Web3 security losses reached about $1.32 billion across 344 incidents in the first half of 2026, according to a Foresight News report citing CertiK, TRM Labs and SlowMist. The sharpest damage no longer came from smart contract bugs alone. Instead, major losses clustered around operational failures such as key management, credential compromise, social engineering and supply-chain attacks. CertiK said that, excluding Bybit’s $1.46 billion single incident from the prior year, H1 incidents still rose 28% year over year. SlowMist said operational failures accounted for 53 of 182 cases it tracked, or 29.1%, yet represented 76.6% of losses. TRM Labs reported a similar split, with infrastructure and operational weaknesses making up only about 15% of incidents but roughly 76% of total losses. The report argues that AI is changing the economics of attacks by lowering cost, speeding up exploit development and widening the range of viable targets. Researchers and security firms interviewed by Foresight News said that trend is compressing response windows and pushing the industry beyond one-off code audits toward continuous operational security, key controls, monitoring and incident readiness.

Open-source AI agent platform OpenClaw releases major v2026.3.22 update, featuring ClawHub plugin marketplace, native GPT-5.4 full series support, SSH sandbox execution, 48-hour sessions, and MiniMax M2.7 integration for Chinese tasks.

Over 500 dormant Ethereum wallets (4–14 years untouched) were drained by a single address, losing ~$800K in ETH. Funds were bridged via ThorChain to BTC and Monero. Community debates AI brute-force, but analysts point to old seed phrase leaks (e.g., LastPass breach).

IBM and Red Hat have launched Project Lightwell with a $5 billion commitment and 20,000 full-time engineers focused on finding and fixing open-source software vulnerabilities. Six major financial firms are already on board.

Puffer Finance has published a detailed breakdown of the security architecture behind its ETH staking system, arguing that security should cover the entire protocol stack rather than stop at smart contracts. The team said that since launching in 2024, Puffer has reached more than $1 billion in peak TVL and processed over $1 billion in ETH redemptions without pauses, withdrawal restrictions, or a depeg. The article describes a multi-layer model that combines continuous AI-assisted code review, sequential third-party audits, deployment audits, and role-based access controls built with OpenZeppelin Access Manager. Puffer said upgrades proposed by its Operations multisig are subject to a hard-coded 7-day timelock, while a separate Security Council can intervene during that period and a Pauser role can halt the protocol immediately, including through automated monitoring connected to BlockSec Phalcon. Puffer also said node operators must post a 2 ETH bond in pufETH before running validators, with that collateral serving as first-loss capital in slashing events. The company added that users can exit through either instant withdrawals using Vault liquidity for a small fee or a standard fee-free route, and said the withdrawal system has already been tested by more than $1 billion in ETH redemptions.

OpenAlice, an open-source AI trading agent built for local deployment, has passed 3,100 GitHub stars. The project combines research, multi-asset analysis, staged order execution, and account-level risk controls.

Anthropic switched Claude Code from an npm package to precompiled native binaries in v2.1.113, eliminating Node.js startup and JIT warm-up overhead. Same install command, zero user action required.

Claude Code Routines lets developers schedule recurring maintenance tasks in the background. The tutorial covers setup, YAML fields, registration commands, common use cases, and the safety controls needed before moving into automated fixes.