News linked to this event type.
According to CoinDesk, blockchain analytics firm Chainalysis disclosed on Thursday on X that a cryptocurrency scammer who profited from a "task scam" (luring victims with paid review boosting or order brushing, then demanding account top-ups under the guise of a "negative balance") transferred the illicit proceeds to three Ledger hardware wallet addresses. These addresses were subsequently drained by attackers, resulting in a total loss of 60 BTC valued at over $4.9 million, making it one of the biggest victims in this Ledger device intrusion incident.
Odaily reports: SlowMist has issued a warning that a fake "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to conduct attacks. The phishing page is highly convincing, including a fake "Genuine check" page, a device selection interface, and an "Update Now" button. SlowMist reminds users never to update Ledger devices through website links and never to enter their Recovery Phrase anywhere.
Odaily News: The artificial intelligence task force led by U.S. President Donald Trump, named the "Super Intelligence Force," convened its first meeting and agreed to prioritize assessing AI risks in areas including cybersecurity, biosecurity, and "model control and accountability." The White House stated that the task force will commission the President's Council of Advisors on Science and Technology (PCAST) to produce a report on these risks and other potential issues.The task force also plans to establish a mechanism requiring AI laboratories to provide early warnings and systematic notifications to the government regarding security vulnerabilities, hacks, jailbreaks, and other issues, and to form an enforcement and consumer protection coordination committee involving the U.S. Department of Justice, the Federal Trade Commission (FTC), and other agencies. The White House said the task force has not yet discussed drafting new laws or regulatory rules.Although Trump has repeatedly opposed strengthening AI regulation, arguing it could weaken U.S. competitiveness with China in the AI field, AI safety issues are drawing increasing attention from bipartisan lawmakers in the U.S. as concerns grow over AI's potential to cause mass unemployment, humanity losing control of AI, and data centers driving up electricity prices. (Bloomberg)
Odaily News: On-chain analyst Murphy posted on X that during the recent BTC decline, the scale of BTC transfers to exchanges by short-term holders (STH) increased significantly, with an average of approximately 2,200 BTC transferred per hour within a 4-hour window, reaching the fourth-highest level since the market rally began in August this year. However, the transfer peak on October 15 was already lower than that of October 8, indicating that the potential selling pressure from short-term holders has somewhat weakened.In contrast, long-term holders (LTH) transferred only about 480 BTC per hour to exchanges during the same period, roughly one-fifth of that of short-term holders. Murphy noted that on October 8, long-term holders had a transfer peak of approximately 3,700 BTC per hour, which may have been partly related to asset transfers triggered by a hardware wallet security incident. However, considering that both long-term and short-term holders showed large-scale transfers on that day and BTC prices fell rapidly, actual selling pressure still existed in the market.Murphy believes that during the current decline, those transferring BTC to exchanges are primarily short-term holders, while long-term holders remain relatively stable overall, and the transfer intensity of short-term holders has weakened compared to before, reflecting that the BTC holder structure still possesses a certain degree of resilience.
According to PeckShield monitoring, the phishing attacker who previously stole $2 million in DAI from an address associated with Bofur Capital has converted all the stolen funds into 825.5 Ether (ETH).
According to official reports, privacy blockchain project Pirate Chain disclosed that it suffered a transaction verification vulnerability exploit, resulting in the unauthorized minting of approximately 39.8 million ARRR and an increase in the total token supply of about 20%. The attacker transferred the newly minted funds into the Sapling shielded pool, after which part of the funds flowed into the NonKYC exchange, with related deposit accounts restricted from withdrawals; due to the shielding features of the transactions, the complete subsequent flow of funds cannot be traced.
Odaily reports: Bitcoin News posted on X that Citizen Lab researchers have discovered the first publicly documented case of mercenary spyware being delivered through targeted online advertising, in which malicious code can initiate infection once an ad loads, without the user needing to click or download anything. The campaign is called "AdFection." At least 45 Al Jazeera devices were targeted between 2024 and 2025, and the operation has been linked to Israeli advertising company Discover-Tech and spyware vendor Candiru.After analyzing approximately 4 billion ad bidding records, researchers found that Discover-Tech's ads had appeared on nearly 200,000 websites and apps worldwide, but ad exposure does not necessarily lead to infection. Discover-Tech previously conducted business through major ad networks, including Google, and was removed after the investigation.
