Arkham now puts full wallet history, cross-chain tracing and risk scores behind a paid Enterprise tier. I followed a real $26 million theft with two Bitquery tools, then lined up five more options.

Arkham’s free plan now shows only the last 100 transactions of any wallet. To see the rest, you need Arkham Enterprise. That paid tier also holds risk scores, case files and tracing from one chain to another. Arkham launched it on 20 October 2026, and its announcement lists no price.

A busy wallet can make 100 transactions in an afternoon. So if you chase stolen funds or check wallets for a compliance team, the free plan now stops early. If that is you, you need an Arkham Intelligence alternative, at least for part of the work.

I wanted a fair test, so I took one real theft and followed it to the end. On 8 January 2026, an attacker took 8,535 ETH from Truebit, an Ethereum project with its own token. That was about $26.4 million at the time. Within 53 hours, all of it had gone into Tornado Cash, a mixer that pools many people’s coins so the trail breaks.

I ran that trail through both Bitquery tools myself. For the other five, I say what each does best and where it stops.

The short version

• Bitquery MoneyFlow (lite.bitquery.io): a free, Arkham-style flow chart in your browser. Paste a wallet, pick one of 17 chains, and follow the money one step at a time.
• Bitquery MCP: for people who work in Claude, ChatGPT or Cursor. Ask in plain English, and the AI pulls live transfers and labels from 19 chains, plus risk scores for Ethereum, Bitcoin and TRON.
• Nansen: for trading research and “smart money” wallets.
• Chainalysis Reactor and TRM Labs: what police and large compliance teams buy. Prices come by quote.
• Dune: for people who write SQL and want dashboards.
• Etherscan: free, and fine for checking one wallet or one transfer at a time.

Why people look for an Arkham Intelligence alternative

Arkham Intelligence is a blockchain analytics platform, and it built its name on labels. A label is a name attached to a wallet address, such as “Binance hot wallet”. Arkham says it holds 3.9 billion “attributions”, its word for these labels. Those labels stay free, along with its graph tool, called Visualizer, and its block explorer.

Here is what sits behind Arkham Enterprise on 20 October:

• the full transaction history of a wallet, with filters (free users see the 100 most recent transactions)
• Tracer 2.0, which follows money across bridges, the services that move coins between chains
• the counterparties panel, which shows who a wallet deals with most
• risk scores and case management
• creating new custom labels

Arkham does give free Enterprise access to some independent investigators and public-interest groups through a grant program. Everyone else has to ask for a price.

The API is gated too, with one exception. You apply through a form, and once Arkham approves you, paid plans start at $100, billed in monthly credits. Arkham also hosts an MCP server, so Claude, Cursor or Codex can query its data, but it needs that API plan or a trial. The exception is for AI agents: about 90 read endpoints sold one call at a time, at $0.20 per credit in USDC, with no account.

I get why Arkham moved full history behind a paywall. Serving full history for every wallet costs money. Still, Arkham keeps one big edge. If your main question is who owns a wallet, its free labels are hard to beat, and nothing on this list replaces them one for one. The tools below compete on history, access and price instead.

The test case: the $26 million Truebit hack

Truebit sold its TRU token through its own sale program on Ethereum, written in 2021. A math bug in that old code made the price of new TRU come out as zero. The attacker minted TRU for free, sold it back for ETH, and repeated the trick several times in one transaction. Security firm SlowMist put the loss at $26.44 million.

Here is the trail, as the two Bitquery tools showed it:

1. 8 January, 16:02 UTC. 8,535 ETH lands in the attacker’s wallet, 0x6C8E鈥�2b50 (transaction).
2. Same day. The wallet splits the money: 4,267 ETH to one new wallet, 4,001 ETH to another. A third payment of 268 ETH follows on 10 January.
3. 8 to 10 January. The 4,267 ETH pile hops through three more new wallets. The 4,001 ETH pile makes one hop.
4. 10 January. Two final wallets feed Tornado Cash in round amounts of 100, 10, 1 and 0.1 ETH. By 20:52 UTC, 8,535 ETH has gone in, the same amount that was stolen.

Any tracing tool should answer three questions about a trail like this. Where did the money come from? How did it split? Where did it end up?

1. Bitquery MoneyFlow: visual crypto tracing in your browser

MoneyFlow is Bitquery’s browser tool for tracing money between wallets. It lives at lite.bitquery.io, and it is free: you only need to sign in with a Bitquery account.

Starting a trace takes four steps:

1. Paste an address.
2. Pick the chain. On 29 October the menu listed 17: Bitcoin, Ethereum, BNB Smart Chain, Polygon, Arbitrum, Base, Optimism, TRON, XRP Ledger, Cardano, Litecoin, Dogecoin, Dash, Algorand, Filecoin, Arc and Robinhood Chain.
3. Pick the coin or token. MoneyFlow lists every currency the wallet has touched, with the date it last moved.
4. Set a date range if you want one, then press Create MoneyFlow.

The result is a flow chart. Money coming in sits on the left, money going out sits on the right, and the width of each band shows the amount. For the Truebit wallet, one green band of 8,535 ETH comes in and splits into red bands of 4,267, 4,001 and 268 ETH.

Trace Out adds the next step of the trail, and Trace In walks back toward the source. Each step saves a new version of the trace, so you can go back if a step gets messy.

The table under the chart shows Bitquery’s labels next to each address. Both wallets that took the big piles carry the tag hacker-truebit-hacker. Exchange wallets get tagged too. When I traced the Bybit hacker’s wallet from February 2025 the same way, the money came from a Bybit wallet tagged bybit-proof-of-reserves.

The chart also showed something I did not expect. A fan of tiny payments, each worth less than $1, came into the attacker’s wallet from look-alike addresses. One look-alike copies the first and last four characters of a wallet the attacker used, so both read 0x3b58鈥�862a in short form. The trick is called address poisoning. Scammers hope you copy the fake address from your history next time, and here they aimed it at the thief. A threshold box above the chart hides payments below any dollar amount you choose.

Two more buttons help when you need to share the work. Generate report turns the trace into a table of every transfer, with full hashes, which you can download as a CSV file. Get API opens the query behind the chart in Bitquery’s GraphQL IDE, so a developer can run it again.

Where it falls short. Solana is not in the chain menu yet. Each trace follows one currency, so if a thief swaps ETH for USDT, you start a second trace. And after a few steps the chart can turn into loops when money flows back into wallets already on it. In the Truebit case, the third step got hard to read, and the table was clearer.

2. Bitquery MCP: ask your AI assistant to follow the money

MCP, short for Model Context Protocol, is a standard way to plug outside tools into an AI assistant. Bitquery MCP plugs live blockchain data into Claude, ChatGPT, Cursor, VS Code and OpenAI Codex.

