News linked to this event type.
慢雾安全团队（@SlowMist_Team）与 OKX 安全团队联合调查，FomoPeek App 1.1–1.2 版本被证实含有恶意代码。该应用内置 iOS 内核漏洞利用框架，共包含 8 种攻击方式，可根据设备型号及 iOS 版本自动选择攻击路径，成功后可逃逸 iOS 沙箱、解密 Keychain 数据，并读取其他应用文件，导致私钥、助记词、登录凭证、聊天记录等敏感信息泄露。受影响 iOS 版本为 12.0–18.7 及 26.0–26.1，攻击功能当前处于激活状态并定期自动运行。 已安装该应用的用户建议立即采取以下措施： 1. 检查账户及资产是否有异常活动 2. 在未安装过 FomoPeek 的可信设备上创建新账户并生成新私钥/助记词 3. 尽快将资产转移至新账户 4. 将设备 iOS 更新至最新版本 5. 停止使用并卸载 FomoPeek
According to Crypto in America, the US Senate failed to advance the crypto market structure bill known as the "Clear Act" this week with a 49-50 vote, with Democrats voting as a bloc against it and Republican Senators Collins, Hawley, and Moran joining the opposition. Following the setback, the focus of crypto regulation shifted from Congress to regulatory agencies: the SEC subsequently issued innovation exemption measures, paving a limited pathway for on-chain trading of tokenized US stocks, while the CFTC adopted a no-action stance regarding passive software providers and submitted a broader proposal for crypto market rulemaking to the White House. Meanwhile, Visa announced the closure of a loophole that allowed purchasing memecoins with credit cards in exchange for standard loyalty points, with related processors granted a grace period expected to expire next week. Some Democratic senators involved in the negotiations stated that the "Clear Act" is not "dead," with efforts to restart talks still underway.
Odaily News: Crypto technology service provider Haruko suffered a targeted cyberattack, with 15 clients affected. Read-only API information and trading data from some exchanges were leaked.Haruko stated that smaller hedge fund clients with weaker security controls may have lost a small amount of funds. The company has patched the vulnerability and updated its server-side keys. (CoinDesk)
According to CoinDesk, London-based crypto institutional technology services provider Haruko was targeted by a cyberattack earlier this week, affecting a total of 15 clients. Attackers exploited vulnerabilities in Haruko’s infrastructure to extract user access tokens, gaining access to clients’ read-only exchange API information and trading data. A small amount of client funds were stolen, and smaller hedge funds with weaker security controls face a higher risk of loss. Haruko co-founder and CTO Adam Carlile confirmed that the attack specifically targeted Haruko itself. The vulnerability has been patched, and the company plans to release a complete technical post-incident report. Haruko serves over 80 institutional clients globally and connects to more than 100 centralized exchanges and 30 blockchains.
DeBot team member Cat has released a security incident update, confirming that the previous wallet security incident was an APT (Advanced Persistent Threat) attack. No related fund losses have been identified so far. According to the announcement, analyses by multiple security teams and cloud service providers revealed traces of intrusion in the system, and the relevant private keys remain at security risk. Therefore, the platform will continue to implement automatic fund isolation. Currently, DeBot is operating in a fully isolated environment. Users can still trade and withdraw normally, but other operations involving private keys have been suspended and will be gradually restored after the security audit is completed.A new security solution is being upgraded and is being audited by the SlowMist team and cloud service providers. DeBot stated that this incident exposed security issues in the project, and the team will further upgrade security measures.
Odaily News: Japan's National Police Agency, together with the U.S. FBI and other agencies, released a report stating that the North Korea-backed hacker group WaterPlum infected more than 30,000 devices across over 100 countries and regions worldwide between December 2025 and July 2026, stealing more than 7,000 pieces of crypto wallet information, with wallets under its control receiving at least approximately $10.71 million in crypto assets.The group's tactics include impersonating recruiters at crypto companies to trick job seekers into running malicious code to carry out attacks. Japanese police also for the first time seized a "laptop farm" within the country that assisted North Korean IT personnel in working remotely, and disclosed that a suspected North Korean IT worker had applied for an engineer position at bitFlyer but was not hired.
