News linked to both this project and an event.
Odaily reports: Blockchain security firm CertiK stated that although Google, Apple, and Microsoft have blocked 8 affected certificates issued by Indian digital certificate authority eMudhra, crypto trading bots and exchange applications may still be exposed to related vulnerability risks, as browser remediation measures may not cover software that uses independent security systems.Peiyu Wang, Senior Director of Digital Asset Security at CertiK, noted that attackers could exploit compromised certificates to impersonate exchanges, wallet interfaces, and APIs, replace deposit addresses, or trick users into approving malicious transactions. However, such attacks would also require intercepting or redirecting network traffic, and the compromised certificate authority keys alone cannot expose wallet private keys. Crypto service operators should update their software and certificate trust stores, and confirm that their applications reject the affected certificates. (Cointelegraph)
Odaily Report: Three men in Bristol, UK, broke into a man's home in the early hours of May 15, assaulted the victim, and demanded he hand over a large amount of cryptocurrency. The victim sustained head injuries and was hospitalized for treatment; the three men were unsuccessful in their attempt.Terroll Paul, Mohamed Samagassi, and Pierre Madzou all pleaded guilty to aggravated burglary and were sentenced at Bristol Crown Court on October 15. Paul was sentenced to 6 years, Madzou to 5 and a half years, and Samagassi to 5 years; the victim's underage sister called the police, and the three were subsequently arrested at the scene.Police did not disclose the amount of cryptocurrency the three demanded. The case is a "wrench attack," in which criminals use violence or threats to force cryptocurrency holders to hand over digital assets; data from blockchain security firm CertiK shows that in the first six months of 2026, such attacks worldwide caused $124 million in losses, a 12-fold year-on-year increase. (Decrypt)
According to CertiK's monitoring, the decentralized protocol 79thVault exhibited suspicious activity. The attacker dumped 2.01 million 79AU tokens via a privileged function and transferred 16,200 BNB (approximately $12.5 million) to an attacker-controlled address. Approximately 90% of the stolen funds currently remain in the relevant address, and the project team has extended a 10% bug bounty offer for their return.
Odaily News: Analysis by security firm CertiK shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker draining 200 ETH worth over $500,000. According to CertiK, the root cause is a lack of access control in the 0x8804d1de function within the keeper implementation contract. This contract was involved in the March 2020 "Black Thursday" liquidation crisis, where it won ETH at zero bids. Four lots of 50 ETH each were never settled, and the attacker used this to drain the funds, transferring them out via Tornado Cash in batches of 10 ETH each. This contract is not part of the current Sky ecosystem core, but old contracts still holding funds may remain potential attack targets.
Odaily News — Web3 security firm CertiK today officially released its Intel3D report, "The Rise of AI Employees: How Agentic AI Is Reshaping Cybersecurity, Anti-Money Laundering, and Compliance." The report notes that AI is transitioning from an assistive tool that helps analysts identify issues to a member of the working team capable of conducting investigations, making judgments, and executing remediation tasks within defined permissions. This shift is reshaping security and compliance processes across traditional finance and Web3, and is also raising new requirements for how enterprises supervise AI, define permission boundaries, and allocate responsibility.The report also cautions that model misjudgments, prompt injection, and adversaries' exploitation of AI may introduce new risks. As AI begins to hold and trade digital assets, its own behavior must also be subject to audit. CertiK recommends that enterprises establish governance mechanisms covering permission boundaries, human approval, decision records, and division of responsibilities, and conduct regular red-team testing; these mechanisms must be improved in tandem with AI's execution capabilities to support "AI employees" in continuously creating value for security and compliance work under supervision and accountability.