Setup is short. Add https://mcp.bitquery.io as a custom connector in your assistant, then sign in with your Bitquery account. There is no API key to paste.

You then get 314 tools. They trace transfers on 19 chains, including Solana, Bitcoin, Ethereum, TRON, the XRP Ledger and Stellar. They also cover DEX trades and prices on 10 chains. Guided prompts handle the common jobs: money_flow follows funds until they reach an exchange or a mixer, and risk_screen returns a LOW, MEDIUM or HIGH verdict with evidence.

I gave Claude the Truebit attacker’s wallet and asked where the ETH ended up. I also asked it to name every wallet on the way and score the last ones for risk. It pulled the transfers hop by hop, looked up the labels and ran a risk check on each final wallet.

The answer named two exit wallets. The first, 0x7720鈥59d, got 4,267 ETH after three more hops and sent 4,266.9 ETH to Tornado Cash on 10 January. The second, 0xd841鈥135, got the 4,001 ETH pile plus the 268 ETH payment and sent 4,268.5 ETH to Tornado Cash the same evening. Both scored 100 out of 100 for risk, the top of the scale, mainly because they paid a mixer. The risk check also flagged look-alike poisoning addresses next to both.

MoneyFlow reached the same Tornado Cash address three steps out from the attacker. The MCP got there from one question. Arkham has a hosted connector too, so the real difference is access. Arkham’s needs an approved API plan or trial, while Bitquery’s trial is self-serve and needs no card.

The product page listed three plans on 29 October 2026. The free trial runs 7 days with 100 credits, and it needs no card. Trading MCP costs $19 per month and covers trading data only, with 32 tools and no tracing. AI Investigation MCP, the plan with tracing, costs $149 per month, or $100 per month billed yearly, and includes all 314 tools.

Where it falls short. On Ethereum the risk check looks one step out from a wallet; on TRON it can look several steps. An AI assistant can also misread a result, so open the transaction hashes it cites before you rely on them. And like MoneyFlow, it follows one chain at a time, so you hop a bridge yourself.

Arkham vs Bitquery at a glance

In words: Arkham’s free plan shows the last 100 transactions per wallet, while MoneyFlow uses whatever date range you set and the MCP pages through the full history. Arkham’s Visualizer stays free, and MoneyFlow draws a flow chart too; the MCP answers in text.

Arkham Enterprise follows money across bridges for you. MoneyFlow and the MCP work one chain at a time. Risk scores come with Arkham Enterprise and with Bitquery MCP, not with MoneyFlow.

Price works differently on each side. MoneyFlow is free with a Bitquery account. Arkham Enterprise lists no price. Its API starts at $100 after approval, or $0.20 per credit pay as you go. Bitquery MCP is self-serve, with a free trial and then $149 per month for tracing.

5 more Arkham alternatives worth knowing

3. Chainalysis Reactor

Best for police, prosecutors and large exchanges. Reactor is Chainalysis’s case graph, and law enforcement uses it widely. There is no public price and no self-serve trial. If you work alone or on a small budget, it is likely out of reach.

4. TRM Labs

Best for compliance teams and government buyers. TRM sells its Forensics tool for tracing funds across chains, next to its wallet screening tools. Most of it is sold by quote, mainly to large firms.

5. Dune

Best for analysts who write SQL. Dune lets you query blockchain data and build dashboards, and it has a free tier and its own MCP server. There is no ready-made tracing screen, so you write the queries yourself or let its MCP server write them.

6. Etherscan

Best for checking one transaction or one wallet for free. Etherscan shows name tags on well known addresses, and it tags the Truebit attacker’s wallet “Truebit Exploiter 1”. There is no flow chart, so tracing a trail across many hops means a lot of tabs.

7. Nansen

Best for trading research. Nansen labels wallets and marks the ones with a strong record as “smart money”. You can then watch what they buy and sell. There is a free tier and a paid Pro plan, plus an API, an MCP server and a command-line tool. Its tools center on trading signals, so it is a weaker fit if you need to build a case file.

Other Bitquery products for investigators

Bitquery sells three more things for this kind of work:

• Coinpath: the money-flow data behind MoneyFlow, sold to companies with full history and bulk export.
• Crypto investigation service: if you were robbed and would rather hand the work to someone, Bitquery’s team traces the funds. Its page says the first assessment is free.
• Ethereum datasets: the full history of the chain as files, for teams that want to run their own analysis.

How to choose an Arkham alternative

• You want Arkham’s look without paying for Enterprise: Bitquery MoneyFlow, which is free.
• You already work in Claude or ChatGPT: Bitquery MCP.
• You trade and want smart-money signals: Nansen.
• You work for police or a regulated firm with a budget: Chainalysis Reactor or TRM Labs.
• You write SQL: Dune.
• You only need to check one transfer: Etherscan.

FAQ

Is there a free alternative to Arkham Intelligence?

Yes. Bitquery MoneyFlow is free with a Bitquery account and traces a wallet over any dates you pick. Etherscan is free for looking up one wallet or transaction at a time, and Dune has a free tier. Bitquery MCP has a 7-day free trial with 100 credits and no card. Arkham itself still has a free plan, but it shows only the last 100 transactions per wallet.

What is the best Arkham alternative for tracing stolen crypto?

For a visual trail, Bitquery MoneyFlow; for asking questions in plain English, Bitquery MCP. For court work with a large budget, Chainalysis Reactor or TRM Labs. I work at Bitquery, so weigh my pick with that in mind.

Does Arkham have an API?

Yes. You apply through Arkham’s API form, and once Arkham approves you, plans start at $100, billed in monthly credits. Some applicants get trial access first. Arkham also hosts an MCP server for AI assistants, and AI agents can pay per call at $0.20 per credit in USDC.

Can AI trace crypto transactions?

Yes, if the assistant is connected to live blockchain data. With Bitquery MCP, Claude followed the Truebit money to Tornado Cash and scored both exit wallets 100 out of 100 for risk. Check the transaction hashes it cites before you act on them.

Can you trace crypto after it goes into Tornado Cash?

Not directly. A mixer pools many people’s deposits, so the link between a deposit and a withdrawal breaks. Investigators match the timing and size of later withdrawals, which is slow and gives odds, not proof.

Try it yourself

Start a trace at lite.bitquery.io, or connect Bitquery MCP to your AI assistant and ask it to follow a wallet. If you want the raw history instead, Bitquery sells the Ethereum dataset as files.

Best Arkham Intelligence Alternatives in 2026: 7 Tools, 2 Tested on a $26M Hack was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Scammers can copy a name, a logo and a job title in a minute. A few checks you can run yourself show whether a “support agent”, recruiter or business partner is real.

