News linked to both this project and an event.
according to Zilliqa's monitoring, it has learned of a security incident involving a CEX partner, where some ZIL has been stolen from a cold wallet. The incident is currently under investigation, and the team is working with relevant parties to determine the root cause and the scope of the impact. As a precautionary measure, Zilliqa has notified all CEX partners to temporarily suspend ZIL deposits and withdrawals to prevent the stolen funds from being transferred or sold through centralized platforms. The official stated that further updates will be released after verifying the information and reminded the community to only follow information published through official channels.
security researchers have discovered an information-stealing malware targeting MacOS devices that is attacking crypto users. It can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Affected wallets and applications include: Exodus, Atomic, Electrum, Wasabi, Monero, and others.Security experts advise that users with potentially infected devices should immediately treat them as "untrusted devices," terminate all active Telegram sessions, and change both their Telegram two-factor authentication password and desktop app password. Additionally, users should not enter seed phrases, private keys, or wallet passwords on the infected device, and should generate a new wallet and migrate their assets. (FinanceFeeds)
security firm Project Eleven has introduced a post-quantum proof technology designed to help users prove ownership of their Bitcoin wallets after quantum computers become capable of deriving private keys and generating valid signatures. Project Eleven CEO Alex Pruden stated that the technology utilizes the wallet's key derivation path, enabling users to prove control without disclosing the parent key, thus distinguishing legitimate owners from attackers. The solution was developed in collaboration with Jim Posen, a primary maintainer of the open-source Binius zero-knowledge proof system, and is based on the "signature lifting" technique proposed by Alon Sattath and Robert Wyborski. Project Eleven noted that the prototype has not yet been audited and requires blockchain protocol support before it can be deployed. It is primarily aimed at users who miss the window to migrate to quantum-resistant addresses in the future.
According to PeckShield monitoring, the previously detected unusual fund activity in the LayerZero Executor wallet was not an attack incident, but part of normal operational adjustments. User funds are not at risk.
Odaily reports: A court in the state of São Paulo, Brazil, has ordered Coinbase to refund nearly $100,000 to a user who claimed funds deposited in their Coinbase Wallet disappeared in an unauthorized transaction. Coinbase argued that the private keys to the wallet were entirely under the user's control. However, it failed to prove that the transaction was initiated by the wallet holder or that adequate security measures were in place to prevent the incident. The court ruled based on relevant provisions of the Consumer Protection Code and ordered Coinbase to return the full amount plus statutory interest. (Bitcoin.com News).
According to The Block, Ledger's security research team Donjon disclosed a security vulnerability in Tangem hardware wallet cards. After obtaining the physical card, attackers can use laser fault injection equipment to bypass recovery state verification in the firmware and reset the password, thereby controlling the wallet and initiating transactions. The research states that this vulnerability affects all Tangem cards currently in circulation, and since the product does not support firmware updates, it cannot be fixed via patches.
according to monitoring by Coinspect Security, by analyzing crypto wallet seeds generated using insecure code since 2018, it was discovered that thousands of seeds have been used in practice. In the past month alone, $3.14 million in suspected stolen funds was identified in related wallets. Coinspect Security stated that some funds exhibited patterns of being consolidated into a single address and money laundering. One affected address transferred out another $2 million just hours after the alert was issued, and it remains unclear whether this was part of the theft. Additionally, Coinspect Security issued a special warning to the Chinese-speaking community, indicating that many users whose assets may still be at risk are likely located in China.
Odaily, Cardano wallet service provider SecondFi has launched an asset recovery wallet check tool, allowing users to preliminarily check whether their relevant wallets have been affected by the previous security incident.SecondFi stated that the addresses currently displayed in the tool are based on the team's preliminary review data of the security incident and are not final. The list may not be complete and does not represent the final scope of recovery.
Microsoft’s Threat Intelligence Team has disclosed a Windows clipboard cryptojacking trojan that has been active since February 2026. This malware employs a combination of “worm-like propagation,” “clipboard hijacking,” and “Tor-based anonymous communication” to target cryptocurrency users.
