News linked to this event type.
a high-severity reliability vulnerability has been disclosed in Succinct's zero-knowledge proof system SP1. The vulnerability was disclosed on October 11 via GitHub advisory GHSA-p7v2-jjv3-8p8f, affecting SP1 native Rust verifier versions 6.0.0 through 6.8.0, potentially allowing the mainnet Prover Network to accept invalid proofs: a malicious prover could submit a proof of invalid execution, and the network verifiers would still accept it. The cause of the vulnerability is that the verifier only reads the data's label (declared dimension) and does not verify whether the actual number of stored elements equals the product of the dimensions; an attacker could forge the label to make an invalid proof pass. Groth16 and Plonk checks that use fixed-shape wrap proofs are unaffected, and the on-chain Solidity verifier is also secure. Succinct released fix version 6.8.1 on September 24, which has been deployed to mainnet; this version adds deserialization length validation. The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users who run the native Rust verifier themselves and accept untrusted proofs need to upgrade to 6.8.1.
Initia stated that on October 23 at 22:59 (UTC+8), an attacker exploited a vulnerability in the Initia MoveVM script cache to bypass security checks and forge MoveVM state, crediting themselves with WETH, iUSD, and USDC that had no actual backing. The total supply of the relevant tokens has not changed, INIT was not minted additionally, and the total supply is unaffected.
CNVD stated in its security protection recommendations that operators of information systems should further strengthen security measures, conduct a comprehensive inventory of their network assets, and reduce the public-facing exposure surface of information systems by adhering to the principle of keeping non-essential systems off the internet. Operators that do not yet meet the conditions for remediation should implement temporary countermeasures such as network isolation, network access restrictions, and taking non-essential business systems offline.
Odaily reports: At 2:39 AM EST on October 23, Swell announced the suspension of deposits and withdrawals for its liquid staking token swETH and restaking token rswETH until the net asset value (NAV) returns to correct levels, without disclosing a restoration timeline. On-chain data shows that at 16:48 that day, the contracts reported approximately 1.203 ETH per swETH and approximately 1.138 ETH per rswETH, roughly 6% and 5% higher than the normal exchange rates of 1.133 ETH and 1.082 ETH as determined by Spreek, respectively; rates on decentralized exchanges stood at approximately 1.089 WETH per swETH and 1.029 WETH per rswETH, both far below the contract-reported values. Spreek stated that at 21:28 on October 21, the admin keys of both tokens were suspected to have been compromised, with NAV being inflated by up to 1% per hour without asset backing; the attacker deployed 4 malicious upgrade contracts capable of withdrawing approximately 2,513 ETH, but the transactions were not queued through Swell's multisig. Odysseus, founder of Phylax Systems, said the incident involved BOT key misuse, and losses have not been confirmed. Railway disclosed the same day that an unauthorized third party may have read customers' encrypted environment variables. Swell stated that funds are safe.
According to monitoring by SlowMist founder Yu Xian, users should promptly update their iPhone and iPad systems and be wary of certain installed apps that have been compromised by DarkSword. DarkSword primarily conducts targeted attacks and steals crypto assets from iPhone crypto users, exploiting iOS vulnerabilities to break out of the sandbox and steal various passwords and other private data stored in the Keychain, as well as local wallet private key files, notes, and other private data.
According to on-chain anti-money laundering monitoring platform AMLBot, Tether has frozen approximately $2.2 million worth of USDT related to the hacking incident at cryptocurrency exchange CoinDCX, involving multiple on-chain addresses.
OpenAI requires state-of-the-art models to be trained in environments without direct access to the real-time internet. Previously, an internal research model exploited a vulnerability to gain limited internet access, resulting in an 11-day suspension of training.
According to Zon monitoring, available information indicates that this security incident may have originated from a Day 0 vulnerability in Initia's MoveVM built on Cosmos SDK. The vulnerability allowed attackers to mint additional tokens on Initia L1, but does not affect the native token INIT. Before the blockchain was halted, the attacker had already transferred out approximately $2.7 million worth of AUSD, ETH, and USDC through additional minting and cross-chain transfers. The team is still investigating, and the subsequent impact and further details remain to be confirmed.
