Web3 security

Gate

2026-10-12 09:59:01

Gate and GoPlus say AI is reshaping crypto security, and one-off audits are no longer enough

Gate and GoPlus Security used the third installment of Gate’s “Security Class” series to make a blunt case: in crypto, an audit is a starting point, not a lasting guarantee. The discussion focused on why audited projects still get hacked, how AI is changing the balance between attackers and defenders, what a useful audit report should actually contain, and how ordinary users can reduce risk before signing a transaction. GoPlus partner Adam argued that traditional contract audits fail in four structural ways. They are point-in-time checks, they cannot anticipate future exploit patterns, they do not fully cover changing external dependencies such as oracles and cross-chain bridges, and they leave old “audited” contracts exposed to fresh AI-driven review. Gate’s security team added that audits can show what code is allowed to do, but not what a project team may choose to do with legitimate owner powers such as blacklisting, minting, or changing trading rules. Both sides said AI has widened the speed gap in security work, but they also argued that the same tools can help defenders catch up if they are used continuously. The article outlines a shift from one-time reviews to full lifecycle security, including pre-launch checks, AI-assisted contract audits, post-launch monitoring, and recurring scans. It also details user-facing tools from Gate, including AI contract analysis, anti-phishing checks, account hardening features, and products designed to reduce signing and wallet-connection risk.

670

CertiK

2026-10-07 13:54:00

CertiK unveils rebrand at TOKEN2049, sets sights on becoming the trust layer for digital value

CertiK said on Oct. 7 at TOKEN2049 in Singapore that it is rolling out a brand upgrade centered on a new positioning: “The Trust Layer for Digital Value.” The company said the move reflects its mission to build trust infrastructure for the digital economy and marks a broader push beyond its early focus on smart contract audits. According to CertiK, its product lineup now spans Skynet for continuous monitoring, CertiK Compliance for compliance management, CertiK Supervision for regulatory tools, and CertiK AI Auditor for AI-assisted review. Its service portfolio includes smart contract audits, expert-led formal verification, penetration testing, proof of reserves, and node validation. The company also said it has supported digital asset policy development in the United States, Hong Kong, Singapore, and the United Arab Emirates by combining technical security assessments with the needs of regulated digital asset markets. Founded in 2017 by professors from Yale University and Columbia University, CertiK said it has served more than 5,500 clients across over 150 countries and regions, identified more than 119,000 vulnerabilities, and helped protect over $600 billion in digital assets.

300

CertiK

2026-10-07 13:57:09

CertiK unveils rebrand at TOKEN2049, sets sights on becoming the trust layer for digital value

CertiK announced a brand refresh at TOKEN2049 in Singapore on Oct. 7, saying it will enter its next phase under the positioning "The Trust Layer for Digital Value." The company said the move reflects its mission to build trust infrastructure for the digital economy and follows its expansion from smart contract auditing into a broader Web3 security business. Chief Business Officer Jason Jiang said institutions offering digital asset services and regulators overseeing the sector need security and compliance management to work together, with a clear view of risk exposure. CertiK said its current product lineup includes Skynet, CertiK Compliance, CertiK Supervision and CertiK AI Auditor, covering continuous security monitoring, compliance risk management, digital asset supervision and AI-assisted code review. On the services side, the company listed smart contract audits, expert-led formal verification, penetration testing, proof of reserves and node validation. CertiK also said it has provided technical support for digital asset policymaking in the United States, Hong Kong, Singapore and the United Arab Emirates. Founded in 2017 by professors from Yale University and Columbia University, the company said it has served more than 5,500 clients across over 150 countries and regions, identified more than 119,000 code vulnerabilities and helped protect over $600 billion in digital assets.

280

CertiK

2026-10-07 13:55:53

CertiK unveils rebrand at TOKEN2049, sets sights on becoming the trust layer for digital value

CertiK announced a brand refresh at TOKEN2049 in Singapore on Oct. 7, saying it will move forward under the positioning of “The Trust Layer for Digital Value.” The company said the new identity reflects its broader mission of building trust infrastructure for the digital economy, extending beyond its original focus on smart contract audits. Chief Business Officer Jason Jiang said digital assets are changing how value moves, and that institutions offering digital asset services, along with regulators overseeing them, need a combination of security, compliance management, and clear risk visibility. He said the rebrand reflects CertiK’s own evolution in addressing those needs and its longer-term vision for the sector. CertiK said its product lineup now includes Skynet, CertiK Compliance, CertiK Supervision, and CertiK AI Auditor, covering continuous security monitoring, compliance risk management, digital asset supervision, and AI-assisted code review. On the services side, it offers smart contract audits, expert-led formal verification, penetration testing, proof of reserves, and node validation. The company also said it provides technical support for digital asset policymaking in the United States, Hong Kong, Singapore, and the UAE. Founded in 2017 by professors from Yale University and Columbia University, CertiK said it has served more than 5,500 clients across over 150 countries and regions, identified more than 119,000 code vulnerabilities, and helped protect more than $600 billion in digital assets.

