# Security Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Security", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Should Ethereum's Staking Rate Be Capped? EIP-8363 Proposal Ignites Heated Debate

The Ethereum community is currently engaged in intense debate over EIP-8363, a proposal aiming to cap the network's staking ratio. With the ETH staking rate exceeding 33% and rising, concerns have grown about potential centralization if a few large entities control most staked ETH and about perpetual dilution for non-stakers. The "diminishing issuance burn" mechanism of EIP-8363 would progressively burn an increasing portion of validator rewards as the total staked ETH approaches roughly 50% of the supply. At that threshold, new consensus issuance would effectively stop, leaving validators to earn solely from transaction fees and MEV until the staking ratio falls back below 50%. Proponents argue this protects ETH's monetary properties by limiting dilution and establishing a firmer supply cap, while also disincentivizing excessive growth by large stakers first. Critics, however, warn the proposal threatens DeFi vitality by destabilizing the staking yield which serves as a benchmark rate for lending and other protocols. They also argue it could make independent, home staking economically unviable as fixed costs remain while rewards shrink, potentially increasing centralization as MEV becomes a larger portion of validator income. Some suggest the proposal's economic rationale needs refinement. The proposal's procedural status for inclusion in a future upgrade is pending. Regardless of the immediate outcome, the debate centers on whether Ethereum currently overpays for security and if implementing such a cap is worth the potential disruption.

marsbit08/08 12:45

Should Ethereum's Staking Rate Be Capped? EIP-8363 Proposal Ignites Heated Debate

marsbit08/08 12:45

Bitcoin Lightning Network Nodes Affected, BTCPay Announces Emergency Patch 2.4.2

Bitcoin's ecosystem faces another security incident. The open-source, self-hosted cryptocurrency payment processor BTCPay Server is under an active attack exploiting a critical vulnerability that can lead to loss of funds, as reported by the Bitcoin Red Team. The BTCPay team urgently advises all users to immediately update to version 2.4.2. If an immediate update isn't possible, they recommend disabling the server until it can be updated. Users must also refresh server authentication files and move funds from any "hot" wallets generated by BTCPay. At least two incidents of stolen funds have been confirmed, affecting nodes from Foundation's Zac Herbert and the Lightning Citadel 21 node. Observers note that these targeted attacks on tools like Coldcard and BTCPay Server seem aimed at the core of Bitcoin's enthusiast community.

cryptonews.ru08/07 23:55

Bitcoin Lightning Network Nodes Affected, BTCPay Announces Emergency Patch 2.4.2

cryptonews.ru08/07 23:55

Coldcard Company Abandons Data Deletion Policy Following $116 Million Wallet Hack

Coldcard wallet maker Coinkite is changing its customer data retention policy following a major July 2026 security breach that resulted in the theft of over $116 million in Bitcoin. The company will no longer automatically delete customer records, a reversal of its prior privacy-focused stance, citing preparation for potential legal obligations arising from the hack. The breach exploited a firmware vulnerability (version 4.0.1) present since March 2021. Security firm TRM Labs warned that any seed phrase created on a vulnerable device before patching should be considered compromised. The attack occurred in several waves, ultimately draining over 1,816 BTC from more than 5,200 addresses, making it the third-largest crypto hack of 2026. Canada was reportedly the hardest-hit region. Coinkite has publicly denied long-standing allegations that it knew about the critical flaw beforehand, pointing to its public incident history log. The hack has shaken trust in self-custody solutions within the Bitcoin community.

cryptonews.ru08/07 23:47

Coldcard Company Abandons Data Deletion Policy Following $116 Million Wallet Hack

