News linked to both this project and an event.
Privacy blockchain Iron Fish confirmed that recent anomalous activity involving wIRON and the ChainPort cross-chain bridge originated from an inflation vulnerability within its own blockchain, rather than an issue with the cross-chain bridge itself. The vulnerability traces back to the 2019 Merkle tree implementation, which could allow the same privacy note to be double-spent. The team has submitted a patch and plans to close and archive the code repository.
According to CryptoSlate, Microsoft and the cybersecurity organization Health-ISAC have obtained a U.S. court order to seize and redirect the domains supporting three services: YAM Store, CoGUI, and Iron Man. These three services sell stolen accounts and phishing tools to fraudsters. Since January this year, they have assisted in sending over 1 billion phishing messages, targeting more than 75,000 institutions across over 150 countries, generating tens of millions of dollars in revenue for operators. Microsoft has disabled more than 20,000 accounts associated with YAM Store and continues to block over 100,000 spoofing and fraudulent domains. According to Microsoft's investigation, these services accept payments in USDT (Tron network) and ETH, with Cloudflare noting that buyers can also pay using USDC. Blockchain analytics firm TRM Labs assisted investigators in locating and freezing related assets, though the frozen amount was not disclosed.