News linked to both this project and an event.
Odaily reports: Israel's State Attorney's Office announced on Thursday that Israel has extradited Alexander Block, a dual Israeli-Russian national, to the United States. Block, whose original name is Alexander Gurevich, faces charges for allegedly stealing approximately $2.8 million from the crypto cross-chain bridge Nomad in 2022.U.S. prosecutors allege that Block, operating under the username "Bitlik," carried out six test transfers and four main transfers, moving tokens through multiple wallets and converting them into other cryptocurrencies to conceal their origin. His actions exposed a vulnerability in Nomad's smart contract, after which other users drained over $186 million from wallets controlled by the project.Israel's Supreme Court rejected Block's extradition appeal, ruling that even if the software permits the actions in question, exploiting a programming vulnerability can still constitute unauthorized computer intrusion; the court also noted that publicly visible on-chain transactions do not necessarily reveal the identity of wallet controllers, nor do they rule out attempts to conceal the source of funds. Supreme Court President Isaac Amit subsequently denied his request for a retrial. (Decrypt)
Odaily report: A wallet suspected to be associated with the Binance hack incident received tens of thousands of ETH through a Uniswap contract and borrowed 19,762 ETH on Aave using approximately $60 million in USDT as collateral. On-chain records do not show any vulnerabilities in Uniswap or Aave.As of 22:07 UTC, the two wallets held approximately 253,000 ETH, worth about $570 million, with no outgoing transfers recorded. Aave has paused the Ethereum mainnet V3 market, and Kamino has also paused borrowing in the SOL/BTC market; Ripple has frozen approximately $200 million in RLUSD, and more than $2 billion in USDT and USDC has been frozen by stablecoin issuers. (Decrypt)
According to Decrypt, Binance co-CEO He Yi stated that Ripple has frozen approximately $200 million in RLUSD; suspected hackers are converting freezeable stablecoins into ETH via Uniswap and Aave, while Kamino has suspended SOL/BTC market lending.
According to on-chain statistics cited by Decrypt, at least $5.57 billion in assets have been transferred from wallets associated with Binance, involving Ethereum, Bitcoin, and TRON; if confirmed as a hack, it would become the largest cryptocurrency heist in history. Binance stated that it is still investigating.
According to Decrypt, Polymarket has switched trading to cancel-only mode and paused relay operations due to a security incident, with multiple users reporting unauthorized asset transfers. The suspected attacker's address holds approximately $2.65 million in POL.
Odaily reports: Bitcoin hardware wallet manufacturer Keystone has stated that attackers obtained the permanent factory keys used to verify device authenticity. The company will destroy 18,835 unsold devices in its inventory and suspend all unshipped orders on its official website. The incident was discovered on October 20. Devices delivered before October 20 are not affected, and mnemonic phrases and private keys were not involved.The incident also affected 25,964 buyer records from Keystone's Shopify online store, involving names, contact information, shipping addresses, and order information between 2024 and 2026. A total of 51,083 records were previously involved, and 25,119 pieces of personal information have been deleted; customers who purchased through channels such as Amazon are not affected.Keystone stated that some records were not deleted within the originally planned 180-day period. The company has shortened the data retention period to 90 days and on October 24 requested that Shopify delete overdue data, which is expected to be completed on November 3. Official website sales will switch to pre-orders until devices using the new keys are produced; the company has submitted reports to relevant authorities in the EU, the UK, and other regions. (Decrypt)
Bitcoin software wallet Electrum released version 4.8.3 on October 24, fixing a critical vulnerability. Malicious servers could exploit this vulnerability to tamper with unconfirmed transactions and redirect user funds to attacker addresses; the vulnerability affects all versions prior to 4.8.3.Attackers could intercept payments broadcast by users through compromised servers and inject fake conflicting transactions displaying zero fees. If users increase the fee on a transaction that appears stuck, the newly signed and broadcast transaction could send funds to the attacker's address. At least one user reported losing funds as a result on October 18.This patch verifies the signatures of the wallet's own inputs before adding unconfirmed transactions to the local record; transactions from external senders whose inputs do not belong to the user's wallet are still not subject to signature verification. Electrum developer SomberNight stated that closing this gap will require additional work. (Decrypt)
