Adrian ⛩️ Hetman 🐺 | 📓+🖋️+☕️

In July 2025, a man opened his bug bounty inbox. He found seven security reports. All seven had arrived in the last sixteen hours. He read every one. Not one described a real bug. His name is Daniel Stenberg. He runs curl, software that sits on billions of devices, and his security team is seven volunteers. Every report looked confident and precise. Each one named real functions and cited a real class of bug. Each one was a chatbot's guess in the shape of a discovery. And each one took a person far longer to disprove than the machine took to write. Stenberg gave the pattern a name. Death by a thousand slops. --- More in the article below. burnnotice.adrianhetman.xyz/…

It’s been 2 weeks since my last post, all due to my new job and new reality of juggling between work and 2 kids and still being a good husband. But we’re back! — The two largest crypto losses of late July 2026 occurred within days of each other, and neither attack required breaking any cryptography. In each case, the loss originated in the way a system's keys were generated or held. Coldcard, a Bitcoin hardware wallet, lost more than $116 million after a firmware change made in 2021 caused affected devices to generate their seed phrases with far too little randomness. Because the weakness lay in the keys themselves, an attacker could reproduce them from public blockchain data alone and empty the wallets remotely, and the flaw had shipped unnoticed for more than five years. AFX Trade, a perpetuals exchange on Arbitrum, lost about $24 million from a bridge it operated itself rather than the network's native one. An attacker obtained the private signing keys of five of the bridge's seven validators, which was sufficient to meet its two-thirds quorum, and the contract released the funds against signatures it accepted as valid. The security of the bridge had rested entirely on the custody of those keys. As audited contract logic has become harder to exploit directly, the decisive weaknesses have moved to the foundations beneath it, including the randomness that produces a key and the custody of the keys that approve a transfer. For any team holding or moving significant value, the relevant question is no longer only whether the contract is correct, but when the generation and custody of its keys were last independently examined. A full analysis of both incidents is in this week's Burn Notice below 👇

burnnotice.adrianhetman.xyz/… If you like this writing and security news digest consider subscribing!