Initia officially announced that due to a security incident, Initia L1 and its Rollups have been suspended. The team is working with security teams, validators, and exchanges to investigate the incident and determine the scope of impact. Initia stated that verified information will be released through official channels going forward, and reminded users to be wary of unofficial links, messages, and unverified claims circulating during the incident.
据 Spreek 监测表示，Initia 链遭遇攻击，多个代币出现“无限增发”情况。攻击者目前已套现约 260 万美元，另有部分资金仍在转移过程中。攻击者以太坊地址（0xDD9 开头）目前持有约 1102 枚 ETH，价值约 265 万美元，该地址初始资金来自 Tornado Cash。此外，攻击者在 Initia 链上的地址仍持有约 454 万美元资产，包括 300 万枚 iUSD、92 万枚 USDC、40 万枚 AUSD 及 95 枚 ETH。目前 Initia 官方尚未回应。
The International Criminal Police Organization (Interpol) reported that Operation Serengeti III was conducted across 21 countries from June 29 to August 31, 2026, resulting in the arrest of 1,462 suspects, the takedown of 10,909 malicious websites, and the seizure of over $105 million in illicit funds. Investigations also confirmed that 65,929 victims were targeted by cybercrime syndicates, with associated losses exceeding $385 million. The operation primarily targeted cyber fraud, ransomware, business email compromise, online scams, and digital extortion. In specific cases, Ugandan police dismantled two transnational fraud rings and arrested 365 foreign nationals; Angolan authorities shut down two illegal cryptocurrency mining farms, arresting nine individuals and confiscating more than 2,000 mining rigs; and another case in Nigeria involved over $2.4 million in suspected illicit proceeds, a significant portion of which was laundered through cryptocurrency transactions.
Odaily reports: Bitcoin Core developers have merged a security policy adjustment. For vulnerabilities that can be easily discovered or rediscovered through simple large language model (LLM) prompts, the previous long-term confidential disclosure mechanism will no longer be used. The new rules allow developers to mark such issues as "easy to find" during vulnerability classification, then backport fixes to all still-supported versions and release them as soon as possible through minor version updates, along with a security advisory and some vulnerability details.Previously, Bitcoin Core scheduled disclosure based on vulnerability severity, with medium- and high-risk vulnerabilities usually only made public after the affected versions stopped being maintained. This adjustment stems from AI tools lowering the threshold for vulnerability discovery: in July this year, a Bitcoin Red Team composed of 16 developers used AI models to scan about 390 Bitcoin-related projects and recorded 4,962 findings in one day, of which 85 were listed as critical issues. Developers noted that continuing to extend the confidentiality period for such vulnerabilities can no longer effectively prevent attacks and instead delays the release of fixed versions; however, the new rules also mean that fixes may lack longer testing time. Currently, no vulnerability has been officially marked as falling into the "easy to find" category under the new rules. (CoinDesk)
Cysic has released the latest update on the cross-chain bridge security incident, announcing plans to burn 7.2 million CYS from the foundation reserve by the end of October to offset previously unauthorized minted tokens and bring the token supply back in line with the established tokenomics model. The relevant on-chain burn records will be published once confirmed.
In a recent threat intelligence report, Mist disclosed that it received user feedback regarding a GitHub repository named sol-live masquerading as a Solidity interview practice project. The repository conceals commands to download and execute remote scripts in its .vscode/settings.json file, which may trigger malicious payloads when users launch the custom terminal configuration. Analysis by Mist indicates that the associated malware can harvest browser login databases, wallet extension storage, and macOS Keychain files. It also possesses capabilities such as scanning and uploading local files, executing remote commands, providing interactive Shell access, and monitoring the clipboard. On macOS and Linux, execution only occurs if users manually activate the malicious terminal configuration. The attack chain on Windows remains unconfirmed due to issues with quotation mark handling.
On-chain analyst PeckShield (@PeckShieldAlert) has tracked an address flagged as the Cysic attacker depositing 300 ETH (approximately $721,140) and 30.4 BNB (approximately $22,590) into Tornado Cash. According to the Cysic Foundation, a security incident involving the Cysic cross-chain bridge occurred on October 17, during which the attacker minted 10 million CYS tokens without authorization on the BNB Chain.
