Security
Security
111 Ledger Wallets Emptied in One Bitcoin Block, and the Reseller Had Changed Hands in March
Ledger said on October 10 that one affected user's device carried “an unauthorized hardware implant.” Bitquery counts $93.2 million drained from 315 wallets on six chains on October 9, including 111 Bitcoin wallets emptied in a single block after two weeks of test transactions. Corporate filings show the reseller, CryptoBilis, was sold in March under a non-disclosure agreement. Ledger's own buying guide says its Genuine Check cannot detect physical modifications to the hardware.
Security
Eleven Seed Phrases on an Open Directory
Censys found five servers with open directories exposing a DarkSword/Coruna iPhone exploit platform, still in use, with an admin panel that pays resellers commission on infected devices. A copy of its production server held 11 victim recovery phrases, 179 device loot directories and 18 wallet-theft modules. iVerify's P7 variant polls its operator every 15 seconds and ships commands named wallet_scan and wallet_extract. Every bug it uses is patched; the exploit still works on phones that have not updated.
Security
Ten Minutes of AI Tracing, and a North Korea Verdict With the Working Left Out
Chainalysis says its in-house AI compressed more than 20 hours of bridge reconciliation on the $387 million Bitget theft to under 10 minutes, and that the theft pushes North Korea's 2026 total past $1 billion. The post states the attribution as settled and explains it nowhere. Elliptic, six days earlier, published the address overlaps it relied on. No government has attributed the theft, and the money anyone has actually stopped totals $318,013 frozen and $503,000 held.
Security
MetaMask Is Pulling Its Lido Validators Over 0.36 ETH in Misrouted Tips
On September 30, 18 of the 19 MetaMask Staking validators that proposed blocks paid their tips to an address funded through Tornado Cash, by an independent analyst's count. The take was worth less than $1,000. The response is the exit of every validator the operator runs for Lido, which outside analysts put at roughly 17,000 validators and more than half a million ETH, with the last expected out by October 7 and the stake taking up to 45 days to come back. Nobody has said what was compromised.
Security
'We Have Identified You, Sir': NEAR Intents' $3.8 Million Came Back Within a Day of the Ultimatum
A bug in how NEAR Intents' Omni deposit and withdrawal layer talked to its settlement contract let someone pull $3.8 million in USDT out of a BNB Chain hot wallet on October 1. Services on eleven networks paused, the contract was patched within an hour, and the general manager posted a 48-hour deadline addressed to a person he said the team had identified. The money was back by 14:30 UTC on October 2. The team says it has stopped investigating and will not say how it knew.
Security
A Hidden Script Inside Bitget Was Reading a Database Password on August 31
SlowMist's interim report on the $388 million Bitget theft, posted to GitHub overnight, dates the first malicious activity to August 31: a hidden script on a node of a security product it calls only Product A, reading the environment variable that held a database password. That is 25 days before the money moved. The firm also recovered the attacker's custom withdrawal tool from deleted files, and its compiled transfer window ends at 21:23:11 UTC, the same second this desk found on Ethereum and 74 minutes past where the CEO's account stops.
Security
On Zano, Block 3,833,001 Arrived 31 Days After Block 3,833,000
Zano's emergency release rolled the privacy chain back to block 3,833,000, the last block before Hard Fork 6, and activated a new fork at that same height with Gateway Addresses switched off. The commit contains no fix for the bug that minted unauthorized ZANO and fUSD, only a table that disallows the feature; the post-mortem is still pending. On the recovered chain, two consecutive blocks are stamped 31 days apart, and a mining pool produced the first new one 95 minutes before the release appeared on GitHub.
Security
Bitget Says the Thief Came In Through a Security Product It Won't Name
Bitget's new timeline moves detection from 18:31 UTC to 19:05 and blames a flaw in a vendor's product it has not named. On Ethereum, about 71 percent of the ETH sent straight to the attacker left after the alarm, the last of it at 21:23.
Security
23,155 NFTs Rescued From a Contract Nobody Could Pause
Approvals from Magic Eden listings made in 2024 still pointed at Limit Break's Payment Processor V2, which could not be paused. A whitehat emptied the exposed wallets first; a reverse version of the bug took WETH, and the loss counts still disagree.
