News linked to both this project and an event.
SlowMist Chief Information Security Officer 23pds stated that, based on historical forensic experience, the one-time transfer of Binance's assets indicates the attacker successfully bypassed the risk control system. Whether the intrusion vector involved a leaked private key or compromised signing machines still requires priority verification. He personally leans toward the private key leakage hypothesis and believes the attacker most likely employed custom-built withdrawal tools. He advises security teams to prioritize investigating private key leak pathways and anomalies associated with unauthorized withdrawal tools during attribution and forensic investigations.
Blockaid CEO Ido Ben-Natan stated that the preliminary assessment indicates Binance was either hacked or had its private keys "abused" due to a compromised signing infrastructure, rather than a private key leak, and noted that it is highly similar to the Bybit theft incident.
Odaily report: Crypto hardware wallet manufacturer NGRAVE has issued a security warning, stating that it is currently facing a high-level cyber threat, and the team is actively monitoring and taking countermeasures.NGRAVE reminds users to be vigilant against phishing attacks carried out through SMS, emails, fake websites, and fraudulent customer service, and emphasizes that the official team will never ask users for their recovery seed phrase or Perfect Key.NGRAVE states that users' private keys are stored only offline in the ZERO hardware device. As long as the seed phrase has not been entered on a phone, computer, or webpage, such phishing attacks will not compromise the security of the private keys. The official team recommends that users manually type the official website domain name to avoid accessing phishing links.
Hardware wallet manufacturer Keystone's device verification keys were stolen, leading to suspended shipments, the destruction of 18,835 unsold devices, and the leak of 25,964 buyer records.
Odaily reports: The SlowMist security team has released a report stating that two recently disclosed high-severity PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are posing risks to the off-chain infrastructure of the Web3 industry. Both vulnerabilities have a CVSS v4.0 score of 9.2. Attackers do not need an account password or API key—simply sending a crafted request to a PHP service exposed to the public internet may allow them to execute arbitrary code with the privileges of the web service process.The vulnerabilities affect all versions of PHP from 5.4 to 8.5.11, and details of the flaws leaked before the official patches were released. Amazon's threat intelligence team observed actual exploitation attempts 4 days before public disclosure. Scanning by SlowMist's threat intelligence system MistEye shows that among 1,488 crypto-related domains surveyed, 793 carry direct PHP fingerprints, accounting for approximately 53.3%.Affected off-chain infrastructure includes Web3 project frontend pages, API interfaces, airdrop claim pages, operations backends, and custodial wallet services. If attackers exploit the PHP vulnerabilities to compromise a project's web server, they may tamper with frontend pages and trick users into signing malicious transactions, thereby stealing assets.Official releases of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been published, and affected projects should upgrade to the corresponding latest versions. PHP 8.1 and earlier versions have reached end-of-life for upstream regular support and should be migrated as soon as possible. Temporary mitigation measures taken when an immediate upgrade is not possible can only reduce the risk of specific attack paths; applying the patch remains the definitive solution.
The Polkadot Community Foundation issued a security warning on the Polkadot Forum stating that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the browser extension for the third-party wallet Fearless Wallet contain malicious code, which may transmit users' private keys to attacker-controlled servers when unlocking the wallet. The relevant code was added on February 19, 2025, via a code commit titled “TON ecosystem”, and was triggered intermittently from February 2025 to October 10, 2026.
Indian digital certificate authority eMudhra had a flaw in its key setup script that caused it to use extremely weak values as private keys, resulting in the compromise and exposure of eight private keys. Attackers can exploit forged digital certificates to impersonate trusted websites and carry out man-in-the-middle attacks to steal or tamper with data.
According to Odaily, digital hardware wallet manufacturer NGRAVE disclosed on October 19 that attackers hijacked a third-party notification service used by its LIQUID companion app and sent fake security alerts to users, resulting in approximately 70 wallet addresses being stolen for about $2.56 million across 4 blockchains. Among the losses, Bitcoin accounted for approximately $1.77 million, XRP approximately $454,000, Ethereum assets approximately $316,000, and Stellar approximately $18,000.The attackers lured users into clicking on counterfeit websites and entering their 24-word recovery phrases or Perfect Keys, after which automated scripts transferred the assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised, and that victims voluntarily handed over their recovery credentials during the phishing process.The unauthorized access may have begun on October 11. After obtaining one access key, the attackers acquired a key with broader permissions and sent fake notifications on October 17. NGRAVE detected the anomaly approximately 1 minute after the notifications appeared, but the first wallet had already been drained 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a crypto security company, and said that the affected keys have been replaced, with two-person approval, domain restrictions, and emergency shutdown mechanisms added. The company also reminded affected users to create new wallets and contact the support team, noting that some device information, wallet activity, IP addresses, and approximate locations may have been exposed. (Bitcoin.com News)
The SlowMist security team discovered during an analysis of the Qubic wallet that it uses the same non-cryptographically secure random number data stream (Math.random()) for both generating the account seed and producing the dejaVu identifier values disclosed in network packet headers, potentially allowing private keys to be recovered through network observation.
