News linked to both this project and an event.
Previously, Gamdom suffered a hot wallet attack on October 13. Founder Felix Römer acknowledged losses exceeding $3 million, while blockchain researcher vxdb estimated the stolen amount across multiple networks at approximately $4.2 million.
According to SlowMist, its security personnel discovered during routine threat intelligence monitoring that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js has been implanted with a malicious loader. The loader hides the address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com; note that the domain starts with the letter 'q'). This script reads page-accessible Cookie, localStorage, and sessionStorage data, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[.]com/c.php, enabling attackers to hijack sessions or take over accounts. This data collection behavior is not restricted by target site policies, and unmatched pages may also be affected. According to SlowMist's analysis, the script also targets three categories of sites: mgbx[.]com, bikingex[.], and bitxex[.]io. It scans deposit pages every 200 milliseconds and replaces recognized deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, by wrapping the Clipboard API, replacing copy buttons, and intercepting copy events, the script ensures users only see and copy tampered addresses. If users transfer funds to these addresses, the assets will flow into the attacker's wallet.
according to On Nexus monitoring, on October 25, the legacy DotSwap trading platform DotSwap V1 was attacked. The attacker exploited a server-side signature mechanism left over from V1 and, within about 4 hours, stole about 8.5 BTC from V1 liquidity pools and accounts, involving approximately $685,000 in funds. V1 used custodial multisignature management for liquidity pools, and the losses involved BTC deposited by liquidity providers into V1 pools, with all V1 deposits affected; wallets self-custodied by trading users were not affected. The attack was launched through automated scripts, and the attacker probed all interfaces and gradually carried out fund theft against 99 Runes tokens. On Nexus believes that this incident is consistent with the recent trend of AI agent-driven attacks. Currently, DotSwap V1 has been taken offline. The team is tracing the stolen funds and collaborating with exchanges and on-chain analysis partners, and will later publish a full incident retrospective and user remediation plan. The team also stated that it is working to restore Nexus-related services.
Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)
Odaily reports: Bitcoin News posted on X that Foundation Devices stated attackers launched over 23,000 phishing email attempts targeting its hardware wallet customers, exploiting customer records the company believed had been deleted but were still retained in historical database tables. Investigators confirmed that 19,057 of these emails were sent via Mailgun, while another 1,503 were sent through Google Workspace; the number of affected customers remains undetermined.Foundation Devices stated that after the legacy WooCommerce database migration, customer names, shipping information, refund records, and incomplete checkout information in the old tables remained accessible; recent Shopify order information may also have been exposed. The company said there is no evidence that the Passport hardware wallet or its private keys were compromised, and the investigation is ongoing.
Bitcoin News posted on X that researchers claim Tailscale has a critical vulnerability: users with approved access permissions can exploit its built-in SSH to gain root access on devices, and the attack may also spread to other devices on the network. Users running nodes with Tailscale should disable Tailscale SSH and update promptly once a patch is released. Tailscale has not yet responded.
Odaily reports: According to Bitcoin News monitoring, Electrum has disclosed a high-risk security vulnerability in which malicious servers can trick users into sending Bitcoin to an attacker's address when users increase transaction fees. The attacker intercepts broadcast transactions and replaces them in the wallet history with a forged transaction that redirects funds to an address controlled by the attacker. If users increase fees via Replace-by-Fee (RBF), Electrum may sign the malicious transaction. Electrum confirmed receiving two related incident reports, with one user losing funds. The attacker also generated addresses with the same last four characters as the intended recipient addresses. The vulnerability affects versions prior to 4.8.3 and has been fixed in version 4.8.3. Electrum reminds users to update immediately and to verify all recipient addresses and amounts before signing transactions.
