News linked to both this project and an event.
According to on-chain analyst Onchain Lens (@OnchainLens), the hacker associated with the $90 million Ledger reseller incident has cumulatively deposited approximately $270,300 into Binance, including 256.57K USDT and 41.12K TRX (about $13,700), with the majority of funds already transferred to Binance's hot wallet. Previously, the hacker also used four wallets to deposit 430.2 ETH (approximately $1.07 million) into Tornado Cash for mixing, and converted USDT to USDD to evade Tether's fund freeze.
According to monitoring by Galaxy's head of research, in the Ledger CryptoBillis attack incident, approximately $72.9 million remains in addresses controlled by the attacker, involving Bitcoin, Ethereum, and USDT; $3.1 million entered Tornado Cash, while the remaining funds have been bridged across chains, swapped, or layered and transferred through relayers.
According to Onchain Lens monitoring, the suspected hacker behind the reported $90 million Ledger reseller incident has deposited 430.2 ETH, worth $1.07 million, into Tornado Cash through 4 wallets. After Tether froze the related funds, the hacker swapped USDT for USDD through SUN.io and USDD's PSM, with some funds also flowing into Binance hot wallets.The hacker's wallet tracked by Arkham currently holds a total of $70.6 million in assets, including 11,406 ETH worth $28.35 million; 213.371 BTC worth $17.65 million; 13.646 million USDD worth $13.65 million; and 10.909 million USDT worth $10.91 million. Onchain Lens is calling on Binance to investigate these transfers and freeze accounts associated with the stolen funds as soon as possible.
Ledger Support posted on X platform stating that it is currently investigating a theft of assets involving Southeast Asian users, who had purchased devices through reseller CryptoBilis. Ledger has asked CryptoBilis to suspend sales and shipments, and recommends that users who purchased devices through this reseller within the past 90 days refrain from initializing their devices; users who have already completed setup should create a new Ledger signing device using a new mnemonic phrase and transfer their assets to a new wallet.On-chain investigator Specter previously estimated that this incident has led to the theft of hundreds of wallets across Bitcoin, Ethereum, and Tron networks, with losses exceeding $86 million. Security researcher tanuki42 previously estimated losses had exceeded $72 million and stated that the amount is still increasing. Currently, the specific cause of the incident and whether the affected devices have security vulnerabilities remain to be investigated and confirmed.
Odaily News: Dragonfly Managing Partner Haseeb Qureshi stated that the "bunker mode" proposed by Ethereum researcher Justin Drake to address the risk of AI cracking cryptographic signatures amounts to "cryptographic doomerism," and argued that migrating tokens to new addresses is not a real solution.Qureshi said that "bunker mode" can only protect assets that users have not yet transferred out of new addresses. If tokens in other addresses are attacked and heavily sold off, those assets could still lose value. He suggested that blockchain networks adopt a "Cryptographic Recovery Mode," using hash-based backup signature schemes that allow users to bind recovery mechanisms in advance, so that validators can assist in recovering assets after cryptographic signatures are cracked.Previously, Ethereum researcher Justin Drake warned that with the rapid improvement of AI mathematical capabilities, the ECDSA signature algorithm protecting crypto wallets could face the risk of being cracked within "months rather than years," and advised users to gradually migrate funds to new wallets that have not exposed public keys. Glassnode data shows that approximately 6.26 million BTC are currently held in addresses with potential risk. (Cointelegraph)
According to Lookonchain monitoring, a wallet (0xf15d...bddf) suspected to belong to a gambler or hacker sold 262.78 ETH 40 minutes ago, obtained $643,000 USDC and deposited it into Hyperliquid, then opened a 40x leveraged short position on 305.51 BTC, with a notional value of $25.4 million and a liquidation price of $84,086.03.
Odaily News: According to on-chain detective Specter, multiple reports of Ledger user wallet thefts have appeared on X and Reddit. After tracing the theft addresses, it was found that the related addresses received inflows of funds from hundreds of victim wallets across multiple major blockchains including Ethereum, TRON, and Bitcoin, with total losses exceeding $86 million. The related addresses include: bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl, TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C, TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9, TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW, 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841, 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a, 0x83aeac166f6832ae3500000a24510a95a052a599, bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9, bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n, TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a.