cryptonews.ru08/07 23:47

Bitcoin 'Red Team' Uncovers 4,962 Vulnerabilities Following Coldcard Hack

A security vulnerability in the Coldcard hardware wallet led to the theft of over 1,800 BTC (worth more than $116 million at the time) from long-term holders, stemming from a firmware bug first identified in March 2021. This incident prompted the formation of the volunteer 'Bitcoin Red Team,' led by developer Calle and Rob Hamilton, CEO of custody insurance firm Anchorwatch. The team conducted an emergency audit of the broader open-source Bitcoin ecosystem. Sixteen security researchers spent 27.5 hours analyzing 390 Bitcoin-related open-source repositories, combining AI-assisted analysis with manual review. They documented a total of 4,962 vulnerabilities, including 85 classified as critical and 635 as high severity. Funding was provided by the non-profit OpenSats. The team described the ecosystem's security state as "extremely poor," though only about one-fifth of the findings have been independently reproduced so far. The highest concentration of critical issues was found in privacy and coinjoin tools, accounting for 24% of critical finds. Cryptographic libraries had the highest absolute number of issues (1,101) but a lower proportion of high-severity ones. Most analyzed projects had few or no critical problems, with the real danger concentrated in a small group of tools handling private key generation, signing, and privacy-preserving transactions—the same category responsible for the original Coldcard failure. The audit is the first phase of an ongoing effort. The next steps involve verifying which vulnerabilities are actually exploitable and coordinating responsible disclosure with affected projects. For the self-custody community, the audit shows white-hat researchers are now scaling their efforts to match the pace of potential attackers.

cryptonews.ru08/07 13:40

Bitcoin 'Red Team' Uncovers 4,962 Vulnerabilities Following Coldcard Hack

cryptonews.ru08/07 13:40

Fierce backlash to Ethereum’s EIP-8363 staking proposal

Ethereum's EIP-8363 proposal, aiming to taper and eventually stop issuance rewards once 50% of ETH is staked, has sparked intense debate. Proponents, including authors Justin Drake and Jerome de Tychey, argue the network is overpaying for diminishing security gains, unfairly diluting non-stakers. However, critics from across the ecosystem fiercely oppose it. They contend the proposal could severely damage decentralization by making solo staking uneconomical, disproportionately favoring large institutional players. It's also seen as a threat to DeFi, where staking derivatives are deeply integrated as collateral. Figures like Ether.fi's Mike Silagadze and Aave's Stani Kulechov warn it could destabilize lending markets and drive capital to other yield-bearing assets. Furthermore, critics like Bitwise's Dr. Steve Berryman argue the "problem" of excessive staking is overstated, with market forces naturally capping participation, and that Ethereum's sub-1% inflation is not burdensome. A core criticism is that the change undermines the predictability and stability valued by institutions, creating harmful uncertainty. The rushed publication timeline ahead of a hard fork deadline also drew ire. The backlash highlights the extreme difficulty of altering Ethereum's economic foundations, where any adjustment creates clear winners and losers.

cointelegraph08/07 13:37

Fierce backlash to Ethereum’s EIP-8363 staking proposal

cointelegraph08/07 13:37

MetaMask Team Expands Wallet Access for AI Agents

On August 6th, MetaMask launched the Agent Wallet, a non-custodial wallet that allows AI agents to autonomously conduct on-chain operations within user-defined rules. Accessed via CLI, it's compatible with various AI platforms. By default, Guard Mode enforces spending limits, allowlists for networks/addresses, and acts as a 2FA-like security check, requiring user approval for suspicious transactions. Beast Mode removes allowlists and spending caps but retains threat detection. Private keys are isolated in a secure environment, separate from the AI agent's process. The wallet supports EVM chains, Hyperliquid, and Solana, enabling swaps, trading, and DeFi interactions. MetaMask also introduced Transaction Protection, offering up to $10,000 monthly compensation in mUSD for certain losses from system-approved transactions, excluding market losses or key compromises. Risks include prompt injection attacks, where malicious instructions could trigger transactions. MetaMask mitigates this by separating the AI's proposal from the isolated signing module and transaction checks, though risks remain, especially in Beast Mode. The launch follows similar offerings from Coinbase and Base, expanding tools for AI-driven blockchain interactions.

cryptonews.ru08/07 13:35

MetaMask Team Expands Wallet Access for AI Agents

cryptonews.ru08/07 13:35

Demand for Hardware Crypto Wallets Grows in Russia. What's Going On?