Odaily reports: Bitcoin Core developers have merged a security policy adjustment. For vulnerabilities that can be easily discovered or rediscovered through simple large language model (LLM) prompts, the previous long-term confidential disclosure mechanism will no longer be used. The new rules allow developers to mark such issues as "easy to find" during vulnerability classification, then backport fixes to all still-supported versions and release them as soon as possible through minor version updates, along with a security advisory and some vulnerability details.Previously, Bitcoin Core scheduled disclosure based on vulnerability severity, with medium- and high-risk vulnerabilities usually only made public after the affected versions stopped being maintained. This adjustment stems from AI tools lowering the threshold for vulnerability discovery: in July this year, a Bitcoin Red Team composed of 16 developers used AI models to scan about 390 Bitcoin-related projects and recorded 4,962 findings in one day, of which 85 were listed as critical issues. Developers noted that continuing to extend the confidentiality period for such vulnerabilities can no longer effectively prevent attacks and instead delays the release of fixed versions; however, the new rules also mean that fixes may lack longer testing time. Currently, no vulnerability has been officially marked as falling into the "easy to find" category under the new rules. (CoinDesk)
According to Cointelegraph, Bitcoin Core developer Antoine Poinsot stated on Thursday on the bitcoin-dev mailing list that large language models (LLMs) have made certain software vulnerabilities extremely easy to rediscover. Maintaining long-term secrecy is already of limited value and instead delays the release of patched versions, prompting the team to update its vulnerability disclosure policy. The new policy dictates that "easily discoverable" vulnerabilities, which can be identified with minimal cost such as through simple LLM prompts, will be patched as soon as possible across all supported major versions, alongside the simultaneous release of security advisories. Other vulnerabilities will continue to be disclosed based on severity: low-severity vulnerabilities will be disclosed two weeks after the release of the major version containing the fix; medium-to-high-severity vulnerabilities will be disclosed two weeks after the end-of-life (EOL) of the last affected version, typically around one year after the patch release; critical vulnerabilities will be handled through a dedicated process.
Bitcoin Core has adjusted its security vulnerability disclosure policy, defining easily discoverable vulnerabilities as those that can be found through simple large language model prompts, and will release fixes as soon as possible across all major versions still under maintenance, while publishing security advisories.Bitcoin Core developer Antoine Poinsot stated that in the past, vulnerabilities were typically kept confidential during a longer disclosure embargo period to allow users to upgrade, but large language models have lowered the threshold for rediscovering certain vulnerabilities, limiting the protective value of delayed fixes.Low-severity vulnerabilities will be disclosed two weeks after the major version containing the fix is released; medium- and high-severity vulnerabilities will be disclosed two weeks after the affected version reaches end of life, typically about one year after the fix enters a new version. Critical vulnerabilities are not subject to the standard policy and will be handled through ad hoc procedures.In August, the volunteer organization Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with about one-fifth having been reproduced at the time. Core Lightning developers that same month asked node operators to upgrade or take nodes offline, and delayed disclosure of technical details for two weeks. (Cointelegraph)
CZ stated that while the market widely worries AI could attack crypto systems, the internet and banking systems actually rely on weaker encryption technologies.CZ also noted that AI doesn't need to genuinely crack Bitcoin's cryptographic system to cause harm—existing data leaks can already be used for larger-scale phishing, social engineering attacks, and other risk scenarios.
Odaily reports: Bitcoin News posted on X platform that users running Eclair Lightning nodes should upgrade to v0.14.5. ACINQ released two versions within 5 days: v0.14.4 on October 15 fixed a vulnerability where malicious websites exploited browser-cached API login credentials to trigger payment and channel operations; v0.14.5 on October 20 fixed vulnerabilities in the node's peer layer, which developers said could allow channel partners to steal funds or interfere with payments. No fund losses have been reported so far. After the update, the browser dashboard will no longer be able to communicate directly with the node API.
Bitcoin News posted on X that BTCPay Server has updated its optional WooCommerce/WordPress deployment through its Docker installer in response to a recently disclosed severe PHP vulnerability. Users running WooCommerce through BTCPay Server should update immediately by simply clicking "Update" within BTCPay Server.
Bitcoin News posted on X that the St. Louis Fed Economic Research website is currently displaying a maintenance notice. The site hosts the widely used FRED economic database. The website outage comes amid reports of a severe PHP security vulnerability, but the Federal Reserve has not yet confirmed whether the two are related.
Bitcoin News posted on X that 8 TLS certificates issued by India's eMudhra were found to have extremely weak private keys, which attackers could exploit to impersonate virtually any website. Major browsers have blocked the affected certificates, but millions of servers, Linux systems, and internet-connected devices may still require updates. A cryptography expert warned that the scale of this cleanup effort could exceed the 2014 Heartbleed vulnerability. No malicious exploitation has been confirmed yet.