Security
31 Hours After the Mint, Meter Pushed a Branch Named 'Unconditional Consensus Validation'
Meter blames a block validation flaw for $2.3 million in unbacked tokens. A new branch in its node code switches on three checks that synced blocks skip; the deployed code still skips them.
Security
Bitget's Own Approval System Signed Off on $387.5 Million
No key was stolen, Bitget says. A compromised wallet backend spoofed transfer data and the exchange's authorization process moved the funds; the tally rose from $351.6 million to $387.5 million in a day.
Security
Cosmos Hub Validators Moved 1.2 Million ATOM Without a Governance Vote
A $20,199 vote on Neutron handed an attacker 11 Astroport and Drop contracts. The Cosmos Hub halted, restarted on a build with no public tag, and moved 1,227,121 ATOM out of the attacker's wallet into an address nobody has claimed.
Security
Restart a Halted Chain and Six Hourly Quotas Can Leave in 36 Seconds
IBC's rate-limiting module says it exists to protect chains from economic attacks and token drainage. Its hour clock advances only one hour per block, so after a halt a one-hour quota is zeroed in each of the next N blocks. A five-hour gap reopens the ceiling six times in about 36 seconds.
Security
Pragma Says a Third Price Source Would Have Stopped the Nostra Drain
One account borrowed about $3.5 million from Starknet lender Nostra against NSTR, a token worth roughly $550,000 in total. Pragma's own update says the price came from two sources where its guidance recommends three.
Security
Four Governments Trace 30,000 Infected Developer PCs to Fake Job Interviews
A joint advisory from seven agencies in four countries says North Korea's WaterPlum group compromised at least 30,000 PCs through fake job interviews and took ¥1.7 billion from more than 7,000 crypto wallets. One of its tools runs when a developer tells VS Code to trust a take-home project.
Security
Most of the 11.7 Million XRP in the D'CENT Drain Left After the Warning
XRPL.to counts 6,678 XRP Ledger wallets emptied of 11,746,198 XRP in six waves between September 15 and 20. D'CENT warned App Wallet users on September 16, and five of the waves came afterwards. The same keys were used to delete 5,001 accounts, so whoever did this held the keys themselves.
Original reporting
225,000 Empty Rounds Since MultiversX Last Produced a Block
MultiversX halted its mainnet on September 19 after what it says was an attempt to exploit an atomicity flaw at the virtual-machine level. All three shards and the metachain stopped inside three and a half minutes, and the round counter has since advanced almost 225,000 slots past the last block. Nine days earlier the chain had shipped Supernova, which makes blocks final before their transactions are executed.
Original reporting
Since 2022, a Bitcoin Core Wallet Name Could Carry a Shell Command
Bitcoin Core 32.0rc1 fixes a bug, introduced by a 2022 refactor and shipped since v24.0, in which a wallet name containing regex replacement characters could break shell escaping and run commands on non-Windows nodes configured with -walletnotify. An authenticated RPC caller with wallet-creation rights was required. A reviewer said the fix should be backported; as of September 17 the 31.x, 30.x and 29.x branches still use the vulnerable code. A second fix, found with the Kimi K3 model, closes a memory-exhaustion flaw in the new HTTP server before it ships.
Original reporting
2,882 rsETH Went Back to the Safe's Owner 30 Hours After an MEV Bot Took It
An open Safe module let an attacker pull rsETH from a leveraged Aave position, and the MEV bot Yoink front-ran the attack for about $7.7 million. Kelp froze the receiving address for 24 hours. This desk traced what followed onchain: 18 drain transactions from six addresses before an owner disabled the module 81 minutes in, and on September 16 the frozen address sent all 2,882.37 rsETH to one of the Safe's owners. Nobody has said what was agreed.
Original reporting
25 Fixes Core Lightning Kept Sealed for Two Weeks
Core Lightning shipped v26.06.7 as binaries on August 28 and kept the source sealed until September 11. This desk read the changelog and the commits: 25 fixes, including a clnrest crash any unauthenticated user could trigger, a crafted BOLT12 message that read out of bounds, a SOCKS5 buffer overrun reachable through a gossiped hostname, unbounded peer feerates, and an onchaind that was never restarted after a reorg. The project still hasn't published an advisory, CVE identifiers or severity ratings.
