News linked to both this project and an event.
GoPlus Security released a security alert stating that on August 25, realio[.]fund, a project under Realio Network, was attacked. The attacker took control of the platform's signing system and moved treasury and custody wallet assets across Ethereum, BNB Chain, Algorand, Stellar, and the Realio native chain. A total of approximately 127.9 million RIO tokens worth around $6.2 million were affected, with the attacker having cashed out approximately $317,000 so far.
Odaily News, The Sandbox has released a post-mortem report on the August 22 vulnerability incident. The report shows that attackers exploited vulnerabilities in contracts related to cross-chain configurations on Base and BNB Smart Chain (BSC), stealing 14,742,341.84 SAND from the Ethereum treasury, accounting for approximately 0.5% of the maximum supply, with an estimated economic impact of approximately $1.4968 million, of which about $987,000 was actually retained by the attackers. The Ethereum mainnet and Polygon network were not affected. Until further notice, please do not purchase or send SAND on Base or BNB Smart Chain. Contracts deployed on Base and BNB Smart Chain have been permanently deactivated and will not be reopened. The Sandbox stated that the team has reported the attacker's wallet address to blockchain analysis firms TRM Labs and Chainalysis, and has communicated directly with relevant exchanges. The Sandbox also announced a compensation plan, which will compensate wallets that legitimately held cross-chain SAND on Base or BSC prior to the incident at a 1:1 ratio in Ethereum SAND. Compensation funds will come from The Sandbox treasury, with no new tokens issued. The claim process will open within the next two weeks and remain open for two weeks.
Odaily News reported that Galaxy Research tracking found that 6 bitcoin wallets, dormant since 2011, 2012, and 2014, transferred a total of 553.59 BTC between August 16 and 26, valued at $40.15 million at the time of transfer. Two of the wallets carry the "Salomon Client Dusted" tag linked to a New York lawsuit involving Noah Doe.One of the transfers involved 40 BTC from a wallet dormant since May 28, 2012, with the funds moved on August 26 to German crypto custodian bank Boerse Stuttgart Digital. Calculated at a cost of approximately $5, the funds appreciated by roughly 1,535,911%.The remaining transfers included 212 BTC, 150 BTC, and 132.31 BTC, originating from wallets inactive since 2012, 2014, and 2011, respectively. The Noah Doe lawsuit seeks to declare 39,069 dormant bitcoin addresses in New York State as lost property. Additionally, several long-term holding addresses moved funds following the July Coldcard hardware wallet vulnerability incident. (Decrypt)
Odaily News - Hardware wallet maker BitBox reports that credit card sales in August grew roughly 10x compared to the baseline of previous weeks, with the increase primarily driven by North America. Trezor and OneKey also confirmed rising sales during the same period, though neither disclosed specific figures.Trezor, BitBox, and OneKey have all re-reviewed their seed phrase generation, random number generator, entropy, and firmware verification processes. Trezor plans to conduct penetration testing on core firmware functions and publish related security audit reports. OneKey will strengthen reviews of security-critical code paths and transaction signing processes.Ledger CTO Charles Guillemet stated that AI-assisted attacks mean patch releases, vulnerability disclosures, and user education need to accelerate. Blockstream Jade has released a firmware update containing multiple fixes and recommends users simultaneously update their apps, operating systems, devices, routers, and home appliances. (Bitcoin.com News)
Odaily News, L1 blockchain Decred stated that between August 16 and 17, its mainnet inflation vulnerability was exploited, resulting in the generation of approximately 2,077.97 DCR. This vulnerability has existed in the consensus code since the mainnet launch in February 2016, stemming from improper handling of edge cases when the regular transaction tree interacts with the stake transaction tree, allowing for double-spending of inputs. The vulnerability was submitted via a bounty program on August 12, but was exploited before a fix could be implemented. Decred has decided not to roll back to minimize the impact on users. The approximately 2,000 DCR minted through this exploit do not affect the 21 million hard cap and are far lower than historical shortfalls in subsidies due to missed votes and other causes, which exceed 215,000 DCR. Currently, the team has developed an additional double-spend monitoring service and plans to improve the emergency upgrade signaling mechanism.
