something goes wrong that they add, “Oh, and live tokens.”