Analysis
Revolut Gave Passports and Bitcoin Histories to a Fake Official
Revolut says someone using an email account on a real government agency's domain requested customer records, and the company sent them: identity documents, verification selfies, statements and transaction histories that include bitcoin. It has declined to say how many customers were affected, which agency's domain was used, or which market. Within two days, a group claiming to hold the files began threatening daily leaks; the reported 10,000 BTC demand is unverified. The FBI warned about this technique in 2024.
Analysis
$736,442 Left Chainflip Through Refunds for Swaps That Already Paid
Early on September 12 an attacker got Chainflip's Tron USDT route to issue refunds for swaps that had already paid out: six unauthorized payouts in about ninety minutes, with a seventh caught pending. Chainflip says the attacker attached a new memo to a validator-signed transaction. This desk read the public code: on Tron, Chainflip decodes swap instructions from the memo of any transaction that sends tokens to its vault, while on Ethereum a single vault contract call carries the money and the instruction together. The network is paused, and users are promised repayment.
Analysis
Ether.fi's Old Queue Could Only Rob Smart Wallets
On September 11 an attacker used a missing solver check in a legacy Veda AtomicQueue behind ether.fi's Liquid vaults to spend eleven wallets' standing approvals, taking 14.45 liquidETH and 7.05 USDC. Because the queue calls back into the named solver, only addresses with code could be drained. This desk read every victim on-chain: seven are EIP-7702 accounts, and nine of the eleven run Coinbase Smart Wallet's implementation. A plain wallet with a 482-liquidETH approval was never touched. All eleven were repaid within about nine hours.
Analysis
Hemi's Empty Claim Contract Still Says It Holds 124.5 Million Tokens
On September 7 an attacker re-entered Hemi's modified Genesis Drop MerkleBox 63 times through a fake lockup contract and drained about 124.5 million unclaimed HEMI, realizing roughly $255,000. The contract now holds zero HEMI, but its per-group ledger — read on-chain by this desk — still records 124,506,337.76, and the owners of those groups could have withdrawn the balances since September and October 2025. The first alert came an hour and 46 minutes after the last bridge-out. No audit of the claim contract appears in Hemi's public audit repository.
Analysis
46 Billion Synthetic Bitcoin Converted Into 4.39 Real Ones
Symbiosis halted BTC routing at about 04:28 UTC on September 11 after its BridgeV2 contract mishandled a signed message and minted roughly 262 raw units of syBTC with no Bitcoin behind it. Sources disagree on the token count — 46.1 billion per Blockaid, 368.9 billion across both chains per DefraudTG — but agree on the exit: 4.39 WBTC sold into Uniswap V4, about $336,000, with some 184.5 billion syBTC left unsold. The protocol has recovered about 15 BTC and offered the attacker 20% until September 13. The bridge had been audited by Decurity.
Analysis
Wormhole Is Closing a Way Out of Its Own Four-Day Quarantine
A pull request opened on September 10 adds a missing guard to Wormhole's notary, the component that holds a token bridge transfer for four days when the transfer verifier cannot clear it. Without it, a re-observed message could come back Valid, return Approve, and be signed before its release time. The path is reachable only through guardian-signed reobservation requests, the patch is still unmerged, and the notary itself ships switched off.
Supply chain
Two Wallet Makers, One Newsletter Vendor, and the Same Fake Alert
A phishing email warning of a "critical STM32 entropy vulnerability" went out from Trezor's own domain and passed every authentication check, because it was genuinely sent through Trezor's mail infrastructure. BitBox customers received the same message the same day; BitBox's preliminary read is that a newsletter provider shared by multiple bitcoin companies was breached.
Analysis
If Your Alby Hub Predates August 2025, Take It Off the Internet
Alby disclosed a critical flaw in its self-hosted Lightning wallet affecting versions v1.7.0 through v1.18.5, exploitable where the owner had made the Hub's management interface reachable from the open internet. An attacker could take the wallet over and send its funds. The first release without the flaw, v1.19.0, shipped on August 29, 2025 — more than a year before the warning — and Alby has not said whether that change was shipped as a security fix. One user is known to have been affected, a figure that counts reports rather than incidents.
