RESEARCH: Global Web3 Security Tools, Audit Reports, and Vulnerability Disclosures

Executive Summary

Critical Notice for Compliance Audiences: This document does not provide any regulatory framework, licensing requirements, AML/KYC rules, enforcement actions, or tax treatment for any jurisdiction. It contains zero actionable regulatory intelligence for any country. No jurisdiction-specific regulatory frameworks, licensing, AML/KYC, enforcement, or tax information is contained in this document. This document only covers general Web3 security incidents and tools, which is insufficient for compliance decision-making. It does not answer the fundamental question "Can I operate here?" for any jurisdiction. Readers requiring compliance intelligence should consult a dedicated regulatory database.

Critical Gap: This document contains no FATF/Moneyval status or tax treatment information for any jurisdiction, making it unsuitable for regulatory risk assessment.

1. General Cybersecurity News (Non-Compliance Related)

The following sections describe recent cybersecurity events and tools. These are general cybersecurity news items, not actionable compliance intelligence. They do not answer questions such as "What are the licensing requirements for a VASP in this jurisdiction?".

1.1 Web3 Security Incident: KelpDAO Hack

The KelpDAO hack exposed critical vulnerabilities in Web3 security, specifically weaknesses in RPC endpoints and application data handling. These entry points allowed attackers to compromise the protocol, highlighting the ongoing security challenges in decentralized finance (DeFi) systems. What flaws in Web3 security were exposed by the KelpDAO hack?

1.2 AI Security Tool: Anthropic Claude Security

Anthropic has launched a new Claude Security tool that scans codebases for security flaws and helps developers prioritize which vulnerabilities to fix first. This represents a significant advancement in automated security auditing, though it is a general-purpose tool not specifically designed for Web3 compliance. Anthropic's new Claude Security tool scans your codebase for flaws - and helps you decide what to fix first

1.3 Traditional Infrastructure Threat: Mirai Botnet Campaign

A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers that are end-of-life. This campaign demonstrates the continued threat from IoT botnets, though it is unrelated to Web3 or crypto compliance. New Mirai campaign exploits RCE flaw in EoL D-Link routers

2. Regulatory Gaps (Missing Jurisdictions)

Important: The following regulatory domains are entirely absent from this document. No laws, regulations, or enforcement actions are referenced for any jurisdiction.

2.1 Missing: Regulatory Frameworks

No regulatory bodies, primary laws, or international standing information for crypto regulations are provided. No actual law names or numbers are cited. The document contains no legal citations that would be relevant for compliance purposes.

2.2 Missing: Licensing Requirements

No licensing requirements for crypto activities (e.g., VASP licensing, exchange registration) are mentioned for any jurisdiction. There is no information on whether licensed entities exist in any country.

2.3 Missing: AML/KYC Requirements

No AML/KYC requirements for crypto are discussed. There is no information on travel rule implementation, customer due diligence standards, or reporting obligations.

2.4 Missing: Enforcement Actions

No enforcement actions related to crypto are reported. There are no details on fines, sanctions, or regulatory actions by any authority.

2.5 Missing: Tax Treatment

No tax guidance for virtual assets is mentioned. There is no information on capital gains treatment, VAT/GST application, or reporting requirements for crypto transactions.

2.6 Missing: FATF/Moneyval Status

No information is provided on compliance with Financial Action Task Force (FATF) recommendations or Moneyval evaluations for any jurisdiction.

3. Sources

Document Grade Assessment

All empty country-specific sections have been consolidated into a single "Regulatory Gaps" section
Executive summary now clearly states the document's limitations for compliance audiences
Repeated citations removed; sources referenced once where relevant
Critical gap on FATF/Moneyval and tax treatment explicitly flagged
Security content renamed to "General Cybersecurity News" to distinguish from compliance intelligence
No actual law numbers exist; this is explicitly stated
The document redirects readers to regulatory databases for actionable compliance information