PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Crypto wallet security: Best Practises

hackenproof.com | blog | #web3 | #secrets | #malware | #phishing | #best-practices | #private-keys | #security-guide | #crypto-wallets
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Best practices for crypto wallet security, framed by the Atomic Wallet breach: safeguarding private keys and seed phrases, and understanding phishing, malware and key-generation risks.
Published
Collected

Related coverage

blog · certik.com
Preparing for a Web3 Penetration Test: What to Expect Before, During, and After
reparing for a Web3 penetration test? Here’s what happens before, during, and after an engagement, and how to get the most value from yours.
blog · certik.com
How to Prepare for a CCSS Audit
The CryptoCurrency Security Standard (CCSS) certifies how businesses protect private keys across ten control aspects. This guide explains what the audit covers, the three levels, and how to prepare.
vulnerability · volexity.com
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware.
research · volexity.com
OceanLotus: Extending Cyber Espionage Operations Through Fake Websites
Since Volexity’s 2017 discovery that OceanLotus was behind a sophisticated massive digital surveillance campaign, the threat group has continued to evolve. In 2019, Volexity gave a presentation at RSA Conference […]
blog · hackenproof.com
Aptos Move Smart Contract Security: How Object Refs Leak and Global Storage Breaks
Unchecked borrow_global_mut, leaked object refs, and Block-STM races break Aptos protocols. See the $25.5M Thala exploit and an Aptos/Supra audit checklist.
blog · hackenproof.com
Sui Move Smart Contract Security: How Shared Objects Leak and Ownership Breaks
Sui’s VM protects owned objects, not shared ones. See how shared-object, Kiosk, and PTB bugs break protocols, plus a full Sui Move audit checklist.
Back