News linked to both this project and an event.
Odaily reports: Cross-chain protocol Chainflip has disclosed that an attack targeting Tron USDT occurred yesterday. It has been confirmed that 736,442.17 USDT was stolen through 6 unauthorized payments, while another 115,654.41 USDT in user swaps remained in the vault due to failed payments. All other funds were unaffected.Chainflip stated that the attacker exploited a vulnerability in the Tron transaction memo mechanism by attaching custom memos to transactions already signed by validators, causing the system to identify the same deposit as separate swaps and issue refunds again, ultimately resulting in duplicate payments. The attacker carried out 8 operations over approximately 90 minutes, gradually increasing the amounts. Chainflip said it has completed a fix and has flagged the stolen funds to relevant authorities in an attempt to recover them. The protocol is expected to resume operations as early as Monday and will be responsible for compensating affected users for their losses.
Odaily News: Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after using a download link provided in a Claude chat window to install a transcription application. The link pointed to a fake website bundled with malware, which attempted to steal all information from his device upon execution.Numa Lunah said he wiped and reinstalled the affected laptop and found no signs of sensitive data leakage. Subsequently, he discovered a contaminated Claude Code skill file named SKILL.md in his backups. The file was disguised as a style guide written by himself and contained instructions to re-download malware and steal credentials every time it was loaded.Microsoft Defender Experts previously warned that attackers have shifted from search engine optimization poisoning to large language model response poisoning. These tactics include recommending attacker-controlled download links, AI-branded fake installers, and contaminated code repositories and agent skills. Individuals working in the crypto industry may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSONs, exchange API keys with withdrawal permissions, and deployer keys. (Bitcoin.com News)
According to Bloomberg, digital asset exchange Kraken stated that some customer accounts were temporarily locked after receiving small cryptocurrency transfers from wallets linked to the sanctioned exchange HTX. Kraken refers to such transfers as "dust attacks," which involve sending tiny involuntary transactions to disrupt or manipulate other cryptocurrency users. In this incident, Kraken believes the attackers' objective was likely to trigger the platform's compliance review by spreading sanctioned funds.
According to monitoring by CertiK Alert, the DeFi lending protocol Term Labs has been targeted by a governance attack, resulting in approximately $8.5 million in asset losses. Currently, around 2,843 ETH and approximately $1.6 million worth of DAI have been transferred to address 0xD5183d8BfC65a50863C62aF2538198A8288FFc13. Term Labs has confirmed that its Term Vaults fell victim to a governance exploit, stating that the team is continuing to investigate the incident and will release further details upon completion of the investigation. Official sources have yet to disclose the specific attack vectors or the scope of the impact.
According to The Block, open-source Bitcoin payment processor BTCPay Server disclosed a critical security vulnerability being actively exploited last Friday and urgently requested users to upgrade to version 2.4.2. The vulnerability affects all versions prior to 2.4.2; attackers can use it to steal administrator macaroon authentication credentials of LND nodes, thereby fully controlling the connected Lightning Network wallets. Users such as Foundation and Citadel21 have confirmed that their Lightning node funds were drained, but BTCPay has not publicly disclosed the total amount stolen or the number of affected nodes. Currently, the official release version 2.4.2 has fixed this vulnerability, and on-chain hot wallets are not affected. The BTCPay Server Foundation has donated 0.21 BTC each to security researcher Craig Raw and Bitcoin Red Team to commend their responsible private disclosure of the vulnerability. Meanwhile, BTCPay supporters have promised to provide a bounty incentive of "10% of recovered funds," capped at 3 BTC.
Bitcoin payment processing project BTCPay Server warns that a critical vulnerability on its servers is being actively exploited, potentially allowing attackers to gain unauthorized access and cause loss of funds. Users are urged to upgrade to version 2.4.2 and change relevant credentials.
According to The Block, data from blockchain analytics firm Chainalysis shows that violent robberies targeting cryptocurrency holders in the first half of 2026 have resulted in losses exceeding $30 million. If the trend continues in the second half, the full-year total will surpass the historical peak of $58 million in 2025. France has become the world's largest "Wrench Attack" hotspot, with 30 public cases recorded in the first half of 2026, while the French Minister of the Interior stated that actual cases exceed 70. Chainalysis attributes this to the 2024 French tax authority data breach—a tax official was suspected of stealing and selling the names, addresses, holdings, and tax records of high-net-worth crypto holders, causing the attack frequency to surge from a monthly average of 1.9 in 2025 to a monthly average of 4.6 in the first half of 2026. Attack methods have also deteriorated; cases targeting family members rather than the holders themselves now account for over 40% of French cases, and the proportion of home invasions rose from 14% in 2025 to 37%. Stolen funds are typically quickly moved on-chain, with some laundered through tools such as decentralized exchanges and cross-chain bridges; advanced criminal networks are even linked to cartel money laundering and terrorist financing channels.
Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently, after a user implanted illegal pornographic content in a public group. The app was restored within hours.Durov said the attacker exploited a technical vulnerability to insert AI-modified illegal content into old messages within active groups, hiding the content by editing historical messages, making it difficult for regular group members to detect and report in time. This type of attack constitutes "takedown extortion," where attackers use automated accounts to implant violative content in public groups and report it to platforms like Apple, attempting to force group administrators to pay a ransom, or else exploit platform rules to get the community banned.Durov added that Telegram continuously combats illegal content through mechanisms such as user reports, AI filtering, and content hashing. This incident is not a systemic issue with the platform, but rather a targeted attack exploiting rule loopholes. He also warned that Apple's removal of the app without prior contact with Telegram could pose a risk to all mobile applications offering user-generated content (UGC), and platform developers need to strengthen their defenses against malicious reporting and "takedown attacks."
as the suspected hacking incident involving Coldcard wallets continues to unfold, Bitcoin small-value transfers have surged significantly, reaching their highest level since the FTX exchange collapse, reigniting market discussions on Bitcoin self-custody security.Julio Moreno, Head of Research at CryptoQuant, disclosed data on X platform showing that the number of on-chain Bitcoin transfers below 1 BTC has risen to its highest level since November 2022, with approximately 39,600 BTC transferred in a single day—only about 300 BTC below the record of 39,900 BTC set on November 16, 2022, just days after FTX filed for bankruptcy. He believes that users proactively taking action to address risks is a positive signal. Additionally, Eric Balchunas, Senior ETF Analyst at Bloomberg, noted that Bitcoin ETFs, backed by a mature regulatory framework and convenience, may offer some users a safer investment approach.However, industry insiders point out that the Coldcard incident more likely reflects issues with a single wallet provider or specific security processes, rather than indicating a failure of the entire Bitcoin self-custody system. This event once again highlights the importance of security awareness, risk diversification, and wallet usage habits in personal asset management.
According to CryptoQuant Head of Research Julio Moreno (@jjcmoreno), following the hack of Coldcard hardware wallets, users transferred Bitcoin on a large scale due to security concerns. On-chain data shows that Bitcoin daily active addresses surged from 645,000 on July 30 to nearly 1 million on July 31, marking the highest single-day level since December 10, 2024, with active sending addresses rising significantly while receiving addresses saw relatively limited growth. Meanwhile, daily exchange deposit volume for single transactions under 10 BTC soared to 7,300 BTC, the highest since February 6 this year.
Odaily Planet Daily reported that the algorithmic stablecoin Balance Coin dropped from $0.9954 to $0.001358, a decline of over 99%. The stablecoin is the native algorithmic stablecoin of the Balance Protocol, designed to maintain a peg to the US dollar. Blockchain security firm PeckShield stated that the depegging occurred following an exploit of the decentralized autonomous organization 42DAO, which governs the Balance Protocol and its BLC token, resulting in a $915,000 loss. TenArmor reported detecting suspicious attacks involving GemJoin and 42DAO on the BNB Chain.
SlowMist announced that over 140 Mastra-related npm packages were compromised via a supply-chain attack. Affected versions introduce the malicious dependency `[email protected]`, which triggers attacker-controlled code execution during installation.
LayerZero’s official tweet: LayerZero Labs has formally apologized for the security incident that occurred over the past three weeks and for insufficient communication. Regarding the incident, an internal RPC of LayerZero Labs was compromised by the North Korean hacking group Lazarus Group, contaminating the data sources for its Decentralized Verifier Nodes (DVNs). Concurrently, external RPC providers also suffered DDoS attacks. This incident affected a single application—0.14% of all applications—and involved assets valued at approximately 0.36% of LayerZero’s total assets. The LayerZero protocol itself remained unaffected; over $9 billion in assets continued to flow across chains normally following the incident. LayerZero Labs acknowledged that it previously permitted its DVNs to operate under a “1/1” single-node configuration to secure high-value transactions—a setup inherently vulnerable to single-point failure. LayerZero Labs accepts managerial oversight responsibility for this decision. Additionally, LayerZero disclosed that, three and a half years ago, one of its multi-signature signers had mistakenly used a multi-sig hardware wallet for personal transactions. That signer has since been removed, and the associated wallet has been rotated. As corrective measures, LayerZero Labs announced: - It has discontinued support for “1/1” DVN configurations; - It is migrating all paths to a default 5/5 multi-signature configuration, with a minimum threshold of 3/3; - It has developed a second DVN client written in Rust to ensure client diversity.
SlowMist CISO 23pds (@im23pds) disclosed that the Bitwarden CLI version 2026.4.0 was subjected to a Checkmarx supply-chain attack between 17:57 and 19:30 ET on April 22. During this window, attackers abused a GitHub Action within Bitwarden’s CI/CD pipeline to briefly distribute a malicious package via npm. The official statement confirmed that Vault data was not compromised and production systems remained unaffected; only users who installed this specific version via npm during the aforementioned time window were impacted. Affected users are advised to immediately uninstall version 2026.4.0, clear their npm cache, rotate sensitive credentials—including API tokens and SSH keys—investigate anomalous activity in GitHub and CI environments, and upgrade to the patched version 2026.4.1.
According to BlockSec Phalcon, the HandlerV1 contract managed by Hyperbridge on the Ethereum network was found to contain a Merkle Mountain Range (MMR) proof replay vulnerability, resulting in approximately $242,000 in losses. The vulnerability stems from the lack of binding between proofs and requests, enabling attackers to replay historical valid proofs alongside newly forged requests to perform malicious actions—such as altering administrator privileges. In the specific incident, the attacker changed the Polkadot (DOT) token administrator and then exploited those privileges to mint additional DOT tokens for profit. Observed attack transactions include: changing the DOT token administrator and minting new tokens (losses of ~$237,400), changing the ARGN token administrator and minting new tokens (losses of ~$3,800), and host withdrawal operations. The vulnerability was discovered by PhalconSecurity and analyzed via PhalconExplorer. Previously, the Hyperbridge gateway contract was attacked, leading to the unauthorized minting and subsequent dumping of 1 billion DOT tokens on Ethereum.