News linked to both this project and an event.
Bithumb stated that on October 27, its internal mobile collaboration system, DaouOffice, was subjected to unauthorized external access, resulting in the theft of some customer and employee personal information. The incident involved 6,444 customers, among whom the data for 5,600 individuals was encrypted and unreadable, while an additional 844 customers were confirmed to have had their personal information compromised. Furthermore, the information of 715 employees and partner personnel was also affected.
According to security researcher Spreek (@spreekaway), the administrative keys for swETH and rswETH under Swell DAO appear to have been compromised. Attackers are inflating the NAV (Net Asset Value) without asset backing by up to 1% per hour. Four malicious upgrade contracts have been deployed and are queued for multisig execution; if executed, they could result in the theft of approximately 2,500 ETH. Furthermore, analysis by ADL (@ADLXBT) indicates that the management keys control proxy administrator permissions. Once seized by attackers, these keys could allow the redirection of swETH/rswETH proxies to malicious implementation contracts, triggering minting or withdrawal functions to artificially inflate the NAV without corresponding asset backing. Spreek noted that any connection between this incident and the Railway platform remains speculative, with only a coincidental timeline observed and no concrete evidence available. The incident report he published was generated by Claude, and certain portions remain unverified.
Vitalik Buterin (@VitalikButerin) stated that the ideal path for supporting various cryptographic algorithms lies in EIP-8288: users locally generate arbitrary signatures, produce STARK proofs, and submit them on-chain via a STARK aggregator. This avoids consuming calldata on-chain, so Ethereum no longer needs to add new precompiles. He also noted that if lattice cryptography (Lattice) is proven to be secure against AI attacks, it could still be utilized for accounts, wallets, and similar applications via precompiles in the future. Previously, Starknet co-founder Eli Ben-Sasson pushed back against related views from a16z, arguing that the rich mathematical structure of lattice cryptography makes it susceptible to AI attacks. Furthermore, the simplified variant based on Module SIS only emerged in 2012 and lacks sufficient maturity. He recommended waiting another three to five years until AI has thoroughly stress-tested these approaches before deploying them to custody large asset balances.
Former Mt. Gox CEO Mark Karpelès (@MagicalTux) posted that Ledger Support (@Ledger_Support) stated on August 20 that the Secure Element chip can detect physical tampering; if extra hardware intercepts signals, the device will refuse to execute unsigned code or fail the Genuine Check. Karpelès pointed out that Ledger's own technical documentation explicitly states: if the original Secure Element is intact, the Genuine Check cannot detect unauthorized physical hardware modifications such as spy implants. The two statements contradict each other. He also noted that recent reports show over $90 million in assets were stolen precisely through this method of "extra hardware intercepting signals." Furthermore, in a March 2026 Ledger Academy article, Ledger had already published photos of spy implants installed inside multiple Ledger devices, including mass-produced complex PCBs, indicating they were long aware of this threat. Karpelès believes this conduct constitutes misleading promotion and cited that French law has specific regulations regarding misleading advertising.
OneKey founder Yishi posted on X platform that in response to recent incidents where Ledger hardware wallets purchased by some users through CryptoBilis were found to have unauthorized hardware implanted, leading to asset theft, OneKey has not yet received any reports of its own users experiencing asset theft as a result. However, out of security concerns, OneKey has terminated CryptoBilis's authorized dealer status.OneKey also announced that it will immediately stop accepting new dealers and will re-conduct qualification reviews for all existing authorized dealers. Additionally, for users who purchased OneKey hardware wallets through CryptoBilis between March 1, 2026 and the date of this statement, regardless of device model or usage status, they may apply for a free replacement. The application deadline is December 31, 2026.Furthermore, Yishi advised users who have already used the affected devices to treat their original seed phrases as potentially compromised and to transfer their assets to wallets using new seed phrases as soon as possible, without waiting for replacement devices to arrive.
