Bitcoin and Ethereum protocols lost a combined $35 million in security breaches this week, according to reports. The incidents, which struck the underlying software of the two largest blockchain networks, mark one of the bigger direct hits on protocol-level security in recent months.
The scale of the losses
The $35 million figure covers separate breaches on Bitcoin and Ethereum. Details on how the money was taken remain sparse, but the losses are notable because they hit the protocols themselves — not exchanges, wallets, or DeFi apps. That means the vulnerabilities existed in the core code that runs each network.
Neither the Bitcoin Core team nor the Ethereum Foundation has released a detailed post-mortem as of Friday. The timing isn't great: both networks have been under increased scrutiny from regulators and institutional investors who want to see stronger security guarantees.
What the protocols are saying
So far, public communication has been minimal. A short notice on the Bitcoin development mailing list acknowledged a bug and urged node operators to update. On the Ethereum side, developers mentioned the incident during a routine call but didn't give specifics. No official statements have been published on either project's blog.
The lack of detail has left users guessing. Some security researchers on social media have speculated about the attack vectors, but nothing has been confirmed. The affected teams are likely still investigating and patching before going public.
What users should know
For everyday users, the risk is indirect — unless you run a node or rely on a service that interacts directly with the protocol layer. Exchanges and custodians that hold large amounts of Bitcoin and Ethereum are likely already updating their software. Individual holders probably don't need to do anything right now, but keeping wallets and nodes up to date is always a good practice.
The $35 million loss is a reminder that even the most battle-tested blockchains can have blind spots. The teams behind Bitcoin and Ethereum are working on fixes, but no timeline for a full disclosure has been set.
