Topic
security
85 stories
Bitcoin Core discloses three now-patched bugs, including a high-severity mining flaw
Bitcoin Core publicly disclosed three previously patched vulnerabilities on November 11, including a high-severity bug that could stop affected mining nodes from building valid block templates after a chain reorganization.
Bitcoin Core discloses three node-level bugs, all patched a year ago and sat on until the last vulnerable release died
Bitcoin Core disclosed three vulnerabilities on November 10, 2026 — two medium-severity and one high — all patched in October 2025 releases and held back until the last affected version reached end of life on October 27, 2026.
NEAR AI breach: SGLang flaw let attacker read user account details and live requests
NEAR AI says an attacker used a remote code execution flaw in the open-source SGLang inference engine to pull account details for about 100 users and access 18 legacy agents before access was contained.
Web3Auth says it drained vulnerable Keplr wallets before the hackers could — and is holding $5.6M
Consensys-owned Web3Auth says it exploited the same private-key flaw as an attacker to sweep roughly $5.6 million out of vulnerable Keplr wallets created with Google or Apple logins, and is now working with Keplr to return the funds.
Gnosis Pay Says Hackers Took Customer Data From the Card System It Was Already Shutting Down
Gnosis Pay says attackers accessed customer data on the legacy system behind its own-branded cards on Nov. 3, but has not disclosed how many users or what information was exposed.
Ethereum delays Glamsterdam hard fork after gas-rework audit flags broken invariants
Ethereum core developers have paused the Glamsterdam hard fork after ChainSecurity found projects relying on gas-related invariants that EIP-8037 and EIP-8038 would break.
Blockchain data contradicts Mercado Bitcoin's claim it "contained" its hack
Blockchain analytics firm Bitquery says a Mercado Bitcoin attacker kept draining customer deposit addresses for nearly four hours after the Brazilian exchange declared the breach contained, with losses it puts at $48.6 million across 11 chains.
Mercado Bitcoin's attacker kept draining wallets for hours after the exchange said it was "contained"
Blockchain analytics firm Bitquery says Mercado Bitcoin's attacker kept draining customer deposit addresses for about four hours after the Brazilian exchange declared the breach contained, with total losses now traced at $48.6 million across 10 chains.
Coinbase touts 99% cold storage as Binance says it has replaced 98% of its $6 billion-plus hack
Coinbase said it holds more than 99% of customer assets in offline cold storage and was untouched by the roughly $6.3–6.4 billion Binance breach, which Binance says it has already replenished by about 98%.
GitBook Reports AI-Agent Breach, Tells Users to Rotate API Tokens
Documentation platform GitBook says an attacker used AI agents to reach some of its infrastructure credentials on November 2, exposing API tokens and integration secrets and prompting urgent key rotations.
Binance blames fake job interview and internal AI tool for $6.3 billion breach
Binance's own incident report blames a months-long North Korea-linked campaign — a fake job interview and compromised internal AI tooling — for the roughly $6.3 billion theft, as it reopens withdrawals and says it has recovered most assets.
Binance publishes fresh proof of reserves, says 95% of record-hack losses replenished
Binance says it has completed a zero-knowledge proof-of-reserves snapshot for 10 assets and replenished about 95% of funds lost in a record $6 billion exploit, with withdrawals set to resume progressively from Tuesday.
BTCPay Server tells merchants to shut down after reports of drained hot wallets
BTCPay Server told merchants on November 1 to shut down their instances after reports that attackers gained admin access and swept bitcoin from internet-connected hot wallets; the project has named no loss figure or fix.
Chainalysis says an AI-assisted hacker accessed customer names and emails
Chainalysis disclosed that an AI-assisted hacker breached its systems this month and accessed non-sensitive customer data — names, emails, user IDs and role labels — while the firm separately tracks the roughly $6.3 billion Binance theft.
