⬢ GM Security — 2026-06-26: $50.0M across 30 incidents

📊 Trend tracker

• 18 new today · 12 developing

• 7-day: 127 incidents, $880.8M stolen (+377% vs prior week)

• 30-day: 208 incidents, $1.07B stolen

• 7-day vectors: smart-contract bug (21), social engineering (15), supply-chain attack (6)

• Repeat targets (30d): certik (6), bitcoin (6), tornadocash (5), thetanuts (5), coinbase (4)

Last 24 hours

• [ADVISORY · NEW] South Korea revises debt relief rules to include crypto assets (crypto.news)

• [ADVISORY · NEW] @GoPlusSecurity: 🧵1/3 (@GoPlusSecurity)

• [OTHER · NEW] Ark Invest buys Coinbase, Robinhood, Circle and Bullish on market dip (crypto.news)

• [EXPLOIT · NEW] @GoPlusSecurity: 🚨GoPlus Security Alert: — ~$3.0M (@GoPlusSecurity)
  also: @GoPlusSecurity · @PeckShieldAlert

• [EXPLOIT · NEW] Coinbase-backed Base returns after 2-hour consensus halt (crypto.news)
  also: CoinDesk

• [ADVISORY · DEVELOPING · day 2] @SlowMist_Team: 🚨 SlowMist TI Alert 🚨 (@SlowMist_Team)
  also: @SlowMist_Team

• [OTHER · NEW] 21Shares slashes crypto forecasts despite rising institutional demand (crypto.news)

• [OTHER · DEVELOPING · day 3] Michael Saylor built a flywheel for a bull market. It is now spinning in reverse (crypto.news)

• [EXPLOIT · NEW] Polymarket to Refund Users After Scammers Swipe Millions in Website Exploit (Decrypt)

• [ADVISORY · NEW] @HalbornSecurity: AI agents move funds on-chain at machine speed. One compromised compliance oracle can push them into a sanctions violat… (@HalbornSecurity)

• [ENFORCEMENT · DEVELOPING · day 2] CoinEx Denies ‘Knowledge’ of Aiding Sanctioned Iran Crypto Market in $3.8 Billion Disconnect (Decrypt)

• [EXPLOIT · NEW] @PeckShieldAlert: #PeckShieldAlert @apyx_fi’s $apxUSD has dropped below $0.8. https://t.co/YUYPIEuRDF (@PeckShieldAlert)

• [OTHER · NEW] Kraken in talks to buy 15% stake in DeFi lender Aave at $385 million valuation (CoinDesk)

• [OTHER · NEW] @spreekaway: the good news: this makes slightly more sense than SBF’s bet (@spreekaway)

• [OTHER · NEW] @spreekaway: Even the DAO extractoooors are capitulating https://t.co/vjTvQSRcjb (@spreekaway)

• [OTHER · NEW] @tayvano_: Genuinely what the fuck do you want the govt to do about this? (@tayvano_)

• [OTHER · NEW] @tayvano_: Completely insane to let the fucking government control your product, release processes, and, ultimately, your profits. (@tayvano_)

• [OTHER · NEW] @tayvano_: One of my 4am tweets mentions nonce reuse. I was speaking casually bc I was flabbergasted by just how fucking stupid th… (@tayvano_)

Earlier · 24–72h

• [SCAM · DEVELOPING · day 2] @PeckShieldAlert: #PeckShieldAlert Our community member has reported that @gnosis_ ‘s X account has been compromised. Do *Not* interact w… (@PeckShieldAlert)

• [ADVISORY · DEVELOPING · day 2] @tayvano_: To be clear: these guys rolled their own crypto so fucking hard that anyone could get your private key from public info… (@tayvano_)

• [ADVISORY · DEVELOPING · day 2] @CertiK: Most RWAs are Treasuries. @XDCNetwork is different. — ~$860.0M (CertiK)

• [ENFORCEMENT · DEVELOPING · day 2] $47M in Crypto Frozen in Global Infostealer Takedown: Europol — ~$47.0M (Decrypt)

• [EXPLOIT · NEW] OHIF Viewers DICOM (CISA Cybersecurity Advisories)

• [ADVISORY · DEVELOPING · day 7] @Phalcon_xyz: 🗓 Weekly Web3 Security Roundup | Jun 15 - Jun 21 — ~$18.3M (@Phalcon_xyz)

• [EXPLOIT · DEVELOPING · day 2] @CertiKAlert: #CertiKInsight 🚨 — ~$47.0M (@CertiKAlert)
  also: @CertiKAlert · @CertiKAlert

• [EXPLOIT · DEVELOPING · day 2] @pcaversaccio: the latest tornado cash proposal 67 is _malicious_: https://bafybeie5hxovqc4ifcnrnhvmjbefxgeix6oqvzaspyytdxiyscji22v5pu… (pcaversaccio)
  also: pcaversaccio · Protos

• [OTHER · DEVELOPING · day 2] @tayvano_: They did it. They actually did it. (@tayvano_)

• [OTHER · DEVELOPING · day 2] @PeckShieldAlert: #PeckShieldAlert $MIM has dropped -36% to 0.5 (@PeckShieldAlert)

🧠 Deep reads

• Wallet Screening Best Practices for Compliance Teams | TRM Labs (TRM Labs)

• a16z-backed crypto firm rebrands, shifts focus to solving AI’s global copyright headache (CoinDesk)

💡 Security thought-spark

Regulatory changes like South Korea’s crypto asset inclusion in debt relief could drive complex liquidation cascades; review your protocol’s oracle and debt position handling for non-standard collateral types.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? hello@gmsecurity.net. George Donnelly offers Web3 development & security consulting.