📝NOXCAT On-chain Security Weekly｜2026.05.18-05.24

The playbook of on-chain exploits is shifting. If you aren't adapting, you’re subsidizing hackers.

-Bankr ($150K): AI agents as a new attack surface. No contract exploits—just prompt injection exploiting the AI into signing away funds.

-Verus Bridge ($11.58M): Typical bridge flaws. A zero-value fake transfer slipped through as 8 out of 15 notaries blindly signed a forged state root.

-DPRK Attack ($5.2M): Public balances make wealth a target. Lazarus is shifting from protocol exploits to precision-targeting high-net-worth individuals.

This week proves why NOXCAT holds the line:

Vs. AI Blind Signing ➡️ Native non-custodial tech. Private keys never leave your hands; no third party can authorize for you.

Vs. Physical Coercion ➡️ Panic Mode fakes asset displays and freezes the main account for 24 hours.
Security isn't about trusting AI guardrails or notary conscience—it's about baking defenses into the infrastructure.

Feel Nothing, Do Everything😊😊

📝 NOXCAT On-Chain Security Weekly｜2026.05.25–05.31

This week's attacks didn't break contracts. They broke assumptions.

· Squid Protocol ($ 3M+): Exploited right after a $6M funding announcement. A routing module flaw drained 86 Gnosis Safe wallets — proof that protocol integrations are becoming the new attack surface.

· Uniswap Phishing ($400K): Fake Google Ads. Cloned UI. One "Approve" click. The most dangerous attacks now wear the most familiar faces.

· NY BTC Lawsuit (39,000 wallets): No hacker needed. Courts are pursuing dormant wallets under "lost-property law" — your assets could be claimed legally, without anyone touching your keys.

Feel Nothing, Do Everything😊😊

📝 NOXCAT On-Chain Security Weekly｜2026.06.01–06.07

65% of crypto theft doesn't need a single line of malicious code. It just needs your trust.

· Social Engineering ($17B, 2025): The #1 attack vector isn't a zero-day — it's human nature. Fake support reps, phishing links, cloned identities. The door wasn't broken. The user opened it.

· May 2026 Recap ($81.7M, PeckShield): 40 incidents in 31 days. Permission exploits. Private key compromises. Smart contract bugs. Social engineering. Every vector, every week, all at once.

· Sui Mainnet Outage: Three upgrade-related failures. No funds rolled back — this time. But if assets were mid-flight when the chain went dark, there was no fallback. Infrastructure risk is asset risk.

· Zcash Orchard Vulnerability (AI-discovered): AI found what auditors missed — a flaw that could mint unlimited tokens out of nothing. $4.5B erased after disclosure. Vulnerability discovery is now automated. Remediation still isn't.

Feel Nothing, Do Everything😊😊

📝 NOXCAT On-Chain Security Weekly｜2026.06.08–06.14

A leaked key. A governance vote. An AI script. None of them are exploits — and all of them moved real money this week.

· Humanity Security Incident: A private key leaked from a foundation member compromised the bridge and liquidity pools. No malicious code involved — one exposed key was enough to put the entire system at risk.

· Token of Power Governance Attack ($1.58M): The attacker didn't break anything. They simply acquired over 50% of governance power, passed a proposal to mint new tokens, and drained the Balancer pool — using the protocol's own rules against it.

· Chainalysis AI Report ($36.7M, 6 months): Attacks on unverified contracts are accelerating. AI now reads bytecode faster than any human researcher. The old bottleneck — too few people looking for bugs — no longer exists. Everyone has AI now.

Feel Nothing, Do Everything😊😊

📝 NOXCAT On-Chain Security Weekly｜2026.06.15–06.21

A trading bot. A quarterly record. A developer's npm package. None of them were smart contract hacks.

· ETH's Largest MEV Sandwich Bot Loses $7.5M: The flaw wasn't in the contract — it was in the bot's own trading logic. Automated systems running on-chain are targets too.

· Q2 2026: Crypto's Most Attacked Quarter (70 incidents, DefiLlama): Not one big breach — just relentless frequency. The industry is no longer bracing for the next catastrophic hack. It's absorbing a constant stream of smaller ones.

· Supply Chain Attacks Hit Developers (Checkmarx): One malicious npm package. Thousands of projects at risk. The attack surface has moved upstream — from protocols to the people building them.

