News linked to this event type.
Odaily Report: Three men in Bristol, UK, broke into a man's home in the early hours of May 15, assaulted the victim, and demanded he hand over a large amount of cryptocurrency. The victim sustained head injuries and was hospitalized for treatment; the three men were unsuccessful in their attempt.Terroll Paul, Mohamed Samagassi, and Pierre Madzou all pleaded guilty to aggravated burglary and were sentenced at Bristol Crown Court on October 15. Paul was sentenced to 6 years, Madzou to 5 and a half years, and Samagassi to 5 years; the victim's underage sister called the police, and the three were subsequently arrested at the scene.Police did not disclose the amount of cryptocurrency the three demanded. The case is a "wrench attack," in which criminals use violence or threats to force cryptocurrency holders to hand over digital assets; data from blockchain security firm CertiK shows that in the first six months of 2026, such attacks worldwide caused $124 million in losses, a 12-fold year-on-year increase. (Decrypt)
According to CoinDesk, the development team behind Zcash's new node software, Zakura, plans to generate a unique viewing key for each ZEC swap conducted via NEAR Intents, while the spending key remains secured by the user's primary account. Under the current architecture, when users swap private ZEC for USDC via NEAR Intents, one of their Zcash privacy addresses is publicly broadcast on the NEAR public chain as a refund address and remains retained after the swap is completed. While this address currently does not leak information, sufficiently powerful quantum computers in the future could potentially reverse-engineer the viewing key using Shor's algorithm, thereby linking all payments received by that account, including amounts and memos. By implementing a "one-key-per-swap" approach, even if a refund address is compromised, attackers will only be able to view payments related to that specific swap. To address the issue of having to scan the entire blockchain sequentially during wallet recovery due to an abundance of keys, Zakura employs Private Information Retrieval (PIR) technology, allowing the wallet to query the location of incoming refunds without the database learning which address was queried.
Vitalik Buterin (@VitalikButerin) stated that the ideal path for supporting various cryptographic algorithms lies in EIP-8288: users locally generate arbitrary signatures, produce STARK proofs, and submit them on-chain via a STARK aggregator. This avoids consuming calldata on-chain, so Ethereum no longer needs to add new precompiles. He also noted that if lattice cryptography (Lattice) is proven to be secure against AI attacks, it could still be utilized for accounts, wallets, and similar applications via precompiles in the future. Previously, Starknet co-founder Eli Ben-Sasson pushed back against related views from a16z, arguing that the rich mathematical structure of lattice cryptography makes it susceptible to AI attacks. Furthermore, the simplified variant based on Module SIS only emerged in 2012 and lacks sufficient maturity. He recommended waiting another three to five years until AI has thoroughly stress-tested these approaches before deploying them to custody large asset balances.
Odaily reports: Lending protocol Secured Finance has announced that it has completed its recovery and reopened on Ethereum, Arbitrum, and Filecoin. According to the official statement, users did not lose funds, assets have been replenished, and contracts, balances, positions, and order books have all been repaired and verified. Secured Finance's lending market suffered an attack on September 5, with losses of approximately $104,000.
Former Mt. Gox CEO Mark Karpelès (@MagicalTux) posted that Ledger Support (@Ledger_Support) stated on August 20 that the Secure Element chip can detect physical tampering; if extra hardware intercepts signals, the device will refuse to execute unsigned code or fail the Genuine Check. Karpelès pointed out that Ledger's own technical documentation explicitly states: if the original Secure Element is intact, the Genuine Check cannot detect unauthorized physical hardware modifications such as spy implants. The two statements contradict each other. He also noted that recent reports show over $90 million in assets were stolen precisely through this method of "extra hardware intercepting signals." Furthermore, in a March 2026 Ledger Academy article, Ledger had already published photos of spy implants installed inside multiple Ledger devices, including mass-produced complex PCBs, indicating they were long aware of this threat. Karpelès believes this conduct constitutes misleading promotion and cited that French law has specific regulations regarding misleading advertising.
Qubic stated that between 23:42 UTC on October 17 and 01:26 UTC on October 18, an attacker exploited insufficient randomness in some wallet seeds to access and drain approximately 2.94 trillion QU tokens from 1,404 Qubic wallets. The project team emphasized that the issue lies with the seed generation mechanism, not the Qubic protocol itself.