A message lands on Telegram: “Hi, I’m Daniel from the security team at your exchange. We saw a login from a new device. Please confirm your wallet so we can protect your funds.” The profile photo shows the company logo. The English is good. Daniel is patient, and he knows your username.

Daniel does not work at the exchange. He works for a scam crew, and the “confirm your wallet” link empties your wallet.

People reported losing $3.5 billion to imposter scams in 2025, and nearly $1 billion of that went to people pretending to be a business, according to the FTC’s June 2026 report. The FBI’s figure for crypto is bigger. Victims told its Internet Crime Complaint Center they lost $11.4 billion to crypto-related crime in 2025, more than half of all the losses it counted that year (IC3 2025 report).

A lot of those losses started the same way. Someone claimed to work for a company, and the victim took their word for it. Some victims did not know how to check. Others saw a familiar name, a logo and a confident tone, and felt no need.

The checks run from a 30-second test to reading the hidden part of an email. If you only have time for two, use the first and the tenth: both are free, and both are very hard for a scammer to fake.

The one rule behind every check

Never use the contact details a stranger gives you to check that stranger.

If “Daniel” sends you a phone number, a website or an email address and says “contact us here to confirm”, all three belong to Daniel. Calling the number he gave you only proves that Daniel answers his own phone.

Every check in this list works the same way. You find the company’s official channel yourself, from a source the stranger did not hand you. Then you ask that channel whether the person is real.

Why people skip the check

It looks official, so we assume it is. A logo, a job title and a company name take a minute to copy. Real staff photos sit on LinkedIn and on company “Team” pages for anyone to download.

They already know something about us. Your username, your last order or the exchange you use is often public, or leaked in a data breach. Knowing those details says nothing about who the sender is.

There is a clock. “Your account will be frozen in 30 minutes.” The deadline is there to stop you checking. A real company will still exist after you spend ten minutes confirming.

The more urgent the message, the slower you should move.

13 ways to check that someone works for a company

1. Contact the company yourself, through its official website

Type the company’s address into your browser by hand, or use a bookmark you saved earlier. Skip links in the message and skip search ads, because scammers buy ads for fake support pages. Find the support page or contact form and ask: “Someone called Daniel, Telegram @daniel_sec_team, says he works on your security team and contacted me today. Is that real?”

Example. A “recruiter” emails about a job at a well-known firm. You open the firm’s careers page from a bookmark. The role is not listed, and the HR address on the page is another one. The recruiter does not work for the firm.

The catch is speed. If support takes two days to reply, wait two days, and do nothing the stranger asks in the meantime.

2. Use the company’s own checking tool

Many crypto exchanges now run a page where you paste a username, email, phone number or link, and it tells you whether the contact is official. Three examples:

• Binance Verify at binance.com/en/official-verification checks domains, email addresses, phone numbers and social handles, Telegram included. Binance says anyone who claims to work with Binance and cannot be confirmed there should be treated as untrusted.
• OKX has a channel verification page in its Help Center. OKX says to type the “@” before a username, or the result can be wrong.
• KuCoin runs an Official Verification Center at kucoin.com/cert. It checks emails, Telegram IDs, X accounts, websites and official wallet addresses.

Example. “Binance support” adds you on Telegram as @BinanceSupportDesk. You paste the handle into Binance Verify, and it comes back as not official. Block the account and report it.

Reach these tools by typing the exchange’s main address yourself and looking in its Help Center for “verify” or “official channel”. If the stranger sends you a link to a “checking tool”, that link is the trap.

A tool can confirm that an address belongs to the company. It cannot confirm that an email really came from that address, because the From line can be forged. Bybit’s own help page warns about this. For email, add check 5.

3. Ask them to message you from the company’s official X account

Ask the person to prove it on a channel only the company controls. Better still, contact that channel yourself. Here is a message you can send:

“Before I continue, please send me a DM from @ExampleExchange, the official account, confirming you work there and what this is about. Or I can DM that account and ask.”

A real employee will say “sure” or send you to the official support channel. A scammer will make excuses: “That account is for marketing only”, “our team can’t access it”, “this is confidential.” Each of those excuses means the person cannot prove it.

Make sure you have the right official account. Open it from a link on the company’s own website, since search results can show copycat accounts. It should have years of posts and the follower count you would expect.

Then look for X’s affiliate badge. Companies that pay X to verify their brand can link their staff accounts. An affiliated employee shows a small copy of the company’s profile picture next to their name, and tapping it opens the company’s account. A plain blue tick on a personal account says nothing about employment, because anyone can buy one.

Official accounts do get hacked. If the official account suddenly DMs you first with a link, treat that as suspicious too. Most companies never start private conversations about your account.

4. Ask for an email from the company domain, then read that domain letter by letter

A real employee can email you from a work address in a minute. Ask for it. A recruiter or “partner” who only uses Gmail, Outlook.com, Telegram or WhatsApp fails this test.

Then read the address slowly. Say the real company is Example Exchange at example.com. Each of these addresses is fake:

• support@examp1e.com (the digit 1 in place of the letter l)
• hr@exarnple.com ("rn" looks like "m" in many fonts)
• security@example-support.com (an extra word added to the name)
• team@example.co (the wrong ending)
• alerts@example.com.account-check.net (the real domain is account-check.net, read from the right)
• help@exаmple.com (the "а" is a Cyrillic letter that looks the same as the Latin one)

Two more things to check in the same email:

• The display name can say anything. “Example Exchange Security” might sit on top of x7k2@mail-ru.biz. Click or tap the name to see the real address.
• The Reply-To can differ. An email can arrive from an address that looks right and still send your reply to a stranger. Hit reply and look at the “To” field before you type.

A correct domain is a good start. On its own it can still be forged, which is why check 5 comes next.

5. Check the email’s sign-in results (SPF, DKIM and DMARC)

Every email carries test results that show whether it really came from the domain in the From line. Your inbox runs these tests already. You just have to look.

In Gmail, open the email, click the three dots and choose “Show original”. In Outlook, open the message, then More actions, View, “View message source”. In Apple Mail, choose View, Message, Raw Source.

Find the line that starts with Authentication-Results. A real email from example.com looks like this:

dkim=pass header.d=example.com; spf=pass smtp.mailfrom=example.com; dmarc=pass header.from=example.com

In plain words:

• SPF pass means the server that sent the email is on the domain’s approved list.
• DKIM pass means the email carries the domain’s digital signature, and nobody changed the message on the way.
• DMARC pass means at least one of those two tests passed for the same domain you see in the From line. This is the result to read first.

