CertiK 博客

On October 6, 2026, at 06:13:11 UTC, an attacker drained 200 ETH ($542,982 at the time of the exploit) of ETH-A collateral from a legacy auction-keeper contract on Ethereum mainnet. The 200 ETH came from four 50 ETH lots that the keeper won with zero bids during MakerDAO's "Black Thursday" liquidations in March 2020 and never settled. An unauthenticated function on the keeper let the attacker give a contract it controlled full delegation over the keeper's MakerDAO Vat account. In a single transaction, the attacker settled the old auctions and withdrew the collateral.

On 6 September 2026, the Liquid Network was exploited through a vulnerability in the Elements codebase used to validate Confidential Transactions. The issue stemmed from an ambiguous cache-key encoding in the rangeproof verification cache, allowing two different validation inputs to produce the same cached entry.

On July 23, 2026, an attacker exploited the Verus Protocol’s Ethereum cross-chain bridge, draining approximately $7.44 million in ETH, tBTC, stablecoins, and MKR. The attack relied on a discrepancy in how Verus and Ethereum interpreted notarization data: malicious duplicate state-root entries were included in otherwise legitimate notarizations, signed by Verus notaries, and then relayed to Ethereum, where they overwrote the genuine trusted state root.

Kyrgyzstan’s central bank is developing a digital version of its national currency, the Digital Som. On 9 September 2026, it signed a Memorandum of Understanding with CertiK, the largest Web3 security services provider, on Digital Som security and broader digital asset oversight. The partnership spans security assessment, formal verification, operational resilience, and ongoing risk monitoring, connecting technical security with longer-term risk management and regulatory oversight.

As I wrap up a three-day DC roadshow coordinating Capitol Hill and agency roundtables for the US/UK Crypto Alliance, one conclusion stands out above the rest: the narrative surrounding digital asset policy in Washington has fundamentally shifted.

The regulatory landscape for Web3 in the U.S. is undergoing a significant transformation, even in the absence of the long awaited CLARITY Act. On August 18, 2026, the U.S. Securities and Exchange Commission (SEC) issued a notice of proposed rulemaking titled Regulation Crypto Assets (Release No. 33-11434; File No. S7-2026-27).

Red team vs. pentest vs. bug bounty for Web3 projects: what each one actually tests, when to use which, and how to combine them into one program.

This article compares FunC and Tolk through code, explains how typed schemas, automatic serialization, and lazy loading change TON contract security, and identifies the risks developers and auditors still need to review.

How Daml views, choices, factories, client-side construction, and operational permissions determine the security of CIP-56 assets.

CertiK’s formal verification of zkWasm provides mathematical proof that a leading zero-knowledge virtual machine executes programs correctly — a rigor level beyond traditional audits, now validated for ACM CCS 2026.

CertiK joins LF Decentralized Trust to bring formal verification and security expertise into the open-source infrastructure enterprises are building on amid intensifying global regulation.

CertiK signs an MoU with the National Bank of the Kyrgyz Republic to advance Digital Som security, AML/CFT oversight, and digital asset supervision.

Circle’s Arc mainnet is scheduled for September 16, 2026, using USDC for gas and settlement while connecting stablecoin scale with institutional and programmable financial activity.

This article examines how crypto wallets must extend security controls across key generation, recovery, transaction review, and incident response as they evolve into execution environments.

This H1 2026 review compares centralized exchanges by spot and futures volume, open interest, reserve depth, Bitcoin custody, and expansion into tokenized stocks and traditional financial products.