Blockchain news and engineering summaries

A major supply chain attack compromised over 30 WordPress plugins from the 'Essential Plugin' library. After being sold on Flippa to a commercial buyer, the plugins were updated with a dormant backdoor that triggered months later, using blockchain-based command-and-control to inject spam. WordPress.org eventually closed the plugins, but users must manually clean their compromised wp-config.php files.

PeerWeb is a decentralized website hosting platform that leverages WebTorrent technology to distribute content across a peer-to-peer network. By removing the dependency on centralized servers, the platform ensures that websites are censorship-resistant and maintain high availability through community seeding. Users can easily host sites by dragging and dropping folders, which generates a unique torrent hash. PeerWeb includes advanced features like smart caching for improved performance, debug modes for developer troubleshooting, and security measures integrated via DOMPurify. Its architecture represents a significant shift toward a decentralized web, where magnet links and trackers replace traditional hosting infrastructures.

A malicious pull request in the Egonex-AI/Understand-Anything repository uses a supply chain attack targeting Astro’s build pipeline. The attacker hides an obfuscated payload in astro.config.mjs, which executes during build or dev processes. It beacons C2 servers and uses Tron/BSC blockchain transactions as a command-and-control relay to fetch and execute secondary payloads, mirroring the PolinRider campaign.

Researchers discovered a social engineering campaign targeting finance and crypto sectors using a malicious Obsidian vault. Victims are tricked into enabling community plugins, triggering the PHANTOMPULSE RAT. This malware features a sophisticated blockchain-based C2 mechanism for resilience, enabling full system control on Windows and macOS. Defensive measures include plugin restrictions and user training.

On-chain investigator zachxbt has publicly identified an individual known online as 'Lick' as John Daghita, allegedly involving him in cryptocurrency theft. Following the exposure, Daghita attempted to erase his Telegram history and sent unsolicited funds from a theft-linked address to zachxbt's public wallet. The investigation highlights a significant conflict of interest, as John Daghita is the son of Dean Daghita, owner of Command Services & Support (CMDSS). CMDSS recently secured a contract with the US Marshals to manage seized cryptocurrency assets. In response to the allegations, CMDSS scrubbed its digital presence, raises serious questions regarding the vetting process for government contractors handling sensitive digital assets and the Department of Justice's oversight of their service providers.

Freenet is a peer-to-peer decentralized platform that enables unstoppable communication, collaboration, and commerce. By utilizing open protocols and a small-world network, it eliminates the need for central servers. Developers can build serverless, cloud-free applications using Rust and TypeScript, while users benefit from private, censorship-resistant, browser-based web experiences.

Monero uses RandomX for its proof of work, a mechanism designed to be CPU-friendly by executing random programs on a specialized virtual machine. Unlike Bitcoin's SHA-256, which favors ASICs, RandomX forces miners to utilize memory-intensive operations, floating-point math, and branch handling, effectively neutralizing the advantage of specialized mining hardware to ensure network decentralization.

Bitcoin miners face a crisis, with average production costs of $88,000 against a $69,200 market price. Rising energy costs from geopolitical tensions have caused hashrate drops and a 7.76% difficulty decline. Many miners are diversifying into AI and high-performance computing to mitigate losses as forced liquidations continue to impact the market structure.

The emergence of 'Pump and Dump Software' represents a cynical convergence of generative AI and cryptocurrency scams. Following the 2025 boom in 'vibe coding'—where large language models allow individuals to generate massive amounts of code without deep technical understanding—a new fraudulent pattern has emerged. Developers create unmaintainable, AI-generated software blobs at a high token cost, then partner with crypto entities to launch associated shitcoins. Through aggressive astroturfing and FOMO-driven marketing, they lure unsuspecting users and investors before liquidating the currency and abandoning the project. This cycle exploits the rapid pace of the tech industry, leaving users with broken tools and investors with worthless tokens. Projects like 'gastown' and Clawdbot are cited as examples of this deceptive trend, highlighting the need for critical evaluation of hyped AI tools.