According to Cointelegraph, Bitcoin Core developer Antoine Poinsot stated on Thursday on the bitcoin-dev mailing list that large language models (LLMs) have made certain software vulnerabilities extremely easy to rediscover. Maintaining long-term secrecy is already of limited value and instead delays the release of patched versions, prompting the team to update its vulnerability disclosure policy. The new policy dictates that "easily discoverable" vulnerabilities, which can be identified with minimal cost such as through simple LLM prompts, will be patched as soon as possible across all supported major versions, alongside the simultaneous release of security advisories. Other vulnerabilities will continue to be disclosed based on severity: low-severity vulnerabilities will be disclosed two weeks after the release of the major version containing the fix; medium-to-high-severity vulnerabilities will be disclosed two weeks after the end-of-life (EOL) of the last affected version, typically around one year after the patch release; critical vulnerabilities will be handled through a dedicated process.
Bitcoin Core has adjusted its security vulnerability disclosure policy, defining easily discoverable vulnerabilities as those that can be found through simple large language model prompts, and will release fixes as soon as possible across all major versions still under maintenance, while publishing security advisories.Bitcoin Core developer Antoine Poinsot stated that in the past, vulnerabilities were typically kept confidential during a longer disclosure embargo period to allow users to upgrade, but large language models have lowered the threshold for rediscovering certain vulnerabilities, limiting the protective value of delayed fixes.Low-severity vulnerabilities will be disclosed two weeks after the major version containing the fix is released; medium- and high-severity vulnerabilities will be disclosed two weeks after the affected version reaches end of life, typically about one year after the fix enters a new version. Critical vulnerabilities are not subject to the standard policy and will be handled through ad hoc procedures.In August, the volunteer organization Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with about one-fifth having been reproduced at the time. Core Lightning developers that same month asked node operators to upgrade or take nodes offline, and delayed disclosure of technical details for two weeks. (Cointelegraph)
Odaily reports: The SlowMist security team has released a report stating that two recently disclosed high-severity PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are posing risks to the off-chain infrastructure of the Web3 industry. Both vulnerabilities have a CVSS v4.0 score of 9.2. Attackers do not need an account password or API key—simply sending a crafted request to a PHP service exposed to the public internet may allow them to execute arbitrary code with the privileges of the web service process.The vulnerabilities affect all versions of PHP from 5.4 to 8.5.11, and details of the flaws leaked before the official patches were released. Amazon's threat intelligence team observed actual exploitation attempts 4 days before public disclosure. Scanning by SlowMist's threat intelligence system MistEye shows that among 1,488 crypto-related domains surveyed, 793 carry direct PHP fingerprints, accounting for approximately 53.3%.Affected off-chain infrastructure includes Web3 project frontend pages, API interfaces, airdrop claim pages, operations backends, and custodial wallet services. If attackers exploit the PHP vulnerabilities to compromise a project's web server, they may tamper with frontend pages and trick users into signing malicious transactions, thereby stealing assets.Official releases of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been published, and affected projects should upgrade to the corresponding latest versions. PHP 8.1 and earlier versions have reached end-of-life for upstream regular support and should be migrated as soon as possible. Temporary mitigation measures taken when an immediate upgrade is not possible can only reduce the risk of specific attack paths; applying the patch remains the definitive solution.
CZ stated that while the market widely worries AI could attack crypto systems, the internet and banking systems actually rely on weaker encryption technologies.CZ also noted that AI doesn't need to genuinely crack Bitcoin's cryptographic system to cause harm—existing data leaks can already be used for larger-scale phishing, social engineering attacks, and other risk scenarios.
According to Bloomberg, the Commodity Markets Council, representing derivatives exchanges such as CME Group and commodity traders, has informed the U.S. Commodity Futures Trading Commission (CFTC) that perpetual futures pose significant risks to market integrity, urging regulators not to approve the perpetual oil futures contract proposed by prediction market platform Kalshi. The organization also called on the CFTC to plug regulatory loopholes to prevent retail investors from accessing offshore trading platforms through this channel.