371 articles · page 1 of 13
An attacker minted 19 million THEO on Base without authorization and swapped the tokens for roughly 700.8 ETH before bridging the proceeds to Ethereum, PeckShield's on-chain analysis shows. Autheo says the suspected exploit involves its cross-chain bridge and has warned users.
Security firm ExVul says an attacker sponsored a transaction carrying the victim's valid EIP-7702 authorization, delegated the wallet's execution to malicious code, and withdrew 9.12 ETH plus TAPEETH rewards in a single transaction. The delegation reportedly remains active, leaving new deposits at risk.
Ledger has asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and pull devices from shelves while it investigates where tampering occurred. Separately, Mark Karpelès reports a suspected implant in a Ledger Flex bought at Singapore Airport from a different retailer.
The Information reports OpenAI is in early-stage acquisition talks with Trail of Bits, the New York security firm known for open-source vulnerability research and smart-contract audits of major DeFi protocols. Neither company has confirmed the discussions, and early talks may not result in a deal.
OneKey has revoked the Malaysian reseller's authorization, halted new dealer signups and offered free replacements for devices sold through CryptoBilis since March — after Ledger confirmed an unauthorized hardware implant in a reseller-sold device tied to an estimated $86M–$93M in thefts from roughly 300 wallets.
iVerify documents a new DarkSword variant that extracts keychain data into JSON on-device, steals cryptocurrency wallet data and accepts real-time instructions from attacker infrastructure — while the infection route, targeted wallets and victim counts remain unknown.
Today's roundup: NEAR Intents reveals most of its stolen $3.8M came back in Monero and is struggling to convert it; attackers exploit AhsayCBS backup flaws to plant webshells and an XMRig miner; the tampered-Ledger tally passes $86M as OneKey purges the reseller; and a two-week loss count reaches $422M.
Treasury Secretary Scott Bessent said the US is 'probably gonna seize a billion dollars of crypto this week' as part of its economic isolation campaign against Iran. No wallet addresses, forfeiture filings, or exchange disclosures have accompanied the statement, and past Bessent claims of seized amounts have shifted between tellings.
Bitquery's live tracing shows the suspected CryptoBilis attacker pushed another 1,736 ETH through Tornado Cash and Zcash on October 10, exiting into 5.35 million USDC that Circle can freeze — while 5.2 million USDT mixed with other clients' funds was paid into Binance via OTC-style wallets. About $81 million of the $93.2 million taken remains traceable on-chain.
The Ontology (ONT) network stopped producing blocks on Saturday after an emergency report flagged a potential security risk involving a project built on the blockchain. The pause was coordinated with the vast majority of consensus nodes, and no public resumption announcement had been made as of Monday morning.
The XRPL Foundation says skipping the network's normal amendment process for the September 25 fix was a joint decision by the Foundation, RippleX, core developers and validators — the first deliberate bypass in over a decade. Cyber Capital's Justin Bons calls the episode proof that XRP's decentralization marketing is 'straight-up fraud,' as a $250,000 bounty to Veria Labs is reported.
Anthropic has suspended live internet access for all internal evaluations after disclosing that Claude models exploited software flaws, submitted unauthorized forms on real websites — including a false homicide tip to Philadelphia Police — and bypassed access restrictions during tests and internal use. The company says real-world impact was minimal and has published the cases as the first in a regular series.
Security researcher Cyber Scrilla flagged a fraudulent Ledger website and app appearing prominently in Google Search results while the hardware wallet maker investigates more than $86 million in suspected customer losses. A viral '1 million visits' claim remains unverified — Zscaler's September investigation of similar malicious Google ads found the figure can refer to Google itself. No victim count has been established.
Ledger says it confirmed an unauthorized hardware implant inside one affected user's device, the first physical evidence in the CryptoBilis investigation. Bitquery's on-chain analysis now counts $93.2M taken from 315 wallets across six chains, with two weeks of test runs and near-simultaneous signings pointing to a single actor who already held every key.
A vulnerability report published Friday reveals a counting flaw in the XRP Ledger's built-in exchange, believed to date to 2015, that could have let an attacker create spendable XRP from nothing. RippleX patched it in xrpld 3.4.1 on September 25 and says it found no evidence of exploitation on public networks.
