Crypto is planning for AI that can break wallet signatures. All the fixes on the table share one flaw. Our CTO Danor @An7i21 Cohen on what actually holds.

📝 Kerberus 2025 Recap Acquisitions, expansions, and the stat we're most proud of: 0 losses for our users now in 3+ years 🔥 Here's how the year unfolded 🧵

December's Damage Report $51.8M lost to address poisoning $10.1M lost to DeFi phishing 52.55% of the $117.8M total - all avoidable How? Sentinel3 with 99.9% detection rate & address poisoning protection If every Web3 user had it, this month would've looked very different

Kerberus Web3 Security Weekly Recap 📝 $7M stolen from Trust Wallet users, Flow blockchain halted for 30 minutes, Aave's $10M revenue dispute exploded, and much more Here's what you need to know 👇 1️⃣ Trust Wallet Chrome Extension Hack Someone obtained a leaked Chrome Web Store API key and pushed version 2.68, disguised as a normal update. Hidden within what appeared to be analytics code was a seed phrase stealer that activated when you unlocked or imported a wallet. Only the Chrome extension got hit. Mobile and hardware wallet users were completely safe. xitter.cf/EowynChen/status/20046… They patched it to v2.69, took down the attacker's server, and CZ immediately said they'd cover everything. “Funds SAFU.” They've identified 2,596 actual victims, but over 5,000 people are filing claims. xitter.cf/EowynChen/status/20050… The crypto community DDoS'd the hacker's data-collection site, slowing the attack. If you used Trust Wallet's Chrome extension between Dec 24-26, check if you're on the affected list. Real victims are getting 100% reimbursed. xitter.cf/k_firsov/status/200457… 2️⃣ Flow Blockchain Exploit On Dec 27, Flow Blockchain got hit with an execution-layer exploit. The attacker exploited a bug to mint fake tokens and bridged approximately $3.9M off-chain, eventually laundering it to BTC. Important to note: no actual user funds were stolen. Real balances stayed completely safe throughout. The team shut down the network within 30 minutes to limit damage, but $FLOW still tanked amid fear. They initially planned a rollback, but dropped it after bridge operators pushed back. xitter.cf/alexsmirnov/status/200… Instead, they went with a surgical fix: burn the fake tokens and temporarily freeze the tiny fraction of accounts (under 0.1%) that received them. xitter.cf/findlabs/status/200502… Phase 1 restart went live on Dec 29. The Cadence side is now fully operational, covering 99.9% of activity, including most apps and NFTs. The EVM side remains read-only during final checks, and bridges are coming back gradually. xitter.cf/flow_blockchain/status… 3️⃣ Aave Governance/Revenue Drama Aave Labs quietly integrated CoW Swap as the default on their frontend on Dec 4. A week later, a delegate discovered that fees estimated at $200K/week were being sent to Labs wallets rather than the DAO treasury. Previously, Labs had voluntarily contributed ~$1.1M in 2025. governance.aave.com/t/aave-c… The community erupted over "stealth privatization" after Labs built the frontend using DAO's brand and liquidity without a governance vote. Labs argued they self-funded the frontend, and that protocol revenue ($140M annually to the DAO) remained untouched. A rushed proposal to transfer IP/brand to DAO failed spectacularly during the holidays. Price chart showing the damage: xitter.cf/duonine/status/2003041… Founder Stani bought $15M of AAVE personally and committed to clearer alignment going forward. Drama is cooling off now with both sides talking. No user funds or security were affected. xitter.cf/StaniKulechov/status/2… 4️⃣ Gnosis Chain Hard Fork Recovery Gnosis Chain recovered $9.4M from the Balancer hack through a hard fork, freezing hacker addresses and moving funds to a safe wallet for victims. Smooth execution, but raises questions about immutability vs protection. xitter.cf/gnosischain/status/200… 5️⃣ Stealka Malware Warning The new "Stealka" malware is spreading via fake game cheats and cracks, targeting 80+ crypto wallets, including MetaMask and Phantom. Stay away from sketchy downloads. xitter.cf/kaspersky/status/20038… 6️⃣ Private Key Leak Drain Two wallets were drained of $2.3M in USDT after private keys were leaked; the attacker swapped to 757 ETH and ran it through Tornado Cash. This is why you need hardware wallets and should never store your seed phrases digitally. xitter.cf/peckshieldalert/status… 7️⃣ Lido DAO adopts SEAL agreement Lido DAO has adopted the SEAL Whitehat Safe Harbor Agreement, allowing ethical hackers to recover funds during live exploits without fear of lawsuits. Unanimous vote protects $26B in staked ETH and joins 20+ protocols covering $45B+. xitter.cf/LidoFinance/status/199… 8️⃣ CertiK 2025 Skynet Hack3d Report Web3 lost $3.35B in 2025 across 700+ incidents according to CertiK's new security report. Private key compromises and social engineering attacks were the primary culprits, while supply-chain attacks caused the most damage. xitter.cf/CertiK/status/20034656… That's all for this week's recap 🔚 Thank you for reading! About us: Kerberus is the market-leading Web3 security solution for detecting scams, phishing, and hacks in real time. 0 user losses for 3+ years and up to $30,000 in transaction coverage. See you next week 🫡 Stay protected, stay informed, and remember as always: You make the profits, we keep them yours 🛡️

From the entrance gates to the builder halls, Kerberus guarded every interaction at Solana Breakpoint. On-chain. On-site. In real time. Here’s how it was 🛡️👇