News linked to this event type.
According to Decrypt, Polymarket has switched trading to cancel-only mode and paused relay operations due to a security incident, with multiple users reporting unauthorized asset transfers. The suspected attacker's address holds approximately $2.65 million in POL.
Odaily reports: Research from quantum computing company Alice & Bob estimates that a fault-tolerant quantum computer with approximately 29,588 physical qubits could solve the 256-bit elliptic curve cryptography problem used by Bitcoin in about 61.8 minutes. This problem underpins the digital signatures used to authorize Bitcoin transactions. The findings are theoretical resource estimates and do not mean that existing quantum computers already have the capability to crack it.The research also estimates that 22,593 physical qubits could crack RSA-2048 encryption in about 3.14 days. The calculations use cat qubits technology designed to reduce quantum errors, combined with more efficient error-correcting codes and improvements to Shor's algorithm.If a sufficiently powerful quantum computer could derive private keys from publicly exposed public keys, the relevant Bitcoin could face risks of unauthorized signatures and asset theft. The estimated cracking time is still longer than Bitcoin's average block interval of about 10 minutes; approximately 6.9 million Bitcoin may be at risk because their corresponding public keys have already been exposed. (Bitcoin.com News)
According to an official announcement from Cysic, following the cross-chain bridge security incident that occurred earlier, Cysic has fully resumed its cross-chain bridge services, and users can now once again transfer CYS across chains between the Cysic mainnet and other supported blockchains. Additionally, Cysic has permanently burned 7,200,002 CYS on the BNB Smart Chain and confirmed that this operation has been recorded on-chain.
According to an official announcement from BNB Chain, the winner list for the BNB Hack: Tokenized Edition hackathon has been announced. Co-hosted by BNB Chain and Binance Wallet, the event awarded five projects from a total prize pool of $20,000. Moi took first place, while 4lpha, Redeye, TARE, and Firstshare ranked second through fifth. Additionally, 4lpha won the Best Agentic Wallet / Wallet Skills Application award, and Firstshare won the Best BNB Agent Studio Application award.
Cybersecurity firm XBOW disclosed that it discovered a critical remote code execution (RCE) vulnerability in a publicly accessible web application for the U.S. Election Assistance Commission (EAC), which can be exploited without authentication. The application is used for resource and logistics calculations, and is not a voting machine or voter registration system.
Trader Killa posted that despite the market facing multiple bearish factors—including the Fed's hawkish decision, rising oil prices, hotter-than-expected CPI data, surging global bond yields, a stronger dollar, the Ledger wallet hack, and market concerns over Strategy (MSTR)'s delisting risk and its pivot to AI—Bitcoin has still maintained range-bound trading. Given the current macroeconomic pressures and negative news, Bitcoin should have fallen below $70,000, but its resilience is noteworthy. The market may be gradually forming a significant interim bottom, and its ability to hold the price range amid bearish shocks indicates that it is absorbing negative news, which is also a typical characteristic of a bull market.
Due to an increase in detected cyberattack attempts, Indonesian cryptocurrency exchange Indodax has temporarily suspended user deposits and withdrawals to conduct security assessments and risk mitigation measures. The platform confirmed that all user assets remain secure, with no unauthorized withdrawals or data breaches detected to date. Deposit and withdrawal services will resume once system security is verified, and subsequent updates will be published via official channels.
Odaily reports: According to zkLink monitoring, the attack on the Arbitrator contracts of zkLink Nova on Ethereum and Optimism is still ongoing, and the technical team is urgently responding to contain the losses. zkLink has called on the attackers to stop further exploiting the omnichain contracts and return the affected funds, stating that if the attackers cooperate in returning the funds, a 20% white-hat bounty will be offered and no further action will be pursued. Previously, SlowMist issued a security alert stating that the related losses amounted to approximately $783,100. The root cause of the attack points to the Arbitrator contract's claimMessage failing to clear the temporary finalizeMessageHash and failing to require each call to go through a new authentication callback; attackers can exploit the publicly callable authorized SyncL2TxHashRelayer to inject a forged batch root and withdraw assets.
Bithumb stated that on October 27, its internal mobile collaboration system, DaouOffice, was subjected to unauthorized external access, resulting in the theft of some customer and employee personal information. The incident involved 6,444 customers, among whom the data for 5,600 individuals was encrypted and unreadable, while an additional 844 customers were confirmed to have had their personal information compromised. Furthermore, the information of 715 employees and partner personnel was also affected.
Odaily reports: A federal judge in Miami, United States, sentenced 20-year-old Canadian man Trenton Johnston to 25 months in prison. Johnston had previously pleaded guilty to conspiracy to commit money laundering and surrendered approximately $3.8 million in stolen cryptocurrency. In January 2024, when Johnston was 17, he began his crime spree by impersonating Google technical support staff and representatives of crypto companies to trick victims into providing wallet access codes. In one case, he and a co-conspirator defrauded a California victim of 185 bitcoins, then worth approximately $13 million. Johnston subsequently used the proceeds to purchase a Lamborghini Aventador SVJ, two BMWs, and jewelry, and to pay for private jet charters.
