News linked to this event type.
Odaily News: According to Bitcoin News monitoring, a wallet tagged as the United States transferred 833.6 BTC, valued at $71.6 million, to a Coinbase Prime deposit address. Arkham data shows that 568.7 BTC of this is related to assets forfeited from HashFlare, and 264.9 BTC is related to funds from the Bitfinex hack. Transfers to a Prime deposit address do not necessarily indicate a confirmed sale; Coinbase also provides custody services for cryptocurrency held by the government, and a similar $288 million transfer occurred in July.
Trump stated that the United States and Iran are engaged in productive discussions, and explicitly committed to not launching an attack against Iran before the U.S. midterm elections on November 3, while emphasizing that Iran will not acquire nuclear weapons.
Odaily News: US President Trump stated: We are holding productive discussions with the Islamic Republic of Iran, and I want to make one thing clear to everyone: despite Iran being in a very bad situation both economically and militarily, despite the blockade continuing to be fully enforced, and despite oil flowing through the Strait of Hormuz at record barrel counts (22 million barrels just last night, none of which came from or were destined for Iran!), we will not attack Iran at any time before the US midterm elections on November 3. Iran will not have nuclear weapons.
Odaily News: As the crypto industry discusses whether users need to enter "bunker mode" before AI or quantum computing technologies expose wallet private keys, custody institutions face a more complex challenge: how to upgrade key management, approval, and audit systems before an emergency migration occurs.Project Eleven CEO Alex Pruden stated that institutions have already begun preparing for post-quantum migration outside of blockchain, and different blockchains may adopt different quantum-resistant signature schemes and migration paths in the future. Institutions holding multiple types of assets will face the challenge of simultaneously adapting to multiple cryptographic systems.Quantus co-founder and CEO Christopher Smith stated that AI is accelerating the development of quantum hardware and software, and the tail risk of quantum attacks should be incorporated into portfolio decisions — this is an institutional fiduciary duty.Currently, the timeline for quantum computers to crack Bitcoin and Ethereum's existing public-key cryptographic systems remains uncertain, but the industry is gradually viewing the coming years as a window for establishing migration plans, rather than waiting for an attack to occur before responding reactively. (CoinDesk)
OpenAI has released a report stating it recently banned two groups that used its models to conduct covert influence operations (IO). These operations combined AI with traditional techniques to create "fake front" entities and fake identities. OpenAI stated that the Russia-linked operation "Dark Clark" controlled a fake think tank called the "Social Research Center (SRC)," and is suspected of using ChatGPT to write internal reports, generate content, and conduct influence activities in Latin America. OpenAI assessed this operation as Level 5 on the IO Breakout Scale, marking the first time it has identified a case reaching this level since it began disclosing such operations.OpenAI stated that AI has not changed the fundamental patterns of these influence operations, but has enhanced their scale, efficiency, language capabilities, and content production capacity, making it easier for attackers to create fake identities, fabricate content, and disseminate information to real media channels.
security firm CrowdStrike released an intelligence report stating that an unidentified hacker, between late September and early October, combined large language models (LLMs) with the domestic open-source AI penetration testing tool ARTEX to launch targeted cyberattacks against multiple South Korean financial institutions and steal data.After analyzing the hacker's exposed open directory, it was found that they employed a dual-server architecture centered on a Hong Kong IP, and used models including Claude Code, GLM-5.3, Grok 4.6, and DeepSeek v4.1-flash accessed through an API proxy to orchestrate the attack process. The hacker also asked Claude how to monetize the leaked South Korean data in Telegram groups. According to estimates by South Korean media, at least seven South Korean financial institutions were attacked, including KB Kookmin Bank, Shinhan Bank, and Hana Bank, with personal data of approximately 68,000 people leaked, involving sensitive information such as annual income and loan limits.
Odaily reports: A community user posted that after connecting to free WiFi at Singapore Changi Airport, a "burner wallet" that had been inactive for a long time was drained of 3.7 BNB, and warned users not to casually connect to public WiFi. The user stated that the wallet had no transaction records for several months prior, but the assets were transferred out after connecting to the airport's free network.In response, Binance founder CZ said, "I've always advised against connecting to Wi-Fi, especially public Wi-Fi. But just connecting to Wi-Fi shouldn't be enough to get your wallet compromised. Was there some other operation in between?"
