News linked to this event type.
北韩黑客利用虚假招聘陷阱感染近 3 万台设备，并窃取价值超 1.07 亿美元的加密货币。
Odaily reports: Owen Simonin, founder and CEO of French crypto platform Meria, stated that following several recent data breach incidents in France, there has been an increase in scam calls impersonating customer service representatives from legitimate platforms such as Binance and Meria.Scammers falsely claim that users' accounts or funds are at risk, inducing them to urgently transfer their crypto assets to designated addresses. Simonin emphasized that platforms will not ask users to initiate transactions or provide personal information when users have not proactively contacted them.In August, the French General Directorate of Public Finances (DGFiP) disclosed that a data breach incident allowed hackers to obtain the data of 678,000 taxpayers. (Bitcoin.com News)
Odaily reports: The North Korean hacker group WaterPlum has been posing as recruiters for cryptocurrency, AI, and NFT companies, targeting software developers and IT professionals with malware disguised as coding assignments or video conferencing fix files.The group has infected at least 30,000 devices across more than 100 countries, and between December 2025 and July 2026, extracted funds or account credentials from over 7,000 cryptocurrency wallets, stealing at least $10.7 million. (Cointelegraph)
Visa is closing a checkout loophole supported by crypto payment infrastructure company Crossmint. The loophole previously allowed users purchasing Meme coins with credit cards to have transactions classified under a merchant category code intended for digital media such as e-books, movies, and music.Visa has notified payment processors, including Checkout.com, that it will no longer accept that code for Meme coin transactions, giving processors a grace period to stop the practice, which is expected to end next week. Thereafter, Meme coin purchases must be processed as cryptocurrency transactions and are subject to Visa's corresponding rules.Chase had disputed a Visa transaction that was not flagged as a cryptocurrency transaction, arguing that its merchant category code was incorrect and that it should not have earned credit card rewards. The New York State Attorney General's Office is also aware of and reviewing the matter. (Decrypt)
According to on-chain analyst PeckShield (@PeckShieldAlert), the same attacker successively exploited vulnerabilities in the @SingularityNET bridge contract to illicitly mint 260 million AGIX and 53.838 million WMTx on Ethereum. The attacker currently holds approximately $16.77 million in crypto assets, including 198.3 million AGIX (approximately $14.42 million), 649 ETH (approximately $1.67 million), and 33.538 million WMTx (approximately $627,000).
Fetch.ai officially announced that it was hacked, with attackers breaching the system via stolen signing keys and transferring funds to withdrawal wallets. An on-chain attack analysis report tracing the complete path from the key leak to the attacker's withdrawal has been published on the ASI:One platform. Currently, Fetch.ai has collaborated with SingularityNET to disable the affected wallets and related contracts. The investigation is ongoing, and updates will be provided continuously.
According to an official tweet from the Artificial Superintelligence Alliance (@ASI_Alliance), a security vulnerability occurred in the FET token migration and bridging architecture, enabling an unauthorized party to withdraw approximately $1.56 million worth of FET from the converter. The team responded immediately and has launched an investigation in coordination with security partners.
Odaily News: A 2021 firmware vulnerability in the hardware wallet Coldcard resulted in insufficient randomness in some recovered seeds. Since July 30, attackers have transferred approximately 1,600 to 1,800 BTC from affected wallets, involving thousands of addresses, with an estimated value exceeding $100 million.Coldcard manufacturer Coinkite stated that it must be assumed that someone used AI to review its public firmware. The vulnerability has existed for about five years, and whether AI was involved in the related attacks has not yet been confirmed.Shielded Labs researcher Taylor Hornby used a Claude Opus 4.8 audit agent and discovered a vulnerability in the Zcash Orchard shielded pool circuit dating back to 2022, which in testing could generate unlimited counterfeit ZEC without a trace. Developers completed the fix within days, and no theft of coins has been confirmed.Statistics from blockchain analytics firm Chainalysis show that on-chain writes carrying malware instructions and command-and-control information rose from about 2.06 per day to 11.1 per day, an increase of 440%. (Bitcoin.com News)
MultiversX has confirmed that attackers attempted to exploit atomicity issues at the virtual machine level, resulting in invalid state changes. To prevent further escalation, block production on the network remains paused. The development team has completed the fix and will validate it in a shadow fork environment. Upon successful testing, the update will be deployed to the mainnet in coordination with validators, trading platforms, and infrastructure partners.
Odaily News: According to MultiversX monitoring, attackers attempted to exploit a VM-level atomicity issue, causing invalid state changes on the network. To prevent the incident from escalating further, the network has been paused.The development team has prepared a fix, which will first be verified in a shadow fork environment; after successful testing, it will be coordinated with validators, exchanges, and infrastructure partners for deployment to mainnet. Currently, the team is evaluating a targeted recovery plan to process only the invalid state changes related to this incident while preserving confirmed transaction history and normal user state.Users do not need to take any action. Until the official recovery notice is issued, please do not submit or rebroadcast transactions, and do not deposit or withdraw EGLD and ESDT assets through trading platforms or cross-chain bridges. After the incident is resolved and the investigation results are confirmed, MultiversX will release a full technical report.
According to Forbes, seven agencies including the U.S. Federal Bureau of Investigation and Japan’s National Police Agency jointly disclosed that the North Korean hacker group “WaterPlum” (also known as “Infectious Interview”) spreads malware through fake recruitment and coding tests, infecting over 30,000 devices in more than 100 countries worldwide and stealing approximately $10.71 million from over 7,000 crypto wallets.
