cryptosecurity

2026年、暗号資産分野が思いがけない記録を更新：これまでで最も多くのハックが発生しているのに、総損失は減少しています。これは本当のところ、あなたにとって何を意味するのでしょう。
📊 S1 2026 の主要数字
第1学期に記録された207件のインシデント。2025年同時期の83件から→+150%
~972百万ドル（M$）が盗まれ、前年は23億ドル（Md$） → -60%
盗まれた資金の66%は、北朝鮮に関連するグループに結び付けられている
2026年4月に被害の大半が集中。Drift ProtocolとKelpDAOへの攻撃（単独で約600M$）がその中心です

Over 90% of enterprise crypto hacks do not happen because of blockchain vulnerabilities, but because of poorly integrated wallet infrastructure.
It is painful watching funds spend millions on security audits only to lose user assets because they chose the wrong custody setup. One bad API integration or misconfigured key management system can wipe out a treasury overnight.
Before committing capital to $BTC or $ETH wallet infrastructure, boards often get blinded by slick sales pitches and ignore the disaster recovery protocols. The real danger lies in key management. If you are using multi-party computation, you need to know exactly who holds the key shares and what happens if your provider goes bankrupt. A lot of teams assume their tech partner is fully compliant, but when regulatory crackdowns hit, they find their access frozen.
Another massive risk is transaction fee scaling. During periods of extreme network congestion, a poorly designed wallet system can lock you out of your own funds because it cannot handle dynamic gas fees. This means you cannot exit positions or rescue capital when the market starts crashing.
Have you ever had funds stuck due to a wallet provider outage?
#CryptoSecurity #Custody #BlockchainInfrastructure

ホワイトハットハッカーが“700億ドル”級の欠陥を3,000ドルのサーバーで発見 — 暗号資産の2026年最接近の危機の全貌
たった3,000ドルのサーバー。成功率90％以上の模擬攻撃。そして、デジタル資産700億ドルが危険にさらされ得た脆弱性——それらを見つけたのは、攻撃者ではなく善意の人たちでした。
完全に検証された内訳はこちらです：
◆ セキュリティ研究者が、Aptosブロックチェーンのスマートコントラクト実行環境における重大な欠陥を発見しました。その内容は「stale-cache bug」として説明されており、型の取り違え（タイプ・コンフュージョン）の脆弱性につながるものです

暗号資産で最も痛手となる損失は、高レバレッジの清算画面で起きるのではなく、見かけ上はうまくいったピアツーピア取引の後に、あなた自身の地元の銀行口座で発生します。
購入者に説得されて、相手のいとこの口座からの送金を受け入れてしまったせいで、目が覚めたら銀行口座が完全に凍結されていた——そんな耐えがたい感覚を想像してみてください。あなたは$USDTを売りましたが、現実の資金は法的な宙ぶらりんの状態に閉じ込められてしまいました。
OTC取引の初期のころ、身を守るために唯一重要なのは本人確認（アイデンティティの照合）だと、痛い目で学びました。購入者が家族の名義で支払うよう求めてくる場合、たいていは典型的なトライアンギュレーション詐欺（いわゆる三角詐欺）です。送金してくる相手は、暗号資産を買っていること自体を理解しておらず、市場の取引商品を支払っているつもり、あるいは友人を助けているつもりです。そして詐欺に遭ったと気づいた時点で、警察に被害届を出します。

A $3,000 Server Nearly Exposed $70 Billion in Crypto — Here's How It Was Stopped
A team of ethical hackers spent a few thousand dollars on server hardware and found a flaw that could have put tens of billions of dollars in digital assets at systemic risk — before anyone with bad intentions found it first.
Security firm Hexens discovered a vulnerability in a major layer-1 blockchain that, if exploited, could have exposed up to $70 billion in digital assets across stablecoins, cross-chain bridges, and DeFi protocols. Researchers simulated the attack with a success rate above 90% under real network conditions, using infrastructure that cost roughly $3,000 to build. The flaw was reported through emergency channels and patched within days — before any funds were lost.
◆ The proof-of-concept required no insider access or special permissions, only a well-provisioned server simulating about a third of the validator network
◆ An independent reviewer, the CTO of a major layer-2 network, confirmed the exploit logic held up under scrutiny
◆ A separate verification firm calculated that roughly $250 million in native total value locked was directly at risk, apart from broader cross-chain exposure
◆ Direct protocol exposure was assessed in the low single-digit billions, though the theoretical worst case involved minting a very large amount of a major stablecoin and moving it across chains
◆ This discovery lands in a year that has already seen over $840 million drained from DeFi protocols across 50-plus separate incidents — a 70% increase year-over-year
◆ Blockchain analytics firm Chainalysis attributes approximately 76% of global crypto hack losses in 2026 to a single state-linked hacking group, whose cumulative crypto theft now exceeds $6 billion since 2017
◆ Just days after this disclosure, a separate live exploit hit a DeFi yield platform, draining roughly $6 million through a flash loan attack that manipulated vault asset accounting
What makes 2026 different from earlier hack cycles isn't just the dollar figures — it's where the attacks are increasingly coming from. Security researchers note that several of this year's largest incidents didn't involve broken code at all; smart contracts executed exactly as programmed, following instructions from attackers who had obtained access they shouldn't have had. Code audits and bug bounty programs address vulnerabilities in logic, but they don't fully address compromised credentials, social engineering, or infrastructure-level manipulation.
The $70 billion near-miss is being treated as a best-case outcome: a vulnerability found by researchers who reported it responsibly, rather than by someone who exploited it. Not every story this year has ended that way.
Does this kind of responsible disclosure change how much trust you place in blockchain infrastructure, or does it reveal how fragile the entire system still is?
#CryptoSecurity #blockchain #defi #CyberSecurity #CryptoNews