Warning signs: dmarc=fail, spf=fail, dkim=none, or a pass for some other domain, such as dkim=pass header.d=bulk-mailer-7.net on an email that claims to be from example.com.

Example. An email from “security@example.com” asks you to reset your password. Gmail’s “Show original” says dmarc=fail header.from=example.com. The From line is forged. Delete the email.

A DMARC pass means the email left a mail system the company approved. A hacked staff mailbox passes too, and forwarded emails sometimes fail SPF while being genuine. Treat the result as strong evidence and combine it with the other checks.

6. Paste the raw email into an AI chatbot and ask it to find the tricks

Raw email source is hard to read. A chatbot such as ChatGPT, Claude or Gemini can read it for you and point at the parts that look wrong.

1. Open “Show original” (or “View message source”) as in check 5 and copy everything.
2. Remove your own details first: your email address, name, phone number, account numbers and any codes. Replace each with “[removed]”.
3. Paste the text into the chatbot with a prompt like this one.

“Below is the raw source of an email, including headers and HTML. I think it may be a phishing email pretending to be from example.com. Please check: (1) Do SPF, DKIM and DMARC pass, and for which domain? (2) Does the From address match the Return-Path and Reply-To? (3) List every link in the HTML and show where it really points, compared with the text shown to me. (4) Are any domains lookalikes of example.com? (5) Anything else suspicious? Quote the exact lines you rely on.”

AI is good at this job. It will catch a link whose visible text says https://example.com/login while the code behind it points to https://example-com.login-verify.app, and it spots lookalike domains and hidden text far faster than most people do.

Example. You paste a “your withdrawal is on hold” email. The chatbot lists four links. Three go to example.com. The “Release funds” button goes to a domain nobody at the company owns, and that button is the scam.

Chatbots also make mistakes in both directions. An email that “looks fine” to a chatbot can still come from a hacked real account. Make it quote the lines it relies on, then check those lines yourself. Never paste passwords, seed phrases or one-time codes into any chatbot.

7. Hover over links and check when the domain was registered

Before you click anything, hover over the link on a computer, or press and hold it on a phone, to see the real address. Read the domain from the right, as in check 4.

Then look up when the domain was created. Paste it into the ICANN lookup and check the “Created” date. A company that has existed for ten years does not send security alerts from a domain registered last Tuesday.

Example. A “partnership manager” from a known crypto project emails from bd@exampleprotocol-team.com. ICANN lookup shows the domain was created nine days ago. The project's real site has used a different domain since 2021.

A brand-new domain is a strong warning sign. An old domain proves less, because some scam domains sit unused for months before they are used.

8. Check their LinkedIn the right way

A LinkedIn profile is easy to fake. A good fake still leaves gaps you can spot.

• Look for LinkedIn’s workplace check. LinkedIn lets members confirm their current employer, most often with a code sent to their work email, and the result shows on the profile. It confirms the company only. The job title is unchecked, and only some companies support it so far.
• Start from the company page. Open the company’s official LinkedIn page, go to its People tab and search for the name. Searching from the company side is harder to fool than clicking a profile someone sent you.
• Read the history. Real profiles usually have years of posts, a work history that makes sense, and connections who also work at the company. Fake ones are often new, with a few hundred random connections and a headshot that looks too perfect.
• Message the profile directly. Ask the LinkedIn account to confirm the chat you are having on Telegram or WhatsApp. Scammers often copy a real employee’s profile, and the real employee will reply confused.

A long history plus a workplace check is good evidence that the person exists and works there. It does not show that the person messaging you on another app is the same person, so always confirm on the profile itself.

9. Check the company’s team page, docs, GitHub and community admin lists

Many companies publish who speaks for them:

• The Team or About page on the official website.
• The docs or Help Center, which often list official support channels and say “we will never DM you first.”
• The GitHub organization. Open github.com/the-company and look at public members. A developer who says they work there can usually be found in that list.
• Telegram and Discord admin lists. Check the admin’s username, the part with the @, and ignore the display name. Anyone can set a display name to “Example Support | Admin”. OKX advises copying the username from the profile screen. If the “username” appears only in the bio, the account is probably fake.

Example. You post a question in a project’s Discord, and “Mod Alex” sends you a private message offering help. You check the server’s member list. The real Alex has a staff role and a different username. The account in your DMs joined the server yesterday.

Lists go stale when people leave, so when the stakes are high, confirm with check 1 as well.

10. Call back through the switchboard

If someone phones you from “the company”, hang up and call the number on the company’s website or on the back of your card. Ask to be put through to that person or department.

Example. “Your bank’s fraud team” calls and asks you to move savings to a “safe account”. You hang up and dial the number printed on your bank card. The bank has no record of the call. The FTC says bank impersonators caused the largest reported losses among business imposters in 2025, and these scams often end with victims persuaded to move money to “protect” it.

This check is hard to beat. Use another phone if you can, because some scams keep the line open after you hang up.

11. For crypto: ask for a signed message from a known wallet

Crypto has a check that nobody can fake without the private key. If a project or team member claims to control a wallet the project lists publicly, ask them to sign a message with it.

1. Find the wallet address yourself, in the project’s official docs, website or official X account.
2. Ask them to sign a message with today’s date and your name in it, such as: “I am Daniel from Example Protocol. Signed for Priya on 29 October 2026.” The date and your name stop them from reusing an old signature.
3. Check the signature on Etherscan’s Verified Signatures page. BaseScan, Arbiscan and other Ethereum-style explorers have the same tool. Enter the address, the message and the signature, and see whether it is valid.

A valid signature proves the signer controls that wallet. Whether the wallet belongs to the project depends on where you found the address, which is why step 1 matters.

12. Don’t treat a video call as proof

Plenty of people still treat a video call as the final word. Since 2024 that has been a costly habit. In January 2024, a finance employee at the Hong Kong office of engineering firm Arup joined a video call with what looked like the company’s CFO and other colleagues. Every other face on the call was a deepfake. The employee made 15 transfers worth HK$200 million, about $25.6 million, before checking with the head office, Hong Kong police said. Arup later confirmed to CNN that fake voices and images were used.

If a video call is part of the story, confirm through a second channel you found yourself: the company switchboard, the official X account or a work email you already confirmed with checks 4 and 5. Ask for a calendar invite sent from the company domain, and run check 5 on it.

13. Search their name, handle and domain with “scam”

Spend a minute on a web search:

• "@daniel_sec_team" scam
• "example-support.com"
• "Example Exchange" recruiter scam

Also look for the company’s own warnings. Many companies publish lists of fake domains and copycat tricks on their blog or Help Center.

If others have reported the same handle or domain, you know it is a scam within a minute. An empty search proves nothing, because a new scam has no reports yet.

