News linked to this event type.
Web3 infrastructure and payment network Diamante announced that a security incident occurred within the Diamante ecosystem, with malicious actors carrying out unauthorized operations. The team has coordinated with partners including exchanges, market makers, and liquidity providers to suspend affected withdrawals and transfers, and to restrict unauthorized asset transfers.
Odaily reports: Bitcoin hardware wallet manufacturer Keystone has stated that attackers obtained the permanent factory keys used to verify device authenticity. The company will destroy 18,835 unsold devices in its inventory and suspend all unshipped orders on its official website. The incident was discovered on October 20. Devices delivered before October 20 are not affected, and mnemonic phrases and private keys were not involved.The incident also affected 25,964 buyer records from Keystone's Shopify online store, involving names, contact information, shipping addresses, and order information between 2024 and 2026. A total of 51,083 records were previously involved, and 25,119 pieces of personal information have been deleted; customers who purchased through channels such as Amazon are not affected.Keystone stated that some records were not deleted within the originally planned 180-day period. The company has shortened the data retention period to 90 days and on October 24 requested that Shopify delete overdue data, which is expected to be completed on November 3. Official website sales will switch to pre-orders until devices using the new keys are produced; the company has submitted reports to relevant authorities in the EU, the UK, and other regions. (Decrypt)
Hardware wallet manufacturer Keystone's device verification keys were stolen, leading to suspended shipments, the destruction of 18,835 unsold devices, and the leak of 25,964 buyer records.
Odaily reports: According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that has already been exploited in real attacks. Malicious servers could display fabricated transactions to users and, when users attempt to speed up transactions via Replace-by-Fee (RBF), trick them into signing transactions that pay the attacker's address; the attacker does not need to obtain the user's private keys. Electrum stated it has received two related reports, in which one user lost bitcoin after increasing the fee, and recommends that users update to version 4.8.3.
U.S. prosecutors have indicted six members of a suspected Madagascar NFT wallet theft ring, with the FBI estimating that at least $516,700 was drained from 74 victim wallets.
Odaily reports: Cyber extortion group WhiteArmor claims to have obtained the complete user database of crypto casino Gamdom, involving approximately 15.42 million accounts and 146 columns of data, and is demanding a payment of $15 million in Bitcoin. The group claims to have breached the system through an internal machine account with administrator privileges, and has published approximately 100 account records as evidence.Previously, Gamdom suffered a hot wallet attack on October 13, with the platform officially confirming losses exceeding $3 million, while on-chain researchers estimated losses at approximately $4.2 million. Currently, there is no evidence linking the two incidents, and the scale of the data breach claimed by WhiteArmor has not yet been independently verified. (Dark Web Informer)
Previously, Gamdom suffered a hot wallet attack on October 13. Founder Felix Römer acknowledged losses exceeding $3 million, while blockchain researcher vxdb estimated the stolen amount across multiple networks at approximately $4.2 million.
According to monitoring by on-chain analyst Onchain Lens (@OnchainLens), the BSC-based prediction market platform Predict Fun was allegedly compromised via a vulnerability, with approximately $300,000 in suspected stolen funds transferred from multiple contracts through intermediary wallets to Relay. These funds were reportedly routed into Tornado Cash following a cross-chain transfer.
Odaily Report: After GMO Internet Group of Japan suffered a cyberattack, hackers claimed they had published customer information after not receiving a $50 million ransom. GMO has not yet confirmed whether the follow-up ransomware attack threatened by the hackers occurred. The company said its foreign exchange trading service has been suspended since October 21 and it has stopped accepting new subscriptions; all servers of its domain and cloud service Onamae.com were compromised, potentially affecting all users. Previously, some customers had reported transactions they did not initiate.Japanese Finance Minister Satsuki Katayama said that five foreign exchange trading companies have reported customers affected by the incident, and no new unauthorized transactions have been reported so far. GMO has asked the government to help block the source of the attack and called for proactive cyber defense measures. Amid mounting concerns over the impact of the cyberattack, GMO's stock price posted its biggest drop since 2011 on Monday. (Bloomberg)
According to SlowMist, its security personnel discovered during routine threat intelligence monitoring that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js has been implanted with a malicious loader. The loader hides the address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com; note that the domain starts with the letter 'q'). This script reads page-accessible Cookie, localStorage, and sessionStorage data, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[.]com/c.php, enabling attackers to hijack sessions or take over accounts. This data collection behavior is not restricted by target site policies, and unmatched pages may also be affected. According to SlowMist's analysis, the script also targets three categories of sites: mgbx[.]com, bikingex[.], and bitxex[.]io. It scans deposit pages every 200 milliseconds and replaces recognized deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, by wrapping the Clipboard API, replacing copy buttons, and intercepting copy events, the script ensures users only see and copy tampered addresses. If users transfer funds to these addresses, the assets will flow into the attacker's wallet.
