371 articles · page 2 of 13
A University of Winchester study published in the Journal of Financial Crime scanned 20.63 billion transactions across seven blockchains, counting 254 successful DeFi attacks and $6.568 billion in losses between February 2020 and July 2024 — including 72 flash loan incidents worth $1.211 billion that grew more sophisticated and harder to predict over time.
A new CertiK report describes autonomous AI agents taking on smart contract analysis, live transaction monitoring and cross-chain fund tracing as attacks accelerate — while warning that agents with authority to act create their own attack surface, from prompt injection to confident wrong answers.
Citrix released emergency fixes for CVE-2026-88779, a high-severity NetScaler ADC and Gateway flaw exploited as a zero-day against SAML-enabled deployments — including instances patched days earlier — weeks after Mandiant's Bitget report showed third-party security appliances as the entry path to a $387M theft.
Security firm Salus reports that users of Revenue, an unofficial X Money-to-crypto bridge, were drained through permit signatures granting unlimited USDG spending approval, with stolen funds split 20/80 between two attacker addresses — a pattern resembling Inferno's drainer-as-a-service model, though no infrastructure link was established.
In an October 5 disclosure, blockchain investigator ZachXBT describes posing as a client of a Chinese organized crime network he alleges laundered more than $1 billion for North Korea's Lazarus Group, tracing a cluster of over $12 million in Bybit exploit funds and enabling a 442,000 USDT freeze by Tether.
An unnamed vault on Base lost 1,783 wstETH (about $6 million) after an attacker-controlled contract was removed from the vault's whitelist and re-enabled one minute later with valid multisig signatures — the fourth Aave-linked or Base incident in a week, according to Blockaid, PeckShield, CertiK and ExVul.
Chainalysis says the September 24 Bitget breach was DPRK-attributed, pushing North Korean-linked crypto theft past $1 billion in 2026, while a BitOK trace pins 87.82 BTC in ten unspent outputs and Mandiant's preliminary report describes a supply-chain path through third-party security appliances into Bitget's wallet job server.
Unknown attackers compromised Microsoft's 13-million-follower X account to amplify a Clippy-impersonation account promoting a $Clippy token claimed to pair with $MSFT stock — a confirmed unauthorized-access incident that shows verified brand accounts remain prime pump-and-dump infrastructure.
NEAR Intents says the full $3.8 million taken in an October 1 exploit of its cross-chain system has been returned — confirmed by a BNB Chain transaction whose input data carried a message from the address labeled 'Near Intents Exploiter 1' — and the team has stopped its investigation, urging researchers to use bug bounties.
Today's roundup: Base absorbs a cluster of Aave-linked incidents in a single week — FlashLoopAdapter ($305K), an allegedly drained GoldPesa hook ($114K) and a $6M vault drain — while CertiK confirms September as 2026's worst month for losses at ~$766M and Bitget completes its withdrawal restoration.
Roughly 0.3 percent of the September 24 theft has been frozen, the CEO says most of the rest is probably gone, and analysts disagree on whether North Korean actors are behind the largest exchange hack of 2026.
The cross-chain protocol says the entire amount stolen in the October 1 Omni exploit has been returned after the attacker was identified, and that it has halted its investigation — a rare full recovery in a year of major thefts.
The week's smaller security stories: Chainalysis reportedly compressed 20 hours of cross-chain tracing into minutes, the THORChain censorship debate deepens, and an independent researcher published critical findings against DEX223's contracts.
Anibal Canelon Aguirre, the alleged developer of Ploutus ATM jackpotting malware, appeared in a Nebraska courtroom after capture in Venezuela — days after OFAC sanctioned ten targets and seven TRON addresses tied to the Tren de Aragua cash-to-crypto pipeline.
SlowMist says an access-control flaw in FlashLoopAdapter — a third-party Safe module for leveraged Aave v3 positions — let an attacker spoof module authentication, repay vault debt with a flash loan, and extract 114 ETH. Aave's core contracts were not affected.