Odaily News: The State Attorney General's Office of Mexico (FGJEM) stated that two suspects are accused of killing four people in search of a cold wallet believed to contain millions of dollars in Bitcoin. The two are scheduled to appear in court on Wednesday, where a judge will determine whether there is sufficient evidence to continue criminal proceedings.The surnames of suspects Diego Sebastián and Gerardo have not been disclosed. Prosecutors allege that the pair killed Jonathan Meléndez, keyboardist for the rock band Camilo Séptimo, his pregnant wife, their daughter, and an employee at a residence in the city of Atizapán de Zaragoza. The family's golden retriever was also killed.Mexico's Secretary of Security, Omar García Harfuch, stated that one of the suspects was a business partner of the victim and allegedly used that relationship to gain entry into the residence. If convicted, the two could face sentences ranging from 25 to 70 years in prison for each victim.Blockchain security firm CertiK reported that 52 violent coercion attacks against cryptocurrency holders were recorded globally in the first half of 2026, a 33.3% increase from 39 during the same period in 2025. Blockchain analysis company Chainalysis estimates that the value of stolen cryptocurrency from related attacks exceeded $30 million. (Cointelegraph)
Bitcoin News posted on X platform, stating that France disclosed this month that its tax administration had been hacked, with data of approximately 678,000 individuals and businesses stolen. The stolen data allegedly includes names, addresses, income, and property information. Analysis of the alleged database found 26,805 records showing income exceeding €100,000, including 386 records exceeding €1 million. According to CertiK data, out of 52 verified cryptocurrency wrench attacks globally in the first half of 2026, France accounted for 33. French prosecutors have also accused a tax department employee of using government databases to identify cryptocurrency investors and selling personal information to criminals involved in physical assaults and extortion. The latest data breach has no publicly linked physical attacks yet, but sensitive financial and location data of hundreds of thousands of people may now no longer be under government control.
Odaily News: Ethereum client Besu has fixed 5 security vulnerabilities discovered by blockchain security firm CertiK in version 26.7.1 released on July 27, and published 4 detailed security advisories on August 14. Vulnerability details were disclosed after a delay to allow node operators to complete upgrade deployments.Jialiang Chang, Director of Security Engineering and Senior Audit Partner at CertiK, stated that the arrangement of releasing patches first and details later provided an 18-day buffer period, allowing node operators to identify affected deployments, test new versions, and coordinate with validators or consortium participants to complete upgrades.The vulnerabilities involve block broadcast handling, caching of future-height consensus proposals, WebSocket subscription limits, and JSON-RPC filter creation. If left unpatched, attackers could exhaust node memory or thread resources, impacting node availability and consensus processing.Using the Chain Scan methodology, CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand round-the-clock multi-node testing on public chain networks. (Bitcoin.com News)
Term Labs 发文更新漏洞事件进展。目前所有 Term Meta Vault 已关闭，DAO 治理角色已被撤销。此关闭不可逆，永久禁止进一步存款，但提款仍开放。本次事件涉及 Term Vault 治理。底层 Term 协议及其直接借贷市场尚未受到影响，团队正在继续核实影响范围。若仍存在资金缺口，团队将寻找解决途径。 此前消息，据 CertiK 监测，Term Finance 于昨日遭遇治理攻击，损失约 850 万美元。
According to monitoring by CertiK Alert, the DeFi lending protocol Term Labs has been targeted by a governance attack, resulting in approximately $8.5 million in asset losses. Currently, around 2,843 ETH and approximately $1.6 million worth of DAI have been transferred to address 0xD5183d8BfC65a50863C62aF2538198A8288FFc13. Term Labs has confirmed that its Term Vaults fell victim to a governance exploit, stating that the team is continuing to investigate the incident and will release further details upon completion of the investigation. Official sources have yet to disclose the specific attack vectors or the scope of the impact.
Odaily News: Brazil's crypto market has recorded $318.8 billion in on-chain transaction value over the past 12 months, ranking fifth globally in cryptocurrency adoption, with nearly one-third of Latin America's related activity conducted through Brazilian wallets and platforms. Blockchain security firm CertiK stated that virtual asset service providers must submit authorization applications to the Central Bank of Brazil (BCB) by October 30, 2026, accompanied by independent audit reports. On November 10, 2025, the Central Bank of Brazil issued three resolutions clarifying the licensing scope, minimum capital requirements, and foreign exchange rules for virtual asset service providers. Minimum capital requirements for different license categories range from approximately R$10.8 million to R$37.2 million. Among the current approximately 120 service providers, most have not yet obtained formal licenses, and overseas operators must relocate their operations to Brazil within 270 days. Approximately 80% of Brazil's declared cryptocurrency transaction volume is settled via dollar-pegged tokens, with USDT accounting for 88.7% of that share. Total stablecoin transaction volume from 2019 to 2025 reached R$1.13 trillion. CertiK statistics show that the crypto industry suffered losses of $1.32 billion due to hacker attacks and exploit incidents in the first half of 2026, involving 344 events. (Decrypt)
CertiK 表示，其监测系统发现两笔各 200 ETH 的交易转入 Tornado Cash，相关资金与正在进行的 Coldcard Wallet 攻击事件有关。上述资金此前通过 THORChain 由 BTC 跨链转入以太坊地址，随后再被转入 Tornado Cash。
According to CertiK Alert monitoring, a security incident occurred on VerusCoin's Ethereum cross-chain bridge, with approximately $7.53 million in assets transferred out. Preliminary analysis indicates that this issue may be related to the cross-chain bridge failing to sufficiently verify whether the Verus chain-side input supports the paid amount, similar to an incident that occurred in May this year.