Requests that end the conversation, whoever is asking

Some requests are scams however well the person passes these 13 checks, because a hacked real account can pass every test. Nothing makes these requests safe:

• Your seed phrase, recovery phrase or private key. No company ever needs it. Anyone who asks is stealing.
• Your password or a one-time code from SMS, email or an authenticator app.
• Remote access or screen sharing through AnyDesk, TeamViewer or a “support tool”.
• Moving money to a “safe” or “secure” wallet or account to protect it.
• Paying to receive money, such as a fee to unlock a withdrawal, a deposit to start a job, or “gas” to claim a prize.
• Installing software for a job interview. Fake crypto recruiters ask candidates to install a “video call app” or run a coding test that carries malware.
• Connecting your wallet to “verify” it, or signing a transaction you do not understand.

When you see one of these, stop. You don’t owe anyone a polite goodbye.

Three common scams, checked step by step

Scam 1: Fake exchange support on Telegram

The message. “@ExampleEx_Support” writes: “Your withdrawal is stuck. Connect your wallet at example-unlock.com to release it.”

The checks.

1. Check 2: the exchange’s checking tool says the handle is not official.
2. Check 7: ICANN lookup shows example-unlock.com was created this month.
3. The requests list: “connect your wallet to release funds” is on it.

Verdict. Scam. Block the account and report it to the exchange and to Telegram.

Scam 2: A recruiter from a crypto firm

The message. A LinkedIn profile titled “Senior Talent Partner at Example Labs” offers $180,000 for a remote developer role. The next step is a “technical test”: download a code repository and run it on your laptop.

The checks.

1. Check 4: you ask for an email from @examplelabs.com. The reply comes from a Gmail account, “because of internal policy”.
2. Check 8: nobody with that name appears on Example Labs’ LinkedIn People tab, and the profile is four months old.
3. Check 1: Example Labs’ careers page lists no such role.
4. The requests list: running unknown code from a stranger is on it.

Verdict. Scam. If you already ran the code, treat the laptop as compromised. Move any crypto to a new wallet created on a clean device, and change your passwords from that device.

Scam 3: A “partnership” email to a small project

The message. “Hi, I lead business development at Example Exchange. We’d like to list your token. Please sign the attached agreement and pay the $15,000 listing deposit.”

The checks.

1. Check 5: “Show original” says dmarc=pass header.from=example-exchange-listing.com. The email really came from that domain, and that domain belongs to someone else.
2. Check 3: you DM the exchange’s official X account. The exchange replies that it never asks for listing deposits by email and does not know this person.
3. Check 2: the exchange’s checking tool does not recognize the address.

Verdict. Scam. The email passed DMARC for its own lookalike domain, which is why reading the domain letter by letter (check 4) comes before the header check.

A checklist you can save

Before you share anything, pay anything or click anything:

• I found the company’s contact details myself. This person did not give them to me.
• I asked the company, through that channel, whether this person is real.
• I checked the handle or email in the company’s checking tool, if it has one.
• I read the email domain letter by letter, from the right.
• “Show original” shows dmarc=pass for the company's real domain.
• I checked where every link really goes, by hovering or with AI.
• The domain is more than a few months old.
• Their LinkedIn, team page or GitHub matches, and I searched from the company’s side.
• Nobody asked for a seed phrase, code, password, remote access, a fee or a software install.
• I am not rushing because someone told me to.

If any line fails, stop and confirm through a channel you found yourself.

If you already replied or paid

Act in this order:

1. Stop all contact. Do not send “one last” payment to unlock the first one. Fake “recovery” offers usually follow, often from the same crew.
2. Secure your accounts from a device you trust. Change passwords, reset two-factor authentication and log out of other sessions.
3. Move your crypto to a new wallet with a new seed phrase if you shared the old phrase or connected your wallet to a site. Revoke token approvals you do not recognize.
4. Tell the real company through its official support. The company can freeze accounts and warn other users.
5. Report it. In the US, use reportfraud.ftc.gov and the FBI’s ic3.gov. In the UK, use Report Fraud. Elsewhere, contact your national police cyber-crime unit.

FAQ

How can I verify if someone works for a company?

Contact the company through a channel you found yourself, such as its official website or official X account, and ask whether the person works there. Back that up with the company’s checking tool if it has one, a work email from the real domain that passes DMARC, and LinkedIn’s workplace check.

Can a verified X account be fake?

Yes. Anyone can buy a blue checkmark, and it says nothing about employment. On X, staff linked to a verified company show an affiliate badge, a small copy of the company’s logo next to their name. Official accounts can still be hacked, so pair the badge with a second check.

Is an email from the company’s domain always safe?

No. The From address can be forged, which is why you check for dmarc=pass in the raw headers. A real staff mailbox can also be hacked, and a hacked mailbox passes every check. If the email asks for anything on the requests list, treat it as a scam even when the headers pass.

Can AI tell me if an email is a scam?

AI is very good at reading raw email source and finding fake links, lookalike domains and failed SPF, DKIM or DMARC results. It still makes mistakes. Use it to point at the suspicious lines, check those lines yourself, and remove your personal details before you paste.

Will a real company ever message me first on Telegram or WhatsApp?

Most large crypto exchanges say their staff will not start private chats about your account and will never ask for funds, passwords or codes. Check the company’s Help Center for its own policy, and treat any unprompted private message as unconfirmed until you check it.

What is the safest way to check a recruiter?

Ask for an email from the company domain, find the role on the company’s own careers page, and search the recruiter’s name on the company’s LinkedIn People tab. Never pay a fee, buy equipment through the recruiter, or install software as part of an interview.

What should I do if someone fails these checks?

Stop replying, block the account, and report it to the real company and to the platform where you met. If you shared anything or sent money, follow the steps under “If you already replied or paid”.

Gaurav Agarwal writes about crypto security and on-chain investigations. If a scam message reached you that these checks did not cover, describe it in the comments, without personal details, and I will add a check for it.

How to Verify Someone Really Works for a Company: 13 Checks was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

TL;DR: Ethereum Foundation researchers are examining native transaction assertions that could make transaction safety depend on the final state as well as the signed instructions. The official source also identifies specific limits or future steps, so implementation and market impact should not be assumed.

Ethereum Foundation researchers are examining native transaction assertions that could make transaction safety depend on the final state as well as the signed instructions. For digital-asset markets, the important issue is less the announcement in isolation than the channel through which it could affect users, capital or network activity. The latest development deserves attention, but its relevance depends on the facts published by the organisation behind it and the work still required to make it matter.

What the primary announcement establishes

The foundation describes blind signing and uncertain execution outcomes as distinct ways users can approve actions with unwanted results. The research explores checks that inspect net balance, storage or code changes after execution and revert the transaction if a required rule fails.