Analysis
One Signature, Counted Twice, Emptied 2,321 Card Balances
An outdated Rain card contract on Solana required two independent approvals before collateral could move, then read the same attacker-supplied signature twice by pointing the second verification instruction back at the first. In roughly two and a half hours on August 28 the attacker registered itself as administrator on thousands of card-collateral accounts and withdrew about $1.1 million across four consumer card brands whose customers had never chosen Rain. Avici and Tria have refunded 2,321 users between them; Rain has upgraded the affected programs but has published no technical post-mortem.
Analysis
The 598 Bitcoin Nobody Will Call a Bounty
The parties who moved roughly 4,000 BTC out of the Liquid federation returned 3,400 of it on Monday — about 85 percent — after negotiating in public by writing messages into Bitcoin transactions. Roughly 598.5 BTC, worth around $47 million, stayed behind. Blockstream has not called it a bounty, disclosed any terms, or confirmed an agreement exists. Ledger CTO Charles Guillemet said that if the remainder was a reward negotiated over encrypted on-chain messages, it looked "more like extortion than white-hat hacking." The sidechain was still frozen as the federation prepared a coordinated restart.
Desk original
Set the Clock to 1970 and the Wallet Looks for Its Coins in 2149
lnd stores a seed's birthday as an unsigned 16-bit day count from the Bitcoin genesis block, and until a draft pull request opened on September 8 it converted that value without checking either bound. A machine whose clock reads before 2009 produces a negative count that wraps to a date in the twenty-second century — and the birthday is encrypted inside the 24 words, so it cannot be corrected afterward. The fix guards both ends: reject bad dates at creation, and clamp any future birthday to genesis on restore. It is a draft, nothing has been merged, and no loss of funds has been reported.
Analysis
Malware Moved Its Address Book Onto Polygon, Where Takedowns Don't Reach
Three vendor investigations published between late July and September 1 traced three distinct Polygon smart contracts holding the current address of a malware command server. One operator rewrote the pointer sixteen times in sixty-seven days; another linked twenty-six transactions across four contracts. Nothing in Polygon was exploited — the attackers are paying fractions of a cent to use a globally readable store that no registrar can seize. GuidePoint counts at least 31 compromised organisations, several cleaned and then silently re-compromised.
Desk original
Five Days Before Liquid's $320 Million Peg-Out, the Fix Was Already in Git
A commit titled "range proof cache bind to asset and scriptpubkey" reached Elements master on September 1 and both live release branches by September 3. On September 6, roughly 4,000 BTC left Liquid's federation wallet against L-BTC that had never been backed. The verifier already held the asset commitment and the destination script; it just never hashed them into the cache key. No tagged release contains the fix, and the project has published no security advisories at all.
Zero-day
A $1,000 Bounty Bought a Bug Attackers Were Already Using
A researcher reported a V8 type-confusion flaw on August 4 and was paid four figures. On September 3 Google patched it as the sixth actively exploited Chrome zero-day of 2026, and CISA listed it the next day with a September 18 federal deadline — the first browser zero-day handled under BOD 26-04, the risk-based directive that replaced the flat KEV clock in June. No link to crypto theft has been established, and the code execution stays inside the sandbox.
Update
After Weeks of Stillness, 20.5 Bitcoin Tested the Exit
Five weeks after the Coldcard theft, the wave-3 attacker moved for the first time — roughly 20.5 BTC into THORChain and out as ether. The swaps kept getting refunded and kept being retried, which is what a route test looks like rather than a cash-out. Over 90% of that wave is still sitting where it landed, and a researcher's bait wallet was swept as recently as August 28.
Unconfirmed
The Wallets Emptied. The Company Has Said Nothing
More than 600 wallets were drained on Friday and the proceeds consolidated into a single new address. The desk checked it: 1,147.94 ETH, funded 21 hours earlier, receiving cross-chain inflows through NEAR Intents and running as a smart account under EIP-7702. What is not established is whose money it was — the link to GoMining rests on shared token history, and the company has issued no statement.
Data exposure
Pocket Never Held a Coin. It Held the Map
A Swiss broker that structurally cannot touch customer bitcoin disclosed that an intruder in its support system copied records for 5,411 customers. For 291 of them the set included identity documents, postal addresses and the public Bitcoin addresses to go with them — a link that, unlike a password, can never be reissued.
