News linked to this event type.
Odaily News: Canadian Bitcoin exchange and wallet company Bull Bitcoin stated that due to the Liquid Network attack on September 6, users are temporarily unable to redeem L-BTC back to Bitcoin through the platform, and redemption operations are still pending resumption.Bull Bitcoin expects the related redemption service to potentially resume within 30 days, but stated that this expectation is not guaranteed. Due to its reliance on the L-BTC redemption mechanism to balance inventory, the platform has temporarily closed inbound Lightning Network payments.In this attack, the attacker transferred out nearly 4,000 Bitcoin from the protocol, later returning approximately 3,400; currently still holding 598.50 Bitcoin, valued at over $51 million. Liquid Network stated on September 17 that block production, network transactions, and L-BTC transfers have returned to normal. (Bitcoin.com News)
Odaily News: The European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA) stated in a joint risk update that advances in quantum computing could weaken the cryptographic systems that secure blockchain transactions, communications, and database security.In March, Google Quantum AI researchers estimated that the number of physical qubits required to break the cryptographic techniques used by many cryptocurrencies may be about 20 times fewer than previously estimated. A computer capable of carrying out such an attack does not yet exist.In February, Bitcoin developer Jameson Lopp and others proposed phasing out current signature schemes and restricting how unmigrated funds can be used five years after the proposal's activation. The proposal has not yet been adopted. The Ethereum Foundation plans to make Ethereum's execution, consensus, and data layers quantum-resistant by December 2029. (Cointelegraph)
Odaily News: North Korean hacker group WaterPlum obtained funds or credentials from over 7,000 crypto wallets through fake recruitment processes and transferred approximately $10.71 million to North Korea. Between December 2025 and July 2026, the group infected at least 30,000 devices across more than 100 countries.WaterPlum impersonates AI, crypto, or NFT companies and approaches developers through social media, job platforms, and freelance platforms, luring them into downloading malware-laden files under the guise of technical interviews or coding assignments. Targets include web designers, engineers, and professionals in the crypto, blockchain, and Web3 sectors.Japanese law enforcement dismantled a "laptop farm" within the country for the first time, discovering that hundreds of millions of yen in crypto assets had already been transferred overseas. Investigations suggest that WaterPlum and some North Korean remote IT workers both belong to the 313th General Bureau of North Korea's Ministry of Munitions Industry and share IP addresses used to access the laptop farm and job-seeking services. (Decrypt)
According to a Binance announcement, due to a security incident involving Zilliqa, the project team has announced the migration of ZIL from the Zilliqa mainnet to the ZILEVM network. Binance will discontinue support for the Zilliqa mainnet and will support ZIL deposits and withdrawals via the ZILEVM network. ZIL will be migrated from the Zilliqa mainnet to the ZILEVM network at a 1:1 ratio. Binance paused ZIL deposits and withdrawals on the Zilliqa mainnet at 9:00 on August 5, and will reopen deposits and withdrawals on the ZILEVM network upon completion of the migration without further notice. During the migration period, spot trading, leverage trading, contract trading, and Binance wealth management services remain unaffected.
Odaily News: On September 21, a white hat actor transferred 40.71 BTC linked to the Coldcard vulnerability in a single transaction valued at approximately $3.31 million. The transaction consolidated funds from 11 addresses and included an OP_RETURN message pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, disclosed that the broader consolidation involved a total of 52.37 BTC across multiple clusters of attacker addresses, accounting for approximately 2.8% of the funds tied to the vulnerability. A firmware flaw in Coldcard devices dating back to March 2021 resulted in insufficient mnemonic seed randomness, with the total funds involved peaking at approximately $130 million. (Decrypt)
Cosmos 生态 DEX Astroport 发文表示，Neutron 上发生的攻击事件可能已经导致 Astroport 合约的管理员权限被盗，Neutron 已暂停链运行进行调查。Astroport 建议用户从所有 Astroport 资金池中撤回流动性。
As reported by Astana Times, Kazakhstan's regulated cryptocurrency market recorded a trading volume of $10.58 billion in 2025, marking a significant surge from $320 million in 2023, while the number of users increased from 53,000 to 215,000. At the same time, Kazakhstan ranked within the global top 10 for submission numbers to the International Solana Hackathon, with over 8,000 individuals completing training through the Solana ecosystem and more than 2,000 earning certificates. Additionally, 57 Web3 startups in the country have already received a combined total of approximately $262,000 in funding, and plan to complete the tokenization of real estate and logistics projects valued at up to $60 million by the end of 2026, exploring the feasibility of digital assets as a new channel for economic financing.
the North Korea-linked threat group TraderTraitor, also known as UNC4899 and Jade Sleet, recently breached an IT services company based in India that is unrelated to the crypto industry. The attackers posted fake job listings on GitHub, using technical interview assignments as bait to carry out phishing attacks targeting DevOps and crypto engineers.After victims download the project, a malicious .terraform.lock.hcl file points to a Terraform Provider domain controlled by the attackers. Upon running terraform init, the malicious Provider module is downloaded and executed, ultimately deploying the Rust/ARM64 backdoors FLATROOF and ROOFDECK on macOS devices. The associated malware can steal credentials and sensitive data, execute shell commands, collect and exfiltrate files, and gain access to cloud services and code repositories.