According to Odaily, digital hardware wallet manufacturer NGRAVE disclosed on October 19 that attackers hijacked a third-party notification service used by its LIQUID companion app and sent fake security alerts to users, resulting in approximately 70 wallet addresses being stolen for about $2.56 million across 4 blockchains. Among the losses, Bitcoin accounted for approximately $1.77 million, XRP approximately $454,000, Ethereum assets approximately $316,000, and Stellar approximately $18,000.The attackers lured users into clicking on counterfeit websites and entering their 24-word recovery phrases or Perfect Keys, after which automated scripts transferred the assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised, and that victims voluntarily handed over their recovery credentials during the phishing process.The unauthorized access may have begun on October 11. After obtaining one access key, the attackers acquired a key with broader permissions and sent fake notifications on October 17. NGRAVE detected the anomaly approximately 1 minute after the notifications appeared, but the first wallet had already been drained 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a crypto security company, and said that the affected keys have been replaced, with two-person approval, domain restrictions, and emergency shutdown mechanisms added. The company also reminded affected users to create new wallets and contact the support team, noting that some device information, wallet activity, IP addresses, and approximate locations may have been exposed. (Bitcoin.com News)
Odaily reports: Crypto researcher Stacy Muur has compiled a list of 82 digital asset projects and protocols said to have shut down in 2026, including Balancer, Radiant Capital, Neon EVM, Step Finance, and others, spanning DeFi, blockchain infrastructure, and Web3 gaming.The shutdowns were driven by declining revenue, exhausted funding, and security incidents. Earlier this year, Bitcoin's price briefly fell below $60,000, retreating from an all-time high of over $126,000 in October 2025, adding financial pressure on projects.When Ethereum Layer 2 network Blast announced its shutdown, it stated that the project had no "credible path to economic viability." Step Finance shut down following a major treasury exploit, while Radiant Capital announced the end of operations after failing to recover from a 2024 exploit.An August study by DeFiLlama showed that 100 crypto projects had announced shutdowns in 2026, 40 of which occurred in the preceding 90 days; the most common reason was product-market mismatch, followed by exhausted funding, insufficient revenue, and pivots to other products. The projects involved raised a combined total of approximately $1 billion and generated $250 million in cumulative fees, with 9 individual projects each raising over $50 million. (Cointelegraph)
Odaily reports: Cryptocurrency trading platform OKX launched its Shield account protection program in the United States on October 20, with eligible users able to receive up to $500,000 in coverage. The program covers certain unauthorized account takeovers caused by phishing, malware, and SIM-swap attacks, and users must enable passkeys and other security settings.Former New York Governor Andrew Cuomo said his interest in cryptocurrency began in 2011, and he currently serves on OKX's board of directors and co-chairs the company's joint venture with Intercontinental Exchange (ICE), the parent company of the New York Stock Exchange. He supports OKX's push to tokenize US stocks and said some companies remain on the sidelines.Andrew Cuomo expects that the CLARITY Act will not receive a vote before the 2026 midterm elections, with the next opportunity possibly in January next year. He said the US Congress should reduce partisan strife and establish clearer federal rules for the digital asset market; companies such as Microsoft and Google parent Alphabet are currently cautious about tokenized stocks. (Bitcoin.com News)
Odaily reports: Blockchain project Qubic has disclosed that between October 17 and 18, approximately 2.94 trillion QU worth $1.3 million was transferred out of 1,404 wallets. The unauthorized transfers occurred between 23:42 and 01:26 the following day, after which network validators paused transactions at tick 85,371,949.Qubic stated that the incident involved predictable wallet seeds generated by older Apple devices and browsers, and that the issue has been fixed in version 4.26.4. Developers also secured other at-risk funds before the attacker could move them.About 87.1% of the stolen QU remains within the paused Qubic network, while approximately 12.9% was transferred to cryptocurrency exchange MEXC and frozen. Cryptocurrency exchange Bitget has suspended QUBIC deposits and withdrawals. Whether victims will be compensated is to be decided by Qubic's Computor cluster, and QEARN staking remains unaffected. (Bitcoin.com News)
Odaily reports: Former Mt. Gox CEO Mark Karpelès is developing a low-cost device designed to detect hidden LTE antennas used in hardware wallet supply chain attacks, without the need to open the wallet. The device will emit weak radio waves and measure resonant frequencies to identify potential spy implants. Karpelès plans to publicly release the circuit board design and specifications so that anyone can build one themselves; the project is still in the conceptual stage, with a prototype expected to be launched in the coming weeks. (Bitcoin News)