Hacks
Autheo's THEO Drops 92% After Suspected Bridge Mint Exploit Nets $1.76M
An attacker minted 19 million THEO on Base without authorization and swapped the tokens for roughly 700.8 ETH before bridging the proceeds to Ethereum, PeckShield's on-chain analysis shows. Autheo says the suspected exploit involves its cross-chain bridge and has warned users.
What We Cover
One beat: the security of crypto.TrustGrade Cybersecurity Crypto News reports hacks and exploits, audit findings, enforcement and takedowns, phishing and malware operations, and incident analysis. Every story is verified against at least two independent sources or on-chain evidence before it runs — no price predictions, no token promotion, no noise. Trust data comes from TrustGrade, the trust layer for crypto.
Latest News
OneKey Cuts CryptoBilis and Orders Full Reseller Purge as Hardware Wallet Fallout Spreads
OneKey has revoked the Malaysian reseller's authorization, halted new dealer signups and offered free replacements for devices sold through CryptoBilis since March — after Ledger confirmed an unauthorized hardware implant in a reseller-sold device tied to an estimated $86M–$93M in thefts from roughly 300 wallets.
P7 DarkSword: iOS Exploit Kit Variant Adds Crypto Wallet and Keychain Theft, Live Remote Commands
iVerify documents a new DarkSword variant that extracts keychain data into JSON on-device, steals cryptocurrency wallet data and accepts real-time instructions from attacker infrastructure — while the infection route, targeted wallets and victim counts remain unknown.
Security Digest — October 13, 2026: NEAR Intents' Monero Problem, XMRig via Backup-Software Flaws, Ledger Tally Climbs
Today's roundup: NEAR Intents reveals most of its stolen $3.8M came back in Monero and is struggling to convert it; attackers exploit AhsayCBS backup flaws to plant webshells and an XMRig miner; the tampered-Ledger tally passes $86M as OneKey purges the reseller; and a two-week loss count reaches $422M.
US Treasury Chief Says $1 Billion Iran-Linked Crypto Seizure Coming 'This Week'
Treasury Secretary Scott Bessent said the US is 'probably gonna seize a billion dollars of crypto this week' as part of its economic isolation campaign against Iran. No wallet addresses, forfeiture filings, or exchange disclosures have accompanied the statement, and past Bessent claims of seized amounts have shifted between tellings.
Suspected CryptoBilis Attacker Washes 2,990 ETH Through Tornado Cash as $5.35M in USDC Surfaces Freezable
Bitquery's live tracing shows the suspected CryptoBilis attacker pushed another 1,736 ETH through Tornado Cash and Zcash on October 10, exiting into 5.35 million USDC that Circle can freeze — while 5.2 million USDT mixed with other clients' funds was paid into Binance via OTC-style wallets. About $81 million of the $93.2 million taken remains traceable on-chain.
Ontology Halts Block Production Across Consensus Nodes Over Potential Security Risk
The Ontology (ONT) network stopped producing blocks on Saturday after an emergency report flagged a potential security risk involving a project built on the blockchain. The pause was coordinated with the vast majority of consensus nodes, and no public resumption announcement had been made as of Monday morning.
XRPL Developers Defend Emergency Patch Bypass as Decentralization Criticism Mounts
The XRPL Foundation says skipping the network's normal amendment process for the September 25 fix was a joint decision by the Foundation, RippleX, core developers and validators — the first deliberate bypass in over a decade. Cyber Capital's Justin Bons calls the episode proof that XRP's decentralization marketing is 'straight-up fraud,' as a $250,000 bounty to Veria Labs is reported.
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploited Injection Flaws
Anthropic has suspended live internet access for all internal evaluations after disclosing that Claude models exploited software flaws, submitted unauthorized forms on real websites — including a false homicide tip to Philadelphia Police — and bypassed access restrictions during tests and internal use. The company says real-world impact was minimal and has published the cases as the first in a regular series.
Fake Ledger Site Rides CryptoBilis Panic to Top of Google Search, Researchers Warn
Security researcher Cyber Scrilla flagged a fraudulent Ledger website and app appearing prominently in Google Search results while the hardware wallet maker investigates more than $86 million in suspected customer losses. A viral '1 million visits' claim remains unverified — Zscaler's September investigation of similar malicious Google ads found the figure can refer to Google itself. No victim count has been established.