EIP-7906 is a possible route, using a read-only post-transaction frame to evaluate changes and events before accepting the outcome. The foundation states that EIP-7906 is under consideration, not yet confirmed for a future upgrade, and would still require wallets or protocols to enforce a rule.

Why this could matter for crypto markets

A transaction signature proves authorisation of certain bytes; it does not by itself guarantee that a complex smart-contract interaction achieves the signer’s economic objective. Independent checks over final balances or approvals could narrow that gap. Yet they introduce design choices about who defines the rule, how much gas it costs and whether third-party software can silently omit it.

Blockchain infrastructure does not improve in a vacuum. Engineers must consider existing applications, node operators, client compatibility and how errors behave under stressed conditions. A change that appears straightforward at the protocol level can create a demanding coordination problem. That distinction matters to investors trying to separate a plausible structural change from a headline that may not immediately move price or onchain activity.

The limits of the headline

This is research and proposal-level work, not a new safety guarantee available for ordinary Ethereum transactions today. Assertions sourced from a compromised interface could still encode a harmful outcome.

Performance claims also require careful definitions. Throughput, finality, responsiveness, cost and fault tolerance are different measurements. Improving one does not automatically improve all of them, especially when a wallet, exchange or application adds its own confirmations.

The wider context

Ethereum native transaction assertions sits within a wider shift toward wallet security. This area has a recurring challenge: the benefits are easiest to describe before the operational details are complete. Different stakeholders measure success differently. A user wants clarity and predictable access; an operator wants reliable controls and manageable costs; an institution wants accountability if something fails. Those perspectives can be in tension, and the source announcement should be read with that in mind.

The distinction also shapes how to read future updates. A new partnership, proposal or software version is a verifiable milestone. Adoption, consistent performance and financial effects require additional evidence. That is why follow-up reporting should distinguish released features, planned features and measured use rather than combining them into one claim.

What to watch next

Watch for EIP governance, wallet implementations, protocol support and testing of the proposed state-difference opcodes.

The operational test comes after the proposal or release note: can different client teams implement it, can developers upgrade safely and can users rely on it when activity spikes? That is the difference between an attractive design and durable infrastructure. The next evidence should come from official implementation updates and measurable outcomes, not from assuming that a news release guarantees adoption or a token-price response.

Primary source: Ethereum native transaction assertions (published 2026-10-05).

This article was written by the News Desk and edited by Samuel Rae.

▶

Bitcoin Magazine

Bitcoin Security Expert Jameson Lopp: Cyberattacks on “Exponential” Path

Bitcoin Core just changed its security policy because AI can find bugs with a simple prompt. Jameson Lopp explains the bigger trend behind it: two and a half months of exponential growth in vulnerability discovery, attackers adopting uncensored AI models first, and security researchers who “have not been able to get a lot of rest.” He breaks down the PHP remote code execution flaw, why the fallout was smaller than expected, and why security now has to be real time and built into the development pipeline instead of a once-a-year audit.

Chapters:
0:00 Bitcoin Core Changes Its Security Policy: AI Finds Bugs With a Simple Prompt
1:04 Google’s 500,000-Qubit Estimate: Physical vs. Logical Qubits
2:00 The Quantum Timeline: “If We Have Less Than a Decade, We’re Behind”
2:57 Why We Don’t Have a Quantum Computer With More Than a Few Hundred Usable Qubits
4:26 30% of Addresses Have Exposed Keys: Who Attackers Would Target First
6:27 Why a Quantum Upgrade Will Take Years: Taproot, Consensus and Untested Cryptography
7:54 The PHP Remote Code Execution Flaw Explained
9:41 The Real Trend: Exponential AI Vulnerability Discovery and Exhausted Defenders
10:54 Security Must Be Real Time: From Annual Audits to the Development Pipeline
13:19 Hardware That Can’t Be Patched, and Why Wrench Attacks Have Topped 700

DISCLAIMER: The views and opinions expressed in this show are those of the participants and do not necessarily reflect the official policy or position of BTC Inc., Bitcoin Magazine, or any affiliated entities. This content is provided for informational and educational purposes only and should not be construed as investment, legal, tax, or accounting advice. Nothing contained in this show constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or financial instruments. Viewers should consult their own advisors before making financial or business decisions.

This post Bitcoin Security Expert Jameson Lopp: Cyberattacks on “Exponential” Path first appeared on Bitcoin Magazine and is written by Patrick Green.

▶

Bitcoin Magazine

PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic”

Government websites in France and Finland and hospital sites in the Netherlands are offline, Cloudflare is seeing attack traffic, and Britain’s National Cyber Security Centre is telling organizations to pull systems if they can’t patch fast. Bitcoin Magazine technical editor Shinobi joins Grace Remington and Sean Hagan to explain what broke in PHP, why memory management mistakes are the most common security flaw, and why AI finding the exploit in hours changes the pace of hacking but not its nature. He also answers the question every Bitcoiner is asking: is Bitcoin exposed?

Chapters:
0:00 The PHP Exploit Takes Government and Hospital Websites Offline
0:54 AI Found the Flaw in Hours: The “Cyber Pandemic” Warning
1:45 What Actually Broke: Memory Management Mistakes Explained
3:06 Why PHP Was Never Secure and Why This One Is Different in Scale
3:47 Is the AI Hacking Story Sensationalized? AI Does 95% of the Work
5:08 The Rough Adjustment Period and Why Shinobi Is Confident About the Other Side
6:41 No Serious Software Will Ship Without an AI Security Audit
7:23 Is Bitcoin Exposed? libsecp256k1, Bitcoin Core and Why Slow Development Was Right
9:30 Take Your Lightning Node Offline and Keep Your Coins in Cold Storage
12:09 Multisig and Sparrow Setup Checks, and Where to Follow Security Engineers

DISCLAIMER: The views and opinions expressed in this show are those of the participants and do not necessarily reflect the official policy or position of BTC Inc., Bitcoin Magazine, or any affiliated entities. This content is provided for informational and educational purposes only and should not be construed as investment, legal, tax, or accounting advice. Nothing contained in this show constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or financial instruments. Viewers should consult their own advisors before making financial or business decisions.

This post PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic” first appeared on Bitcoin Magazine and is written by Patrick Green.

World launched its banking-and-finance offering on October 18. For a bank considering human verification, the useful question is narrower than whether an interaction looks authentic: what exactly does the proof establish, and what must the institution still verify?

• Human uniqueness, present participation and document attributes answer different questions.
• Identity evidence does not establish permission for every financial action.
• Recovery, privacy and transaction authorization remain part of the complete control system.