— In the theft incident involving crypto hardware wallet manufacturer Ledger, one of the biggest victims was also a scammer, who lost over 60 BTC worth approximately $4.8 million. The funds in question came from a task scam: participants were hired to fake sales and reviews for real products. A "negative balance" then appeared, and participants were told they had to put in their own funds in order to get paid. On September 22, the operator behind the scam transferred the proceeds to 3 separate Ledger addresses. On October 9, thieves emptied these 3 addresses, each transferring funds to the same wallet via a single transaction. The receiving wallet has been reported as being involved with stolen funds.
Polygon Labs has announced the official release of Bor v2.10.3, which fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. Both issues were reported through the Immunefi bug bounty program.In addition, the new version includes multiple security and stability improvements, such as transaction filtering, RPC execution concurrency limits, and pending transaction cleanup. The team stated that the affected versions are Bor v2.10.1 and v2.10.2, where BlockSTM V2 is enabled by default, and that no exploitation of these vulnerabilities has been detected on the mainnet or the Amoy testnet. This upgrade does not involve a hard fork, and nodes can upgrade gradually as needed.
Odaily News: According to Bitcoin News monitoring, in the Ledger supply chain attack, attackers do not need to immediately steal users' Bitcoin. @MagicalTux explained that the implanted program can transmit users' seed phrases to the attacker, who can then wait for users to accumulate more Bitcoin before emptying their wallets.
Odaily News: Crypto hardware wallet company Ledger will launch the Atom in mid-2027. The device supports running apps such as WhatsApp and Instagram, and can switch between smartphone functionality and a protected digital asset management mode.The Atom will feature a tamper-resistant casing, sensors, and specialized packaging, which can help prevent supply chain attacks like the recent CryptoBilis vulnerability even when the device is powered off.Ledger initially plans to sell the Atom exclusively through its official website to reduce third-party distribution risks, but will not offer trade-in services for customers affected by the vulnerability. (CoinDesk)
Ledger has released an update on its investigation into the hardware wallet implant attack. According to its disclosure, an organized criminal group spent months purchasing genuine Ledger devices, disassembling them, and implanting custom hardware specifically designed to steal seed phrases, before reintroducing them to the market through distribution channels in Southeast Asia. The group also built a supporting infrastructure for seed phrase collection, asset theft, and money laundering. Ledger stated that the operation involved millions of dollars in investment.Ledger emphasized that this incident was a localized distribution channel attack, and that its chips, operating system, and servers were not compromised. The company has instructed authorized dealers and distributors in Southeast Asia and Hong Kong to suspend sales and has implemented new security rules, including prohibiting devices from being placed on shelves or display areas, and prohibiting the resale of returned devices.
据 Cointelegraph 报道，安全公司 Hacken 发布 2026 年 Q3 报告显示，第三季度加密货币黑客攻击事件共 107 起，总损失达 11.8 亿美元，为 2025 年 Q1 Bybit 事件（损失 16 亿美元）以来最严重的季度。 其中 77%（约 9.06 亿美元）损失源于第三方供应商、开发工具或未纳入安全审计的基础设施漏洞。四大主要事件分别为：Bitget 黑客攻击（3.87 亿美元）、Liquid Network 漏洞（3.2 亿美元）、Tectonic 漏洞（1.2 亿美元）及 Coldcard 固件漏洞（1.15 亿美元），合计占总损失约 80%。智能合约为最高频攻击向量，涉及 71 起事件，损失 2.28 亿美元。 在资金追回方面，约 3.87 亿美元（33%）被归还或逆转，其中"白帽黑客"归还 Liquid Network 被盗资金 2.72 亿美元，Cronos 验证者回滚 114 分钟区块链历史追回 1.11 亿美元；运营商另行垫付 4.1 亿美元补偿用户损失，但仍有约 3.84 亿美元（32%）既未追回也未获赔付。
According to BBC reports, multiple X platform accounts operated by An Garda Síochána (Irish police) were hacked, including @GardaTraffic, which has 600,000 followers, and @GardaInfo, with nearly 300,000 followers. Hackers removed the accounts' original branding information and posted cryptocurrency promotional content, while also altering the account location to Amsterdam. Some posts were flagged by the platform as being associated with previously banned accounts. Irish police have been contacted for comment, and the investigation remains ongoing.
