Wallet Security News

You are helping a contributor add a Wallet Security News entry to the Walletbeat project. The incident they want to record is: $ARGUMENTS (if blank, ask them for the incident URL or a description of the incident before proceeding).

You have explicit permission to create and edit files inside data/news/ and to edit data/news/index.ts and .cspell.json.

Your first actions

1. If $ARGUMENTS is blank, ask: "Which incident would you like to add a security news entry for? Please share the announcement URL or a description."
2. Read the source material. If a URL was provided, fetch the page (use the browser or curl). Extract the facts below from the article itself — do not guess.
3. Read the schema and an example file so your entry matches the project conventions:
   • src/types/content/news.ts — the WalletSecurityNews type and all enums
   • data/news/index.ts — how entries are registered and sorted
   • One or two existing entries in data/news/ as style references (e.g. data/news/2026-01-06-global-e-breach.ts for a service-provider data breach, or data/news/2026-07-17-consensys-metamask-north-korean-hacker.ts for a wallet-company incident)

After reading these, summarize the facts you extracted and confirm the classification with the contributor before creating the file.

What data to look for

From the source, extract as many of these as the article supports:

• Date of the incident / disclosure → publishedAt
• Date of the last update (e.g. the publication date of the incident report, or today) → updatedAt
• Affected wallet(s) → wallets. Map to the exact wallet ID (the filename of the wallet in data/software-wallets/, data/hardware-wallets/, or data/embedded-wallets/, e.g. metamask, ledger).
  • If the wallet is not tracked in the project (no wallet file exists), use wallets: [] — the entry is then a general incident. Do not invent an ID.
• What happened → summary (2–3 sentences, objective, and factual)
• A short headline → title

Classifying the incident

Use the enums in src/types/content/news.ts. When unsure, pick the most conservative matching value and confirm with the contributor.

• type (NewsType) — how the event is categorized:
  • HACK — exploit/attack that stole crypto or wallet funds
  • DATA_BREACH — unauthorized exposure of personal information (not funds)
  • VULNERABILITY — discovered flaw, exploited or not
  • INCIDENT — general security event not covered above
• severity (Severity) — CRITICAL / HIGH / MEDIUM / LOW, based on impact (funds at risk is high; a non-fund privacy exposure of emails is typically MEDIUM).
• impact.category (ImpactCategory) — what kind of damage:
  • SEED_PHRASE_LEAK, PRIVATE_KEY_LEAK, SIGNING_BUG, SUPPLY_CHAIN, PRIVACY_LEAK, PHISHING_RELATED, HARDWARE_VULNERABILITY, VENDOR_INFILTRATION, OTHER
• impact.fundsImpacted — true if user funds were affected or at risk, else false.
• status (IncidentStatus) — RESOLVED / MITIGATED / ONGOING / DISPUTED. Use the value matching how much the article indicates the incident is addressed.

References

Every entry needs a ref (WithRef<WalletSecurityNews>) pointing at the primary source(s):

• Prefer the official announcement / incident report from the wallet developer or the affected party (e.g. a blog post, a security advisory).

• The ref.label should be a human-readable description of the link (e.g. the article's title), and ref.url the direct URL.

• Add secondary refs (news coverage, affected-company advisories) only if they add meaningful detail.

• To cite more than one source, make ref an array of labeled ref objects (each with label + url). E.g. a blog post plus the vendor's announcement on X:

  ref: [
    { label: 'Trezor blog: Recent customer data exposed in shipping provider incident', url: 'https://trezor.io/blog/news/...' },
    { label: 'Trezor on X: Customer data exposure incident', url: 'https://x.com/Trezor/status/...' },
  ],

• refTodo / refNotNecessary are not appropriate here — the news entry should always cite the incident source.

File structure

1. Create the news file

Create a single file in data/news/:

data/news/YYYY-MM-DD-<slug>.ts

• YYYY-MM-DD = the incident's publishedAt (when the incident occurred or was first disclosed).
• <slug> = a short, kebab-case slug of the incident, matching the entry's slug field.

Example: data/news/2026-08-06-privy-metabase-security-incident.ts

The file exports a single default object as const satisfies WalletSecurityNews. Match the exact structure of existing entries — the object must include every WalletSecurityNews field (slug, type, ref, impact, publishedAt, severity, status, summary, title, updatedAt, wallets). Dates use YYYY-MM-DD strings.