BlockThreat - Week 42, 2026

BlockThreatOct 19, 2026

BlockThreat - Week 42, 2026

$20M+ stolen across 11 incidents. AI FUD. Blockchain and wallet hacks will continue until morale improves.

By Peter Kacherginsky • 19 Oct 2026

The AI FUD machine keeps rolling. OpenAI published a misalignment report in which an internal GPT model "hacked" a Sepolia testnet wallet:

The model later wrote a script to derive accounts from common developer recovery phrases and query their balances. The result reported 362 addresses checked. One account held enough Sepolia ETH for the planned deployment. The model selected it. A recovery phrase lets anyone who knows it derive the private keys that control the corresponding accounts.

The well known phrase is “test test test test test test test test test test test junk” mnemonic which is default for Hardhat and Anvil. The whole point of accounts derived from the phrase if for free experimentation and yet even a case this benign gets a global press release.

Anthropic is also riding the recent news cycle by pointing Claude at ECDSA. As a result, they solved the old mystery in the recently published origins of the ECDSA curve seeds paper. It’s a fascinating finding (the seeds came from lrand48(timestamp)) but nothing like the existential threat some in the community made it out to be. If anything, it makes a backdoor in those seeds far less plausible and the curves more trustworthy than ever.

In other news, BlockThreat is partnering with SEAL as the first SEAL Labs collaboration. We’ll contribute the hundreds of hours that go into collecting compromises and extracting signal from them every week to help power SEAL Intelligence product. What an honor and impactful opportunity to make our community safer!

I’m also feverishly working on my talk for the DeFi Security Summit 2026 in Mumbai. The final schedule hasn’t been announced yet, but I’m looking forward to sharing lessons from the toughest year I’ve seen in all my time in blockchain security. I hope you’ll join me in person or virtually. It will be worth it.

In the full briefing, 11 new compromises added up to $20.4M this week. Another lesser-known chain fell to a consensus failure, a Cosmos chain suffered an infinite mint, a weak PRNG drained wallets on yet another network, and two bridges were breached. DPRK’s laptop farms took another hit in Texas, a well-known crypto founder was arrested abroad, and three soldiers were charged in the kidnapping of a crypto exchange owner. Plus new research on Hyperliquid, Solana sandwich attacks, Safe multisig transactions, and more.

Let’s dive into the news!