TAC tweeted that on August 22, an attacker exploited a vulnerability in the Cosmos EVM precompile layer, transferring 2,985,651,403 TAC from a single account on the TAC network. The project team subsequently paused the network at block height 24,671,475 to halt the attack.
Odaily News: Ethereum client Besu has fixed 5 security vulnerabilities discovered by blockchain security firm CertiK in version 26.7.1 released on July 27, and published 4 detailed security advisories on August 14. Vulnerability details were disclosed after a delay to allow node operators to complete upgrade deployments.Jialiang Chang, Director of Security Engineering and Senior Audit Partner at CertiK, stated that the arrangement of releasing patches first and details later provided an 18-day buffer period, allowing node operators to identify affected deployments, test new versions, and coordinate with validators or consortium participants to complete upgrades.The vulnerabilities involve block broadcast handling, caching of future-height consensus proposals, WebSocket subscription limits, and JSON-RPC filter creation. If left unpatched, attackers could exhaust node memory or thread resources, impacting node availability and consensus processing.Using the Chain Scan methodology, CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand round-the-clock multi-node testing on public chain networks. (Bitcoin.com News)
Odaily News, SlowMist Security Team disclosed that the cross-chain bridge project Allbridge suffered an attack on August 19, 2026, with losses of approximately $190,000. Notably, this attack was not executed instantaneously—the attacker began laying the groundwork nearly a month in advance, bypassing the verification mechanism through forged cross-chain messages.According to SlowMist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as CCTP-style, claiming a transfer of 1 million USDC, despite no actual USDC burn operation occurring. Subsequently, Circle generated a valid attestation for this complete message following standard procedures.Approximately 24 days later, on August 19, the attacker waited for the Base Router to receive a genuine CCTP deposit, bringing its balance to approximately 191,000 USDC, then launched the attack just 6 seconds later. Using the previously forged message and attestation, the attacker called Allbridge's receiveCctpMessage function. Due to the project's lack of critical validation, the system mistook the fraudulent cross-chain message for a genuine deposit and recorded a 1 million USDC credit.Subsequently, the attacker borrowed approximately 809,000 USDC temporarily via an Aave flash loan to match the Router's balance with the forged amount, then utilized the internal credit record to call the transfer function, ultimately moving out approximately 999,000 USDC (after deducting a 0.1% fee). After repaying the flash loan and fees, the attacker netted approximately $189,800 in profit. The root cause of this vulnerability lies in Allbridge's failure to verify the identity of the cross-chain message sender and receiver, as well as its failure to confirm whether USDC was genuinely minted or whether the balance actually increased—instead directly trusting the amount and message hash data constructed by the attacker.SlowMist emphasized that on-chain message verification does not equate to actual asset arrival. Cross-chain protocols must not only verify message authenticity but also ensure the message source is trustworthy, confirm the receiver is Circle's official TokenMessengerV2, and only record assets after confirming actual minting and balance changes. This incident once again highlights the security risks in cross-chain bridges' message verification and asset settlement processes.
Odaily News: Metaverse gaming platform The Sandbox has confirmed a vulnerability in its cross-chain bridge, allowing attackers to mint unbacked SAND on Base and BNB Smart Chain. Blockchain security firm PeckShield detected on August 21 that two addresses had collectively minted approximately 14.9 billion SAND. The Sandbox subsequently shut down bridging functionality on both networks.The Sandbox stated that the affected assets are bridged assets on Base and BNB Smart Chain, while SAND on Ethereum and Polygon, user wallet assets, and the Ethereum-locked assets backing the token remain unaffected. The proportion of genuinely collateralized assets involved in this incident is less than 0.01% of the total SAND supply.The Sandbox is developing a compensation plan for affected liquidity providers and advises users not to trade SAND on Base or BNB Smart Chain until bridging is restored. Coinbase plans to delist 10 perpetual futures contracts, including SAND, on August 26, with open positions to be automatically settled at that time. (Bitcoin.com News)
According to Cryptopolitan, cybersecurity firm Adversa AI has disclosed that xAI's AI assistant Grok contains a security vulnerability known as "Encrypted Context Injection." Attackers can embed encrypted commands within standard web pages. When a user requests Grok to summarize such a page, Grok automatically decrypts and executes the hidden command, forwarding the user's name, geographic location, subscription tier, and complete chat history to the attacker's server. The vulnerability was reported to xAI through the HackerOne platform on June 3, 2026. Researcher Rony Utevsky followed up on August 4 and August 10, respectively. However, as of August 19, the vulnerability remains unpatched on Grok.com, and xAI has not provided a timeline for a fix.
