News linked to both this project and an event.
According to Odaily, digital hardware wallet manufacturer NGRAVE disclosed on October 19 that attackers hijacked a third-party notification service used by its LIQUID companion app and sent fake security alerts to users, resulting in approximately 70 wallet addresses being stolen for about $2.56 million across 4 blockchains. Among the losses, Bitcoin accounted for approximately $1.77 million, XRP approximately $454,000, Ethereum assets approximately $316,000, and Stellar approximately $18,000.The attackers lured users into clicking on counterfeit websites and entering their 24-word recovery phrases or Perfect Keys, after which automated scripts transferred the assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised, and that victims voluntarily handed over their recovery credentials during the phishing process.The unauthorized access may have begun on October 11. After obtaining one access key, the attackers acquired a key with broader permissions and sent fake notifications on October 17. NGRAVE detected the anomaly approximately 1 minute after the notifications appeared, but the first wallet had already been drained 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a crypto security company, and said that the affected keys have been replaced, with two-person approval, domain restrictions, and emergency shutdown mechanisms added. The company also reminded affected users to create new wallets and contact the support team, noting that some device information, wallet activity, IP addresses, and approximate locations may have been exposed. (Bitcoin.com News)
Odaily reports: Crypto researcher Stacy Muur has compiled a list of 82 digital asset projects and protocols said to have shut down in 2026, including Balancer, Radiant Capital, Neon EVM, Step Finance, and others, spanning DeFi, blockchain infrastructure, and Web3 gaming.The shutdowns were driven by declining revenue, exhausted funding, and security incidents. Earlier this year, Bitcoin's price briefly fell below $60,000, retreating from an all-time high of over $126,000 in October 2025, adding financial pressure on projects.When Ethereum Layer 2 network Blast announced its shutdown, it stated that the project had no "credible path to economic viability." Step Finance shut down following a major treasury exploit, while Radiant Capital announced the end of operations after failing to recover from a 2024 exploit.An August study by DeFiLlama showed that 100 crypto projects had announced shutdowns in 2026, 40 of which occurred in the preceding 90 days; the most common reason was product-market mismatch, followed by exhausted funding, insufficient revenue, and pivots to other products. The projects involved raised a combined total of approximately $1 billion and generated $250 million in cumulative fees, with 9 individual projects each raising over $50 million. (Cointelegraph)
Odaily Report: According to monitoring by on-chain analyst Yu Jin, the hacker who stole $285 million in assets from Drift Protocol in early April transferred 25,710 ETH, worth $61.24 million, through Tornado 3 hours ago. In early April, the hacker exchanged the stolen assets into 131,564 ETH at an average price of $2,154, and in July transferred 24,400 ETH through Tornado; the address currently still holds 81,454 ETH, worth $194 million.
According to Onchain Lens monitoring, the Drift Protocol attacker has become active again after 2 months, sending at least 13,400 ETH worth approximately $32 million to Tornado Cash, possibly to obscure the fund trail. The attacker still holds $225 million in assets across tracked wallets, including 93,965 ETH worth $224 million; 477,375 USDY worth approximately $549,000; and 1.33 SOL worth $138.
The Aztec Rollup attacker deposited 1,255.8 ETH, worth approximately $3 million, into Tornado Cash.
Vitalik Buterin (@VitalikButerin) stated that the ideal path for supporting various cryptographic algorithms lies in EIP-8288: users locally generate arbitrary signatures, produce STARK proofs, and submit them on-chain via a STARK aggregator. This avoids consuming calldata on-chain, so Ethereum no longer needs to add new precompiles. He also noted that if lattice cryptography (Lattice) is proven to be secure against AI attacks, it could still be utilized for accounts, wallets, and similar applications via precompiles in the future. Previously, Starknet co-founder Eli Ben-Sasson pushed back against related views from a16z, arguing that the rich mathematical structure of lattice cryptography makes it susceptible to AI attacks. Furthermore, the simplified variant based on Module SIS only emerged in 2012 and lacks sufficient maturity. He recommended waiting another three to five years until AI has thoroughly stress-tested these approaches before deploying them to custody large asset balances.
