Incident Analysis
White Hats Move 52 BTC From the Coldcard Exploit Into a 'Recovery Trust' — About 2.8% of the Haul
On-chain trackers at Galaxy Research say apparent white-hat actors consolidated 52.37 BTC (about $4.5 million) from several Coldcard attacker clusters into a fresh address advertising a 'Crypto Recovery Trust' — the first large-scale rescue of funds from the roughly $130 million hardware wallet incident.
Latest News
D'CENT App Wallet Flaw Drained 9.3M XRP From 6,160 Addresses as Vendor Urges Immediate Updates
On-chain tracking ties a mid-September drain of 9.3 million XRP — over $9 million — to a signing flaw in D'CENT's App Wallet software, with 1,552 wallets emptied in one two-hour window; D'CENT says users who typed recovery phrases into the app on versions before 8.1.0 are the exposure group.
One Attacker Drained $2M From Fetch.ai and NuNet in Coordinated Strike, On-Chain Firms Say
Blockaid and PeckShield traced a September 19 attack that emptied a Fetch.ai token converter of 8.7 million FET and used the same wallet to mint 408.5 million unauthorized NTX through NuNet's deployer account — about $2 million combined, with NTX collapsing to an all-time low.
Haruko Breach Exposed Exchange API Details of 15 Fund Clients as TRM Counts Record Attacks
The London institutional crypto-tech provider said a targeted attack exploited a vulnerable process to extract a user-access token, exposing read-only exchange API details and trading data for all 15 non-whitelisted clients — with a small amount of client funds possibly stolen from smaller hedge funds.
Revolut Notifies Hundreds of Crypto Customers After Five-Month Data Breach; Attackers Demand $3 Million Ransom
Attackers posing as government officials obtained data on roughly 680 high-value crypto customers from Revolut over five months, reports say, and are now demanding about $3 million in Monero — a breach that turns holder anonymity into a physical-security problem.
Security Digest: Nostra's 8,000x Oracle Pump Drained $3.5M, a MEV Bot Out-Ran a $7.8M Safe Exploit, and the Week Cost Crypto $20M
The week's smaller security stories in brief: a manipulated NSTR price feed let one account borrow $3.5 million from Nostra on Starknet, the Yoink MEV bot front-ran a $7.8 million rsETH theft on Ethereum, and trackers tally roughly $20 million in incident losses across seven days.
FomoPeek: iOS Malware With a Kernel Exploit Framework Passed Apple's App Store Review — Binance and SlowMist Warn Users
Binance Wallet issued an urgent advisory after SlowMist and OKX found that FomoPeek versions 1.1 and 1.2 — distributed through the official App Store — contained an iOS kernel exploitation framework able to escape the sandbox, decrypt Keychain data and harvest private keys and seed phrases from other apps. Version 1.3 removed the code; anyone who ran the affected versions is advised to rebuild their wallet on a clean device.
Radix Post-Mortem: Three-Year-Old Vault Authorization Bug Drained $1.3M and Forced a 10-Day Halt
The Radix Foundation's public incident report traces the August 31 theft of roughly $1.3 million to a vault-authorization flaw introduced during a June 2023 code cleanup — a defect that survived a 2024 Zellic audit and was only contained after validators deliberately broke network liveness for more than ten days. The Foundation said the attacker appeared to use AI-assisted code-analysis tools to find the gap.
RatHat: Android Malware Ships an AI-Guided Navigation Engine to Drain Banking and Crypto Apps
Zimperium zLabs analyzed a new Android remote-access trojan that enables Wireless Debugging for shell-level access, installs a persistent Go agent, and feeds the live accessibility tree to an AI assistant to navigate infected devices — with credential overlays aimed at banking and cryptocurrency applications. Attribution to China-based operators is suspected, based on Chinese-language AI prompts, and remains unconfirmed.
Security Digest: The Last Meter — September 21
This week's freshest attacks converge on the last meter between a user and their assets: an iOS app that shipped a kernel-exploitation framework through the App Store, an Android RAT that navigates infected phones with an AI assistant, and — in northern France — a family tied up at home while attackers forced a €40,000 transfer. Plus the status board: Liquid, Chainflip, Revolut, Kelp DAO, Swiss Bitcoin Pay and Fetch.ai — no new verified developments.