According to Initia monitoring, a security remediation plan has been drafted for the vulnerability discovered on October 23 and is currently being audited with security partners. Once the audit is complete, Initia will publish a detailed plan outlining how support for affected assets will be restored and how the Initia L1 and Rollup networks will be restarted in an orderly manner. This process is expected to be completed within the coming days.
Odaily Report: OneKey founder Yishi posted that after a series of data breaches and supply chain attacks in the hardware wallet industry recently, OneKey is strengthening its existing security measures, stating that it has not experienced any security incidents and that these measures are being implemented proactively. OneKey has confirmed through the Shopify API that personal information such as customer names, emails, and shipping addresses in historical order records has been deleted, and has reduced the customer data retention period to a maximum of 30 days. Returns, warranties, and device verification will switch to methods that do not rely on long-term data retention. The retention policies of carriers such as FedEx and UPS are not controlled by OneKey; with customers' explicit consent, OneKey may separately retain privacy-processed email addresses solely for product updates and security patch notifications. OneKey's long-term goal is to migrate its e-commerce operations to its own infrastructure and reduce dependence on third-party platforms such as Shopify.
According to CoinDesk, Ethereum developers have fixed a bug in the upcoming Glamsterdam upgrade that could cause ETH deposited by staking services for new validators to be incorrectly credited to block builder accounts, giving operators the opportunity to withdraw the associated funds. The fix was merged into the Ethereum consensus specification on October 26, having previously been rejected on October 19 due to insufficient support from client teams.
according to On Nexus monitoring, on October 25, the legacy DotSwap trading platform DotSwap V1 was attacked. The attacker exploited a server-side signature mechanism left over from V1 and, within about 4 hours, stole about 8.5 BTC from V1 liquidity pools and accounts, involving approximately $685,000 in funds. V1 used custodial multisignature management for liquidity pools, and the losses involved BTC deposited by liquidity providers into V1 pools, with all V1 deposits affected; wallets self-custodied by trading users were not affected. The attack was launched through automated scripts, and the attacker probed all interfaces and gradually carried out fund theft against 99 Runes tokens. On Nexus believes that this incident is consistent with the recent trend of AI agent-driven attacks. Currently, DotSwap V1 has been taken offline. The team is tracing the stolen funds and collaborating with exchanges and on-chain analysis partners, and will later publish a full incident retrospective and user remediation plan. The team also stated that it is working to restore Nexus-related services.
Odaily Report: According to monitoring by on-chain analyst Ember, a hacker who stole approximately $40 million in assets from UXLINK last year opened a long position of 30,300 ETH on Hyperliquid at a price of $2,134, with a position value of $70.25 million and current unrealized profit of $5.62 million. The funding source address for the ETH long position has a direct fund intersection with a known UXLINK hacker address: one month ago, both addresses consolidated their remaining ETH Gas to the same wallet on the same day. In early August, after consolidating 11.54 million USDC from multiple channels, the hacker began trading ETH on Hyperliquid, opening positions 6 times in total, with 5 profitable trades and total profits of $5.71 million.
According to monitoring by Scam Sniffer, a user's assets on the Ethereum and Base networks were reportedly stolen due to a leaked private key, resulting in losses of approximately $1.58 million. The attacker drained 682 ETH in under two hours, with approximately 281 ETH subsequently transferred to Tornado Cash.
According to the official announcement from Foundation, regarding the recent phishing email incident, the team's investigation found that its email system recorded over 23,000 phishing email sending attempts, of which 19,057 were sent via Mailgun and another 1,503 via Google Workspace. Since some mailboxes received multiple emails and some sending attempts failed or were blocked, the actual number of affected individuals cannot currently be confirmed.
Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)
Odaily reports: Bitcoin News posted on X that Foundation Devices stated attackers launched over 23,000 phishing email attempts targeting its hardware wallet customers, exploiting customer records the company believed had been deleted but were still retained in historical database tables. Investigators confirmed that 19,057 of these emails were sent via Mailgun, while another 1,503 were sent through Google Workspace; the number of affected customers remains undetermined.Foundation Devices stated that after the legacy WooCommerce database migration, customer names, shipping information, refund records, and incomplete checkout information in the old tables remained accessible; recent Shopify order information may also have been exposed. The company said there is no evidence that the Passport hardware wallet or its private keys were compromised, and the investigation is ongoing.
According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."