Tracking the latest NPM supply-chain attack (“Shai Hulud”): • Socket: socket.dev/blog/shai-hu... • Aikido: www.aikido.dev/blog/shai-hu...

Quarkslab engineers Robin David, Mihail Kirov and Kaname just completed the first public security audit of Bitcoin Core, led by @ostifofficial.bsky.social and funded by Brink.dev Details on the blog post: blog.quarkslab.com/bitcoin-core... Congrats to developers for such software masterpiece !

Great YouTube playlist to learn more about Hash-Based quantum-safe signature schemes (LMS, XMSS and SPHINCS+). www.youtube.com/watch?v=pt5W... #cryptography

Coinbase Security series: what is MPC and how to use it for Key Management: youtu.be/qdhM3syDkxM #cryptography

Breaking server SGX via DRAM bus: wiretap.fail

See also www.aikido.dev/blog/npm-deb... and www.securityalliance.org/news/2025-09...

"The malware did more than just steal SSH keys, npm tokens, and .gitconfig files - it weaponized AI CLI tools (including Claude, Gemini) to aid in reconnaissance and data" www.stepsecurity.io/blog/supply-...

Algebraic intermediate Representation (AIR) for Blake Hash youtu.be/INtBA-9vJpU?... hackmd.io/@starkware-h...

Coinbase MPC wallet library presentation at EthCC m.youtube.com/live/ppeyz_J...

My last article about ERC-20 ConditionalTransfer is available on Taurus blog: www.taurushq.com/blog/tokeniz... Based on CMTAT, an open-source project: github.com/CMTA/CMTAT #solidity

Coinbase has fixed a confusing bug in its account activity logs that caused users to think their credentials were compromised.

MITRE Vice President Yosry Barsoum has warned that U.S. government funding for the Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) programs expires today, which could lead to widespread disruption across the global cybersecurity industry.

NFTs are used to represent unique items on the blockchain. As you may know, the most known standard on Ethereum is ERC-721. Since its creation, several other standards (ERC-1155, ERC-2981, ERC-4907,...) have emerged to meet various use cases. More details here: rya-sge.github.io/access-denie...

Ledger's article on the security and integrity of the Trezor Safe 3 crypto wallet firmware is a great read to better understand how the new Trezor models (Safe Family) work (Secure Element, firmware integrity, chips used) www.ledger.com/why-secure-e... blog.trezor.io/trezors-mult...

How to tokenize on Ethereum and EVM based blockchain? My last article on Taurus blog is a deep dive into ERC-1400, one of the oldest tokenization standards (2018). www.taurushq.com/blog/erc-140...

A cascading supply chain attack that began with the compromise of the "reviewdog/action-setup@v1" GitHub Action is believed to have led to the recent breach of "tj-actions/changed-files" that leaked CI/CD secrets.

A couple weeks ago we published our monthly release of ZK Mesh: the February 2025 Recap. Wondering which articles/threads are the most popular amongst our #ZKMesh readers so far? ZK Mesh Feb 2025 Top 5, here we go 🧵 👇 open.substack.com/pub/zkmesh/p...

damn this halo2 book is soooo goooood halo2.zksecurity.xyz/intro/

A large-scale Coinbase phishing attack poses as a mandatory wallet migration, tricking recipients into setting up a new wallet with a pre-generated recovery phrase controlled by attackers.

Sepolia Pectra fork incident recap: "we quickly realized that, because the deposit contract is token gated, an ERC-20 transfer event was emitted whenever a deposit was processed. mariusvanderwijden.github.io/blog/2025/03...

Bybit hack deep dive by ncc group www.nccgroup.com/us/research-...