Odaily News: The XRP Ledger Foundation posted on the X platform to clarify the recent XRP Ledger security vulnerability incident, stating that the vulnerability could potentially have been used to bypass the limit that fixes XRP's total supply at 100 billion, but it was fixed two weeks ago via version 3.4.1. Furthermore, upon verification, no new XRP was found to have been created, and the total amount of XRP currently circulating on the ledger is approximately 99.986 billion.The Foundation stated that the vulnerability would have required hundreds of deliberately constructed operations to trigger, and normal payment transactions would almost never involve it. In the future, it will strengthen formal verification, AI adversarial testing, security research collaboration, and bug bounty programs with RippleX and the community. Regarding the fix process, the Foundation explained that publicly releasing a patch could allow attackers to use AI to accelerate vulnerability analysis. To address this situation, the XRPL community engaged in coordination. Participating parties including the XRP Ledger Foundation, RippleX, core developers, and validators reached a social consensus and agreed to adopt the approach of directly releasing the fix. In addition, version 3.4.1 only became a version the network was required to adopt after going through the normal amendment voting process and receiving support from more than 80% of validators for two consecutive weeks. Protocol changes still need to be completed through the amendment mechanism.Previously, RippleX engineering lead J. Ayo Akinyele also posted on the X platform, stating that he attaches great importance to the recently disclosed critical vulnerability in the XRP Ledger (XRPL) payment engine. This vulnerability is a serious security issue that has existed in the codebase for more than 10 years and could theoretically lead to the over-creation of XRP, breaking through the fixed supply cap. However, before the vulnerability could be exploited, it was discovered by the security research firm Veria AI through Ripple's bug bounty program.
According to a post by user @shuangfei8, their MEXC account was compromised on September 25 when attackers used forged identification documents to complete a security reset and breach the account within 10 minutes. Although MEXC subsequently froze the account and assisted in its recovery, it failed to revoke the API key created by the attacker during the period of unauthorized control. At 04:12 on September 27, merely 27 minutes after the 24-hour withdrawal restriction was lifted, the attacker exploited this residual API to bypass Google verification and email verification, draining 322,110 USDT and 9,133,999 ONE (totaling approximately $340,000) from the account across six separate transactions. The user has submitted a formal compensation claim to MEXC and attempted to report the incident to the police, demanding that the platform preserve logs, provide a written response regarding the security vulnerability, and return the stolen assets. Furthermore, multiple MEXC users have recently reported receiving suspicious emails resembling a "request to reset security settings," prompting users to immediately navigate to 【API Management】 to check for any unknown API keys.
Yi Lihua, founder of LD Capital, stated that over the past decade-plus, the crypto industry has gradually formed a "small world." However, in recent years, industry attention has increasingly been captured by negative content such as smear articles, traffic competition, personal attacks, and fabricated narratives, which has inevitably impacted the sector's reputation. He believes the industry should refocus its attention on innovation and opportunities themselves, stating that "a new bull market is approaching." On-chain finance, particularly on-chain stocks, is unlocking new avenues for imagination, with substantial meaningful developments and wealth-creation opportunities still ahead. Furthermore, compared to the crypto industry, the significantly larger AI sector is equally worth exploring.
according to official sources, OKX, in collaboration with Elliptic, SlowMist, and OttoSec, has released the "H1 2026 Web3 Security and Risk Control Report." The report indicates that the focus of Web3 attacks is shifting from smart contract code to more complex scenarios such as signature processes, user devices, operational infrastructure, and AI Agents.Data shows that in the first half of 2026, OKX's risk control system intercepted over 5.7 million high-risk transactions, including approximately 2.41 million related to hacking and theft, about 1.48 million phishing-related transactions, and roughly 990,000 fraud-related transactions. OKX Web3's on-chain intelligence label library now boasts over 1.1 billion labels, covering more than 420 chains. It has also integrated capabilities such as address screening, transaction monitoring, and sanctioned address control into infrastructure like DEX and Exchange OS.Furthermore, in terms of user protection, OKX has intercepted over 7 million risky website visits, completed more than 200,000 device risk detections, identified over 60,000 high-risk Apps, and blocked or alerted on over 4 million high-risk signature operations. The report also introduces the "proactive risk control" design in scenarios such as Exchange OS, Outcomes, RWA, and Agentic Wallet.
Odaily Odaily News, July 22nd - Web3 security firm CertiK released its "H1 2026 Wrench Attack Report." The report indicates that a total of 52 publicly verified wrench attacks were recorded globally in the first half of 2026, a year-over-year increase of 33.3%; related losses amounted to approximately $124 million, an increase of about 11.8 times compared to the same period last year.The report notes that attackers are shifting from exploiting technical vulnerabilities to targeting asset holders and their real-world social networks. Home invasion incidents increased from 1 case in H1 2025 to 20 cases, accounting for 41% of the total incidents in the period. Europe has become a high-incidence area for attacks, with 33 cases occurring in France alone, representing 63.5% of the global total.CertiK stated that as real-world risks become a significant challenge for digital asset security, enterprises and high-net-worth individuals need to establish more comprehensive protection systems. CertiK has launched operational security services to help identify exposure risks related to identity, family, residence, and travel routes. Simultaneously, through the CertiK Security Workspace, it correlates off-chain intelligence, on-chain transactions, and AML risk signals to support institutions in tracking and analyzing cybercrime activities. Furthermore, CertiK is strengthening cooperation with international law enforcement agencies such as Interpol and Europol, providing technical support for cross-border attack investigations and security policy research.