280

CertiK

2026-10-01 02:55:23

CertiK says crypto security losses hit about $766.4 million in September

CertiK said confirmed exploit and phishing incidents across the Web3 sector caused about $766.4 million in losses in September 2026, making it the costliest month of the year so far. The month also recorded the highest number of incidents seen in 2026, according to the security firm’s data. Among the largest individual cases, Bitget accounted for $387.5 million in losses, while Liquid Network saw about $318.6 million, ranking first and second for the month. By category, centralized exchanges, or CEXs, posted the largest losses, followed by mainnet-related incidents. CertiK also said about $270.6 million in funds had been recovered or frozen. The figures were published by CertiK and cited by Foresight.

570

Sui

2026-09-30 17:16:55

Sui and ChainPatrol remove 3,023 impersonation and phishing threats

Sui has partnered with security platform ChainPatrol to remove 3,023 impersonation and phishing threats, according to Techub News, citing Crypto Briefing. The move was described as part of a broader effort between the two sides to clean up the online environment around the Sui ecosystem. ChainPatrol focuses on risk intelligence tied to Web3 domains and identity security. In the report, the cleanup effort was framed as a way to improve user trust and adoption, while also supporting ecosystem growth. No additional operational details were disclosed in the source summary, but the reported figure highlights the scale of the takedown tied to the partnership.

520

Web3 Security

2026-09-30 00:49:03

Web3 security is shifting from code exploits to trust and permission failures, Foresight says

A long-form analysis published by Foresight argues that the center of gravity in Web3 security has moved away from smart contract bugs and toward permissions, signing flows, RPC dependencies, supply chains, and operational trust. The piece points to four major incidents — Bybit, KelpDAO, Drift, and Bitget — to show that some of the largest recent losses did not come from undiscovered contract 0days. Instead, attackers targeted the systems and people around the code: compromised signing interfaces, poisoned backend approval flows, manipulated RPC responses, and social engineering aimed at privileged operators. The article says the pattern has become clearer over the past three years. In 2024, phishing overtook private key leaks as the biggest threat. In 2025, the Bybit theft pushed front-end supply chain risk and signing interfaces into focus. In 2026, the KelpDAO, Drift, and Bitget cases turned RPC trust, multisig design, and permission configuration into the main battleground. It also argues that AI is changing the economics of attacks by making phishing, fake identities, malware delivery, and old-contract scanning cheaper to run at scale, while forcing defenders to secure every entry point. Foresight’s conclusion is blunt: Web3 has not become safe or unsafe in a simple sense. The most valuable attack surface has moved outside the contract itself and into the broader trust chain that surrounds it.

480

BlockSec

2026-09-22 03:02:12

BlockSec hosts Hong Kong closed-door forum on security and compliance in crypto institutionalization

BlockSec held its Harbouring Trust closed-door seminar in Hong Kong on Sept. 16, with support from East Asia, Jumio and TiDB, bringing together about 50 decision-makers and business leads from exchanges, wallets, payment and stablecoin firms, licensed traditional financial institutions, public blockchain teams and professional service providers. The event focused on how security frameworks, compliance boundaries and business execution are changing as crypto becomes more institutionalized. Opening remarks from Michele Fung, a board member of the Fintech Association of Hong Kong and APAC lead at Unlimit, framed security and compliance as an ongoing system spanning law, technology and accountability rather than a static checklist. In the keynote, BlockSec co-founder and Chinese University of Hong Kong associate professor Zhou Yajin said institutionalization is reshaping market structure and changing the nature of risk, with AI improving attack efficiency and multi-hop transfers making traditional one-hop AML screening easier to evade. The program also included survey findings from 41 pre-event questionnaires and two panel discussions covering compliance decision-making, talent shortages, supply-chain risk, multisig signing visibility, AI-assisted red teaming, wallet payment controls, RWA product expansion and how traditional financial institutions can enter the sector through third-party service providers.

550