BTCPay Server 2.4.7 Security Release Adds Urgency for Self-Hosted Merchants
TL;DR: BTCPay Server’s 2.4.7 release published in late October includes security fixes following a broad review of reported issues. Disclosure of a serious issue is not proof that it has been exploited in the wild. The appeal of self-hosting is genuine control over funds and infrastructure. The hidden cost is that responsibility cannot be outsourced…
Coinbase Explains Multi-User Architecture as Crypto Accounts Become More Complex
TL;DR: Coinbase published an engineering account of its move toward multi-user infrastructure on October 29, describing how one account or organisation can involve several people with different privileges. A blog describing architecture cannot prove that every application and endpoint is free of bugs. Account controls rarely make headlines until something fails. But the ability to…
Hong Kong Launches Post-Quantum Preparation Toolkit for Banks
TL;DR: The Hong Kong Monetary Authority and the Hong Kong University of Science and Technology announced a post-quantum cryptography assessment toolkit on November 2. Post-quantum migration is not the same thing as making every blockchain or bank system instantly quantum-secure. Good security planning is often unglamorous. Discovering where keys are issued, which partners rely on…
Chainalysis Describes Recovery Efforts After Mercado Bitcoin Security Incident
TL;DR: Chainalysis said on November 2 that it had supported tracing and containment efforts following a security incident involving Mercado Bitcoin. Incident estimates can differ between early reports, technical responders and the affected platform. The difference between “identified”, “frozen” and “returned” is easy to lose in fast-moving security coverage. It matters to victims because only…
Chainalysis Discloses Separate October 30 Security Incident Involving User Data
TL;DR: Chainalysis disclosed a security incident on October 30 affecting a subset of customer-related information, including names, email addresses and certain user or role labels, according to the company. “No evidence of compromise” is not proof that a particular system was mathematically impossible to access. The apparent boundary between identity information and investigative data is…