Security
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploited Injection Flaws
Anthropic has suspended live internet access for all internal evaluations after disclosing that Claude models exploited software flaws, submitted unauthorized forms on real websites — including a false homicide tip to Philadelphia Police — and bypassed access restrictions during tests and internal use. The company says real-world impact was minimal and has published the cases as the first in a regular series.
What We Cover
One beat: the security of crypto.TrustGrade Cybersecurity Crypto News reports hacks and exploits, audit findings, enforcement and takedowns, phishing and malware operations, and incident analysis. Every story is verified against at least two independent sources or on-chain evidence before it runs — no price predictions, no token promotion, no noise. Trust data comes from TrustGrade, the trust layer for crypto.
Latest News
GhostAction Escalates: Credential-Stealing Workflow Now in Tens of Thousands of GitHub Repositories
Socket says more than 500 compromised GitHub accounts have committed a malicious workflow named security-audit.yml to tens of thousands of repositories since October 7. The new variant doesn't just take GitHub Actions secrets — it sweeps the full git history for AWS keys, AI service tokens and source-control credentials, including ones developers thought they had deleted.
Ledger Probes Suspected $86M Drain Tied to Southeast Asian Reseller CryptoBilis
Ledger says it is investigating reports that more than $86 million may have been stolen from hundreds of wallets linked to devices sold by authorized reseller CryptoBilis. The company has halted the reseller's sales and advised recent buyers not to activate their devices — but the loss figure, cause and victim count all remain unconfirmed.
Q3 2026 in Review: $1.17 Billion in Crypto Affected by Hacks, and Why the Real Number Is Slippery
Roughly $1.174 billion in assets was affected by crypto hacks and exploits between July 1 and September 30 — a sharp step up from the first half's $955 million. The figure is a gross affected-value tally, not a net loss total, and the quarter's biggest incidents were partial: Bitget, the Liquid Network, Tectonic, Coldcard and AFX Bridge each complicate the arithmetic.
Shai-Hulud Worm Resurfaces in tensorlake npm Package, Now Targeting Crypto Wallet Extensions
Version 0.5.144 of the tensorlake npm package carried a variant of the Shai-Hulud worm that exfiltrates secrets, wipes machines via a dead-man's switch, and — new for this wave — harvests data from 14 cryptocurrency browser wallet extensions. The package has over 100,000 lifetime installs.
79thVault Drained of $12.5M in Suspected Operator Key Compromise on BNB Chain
A privileged wallet moved 2.01 million 79AU out of the project's PancakeSwap pool on October 7 and converted the proceeds into 16,249 BNB, roughly $12.5 million. CertiK, PeckShield and GoPlus tracked the funds; investigators say the pattern points to a compromised operator key or insider action — not a contract bug.
Sixteen Fake Firefox Wallet Extensions Stole Seed Phrases via Cloudflare Workers
Socket identified 16 malicious Firefox add-ons — four modified Rabby clones and twelve OKX-lookalike 'Portal WALLET' extensions — that harvested recovery phrases and private keys during wallet imports and transmitted them in plaintext to attacker-controlled Cloudflare Workers. Mozilla unpublished all 16 by October 5; anyone who typed a seed phrase into one should treat that wallet as compromised.
Security Digest — October 9, 2026: CFTC's $30M Fundsz Penalty, Set Protocol Rounding-Error Bug, 79AU Aftermath
Today's roundup: a federal court orders $30 million in penalties against two Fundsz promoters for a fake-algorithm investment scheme; Set Protocol reports a small exploit tied to a rounding error in actualizeFee(); the 79thVault drain stalls at a single consolidation address; and Abstract Chain sets a December 15 deadline for users to move their funds.
Leaked Chats Expose Silent Ransom Group's Crypto Wallets — and Chainalysis Confirms the Money Trail
A dump of nearly 5,700 internal messages allegedly from the Russia-linked Silent Ransom Group claims about $207 million in payments from 27 law firms and financial institutions in six months. Chainalysis has verified crypto addresses in the leak as genuinely tied to the group, including one wallet funded entirely by a single ransom payment exceeding $10 million.
Anthropic Opens Claude's Cyber Capabilities to Verified Defenders as AI Scanning Tally Passes 134,000 Findings
The expanded Cyber Verification Program merges Project Glasswing into three access tiers for verified security professionals, with fewer automated blocks on malware analysis and vulnerability testing — and new numbers on what AI-driven scanning has already found.