据彭博社报道，区块链安全公司 CertiK 最新报告显示，2026 年上半年全球针对数字资产持有者的暴力"扳手攻击"（即以人身威胁强迫受害者交出加密货币）事件共记录 52 起，同比增长 33%。其中法国以 33 起攻击案例独占近三分之二，成为全球最严重的受害国。报告指出，加密犯罪分子的攻击目标正从数字钱包转向现实中的持币个人，暴力手段日趋普遍。
Odaily Odaily News, July 22nd - Web3 security firm CertiK released its "H1 2026 Wrench Attack Report." The report indicates that a total of 52 publicly verified wrench attacks were recorded globally in the first half of 2026, a year-over-year increase of 33.3%; related losses amounted to approximately $124 million, an increase of about 11.8 times compared to the same period last year.The report notes that attackers are shifting from exploiting technical vulnerabilities to targeting asset holders and their real-world social networks. Home invasion incidents increased from 1 case in H1 2025 to 20 cases, accounting for 41% of the total incidents in the period. Europe has become a high-incidence area for attacks, with 33 cases occurring in France alone, representing 63.5% of the global total.CertiK stated that as real-world risks become a significant challenge for digital asset security, enterprises and high-net-worth individuals need to establish more comprehensive protection systems. CertiK has launched operational security services to help identify exposure risks related to identity, family, residence, and travel routes. Simultaneously, through the CertiK Security Workspace, it correlates off-chain intelligence, on-chain transactions, and AML risk signals to support institutions in tracking and analyzing cybercrime activities. Furthermore, CertiK is strengthening cooperation with international law enforcement agencies such as Interpol and Europol, providing technical support for cross-border attack investigations and security policy research.
CertiK published an analysis stating that the Solana ecosystem protocol DeFiTuna was attacked on July 16, with losses of approximately 569,601 USDC. The attacker first created an extremely low-liquidity TUNA/USDC pool and swapped borrowed USDC into the pool via Jupiter routing. Since only a minimal amount of TUNA was ultimately obtained, the protocol experienced rounding down during the position asset value calculation, causing the total assets to be recorded as 0, thereby incorrectly passing the health and solvency checks.
Decentralized trading protocol Ostium paused trading due to suspected exploitation of its oracle system, with security firms Blockaid and CertiK estimating losses between $18 million and $22 million.
according to CertiK's monitoring, CodexField's X account and website have been taken offline. Earlier, on-chain analyst Specter had warned that the project might be a scam and exit scam, and tracked abnormal cross-chain fund transfers totaling over 17.3 million USDT.
Odaily, Web3 security firm CertiK has released the "Hack3D: First Half of 2026 Report." The report shows that the Web3 ecosystem experienced 344 security incidents in the first half of 2026, with cumulative losses of approximately $1.32 billion. Although this figure represents a 46.8% decrease compared to the same period last year, excluding the impact of the $1.45 billion security incident involving Bybit, the scale of losses in the first half of this year actually increased by approximately 28% year-on-year, indicating that the overall security environment in the industry has not materially improved.The report points out that wallet theft has become the attack type causing the greatest financial loss, accounting for approximately $450 million in losses in the first half of the year. Meanwhile, although the number of phishing attacks fell by more than 50% year-on-year, the loss amount only decreased by approximately 10.8%, reflecting that attackers are shifting towards high-net-worth individuals and institutional targets, carrying out more targeted high-value attacks.Furthermore, code vulnerabilities remain the most frequent type of attack, with 204 related incidents. CertiK believes that attackers are increasingly targeting long-running legacy smart contracts that lack re-audits. The report also shows that mega-attacks continue to dominate industry losses, with the Kelp DAO and Drift Protocol incidents alone causing approximately $577 million in losses, accounting for 44% of the total losses in the first half of the year. Looking at the number of incidents, the impact of single attacks, and the changing attack patterns, the Web3 industry is facing more complex and continuously escalating security challenges.
CertiK warned that the decline in losses was primarily due to a single massive Bybit hack incident worth $1.4 billion during the same period last year; excluding this factor, attacks are becoming "more targeted and more destructive per incident," with private key and multi-signature wallet management remaining the most critical security risk exposures.