Odaily reports: Second, a project built on Ark Protocol, disclosed that its server was exploited in an attack on Monday, resulting in the loss of 0.75 BTC of its own funds, worth approximately $62,300. The team stated that user funds were not affected and that the issue was fixed within hours.The attacker subsequently continued attempting to withdraw more funds from the project and launched a denial-of-service attack. On Tuesday, Second said the attack may have degraded the ability of Bark-based wallets to receive Lightning Network transfers.Second stated that the vulnerability was in the Ark server's boarding process, where an attacker could register and exit the relevant boards using only their own signature, while simultaneously spending the same batch of VTXOs in the node via the Lightning Network. The attacker also attempted to use bitcoin linked to the Blink Wallet security breach on September 19, but was unsuccessful. (Bitcoin.com News)
According to CertiK's monitoring, the decentralized protocol 79thVault exhibited suspicious activity. The attacker dumped 2.01 million 79AU tokens via a privileged function and transferred 16,200 BNB (approximately $12.5 million) to an attacker-controlled address. Approximately 90% of the stolen funds currently remain in the relevant address, and the project team has extended a 10% bug bounty offer for their return.
Jacob Creech, a developer at Anza, Solana's core development team, stated that Solana users need not be concerned about network security due to the accelerated advancement of quantum computing or AI-assisted traditional attacks, as Solana remains secure today and has a clear path forward to address these challenges.
HM Revenue & Customs (HMRC) is pushing to expand its investigation powers over crypto asset information, proposing to allow tax authorities to directly obtain customer data from crypto asset service providers and to update rules for inspecting software and electronic records. UK crypto tax software company Recap has warned that the proposed regulations' definition of service providers is too broad and could encompass non-custodial wallet software, blockchain explorers, hardware wallet manufacturers, and tax software providers. Since Bitcoin transaction records are publicly transparent, once investors' names, addresses, and tax identities are linked to on-chain wallet addresses, their long-term asset activity records could be exposed, increasing the risk of data leaks, extortion, and physical attacks.
Odaily News: Lido is developing a decentralized lending market called Lido Lend, which is built on a modified fork of Morpho Blue, adopts an isolated lending market design, is proposed to be governed by Lido DAO, and is pending a governance vote for approval. Lido Lend is limited to blue-chip assets, encourages price-correlated trading pairs such as stETH/ETH, and provides a deposit screening mechanism to guard against bad collateral. Lido stated that Lido Lend is not a general-purpose pool-based lending solution but is aimed at professional borrowers and risk-averse lenders; currently, stETH staking scale exceeds $25 billion, with no major security incidents since launch.
Odaily News: Galaxy Research on-chain tracking shows that the US government transferred approximately 9,261 BTC, worth about $770 million, to Coinbase Prime over two days. Since the deposit address was first activated in December 2025, it has cumulatively received 11,567 BTC, of which 6,406 came from wallets already labeled as belonging to the US government, and 5,160 came from previously unlabeled wallets.Of the 9,261 BTC transferred this time, nearly half can be traced back to Bitfinex hacker funds recovered by the US government, with some coming from previously known Binance-related seized assets; among them, 2,456 BTC previously had no clear government attribution label, but because they entered this address through the same path as government funds, they are currently regarded as US government seized assets. The US government currently holds approximately 319,100 BTC, of which about 71% comes from LuBian-related BTC and Bitfinex recovered funds.In January 2025, a US federal court approved the return in kind of seized Bitfinex hacker funds to Bitfinex, and the main address holding approximately 94,600 BTC has still not moved. In October 2025, the US Department of Justice filed a civil forfeiture lawsuit against Chen Zhi and related assets, involving approximately 127,300 BTC; this batch of LuBian BTC entered addresses attributed to the US government between June and July 2024. Since 2013, US government-related addresses have received a total of approximately 555,300 BTC, worth about $16.1 billion at prices at the time; during the same period, approximately 236,200 BTC flowed out, worth about $3.8 billion at prices at the time. After excluding internal transfers between the government's own addresses, this transfer, based on labeled government addresses, ranks 9th among the largest single-day BTC outflows in US government history, and is also the largest since December 2, 2024. BTC being transferred to Coinbase Prime does not mean the US government has already sold it, and on-chain transfers alone cannot confirm the specific purpose of the funds.