Odaily Report: After a publicly listed company under Japan's GMO Internet Group suffered a cyberattack, related risks are spreading to Japan's credit market. Data shows that the spread on a GMO Internet Group yen bond maturing in June 2031 widened to approximately 174 basis points on October 28, up from about 122 basis points on October 20—before the company disclosed the unauthorized access incident—reflecting investor concerns over damaged earnings and rising compensation costs.The GMO subsidiary that provides cloud services disclosed on October 21 that it had suffered unauthorized access and received a ransom demand of approximately 8 billion yen (about $50.7 million). The attackers subsequently published data they claimed contained customer information. GMO refused to pay the ransom and plans to compensate customers for their losses. Analysts noted that as AI-powered cyberattacks increase, such incidents could affect corporate financing and bond issuance arrangements.GMO Internet operates the cryptocurrency exchange "Z.com EX," which has obtained licenses from the Thailand Securities and Exchange Commission and the Thai Ministry of Finance. The exchange disclosed that it has been acquired, with the acquisition involving all shares of the target company held by shareholders including GMO Internet and its related subsidiaries. It remains unclear whether customer information data involves the related cryptocurrency exchange. (Bloomberg)
Blockaid has published two attacker addresses, example attack transactions, victim contracts, and cross-chain bridge addresses. One of the attacker addresses (0xaCA0...5718) currently holds a balance of approximately $11,000 USD.
Solana ecosystem Meme coin free mika (MIKA) fell on October 28. Its genesis address transferred approximately 500.44 million tokens to another wallet, accounting for about half of the initial supply; about 7 seconds later, that wallet sold approximately 500.83 million MIKA on PumpSwap, and after the sale, the short-term trade price was about 99% lower than before. Some claim that the wallet nonce prevented the key holder from transferring funds, but the transfer used a normal recent blockhash, and it is currently still impossible to confirm whether the sale came from an external attack or an existing holder.
According to Yonhap News Agency, South Korean crypto asset exchange Prabang reported on October 26 that it suffered an intrusion involving unauthorized external access, and has filed a report with relevant authorities. The exchange detected anomalous withdrawals from its hot wallet on October 24, identified a security vulnerability upon activating its emergency response protocol, and preliminarily estimated losses at approximately 100 million KRW (around $70,000). To safeguard customer assets, Prabang has suspended services and pledged to fully compensate users with corporate funds once the losses are verified.
According to on-chain researcher Spreek, DeFi protocol Hifi Finance suffered a DAO governance takeover. The attacker gained control through four last-minute votes funded by Tornado Cash, subsequently minted 25 million governance tokens, and drained user collateral assets worth approximately $1 million, most of which were RWA tokens.
Diva Staking issued an official announcement stating that the liquid staking protocol will cease operations and will not launch on the mainnet. Users who made pre-deposits to the Early Staker Vaults can directly withdraw their funds via Enzyme. The team stated that project funding was exhausted by mid-2024, after which three core members persisted in development for nearly two and a half years without income or salary. The team could not afford the costs of a new round of audits, nor the deployment and maintenance expenses for a complex protocol, and no major institution was willing to assist with the launch. Diva had previously launched on the Hoodi testnet, operating stably for four months without any issues. However, the team noted that AI makes vulnerabilities easier to detect, and the protocol still carried risks of audit oversights that could endanger user funds. Therefore, they chose to shut down the project rather than rush the launch.
Bitcoin News posted on X that FoundationHQ stated attackers sent over 23,000 phishing emails after exploiting leaked API keys to access customer data, including addresses and phone numbers.
Bitcoin News posted on X that Bitcoin Core has discovered 3 new vulnerabilities, one of which could allow an attacker to remotely crash nodes. This vulnerability can affect nodes running Windows, macOS, or BSD by exhausting memory, while Linux nodes are not affected by this attack; another vulnerability can gradually exhaust node memory, and a third may corrupt blockchain undo data.
Researchers disclosed a zero-click vulnerability in Telegram's emoji sticker feature at a security conference held in Tokyo, and demonstrated that attackers can execute code on iOS devices without any user interaction. However, Telegram disputes the risk assessment of the vulnerability, and the available information has not yet clarified the specific scope of impact or remediation progress.
Cysic has released an update on the progress of handling the security incident, disclosing that it has completed burning 7,200,002 CYS tokens on the BNB Smart Chain (BSC) to offset prior unauthorized token issuance. Both burn transactions have been confirmed on-chain, permanently reducing the CYS token supply on BSC and bringing it back into alignment with the project's tokenomics.