Demand for hardware cryptocurrency wallets in Russia has significantly increased. According to CNews, sales of these devices surged in the second quarter, with one major retailer reporting a 107% rise in unit sales and a 92% increase in turnover compared to the first quarter. This trend coincides with the upcoming enactment of Russia's "On Digital Currencies and Digital Rights" law on September 1st. While the law does not directly prohibit non-custodial wallets, it introduces strict regulations, requiring cryptocurrency transactions to eventually go through licensed organizations. After a transition period ending July 1, 2027, crypto operations will only be permitted via regulated entities. The law currently restricts transferring crypto from a Russian depository to a personal wallet, allowing withdrawals only to accounts of foreign licensed firms. This regulatory shift may be driving interest in self-custody hardware wallets, despite a recent high-profile hack targeting Coldcard wallets, which resulted in an estimated $115 million loss across thousands of addresses.

cryptonews.ru08/07 13:31

Demand for Hardware Crypto Wallets Grows in Russia. What's Going On?

cryptonews.ru08/07 13:31

Bitcoins from 2011 Moved. Their Owner is Up $10 Million

A dormant Bitcoin wallet from 2011 transferred nearly 50 BTC, worth approximately $3.2 million. The wallet's owner originally accumulated 144 BTC in 2011 when the price fluctuated between $13.99 and $2.76, with the total initial investment valued at around $399. Over 15 years, this early holder has realized a total profit estimated at $9.75 million from price appreciation. The owner made their first withdrawal of 11 BTC in 2021 when the price was $39,000. A second transfer of nearly 13 BTC occurred near the market peak in fall 2025 at $122,000. The latest transfer of almost 50 BTC was spotted on August 6. The wallet still holds 70 BTC, valued at about $4.5 million at current prices. The transferred 50 BTC have not been sold yet but were moved to a newer SegWit address (starting with "bc1"), which is more efficient and secure. Funds from this new address are periodically sent to institutional crypto broker FalconX, indicating a potential intent to sell. The movement is part of a broader trend where early holders migrated assets from old wallets to new ones in 2025 due to security concerns, including a phishing scam involving fake claims from "Saloman Brothers." Separately, this week saw a spike in crypto transfers, with $9 billion in Bitcoin moved to exchanges and new addresses following a major hack resulting in over $115 million stolen from Coldcard hardware wallets, marking a first for such devices traditionally considered highly secure.

cryptonews.ru08/07 13:16

Bitcoins from 2011 Moved. Their Owner is Up $10 Million

cryptonews.ru08/07 13:16

Bitcoiners turn to dice throws as self-custody setups are re-evaluated

Following a critical low-entropy bug in Coldcard hardware wallets linked to thefts starting July 30, Bitcoin holders are reassessing trust in their self-custody setups. The flaw, introduced in a 2021 firmware update, replaced a hardware-based random number generator with a weaker software method, drastically reducing seed phrase entropy and enabling attackers to brute-force private keys, stealing over $100 million. The incident highlights the core Bitcoin principle of "Don't trust, verify." Wallets generated using physical entropy sources, like dice throws, were spared. Methods for generating secure seeds without relying on hardware wallets—such as manual dice rolling with conversion tables, paper shuffling of BIP-39 words, or specialized tools—are now being widely discussed and adopted. The event underscores that verifiable, user-controlled entropy generation is the essential foundation for secure self-custody, moving trust away from opaque electronic components.

cointelegraph08/07 13:11

Bitcoiners turn to dice throws as self-custody setups are re-evaluated

cointelegraph08/07 13:11

Sui Implements Quantum-Resistant Signatures

The L1 blockchain Sui announced the integration of two post-quantum digital signature schemes as part of its long-term plan to enhance network security. The update aims to protect user accounts and smart contracts from potential threats posed by the advancement of quantum computing. The network will implement the ML-DSA-65 algorithm for regular user accounts and the SLH-DSA-SHA2-128s algorithm for smart contract-managed storage. Both algorithms are based on post-quantum cryptography standards approved by the U.S. National Institute of Standards and Technology (NIST). According to the Sui team, using two distinct signature schemes mitigates risk, as each relies on a different mathematical approach. The core implementation is already complete and tested. Quantum-resistant storage is scheduled for deployment on the mainnet by the end of this year, while support for ML-DSA-65 accounts is targeted for the testnet by the end of 2026. The full launch of post-quantum account authentication on the mainnet is planned for the first quarter of 2027. The update will be accompanied by necessary upgrades to wallets, SDKs, and CLI tools, with independent security audits ongoing.

cryptonews.ru08/07 12:52

Sui Implements Quantum-Resistant Signatures