According to Scam Sniffer (@realScamSniffer), Duelbits' hot wallets on Ethereum, BSC, and Tron are suspected of having leaked private keys, with approximately $4.2 million in assets flowing to newly created addresses. The transferred assets include 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB, and 192,000 TRX, with most of them already converted to ETH. The hacker's EVM address is 0xa77e24fe29d16e051e487ef4ea7b056cb05aef76.
Fetch.ai officially announced that it was hacked, with attackers breaching the system via stolen signing keys and transferring funds to withdrawal wallets. An on-chain attack analysis report tracing the complete path from the key leak to the attacker's withdrawal has been published on the ASI:One platform. Currently, Fetch.ai has collaborated with SingularityNET to disable the affected wallets and related contracts. The investigation is ongoing, and updates will be provided continuously.
Odaily reports: Bitcoin News posted on X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the Bitcoin security landscape. Large language models have significantly reduced the cost of vulnerability discovery, and attackers may be able to find catastrophic vulnerabilities with only a few hundred dollars in computing costs. For Bitcoin Core, Project Loupe, Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or critical vulnerabilities have been found. Gögge stated that relying on stronger models to find vulnerabilities before attackers do is not a sustainable security strategy. Developers should build testing infrastructure through automated testing, fuzzing, and property-based testing that can prevent entire classes of vulnerabilities in advance. Key components of Bitcoin Core have cumulatively completed over 100 years of CPU fuzzing and decades of Bitcoin node network simulation.
According to an announcement from the official Liquid Network X account (@Liquid_BTC), a suspected whitehat hacker withdrew approximately 4,000 BTC worth around $320 million from a Liquid Federation wallet using a SideSwap PAK (Peg-out Authorization Key). The official statement indicated that the key itself was not leaked, and the Blockstream team is attempting to contact the party through on-chain signed messages. Following the incident, exchanges have paused or are about to pause LBTC deposit and withdrawal services. Bridge nodes have been temporarily shut down, and the Liquid sidechain is currently suspended, unable to submit new transactions. Officials emphasized that other Liquid assets such as USDT, DePix, and RWA remain unaffected by this incident, while Federation members are actively working to resolve the issue to restore normal network operations as soon as possible.
According to Decrypt, privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on August 28. Developer Craig Raw stated that the update was driven by an AI-assisted code review, with the majority of fixes originating from it. This review was prompted by the recent seed generation code vulnerability exploit affecting Coldcard, as well as the release of unrestricted AI models in China, which has significantly enhanced vulnerability scanning capabilities across large codebases. Key updates include: validating the authenticity of transactions returned by Electrum servers, enforcing stricter BitBox02 hardware wallet security requirements (firmware v9.4.0 or higher required), patching local DNS leaks, and masking sensitive credentials in debug logs. Raw noted that there are no indications of any exploits being leveraged, user funds remain secure, and he still advises all users to update at their earliest convenience.
GoPlus Security released a security alert stating that on August 25, realio[.]fund, a project under Realio Network, was attacked. The attacker took control of the platform's signing system and moved treasury and custody wallet assets across Ethereum, BNB Chain, Algorand, Stellar, and the Realio native chain. A total of approximately 127.9 million RIO tokens worth around $6.2 million were affected, with the attacker having cashed out approximately $317,000 so far.