Odaily reports: SlowMist Chief Information Security Officer 23pds has stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, take control of devices, and extract private keys and other data from self-custodial crypto wallets. The vulnerability was previously used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 through 18.7. According to 23pds, attackers have now adapted it to iOS 26.5, though this assessment has not yet been officially verified.Attacks typically begin with social engineering. After users click on malicious links sent via social media or messaging apps, their devices may be rooted and wallet data extracted. Users should promptly update their phone's operating system and avoid visiting website links sent by strangers. Separately, three investors who lost nearly $1.8 million in Bitcoin after downloading fake wallet apps from Apple's official App Store have filed a lawsuit against Apple. (Bitcoin.com News)
Odaily News: According to monitoring by Galaxy's head of research, Coldcard white hat funds consolidated 52.37 BTC from Wave 2, Footprints AA, AU, and AX into a new address, which inscribed the OP_RETURN message "claim:cryptorecoverytrust dot com" in block 967,948. These white hat funds account for 2.8% of the Coldcard exploit attack funds.
Odaily reports: Bitcoin News posted on X that China launched a next-generation commercial cryptography algorithm initiative in 2025, aimed at developing and evaluating cryptographic standards capable of withstanding future quantum computers. Independent researcher @mjos_crypto, while analyzing the candidate algorithms, has discovered critical vulnerabilities in multiple proposed algorithms, including publicly reproducible private keys, easily constructible hash collisions, and signature implementations that accept invalid signatures. Bitcoin currently relies on well-validated elliptic curve cryptography, which quantum computers may pose a threat to its security model in the future; however, prematurely adopting insufficiently tested post-quantum cryptography schemes could also introduce vulnerabilities before quantum threats emerge.
Odaily reports, according to monitoring by Bitcoin News, security researchers have discovered that versions 1.1 and 1.2 of FomoPeek, distributed through the Apple App Store, contain an iOS exploit framework capable of escaping the app sandbox, enabling the extraction of keychain data, wallet files, and mnemonic phrases. SlowMist has linked the app to multiple theft incidents and traced nearly $580,000 in stolen USDT flowing into a primary address. Users who have installed either of the aforementioned versions should treat any keys accessible on that iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.
Odaily reports: Bitcoin News posted on X that Core Lightning is urging node operators to immediately disable experimental features, as developers are investigating a vulnerability that could put channel funds at risk. This is Core Lightning's second warning within a few weeks, following an August patch and the release of the 26.06.7 upgrade after a series of AI-generated CVE reports. Core Lightning has not yet disclosed how the experimental feature could be exploited.
Odaily News: Bitcoin fork project Bitcoin BLAKE2b developers plan to restrict miners from unlocking newly mined tokens, with a waiting period set at 45 days. The related change is proposed to be executed at block height 973440. The chain forked from Bitcoin on August 8.Its native token BTCB2 is also labeled by some trading platforms as Bitcoin BLAKE2b, Bitcoin BIP-110, or XBT. BTCB2 has fallen 84% from its September high of $1,799, trading at approximately $270 to $315 in recent hours.Developer Luke Dashjr stated that some BLAKE2b mining pools are "attacking" the network. After forking, the chain inherited Bitcoin's difficulty, mining only about 8 blocks in the first 22 days, before resuming operation by enabling BLAKE2b hashing and adjusting difficulty.Currently, the chain is not listed by most trading platforms or CoinGecko and CoinMarketCap. Trading platform Neoxa has stated it supports the upcoming soft fork. (Bitcoin.com News)
Crypto wallet app SecondFi announced that some wallet holders affected by the security incident were originally scheduled to claim NIGHT tokens the following day. After consulting with the Midnight Foundation, it was confirmed that NIGHT token allocations can only be claimed via the original wallets; the system does not support switching to an unaffected wallet address for claims.
According to an official announcement, Upbit has placed MultiversX (EGLD) on its trading warning list. Deposit and withdrawal services are currently suspended. Previously, it was reported that MultiversX suspended its network due to a virtual machine atomicity vulnerability, and a patch is now undergoing testing.
Bank of America notes that AI security concerns are emerging as a sustained catalyst for the cybersecurity sector, as market focus shifts from fears of AI disruption to new attack surfaces, identity requirements, and governance demands. Identity management is central to protecting AI agents, with leading platform security providers poised to benefit. The bank advises monitoring whether AI security spending exceeds current expectations, citing it as a key signal marking the transition from valuation expansion to earnings-driven growth.
北韩黑客利用虚假招聘陷阱感染近 3 万台设备，并窃取价值超 1.07 亿美元的加密货币。
Odaily reports: Owen Simonin, founder and CEO of French crypto platform Meria, stated that following several recent data breach incidents in France, there has been an increase in scam calls impersonating customer service representatives from legitimate platforms such as Binance and Meria.Scammers falsely claim that users' accounts or funds are at risk, inducing them to urgently transfer their crypto assets to designated addresses. Simonin emphasized that platforms will not ask users to initiate transactions or provide personal information when users have not proactively contacted them.In August, the French General Directorate of Public Finances (DGFiP) disclosed that a data breach incident allowed hackers to obtain the data of 678,000 taxpayers. (Bitcoin.com News)
Odaily reports: The North Korean hacker group WaterPlum has been posing as recruiters for cryptocurrency, AI, and NFT companies, targeting software developers and IT professionals with malware disguised as coding assignments or video conferencing fix files.The group has infected at least 30,000 devices across more than 100 countries, and between December 2025 and July 2026, extracted funds or account credentials from over 7,000 cryptocurrency wallets, stealing at least $10.7 million. (Cointelegraph)