Odaily reports: Lending protocol Secured Finance has announced that it has completed its recovery and reopened on Ethereum, Arbitrum, and Filecoin. According to the official statement, users did not lose funds, assets have been replenished, and contracts, balances, positions, and order books have all been repaired and verified. Secured Finance's lending market suffered an attack on September 5, with losses of approximately $104,000.
According to CryptoSlate, Microsoft and the cybersecurity organization Health-ISAC have obtained a U.S. court order to seize and redirect the domains supporting three services: YAM Store, CoGUI, and Iron Man. These three services sell stolen accounts and phishing tools to fraudsters. Since January this year, they have assisted in sending over 1 billion phishing messages, targeting more than 75,000 institutions across over 150 countries, generating tens of millions of dollars in revenue for operators. Microsoft has disabled more than 20,000 accounts associated with YAM Store and continues to block over 100,000 spoofing and fraudulent domains. According to Microsoft's investigation, these services accept payments in USDT (Tron network) and ETH, with Cloudflare noting that buyers can also pay using USDC. Blockchain analytics firm TRM Labs assisted investigators in locating and freezing related assets, though the frozen amount was not disclosed.
According to PeckShield monitoring, the phishing attacker who previously stole $2 million in DAI from an address associated with Bofur Capital has converted all the stolen funds into 825.5 Ether (ETH).
According to on-chain investigator vxdb, the Gamdom platform was targeted in a security attack. Preliminary data indicates that attackers stole approximately $2.2 million worth of assets across EVM-compatible chains, including Ethereum, BSC, Polygon, Arbitrum, and Optimism. Additionally, the Solana network suffered losses of around $965,000, while the TRON and Bitcoin networks each lost approximately $375,000 and $668,000, respectively. The total value stolen across all chains now exceeds $4.2 million.
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
According to on-chain analyst PeckShield (@PeckShieldAlert), hackers illicitly minted 19 million $THEO tokens on the Base network, converted them into 700.8 ETH (approximately $1.76 million), and transferred the funds to the Ethereum network via a cross-chain bridge. As a result, the price of the $THEO token plummeted by 92% within 24 hours.
According to official announcements, Payy has initiated a claims process for affected users following the cross-chain bridge contract hack on September 24, with a 30-day window for claim submissions. Eligible claims will be compensated in USDC on the Ethereum network. Meanwhile, Payy Wallet is currently suspended and will be completely shut down after the claims period concludes.
Odaily News: According to Bitcoin News monitoring, the attacker behind the Ledger supply chain theft has moved nearly 3,000 ETH through Tornado Cash in three separate transactions, and transferred the funds into the Zcash privacy pool before converting them to USDC. Investigator @YFarmX stated that despite the use of privacy tools, they have traced 108 transactions completed through Zcash by exact value matching. An estimated $2.85 million in stolen USDC is still held in 3 wallets, and Circle may be able to freeze the related funds. Meanwhile, Tether is reported to have frozen $10 million in stolen USDT; wallets associated with the attacker still hold approximately $38.6 million in ETH and $16.9 million in BTC.
PaperTrade posted on X stating that trading volume in the first 6 hours after launch exceeded stock market trading volume; one day after launch, PaperTrade has become a trading platform supporting 1000x leverage, with liquidity pool (LP) size reaching $5 million and $25 million in rewards distributed to staking users.In response to community concerns about the fair launch mechanism and BTC/ETH market manipulation, PaperTrade stated that due to the need to prevent frontend congestion and spam request attacks, small orders cannot enjoy exactly the same priority as large orders, and the team has maximized fairness within these constraints. Some users exploiting the Hyperliquid BBO mechanism to manipulate BTC/ETH was not an oversight in mechanism design, but rather resulted from opening a higher OI cap during the initial launch period to alleviate queuing pressure. As traffic has declined, the team has begun tightening position limits at both the on-chain and relay levels to reduce the profit space for manipulation.PaperTrade added that no system can completely eliminate manipulation, and the goal is to make attacks nearly unprofitable through parameter adjustments, noting that in the relevant incidents, some users ultimately returned most of their profits to the platform due to persistent manipulation attempts.