Odaily News Bybit today released its H1 2026 Risk and Security Report. Following the security incident in February 2025, Bybit has comprehensively upgraded its security architecture, transitioning toward a new defense model characterized by earlier detection, faster response, and continuous adaptation. Key highlights from the report are as follows:User Fund Protection: In H1, over 30,000 suspicious withdrawals were intercepted, protecting nearly 20,000 users from potential losses exceeding $700 million. The average initial review time was just 4.7 minutes (with 95% completed within 10 minutes).100% On-Chain Monitoring: Monitoring covers all business-related on-chain activities (including listed tokens, ecosystem contracts, and hot/cold wallets). In H1, 10 security incidents involving listed token projects were handled with zero platform losses; of these, responses to 8 incidents were faster than other major exchanges, and 2 attacks were detected before the project teams themselves. Additionally, approximately $212 million in potentially fraudulent on-chain funds was identified, and over 10,000 malicious addresses were blacklisted.AI-Driven Security Operations: More than 100,000 security alerts were processed. AI-assisted audits identified critical vulnerabilities at an efficiency 3-5 times that of manual efforts; the automated red team platform reduced the time from asset discovery to initial testing to within 24 hours (compared to weeks with traditional manual methods), and the cycle from security assessment to testing was shortened from two weeks to two hours.Accountability and Asset Recovery: In collaboration with law enforcement agencies and blockchain intelligence firms, stolen assets are being traced, and legal action has been taken against North Korea and the Lazarus Group to hold them accountable and recover funds.David Zong, Head of Risk Control and Security at Bybit Group, stated: "The cybersecurity arms race has entered the era of 'minute-level' response. Leveraging AI to strengthen risk control capabilities and ensuring the security of AI systems themselves is our top priority, but critical security decisions remain centered on human judgment."
According to Lookonchain, the whale address "TLBL" has experienced another major asset security incident, with cumulative losses exceeding $50 million. Of this total, the address previously lost approximately $24 million due to a phishing attack two years ago; in the latest incident, it is suspected that over $26 million in assets across 3 wallets were completely transferred out due to a private key leak. This incident has once again sparked market concern regarding security management risks for high-net-worth on-chain addresses.
Odaily News: Kostas Chalkias, co-founder and chief cryptographer of Mysten Labs, the development company behind the Sui blockchain, stated that he has leased a dedicated factory at a secret location and plans to scale up production of quantum-safe hardware wallet cards for Sui. The project aims to keep the cost of a single quantum card key under $10, with NFC quantum signing expected to take 1 to 2 seconds. Chalkias noted that the project is being advanced in his personal time outside of work and may include funding to provide cards for users who cannot afford them. The initiative is partly driven by a recent incident involving Coldcard hardware wallets, though the vulnerability was not a quantum attack. Coldcard manufacturer Coinkite disclosed that a firmware vulnerability in Coldcard, traceable to a 2021 update, bypassed the hardware random number chip and generated keys using a predictable software process linked to device serial numbers. Attackers have been moving funds since July 30, with losses climbing to approximately 2,055 BTC, affecting over 7,700 addresses and nearing a value of $130 million. At the protocol level, Sui plans to integrate two quantum-resistant signature schemes approved by the U.S. National Institute of Standards and Technology (NIST), designed for everyday accounts and high-value Move vaults, respectively. Existing accounts can be rotated to quantum-safe keys based on their original recovery phrases, without needing to migrate to new wallets. (Bitcoin.com News)
Odaily News: Bitcoin Red Team, a volunteer security audit team composed of Bitcoin developers and security researchers, has released its latest audit findings. In approximately 30 hours, the team reviewed 391 Bitcoin-related codebases and identified a total of 4,962 security issues, of which 720 were rated as high-risk or critical vulnerabilities. Only one codebase was found to have no issues at all. Currently, only 147 vulnerabilities have been submitted to project maintainers for resolution.Bitcoin Red Team is a volunteer security audit team made up of Bitcoin developers and security researchers, initiated following the Coldcard hardware wallet vulnerability incident. Key contributors include Calle, a developer of the Cashu protocol, among others. (Beincrypto)
: Anthropic's Claude Mythos Preview model discovered a flaw in the proposed HAWK digital signature scheme, effectively halving its minimum key strength. HAWK is one of the candidate schemes to replace current network and bank signatures in a post-quantum environment. This AI-driven attack took approximately 60 hours, with a computational cost of around $100,000, reducing the effort required to break HAWK's minimum parameter set from roughly 2^64 operations to 2^38 operations, and diminishing the attractiveness of larger compensating key sizes. Current Bitcoin and Ethereum signatures remain unaffected. The results indicate that the capabilities of classical cryptanalysis attacks are improving, while Bitcoin and other networks continue to discuss when and how to migrate to quantum-resistant cryptography.