Analysis
The Auditors Found It in 2020. They Marked It Low
Roughly $1.73 million left a dormant Notional V1 escrow because a fabricated debt of −2128 was cast into a 128-bit unsigned integer and read as zero. Two OpenZeppelin audits flagged that cast, naming the functions and the line numbers. The desk read the source: those lines still carry it, one statement above a SafeCast call the team did adopt.
Analysis
The Vendor Nobody Chose: How a Dashboard Bug Leaked Hardware-Wallet Buyers
A CVSS 10.0 SQL injection in Metabase — business-intelligence software, three companies removed from the customer — exposed 13,689 Trezor buyers through a fulfilment contractor, and up to 250,000 Bits of Gold customers through an analytics provider. Trezor's 90-day deletion policy did more for its customers than any property of the device.
Disclosed Aug 29
The Code Was Public for a Month. The Reason Wasn’t
Polygon fixed denial-of-service flaws in both of its clients, shipped them through two hard forks, and said so on August 29. The hardening itself had been readable on GitHub since July 27 — switched off, and unexplained.
Analysis
The Only Fix Was to Ask Everyone to Leave
Ajna V2 lost $775,400 to liquidation math; Balancer V1 lost $234,000 to a rounding error four days later. Neither contract can be patched — one immutable by conviction, the other by abandonment — and both teams reached for the same remedy, because it was the only one they had.
Developing
The Cause Is Still Unknown. The Label Went Up Anyway
Aquifer lost roughly $2.5 million and nobody has established how. The incident database that feeds the industry's loss statistics had already filed a mechanism against it — and it had an "Unknown" bucket it chose not to use.
Deadline Sep 11
In Ten Days, Silence Becomes a Reportable Event
From September 11 the EU's Cyber Resilience Act requires manufacturers to tell a regulator within 24 hours when a vulnerability in their product is being actively exploited. Crypto's habit of patching quietly was not built for that clock.
Developing
Efficiency Mode Did Exactly What It Was Built to Do
An attacker posted Ankr's liquid-staked FLOW as collateral, switched on the mode that rewards correlated assets with a thinner margin, and left with 15.5 million WFLOW. Nobody has yet said which part broke.
The month in review
The Contracts Held. The Prices Didn't
CertiK closed August at about $215 million. Code vulnerabilities account for $20.6 million of it — and two collateral manipulations account for almost the entire rest.
Security
$951 Bought the Votes. The Vaults Did the Rest
No reentrancy, no overflow, no forged signature. An attacker acquired voting control of a sparsely held governance token and moved $8.5 million out through the front door.
Developing
To Keep the Rest, Cronos Turned the Blockchain Off
An inflated governance token, a 20% collateral factor, and the chain's real assets borrowed against a price nobody was really paying. Then a hundred validators stopped making blocks.
Developing
The Chain Was Fine. The Foundation Wasn't
An unknown actor moved 400 million FOGO out of foundation wallets — 13.2% of the treasury meant to fund the project. Thirty hours on, no vector, and the reporting can't agree whether mainnet stopped.
Post-mortem
The Chains Learned From the Attacker First
A silent patch in a public monorepo, a downstream fork that read the commit, and $5.72M drained from six chains before the maintainer's first private warning went out.
Developing
Nothing Was Hacked. Moonwell Still Lost $8.7 Million
An inflated illiquid token, posted as collateral, borrowed against for real bitcoin. The contracts worked perfectly — that was the problem.
Disclosure
Two Machines Found the Same Bug. Then the Humans Started Arguing
A transaction-swapping race condition in Ledger's Ethereum app, patched in silence — until a rival's autonomous agent found it independently.
Contributed
The Safest Place in Crypto Just Got Robbed
An educator who lost 9 BTC to his own assumptions on why the device was never the security.
Developing
The Machines Found Real Bugs: Inside Core Lightning's Embargoed Emergency
AI-generated CVE reports proved real; a 14-day embargoed fix is rolling out. Upgrade — or --offline, not a shutdown.
Analysis
The Vault Got Robbed: What the $116M Coldcard Exploit Says About Everyone's Cold Storage
A 2021 firmware flaw, brute-forceable seeds, and the death of "buy a hardware wallet, you're done."
Breach
SafePal Breach Doxxes 39,798 Hardware-Wallet Buyers — Names, Home Addresses, Order Records
No coins touched; none needed. A verified owner list with home addresses is the phishing campaign's raw material.