A human signal is not a complete payment approval

The launch statement addresses financial institutions and AI-agent interactions. In either setting, the value of a credential depends on matching the fact it proves to the decision being made.

World’s technical overview distinguishes three credentials. Proof of Human concerns uniqueness through Orb verification. Proof of Presence uses a selfie-based check. Proof of Attributes concerns possession of a supported government document. Those mechanisms should not be treated as interchangeable assurances.

A unique person can still be an unauthorized person. A genuine employee may lack authority to approve a large transfer, and an authorized customer may be deceived about its recipient. Passing a human-verification check cannot resolve the transaction’s entire commercial context.

The wider authentication distinction is also reflected in NIST’s digital-identity guidance, which treats a biometric characteristic as insufficient on its own for the authentication combinations it specifies. That is an independent framework reference, not a statement that World has or has not met a particular certification.

Transaction-risk screening consequently remains a separate layer. Establishing a fact about a participant and evaluating the destination of a payment are complementary tasks.

Agents make the limits of delegation more important

For a hypothetical assistant paying an invoice, proving that a real customer stands behind the request would be useful. The service would still need to know which account the assistant may use, the spending limit, the permitted recipient and when its authority expires.

That permission also needs a revocation path. A customer who loses a device or changes their mind must be able to withdraw authority without relying on the agent to cooperate. A record of earlier consent cannot become unlimited permission for future transfers.

The operational challenge resembles the controls considered in wallet financial-crime guidance. Understanding the relationship behind a transfer takes more than recognizing an address or accepting a single credential.

Privacy needs the same precision. A proof may reduce the data shared in one verification step while the surrounding service still collects transaction records and account information. The complete data flow matters to the customer.

As AI-facing financial applications develop, the strongest implementations will explain the boundary clearly: which fact is proven, which permission has been granted and what additional checks govern the movement of money.

Written by the News Desk and edited by Samuel Rae.

UNDP and the Blockchain for Good Alliance announced a two-year cybersecurity programme on October 19. The initiative brings a practical question into blockchain adoption by public institutions: whether the people operating a service can prevent failures, respond to them and restore access.

• Public payment systems depend on people and processes as well as software.
• A correct blockchain transaction can still originate from a compromised workflow.
• Training outcomes should be measured through working controls and recovery exercises.

A secure ledger still needs a secure payment instruction

The programme announcement describes training and advisory support for public institutions, including work on digital payments and data protection.

Consider a hypothetical public grant system that records payments on a blockchain. The ledger can faithfully record a transfer even if an attacker changed the beneficiary’s details before an authorized employee approved it. Consensus over the final transaction cannot determine whether the original administrative instruction was legitimate.

That makes the surrounding workflow part of the security boundary. A beneficiary change, a payment approval and the act of signing a transaction may need different permissions. Combining all three under one account can make a single compromise more damaging.

NIST’s Cybersecurity Framework provides a wider reference for organizations managing cyber risk. Its relevance here is that security is an organizational responsibility, not merely a property of one technology purchased by an institution.

The distinction is visible in payment screening before settlement. Checks performed before money moves address a different problem from verifying that the network processed the payment correctly.

Recovery has to work for the people using the service

A public service can remain technically online while failing the people who depend on it. Lost credentials, unavailable staff or an unresolved account dispute can prevent a legitimate recipient from accessing funds even when the underlying blockchain continues producing blocks.

A useful exercise would therefore follow a realistic incident from first warning to restored service. Which official can pause a payment instruction? Who confirms a new beneficiary account? Which records establish what happened? How does a person obtain help if the normal digital channel is unavailable?

These are operational questions that can be tested. A training programme becomes more valuable when staff practice the decisions, rather than simply learn the vocabulary of blockchain security.

Custody and key-control arrangements provide one financial example of assigning responsibilities in advance. The software-maintenance process in Bitcoin Core’s disclosure update provides another: knowing about a repair is different from deploying it in the systems that people use.

The programme’s eventual impact will be easier to assess through completed exercises, clearer approval rules and demonstrably recoverable services than through attendance totals alone. For institutions considering digital payments, that is a useful way to judge whether capacity-building has changed day-to-day practice.

Written by the News Desk and edited by Samuel Rae.

Electrum disclosed a wallet flaw on October 24 that could turn a Bitcoin fee adjustment into an unintended payment. Its advisory explains how an apparently routine approval became dangerous.

• Version 4.8.3 fixes the flaw.
• Downloads are available from Electrum’s official site.
• Each transaction approval still needs its destinations and amounts checked.

The dangerous moment came after the original payment

The developer advisory describes malicious servers substituting an unconfirmed wallet-history entry. A user who then approved a replacement transaction to raise its fee could authorize payment to an attacker. Developers reported two affected users, including one who lost money; the disclosure does not establish a total loss figure.

That distinction makes the incident different from someone simply stealing a private key. The wallet owner could make the correct initial payment and still encounter a dangerous second signing request. Checking an address once does not authenticate every transaction a wallet might subsequently ask the owner to approve.

Electrum’s documentation explains the underlying trade-off. Its lightweight client uses servers to retrieve transaction information, including unconfirmed activity, while confirmed transactions receive separate verification. Users avoid running a complete node, but the interface still needs to treat remote data carefully.

The issue adds a practical consumer example to the software-maintenance questions raised in NewsBTC’s coverage of Bitcoin Core’s changing disclosure rules. A security update is useful only once the software people actually use incorporates it.

Version 4.8.3 closes the wallet-history weakness

The official Electrum site now lists 4.8.3 and signed downloads. The project specifically directs users to its own domain and signature-verification process. Downloading an alleged fix from an unsolicited message would introduce a separate risk at precisely the moment users are trying to remove one.

Updating does not reverse a Bitcoin transfer already confirmed to the wrong recipient. Nor should an unexplained transaction-history entry be treated as proof that a legitimate recipient has received funds. The practical task is to establish what was actually broadcast and authorized before taking further action.

NewsBTC’s reporting on shared-key Bitcoin collateral and insured custody arrangements addresses other ways of controlling asset risk. This incident concerns the signing workflow itself: even strong custody arrangements need an accurate description of what a signature will authorize.

The broader lesson is concrete. A fee increase is still a new transaction approval, with recipients and amounts that deserve a fresh check. The patched wallet reduces the danger from this specific deception; it does not make transaction review unnecessary.

Written by the News Desk and edited by Samuel Rae.

Aave Labs has clarified that its proposed V3.8 security upgrade would preserve flash-loan liquidations. The October 23 response addresses how a reentrancy guard would interact with existing integrations.

TL;DR: Aave’s proposed V3.8 guard excludes flash-loan entry points. Governance approval and security audits remain pending.

