News linked to this event type.
ether.fi has stated it is aware of multiple security incidents in the industry over the past 24 hours, including an incident involving Railway. ether.fi says the platform was not affected by these incidents, and neither its system operations nor user funds were impacted.
Onchain Lens posted on X questioning CoinDCX's so-called hack incident, stating that CoinDCX may have undisclosed fund anomalies—user deposits had flowed into a wallet that was not included in the relevant fund accounting, after which nearly equivalent funds were transferred out; some funds were also moved through less common cross-chain bridge entry points and services, indicating abnormal pathways.Onchain Lens further pointed out that some funds suspected to be related to CoinDCX hot wallets flowed through over-the-counter (OTC) services and mixing platforms, and questioned that the CoinDCX team still denied the occurrence of a security incident even after multiple researchers and on-chain investigators presented relevant evidence.
Odaily reports: Bitcoin News posted on X platform that users running Eclair Lightning nodes should upgrade to v0.14.5. ACINQ released two versions within 5 days: v0.14.4 on October 15 fixed a vulnerability where malicious websites exploited browser-cached API login credentials to trigger payment and channel operations; v0.14.5 on October 20 fixed vulnerabilities in the node's peer layer, which developers said could allow channel partners to steal funds or interfere with payments. No fund losses have been reported so far. After the update, the browser dashboard will no longer be able to communicate directly with the node API.
Zipcoin has announced it is ceasing operations, stating that the project's codebase and related keys have been fully compromised, and attackers may control the project's wallets and infrastructure. The team noted that attempts to migrate the code and rotate credentials over the past 12 hours failed to identify a viable security solution. Zipcoin further disclosed that the project was impacted by the UNCX incident on October 15, during which hackers stole tokens from multiple Ethereum-based assets—including ZC, PAAL, and EDGEN—accounting for approximately 1.1% of their respective supplies, which were subsequently sold on open markets. The team had previously repurchased tokens from the market to offset the shortfall against future team commitment allocations.
according to Blockaid monitoring, the WAX multichain bridge on the WAX network is under attack, involving WAX, Solana, and Ethereum. The attacker withdrew mapped tokens on the WAX chain without paying the corresponding assets, while the bridge contracts on Solana and Ethereum still released the corresponding tokens. The attacker transferred approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC through 5 transactions. The scope of the incident's impact and whether losses are still expanding remain to be further confirmed.
CZ posted that no crypto wallet can be absolutely secure, and there is no software completely free of vulnerabilities or technology that is 100% secure. He pointed out that any action carries risk, and so does inaction; problems, setbacks, and challenges that need to be resolved are also inevitable along the way. CZ advised users to stay up to date, manage risk well, and actively solve problems.
Indian crypto exchange CoinDCX has released an update on the on-chain activity of the TQKJQ wallet, stating that following the July 2025 security incident, some previously generated deposit addresses were compromised and deactivated, yet some users continued to transfer crypto assets to these expired addresses. The platform would normally periodically sweep such funds for accounting and safekeeping purposes, but the relevant process failed for a period of time and was discovered this morning, resulting in certain operational losses for the platform, which CoinDCX will bear.CoinDCX stated that despite users depositing to expired addresses, the accounts of affected users have all been credited accordingly. The platform said user funds remain safe, customer assets continue to be held in separate cold wallets, the active addresses currently used by the platform and users are unaffected, and platform funds in active wallets have not been compromised. Currently, the CoinDCX platform and all trading activities are operating normally. The platform reminds users to verify the latest deposit addresses through the official app or website to avoid transferring funds to deactivated addresses.
Odaily reports: Amazon's threat intelligence team found that hackers attempted to exploit two PHP security vulnerabilities days before their public disclosure on October 17. After the vulnerabilities were made public on Wednesday, exploitation activity expanded further. Amazon said the vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity firm Palo Alto Networks found that more than 22.6 million exposed instances worldwide are affected by the vulnerabilities. Wiz researchers estimated that the vulnerability could affect about 70% of the internet and has existed for more than a decade, while Matt Hull, vice president of cyber intelligence and response at NCC Group, warned that some vulnerable systems may already have been compromised or even implanted with backdoors. (Bloomberg)
The Cysic Foundation has issued a notice to the parties responsible for the unauthorized issuance of the CYS token, demanding the return of 275.872 ETH within 72 hours, which accounts for approximately 90% of the confirmed related proceeds. As a bounty for asset recovery, the party may retain the remaining approximately 30.652 ETH. The foundation stated that it has reconstructed key stages of the attack and preserved relevant technical and on-chain evidence; if payment is not received within the deadline, it will escalate the matter and cooperate with law enforcement to launch a criminal investigation.
SlowMist released a security alert warning that the NEM token contract suffered an attack, causing losses of approximately $821,920. The root cause stems from NemTokenV2 recording tokens transferred into the liquidity pool (LP) in the sell volume without verifying swap settlement. Exploiting this vulnerability, the attacker repeatedly executed transfers, called skim() to clear the incoming tokens, and called flushLpSellRecycle() a total of 42 times, depleting the pool's original reserves and suppressing the NEM reserve balance. The attacker then sold the remaining NEM at the inflated price to extract USDT.
According to CoinDesk, the XRP Ledger’s validator support temporarily fell to 26/35, re-triggering the two-week countdown for its vulnerability fix and delaying patch activation to November. Validator support has since rebounded to 31, but due to the reset mechanism, the fix has missed its originally scheduled final activation window.