Wallets associated with or interacted with Humanity Protocol are being compromised. Currently, over 17 wallets holding H tokens have been stolen, with total losses exceeding $19 million. The cause of the theft remains unclear, but the attack pattern suggests that the affected wallets may share a common risk exposure related to Humanity Protocol.
: According to an official announcement, on June 3, Trust Wallet announced a partnership with BNB Chain and CoinMarketCap to officially launch the "BNB Hack: AI Trading Agents" hackathon, featuring a total prize pool of $36,000. The Trust Wallet Agent Kit serves as the core on-chain execution technology stack for this event. This hackathon also marks the first time the Trust Wallet Agent Kit has been fully integrated as a core infrastructure component into a top-tier AI Agent hackathon system.The hackathon features two main tracks: "Autonomous Trading Agents" (prize pool $24,000, 5 winners) and "Strategy Skills" (prize pool $6,000, 3 winners), in addition to three partner special awards of $2,000 each. In the "Autonomous Trading Agents" track, participants must leverage the Trust Wallet Agent Kit to achieve local self-custodial signing, autonomous mode operation, and on-chain trade execution, deployed within native BNB Chain scenarios such as PancakeSwap and BSC Perpetual Contracts. The "Strategy Skills" track does not require an execution layer; participants build backtestable strategy proposals based on 12 categories of data tools from CoinMarketCap MCP, including market data, technical indicators, on-chain data, sentiment, and news.Track one uses real PnL as the core evaluation criterion, setting a maximum drawdown limit as the risk control threshold. Track two is comprehensively scored by a judging panel across four dimensions: technical execution, originality, real-world value, and presentation. The build window runs from June 3 to June 21, the trading window from June 22 to June 28, and winners will be announced during the week of July 6. In addition to cash prizes, winning teams will receive CoinMarketCap Pro API subscription credits, mentorship from CMC Labs, and the BNB Chain Kickstart ecosystem support package.
Cosine, founder of SlowMist, posted an analysis of the Squid security incident on X. He stated that sampling revealed all affected Safe wallets were single-signature, with different owners—but the issue was not related to private keys. Rather, the vulnerability lay in the module shown in the image (SquidRouterModule) used by these Safe addresses. Attackers could forge messages and easily bypass relevant validations to initiate subsequent swap operations, thereby draining funds from the targeted Safe wallets. Additionally, Cosine disclosed the attacker’s profit accumulation address. Earlier reports indicated that a third-party Gnosis Safe module was exploited on Base and Ethereum, causing approximately $3.2 million in losses. The victims were 86 Gnosis Safe wallets that had added this contract as a trusted Safe Module. The contract is named “SquidRouterModule” on Basescan. Subsequently, Squid clarified that it was not impacted by the Gnosis Safe-related vulnerability incident.
Polymarket staff member Shantikiran Chanal posted on platform X, stating that they have taken note of the security reports related to reward distribution, and that user funds and market settlements remain safe. The investigation indicates that a private key leak occurred in a wallet used for internal operations, and the issue is not related to contracts or core infrastructure. Further updates will be provided.Previous report: ZachXBT stated that the Polymarket UMA CTF Adapter contract allegedly came under attack on Polygon, with over $520,000 having been drained.
According to monitoring by MistEye, the threat intelligence monitoring system operated by blockchain security firm SlowMist (@SlowMist_Team), a highly sophisticated npm worm named “Mini Shai-Hulud” is spreading via well-known developer projects including TanStack, UiPath, and DraftLab. Attackers have hijacked GitHub credentials to publish malicious packages disguised as legitimate updates. These packages contain a hidden script—<code>router_init.js</code>—that executes silently within CI/CD environments such as GitHub Actions, specifically designed to steal CI/CD secrets, cloud infrastructure credentials, and cryptocurrency wallet information. Data exfiltration is conducted using GitHub’s own infrastructure. SlowMist has already shared this threat intelligence (IOC) with its clients. It recommends that projects using the affected packages immediately audit their CI/CD pipelines for the presence of <code>router_init.js</code>, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor development environments for anomalous background activity.