One Attacker, Two Protocols: Linked Exploits Drain $2M From Fetch.ai and NuNet
A single attacker drained 8.7 million FET (about $1.53 million) from a Fetch.ai token converter contract, then used the same wallet to mint 408.5 million unauthorized NTX through NuNet's deployer account — roughly $2 million combined. SlowMist traces the Fetch.ai root cause to an authorization gap in TokenConversionManagerV3's conversionIn(). Neither team has issued an official statement.
US Treasury Sanctions Iranian Exchange BitBank in Alleged IRGC Bitcoin Pipeline
OFAC designated the Iranian crypto exchange BitBank, its developers and three associates on September 18, alleging the network transferred hundreds of millions of dollars in Bitcoin to the Islamic Revolutionary Guard Corps. The action extends the Operation Economic Outcast campaign that earlier sanctioned Shelbit and Aban — and all allegations remain unadjudicated.
Security Digest: What a Signature Is Worth — September 20
Today's thread is authorization: the Fetch.ai exploit trusted one signature where the contract should have demanded more, the S&P–OpenZeppelin deal prices exactly that kind of assurance, Gyazo's metadata leak shows what happens when the proof behind a link leaks, and Japan's NPA officially attributes the ¥1.7B WaterPlum campaign. Plus the status board: Liquid peg-outs, Chainflip claims, Revolut extortion, Kelp DAO, Swiss Bitcoin Pay — all unchanged.
S&P Global to Acquire OpenZeppelin, Folding Smart Contract Audits Into Credit Ratings
S&P Global has agreed to acquire the smart contract security firm OpenZeppelin and will run it as a business unit reporting to S&P Global Ratings. Terms were undisclosed. The deal merges code-level security assurance with issuer-level ratings under one division — the clearest signal yet that on-chain code quality is being treated as rated credit infrastructure.
Cardano's IOG Warns Users After Official YouTube Channel Hijacked for Suspected Deepfake Hoskinson Giveaway
Input Output Group told users to avoid its YouTube channel on September 18 after an apparent takeover carried a roughly two-hour livestream — dressed as a Project Catalyst town hall — in which a suspected AI-manipulated Charles Hoskinson promised to 'double your wealth' via a QR code. No losses have been verified.
Targeted Cyberattack on Institutional Provider Haruko Hit 15 Clients; Some Hedge-Fund Assets Lost
The London-based crypto technology provider said a group attacked Haruko itself, exploiting a process vulnerability to extract an access token and capture read-only exchange API details from memory. All 15 affected clients were those without IP whitelisting — and a small amount of their funds was stolen, according to people familiar with the incident.
Security Digest: The Trusted Channel — September 19
Today's stories share one mechanism: attackers operating inside channels victims already trust — a recruiter's coding task, an official YouTube channel, a vendor's own access token, a certified police mailbox. Plus the status board: Liquid peg-outs still paused at day 14, Chainflip's restart resets TRON provider balances to on-chain claims, the Revolut extortionists' countdown expires, Kelp DAO and Swiss Bitcoin Pay unchanged — and the Symbiosis root cause lands as a two-bug report.
FBI and Japan's NPA Attribute $10.7M Fake-Recruiter Campaign to North Korea's WaterPlum
A September 18 joint advisory from Japanese, US, Australian and German agencies says WaterPlum — widely known as Contagious Interview — infected 30,000+ devices across 100+ countries and drained at least $10.7 million from crypto wallets between December 2025 and July 2026, using fake job interviews aimed at developers.
Study: 94% of Losses at Audited DeFi Victims Fell Outside Their Audit Scopes
A preprint from ack3-affiliated researchers and Czech Technical University examined 135 DeFi incidents from H1 2026 ($939.86M in losses) and found that where audits existed, 94.4% of reported losses came from attack paths outside every identified audit scope — though two large incidents dominate the figure.
Incident Analysis: The 20-Bit Gap That Let ICON's Withdrawal Path Be Replayed 1,490 Times
ICON Foundation's post-mortem of the August 27 replay exploit traces the loss to an integer-precision defect: the uniqueness check validated unsigned high bits of a serial number while the signature covered only the low 256 bits — a boundary two audits never crossed.
Security Digest: The Assurance Boundary — September 18
Today's edition is organized around one theme: the gap between what was reviewed and what was deployed. Plus the status board — Liquid peg-outs still frozen at day 13, Chainflip reimbursements still unexecuted, Kelp DAO still silent since the freeze expired, Swiss Bitcoin Pay still dark, and SecondFI rolls out a recovery tool in stages.