Por años ha existido el mito de que los usuarios de macOS están a salvo de los hackeos, pero las últimas investigaciones de firmas como Microsoft y Malwarebytes acaban de revelar una dura realidad. Oleadas de malware avanzado (como PamStealer, MacSync o clones falsos de monederos populares) están logrando saltarse las barreras de Apple para vaciar por completo las wallets de los usuarios despistados.
Moonlock
Los atacantes ya no rompen el sistema operativo; usan ingeniería social de alta precisión para que seas tú mismo quien les dé las llaves de tu capital.
Malwarebytes
🛑 ¿Cómo operan estos nuevos ataques en macOS?
Falsas páginas oficiales (Typosquatting): Crean portales web idénticos a los de wallets legítimas (como campañas recientes imitando a BlueWallet o Ledger). Si descargas la app desde ahí, te guían de forma muy convincente para ejecutar comandos o "scripts" manuales que saltan los filtros de verificación de Apple.
Moonlock
La trampa de la "Actualización de Seguridad": El malware actúa de manera silenciosa en segundo plano bajo nombres falsos como System Settings o GoogleUpdate. Una vez instalado, solicita tus credenciales del sistema, lee tu portapapeles y rastrea tus carpetas en busca de extensiones como .wallet, .txt, o .seed.
Moonlock
Reemplazo de aplicaciones reales: Lo más peligroso detectado este año es que variantes del software malicioso buscan si tienes instaladas las versiones oficiales de Ledger Live, Trezor Suiteo Exodus, las eliminan y las sustituyen por versiones troyanizadas. Cuando abres tu app de siempre, esta simula un error de conexión y te pide "restaurar" introduciendo tus 24 palabras. Si lo haces, tus fondos desaparecen al instante.
Kaspersky
🛡️ Escudo de Defensa: ¿Cómo proteger tus activos si usas Mac?
1️⃣ Semilla Intocable: Jamás, bajo ninguna circunstancia, escribas tus 12 o 24 palabras de recuperación en el teclado de tu computadora. Si usas una wallet fría (hardware wallet), la frase de respaldo solo se introduce físicamente en los botones del dispositivo físico, nunca en una app o sitio web.
2️⃣ Cuidado con la Terminal: Una táctica muy común conocida como ClickFix te pide copiar y pegar códigos extraños en la Terminal de tu Mac para "solucionar un error". Ejecutar un comando curl desconocido abre las puertas traseras para que descarguen el virus en segundos.
3️⃣ Verificación estricta de fuentes: Descarga software únicamente desde los enlaces directos de las páginas oficiales o de la Mac App Store, validando siempre el desarrollador, las reseñas y los counters de descarga (incluso en tiendas oficiales se han llegado a colar clones maliciosos por breves periodos).
Kaspersky+ 1
Perspectiva de Mercado: La seguridad en la Web3 no depende del dispositivo que uses, depende de tu disciplina operativa. En este ciclo de mercado, tus datos locales son el objetivo principal de los ciberdelincuentes. Mantener tus copias de seguridad en papel o placas de metal fuera de la red y desconfiar de cualquier error inusual en tus interfaces habituales es la única forma de blindar tu patrimonio.
¿Suelen almacenar contraseñas o archivos con frases semilla dentro de su computadora, o aplican una autocustodia 100% analógica? 👇 ¡Los leo en los comentarios!
#CryptoSecurity #MacOS #Malware #phishing #Ledger

A $3,000 Server Exposed a Flaw That Could Have Risked $70 Billion in Crypto
Ethical hackers spent $3,000 on a server. What they found could have put $70 billion in digital assets at systemic risk.
Security researchers at Hexens discovered a critical flaw in a major blockchain network's virtual machine — and it's just one data point in a year defined by a strange split: fewer catastrophic losses, but more attacks than ever before.
◆ Security firm Hexens simulated an attack with over 90% success under real network conditions, using hardware costing just $3,000 to model roughly one-third of the validator network
◆ The flaw was patched within days of being reported through emergency channels — no funds were ultimately lost
◆ TRM Labs recorded 207 separate crypto hacks in the first half of 2026, the highest count the firm has ever tracked in a six-month period
◆ Despite the record incident count, total losses fell to $972 million — less than half of the $2.3 billion stolen in the same period a year earlier
◆ The median hack size was about $219,000, while the mean was $4.7 million, showing how a handful of large incidents dominate total losses
◆ Smart-contract exploits accounted for 125 of the 207 incidents, but the largest dollar losses increasingly came from compromised keys, custody systems, and approval infrastructure — not the code itself
The pattern researchers are flagging matters for anyone holding digital assets: the attack surface isn't shrinking, it's shifting. Smart contract audits remain essential, but the systems that decide who can move funds and how signatures get approved are now where the biggest damage happens.
This is educational security information, not financial advice.
Where do you think the industry needs to invest more — smart contract audits, or operational security around keys and custody?
#CryptoSecurity #Web3Safety #BlockchainNews #DigitalAssets #CyberSecurity