According to CryptoSlate, researchers from USENIX Security publicly disclosed a clock attack vulnerability against Solana’s Proof of History (PoH) mechanism on August 12. The vulnerability had been privately reported to the Solana development team as early as December 2025. Research indicates that a malicious scheduler leader could manipulate the PoH logical clock through "re-anchoring," slowing the progression of logical time. This would yield a longer transaction selection window within physical time, allowing the attacker to isolate honest leaders' blocks via the TowerBFT fork-choice mechanism, with the required stake for the attack falling below 33%. The Alpenglow security contest hosted by Anza, which offered a 50,000 SOL prize pool, concluded on August 19. However, the vulnerability was excluded from the evaluation scope because the contest rules explicitly excluded "behaviors that can only be triggered when Alpenglow is inactive." The Solana development team confirmed awareness of the issue, stating that the probability of the worst-case scenario occurring under current conditions is low. They expect the Alpenglow upgrade to fundamentally eliminate the attack's prerequisites. The Alpenglow code is already integrated into the Agave 4.2 client but remains inactive on the mainnet, with full deployment expected alongside Agave 4.3. Until then, the transitional risks associated with this vulnerability have yet to receive public implementation-level analysis or official responses.
As disclosed by security researcher V12 (@v12sec), the Rabby Wallet browser extension contains a silent signature extraction vulnerability that allows attackers to extract wallet signatures via malicious websites without user awareness, thereby draining wallet assets. The conditions required to trigger this vulnerability are extremely limited: users must simultaneously meet two conditions—connecting to a malicious website and manually setting the auto-lock timer to 10 minutes. Other timer settings are unaffected, and the mobile app is also unaffected. Rabby Wallet officially stated that a fix update was released on August 11 following the vulnerability's discovery. No actual exploitation cases have been detected so far. Users are advised to confirm as soon as possible that the extension has been updated to the latest version.
Odaily News: BIP-110 supporters are discussing a hard fork to change the stalled minority chain's mining algorithm from SHA-256d to BLAKE2b. Transaction history before the fork remains shared by both chains. If transaction and signature rules remain consistent, the same transaction could be replayed on the other chain, creating a replay attack.BIP-110's peak miner support was approximately 2.53%. After the consensus rules took effect on August 8, the minority chain produced only two consecutive blocks before stalling, while the Bitcoin main chain continued operating and widening the block height gap. The BIP-110 proposal was subsequently marked as closed, and supporters shifted focus to discussing the BLAKE2b proof-of-work scheme.Bitcoin Knots plans to add a new signature hash option, but RDTS will still maintain compatibility with Bitcoin Core's existing signature hash types. Regular transactions may continue to be valid on both chains. Users will need to use the new option and rely on wallets or hardware signing firmware that support it to achieve asset separation.Luke Dashjr stated on August 18 that Bitcoin should bear the responsibility for replay protection, calling it "Spamcoin." If the BLAKE2b fork proceeds around September 1, exchanges, wallets, and holders will need to distinguish between cross-chain transactions and chain-specific transactions. (Bitcoin.com News)
Odaily News: The KITE Foundation has provided an update on the handling of a token security incident. A new KITE ERC-20 contract has been deployed on the Ethereum mainnet, with the total token supply remaining unchanged. Old KITE tokens will be migrated to the new contract at a 1:1 ratio. Addresses confirmed to be controlled by the attacker will be excluded and will not receive new tokens.The migration snapshot is based on Ethereum mainnet block height 25,692,498. Regular self-custody wallet users will receive the new tokens directly without needing to redeem or authorize anything. Exchange users will have their migration coordinated between the exchange and the KITE team. Cross-chain channels will remain paused until migration and verification are complete.Previously, KITE detected abnormal transfers on August 6 and confirmed it had been attacked by hackers. The team stated that this incident did not result in any asset losses for users or the project, and the impact is currently under control.
