News linked to both this project and an event.
Odaily reports: On-chain monitoring shows that the total assets flowing out of Binance-labeled wallets amounted to approximately $5.643 billion. The breakdown includes: $3.528 billion on Ethereum, $1.449 billion on Bitcoin, $628 million on Tron, and $38 million combined across Arbitrum, Optimism, and Base networks. The tally excludes change outputs and avoids double-counting subsequent transfers and swaps. Tether and USDC issuer Circle have frozen at least $2.316 billion in stablecoins, including approximately $1.493 billion in USDT and $823 million in USDC.
A Binance spokesperson told Cointelegraph that it is investigating a potential security issue with an Ethereum wallet. The security team is reviewing related activities, and no impact on user funds has been confirmed at this time.
Odaily reports: According to zkLink monitoring, the attack on the Arbitrator contracts of zkLink Nova on Ethereum and Optimism is still ongoing, and the technical team is urgently responding to contain the losses. zkLink has called on the attackers to stop further exploiting the omnichain contracts and return the affected funds, stating that if the attackers cooperate in returning the funds, a 20% white-hat bounty will be offered and no further action will be pursued. Previously, SlowMist issued a security alert stating that the related losses amounted to approximately $783,100. The root cause of the attack points to the Arbitrator contract's claimMessage failing to clear the temporary finalizeMessageHash and failing to require each call to go through a new authentication callback; attackers can exploit the publicly callable authorized SyncL2TxHashRelayer to inject a forged batch root and withdraw assets.
the cloud desktop service of Japanese internet giant GMO Group suffered unauthorized access, with up to 26,739 servers potentially affected. In the ransom letter, hackers demanded payment in BTC and ETH, initially asking for $50 million, then reducing the demand to $1 million, while threatening to continue conducting anomalous transactions in compromised accounts and publicly disclosing user data. GMO Group representative Masatoshi Kumagai stated that the company refused to compromise and did not pay any funds; its crypto exchange GMO Coin confirmed that no abnormal operations were found in customer accounts. The hackers subsequently published some data and threatened to update it daily. The website domain hosting the leaked information was shut down in the early morning of October 28.
Initia officials stated that, with support from the Initia Foundation, the 1:1 asset backing for assets affected by the October 23 security incident will be fully restored when the chain resumes operations. The Initia Foundation has approved funding to cover the reserve shortfalls for Noble USDC, WETH, and AUSD0 used as collateral for iUSD, amounting to up to 1.08 million USDC, 105 ETH, and 1.4 million AUSD0, respectively. The specific amounts remain subject to verification and require final transfer approval.
According to Scam Sniffer monitoring, a suspected cryptocurrency theft incident has occurred: in under 4 hours, an attacker drained USDT, USDC, and ETH with a total value of approximately $1.2 million from over 100 wallets across Ethereum and BNB Chain, and has already converted all funds into ETH.
According to CoinDesk, Ethereum developers have fixed a bug in the upcoming Glamsterdam upgrade that could cause ETH deposited by staking services for new validators to be incorrectly credited to block builder accounts, giving operators the opportunity to withdraw the associated funds. The fix was merged into the Ethereum consensus specification on October 26, having previously been rejected on October 19 due to insufficient support from client teams.
Odaily Report: According to monitoring by on-chain analyst Ember, a hacker who stole approximately $40 million in assets from UXLINK last year opened a long position of 30,300 ETH on Hyperliquid at a price of $2,134, with a position value of $70.25 million and current unrealized profit of $5.62 million. The funding source address for the ETH long position has a direct fund intersection with a known UXLINK hacker address: one month ago, both addresses consolidated their remaining ETH Gas to the same wallet on the same day. In early August, after consolidating 11.54 million USDC from multiple channels, the hacker began trading ETH on Hyperliquid, opening positions 6 times in total, with 5 profitable trades and total profits of $5.71 million.
According to monitoring by Scam Sniffer, a user's assets on the Ethereum and Base networks were reportedly stolen due to a leaked private key, resulting in losses of approximately $1.58 million. The attacker drained 682 ETH in under two hours, with approximately 281 ETH subsequently transferred to Tornado Cash.
Odaily reports: At 2:39 AM EST on October 23, Swell announced the suspension of deposits and withdrawals for its liquid staking token swETH and restaking token rswETH until the net asset value (NAV) returns to correct levels, without disclosing a restoration timeline. On-chain data shows that at 16:48 that day, the contracts reported approximately 1.203 ETH per swETH and approximately 1.138 ETH per rswETH, roughly 6% and 5% higher than the normal exchange rates of 1.133 ETH and 1.082 ETH as determined by Spreek, respectively; rates on decentralized exchanges stood at approximately 1.089 WETH per swETH and 1.029 WETH per rswETH, both far below the contract-reported values. Spreek stated that at 21:28 on October 21, the admin keys of both tokens were suspected to have been compromised, with NAV being inflated by up to 1% per hour without asset backing; the attacker deployed 4 malicious upgrade contracts capable of withdrawing approximately 2,513 ETH, but the transactions were not queued through Swell's multisig. Odysseus, founder of Phylax Systems, said the incident involved BOT key misuse, and losses have not been confirmed. Railway disclosed the same day that an unauthorized third party may have read customers' encrypted environment variables. Swell stated that funds are safe.