In an announcement posted on October 22 via Pirate Chain’s official X account (@PirateChain), the team released mandatory update v6.0.14. On October 14, attackers exploited two verification vulnerabilities to mint approximately 39.82 million fake ARRR in the transparent coinbase pool, temporarily inflating the supply by about 20%. Following a consensus reached by the community, node operators, mining pools, exchanges, and dPoW notarizers, the chain was rolled back to block height 4,176,944 (October 14 at 19:55:14 UTC, prior to the attack). Version 6.0.14 automatically rejects the exploited blocks and all subsequent blocks, completely removing the counterfeit coins, while the maximum supply of ARRR remains unchanged at 200 million. dPoW notarizers have agreed to continue notarizing the patched chain, and old forks will no longer receive notarization. The team requires all users, Treasure Chest and CLI node operators, miners, mining pools, exchanges, and service providers to immediately deactivate the outdated version and upgrade.
SlowMist monitoring reveals that LiteLLM has once again been targeted by a supply chain attack. The malicious version [email protected] affects PyPI packages and Docker images, including floating tags such as latest and main-stable. This malware executes automatically upon Python startup, stealing sensitive data such as cloud service credentials, AI API keys, and SSH private keys, and enables remote code execution. The affected versions have currently been removed or replaced. SlowMist advises users to avoid using version 1.107.0, rebuild affected environments with clean images, rotate potentially exposed credentials, and pin the version to 1.106.2.
According to Onchain Lens monitoring, following the Railway security breach, a suspected attacker wallet has transferred at least $369,300 to HitBTC and other addresses. The wallet had also previously received funds from an address associated with CryptoBillis Ledger Drainer, though its connection to the Railway security breach has not yet been confirmed.
WordPress has issued an official security advisory noting that the PHP project has released a security update. Given the severe impact of the vulnerability, site owners are advised to update PHP immediately and contact their hosting providers to verify patch deployment and the implementation of Web Application Firewall (WAF) mitigation rules. Users can check their website's currently running PHP version by navigating to the WordPress backend under Tools > Site Health > Info > Server. Versions prior to PHP 8.2 have ceased receiving official security updates. For sites still operating on older versions with self-managed servers, if an immediate remediation is not feasible, it is recommended to consider temporarily taking the server offline until the vulnerability is effectively mitigated. WordPress emphasizes that this vulnerability is not exclusive to its platform, but rather affects servers running PHP applications.
According to monitoring by Olaoluwa Osuntokun, the CTO of Lightning Labs stated that due to the CVE-2026-111943 vulnerability, all lnd, btcd, tapd, and litd users are strongly advised to update their binaries or rebuild using Go 1.27.3. The vulnerability involves the compromise of a certificate authority and may affect the security of related software.
Dragonfly Managing Partner Haseeb Qureshi (@hosseeb) posted on X stating that the cybersecurity sector is experiencing a pandemic-like wave of attacks. He views on-chain breaches as a "warning signal" for the broader internet security landscape, as it remains the easiest place for cyberattacks to be monetized. He noted that while the volume of exploits in the crypto space has surged significantly, the annualized value of stolen assets remains roughly consistent with 2025 levels—indicating a trend of increased attack frequency offset by smaller individual amounts. Smaller, under-maintained protocols are facing mass breaches, while major protocols have already integrated AI tools to bolster their defenses. He anticipates that a similar dynamic will soon emerge in the traditional cybersecurity industry.
According to security researcher Spreek (@spreekaway), the administrative keys for swETH and rswETH under Swell DAO appear to have been compromised. Attackers are inflating the NAV (Net Asset Value) without asset backing by up to 1% per hour. Four malicious upgrade contracts have been deployed and are queued for multisig execution; if executed, they could result in the theft of approximately 2,500 ETH. Furthermore, analysis by ADL (@ADLXBT) indicates that the management keys control proxy administrator permissions. Once seized by attackers, these keys could allow the redirection of swETH/rswETH proxies to malicious implementation contracts, triggering minting or withdrawal functions to artificially inflate the NAV without corresponding asset backing. Spreek noted that any connection between this incident and the Railway platform remains speculative, with only a coincidental timeline observed and no concrete evidence available. The incident report he published was generated by Claude, and certain portions remain unverified.
Nina Rong (@nina_rong), Head of Growth at BNB Chain, posted that BNB Chain's technology stack does not use PHP and reminded users to remain vigilant. Previously, the National Security Agency's cybersecurity division NSA Cyber (@NSACyber) issued an advisory stating that all organizations using PHP to build systems should prepare for updates aimed at fixing two critical vulnerabilities. PHP is widely used in web applications, and such vulnerabilities can typically provide direct access to the server file system.
Vitalik Buterin (@VitalikButerin) posted on X that he did not predict defense would automatically outpace offense, but rather believes cybersecurity will ultimately reach an endgame favorable to defense, although the transition will be difficult. He pointed out that "good guys discovering vulnerabilities in deployed software before bad guys" does not constitute a defense-biased game. To truly shift the balance toward defense, deeper methodological changes are required, including formal verification and aggressively shrinking the trusted computing base (TCB), which are only just beginning. He also noted that this is a major reason for his support of slowing or pausing AI development, and urged dedicating over 1% of GDP to hardening cybersecurity, biosecurity, and the physical world.