News linked to both this project and an event.
Odaily reports: Blockchain security firm CertiK stated that although Google, Apple, and Microsoft have blocked 8 affected certificates issued by Indian digital certificate authority eMudhra, crypto trading bots and exchange applications may still be exposed to related vulnerability risks, as browser remediation measures may not cover software that uses independent security systems.Peiyu Wang, Senior Director of Digital Asset Security at CertiK, noted that attackers could exploit compromised certificates to impersonate exchanges, wallet interfaces, and APIs, replace deposit addresses, or trick users into approving malicious transactions. However, such attacks would also require intercepting or redirecting network traffic, and the compromised certificate authority keys alone cannot expose wallet private keys. Crypto service operators should update their software and certificate trust stores, and confirm that their applications reject the affected certificates. (Cointelegraph)
Odaily reports: Multiple tech companies have urgently blocked 8 intermediate certificates with security vulnerabilities issued by Indian digital certificate authority eMudhra Limited. Due to flaws in the private key generation process of the affected certificates, attackers could exploit forged certificates to impersonate legitimate websites and intercept, read, or tamper with user communications.Mozilla cryptography engineer Dennis Jackson stated in an incident report that after receiving the vulnerability report on October 17, Mozilla independently recovered the relevant private keys, confirming that the generation mechanism has serious flaws and is highly exploitable.Mozilla subsequently blocked the affected certificates in Firefox through OneCRL and released browser updates for desktop and Android on October 20. Cloudflare also updated protections for services including Cloudflare One, WARP client, and Cloudflare Tunnel on Tuesday. According to Mozilla's disclosure, Chrome blocked the relevant certificates on Saturday, Apple devices completed blocking on Monday, and Microsoft platforms took corresponding measures on Tuesday. (Cointelegraph)
Odaily reports: Layer-1 blockchain Qubic has restarted its network and initiated a fund recovery process. Previously, attackers exploited a wallet seed vulnerability to drain approximately $1.4 million in QU tokens from 1,404 accounts; network validators Computors have approved a recovery plan, and affected users can submit claims until May 1, 2027.Qubic's block explorer shows the network resumed processing ticks at 20:00 on October 19, surpassing the previously paused progress of 85,371,949. The vulnerability affects wallet seeds generated by certain Apple devices and browsers. Qubic recommends creating new wallets using version 4.26.4 or above and transferring funds as soon as possible. (Cointelegraph)
Odaily reports: Blockchain project Qubic has disclosed that between October 17 and 18, approximately 2.94 trillion QU worth $1.3 million was transferred out of 1,404 wallets. The unauthorized transfers occurred between 23:42 and 01:26 the following day, after which network validators paused transactions at tick 85,371,949.Qubic stated that the incident involved predictable wallet seeds generated by older Apple devices and browsers, and that the issue has been fixed in version 4.26.4. Developers also secured other at-risk funds before the attacker could move them.About 87.1% of the stolen QU remains within the paused Qubic network, while approximately 12.9% was transferred to cryptocurrency exchange MEXC and frozen. Cryptocurrency exchange Bitget has suspended QUBIC deposits and withdrawals. Whether victims will be compensated is to be decided by Qubic's Computor cluster, and QEARN staking remains unaffected. (Bitcoin.com News)
According to Cointelegraph, SlowMist stated that it has not yet independently confirmed that the analyzed Safari attack sample has led to actual crypto asset theft. Existing technical evidence primarily covers iOS 18.4 through 18.6.2, while the previously circulated claim that "iOS 13 through iOS 26.5 are all affected" remains preliminary. Analysis by SlowMist reveals that the malicious Safari page exploits a chain of vulnerabilities previously patched by Apple to attempt access to the Apple Keychain, app files, and shared data, which may involve information stored in crypto wallets. However, the presence of exfiltration-capable code does not mean data has been successfully extracted from all targeted wallets. SlowMist continues to recommend that iPhone users promptly install the latest iOS security updates and avoid opening suspicious links.