How attackers drained an estimated $6.3 billion from Binance — and why Washington is now arguing about it
Attackers stole an estimated $6.3 billion from Binance on Oct. 29 by compromising its hot-wallet signing infrastructure; investigators blame North Korea, and Binance says it will cover the losses in full.
Binance pledges $6.34 billion to cover losses from laptop-borne breach
Binance says it has set aside $6.34 billion of its own funds to cover losses from a Thursday breach it blames on a compromised DevOps laptop, as partners froze roughly $3 billion more.
Binance pledges $6.34B of its own funds after record $6.3B hot-wallet theft
Binance says it has earmarked more than $6.34 billion of its own money to make users whole after roughly $6.3 billion was drained from its hot wallets, the largest crypto theft on record.
Trezor warns CryptoBilis buyers to move funds after alleged implant found in a Safe 5
Trezor warned customers who bought hardware wallets from reseller CryptoBilis since March 2026 to move their funds after a disclosure alleged a cellular implant hidden inside a Safe 5 device.
Ledger confirms recovery-phrase implant in a wallet bought from reseller CryptoBilis
Ledger's security team confirmed an unauthorized hardware implant that captured recovery phrases in a wallet sold by Southeast Asian reseller CryptoBilis, amid a suspected but unverified $86 million in losses.
Binance hacker parks $1.4B in bitcoin across 19 wallets — and sits on it
An attacker who drained roughly 18,270 BTC (~$1.4 billion) from Binance split the haul into 19 wallets within minutes, and the coins hadn't moved as of Friday morning; blockchain firm TRM Labs tied the theft to North Korea.
Binance says $6.3B stolen in suspected breach; stablecoin issuers freeze funds and withdrawals halt
Binance says about $6.3 billion in crypto was stolen in a suspected Thursday breach, prompting frozen stablecoins, suspended withdrawals and over $1 billion in liquidations as bitcoin fell below $77,000.
Flash Loan Attacks Took $1.2 Billion From DeFi Over Four Years, Study Finds
A study in the Journal of Financial Crime counts 72 flash loan attacks that drained $1.211 billion from DeFi between February 2020 and July 2024, part of $6.568 billion lost across 254 exploits.
Polymarket freezes trading after third-party breach drains ~$2.7M from users — the second in five months
Polymarket halted trading on its international venue on October 29 after an attacker drained roughly $2.5 million to $2.7 million from user accounts, blaming a compromised third-party provider — its second such breach in five months.
Solflare's validator goes dark after a key breach at a firm it never named
Solana wallet Solflare said a security breach at an unnamed outside firm that held its validator's keys halted staking rewards on about 1.56 million SOL — roughly $160 million — and it has pledged to repay missed rewards to users who move to a new validator.
CoinDCX confirms $16M wallet drain two days after its CEO called the reports a 'false alarm'
Indian exchange CoinDCX confirmed a $16 million theft from deprecated deposit wallets on October 25, two days after CEO Sumit Gupta publicly dismissed breach reports as a "false alarm.
Bitcoin developers rework security practices as AI makes bug-hunting cheap
Bitcoin Core is revising its security disclosure policy as AI lowers the bar for finding software bugs, while a volunteer group called the Bitcoin Red Team hunts AI-assisted vulnerabilities across the ecosystem.
Initia halts its blockchain after reported token-minting exploit
Initia halted its Layer 1 blockchain and rollups on Friday after a security incident in which a researcher reported unlimited token minting; the team has not confirmed how much was lost.
Ledger Finds Cellular Implant in Reseller-Sold Wallets Tied to Suspected $86M Drain
Ledger says it found a hidden cellular implant inside hardware wallets sold by Southeast Asian reseller CryptoBilis that siphoned off users' recovery phrases, in what has been described as a suspected $86 million theft.
Ledger pitches a $900 Android "security phone" as the fix for a breach that already happened
Ledger announced Atom, an $849–$899 Android device that switches between everyday apps and a secure signing mode, pitched as a tamper-resistant answer to a reseller breach — but it won't ship until summer 2027.