Anthropic 推出基于 Claude Mythos 等最强模型的 AI 安全扫描服务，提供开源项目漏洞报告。包括 Ethereum 开发者 Nethermind 和 Bitcoin 钱包 ZEUS 在内的多家加密公司申请接入该服务。
Odaily News: As the crypto industry discusses whether users need to enter "bunker mode" before AI or quantum computing technologies expose wallet private keys, custody institutions face a more complex challenge: how to upgrade key management, approval, and audit systems before an emergency migration occurs.Project Eleven CEO Alex Pruden stated that institutions have already begun preparing for post-quantum migration outside of blockchain, and different blockchains may adopt different quantum-resistant signature schemes and migration paths in the future. Institutions holding multiple types of assets will face the challenge of simultaneously adapting to multiple cryptographic systems.Quantus co-founder and CEO Christopher Smith stated that AI is accelerating the development of quantum hardware and software, and the tail risk of quantum attacks should be incorporated into portfolio decisions — this is an institutional fiduciary duty.Currently, the timeline for quantum computers to crack Bitcoin and Ethereum's existing public-key cryptographic systems remains uncertain, but the industry is gradually viewing the coming years as a window for establishing migration plans, rather than waiting for an attack to occur before responding reactively. (CoinDesk)
Odaily News: Lido is developing a decentralized lending market called Lido Lend, which is built on a modified fork of Morpho Blue, adopts an isolated lending market design, is proposed to be governed by Lido DAO, and is pending a governance vote for approval. Lido Lend is limited to blue-chip assets, encourages price-correlated trading pairs such as stETH/ETH, and provides a deposit screening mechanism to guard against bad collateral. Lido stated that Lido Lend is not a general-purpose pool-based lending solution but is aimed at professional borrowers and risk-averse lenders; currently, stETH staking scale exceeds $25 billion, with no major security incidents since launch.
Odaily News: Analysis by security firm CertiK shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker draining 200 ETH worth over $500,000. According to CertiK, the root cause is a lack of access control in the 0x8804d1de function within the keeper implementation contract. This contract was involved in the March 2020 "Black Thursday" liquidation crisis, where it won ETH at zero bids. Four lots of 50 ETH each were never settled, and the attacker used this to drain the funds, transferring them out via Tornado Cash in batches of 10 ETH each. This contract is not part of the current Sky ecosystem core, but old contracts still holding funds may remain potential attack targets.
Ethereum co-founder Vitalik Buterin warned in a post that AI-accelerated mathematical research could pose a severe threat to existing cryptographic systems within the next two years, particularly lattice-based cryptography (Lattices), ML-DSA, and FHE schemes, with ECDSA also facing a heightened risk of being compromised sooner than anticipated. Vitalik noted that AI could replicate breakthroughs akin to the transition from naive factorization to the Number Field Sieve, substantially undermining the security of lattice-based cryptography. In such a scenario, hash-based schemes would comprehensively outperform lattice-based ones in efficiency. The Ethereum Lean Roadmap is already progressing toward a "pure-hash" approach, employing signature schemes like WOTS or SPHINCS+ without incorporating any lattice-based components. From a personal standpoint, Vitalik offers the following recommendations: • Prioritize hash-based schemes, replacing lattice cryptography in feasible scenarios • Conservatively estimate lattice parameter sizes, with a recommendation to increase key sizes by a factor of 10 • Ensure privacy protocols avoid posting encrypted data on-chain, opting instead for off-chain transmission through third parties • Utilize offline confirmation for multi-signature wallets to prevent signatures from being publicly exposed • It is acceptable to retain funds in "fresh addresses" that have never initiated a transaction; however, address migration must be handled with extreme care, as losses resulting from operational errors may far exceed those caused by hacker breaches.
Odaily News — According to on-chain analyst Yu Jin's monitoring, trader @frogmanhaha's wallet (0x14...5794, 9wMS...ov8z) was suspected of being hacked approximately 5 hours ago, with 9 types of assets worth about $4 million transferred, sold, and swapped into ETH, BNB, and SOL, then dispersed through tools such as Privacy Cash and Chainflip. The stolen assets mainly include 1.43 million BP, worth approximately $1.77 million; 13.96 million MarsCoin, worth approximately $1.55 million; and 3.7 million Cash Cat, worth approximately $510,000.
a new address funded via Tornado Cash extracted 200 WETH on October 6 from a dormant MakerDAO ETH-A liquidation bot proxy, causing losses of approximately $538,000. The upgradeable proxy had won 4 ETH-A liquidation auctions in 2020, namely auctions #1457 through #1460, earning 50 WETH each, but never called deal(), leaving the collateral stuck in the Flipper. The implementation contract's exit function was not protected by ds-auth, allowing any caller to trigger it: first calling deal() on the aforementioned old auctions, then transferring the collateral to the keeper via Vat.flux, and subsequently calling GemJoin.exit to send the 200 WETH to a caller-specified address and unwrap it into ETH. The MakerDAO core contracts operated as designed; the vulnerability lies in the third-party bot's exit function lacking access controls.