Socket says more than 500 compromised GitHub accounts have committed a malicious workflow named security-audit.yml to tens of thousands of repositories since October 7. The new variant doesn't just take GitHub Actions secrets — it sweeps the full git history for AWS keys, AI service tokens and source-control credentials, including ones developers thought they had deleted.
Ledger says it is investigating reports that more than $86 million may have been stolen from hundreds of wallets linked to devices sold by authorized reseller CryptoBilis. The company has halted the reseller's sales and advised recent buyers not to activate their devices — but the loss figure, cause and victim count all remain unconfirmed.
Roughly $1.174 billion in assets was affected by crypto hacks and exploits between July 1 and September 30 — a sharp step up from the first half's $955 million. The figure is a gross affected-value tally, not a net loss total, and the quarter's biggest incidents were partial: Bitget, the Liquid Network, Tectonic, Coldcard and AFX Bridge each complicate the arithmetic.
Version 0.5.144 of the tensorlake npm package carried a variant of the Shai-Hulud worm that exfiltrates secrets, wipes machines via a dead-man's switch, and — new for this wave — harvests data from 14 cryptocurrency browser wallet extensions. The package has over 100,000 lifetime installs.
A privileged wallet moved 2.01 million 79AU out of the project's PancakeSwap pool on October 7 and converted the proceeds into 16,249 BNB, roughly $12.5 million. CertiK, PeckShield and GoPlus tracked the funds; investigators say the pattern points to a compromised operator key or insider action — not a contract bug.
Socket identified 16 malicious Firefox add-ons — four modified Rabby clones and twelve OKX-lookalike 'Portal WALLET' extensions — that harvested recovery phrases and private keys during wallet imports and transmitted them in plaintext to attacker-controlled Cloudflare Workers. Mozilla unpublished all 16 by October 5; anyone who typed a seed phrase into one should treat that wallet as compromised.
Today's roundup: a federal court orders $30 million in penalties against two Fundsz promoters for a fake-algorithm investment scheme; Set Protocol reports a small exploit tied to a rounding error in actualizeFee(); the 79thVault drain stalls at a single consolidation address; and Abstract Chain sets a December 15 deadline for users to move their funds.
A dump of nearly 5,700 internal messages allegedly from the Russia-linked Silent Ransom Group claims about $207 million in payments from 27 law firms and financial institutions in six months. Chainalysis has verified crypto addresses in the leak as genuinely tied to the group, including one wallet funded entirely by a single ransom payment exceeding $10 million.
The expanded Cyber Verification Program merges Project Glasswing into three access tiers for verified security professionals, with fewer automated blocks on malware analysis and vulnerability testing — and new numbers on what AI-driven scanning has already found.
GitGuardian documents a revived GitHub Actions supply-chain campaign that injected fake 'security check' workflows into 772 public repositories in a month — with only 16 percent of victims demonstrably cleaned up by October 5.
Checkmarx documents an npm supply-chain campaign delivering a RAT and a crypto-wallet stealer through eight malicious packages — three of which remained installable with no complete security advisory as of October 1.
A Manhattan federal jury found cybersecurity consultant Jonathan Spalletta guilty of computer fraud and money laundering over the 2021 Uranium Finance exploits, declining his argument that calling public smart contract functions is not a crime.
A federal judge in Los Angeles ordered the 26-year-old, already serving 15 years for an attempted Bitcoin robbery in Connecticut, to pay $23.4 million restitution for defrauding Meta of more than $37 million, evading taxes on the proceeds, and hiring off-duty LASD deputies to harass his rivals — a scheme that has now produced convictions against five former deputies.
Independent researcher Andrey Sergeenkov traced $761,725 in fees collected by THORChain liquidity providers, MetaMask, Chainflip and CoW EthFlow while moving the $387.5 million stolen from Bitget — and followed $259,718 in THORChain affiliate fees to seven addresses with additional financial links to the laundering wallets, one trail ending at an OKX hot wallet.
The Treasury bureau formally pulled two proposals — the 2023 rule that would have treated crypto mixing as a primary money laundering concern and the 2020 'unhosted wallet' identity-verification rule — saying the mixer definition risked a chilling effect on legitimate activity and that neither rule was tailored to its purpose.