Ethereum researcher calls for 'bunker mode' crypto migration, says AI could crack keys before quantum does
Ethereum Foundation researcher Justin Drake urged the blockchain industry to begin a precautionary migration of funds to unused addresses, arguing AI could break cryptographic keys before quantum computers do.
Coinbase pitches 'flexible' signature designs for Bitcoin's post-quantum migration
Coinbase published its technical priorities for Bitcoin's post-quantum migration, calling for flexible signature designs and parallel debate on abandoned coins ahead of any quantum-computing threat.
Ledger confirms seed-stealing implant in CryptoBilis-sold signers; MediaMarkt pulls devices in Europe
Ledger confirmed that hardware signers sold by reseller CryptoBilis were fitted with LTE implants that steal recovery phrases during setup, and MediaMarkt halted European Ledger sales after a German customer found a tampered unit.
Ledger Investigates Suspected $86M Drain Tied to Reseller's Tampered Devices
Ledger is investigating the loss of a suspected $86–87 million in customer funds after devices sold by a Southeast Asian reseller, CryptoBilis, were found to carry an implant that captured recovery phrases.
Ledger blames hidden 'spy chip' in CryptoBilis-sold wallets for recovery-phrase theft
Ledger says a covert chip hidden inside hardware wallets sold by reseller CryptoBilis read users' 24-word recovery phrases off the screen and beamed them to attackers over LTE; researchers estimate up to $93.2 million lost.
Ledger Pins Confirmed Wallet Drains on Reseller CryptoBilis as On-Chain Sleuths Trace $86M+
Ledger says every confirmed case in a wallet-draining incident that on-chain investigators peg at more than $86 million traces to devices sold by Southeast Asian reseller CryptoBilis, which has halted hardware sales.
Ledger confirms hardware implant in wallets sold by reseller CryptoBilis; researchers peg losses near $90M
Ledger confirmed an unauthorized hardware implant in at least one wallet sold by Southeast Asian reseller CryptoBilis, after on-chain researchers estimated $86M–$93M drained from more than 300 wallets.
Ledger probes Malaysian reseller CryptoBilis after wallets drained of up to $86M
Ledger says it is investigating its Malaysian reseller CryptoBilis after wallets bought there were drained of an estimated $72M to over $86M, and has ordered the reseller to halt sales.
Ledger Investigates Reports of Fund Losses Tied to Reseller CryptoBilis, as Investigator Traces ~$87M
Ledger is investigating reported fund losses among Southeast Asian customers who bought hardware wallets from reseller CryptoBilis, as an onchain investigator traces roughly $87 million in suspected thefts.
More than 6 million bitcoin sit behind exposed public keys, Glassnode data shows, as "bunker mode" warnings spread
Glassnode data cited by CoinDesk shows 6 million-plus bitcoin, 31.2% of supply, now sit behind public keys visible on-chain, as an Ethereum researcher urges "bunker mode" against hypothetical AI attacks on wallet cryptography.
SecondFi's hack-recovery portal offers ~$8 per lost NFT — and tells victims to type their seed phrase into a webpage
Cardano wallet firm SecondFi opened a recovery portal for victims of June 2026's $21 million exploit, offering a flat 30 ADA — about $7.60 — for each NFT it can't return, and advising users to enter wallet seed phrases into its website.
Ethereum's Justin Drake urges 'bunker mode' as he warns ECDSA could break in 'months not years'
Ethereum Foundation researcher Justin Drake urged holders to begin shifting funds to never-used addresses, warning that the ECDSA signature scheme behind Bitcoin and Ethereum could be broken in "months not years.
NEAR Intents halts trading after $3.8M exploit, pledges to make users whole
NEAR Intents paused its cross-chain trading service on October 1 after a smart-contract bug drained about $3.8 million, which an investigator traced to KuCoin and into bitcoin; the team patched the flaw and promised full reimbursement.