Odaily reports: Blockchain security firm SlowMist has stated that the attack samples it analyzed targeting iPhone Safari have not been linked to any confirmed incidents of crypto asset theft. The available technical evidence primarily covers iOS 18.4 through 18.6.2, and whether iOS 26.5 is affected still lacks reproducible technical evidence.The attack reuses the previously disclosed DarkSword attack chain technique, loading code through malicious web pages disguised as free virtual private server services. The samples contain components that access Apple Keychain, extract and decrypt stored information, and can also access application files and shared data.SlowMist recommends that iPhone users install the latest iOS security updates available for their devices and avoid clicking suspicious links. Users who suspect their wallet private keys or seed phrases have been compromised should generate a new wallet on a clean device and transfer their assets. (Cointelegraph)
Odaily reports: SlowMist Chief Information Security Officer 23pds has stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, take control of devices, and extract private keys and other data from self-custodial crypto wallets. The vulnerability was previously used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 through 18.7. According to 23pds, attackers have now adapted it to iOS 26.5, though this assessment has not yet been officially verified.Attacks typically begin with social engineering. After users click on malicious links sent via social media or messaging apps, their devices may be rooted and wallet data extracted. Users should promptly update their phone's operating system and avoid visiting website links sent by strangers. Separately, three investors who lost nearly $1.8 million in Bitcoin after downloading fake wallet apps from Apple's official App Store have filed a lawsuit against Apple. (Bitcoin.com News)
Odaily reports, according to monitoring by Bitcoin News, security researchers have discovered that versions 1.1 and 1.2 of FomoPeek, distributed through the Apple App Store, contain an iOS exploit framework capable of escaping the app sandbox, enabling the extraction of keychain data, wallet files, and mnemonic phrases. SlowMist has linked the app to multiple theft incidents and traced nearly $580,000 in stolen USDT flowing into a primary address. Users who have installed either of the aforementioned versions should treat any keys accessible on that iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.
Odaily reports: Earlier this month, the verified Reddit account of streaming service HBO Max was hijacked by hackers, who deployed 108 malicious ads over approximately 48 hours, tricking Mac and Windows users into executing commands to install infostealer malware.The malware can steal browser credentials, Telegram data, Apple Notes, saved passwords, and crypto wallet recovery phrases, and may also alter wallet addresses in the clipboard. Reddit has suspended the relevant ads and launched a security investigation. The number of infections and crypto asset losses have not yet been confirmed. (Decrypt)
Odaily News, According to a disclosure by the SlowMist security team, they have detected an attack campaign disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2. The attackers exploited a chain of six vulnerabilities codenamed DarkSword to form a complete attack sequence, covering WebKit remote code execution, sandbox escape, and kernel read/write operations. This allows them to access app container files and keychain data without user awareness, and record keyboard inputs while wallets such as imToken, TokenPocket, or TronLink are in the foreground.The SlowMist team stated that all six aforementioned vulnerabilities have been patched by Apple, and the current attack constitutes reuse of an n-day vulnerability chain. Merely visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen, and device forensics is still required for confirmation. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.
Odaily News: The Dutch National Cyber Security Centre (NCSC) has reported that attackers are exploiting a vulnerability in Apple's macOS Screen Sharing feature to take control of devices and install Monero mining programs. Multiple systems with port 5900 exposed to the internet have been compromised, with attackers gaining root access. The vulnerability, tracked as CVE-2026-65400, has a severity score of 7.1 out of 10. It stems from a state management error in the authentication process, allowing remote attackers to bypass login verification without valid credentials. Public proof-of-concept code has already been circulated. Apple has addressed the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The NCSC advises users to update their systems promptly and avoid exposing the Screen Sharing service directly to the internet. (Decrypt)
DeFiLlama's anonymous founder 0xngmi stated that the team postponed the release of the official mobile app due to the long-standing presence of phishing apps impersonating DeFiLlama on the Apple App Store. Apple removed them only after the team submitted evidence that the malicious apps were stealing funds.
Odaily News, DefiLlama founder 0xngmi, of the crypto data analytics platform, stated that the team spent months asking Apple to remove phishing apps impersonating DefiLlama from the App Store, which delayed the mobile app's launch until all such counterfeit apps had been removed. 0xngmi noted that after the team downloaded one of the malicious apps and documented a small crypto wallet being stolen, Apple removed it within days. In 2024, the App Store also saw counterfeit apps impersonating Rabby Wallet and Curve Finance; in November 2023, a fake Ledger Live app on the Microsoft Store siphoned off $588,000 across 38 transactions. (Cointelegraph)
Odaily News: DeFiLlama founder 0xngmi has raised questions about Apple's App Store review mechanism in a post on the X platform. He stated that his team had spent months trying to get Apple to remove a fake DeFiLlama app, but multiple previous complaints regarding trademark infringement and impersonation of the official app were not effectively addressed.In the end, the DeFiLlama team had to download and use the fake app, subsequently depositing a small amount of funds into it. As expected, the wallet assets were stolen, confirming the app's malicious behavior. After submitting another report to Apple with this evidence, the fake app was finally removed within a few days.
According to TechCrunch, OpenAI is countering Apple's lawsuit over alleged trade secret leaks, claiming that Apple's own information security management and employee offboarding processes have vulnerabilities, and that it cannot prove the relevant information constitutes protected trade secrets. Apple previously accused OpenAI of obtaining hardware-related secrets through former employees who joined OpenAI from Apple, and requested the court to expedite the evidence discovery process. In its latest legal filings, OpenAI stated that Apple allows employees to use personal iCloud accounts to process work materials and did not revoke access rights in a timely manner after employees departed. OpenAI states that Apple did not clearly specify the concrete trade secrets alleged to be stolen, but merely referred generally to information such as product development processes, supply chains, and testing. OpenAI argues that Apple's current lawsuit is primarily intended to restrict its development in the AI hardware sector, and denies that the company needs or uses Apple trade secrets. The dispute between the two parties centers on employee mobility, intellectual property protection, and competition in the AI hardware sector.
Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently, after a user implanted illegal pornographic content in a public group. The app was restored within hours.Durov said the attacker exploited a technical vulnerability to insert AI-modified illegal content into old messages within active groups, hiding the content by editing historical messages, making it difficult for regular group members to detect and report in time. This type of attack constitutes "takedown extortion," where attackers use automated accounts to implant violative content in public groups and report it to platforms like Apple, attempting to force group administrators to pay a ransom, or else exploit platform rules to get the community banned.Durov added that Telegram continuously combats illegal content through mechanisms such as user reports, AI filtering, and content hashing. This incident is not a systemic issue with the platform, but rather a targeted attack exploiting rule loopholes. He also warned that Apple's removal of the app without prior contact with Telegram could pose a risk to all mobile applications offering user-generated content (UGC), and platform developers need to strengthen their defenses against malicious reporting and "takedown attacks."
According to TechCrunch, Apple Inc. has formally applied for a preliminary injunction against OpenAI, requiring it to stop developing AI devices and related products based on Apple technology. Apple's latest investigation shows that, in addition to Senior Systems Engineer Chang Liu and Chief Hardware Officer Tang Yew Tan named in the previous complaint, another 11 former Apple employees may be involved in trade secret theft, with some having privately retained work equipment issued by Apple upon departure. Apple has simultaneously applied for an expedited discovery process, involving parties including OpenAI, its foundation, and the device startup io co-founded by Jony Ive. In response, OpenAI publicly stated that Apple's allegations are "based on misinformation and completely unnecessary," and counterclaimed that Apple has security procedure vulnerabilities, resulting in former employees still being able to access its internal systems.
Odaily News: Apple has limited the number of vulnerability reports a single researcher can submit at one time because its security team has received a large number of submissions generated by AI, many of which do not actually contain real flaws. Apple stated that researchers can request a higher limit at any time, and the company is also using AI internally to triage submissions.Bynario, a Milan-based cybersecurity startup, said it used OpenAI's ChatGPT to discover more than 50 vulnerabilities in the latest version of macOS within three weeks, including a privilege escalation chain that could give attackers full control of a Mac device.Bynario stated that it was unable to report this vulnerability because Apple had already rejected further submissions. Bynario CEO Alfredo Pesoli estimated the vulnerability's value on the criminal market at $100,000 to $200,000. Apple said it has reached out to the company and reviewed its work. In June, Apple added a submission cap and a 30-day cooldown period to its security portal. In a recent security update, Apple listed vulnerabilities discovered with the assistance of Anthropic and OpenAI software, with the number of fixes approximately five times that of a normal cycle. (Decrypt)
Odaily News: OpenAI has issued a statement responding to Apple's previously filed trade secret lawsuit, calling Apple's allegations "hasty, aggressive, and factually flawed," and released email records as supporting evidence. OpenAI stated that Apple previously claimed it had contacted the company in February and received no response, but in reality, Apple's external counsel had sent the email to the wrong recipient due to a name mix-up. Additionally, Apple also acknowledged that it had not engaged in any relevant communication with OpenAI's General Counsel.Apple previously accused OpenAI of obtaining confidential information through former Apple employees Chang Liu and Tang Tan. OpenAI denied the allegations and stated that Apple employees proactively sought advice from Liu on documents and technical issues after his departure, because Apple had failed to promptly revoke the departed employees' system access. (Business Insider)
QCP Group’s analysis states that U.S.-Iran negotiations have once again collapsed, while the Middle East ceasefire continues, leaving the overall geopolitical landscape relatively static. A shooting incident occurred at the White House Correspondents’ Dinner, with Trump suspected as the target. Following Asia’s market open, BTC briefly surged past $79,000 and ETH above $2,400—but gains quickly reversed amid concerns triggered by news of Iran’s Foreign Minister traveling to Russia for talks with Putin. Since early April, BTC has rallied over 14% cumulatively, marking four consecutive weeks of positive closes. Spot ETFs recorded nine straight days of net inflows totaling approximately $2.11 billion. Strategy funds added over $3.8 billion worth of BTC in the past month. The current key resistance level for BTC lies near the CME gap around $82,000. BTC perpetual contract funding rates remain persistently negative; a breakout above this level could trigger short-covering. Implied volatility continues declining, and risk-reversal skew has narrowed somewhat, signaling gradually rising market interest in upside exposure. Key events this week: - April 29: Earnings reports from Microsoft, Amazon, Meta, and Google, plus the FOMC interest-rate decision. - April 30: Apple earnings report, U.S. Q1 GDP data, and March PCE inflation data.