key management

Bitcoin

2026-10-03 14:25:37

EntropyLab releases candidate build of offline Bitcoin key and wallet calculator

EntropyLab has released v1.0.0rc1, the first candidate version of its self-contained Bitcoin key and wallet calculator, according to a post by Bitcoin News on X. The tool runs as a single HTML file, does not require an internet connection, and does not generate entropy on its own. Instead, users can supply their own entropy and calculate keys and wallets in a fully offline environment. The application supports multisig, PSBT, BIP-85, Silent Payments, vanity addresses, watch-only wallet export, and randomness analysis. The release is reproducible and can be verified through signatures from four independent signers. The team said users should download and verify the file before moving it to an air-gapped computer. A full v1.0.0 release will come after testing of the candidate version is completed.

40

CoinDesk

2026-07-29 15:13:07

Immunefi’s Mitchell Amador says 2026 crypto thefts point beyond smart contract bugs

CoinDesk’s Crypto Long & Short this week features a piece by Immunefi’s Mitchell Amador arguing that the biggest lesson from 2026’s $972 million in crypto hacks is not simply about flawed code. According to the article, most of the stolen funds this year have left projects through compromised keys, signers, and governance mechanisms rather than smart contract bugs alone. Amador’s core point is that security failures are showing up in operational control layers that audits do not fully cover. He also stresses that the phrase “we were audited” was never the same as saying “we are safe,” drawing a line between code review and actual end-to-end security. The article was published by CoinDesk on July 29, 2026, under the Crypto Long & Short column.

480

Web3 Security

2026-07-24 06:30:11

Web3 lost $1.32 billion in H1 2026 as attackers shifted from code to people and operations

Web3 security losses reached about $1.32 billion across 344 incidents in the first half of 2026, according to a Foresight News report citing CertiK, TRM Labs and SlowMist. The sharpest damage no longer came from smart contract bugs alone. Instead, major losses clustered around operational failures such as key management, credential compromise, social engineering and supply-chain attacks. CertiK said that, excluding Bybit’s $1.46 billion single incident from the prior year, H1 incidents still rose 28% year over year. SlowMist said operational failures accounted for 53 of 182 cases it tracked, or 29.1%, yet represented 76.6% of losses. TRM Labs reported a similar split, with infrastructure and operational weaknesses making up only about 15% of incidents but roughly 76% of total losses. The report argues that AI is changing the economics of attacks by lowering cost, speeding up exploit development and widening the range of viable targets. Researchers and security firms interviewed by Foresight News said that trend is compressing response windows and pushing the industry beyond one-off code audits toward continuous operational security, key controls, monitoring and incident readiness.

310

Bitcoin custo

2026-07-03 19:30:14

US Regulators Say Banks May Custody Bitcoin and Crypto Under Existing Rules

The Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation issued a joint statement clarifying that US banks may provide custody and safekeeping services for bitcoin and other crypto-assets as long as they comply with existing laws and maintain strong risk controls. The statement does not create new rules. Instead, it reminds banking organizations that crypto custody must fit within established legal, operational, and compliance frameworks. Banks may offer safekeeping services in either a fiduciary or nonfiduciary capacity, and fiduciary arrangements must comply with 12 CFR 9 or 12 CFR 150, applicable state laws, regulations, and the governing legal instruments. The agencies also stress that crypto custody is fundamentally tied to control over customers’ cryptographic keys, which creates heightened requirements around cybersecurity, operational resilience, technical expertise, and legal compliance. Risks such as key loss, cyberattacks, and unauthorized transfers must be actively managed. In addition, banks remain subject to BSA/AML, CFT, and OFAC obligations when handling crypto-assets. Before launching such services, banks are expected to conduct full risk assessments covering the nature of the assets, the technology involved, and the legal obligations attached. If a bank uses a sub-custodian, it is still responsible for the activities performed under the customer agreement and must perform robust due diligence on that provider’s key-management systems, policies, processes, internal controls, and adherence to standard safekeeping practices.

540