Odaily reports: Hyperliquid News has disclosed that ETH's trading volume over the past 24 hours has surpassed BTC, reaching approximately $1.1 billion. Analysts suggest that this increase in ETH trading volume may be related to a recent incident in which PaperTrade was allegedly exploited through its mechanism, and the associated trading activity may have driven up demand for ETH in the market.Community user boblob previously disclosed that two wallets were suspected of actively "attacking" the PaperTrade platform, using trades worth approximately $20 million to briefly trigger a small fluctuation in ETH price on the Hyperliquid platform (about 10-20 basis points), and established a "9-figure" long position on PaperTrade. boblob further added that there are clear issues with the current protocol that need to be fixed as soon as possible, otherwise it could affect the protocol's long-term sustainability.Crypto trader Rune pointed out that PaperTrade's official documentation has in fact already disclosed that its pricing mechanism carries an "attack" risk, noting that the main risk at the protocol level lies in the use of Hyperliquid's order book BBO (Best Bid and Offer) for price manipulation. This risk involves unresolved price manipulation pathways, contract economic mechanisms and risk exposure control, as well as operational-level protective measures and permission management mechanisms.
Odaily reports: Crypto trader Rune stated on X platform that PaperTrade's official documentation has actually disclosed a "vulnerability" risk in the protocol-level pricing mechanism. According to the document screenshots he shared, attackers can exploit the BBO (Best Bid and Offer) of the Hyperliquid order book for price manipulation. This risk involves unresolved price manipulation paths, contract economic mechanisms and risk exposure controls, as well as operational-level protective measures and permission management mechanisms.Additionally, Rune retweeted a post by community user boblob, which revealed that two wallets were suspected of actively exploiting and "attacking" the PaperTrade platform, conducting trades worth approximately $20 million that briefly caused ETH price fluctuations of about 10-20 basis points on the Hyperliquid platform. boblob further added that the obvious issues currently present in the PaperTrade protocol need to be fixed as soon as possible, otherwise they may affect the protocol's long-term sustainability.
according to Lookonchain monitoring, an old wallet address had been operating securely for 8 years. After more than 4 years of dormancy, the address transferred funds to a new wallet one month ago, and subsequently CryptoBillis Ledger Drainer stole all 59 ETH from that wallet, worth $146,800.
据 Salus 监测，加密支付服务商 Triple-A 的攻击者已将 4,970 枚 ETH（价值约 1,240 万美元）转入混合清算工具 Tornado Cash。今年 7 月，该攻击者盗取了 Triple-A 自身财库的资产，公开估计损失约为 1,180 万美元。在将资金跨链桥接至以太坊网络并完成代币兑换后，攻击者于 9 月 6 日将资金分散至两个中间地址。10 月 9 日，攻击者通过单一钱包整合两笔资金流，并分批充值至 Tornado Cash，其中包括 49 笔 100 ETH 和 7 笔 10 ETH 的交易，其中部分资金来源于此前从混币器提取的款项。
according to on-chain analyst Yu Jin's monitoring, an address received 263 ETH from Tornado Cash yesterday, then swapped it for approximately 643,000 USDC and deposited it into Hyperliquid.The address opened a 40x leveraged cross-margin short position on 305.5 BTC, with a position size of approximately $25.38 million, an average entry price of $83,068, and a liquidation price of $84,088. The current unrealized profit is about $160,000. The source of the address's funds involves Tornado Cash, but it cannot yet be confirmed whether it is related to hacker activity.