Odaily Report: Three men in Bristol, UK, broke into a man's home in the early hours of May 15, assaulted the victim, and demanded he hand over a large amount of cryptocurrency. The victim sustained head injuries and was hospitalized for treatment; the three men were unsuccessful in their attempt.Terroll Paul, Mohamed Samagassi, and Pierre Madzou all pleaded guilty to aggravated burglary and were sentenced at Bristol Crown Court on October 15. Paul was sentenced to 6 years, Madzou to 5 and a half years, and Samagassi to 5 years; the victim's underage sister called the police, and the three were subsequently arrested at the scene.Police did not disclose the amount of cryptocurrency the three demanded. The case is a "wrench attack," in which criminals use violence or threats to force cryptocurrency holders to hand over digital assets; data from blockchain security firm CertiK shows that in the first six months of 2026, such attacks worldwide caused $124 million in losses, a 12-fold year-on-year increase. (Decrypt)
Odaily News: The Finance Committee of the French National Assembly has passed an amendment that would require the declaration of self-custodial wallet crypto assets valued at or above €100,000 (approximately $112,000) at year-end, with non-declarers facing fines of up to €10,000 (approximately $11,000). The rule has not yet become law and may still be subject to changes.Harry Halpin, CEO of privacy infrastructure company Nym, stated that French tax authorities are suspected of selling taxpayer data to criminals, and the new declaration requirement could threaten the safety of asset holders. Rand Hindi, founder of privacy protocol Zama, called on French crypto asset holders to leave France, and those unable to leave should hire security for their families.The proposal comes amid a series of crypto-related robberies, kidnappings, and "wrench attacks" that have occurred in France in recent years. The committee had also passed measures treating crypto-to-stablecoin conversions as taxable sales and expanding the scope of crypto exit taxes, but the budget revenue portion was subsequently rejected by a vote of 31 to 3, and the related amendments will need to be resubmitted. (Decrypt)
According to Decrypt, London police announced that 25-year-old Londoner Ajay Shinjin was sentenced to two and a half years in prison at Inner London Crown Court for his involvement in a "complex and meticulously planned" SIM card hijacking (SIM-swap) fraud that stole nearly £200,000 (approximately $265,000) worth of cryptocurrency. Shinjin previously pleaded guilty to charges including fraud by false representation and transferring criminal property.
According to Decrypt, Europol released a report on Wednesday stating that cryptocurrency wallets are the primary exposure points for quantum computing threats. Attackers can derive private keys from publicly exposed on-chain public keys and transfer assets, while underlying hash functions are largely quantum-resistant. The report notes that approximately 30.2% of BTC (6.04 million coins) public keys have already been exposed on-chain, recommending a phased industry transition to post-quantum cryptography, and calling for proactive preventive migration of related assets prior to an attack.
Odaily reports: Europol released two reports on Wednesday, urging organizations, policymakers, and the cryptocurrency industry to immediately prepare for the threat of quantum computing. Its European Cybercrime Centre noted that cryptocurrency wallet keys are the primary exposure point for quantum attacks, while the hash functions used to secure blockchains currently remain largely quantum-resistant.The reports state that a sufficiently capable quantum computer could derive private keys from exposed public keys, enabling attackers to transfer assets without authorization. Wallets whose public keys have already been exposed on-chain cannot be protected retroactively; holders need to migrate their assets to new wallets before an attack occurs.Glassnode estimated in May that 6.04 million BTC, representing 30.2% of the issued supply, have exposed public keys. The reports note that NIST-standardized post-quantum signatures are 10 to 120 times larger than the ECDSA signatures currently used by Bitcoin, and migrating all Bitcoin unspent transaction outputs would require at least 76 cumulative days of downtime.A second report published by Europol points out that commonly used protocols such as TLS, SSH, and OpenPGP face "harvest now, decrypt later" risks, but there is currently no clear evidence that this approach has been exploited at scale. The report argues that for payments, immediate interception within the brief window before transaction confirmation poses a more direct quantum risk than post-hoc decryption. (Decrypt)
Odaily reports: Cross-chain swap service Near Intents announced that the $3.8 million in funds stolen in a previous exploit has been fully returned, and the team has closed its investigation. Near Intents General Manager Alex Shevchenko had previously issued a 48-hour return deadline to the attacker, providing Bitcoin, BNB, Ethereum, and Solana addresses.The attacker acknowledged wrongdoing in an on-chain message, stating that all funds had been returned and urging others to report issues through the bug bounty program. The incident stemmed from a vulnerability in the interaction between its Omni deposit and withdrawal layer and the main smart contract. Near Intents had suspended services and promised full compensation to users. (Decrypt)
According to Decrypt, Spanish police arrested a 16-year-old Romanian suspect in Alicante for allegedly serving as an administrator and primary operator of the KillSec ransomware group. The operation is part of "Operation KillSwitch," with law enforcement agencies from across Europe taking control of five of the organization's core servers and its data leak site, and securing at least 110 TB of stolen data.