Odaily News: Security firm Hacken disclosed that a total of 107 cryptocurrency hacking incidents were recorded in Q3 2026, with total losses amounting to $1.18 billion. Of that, approximately $906 million stemmed from compromised vendors, developer tools, disclosed but undeployed fixes, and infrastructure outside audit scope, accounting for roughly 77% of quarterly losses.Quarterly losses were mainly concentrated in four incidents: crypto trading platform Bitget suffered $387 million in losses from an attack, Liquid Network lost $320 million to exploitation, Tectonic lost $120 million to exploitation, and a Coldcard firmware vulnerability caused approximately $115 million in losses. About 80% of losses were concentrated in the above incidents, while 98 incidents resulted in losses below $10 million, with a median of $670,000.Smart contract incidents were the most common attack type, involving 71 incidents and causing $228 million in losses. Q3 was the most severe quarter for losses since Q1 2025, when a $1.4 billion loss by Bybit pushed the quarterly total to $1.6 billion.Approximately $387 million of Q3 losses were returned or reversed, accounting for about 33% of gross losses. Among these, about $272 million was returned in the Liquid Network incident; the Tectonic incident reversed approximately $111.2 million in lending impact by rolling back 114 minutes of blockchain history, and Circle and Tether also froze approximately $340,000 related to funds stolen from Bitget. Operators additionally absorbed $410 million in user losses, leaving approximately $384 million still not returned or covered. (Cointelegraph)
According to The Gulf Times, Sharjah Police successfully dismantled four interconnected transnational criminal networks, resulting in the arrest of 33 individuals and companies, marking the largest case in the department's history. The four groups had clearly defined roles: infiltrating systems to steal data, laundering funds through virtual assets, exploiting social engineering to seize digital wallets, and using violence to coerce victims into surrendering wallet passwords. Investigators pinpointed targets based on the suspects' lavish lifestyles (luxury cars, luxury watches, and jewelry) and secured a breakthrough through a young suspect possessing advanced digital skills. Following an examination of hundreds of pieces of digital evidence, authorities carried out targeted operations.
According to CTV News, Toronto police announced the arrest of seven suspects, three of whom are members of the Canadian Armed Forces (CAF), in connection with a violent abduction on July 25 near Finch and Bayview Avenue. The victim was forcibly handcuffed and assaulted, while suspects attempted to extort cryptocurrency assets and commercial security system access credentials. Police have laid a total of 82 criminal charges, including extortion and kidnapping, illegal possession of firearms, and drug trafficking. Searches yielded 3D-printed firearms, GPS tracking devices, large quantities of methamphetamine and cocaine, and approximately 2,500 rounds of ammunition suspected to have been stolen from the military. The implicated service members, Fernando (22) and Moreau (29), both reserve artillery personnel with the 7th Toronto Battalion, have been suspended from military duty. The Department of National Defence stated that military police are cooperating with the investigation and will strengthen ammunition management and tracking protocols.
According to Cointelegraph, South Korea's Financial Services Commission (FSC) plans to implement stricter cybersecurity requirements for financial institutions and cryptocurrency exchanges. A prior industry review revealed that out of 555 financial institutions, 130 had cybersecurity vulnerabilities, resulting in the exposure of approximately 100,000 customer personal information records. The affected institutions include Streami, the operator of Gopax, and crypto exchange Prabang, which disclosed that it was hacked on October 2, leading to a customer data breach.
South Korea's Financial Services Commission (FSC) has announced plans to enhance threat monitoring, increase the frequency of security assessments, and strengthen executive accountability. An industry review revealed that 130 out of 555 financial companies have cybersecurity deficiencies, involving 16 prior security incidents.The FSC stated that the affected institutions had approximately 100,000 customer records exposed in total, including names, contact information, and ID numbers. Affected institutions include Streami, the operator of Gopax, and cryptocurrency trading platform Prabang, which previously disclosed that a hack on October 2 resulted in the leak of some customers' personal information.Under the proposed reforms, large financial institutions would undergo vulnerability assessments at least twice a year, and regulators also plan to strengthen information sharing and consider using AI to monitor the security posture of smaller companies. In the event of urgent threats, regulators may also conduct additional inspections beyond routine assessments. Authorities are still investigating whether the incidents involved AI or were carried out by the same attacker. (Cointelegraph)
UNCX Network officially disclosed that, following the earlier security incident involving the Vesting V2 token vesting contract affecting multiple blockchains, the team has taken emergency measures to contain further attacks. The incident is limited to UNCX Vesting V2, and all liquidity provider (LP) lockup contracts as well as legacy token vesting contracts remain unaffected.