Halborn

We analyzed the 100 largest digital asset security incidents from 2014 to H1 2026. 🔐 The attack surface moved. 96% of H1 2026 losses now come from compromised keys, signing workflows, and vendor infrastructure. 🔗 Get your copy: halborn.com/reports/top-100-…

An estimated $133 million was stolen from a French bank through crypto rails. 🏦 Attackers reportedly sent transfers from Crédit Mutuel Arkéa’s account to exchange accounts under fake identities, then cashed out through crypto. 📰 Full breakdown: halborn.com/blog/post/explai…

We are proud to publish our Framework for Assessing and Measuring Custody Risk in Digital Assets! 🔐 A methodical, measurable, and comparable approach for financial institutions, rating agencies, auditors, and risk functions. 🔗 Download: halborn.com/reports/custody-…

MPC did not fail at Binance. The policy did. 🔐 One EIP-7702 authorization can turn a hot wallet into attacker code. They got 50 signed in minutes. Clearing it took close to 4 hours. @urruts on what an MPC hot wallet needs after Pectra 🔗 halborn.com/blog/post/binanc…

October 2026 put security on the agenda for every institution working with digital assets. 📅 Halborn will be at @FireblocksHQ SPARK’26, @blockworksDAS, and @TheBigWhale_ Summit. If digital assets are on your roadmap, we’d be glad to talk it through.

October 2026 may be the worst month in cybersecurity so far. 📉 An estimated $6.3B stolen from Binance. PHP2Shell RCE bugs live since 2012. A trojanized Claude Code extension on Cursor’s marketplace. 📰 Read our overview: halborn.com/blog/post/black-…

PHP2Shell is an active incident for digital asset firms, even those that don’t build in PHP. 🚨 Marketing sites, support portals and admin panels can run PHP, and many can reach API keys and wallet infrastructure. 📰 Full breakdown: halborn.com/blog/post/php2sh…

$6.3B left Binance’s hot wallets in under four hours, and nobody has shown a private key was stolen. 🚨 The cryptography held. The process that decides what gets signed did not. Read @urruts' full analysis 🔗 halborn.com/blog/post/binanc…

Busy week for digital assets in NYC, and the Halborn team is on the ground. 🔐 Catch us at The Bridge, SWELL 2026, Link:NYC, and the Google Web3 & Digital Asset MPC Symposium, plus Devcon with the Ethereum community.

Swarm fraud is not new. AI agents with wallet access make it easier to run and harder to detect. ⚠️ One actor can coordinate many low-cost accounts to run Sybil attacks, wash trading, oracle manipulation, and protocol exhaustion. 📰 Learn more: halborn.com/blog/post/swarm-…

Supply chain risk is treasury risk. Most crypto orgs file it under engineering hygiene. One poisoned npm or PyPI release or compromised workflow can end in irreversible loss. 📰 Read our overview on threats and controls: halborn.com/blog/post/crypto…

The custody trilemma: agility, cost of the solution, security. ⚖️ Where you land depends on the asset class you want to custody. Fast start? A regulated custodian. Our CEO Jacques Boschung, Digital Assets Week London.

Hybrid incidents are now a recurring pattern in digital asset hacks. 🔓 One infrastructure or social step. One technical exploitation step. 🔗 Learn more in our report: halborn.com/reports/top-100-…

HSMs, multisig wallets, and MPC each move the attack surface somewhere different and trade availability against isolation differently. 🔏 We evaluate them on security, availability, and operational complexity. 📰 Read: halborn.com/blog/post/mpc-vs…

An estimated $93M was stolen from accounts protected by a Ledger hardware wallet. 🔒 The hack is linked to an implant in hardware from a reseller. It monitored the screen during setup and captured the recovery phrase. 🔗 Learn more: halborn.com/blog/post/explai…

Recovery rate in the top 100 digital asset hacks: 40% in 2021, 11% in H1 2026. 💸 Forensics got better. Laundering got faster. DPRK-linked losses recover at 9.0%. 🔗 Get the report: halborn.com/reports/top-100-…

Raising the signer count doesn't address where attackers actually operate. ❌ All 12 multisig breaches in our Top 100 Digital Asset Hacks report were defeated through the human or workflow layer. Not the cryptography. 📰 Full report: halborn.com/reports/top-100-…

$387.5M out of Bitget's hot and warm wallets on Sept 24. The biggest hack of the year so far. 🚨 On current evidence, no private key was stolen. Bitget's own signing service signed the transfers. 📰 Read @urruts' analysis: halborn.com/blog/post/bitget…

Third-party custodian, self-custody, in-house build, or acquisition. Every route to institutional digital asset custody carries a different risk profile. ⚖️🔐 Today at Digital Assets Week London, our CEO Jacques Boschung discussed these trade-offs with fellow experts on a panel.

French fintech @finaryhq needed to run a custody key ceremony, with no internal experience and a regulatory need for independent attestation. 🔑 Halborn reviewed the runbook, identified two gaps, then attested the ceremony live. 🔗 Full case study: halborn.com/case-studies/pos…