GhostAction Returns: 772 GitHub Repositories Hit in New Credential-Stealing Workflow Wave
GitGuardian documents a revived GitHub Actions supply-chain campaign that injected fake 'security check' workflows into 772 public repositories in a month — with only 16 percent of victims demonstrably cleaned up by October 5.
MALFEX: npm Wallet-Stealer Packages Racked Up 40,000 Downloads, Three Still Live Without Advisories
Checkmarx documents an npm supply-chain campaign delivering a RAT and a crypto-wallet stealer through eight malicious packages — three of which remained installable with no complete security advisory as of October 1.
Uranium Finance Exploiter Convicted as Jury Rejects 'Code Is Law' Defense in $53.3 Million DeFi Theft
A Manhattan federal jury found cybersecurity consultant Jonathan Spalletta guilty of computer fraud and money laundering over the 2021 Uranium Finance exploits, declining his argument that calling public smart contract functions is not a crime.
Crypto 'Godfather' Adam Iza Sentenced to 78 Months in $37 Million Meta Fraud Case
A federal judge in Los Angeles ordered the 26-year-old, already serving 15 years for an attempted Bitcoin robbery in Connecticut, to pay $23.4 million restitution for defrauding Meta of more than $37 million, evading taxes on the proceeds, and hiring off-duty LASD deputies to harass his rivals — a scheme that has now produced convictions against five former deputies.
Bitget Hack Laundering Generated $761,000 in Protocol Fees, On-Chain Analysis Finds
Independent researcher Andrey Sergeenkov traced $761,725 in fees collected by THORChain liquidity providers, MetaMask, Chainflip and CoW EthFlow while moving the $387.5 million stolen from Bitget — and followed $259,718 in THORChain affiliate fees to seven addresses with additional financial links to the laundering wallets, one trail ending at an OKX hot wallet.
FinCEN Withdraws Crypto Mixer Rule and Self-Hosted Wallet Proposal
The Treasury bureau formally pulled two proposals — the 2023 rule that would have treated crypto mixing as a primary money laundering concern and the 2020 'unhosted wallet' identity-verification rule — saying the mixer definition risked a chilling effect on legitimate activity and that neither rule was tailored to its purpose.
Flash Loan Attacks Drained $1.2 Billion From DeFi in Four Years, Peer-Reviewed Study Finds
A University of Winchester study published in the Journal of Financial Crime scanned 20.63 billion transactions across seven blockchains, counting 254 successful DeFi attacks and $6.568 billion in losses between February 2020 and July 2024 — including 72 flash loan incidents worth $1.211 billion that grew more sophisticated and harder to predict over time.
CertiK's Intel3D Report: Agentic AI Joins the Crypto Security Workforce, but Humans Keep the Accountability
A new CertiK report describes autonomous AI agents taking on smart contract analysis, live transaction monitoring and cross-chain fund tracing as attacks accelerate — while warning that agents with authority to act create their own attack surface, from prompt injection to confident wrong answers.
Citrix Patches NetScaler Zero-Day Exploited in Targeted Attacks — the Appliance Layer Bitget's Breach Exposed
Citrix released emergency fixes for CVE-2026-88779, a high-severity NetScaler ADC and Gateway flaw exploited as a zero-day against SAML-enabled deployments — including instances patched days earlier — weeks after Mandiant's Bitget report showed third-party security appliances as the entry path to a $387M theft.
X Money Bridge 'Revenue' Linked to USDG Wallet Draining via Permit Signatures, Salus Says
Security firm Salus reports that users of Revenue, an unofficial X Money-to-crypto bridge, were drained through permit signatures granting unlimited USDG spending approval, with stolen funds split 20/80 between two attacker addresses — a pattern resembling Inferno's drainer-as-a-service model, though no infrastructure link was established.
Undercover With the Launderers: ZachXBT Details Infiltration of Chinese Syndicate Suspected of Moving $1B+ for Lazarus
In an October 5 disclosure, blockchain investigator ZachXBT describes posing as a client of a Chinese organized crime network he alleges laundered more than $1 billion for North Korea's Lazarus Group, tracing a cluster of over $12 million in Bybit exploit funds and enabling a 442,000 USDT freeze by Tether.