Odaily News: On-chain detective ZachXBT posted on X that he once posed as a client to infiltrate a criminal group suspected of laundering money for the North Korea-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack.ZachXBT stated that after Bybit suffered a $1.5 billion attack in February 2025, he discovered that more than 15 accounts in public Telegram and Discord groups were seeking help processing transactions related to the stolen funds. He subsequently contacted one of the Telegram users using the alias "Jimmy Green" and built trust through multiple transactions. According to his disclosure, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address for a USDC-to-TRON-chain USDT exchange transaction with the counterparty. The source of gas funds for that address can be traced back to the Bybit attack funds and was publicly flagged as a Bybit attack blacklisted address.ZachXBT said that in subsequent communications, the counterparty revealed that their team had been involved in processing the stolen Bybit funds and disclosed in advance that the funds would be moved across chains including Solana. By matching transaction timing, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in Bybit attack funds, with fund paths spanning multiple networks including BTC→ETH→SOL→TRON. Approximately 442,000 USDT was frozen by Tether, and the group also attempted to launder money through Uniswap liquidity pools and low-liquidity tokens. Additionally, the counterparty disclosed having helped other clients process approximately $3 million in fraudulent proceeds, and ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee.ZachXBT revealed that in this investigation, he initially invested $3.497 million and bore a loss risk of approximately 5% per transaction. The intelligence ultimately obtained was provided to relevant investigative agencies and law enforcement authorities at the earliest opportunity. Since 2022, he has assisted in freezing over $75 million in funds related to North Korea-linked incidents.
victims of the Drift hack, a perpetual contract exchange on Solana, began filing claims on October 1. The recovery pool's initial funding stands at approximately $3.11 million against nearly $295.4 million in verified losses. Victims can redeem USDT through DFX tokens, with each $1 of loss converting to roughly 1.04 cents at launch, meaning a $1,000 loss corresponds to about $10.40.The total supply of DFX is fixed at 299,500,810.998 tokens, with each token corresponding to $1 of verified loss from the April incident, and no additional tokens will be minted. Holders can choose to burn DFX to redeem USDT, sell on secondary markets such as Raydium, or continue holding their claims. Completed redemptions are irreversible, and unclaimed tokens will expire after the claims window closes on January 1, 2028.Future funding for the recovery pool includes a portion of daily net protocol revenue from Velocity, the rebranded exchange rebuilt by Drift, up to $127.5 million in USDT committed by Tether, $20 million in USDT committed by strategic partners, and recovered stolen assets. On the first Friday after claims opened, approximately 216,480 DFX tokens were redeemed for about 2,250 USDT, with Velocity's first revenue transfer amounting to 31 USDT; approximately 13,025.9 ETH is spread across 4 Ethereum wallets, another approximately 2,309.4 ETH passed through Tornado Cash, and about $9.2 million in assets have been frozen at other addresses. (Bitcoin.com News)
Odaily reports: Cross-chain swap service Near Intents announced that the $3.8 million in funds stolen in a previous exploit has been fully returned, and the team has closed its investigation. Near Intents General Manager Alex Shevchenko had previously issued a 48-hour return deadline to the attacker, providing Bitcoin, BNB, Ethereum, and Solana addresses.The attacker acknowledged wrongdoing in an on-chain message, stating that all funds had been returned and urging others to report issues through the bug bounty program. The incident stemmed from a vulnerability in the interaction between its Omni deposit and withdrawal layer and the main smart contract. Near Intents had suspended services and promised full compensation to users. (Decrypt)
according to monitoring by Stani Kulechov, Aave founder Stani Kulechov stated that what was exploited was a third-party external adapter built on top of Aave v3, and the Aave v3 contracts themselves were not affected. The FlashLoopAdapter in the Aave v3 Loop Safe module involved had access control vulnerabilities in its open() and close() functions. The attacker forged Safe authentication and arbitrary module execution to steal approximately 114.09 ETH from two Safe multisig addresses, and repaid approximately 1,300 WETH in debt to unlock collateral.
SlowMist has issued a security alert stating that a vulnerability has been discovered in the Aave V3 Loop Safe Module. Attackers exploited forged Safe authentication and arbitrary Module execution to steal approximately 114.09 ETH from two Safe multisig wallets.The attackers bypassed authentication by forging a Safe that always returns true, and leveraged an arbitrarily controllable router and calldata to execute module transactions, transferring weETH and Aave collateral. The attackers repaid approximately 1,300 WETH in debt to unlock the collateral.
Ethena founder Guy Young stated that USDe backing assets currently have no direct exposure to stETH or other liquid staking tokens, and he expects this incident will not impact Ethena.