Odaily reports: Haseeb Qureshi, managing partner at crypto-focused venture capital firm Dragonfly, has proposed that under current rules, the Zcash development fund should cease operations after its expiration in 2028.Qureshi wrote: "I think this should be the last development fund." He stated that the current fund size is already sufficient to support Zcash's remaining development work, and as the fund's value approaches $100 million, it may face "politicization" risks in the future. According to ZecStats data, as of press time, the Zcash development fund holds 63,962 ZEC, worth approximately $95 million.These remarks come amid ongoing industry discussions about the growing size of the development fund. The previous rise in ZEC's price drove a significant increase in the fund's value. Some also argue that Zcash should continue to maintain the development fund. Paradigm founder Matt Huang said on Wednesday that against the backdrop of improving AI network attack capabilities and the rapid development of quantum computing, the fund is particularly important.
According to on-chain analyst ZachXBT (@zachxbt), an address linked to user @7zarc previously received 4,870 ETH (approximately $15 million) from the $70 million Raidparty rug pull. These funds were subsequently transferred to a centralized exchange deposit address. ZachXBT noted that after @7zarc disappeared in 2022, he suddenly resurfaced in September 2026, and ZachXBT has publicly called on him to account for the movement of the funds.
According to CoinDesk, Ethereum plans to launch Glamsterdam upgrade testing on the Sepolia testnet on October 6. Developers have warned that attackers could exploit free testnet ETH and numerous temporary block builder identities to win block auctions at high prices and then refuse to submit transaction payloads, thereby disrupting the testing process. This risk will not affect mainnet funds, but could hinder upgrade verification. Glamsterdam aims to increase the block gas limit to approximately 200 million, with the mainnet launch date remaining undetermined.
Odaily reports: Ethereum developers have warned that attackers could exploit free testnet ETH and one-time builder identities to win Sepolia block auctions and withhold transaction payloads during the Glamsterdam testing period.This attack does not threaten mainnet funds, but it could disrupt infrastructure testing. The Sepolia public test is scheduled to launch on October 6, while the Hoodi test is tentatively set for October 27. The mainnet activation date remains undetermined. (CoinDesk)
Odaily News: Nostra suffered an oracle attack. The manipulated NSTR oracle price allowed a single account to borrow approximately $3.5 million worth of ETH, STRK, USDC, USDT, WBTC, and DAI on Nostra's Starknet money market using NSTR as collateral. The attacker subsequently bridged approximately $1.92 million of the stolen funds—234.57 ETH and 1.3 million DAI—to Ethereum.
Odaily reports: Bitcoin News posted on X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the Bitcoin security landscape. Large language models have significantly reduced the cost of vulnerability discovery, and attackers may be able to find catastrophic vulnerabilities with only a few hundred dollars in computing costs. For Bitcoin Core, Project Loupe, Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or critical vulnerabilities have been found. Gögge stated that relying on stronger models to find vulnerabilities before attackers do is not a sustainable security strategy. Developers should build testing infrastructure through automated testing, fuzzing, and property-based testing that can prevent entire classes of vulnerabilities in advance. Key components of Bitcoin Core have cumulatively completed over 100 years of CPU fuzzing and decades of Bitcoin node network simulation.