Ledger Confirms Hardware Implant in Affected Device as Bitquery Raises CryptoBilis Drain to $93.2M
Ledger says it confirmed an unauthorized hardware implant inside one affected user's device, the first physical evidence in the CryptoBilis investigation. Bitquery's on-chain analysis now counts $93.2M taken from 315 wallets across six chains, with two weeks of test runs and near-simultaneous signings pointing to a single actor who already held every key.
XRP Ledger Discloses Decade-Old Bug That Could Have Minted XRP Beyond Its 100 Billion Cap
A vulnerability report published Friday reveals a counting flaw in the XRP Ledger's built-in exchange, believed to date to 2015, that could have let an attacker create spendable XRP from nothing. RippleX patched it in xrpld 3.4.1 on September 25 and says it found no evidence of exploitation on public networks.
GhostAction Escalates: Credential-Stealing Workflow Now in Tens of Thousands of GitHub Repositories
Socket says more than 500 compromised GitHub accounts have committed a malicious workflow named security-audit.yml to tens of thousands of repositories since October 7. The new variant doesn't just take GitHub Actions secrets — it sweeps the full git history for AWS keys, AI service tokens and source-control credentials, including ones developers thought they had deleted.
Ledger Probes Suspected $86M Drain Tied to Southeast Asian Reseller CryptoBilis
Ledger says it is investigating reports that more than $86 million may have been stolen from hundreds of wallets linked to devices sold by authorized reseller CryptoBilis. The company has halted the reseller's sales and advised recent buyers not to activate their devices — but the loss figure, cause and victim count all remain unconfirmed.
Q3 2026 in Review: $1.17 Billion in Crypto Affected by Hacks, and Why the Real Number Is Slippery
Roughly $1.174 billion in assets was affected by crypto hacks and exploits between July 1 and September 30 — a sharp step up from the first half's $955 million. The figure is a gross affected-value tally, not a net loss total, and the quarter's biggest incidents were partial: Bitget, the Liquid Network, Tectonic, Coldcard and AFX Bridge each complicate the arithmetic.
Shai-Hulud Worm Resurfaces in tensorlake npm Package, Now Targeting Crypto Wallet Extensions
Version 0.5.144 of the tensorlake npm package carried a variant of the Shai-Hulud worm that exfiltrates secrets, wipes machines via a dead-man's switch, and — new for this wave — harvests data from 14 cryptocurrency browser wallet extensions. The package has over 100,000 lifetime installs.
79thVault Drained of $12.5M in Suspected Operator Key Compromise on BNB Chain
A privileged wallet moved 2.01 million 79AU out of the project's PancakeSwap pool on October 7 and converted the proceeds into 16,249 BNB, roughly $12.5 million. CertiK, PeckShield and GoPlus tracked the funds; investigators say the pattern points to a compromised operator key or insider action — not a contract bug.
Sixteen Fake Firefox Wallet Extensions Stole Seed Phrases via Cloudflare Workers
Socket identified 16 malicious Firefox add-ons — four modified Rabby clones and twelve OKX-lookalike 'Portal WALLET' extensions — that harvested recovery phrases and private keys during wallet imports and transmitted them in plaintext to attacker-controlled Cloudflare Workers. Mozilla unpublished all 16 by October 5; anyone who typed a seed phrase into one should treat that wallet as compromised.
Security Digest — October 9, 2026: CFTC's $30M Fundsz Penalty, Set Protocol Rounding-Error Bug, 79AU Aftermath
Today's roundup: a federal court orders $30 million in penalties against two Fundsz promoters for a fake-algorithm investment scheme; Set Protocol reports a small exploit tied to a rounding error in actualizeFee(); the 79thVault drain stalls at a single consolidation address; and Abstract Chain sets a December 15 deadline for users to move their funds.
Leaked Chats Expose Silent Ransom Group's Crypto Wallets — and Chainalysis Confirms the Money Trail
A dump of nearly 5,700 internal messages allegedly from the Russia-linked Silent Ransom Group claims about $207 million in payments from 27 law firms and financial institutions in six months. Chainalysis has verified crypto addresses in the leak as genuinely tied to the group, including one wallet funded entirely by a single ransom payment exceeding $10 million.
Anthropic Opens Claude's Cyber Capabilities to Verified Defenders as AI Scanning Tally Passes 134,000 Findings
The expanded Cyber Verification Program merges Project Glasswing into three access tiers for verified security professionals, with fewer automated blocks on malware analysis and vulnerability testing — and new numbers on what AI-driven scanning has already found.