Odaily Odaily A new study by the Cambridge Centre for Alternative Finance reveals that approximately 31% of Ethereum node activity is located in the United States, with another 39% distributed across EU countries excluding the UK, indicating that the geographic distribution of Ethereum nodes remains relatively concentrated in Western nations.Lead researcher Alexander Neumuller stated that while node distribution is not currently concentrated in any single country, it is heavily reliant on a few major cloud service providers, including Hetzner, Amazon AWS, and OVH. Notably, the Ethereum network does not require half of its validators to fail for problems to arise. If more than one-third of validators go offline simultaneously, the network may be unable to finalize block checkpoints (finalization). Neumuller pointed out that nodes and validators do not have a one-to-one correspondence; a single node may run multiple validators. Therefore, it is currently impossible to precisely assess the actual impact on the validator network from the failure of a specific node or service provider.Furthermore, the study reassessed the energy consumption of Ethereum following The Merge. Data shows that Ethereum's current annual energy consumption is approximately 7.9 GWh, equivalent to a continuous power draw of about 1 MW. This represents only about 0.02% of pre-merge levels, a reduction of approximately 99.98%. Currently, over 56% of the energy used by the Ethereum network comes from sustainable sources, exceeding the global average.The study also noted that client software diversity is another potential risk. If a dominant client software has a vulnerability, it could affect a large number of network participants. The report was published by the Cambridge Centre for Alternative Finance and supported by the Ethereum Foundation. (The)
an Immunefi report shows that in the first half of 2026, crypto projects suffered cumulative losses of approximately $972 million from 207 hacker attacks. The number of attacks reached a record high, but total losses remained under $1 billion and were less than half the scale of losses in the first half of 2025. The report notes that DeFi attack losses have dropped by 74% from their peak of $2.62 billion in 2022, falling to approximately $680.3 million, with the median single-loss amount declining by 75% over the same period. Furthermore, the source of risk is shifting from purely smart contract vulnerabilities towards infrastructure failures, private key leaks, cross-chain configuration errors, and weaknesses in privileged access.
Odaily, Web3 security firm CertiK has released the "Hack3D: First Half of 2026 Report." The report shows that the Web3 ecosystem experienced 344 security incidents in the first half of 2026, with cumulative losses of approximately $1.32 billion. Although this figure represents a 46.8% decrease compared to the same period last year, excluding the impact of the $1.45 billion security incident involving Bybit, the scale of losses in the first half of this year actually increased by approximately 28% year-on-year, indicating that the overall security environment in the industry has not materially improved.The report points out that wallet theft has become the attack type causing the greatest financial loss, accounting for approximately $450 million in losses in the first half of the year. Meanwhile, although the number of phishing attacks fell by more than 50% year-on-year, the loss amount only decreased by approximately 10.8%, reflecting that attackers are shifting towards high-net-worth individuals and institutional targets, carrying out more targeted high-value attacks.Furthermore, code vulnerabilities remain the most frequent type of attack, with 204 related incidents. CertiK believes that attackers are increasingly targeting long-running legacy smart contracts that lack re-audits. The report also shows that mega-attacks continue to dominate industry losses, with the Kelp DAO and Drift Protocol incidents alone causing approximately $577 million in losses, accounting for 44% of the total losses in the first half of the year. Looking at the number of incidents, the impact of single attacks, and the changing attack patterns, the Web3 industry is facing more complex and continuously escalating security challenges.
: Cardano wallet service provider SecondFi has released an update on the security incident recovery progress, stating that EMURGO has established an asset recovery fund to return assets to users affected by the attack.SecondFi stated that emergency measures have been taken to protect and restore access to some assets. The team is currently discussing appropriate custody mechanisms with Intersect to ensure the safe return of assets to users.Furthermore, SecondFi is collaborating with a Cardano community-led working group to advance the on-chain recovery plan. Due to the recovery plan being more complex than initially expected, the overall recovery time may exceed the previously estimated two weeks.
Odaily Odaily News Blockchain analyst Vadim noted that Base experienced a network outage today due to a consensus bug triggered by a single invalid block. All block generation after height 47806542 ceased, halting the network for nearly two hours. Since Base utilizes a single sequencer architecture, when that node encountered an error, the entire network stopped running, with no backup block producer or other validator nodes available to bypass the fault and maintain on-chain activity. During the outage, users were unable to conduct transactions, perform liquidations, or process withdrawals.Furthermore, the network recovery process was not automated; node operators within the ecosystem had to manually restart for block synchronization to gradually resume. This is not the first such incident for Base. In August of last year, the network also experienced a freeze lasting approximately 33 minutes due to a sequencer switching failure. The single sequencer model exposes the centralization risks in some current L2 networks: while offering higher speed, the entire chain can come to a halt due to a single point of failure when the core component malfunctions.