Odaily reports: Blockchain project Qubic has disclosed that between October 17 and 18, approximately 2.94 trillion QU worth $1.3 million was transferred out of 1,404 wallets. The unauthorized transfers occurred between 23:42 and 01:26 the following day, after which network validators paused transactions at tick 85,371,949.Qubic stated that the incident involved predictable wallet seeds generated by older Apple devices and browsers, and that the issue has been fixed in version 4.26.4. Developers also secured other at-risk funds before the attacker could move them.About 87.1% of the stolen QU remains within the paused Qubic network, while approximately 12.9% was transferred to cryptocurrency exchange MEXC and frozen. Cryptocurrency exchange Bitget has suspended QUBIC deposits and withdrawals. Whether victims will be compensated is to be decided by Qubic's Computor cluster, and QEARN staking remains unaffected. (Bitcoin.com News)
Odaily reports: Former Mt. Gox CEO Mark Karpelès is developing a low-cost device designed to detect hidden LTE antennas used in hardware wallet supply chain attacks, without the need to open the wallet. The device will emit weak radio waves and measure resonant frequencies to identify potential spy implants. Karpelès plans to publicly release the circuit board design and specifications so that anyone can build one themselves; the project is still in the conceptual stage, with a prototype expected to be launched in the coming weeks. (Bitcoin News)
a report from blockchain security firm Hacken shows that in Q3 2026, there were 107 security incidents in the crypto industry, with losses amounting to $1.18 billion, up 55% quarter-over-quarter. Of this, approximately $906.8 million in losses involved compromised vendors or development tools, known vulnerabilities that were not patched in a timely manner, and related components not being included in the latest audit scope.Hacken co-founder Andrii Matiukhin pointed out that project teams often only audit critical smart contracts, while wallets, signing systems, and third-party software may not be covered, leading investors to mistakenly believe that the project is secure as a whole. The report states that the largest loss event in Q3 was the attack on Bitget, with losses of at least $352 million, in which attackers exploited a vulnerability in a third-party security product to gain access to withdrawal infrastructure.Hacken also found that the asset security of some derivatives trading platforms and prediction markets relies on inadequate key management arrangements, but no vulnerabilities currently being exploited have been found in the relevant platforms. The company emphasized that security audits cannot replace continuous vulnerability management, and project teams still need to promptly fix known vulnerabilities and ensure that audits cover the system components that actually affect the safety of funds. (CoinDesk)
The Cysic Foundation released an incident report stating that on October 17, its cross-chain bridge experienced a security incident in which an attacker minted 10 million CYS without authorization on the BNB Smart Chain. Upon discovering the anomaly, the project team suspended the cross-chain bridge, placed related addresses on an on-chain blacklist, and hired a professional security firm to investigate the attack vectors and fund flows.
Odaily reports: The crypto project Cysic has announced that its cross-chain bridge was paused on Saturday after an attacker exploited a processing flaw to mint 10 million CYS tokens without authorization on BNB Smart Chain. Preliminary investigations indicate that the attacker may have gained unauthorized access to the database supporting the bridge.The unauthorized minting occurred at 12:31:38 UTC, and Cysic blacklisted the receiving address in the token contract at 13:47:52. The address currently still holds approximately 2.8 million CYS, and related transfers have been restricted.Cysic stated that the incident only involved cross-chain bridge message processing and token minting, and did not affect the mainnet or other operating systems, nor did it result in the theft or unauthorized transfer of existing CYS or other assets in user wallets. Token transfers, swaps, and actual losses are still under review, and the company has engaged security firms and plans to release a follow-up report. (Cointelegraph)
OpenCode stated that it experienced a security incident related to large-scale model distillation attacks, affecting approximately 1.4% of OpenCode Console users. The affected scope primarily involves certain users who have connected to external model providers. OpenCode has notified all affected accounts via email; users who did not receive a notification are not within the scope of this incident.
Odaily reports: Bitcoin News posted on X platform that former Mt. Gox CEO Mark Karpelès accused Ledger of failing to adequately alert customers to sophisticated hardware implants after learning of the relevant threat as early as March 2026, and of burying related warnings in Ledger Academy articles. Karpelès stated that evidence of mass-produced, self-aligning implants should have triggered a highest-level alarm response. After Ledger CEO Pascal Gauthier responded by referencing his Mt. Gox experience, Karpelès fired back, saying he had trusted Ledger to learn from his failures and do better than he did. Karpelès also criticized Ledger for continuing to downplay the incident and questioned its communication with affected customers.