Trader A (@missoralways) posted that he had stored seven-figure assets in Sigma for a long time without encountering security issues in the past. However, two of his recent wallets have suffered asset theft, both occurring when wallet balances fell below $10,000.He also stated that another friend suffered the theft of approximately $200,000 in assets today, and mentioned Sigma in connection with the incident. The Sigma team has launched an investigation. The trader said he released this information for security reminder purposes and emphasized that he is not an affiliated promoter of any bot-related products.
According to SlowMist, its security monitoring system MistEye has detected a counterfeit TronLink Chrome MV3 extension targeting TRON wallet users with a two-layer phishing attack. The extension disguises itself as the official plugin using Unicode obfuscation and brand spoofing. Upon installation, it first loads a remote iframe-based pop-up page designed to trick users into entering their mnemonic phrases, private keys, keystore files, and passwords—then exfiltrates this sensitive data via same-origin APIs to a Telegram bot. The malicious infrastructure involved includes the domains tronfind-api[.]tronfindexplorer[.]com and trx-scan-explorer[.]org; the malicious extension ID is ekjidonhjmneoompmjbjofpjmhklpjdd. SlowMist advises users to immediately uninstall the extension. If sensitive information has already been submitted, users should promptly migrate their assets and discontinue use of the compromised wallet.
"on-chain detective" ZachXBT posted on X platform, stating that PolyArb is a fake prediction market product with a wallet drainer on its website. Additionally, the product's account posted controversial replies under multiple tweets from well-known prediction markets to drive traffic and lure users into participating.
According to GlobeNewswire, eToro, a trading and investment platform, announced it has signed an agreement to acquire Zengo, a leading self-custodial crypto wallet provider. This acquisition aims to deepen eToro’s digital asset capabilities and accelerate its strategic initiative to bridge traditional finance with on-chain infrastructure. Founded in 2018, Zengo builds its keyless wallet architecture on Multi-Party Computation (MPC) cryptographic technology. It currently serves over 2 million users across more than 180 countries and regions, and has never experienced a wallet breach since its inception. Following the acquisition, eToro will leverage Zengo’s technological expertise to further support decentralized trading use cases—including tokenized assets, prediction markets, and perpetual contracts. The transaction is subject to customary closing conditions.
According to CoinDesk, researchers from the University of California, Santa Barbara; the University of California, San Diego; blockchain security firm Fuzzland; and World Liberty Financial jointly published a paper warning that “LLM routers”—intermediary services positioned between users and AI models—have become a major threat to cryptocurrency asset security. The researchers discovered that 26 LLM routers are secretly injecting malicious tool calls and stealing user credentials, with one incident resulting in the complete draining of a customer’s cryptocurrency wallet worth $500,000. Additionally, by “poisoning” the router ecosystem, the researchers were able to gain control of approximately 400 downstream hosts within hours. Since sensitive data—including private keys and API credentials—is frequently transmitted in plaintext through these routers, users unknowingly expose their assets to risk. The researchers note that as McKinsey forecasts AI agents will mediate $3–5 trillion in global consumer commerce by 2030—and Binance founder Changpeng Zhao predicts AI agents’ payment volume will be one million times greater than that of humans—the current infrastructure’s security lags far behind the pace of industry development. The “weakest link” risk could thus trigger systemic, cascading crises.
According to The Block, U.S. musician Garrett Dutton (stage name G. Love) lost 5.9 BTC—worth approximately $420,000—after downloading and using a counterfeit Ledger wallet app from the App Store and entering his recovery phrase. On-chain analyst ZachXBT discovered that the attacker laundered the stolen Bitcoin via the KuCoin platform. This incident once again exposes the security risks posed by fake wallet apps, reminding users to exercise heightened caution when downloading and using cryptocurrency-related applications, and to avoid entering sensitive information through unofficial channels.