Wallet

Developers are deploying AI agents to monitor and secure smart contracts after crypto platforms lost over $3.4 billion to hacks in 2025. OpenAI's EVMbench now tests whether these systems can detect, fix, or even exploit live blockchain vulnerabilities. Early findings show AI is more effective at exploitation than safe remediation, raising concerns it could empower both defenders and attackers across decentralized finance.

Ether.fi said in a Wednesday announcement it will migrate its non-custodial ether.fi Cash card product from Scroll to OP Mainnet. Over the coming months, the team plans to move ~70,000 active cards, ~300,000 accounts and millions in user TVL, citing OP Mainnet's liquidity, broader asset access and the ability to cover gas fees.

HYLQ Strategy Corp completed an OTC acquisition of 18,333,334 qONE from the Quantum Labs Foundation, totaling $100,000 inclusive of bonus tokens, per a company press release. The USDC-settled deal backs qLABS’ quantum-resistant stack on Hyperliquid; qONE launched on February 6, 2026, and qLABS highlighted the announcement on February 18, 2026.

Kamilah Stevenson, host of a wealth-focused YouTube show, argues that crypto custody is less about passive storage and more about ensuring investors can act when markets or regulations shift. She contrasts retail's focus on safety alone with institutional practices that prioritize segregation, bankruptcy-remote structures, OTC execution, and tax-advantaged wrappers. The core message is that the main risk in a more regulated environment may be being locked into setups that limit movement, borrowing, or portfolio rotation when needed.

On Feb. 13, cybersecurity expert Dmitry Smilyanets reported receiving a fake Trezor-branded letter demanding an "Authentication Check" by Feb. 15 or risk device restrictions, with a QR code leading to a phishing site. The scam, which mislabels Trezor CEO Matěj Žák as "Ledger CEO," targets hardware wallet users whose postal data was exposed in past breaches and attempts to trick them into entering seed recovery phrases. Similar physical letters and QR-based attacks have been reported against Ledger users since at least October last year, following multiple data leaks impacting both Ledger and Trezor customers.

On February 16, 2026, OpenEden said attackers compromised the DNS for openeden.com and portal.openeden.com, creating a phishing risk for anyone accessing those domains. The team sclaimed reserves remain verifiable via Chainlink Proof of Reserve, but users could lose assets if they connect wallets to spoofed pages. The team is investigating and advised against interacting with the sites.

According to the report, scammers are mailing hardware wallet users letters that mimic Trezor and Ledger notices, pushing recipients to scan QR codes and enter recovery phrases. The messages cite urgent security checks and route to clone setup pages that accept 12-, 20-, and 24-word seeds. Hardware wallets are not compromised, but revealing a seed enables immediate wallet takeover.

Ledger and Trezor hardware wallet users are being targeted in a postal QR code scam that attempts to steal their recovery phrases. Criminals are mailing fake compliance letters with a February 15 deadline, pushing users to scan QR codes that lead to phishing sites and submit their seed phrases. The fraudulent sites impersonate official domains and warn of lost wallet functionality to pressure victims into handing over full access to their funds.

X outlined plans on February 14, 2026 to let users execute stock and crypto trades directly from their feeds by tapping ticker symbols like $BTC or $TSLA. The in-feed tool is part of a broader push that includes money-transmission licenses in more than 40 U.S. states, a Visa payments tie-up, and internal tests of the X Money wallet.

On February 14, 2026, researchers at iVerify reported a mobile spyware platform called ZeroDayRAT that can fully compromise Android and iOS devices. The tool is reportedly sold on Telegram and lets attackers control phones, capture GPS data, access notifications from banking and crypto apps, and intercept SMS one-time passwords. Victims are infected through links in smishing texts, phishing emails, fake app stores, and messaging apps.