Bitget CEO says $388M attacker tested its risk controls with two tiny transfers first
Bitget CEO Gracy Chen says the attacker behind the exchange's $388 million exploit ran two small test transfers before draining hot wallets across eight chains on Sept. 24.
Bitget says ~$352M stolen in suspected North Korean hack; withdrawals paused
Bitget CEO Gracy Chen says North Korea's Lazarus Group likely stole roughly $352 million from the exchange's hot and warm wallets, with withdrawals paused and most losses covered by a protection fund.
Bitget says $352M drained from hot wallets, pauses withdrawals
Bitget CEO Gracy Chen said roughly $352 million was drained from the exchange's hot and warm wallets on September 24, and paused withdrawals while insisting cold wallets and user funds are safe.
CertiK Pins ~$2B of 2025 Crypto Theft on North Korea, or About 60% of All Losses
Blockchain security firm CertiK says North Korea–linked hackers stole about $2.06 billion in crypto in 2025 — roughly 60% of all theft losses — and $6.75 billion across 263 incidents since 2016.
Symbiosis recovers ~15 BTC after Bitcoin bridge exploit, dangles 20% bounty at attacker
Symbiosis says it recovered about 15 BTC after a Sept. 11 exploit of its Bitcoin Bridge minted roughly 46.1 billion unbacked syBTC, though security firms peg the attacker's actual take at about $336,000.
Revolut says attacker used a real government email domain to pry customer KYC and Bitcoin transaction data loose
Revolut says an attacker used a legitimate government agency email domain to submit fraudulent data requests, exposing affected customers' KYC documents and full transaction histories, including Bitcoin activity.
Blockstream refuses to pay ransom over $47M Liquid bitcoin hack: 'It is theft'
Blockstream has rejected a ransom demand tied to a hack of its Liquid network that took roughly $47 million in bitcoin, saying it will treat the loss as theft rather than pay for the coins' return.
Researchers cut a key quantum-attack benchmark for Bitcoin and Ethereum in half — with caveats attached
A crowdsourced challenge run through Eigen Labs' ECDSA.Fail cut the estimated quantum resources for a core step of a Bitcoin and Ethereum attack to roughly 1.5 billion, more than half below Google's March benchmark, though the two counts aren't strictly comparable.
Cronos Rolled Back Two Hours of Transactions to Undo a $111M DeFi Exploit
Cronos reversed a roughly $111 million DeFi exploit by rolling back about two hours of on-chain transactions, according to Decrypt — a move that overrode the ledger's normal immutability.
Coldcard-Linked Hacker Moves $7.7M in Bitcoin, About Half of a Third Tranche
A hacker shifted about $7.7 million in bitcoin — reportedly nearly half of a third batch of coins tied to a Coldcard-linked theft — while BTC traded near $79,400, per Decrypt.
Coldcard thief moves nearly half of 'Wave 3' bitcoin as total losses near 1,806 BTC
Galaxy Research says the attacker behind the Coldcard hardware-wallet thefts has moved 45% of the bitcoin taken in the "Wave 3" round, with total losses now put at roughly 1,806 BTC (~$143.9 million).
Trezor's ShipMonk breach balloons: 67,000 more customers exposed, records that should have been deleted
Trezor now says roughly 67,000 more U.S. customers had personal data exposed in a breach at its former shipping partner ShipMonk, far more than the ~14,000 it disclosed in August.
Ledger and OneKey trade claims over an Ethereum app bug that was already patched
Rival hardware wallet maker OneKey says it reproduced a transaction-replacement exploit against Ledger's Ethereum app version 1.22.1; Ledger says the flaw was patched weeks earlier and no user was affected.
StarkWare says it pushed through a quantum-resistant Bitcoin transaction — by going around the network
StarkWare says it executed the first Bitcoin transaction hardened against quantum attack, using brute-forced signatures that a MARA mining pool had to accept directly because ordinary nodes would reject it.