Odaily News: Spanish police have arrested a 16-year-old Romanian national in Alicante on suspicion of being the administrator and primary operator of the KillSec ransomware group. Europol stated that law enforcement agencies have seized control of the group's servers and leak site, and preserved at least 110 TB of stolen data.The operation involved searches at 8 residences across Spain, Greece, Romania, and the United Kingdom, investigating approximately 1,000 suspected attacks worldwide, of which about 500 have been confirmed successful. Two other suspects in their 20s were arrested in the UK and Romania respectively, while a Dutch national residing in the UK was indicted and arrested in Puerto Rico, awaiting extradition.KillSec has been active since around 2024, often demanding ransoms in cryptocurrency and carrying out double extortion through encrypted servers and threats to publish stolen data. Investigators are tracing the group's proceeds, including cryptocurrency; Europol's European Cybercrime Centre provided cryptocurrency tracing and digital forensics support. (Decrypt)
former UK National Crime Agency (NCA) officer Paul Chowles has been ordered by a court to forfeit £1,810,700, approximately $2.4 million, for stealing 50 bitcoins from a wallet seized during the Silk Road 2.0 investigation. The bitcoins were worth about $77,000 at the time of the theft in 2017.Of those, 30 bitcoins have been recovered, and the forfeiture order accounted for their current total value. Paul Chowles pleaded guilty in 2025 to theft, transfer, and concealment of criminal property, was sentenced to 5 years and 6 months in prison, and was dismissed by the NCA in July of the same year. (Decrypt)
Odaily News: North Korean hacker group WaterPlum obtained funds or credentials from over 7,000 crypto wallets through fake recruitment processes and transferred approximately $10.71 million to North Korea. Between December 2025 and July 2026, the group infected at least 30,000 devices across more than 100 countries.WaterPlum impersonates AI, crypto, or NFT companies and approaches developers through social media, job platforms, and freelance platforms, luring them into downloading malware-laden files under the guise of technical interviews or coding assignments. Targets include web designers, engineers, and professionals in the crypto, blockchain, and Web3 sectors.Japanese law enforcement dismantled a "laptop farm" within the country for the first time, discovering that hundreds of millions of yen in crypto assets had already been transferred overseas. Investigations suggest that WaterPlum and some North Korean remote IT workers both belong to the 313th General Bureau of North Korea's Ministry of Munitions Industry and share IP addresses used to access the laptop farm and job-seeking services. (Decrypt)
Odaily News: On September 21, a white hat actor transferred 40.71 BTC linked to the Coldcard vulnerability in a single transaction valued at approximately $3.31 million. The transaction consolidated funds from 11 addresses and included an OP_RETURN message pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, disclosed that the broader consolidation involved a total of 52.37 BTC across multiple clusters of attacker addresses, accounting for approximately 2.8% of the funds tied to the vulnerability. A firmware flaw in Coldcard devices dating back to March 2021 resulted in insufficient mnemonic seed randomness, with the total funds involved peaking at approximately $130 million. (Decrypt)
Visa is closing a checkout loophole supported by crypto payment infrastructure company Crossmint. The loophole previously allowed users purchasing Meme coins with credit cards to have transactions classified under a merchant category code intended for digital media such as e-books, movies, and music.Visa has notified payment processors, including Checkout.com, that it will no longer accept that code for Meme coin transactions, giving processors a grace period to stop the practice, which is expected to end next week. Thereafter, Meme coin purchases must be processed as cryptocurrency transactions and are subject to Visa's corresponding rules.Chase had disputed a Visa transaction that was not flagged as a cryptocurrency transaction, arguing that its merchant category code was incorrect and that it should not have earned credit card rewards. The New York State Attorney General's Office is also aware of and reviewing the matter. (Decrypt)
Odaily reports: Earlier this month, the verified Reddit account of streaming service HBO Max was hijacked by hackers, who deployed 108 malicious ads over approximately 48 hours, tricking Mac and Windows users into executing commands to install infostealer malware.The malware can steal browser credentials, Telegram data, Apple Notes, saved passwords, and crypto wallet recovery phrases, and may also alter wallet addresses in the clipboard. Reddit has suspended the relevant ads and launched a security investigation. The number of infections and crypto asset losses have not yet been confirmed. (Decrypt)