Security news
-
Keystone breach deepens: Hackers stole key used to verify wallets as genuine
Keystone initially disclosed a leak of customer information but has since disclosed that hackers also stole a key that could allow counterfeit wallets to pass authenticity checks.
-
Keystone to destroy almost 19,000 wallets after device key leak
Keystone says it will destroy almost 19,000 unshipped hardware wallets after an attacker obtained the key it uses to verify its devices. First, Keystone took to X on Saturday to confirm a suspected breach of customer shipping information, including “names, contact details, shipping addresses, and...
-
Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers
A confirmed exploit let rogue servers replace Electrum’s pending transactions, tricking users into redirecting Bitcoin to attacker addresses.
-
India’s CoinDCX Confirms $16 Million Loss Days After CEO Called It a ‘False Alarm’
The Mumbai-based exchange says 15.99 million USDT was drained from wallets it retired after last year’s $44 million hack, bringing its combined losses to nearly $60 million—and it’s absorbing the hit.
-
PHP flaw shows AI ‘vulnerability apocalypse’ is on schedule: Immunefi CEO
Mitchell Amador warned internet users that websites could remain compromised for weeks, particularly smaller websites slower to adopt the emergency upgrades.
-
PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic”
▶ Bitcoin Magazine PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic” Government websites in France and Finland and hospital sites in the Netherlands are offline, Cloudflare is seeing attack traffic, and Britain's National Cyber Security Centre is telling organizations to pull systems if...
-
Researcher Cracks 'Steal My Bitcoin' Challenge With PHP Exploit
A 0.02511679 BTC prize was at stake, but the operator had to transfer it after discovering the server held the wrong wallet key.... Read the full story at The Defiant
-
Consensys Warns Ethereum Operators of eMudhra Signing Risks
The teams identify vulnerable Java trust stores and configuration-dependent exposure. Default setups are unaffected, while some Web3Signer deployments need immediate access-control changes.... Read the full story at The Defiant
-
Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments
Attackers replaced legitimate transactions with fake ones, then waited for users to approve higher fees. At least one person lost bitcoin before developers patched the flaw.
-
Foundation Links Passport Phishing Emails to Compromised Cloudflare API Keys
Recipients reported personal and purchase details in the messages; the company said Passport hardware and funds were safe.... Read the full story at The Defiant
-
Keystone says website breach exposed hardware wallet buyers’ addresses
A security researcher warned that the leaked shipping details could expose crypto holders to targeted scams and physical attacks.
-
AI agents help rescue ETH’s Glamsterdam fork, ‘Steal My Bitcoin’ site: Hodler’s Digest
Similar to the Hugging Face hack, Ethereum researchers have set up an AI Agent message board to help rescue the Glamsterdam fork. New site says ‘Steal My Bitcoin’... if you can.
-
CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a ‘false alarm’
CEO Sumit Gupta had told X users on Wednesday that early reports of a breach sounded like "a false alarm."
-
Keystone customers say breach exposed data the hardware wallet maker promised to delete
Keystone has said it deletes customer information 180 days after their orders in most cases, though X users have cast doubt on that claim.
-
X100 Exploit Proceeds Split Into Four 400-ETH Wallets
The first exploiter swapped about 4.75 million USDT into ether, while the distribution wallet retained another 423 ETH.... Read the full story at The Defiant
-
Keystone Website Breach Exposes Customer Addresses and Order Details
The hardware-wallet maker says it blocked access and fixed the vulnerability. Payment details, recovery phrases and private keys were not exposed, according to the company.... Read the full story at The Defiant
-
Electrum Patches Wallet Flaw Exploited Through Malicious Servers
A malicious server can substitute a fake payment, then trick the user into signing it while raising the transaction fee. Developers say one user reported losing money.... Read the full story at The Defiant
-
Block's new voice AI sounds eerily human, sparking awe and scam fears
Reactions split between amazement at how human it sounds and fears it could fuel scams and deception, with CZ eyeing uses in children’s education.
-
Third X100 Exploit Transaction Pulls 550,000 X From Uniswap Pool
A different sender routed about 549,916 X and 1,909 USDT to a new beneficiary, while the affected pool held less than 200 USDT.... Read the full story at The Defiant
-
X100 Exploit Nets 4.85 Million USDT After Governance Takeover
Two transactions turned treasury tokens and liquidity positions into USDT; Blockaid warned that the Ethereum attack was ongoing.... Read the full story at The Defiant
-
Initia halts blockchain after exploit reportedly drains over $2.6M
The blockchain suspended its layer-1 network and rollups after security researchers identified unauthorized token minting and millions in assets transferred to Ethereum.
-
Agora Says Initia Exploit Hit Third-Party Product Using AUSD
Ethereum records show 1.4 million AUSD left a bridge adapter, while Agora says it has no smart contracts deployed on Initia.... Read the full story at The Defiant
-
Bitcoin Core Rewrites Its Security Policy for a World Where AI Finds Bugs in One Prompt
Developers will now backport fixes and cut releases immediately for flaws flagged as “easily discoverable,” abandoning long embargoes for bugs an attacker can surface with a single AI prompt.
-
Agora Freezes AUSD Account Linked to Initia Exploit
Agora says it has no contracts on Initia; the targeted Ethereum account had already swapped 1.4 million AUSD for ETH.... Read the full story at The Defiant
-
Bitcoin Core Ends Long Embargoes for Bugs AI Can Rediscover
Bitcoin Magazine Bitcoin Core Ends Long Embargoes for Bugs AI Can Rediscover Bitcoin Core has changed its security disclosure policy to speed up fixes for vulnerabilities that large language models can find with little effort, ending the months-long embargoes those bugs once received. Maintainers...
-
Initia halts network after security incident as attacker reportedly mints tokens
Onchain data shows a $2.7 million ether transfer as Initia investigates the scope of a security incident.
-
Pump Fun’s Kimchi partnership has turned into chaos
A crossover token launch between prominent crypto trader Kimchi and memecoin platform Pump Fun has descended into chaos after users were left wondering whether or not Kimchi had been hacked. Pump Fun and Kimchi, real name Clayton Kim, have been working together to promote Pump Fun’s “Pill Your...
-
Initia Halts L1 and Rollups After Reported Mint Exploit
Analyst Spreek estimated $2.6 million had been cashed out; Ethereum records show stablecoin swaps and a later 1,135.5 ETH transfer.... Read the full story at The Defiant
-
Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor
Background SlowMist’s security team recently received user reports about a GitHub repository named sol-live. Presented as a Solidity interview practice project, its README lists eight questions and claims that each should take 5 to 10 minutes to complete, lowering users' guard. Upon analysis, we...
-
Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash
The attacker moved $744,000 in ETH and BNB to Tornado Cash after exploiting Cysic’s bridge to mint 10 million tokens on BNB Smart Chain.