FOMO denies its iOS update drained user wallets; the accuser has a history
Crypto trading app FOMO's co-founder denies an X account's claim that an iOS update drained $6 million in user funds, as Protos finds the cited 662 SOL transfer is real but unexplained.
Maya Protocol Halts Network After Six-Bug Exploit Drains $1.4M in Bitcoin
Maya Protocol halted its network on Wednesday after attackers chained six separate bugs to take roughly $1.4 million in Bitcoin, per a Decrypt report; the team has not published its own accounting.
Crypto-stealing malware is riding pirated copies of 'The Odyssey,' Decrypt reports
Decrypt says illegal downloads of "The Odyssey" are bundled with wallet-draining software, but no malware family, indicator or loss figure has been published alongside the claim.
Israeli broker Bits of Gold says vendor breach exposed data on 200,000 customers
Bits of Gold says a hacker reached a third-party analytics vendor and took names, national ID numbers and bank details for roughly 200,000 customers — about 80% of its user base — with no funds or keys touched.
SafePal says 39,798 customers' names and addresses were exposed by an order-tracking flaw
Hardware wallet maker SafePal says an authorization flaw in an order-tracking plug-in exposed names, addresses and contact details for 39,798 customers who ordered between March 2025 and April 2026.
Trezor customer data exposed through a shipping partner, Decrypt reports — scope still undisclosed
Decrypt reported on August 13 that Trezor customer data was exposed via a third-party shipping provider, with the partner's identity, the affected record count and the data fields all still undisclosed.
Trezor customer addresses exposed in breach at shipping contractor ShipMonk
Trezor says a breach at logistics contractor ShipMonk exposed names and contact details of roughly 13,700 customers, including home addresses and phone numbers for 11,742 of them.
Harmony confirms unauthorized mint of 4 billion ONE, says it is weighing a rollback
Harmony says an attacker minted 4 billion ONE tokens without authorization; on-chain researcher Juiceberg estimates about 97% has already reached exchanges, and the token fell roughly a third on Wednesday.
Harmony says attacker minted ~4 billion ONE; token drops 26% as team weighs a rollback
Harmony's ONE fell about 26% on Wednesday after an apparent exploit minted roughly 4 billion tokens, and the team said it is pursuing exchange freezes, a patch and a possible chain rollback.
Coldcard seed bug drives a spike in new Bitcoin addresses as users flee 2021-era wallets
Coinkite users have lost at least 1,816 BTC — roughly $116 million — in four theft waves since July 30, traced to a 2021 firmware bug that generated wallet seeds with a weak software random number generator.
Immunefi puts July crypto hack losses at $110 million — and uses the occasion to market its audit competitions
Immunefi says crypto lost about $110 million to hacks in July and paid researchers $2.32 million, in a statement that also markets its own audit-competition product against rival auditors.
BTCPay Server warns of critical flaw under active exploitation; patch details not yet public
BTCPay Server has warned that a critical flaw in the self-hosted Bitcoin payment processor is under active exploitation, though no CVE number or patched release has surfaced in public reporting yet.
BTCPay Server tells users to patch or power down, citing an actively exploited critical bug
BTCPay Server told users on Aug. 7 to upgrade to version 2.4.2 or shut down their servers, saying a critical flaw is already being exploited and funds may be at risk.
Ethereum Foundation funds a front-end integrity tool built for journalists, aimed at wallets
The Ethereum Foundation's Trillion Dollar Security initiative is funding Freedom of the Press Foundation to build a WEBCAT front-end verification library for crypto wallets, though the announcement names no grant amount, timeline or committed integrators.
Coldcard's seed flaw is still live, and an exchange is already selling the moral
Coinkite says the entropy flaw behind up to $114 million in stolen bitcoin is still live and requires manual migration, while OKX claims the theft is driving record deposits to exchanges.