Odaily News: Analysis by security firm CertiK shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker draining 200 ETH worth over $500,000. According to CertiK, the root cause is a lack of access control in the 0x8804d1de function within the keeper implementation contract. This contract was involved in the March 2020 "Black Thursday" liquidation crisis, where it won ETH at zero bids. Four lots of 50 ETH each were never settled, and the attacker used this to drain the funds, transferring them out via Tornado Cash in batches of 10 ETH each. This contract is not part of the current Sky ecosystem core, but old contracts still holding funds may remain potential attack targets.
According to SlowMist founder Cos (@evilcos), a new bookmark phishing attack targeting the FOMO web platform has recently emerged. Attackers spoof human verification pages to trick users into dragging malicious JavaScript code into their browser favorites to create a "bookmark". After clicking the bookmark two or three times, previously logged-in FOMO accounts are hijacked, and the associated crypto assets are promptly drained. This technique is essentially a legacy exploitation method targeting @privy_io. Because the bookmark executes JavaScript under FOMO's own domain, active logged-in sessions are directly exposed, eliminating the need for users to click on phishing links. Relevant attack samples and the attacker's wallet addresses have been preserved, and the SlowMist team will publish a detailed disclosure in due course. Security Advisory: • Any prompt requesting "drag code into favorites" constitutes a phishing attempt; do not execute it. • If you have been compromised, in addition to immediately transferring your assets, you must forcefully terminate all active sessions for your FOMO account. Simply changing your password will not resolve the issue.
According to Odaily, a Satoshi-era address moved 100.02 BTC worth $8.55 million after 16 years of dormancy. Bankless co-founder David Hoffman suggested that the transfer may be intended as preparation against quantum attacks.
Odaily News: According to monitoring by SlowMist founder Cos, a bookmark phishing attack targeting the FOMO web app is emerging. Such phishing pages trick users into completing a fake CAPTCHA verification, dragging malicious JavaScript code into the browser's bookmarks and saving it as a bookmark. After the user then clicks on that bookmark 2 to 3 times, their previously logged-in FOMO account will be hijacked by the attacker, and the crypto assets in the account will be immediately stolen.
Ethereum co-founder Vitalik Buterin warned in a post that AI-accelerated mathematical research could pose a severe threat to existing cryptographic systems within the next two years, particularly lattice-based cryptography (Lattices), ML-DSA, and FHE schemes, with ECDSA also facing a heightened risk of being compromised sooner than anticipated. Vitalik noted that AI could replicate breakthroughs akin to the transition from naive factorization to the Number Field Sieve, substantially undermining the security of lattice-based cryptography. In such a scenario, hash-based schemes would comprehensively outperform lattice-based ones in efficiency. The Ethereum Lean Roadmap is already progressing toward a "pure-hash" approach, employing signature schemes like WOTS or SPHINCS+ without incorporating any lattice-based components. From a personal standpoint, Vitalik offers the following recommendations: • Prioritize hash-based schemes, replacing lattice cryptography in feasible scenarios • Conservatively estimate lattice parameter sizes, with a recommendation to increase key sizes by a factor of 10 • Ensure privacy protocols avoid posting encrypted data on-chain, opting instead for off-chain transmission through third parties • Utilize offline confirmation for multi-signature wallets to prevent signatures from being publicly exposed • It is acceptable to retain funds in "fresh addresses" that have never initiated a transaction; however, address migration must be handled with extreme care, as losses resulting from operational errors may far exceed those caused by hacker breaches.
Odaily News: According to Bitcoin News monitoring, Arkham reports that US government-linked wallets transferred approximately 4,695 BTC, along with WBTC and USDT, through a series of transactions today, involving total assets worth approximately $470 million. On-chain analyst @TimechainIndex independently flagged the same batch of approximately 4,695 BTC, distributed across 4 transactions. The assets are related to seizures tied to the Bitfinex hack and FTX/Alameda, with some assets already sent to Coinbase Prime deposit addresses. This transfer follows the US government's additional transfer to Coinbase Prime yesterday.
According to Decrypt, Europol released a report on Wednesday stating that cryptocurrency wallets are the primary exposure points for quantum computing threats. Attackers can derive private keys from publicly exposed on-chain public keys and transfer assets, while underlying hash functions are largely quantum-resistant. The report notes that approximately 30.2% of BTC (6.04 million coins) public keys have already been exposed on-chain, recommending a phased industry transition to post-quantum cryptography, and calling for proactive preventive migration of related assets prior to an attack.