Odaily News: The Liquid Network attacker has returned 3,400 bitcoins after the September 6 exploit, accounting for approximately 85% of the transferred assets; they currently still hold 598.50 bitcoins, worth over $45 million.Blockstream, the digital asset infrastructure company responsible for maintaining the Liquid Network, has refused to pay a ransom for the remaining assets and is demanding the return of the relevant bitcoins. The network shows 4,234.76 L-BTC in circulation, while the bitcoin reserves stand at only 3,632.23.The L-BTC-to-bitcoin redemption function has still not been restored, with Sideswap stating that redemptions are currently unavailable; Blockstream founder Adam Back said that L-BTC will be backed 1:1 by bitcoin reserves and reminded holders not to sell L-BTC off-market at a discount.As of now, Blockstream has not yet issued an announcement that "redemptions are live." The attacker's wallet continues to receive on-chain messages and has been subjected to address poisoning attacks and scam messages, with the related attacks inducing transfers by generating visually similar addresses. (Bitcoin.com News)
Odaily reports: Blockchain analytics firm Chainalysis has released a report stating that hackers are increasingly leveraging open-source artificial intelligence (AI) to implant malware control instructions into on-chain transactions and smart contracts, with such cases surging approximately 440% in less than a year. Data shows that these incidents have risen from roughly 2 per day to approximately 11 per day. Attackers write malicious instructions on-chain to manipulate infected devices into stealing passwords and funds, and redirect assets to designated wallets; since on-chain records cannot be deleted, defense and interception are becoming increasingly difficult.The report notes that state-sponsored hackers from countries such as North Korea and Iran have become the primary drivers of such activity. Open-source models support local independent operation and modification, allowing them to directly bypass cloud-based defenses. However, the public and transparent nature of blockchain also leaves critical evidence for tracing attack infrastructure. (Bloomberg)
According to PR Newswire, S&P Global (NYSE: SPGI) announced on September 17 that it signed an agreement to acquire OpenZeppelin, a company specializing in on-chain financial security standards. Founded in 2015, OpenZeppelin's open-source smart contract library has collectively supported over $37 trillion in value transfers, covering global mainstream stablecoins and tokenized funds. The company has completed more than 900 security audits and identified over 10,000 vulnerabilities. This acquisition will expand S&P Global's assessment capabilities in the on-chain technology risk layer, helping it develop next-generation on-chain security assessment and benchmark products. OpenZeppelin will continue to operate as an independent business unit, with CEO Demian Brener remaining in his position and reporting to Yann Le Pallec, President of Ratings at S&P Global. Financial terms of the deal were not disclosed, and the transaction is expected to have no material impact on S&P Global's financial results.
Odaily News: Following a customer data breach at Revolut, multiple hacker groups have publicly demanded ransom. A group calling itself "IAmNotAVillain" demanded that Revolut pay 6,000 Monero (XMR, approximately $3 million) within 24 hours, or it would sell customer data to other criminal organizations; another group, "Revolut Smilik," had earlier demanded 10,000 Bitcoin (approximately $780 million).In response, a Revolut spokesperson stated that the company has not received any direct contact or extortion demands from any of the aforementioned individuals or organizations. Meanwhile, Italy's Anti-Mafia and Anti-Terrorism Directorate has launched an investigation, with Italian prosecutors investigating unauthorized access to government computer systems, and Italy's privacy regulator has also asked banks to urgently review the security of their access systems. (Cointelegraph)
According to court documents, a federal court in New York will hold a hearing today in the case brought by ESS Frontier and Hong Kong lender Minghui Zheng against Ostium, involving a $15 million loan dispute. The two parties are asking the judge to freeze Ostium's assets and refer the dispute to arbitration; Ostium previously lost $23.75 million in an exploit in July.
Paradigm co-founder Matt Huang posted on the X platform outlining some views on Zcash. He stated that blockchain ecosystems generally face the challenge of long-term funding sources, especially for public goods financing, and that funding developer funds through an inflation mechanism is a viable approach. He believes that amid the backdrop of AI-enhanced cyberattack capabilities and the rapid development of quantum technology, the Zcash developer fund remains highly significant.Matt Huang also stated that as Zcash gains greater acceptance and adoption as a privacy supplement to Bitcoin, governance relying purely on coin-holder voting may introduce unpredictability and affect its ability to build long-term trust as a monetary asset. Therefore, Zcash is better suited to combining coin-holder voting with other governance approaches. Matt Huang also disclosed that Paradigm is an investor in ZEC and ZODL.In the early hours of today, ZEC briefly broke above $1,385, setting a new all-time high.
The hacker group "iamnotavillain" attacked Revolut and demanded 6,000 Monero as ransom, threatening to sell the data of at least 680 customers to the black market if the payment is not made.
Odaily reports: Earlier this month, the verified Reddit account of streaming service HBO Max was hijacked by hackers, who deployed 108 malicious ads over approximately 48 hours, tricking Mac and Windows users into executing commands to install infostealer malware.The malware can steal browser credentials, Telegram data, Apple Notes, saved passwords, and crypto wallet recovery phrases, and may also alter wallet addresses in the clipboard. Reddit has suspended the relevant ads and launched a security investigation. The number of infections and crypto asset losses have not yet been confirmed. (Decrypt)