The proposal, posted October 21, adds a guard to Pool operations. Such guards constrain the ability of an external callback to enter protected contract functions again before an earlier call finishes. Aave Labs says flashLoan() and flashLoanSimple() would be excluded, allowing their callbacks to keep invoking Pool actions, including liquidations.

Why The Callback Matters

A smart contract receiving a flash loan needs time within the transaction to do something with the borrowed assets. Aave’s developer guide describes a sequence in which the Pool transfers assets, calls the receiver contract and then checks settlement conditions.

For a simple flash loan, the receiver must make the amount borrowed plus the required fee available for repayment. If the transaction cannot meet its conditions, it reverts. The broader flash-loan interface can cover multiple assets and, under permitted conditions, open a collateral-backed debt position.

Those mechanics explain why the scope of a guard matters. A liquidation integration may need to borrow an asset, repay an unhealthy position and complete the rest of its transaction before settlement. Blocking every subsequent Pool interaction indiscriminately would interfere with that sequence.

The important design question is which routes back into the protocol are intentional. A useful security boundary must account for the transaction patterns that integrations depend on, including calls that occur after assets have left the Pool but before repayment is checked.

A Transaction-Length Lock

The proposed implementation uses transient storage introduced through Ethereum’s EIP-1153. That storage remains available during a transaction and is discarded when the transaction ends. It can therefore carry temporary lock state to track whether a protected operation is already running.

The specification identifies reentrancy locks as a use case and explains why transient storage can cost less than writing temporary state to permanent storage. For a heavily used DeFi protocol, the design question includes the cost imposed on ordinary transactions as well as the protection added by the guard.

Aave’s proposed path includes feedback, a Snapshot vote, security review and an on-chain improvement proposal. Certora and additional reviewers are expected to assess the changes before that final step.

For integrators on Ethereum and other affected networks, the clarification provides a concrete compatibility point to check against the eventual code. The reviewed implementation must preserve the intended transaction sequence while enforcing the new boundary. A statement of design intent is useful during that work; deployed behavior will depend on the implementation governance ultimately accepts.

Written by the News Desk and edited by Samuel Rae.

TL;DR: Bitcoin Core has adopted faster fixes and disclosure for vulnerabilities that are easy to rediscover, including with AI. Longer embargoes remain available for other security flaws.

Bitcoin Core is changing the timetable for dealing with security flaws that an attacker can uncover with little effort. The practical question is whether waiting to explain a bug still protects users when software can rediscover it almost immediately.

A policy update merged on October 22 creates a faster route for these cases. Developer Antoine Poinsot argued that large language models have made some problems easier to find, including by identifying fixes that were intended to attract little attention.

That creates a difficult choice for the people maintaining Bitcoin software: withholding details can buy upgrade time, but delaying a usable patch can also leave operators exposed.

Faster Releases For Easily Rediscovered Flaws

The updated disclosure policy allows developers to classify a reported vulnerability as easily discoverable. A simple AI prompt is one example; the category also covers problems found with minimal effort through other means.

For those vulnerabilities, maintainers plan to issue a fix for each supported major version as soon as possible, accompanied by a security advisory. These cases bypass the usual embargo linked to severity.

The distinction matters for an exchange or payment business running its own node. A point release can deliver a targeted repair without waiting for the next major software version. An advisory also helps the operator judge whether its particular configuration is affected.

Other disclosure rules remain. Low-severity issues normally become public two weeks after a major release containing the fix. Medium- and high-severity issues generally wait until two weeks after the last affected version reaches the end of its support life. Critical vulnerabilities still require individual handling.

Less Secrecy Also Means Less Testing Time

The discussion accompanying the change makes clear that speed has a cost. Poinsot noted that accelerated mitigations will spend less time in development branches before reaching users. Developers therefore have to weigh the risk of exposing a flaw against the risk of introducing a faulty repair.

For businesses providing custody, the operational lesson is that patch readiness belongs alongside key security. Maintaining a current inventory of software versions, understanding which services depend on them and having a controlled upgrade process can make a short notice period easier to manage.

The announcement itself does not identify a new attack on the Bitcoin network. It changes how a defined category of software problem will be handled. Readers should therefore distinguish a revised security process from evidence that coins have been stolen or consensus rules have failed.

Its significance is narrower and more practical: when attackers can cheaply rediscover a weakness, keeping users on unfixed software becomes harder to justify. The response shifts toward getting a repair into their hands sooner, while making the remaining trade-offs visible.

Written by the News Desk and edited by Samuel Rae.

TL;DR: PHP released fixes for two critical flaws on October 21 and urged immediate updates. Crypto businesses using PHP-based web infrastructure should check that layer of their systems; the advisory does not announce a breach of Bitcoin or BTCPay Server itself.

Security work for a crypto business does not end at its wallet. A critical PHP update has put ordinary web-server software back on the operational agenda.

The PHP project’s October 21 advisory identifies two vulnerabilities that can allow unauthenticated remote code execution. Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project strongly encourages affected users to update immediately.

It says installations serving web requests are at risk and highlights the Apache mod_php configuration as particularly exposed. Distribution vendors may provide patched packages, so the applicable fix depends on how the software is supplied and maintained.

A Payment Stack Contains More Than Its Payment Processor

The connection to crypto commerce is practical. BTCPay Server’s official documentation explains how merchants can connect its payment system to WooCommerce, including arrangements involving an existing store or a deployed store environment.

A merchant using that combination has several components to maintain. The checkout website, its plugins, the hosting environment and the payment service have distinct responsibilities. Updating one component does not establish that every other part of the stack has been patched.

The PHP advisory is about the runtime handling web requests. It is not evidence that Bitcoin’s protocol has been compromised, and it does not by itself identify a flaw in BTCPay Server’s core software.

It does provide a reason for administrators and hosting providers to check whether any connected storefront or service uses an affected PHP installation. The relevant confirmation is that the running environment contains the fix, rather than simply that an application plugin was updated.

Follow The Maintainer’s Remediation

The PHP team’s guidance is the authoritative starting point for remediation and version-specific details. Unsupported installations need particular attention to vendor support or migration to a maintained release.

No claim about stolen customer funds or a specific crypto company’s compromise is established by the advisory. The immediate news is the release of critical fixes for infrastructure that can sit underneath a crypto payment experience.

Related Reading

• BTCPay Server Patches Critical LND Credential Bug After Lightning Wallet Drain
• Coldcard Security Notice Puts Bitcoin Wallet Entropy Risk Back In Focus
• EIP-7702 Wallet Delegation Faces Scrutiny After Phishing Research

This article was written by the News Desk and edited by Samuel Rae.