CEO Gracy Chen told CNBC the exchange has frozen roughly 0.3% of the $387.5 million stolen in September's third-party zero-day breach, cautioned that frozen does not mean returned, and said Bitget replenished its protection fund with its own capital as withdrawals fully reopened.
Six months after the April 1 exploit drained about $295.4 million from the Solana perp DEX, the Drift Foundation has opened DFX recovery-token claims: one DFX per USDT of verified losses, with initial redemptions near 0.0104 USDT as a roughly 3.11 million USDT pool begins payouts.
MetaMask disclosed an ongoing infrastructure security incident and began precautionary exits of up to 17,000 Ethereum validators from Lido, after a researcher traced diverted block-production payments — with no immediate threat found to user wallets.
Scammers stood up a counterfeit version of Upbit-backed GIWA's unlaunched Ethereum L2 — complete with RPC endpoint, bridge and the expected Chain ID 9134 — let deposits accumulate for 13 hours, then changed the bridge code and drained 766 ETH in a single transaction.
The cross-chain trading protocol lost about $3.8 million to a bug in its Omni deposit and withdrawal system, paused services across eleven networks, and pledged full reimbursement — one week after its risk system rejected $50 million in swaps tied to the Bitget theft.
The Arbitrum perpetuals protocol has begun repaying victims of its July 15 exploit, with 90.59% of the 3,666 affected wallets eligible for full compensation while larger liquidity providers must choose between a $1,000 payout or a second-phase recovery plan.
The day's smaller security stories in brief: Bitget's final withdrawal phase — all remaining tokens, fiat and P2P — is scheduled for 08:00 UTC today, the protection fund is back above $300 million ahead of schedule, and CoinDesk's quarter tally puts Q3 hack losses at $1.26 billion.
Interim findings from the two firms Bitget hired put the attacker inside the exchange's environment 24 days before funds moved — a zero-day in a third-party security product, stolen employee credentials, and a custom withdrawal tool. No private keys were taken.
Wallets linked to the $387.5 million Bitget theft shielded 2,746 ZEC — about 15% of the stolen Zcash — inside Ironwood after NEAR Intents rejected over $50 million in attempted swaps and roughly $79 million in ETH was already cycled through THORChain into Bitcoin.
The day's smaller security stories in brief: suspected North Korean-linked thefts push past $1 billion for 2026 on the back of the Bitget hack, customers pull $463 million from the exchange since the breach, and the recovery outlook darkens.
Two independent security firms converge on roughly $766 million in September losses, with the Bitget and Liquid Network breaches making up more than 92% of the total — and the damage came from third-party infrastructure and signature failures, not classic DeFi bugs.
Apple's September 28 security updates close an out-of-bounds write in CoreGraphics, reported by Meta Product Security, that the company says may have been exploited in extremely sophisticated attacks against specific individuals on pre-iOS 27 versions — with blockchain security firms noting a suspected crypto wallet targeting angle that remains unconfirmed.
With less than $503,000 of the $387.5 million Bitget breach frozen worldwide, CEO Gracy Chen says full recovery is unlikely; USDT withdrawals across four chains opened September 30 at 08:00 UTC — the moment that will actually test user confidence in the exchange's Protection Fund.
Chainalysis research shows malicious writes to public blockchains used as malware command-and-control infrastructure climbing from about two to more than eleven per day, with state-linked groups behind roughly half of all dead-drop activity by Q2 2026 — DPRK-attributed relays across TRON, BSC and Aptos, Polygon C2 resolvers, and Bitcoin OP_RETURN pointers.
Payy's technical post-mortem pins the September 24 bridge exploit on a proving-system flaw in the deployed Noir/Barretenberg verifier, which accepted an invalid burn proof and released roughly 1.92 million USDC to a single wallet — a supply-side risk for every project using the same Aztec toolchain.