According to Zon monitoring, available information indicates that this security incident may have originated from a Day 0 vulnerability in Initia's MoveVM built on Cosmos SDK. The vulnerability allowed attackers to mint additional tokens on Initia L1, but does not affect the native token INIT. Before the blockchain was halted, the attacker had already transferred out approximately $2.7 million worth of AUSD, ETH, and USDC through additional minting and cross-chain transfers. The team is still investigating, and the subsequent impact and further details remain to be confirmed.
据 Spreek 监测表示，Initia 链遭遇攻击，多个代币出现“无限增发”情况。攻击者目前已套现约 260 万美元，另有部分资金仍在转移过程中。攻击者以太坊地址（0xDD9 开头）目前持有约 1102 枚 ETH，价值约 265 万美元，该地址初始资金来自 Tornado Cash。此外，攻击者在 Initia 链上的地址仍持有约 454 万美元资产，包括 300 万枚 iUSD、92 万枚 USDC、40 万枚 AUSD 及 95 枚 ETH。目前 Initia 官方尚未回应。
On-chain analyst PeckShield (@PeckShieldAlert) has tracked an address flagged as the Cysic attacker depositing 300 ETH (approximately $721,140) and 30.4 BNB (approximately $22,590) into Tornado Cash. According to the Cysic Foundation, a security incident involving the Cysic cross-chain bridge occurred on October 17, during which the attacker minted 10 million CYS tokens without authorization on the BNB Chain.
Zipcoin has announced it is ceasing operations, stating that the project's codebase and related keys have been fully compromised, and attackers may control the project's wallets and infrastructure. The team noted that attempts to migrate the code and rotate credentials over the past 12 hours failed to identify a viable security solution. Zipcoin further disclosed that the project was impacted by the UNCX incident on October 15, during which hackers stole tokens from multiple Ethereum-based assets—including ZC, PAAL, and EDGEN—accounting for approximately 1.1% of their respective supplies, which were subsequently sold on open markets. The team had previously repurchased tokens from the market to offset the shortfall against future team commitment allocations.
according to Blockaid monitoring, the WAX multichain bridge on the WAX network is under attack, involving WAX, Solana, and Ethereum. The attacker withdrew mapped tokens on the WAX chain without paying the corresponding assets, while the bridge contracts on Solana and Ethereum still released the corresponding tokens. The attacker transferred approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC through 5 transactions. The scope of the incident's impact and whether losses are still expanding remain to be further confirmed.
The Cysic Foundation has issued a notice to the parties responsible for the unauthorized issuance of the CYS token, demanding the return of 275.872 ETH within 72 hours, which accounts for approximately 90% of the confirmed related proceeds. As a bounty for asset recovery, the party may retain the remaining approximately 30.652 ETH. The foundation stated that it has reconstructed key stages of the attack and preserved relevant technical and on-chain evidence; if payment is not received within the deadline, it will escalate the matter and cooperate with law enforcement to launch a criminal investigation.
According to security researcher Spreek (@spreekaway), the administrative keys for swETH and rswETH under Swell DAO appear to have been compromised. Attackers are inflating the NAV (Net Asset Value) without asset backing by up to 1% per hour. Four malicious upgrade contracts have been deployed and are queued for multisig execution; if executed, they could result in the theft of approximately 2,500 ETH. Furthermore, analysis by ADL (@ADLXBT) indicates that the management keys control proxy administrator permissions. Once seized by attackers, these keys could allow the redirection of swETH/rswETH proxies to malicious implementation contracts, triggering minting or withdrawal functions to artificially inflate the NAV without corresponding asset backing. Spreek noted that any connection between this incident and the Railway platform remains speculative, with only a coincidental timeline observed and no concrete evidence available. The incident report he published was generated by Claude, and certain portions remain unverified.
According to Lookonchain monitoring, the Drift Protocol attacker who stole over $270 million has once again deposited 24,885 ETH, worth $61.3 million, into Tornado Cash, and currently still holds 56,569 ETH, worth $139.3 million.
According to monitoring by PeckShieldAlert, the address labeled as Drift Exploiter 1 is depositing a new batch of stolen funds into Tornado Cash. To date, it has cumulatively transferred in approximately 18,800 ETH, worth around $46 million.
According to on-chain investigator ZachXBT (@zachxbt), an institutional entity was reportedly targeted by a DPRK-linked group, SquidSquad, on BSC on October 8, with approximately $2.84 million stolen. On October 20, the attacker deposited 1111.2 ETH into Tornado Cash and withdrew the funds to three addresses: 0xb8b25f535a6e51d0b18c48941d791c7e83559d2b, 0x35c72e26f6888b4cba8668c6cfa4143599680bfe, and 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848. Subsequently, the funds were bridged cross-chain via USDT0 from Ethereum to Tron and consolidated into TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux. Both consolidation addresses are linked to previously identified DPRK-affiliated addresses.