Odaily News: A bitcoin wallet created in 2012 has moved 212 BTC after remaining dormant for 14 years, valued at $13.72 million based on the price at the time of transfer. The wallet address was created on August 10, 2012. These bitcoins were originally worth $2,346, with a per-coin price of $11.07; at the article's quoted price of $64,761, if sold in full, the holder would realize a gain of 584,725%. The wallet owner's identity remains unknown. The 212 BTC has been transferred from a legacy P2PKH wallet to an unlabeled Bech32 wallet, arriving in multiple batches before being consolidated. A Coldcard vulnerability led to the theft of nearly 2,000 BTC, which may have prompted some long-term holders to move their assets, but this address has not been linked to any known entity. (Bitcoin.com News)
Odaily News: Peer-to-peer cryptocurrency trading platform NoOnes announced that it will begin gradually winding down operations after running for over three years. The company stated that it had been continuously seeking to resolve and lift the sanctions imposed on NoOnes, but ultimately failed. The sanctions caused the platform to lose key partners, and blockchain monitoring firms also flagged transactions associated with NoOnes as high-risk, making it increasingly difficult for the platform to continue normal operations. According to the plan, the business contraction began on August 17, and the P2P marketplace will close at 23:59 UTC on August 21. Services such as Swap, NoOnes Visa, fiat withdrawals, the gift card store, and the Bitcoin Lightning Network will also be discontinued progressively. After that, the platform will only support withdrawals, and users will still be able to log in, view balances, and withdraw remaining assets. The company advises users to complete asset withdrawals as soon as possible, no later than August 23. Previously, on January 26, 2025, NoOnes revealed that the platform had suffered a major security breach earlier that month, resulting in losses of approximately $8 million in crypto assets. CEO Ray Youssef confirmed the news after on-chain detective ZachXBT disclosed the hacking incident on his Telegram channel.
The official Decred X account (@decredproject) issued a security notice stating that a security vulnerability was discovered in the Decred (DCR) network. The patch will be released on the morning of August 18, Eastern Time. For security reasons, users are advised to pause voting and mining operations before completing the upgrade. An announcement will be posted on the official X account immediately after the patch is released.
Odaily News: Sheldon Lee, founder of cryptocurrency exchange BitMart, stated that a post on X claiming users were unable to withdraw funds and that some employees had not received their July salaries is a "fabricated rumor," adding that the exchange's Chinese-language account had been hacked. Critics, including users and on-chain investigator ZachXBT, have demanded that BitMart resume withdrawals or undergo an independent third-party audit. BitMart is gradually winding down operations, with the final trading day set for August 26. Troubled investment firm Echo Base said it had proposed a funded restructuring plan to BitMart but received no response. The firm warned that resolving a large volume of customer claims may require proceedings through the courts. (CoinDesk)
Odaily News, Tornado Cash founder Roman Storm stated that if the logic behind the U.S. Department of Justice's (DOJ) case against him holds, tech companies Google and OpenAI should also be held liable for North Korean hackers abusing their products. Those involved reportedly used ChatGPT to write code and Google Gemini for forgery and image manipulation. Storm was convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business. He pointed out that the Tornado Cash case could set a legal precedent where software developers are penalized for criminal acts committed by users, emphasizing that criminals should be held accountable rather than the developers of tools. The CLARITY Act for digital asset markets is intended to provide protections for software developers by distinguishing developer liability from the potential misuse of protocols for illegal activities. However, although a final motion for consideration of the bill has been scheduled for a vote, its current chances of passage remain low. (Bitcoin News)
Odaily News: According to monitoring by Galaxy's Head of Research, since July 31, they have communicated with over 190 victims of the Coldcard vulnerability attack, and have asked victims who have not yet been in touch to reach out via direct message so they can provide tracking information and assist in reporting losses to relevant authorities. Since August 6, no new attacks have been confirmed, but this does not mean that new attacks cannot occur, and vigilance should be maintained.