Odaily News: According to monitoring and analysis by the Gate security team, the FomoPeek App contains malicious code with high security risks. It may exploit iOS system vulnerabilities to attack other apps and is capable of dangerous operations such as accessing the clipboard, scanning sensitive phone data, and obtaining login credentials. Based on the security team's analysis, no attack losses caused by the FomoPeek App have been found among Gate App or its users so far, and Gate's existing risk control mechanisms are operating normally.Gate reminds users to upgrade their iOS system to the latest version as soon as possible and check whether the FomoPeek App is installed on their devices. If it is already installed, please uninstall it immediately and restart the phone. After that, it is recommended to log in again to the Gate App and other important applications; if using a Web3 wallet, it is advisable to promptly check the wallet's security status and transfer relevant assets if necessary to reduce potential security risks.
According to PeckShield monitoring, the same attacker transferred approximately 8.7 million FET from Fetch.ai, worth about $1.53 million, and illicitly minted around 408.5 million NTX on NuNet, valued at approximately $462,700. As a result, the NTX price dropped by roughly 65%. Currently, the attacker has converted part of the involved assets into approximately 546.36 ETH, worth about $1.44 million.
According to Onchain Lens monitoring, an attack cluster transferred approximately $1.54 million worth of FET from the Fetch AI token converter on Ethereum; the cluster also received approximately $452,000 in newly minted NTX from the Nunet Global deployer. As of now, the total confirmed amount involved is approximately $2.01 million.
Rezaei, Secretary of Iran’s Supreme National Security Council, stated that he has conveyed three conditions via Qatar to Washington: ending the war, releasing assets, and lifting the naval blockade, and is awaiting a response from the U.S. side. He also emphasized that Iran’s nuclear policy remains unchanged and warned that any attack would trigger strikes against U.S. military bases in the Middle East.
Bitcoin News posted on X that attackers accessed a small number of Blink custodial accounts and withdrew funds. Blink stated that the vast majority of funds remain safe, and non-custodial wallets were not affected; the Bitcoin payment protocol Spark, which it uses, supports multiple Lightning Network wallets, but it has not yet been confirmed that Spark was the source of this security incident.
Odaily Report: According to on-chain detective Specter, the attackers behind this campaign provided so-called arbitrage bot tutorials and code through YouTube videos, and guided victims to use a counterfeit Remix development interface to compile and deploy contracts. The attackers registered ENS names containing "Uniswap" to disguise the related addresses as legitimate incoming fund sources from DeFi activity, leading victims to believe that the deployed arbitrage bot was profiting through Uniswap. After victims injected their own assets into the contracts, the funds were transferred away by the attackers. The attackers currently appear to still be active and hold a substantial portion of the stolen funds in two addresses.
On-chain analyst ZachXBT (@zachxbt) disclosed that the recently launched 10K PFP NFT project zkSNARKs on the Zcash chain is allegedly a rug pull. The project attracted a total of 16,971 bids via a blind auction, ultimately completing the allocation of 8,000 items at a clearing price of 1.5 ZEC (approximately $2,190). Total trading volume reached 25,305 ZEC (approximately $36.94 million), and refunds totaling 13,309 ZEC (approximately $19.43 million) have been progressively returned. ZachXBT noted that the project raised approximately $17 million, while incorporating a 10% team allocation, 5% royalties, and a minting fee of around $2,000, yet offered zero utility. This mirrors the typical "rug pull" strategy commonly seen in Ordinals-style projects.
慢雾安全团队（@SlowMist_Team）与 OKX 安全团队联合调查，FomoPeek App 1.1–1.2 版本被证实含有恶意代码。该应用内置 iOS 内核漏洞利用框架，共包含 8 种攻击方式，可根据设备型号及 iOS 版本自动选择攻击路径，成功后可逃逸 iOS 沙箱、解密 Keychain 数据，并读取其他应用文件，导致私钥、助记词、登录凭证、聊天记录等敏感信息泄露。受影响 iOS 版本为 12.0–18.7 及 26.0–26.1，攻击功能当前处于激活状态并定期自动运行。 已安装该应用的用户建议立即采取以下措施： 1. 检查账户及资产是否有异常活动 2. 在未安装过 FomoPeek 的可信设备上创建新账户并生成新私钥/助记词 3. 尽快将资产转移至新账户 4. 将设备 iOS 更新至最新版本 5. 停止使用并卸载 FomoPeek
According to Crypto in America, the US Senate failed to advance the crypto market structure bill known as the "Clear Act" this week with a 49-50 vote, with Democrats voting as a bloc against it and Republican Senators Collins, Hawley, and Moran joining the opposition. Following the setback, the focus of crypto regulation shifted from Congress to regulatory agencies: the SEC subsequently issued innovation exemption measures, paving a limited pathway for on-chain trading of tokenized US stocks, while the CFTC adopted a no-action stance regarding passive software providers and submitted a broader proposal for crypto market rulemaking to the White House. Meanwhile, Visa announced the closure of a loophole that allowed purchasing memecoins with credit cards in exchange for standard loyalty points, with related processors granted a grace period expected to expire next week. Some Democratic senators involved in the negotiations stated that the "Clear Act" is not "dead," with efforts to restart talks still underway.