Ethereum Layer 2 project Taiko has released the latest update on a security incident, stating that this incident will not result in any user fund losses. Currently, bridged assets are under-collateralized, and the team will complete supplementary collateral for all assets before reopening the bridge, ensuring that each user's balance is supported on a 1:1 basis, identical to the state before the incident. Since the security incident occurred, cautious measures have been taken, including controlling the scope of impact, determining the root cause, and collaborating with the board to develop a plan to protect user assets.Furthermore, the CEO of Taiko has submitted a formal report to relevant authorities in Singapore, and the team will fully cooperate in tracing the responsible parties. Users are currently not required to take any action. The completed fix is now being tested, and Taiko will reopen the chain and bridge services as soon as it is deemed safe. Meanwhile, users are reminded to be vigilant against scams. The Taiko team will not proactively message users, and there are no claim or refund websites. Any links offering such services are fraudulent.
: Cross-chain protocol Axelar Network has issued a statement regarding the recent security incident related to Secret Network, clarifying that there is a misunderstanding within the community. Neither Axelar nor the Inter-Blockchain Communication Protocol (IBC) was attacked or compromised. The affected token smart contract was not developed, deployed, or maintained by Axelar. Furthermore, Axelar's firewall mechanism prevented the impact from spreading to other chains.It is reported that the exploited contract was a fork based on the CW20-ICS20 implementation, but the developers removed two core security checks, leading to an "infinite mint" vulnerability. By deleting the verification mechanisms originally designed to prevent such issues, this fork altered the contract's original trust model and was not subjected to a new security audit.Axelar Network explained that anyone can deploy contracts via IBC for wrapping cross-chain assets, and similar contracts are used to wrap tokens from other chains onto Secret Network. However, the specific fork on the Secret side in this incident contained a vulnerability due to the removal of critical security checks. This incident was not caused by an inherent logic flaw or an issue with the IBC protocol itself, but rather a security risk introduced by modifications made to the third-party contract.
SUPERFORTUNE AI posted on X platform, stating that the team is investigating a GUA security incident that occurred on May 27. The incident led to drastic price fluctuations in the token. Preliminary investigations suggest the incident may involve address tampering during a multi-signature transaction.The announcement states that the original plan was to send additionally unlocked tokens to the airdrop claim contract address. However, during execution, the funds were mistakenly sent to a different hacker address. The team noted that this hacker address had never interacted with any SUPERFORTUNE-related addresses before, making an "address poisoning attack" less likely as the attack vector.Furthermore, SUPERFORTUNE stated that its internal processes include a multi-layered address verification mechanism. The team is continuing its investigation into the incident and will update the community on the latest developments subsequently.
Syndicate, a DAO infrastructure service provider, has announced it will gradually cease operations. It stated that after five years of continuously building on-chain developer infrastructure, the Rollup market has undergone fundamental changes. Currently, the Rollup market has significantly shrunk, some Rollup projects are gradually shutting down, and the market has shifted from EVM Rollups to custom chains built from scratch by consulting teams, leading to a notable decline in reusable technology and network value.Syndicate stated that its system consists of two parts: Syndicate Labs, responsible for development, will be closed, while the independent entity Syndicate Network Collective (Wyoming DUNA), which holds SYND tokens and has governance rights, will continue to exist. SYND governance will not be affected in the short term.Furthermore, Syndicate emphasized that this decision to cease operations is unrelated to recent cross-chain security incidents. Affected users and SYND holders have been fully compensated through the treasury reserves, and team and investor tokens are currently still in a lock-up period.
According to The Block, JPMorgan analysts noted in their latest report that ongoing DeFi security vulnerabilities and stagnant growth in total value locked (TVL) continue to constrain institutional enthusiasm for the DeFi sector. Recently, Kelp DAO’s cross-chain bridge suffered a major attack, during which the attacker minted $292 million worth of uncollateralized rsETH tokens and borrowed real ETH on Aave, resulting in approximately $230 million in bad debt. This caused DeFi TVL to evaporate by roughly $20 billion within several days. LayerZero and blockchain security researchers have attributed this attack to the North Korean hacker group Lazarus Group; some of the stolen funds have been frozen, while the rest remain in circulation. Analysts also pointed out that DeFi TVL denominated in ETH has remained range-bound for an extended period, raising market concerns about whether DeFi can achieve organic growth sufficient to support institutional adoption. Furthermore, following each security incident, users tend to shift funds into USDT as a safe-haven asset—yet this trend has not yet significantly driven USDT’s market capitalization growth.