Odaily Report: According to on-chain detective Specter's monitoring, after ZachXBT disclosed that the Bitget attacker used Zcash (ZEC) to obscure stolen funds, other stolen funds have also begun flowing into ZEC, including funds from the Cryptobills Ledger incident and the $12 million Triple-A hack. Threat actors are using ZEC to move stolen funds.
Odaily reports: Cryptocurrency exchange Bitget has announced that it will cease providing services to certain users through a one-time measure. Bitget stated that user funds remain safe during the related service adjustments, and the platform will continue to operate.Affected users will receive follow-up steps, relevant deadlines, and fund withdrawal arrangements via email, in-app messages, and/or push notifications. Users who have not received official notifications from Bitget may continue to use their accounts normally.Bitget's customer support team will assist users with pending orders, withdrawals, and other account issues during the process, and reminds users to use only official channels and to beware of phishing links, impersonation accounts, and unverified information.On September 25, Bitget confirmed an unauthorized transfer and temporarily suspended withdrawals to investigate a security breach. Subsequent disclosures revealed that the incident involved approximately $388 million in stolen assets. (Cointelegraph)
In a postmortem article published by Alex Shevchenko (@AlexAuroraDev), lead of NEAR Intents, a vulnerability was identified in the NEAR Intents contract's deposit notification mechanism when interacting with third-party contracts. The attacker deployed a contract that caused the notification call to fail, triggering the token contract to refund the deposits while the NEAR Intents contract retained the deposit records. Through 23 failed deposit transactions, the attacker generated approximately $3.8 million in "phantom funds," which were subsequently withdrawn to external chains via Omni infrastructure. This vulnerability resided in the NEAR Intents contract rather than in the Omni infrastructure. The timeline indicates the attack occurred between September 29 and October 1. The team detected withdrawal anomalies on October 1 and paused the contract within 29 minutes. Thanks to collaboration between the SHIELD security layer, on-chain tracking efforts, and industry security researchers, the attacker fully returned the funds on October 2, and all affected users have been compensated. The postmortem highlighted that existing monitoring only tracked discrepancies between aggregate token balances on the source chain versus NEAR, failing to monitor the mismatch between total user balances and contract token balances. This oversight allowed the attack to proceed undetected for several days. For remediation, the team has completely disabled the deposit notification functionality and implemented new monitoring for discrepancies between total user balances and contract balances. If this invariant is violated, the contract will automatically pause. On October 7, white hat research
According to CryptoSlate, Microsoft and the cybersecurity organization Health-ISAC have obtained a U.S. court order to seize and redirect the domains supporting three services: YAM Store, CoGUI, and Iron Man. These three services sell stolen accounts and phishing tools to fraudsters. Since January this year, they have assisted in sending over 1 billion phishing messages, targeting more than 75,000 institutions across over 150 countries, generating tens of millions of dollars in revenue for operators. Microsoft has disabled more than 20,000 accounts associated with YAM Store and continues to block over 100,000 spoofing and fraudulent domains. According to Microsoft's investigation, these services accept payments in USDT (Tron network) and ETH, with Cloudflare noting that buyers can also pay using USDC. Blockchain analytics firm TRM Labs assisted investigators in locating and freezing related assets, though the frozen amount was not disclosed.
Odaily News: Former Mt. Gox CEO Mark Karpelès stated that hardware wallet manufacturer Ledger received warnings about possible tampering with its hardware wallets as early as December 2025, but did not take sufficient measures to alert customers before the recent security incident occurred.Karpelès believes that Ledger should have disclosed the relevant risks to users earlier and strengthened security warnings. Currently, the above claims are Karpelès's personal allegations, and it cannot yet be confirmed on this basis that Ledger devices have a large-scale security vulnerability. (Cointelegraph)
According to CoinDesk, blockchain analytics firm Chainalysis disclosed on Thursday on X that a cryptocurrency scammer who profited from a "task scam" (luring victims with paid review boosting or order brushing, then demanding account top-ups under the guise of a "negative balance") transferred the illicit proceeds to three Ledger hardware wallet addresses. These addresses were subsequently drained by attackers, resulting in a total loss of 60 BTC valued at over $4.9 million, making it one of the biggest victims in this Ledger device intrusion incident.
Odaily reports: SlowMist has issued a warning that a fake "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to conduct attacks. The phishing page is highly convincing, including a fake "Genuine check" page, a device selection interface, and an "Update Now" button. SlowMist reminds users never to update Ledger devices through website links and never to enter their Recovery Phrase anywhere.