Prediction markets like Polymarket are emerging as significant national security risks. Suspiciously timed bets preceded military strikes in Iran and Venezuela, suggesting potential insider trading by individuals with classified knowledge. While these platforms offer forecasting signals, they also allow adversaries to anticipate secret operations, potentially leading to retaliation or Compromised military objectives through financial incentives.

A cryptographically-relevant quantum computer (CRQC) poses an existential threat to Bitcoin by breaking current signature schemes. While the exact timeline is uncertain, the risk necessitates proactive planning. The upgrade requires complex consensus changes, wallet migrations, and ecosystem coordination. Experts argue that prioritizing post-quantum cryptographic development is essential for Bitcoin's long-term survival and security.

Y Combinator, the world-renowned startup incubator, has announced a significant shift in its funding strategy by offering its spring cohort the option to receive their $500,000 investment in USDC, a stablecoin issued by Circle. This move, led by visiting partner Nemil Dalal, reflects a growing commitment to on-chain capital raising and the broader crypto ecosystem. Founders can choose to receive these tokens across multiple blockchains, including Ethereum and Solana. Despite the current volatility in the broader cryptocurrency market, stablecoins are increasingly viewed as essential financial infrastructure for modern startups. This transition aligns with major industry moves, such as Stripe's acquisition of Bridge and interest from tech giants like Cloudflare. Y Combinator aims to institutionalize stablecoin use for its operational speed and lower transaction costs, signaling a future where blockchain-based funding becomes standard for tech entrepreneurs globally.

HardenedBSD has begun migrating its code repositories to Radicle, a decentralized code collaboration platform. While core functionality is operational, including basic ports tree integration, the project is still addressing performance tuning for large repositories. Users can now seed and clone official HardenedBSD repositories from their dedicated node infrastructure.

The fil-qt repository is a specialized C++ framework tailored for local development workflows within the Filecoin ecosystem. It leverages the Qt framework to provide a cross-platform graphical user interface for managing Filecoin actors and network interactions. Key features include tools for visualizing state transitions, debugging smart contracts, and streamlining the deployment process for developers working on the Filecoin Virtual Machine (FVM). By integrating these technical components, the project aims to lower the barrier to entry for building decentralized applications and maintaining robust nodes in a local testing environment.

The ATProto architecture faces a critical security vulnerability because Personal Data Server (PDS) operators hold user signing and rotation keys. This allows operators to impersonate users across the entire ecosystem or lock them out entirely. To improve sovereignty, users should be prompted to enroll self-controlled rotation keys by default to mitigate trust-based centralization risks.

The Next Generation Internet (NGI) initiative has awarded grants to 67 open-source projects. These initiatives span the entire technology stack, from secure hardware and privacy-preserving payment systems to decentralized communication tools and AI. Funded by the European Commission, these projects aim to promote digital autonomy, human-centered internet standards, and a resilient, open information infrastructure.

The Resolv DeFi protocol lost $25 million after attackers compromised their AWS KMS environment to access privileged signing keys. By exploiting this off-chain weakness, hackers bypassed smart contract logic to mint 80 million unbacked USR tokens. This incident highlights the critical need for real-time, on-chain threat detection to safeguard against vulnerabilities in off-chain infrastructure.

Sneakerweb is a permissionless, peer-to-peer web publishing protocol that replaces DNS and traditional hosting with physical storage media. By using the Willow protocol, it ensures data integrity and enables offline browsing and sharing via .snk files. Users manage content through a dedicated CLI, allowing for local storage, publishing, and synchronization without centralized infrastructure.

The 100 Days of Solana program is a free, structured challenge designed to help developers transition from Web3 curiosity to building live applications. Through weekly thematic arcs and collaborative community support on Discord, participants learn to build, ship, and explore the Solana ecosystem, benefiting from its fast, low-cost transaction environment.

Users of H&R Block Business 2025 software are warned of a critical security vulnerability. The application installs a rogue root certificate with an accessible private key, exposing systems to potent Man-in-the-Middle attacks. The certificate persists after uninstallation, and H&R Block has failed to remediate the issue despite internal awareness.