This week's pattern: the perimeter keeps expanding. Smart contracts were never the only weak point — just the most obvious one.

Feel Nothing, Do Everything😊😊

📝 NOXCAT On-Chain Security Weekly｜2026.06.22–06.28

· Taiko Bridge Exploited ($1.7M): A flaw in the verification process, not the protocol logic.

· Bitcoin Depot Breached (~50 BTC, $3.6M): Confirmed infrastructure breach — not a blockchain exploit.

This week's pattern: contract-level gaps and infrastructure breaches are both back in play. The attack surface isn't narrowing to one category — it's expanding across every layer.

NOXCAT Wallet Co-Builder Recruit🙋‍♀️🙋

Hey everyone! 🎉👏 We’re about to drop the beta version of the NOXCAT Wallet APP, and we’re looking for our very first batch of Co-Builders from the community!

Cross-chain swaps, staking, on-chain escrow, and social transfers—all in one account, with zero entry barrier and smooth UX.

Co-Builder Perks:
·Direct line to the team via an exclusive TG group
·Genesis Badge (limited to the first 500)
·50% off on-chain escrow fees
·Become an arbitrator and earn USDT
·Priority access to all upcoming events

👉 To join: Follow NOXCAT official X + Retweet the giveaway post
🎁 Raffle on July 3rd | 20 winners | 5 $NOX each

Link：https://x.com/_noxcat_/status/2071466453421936827?s=20

NOXCAT Wallet has partnered with Pleasing Market 🎉🎉

Through this collaboration, users will be able to purchase physical gold directly within NOXCAT Wallet in the future, further expanding NOXCAT’s RWA use cases and bringing real-world assets into a more accessible on-chain experience.

Stay tuned for more updates.

📝 NOXCAT On-Chain Security Weekly｜2026.06.29–07.05

· 2026 H1 Security Report: 207 attacks, ~$972M in losses — with risks moving beyond smart contract bugs.

· June Security Incidents: 40 cases, ~$75.87M lost — bridge attacks, MEV bots, and private key-related incidents remained active.

This week's pattern is clear: Web3 security is no longer just about patching contracts.

Private keys, infrastructure, endpoints, and user workflows are becoming the new attack surface.

📝 NOXCAT On-Chain Security Weekly | 2026.07.06–07.12

-BonkDAO Governance Attack: The hacker spent $4 million to acquire voting power, successfully passing a "legitimate" proposal to siphon $20 million from the treasury. No exploits, just pure manipulation—the attacker completely outplayed the DAO's economic model and democratic processes.

-Summerfi Automated Vault Exploit: A protocol vulnerability led to $6 million DAI being drained from automated vaults. While automation boosts efficiency, it seems it also fast-tracked the hacker's path to financial freedom.

-Arcadia Finance Flash Loan Attack: By expertly manipulating oracle pricing and liquidation logic, the attacker pulled off a risk-free $6 million heist using a $64.8 million flash loan. An old playbook, but still highly effective.

Everyone is talking about CASHCAT.

But the bigger story is Robinhood Chain

If you're exploring the ecosystem, NOXCAT already supports bridging assets to Robinhood Chain.

One wallet.
Cross-chain.
Ready when you are🐱🐱

Official DApp Link👉 https://dapp.noxcat.io

NOXCAT Wallet App Beta: First Official Incentive Campaign Now Live with a 10,000 USDT Pool Open!🔥🔥

1.Welcome Bonus: Register, purchase, and stake any amount of $NOX to get 5 $NOX credited directly to your account.

2.Referral Rewards: Secure 5 $NOX for every 2 successful referrals you bring in.

Both events can be completed concurrently with rewards fully stackable.

Join now and grab your share of the pool!

（Download link: https://noxcat.io/download

For event details, please refer to the official announcement: https://noxcat.io/announcements

📝 NOXCAT On-Chain Security Weekly | 2026.07.13–07.19

-U.S. Stablecoin Regulation: Stablecoins are moving beyond trading and toward mainstream payment infrastructure. Compliance is becoming part of Web3.

-Humanity Protocol: A compromised laptop led to a $36M loss—Multi-Sig only works when keys are truly isolated.

-Ledger Phishing Scams: Never enter your Recovery Phrase anywhere. One fake “official” letter can drain everything.