Fourth Coldcard sweep is running live, with estimated losses near $114 million
Galaxy's Alex Thorn says a fourth wave of sweeps against Coldcard-generated bitcoin addresses began Monday, putting estimated losses since July 30 near 1,816 BTC, or roughly $114 million.
Coldcard wallet drain reaches $88 million, per Decrypt — with the mechanism still unspecified
Decrypt reports that losses from an exploit hitting Coldcard bitcoin wallets have reached $88 million and are still climbing, with the attack vector and vendor response not yet specified.
CZ warns Bitcoin holders after reported $70 million Coldcard exploit
Decrypt reported on August 1 that Binance founder Changpeng Zhao warned Bitcoin holders after a roughly $70 million exploit involving Coldcard hardware wallets, with the attack path still unspecified.
Coldcard key flaw: third sweep takes 208 BTC, running total hits 1,367
A third sweep of wallets seeded by a flawed March 2021 Coldcard firmware build drained 208 bitcoin from 1,912 addresses, pushing the running total to 1,367 BTC.
Galaxy puts the Coldcard drain at 1,082 BTC across 1,196 wallets — roughly double the first count
Galaxy Research says an attacker swept 1,082.65 BTC from 1,196 Coldcard wallets in 41 minutes on July 30 by reconstructing weakly generated seeds offline, without touching a single device.
Crypto 'wrench attacks' hit 52 in first half of 2026, with money targeted up more than tenfold
CertiK recorded 52 crypto "wrench attacks" — physical assaults and extortion targeting holders — in the first half of 2026, with total money demanded or stolen jumping more than tenfold to $124 million, most of it concentrated in France.
Trezor executive concedes hardware wallets are "clunky" but rejects ZachXBT's "complete garbage" verdict
On-chain investigator ZachXBT called all hardware wallets "complete garbage" for high-stakes use; Trezor's commercial chief conceded the tools are "clunky" but rejected the blanket verdict, while Tornado Cash's Roman Storm sided partly with ZachXBT.
Ethereum Foundation: AI agents found real protocol bugs, but the triage is where the work is
Ethereum Foundation's Protocol Security team says coordinated AI agents found real bugs in protocol code, including a disclosed libp2p flaw, but that verifying the findings — not generating them — is now the hard part.
BitGo says it will ship quantum-risk tools for institutional Bitcoin wallets 'in coming weeks'
BitGo said Thursday it will roll out tools in the coming weeks to help institutions measure and cut Bitcoin wallets' exposure to a future quantum-computing attack, built on its existing multi-signature setup.
Bitcoin Core ships a test build to fix the privacy feature that leaked privacy
Bitcoin Core has published v31.1rc1 for testing, a minor release whose headline fix closes a privacy bug in the new private-broadcast feature that could leak a sender's IP address to a peer.
Bitcoin Core discloses a high-severity node-crash bug, CVE-2024-52911, fixed in version 29.0
Bitcoin Core disclosed CVE-2024-52911, a high-severity use-after-free bug that let a miner crash nodes running versions from 0.14.0 up to 29.0 by broadcasting a specially crafted invalid block.
Bitcoin Core discloses five patched vulnerabilities, including a high-severity remote-crash bug that lingered for eight years
Bitcoin Core disclosed five node vulnerabilities patched in earlier releases, led by a high-severity use-after-free crash bug that went unnoticed for roughly eight years.
Ethereum Foundation launches "Clear Signing" standard to kill blind transaction approvals
The Ethereum Foundation released ERC-7730, an open "Clear Signing" standard that gives wallet users human-readable descriptions of transactions to eliminate blind signing approvals.
Crypto theft dipped to $76M in June, with Humanity Protocol's $31M–$36M hack the largest single loss
Blockchain security firm PeckShield tallied about $76 million stolen across 40 crypto incidents in June, a 7% dip from May, led by Humanity Protocol's private-key breach.