GCSA disclosed KuCoin phishing, Bitkub supply chain risks, and Avalanche contract vulnerabilities: attackers transferred approximately 1,013,400 USDC

According to GCSA monitoring, the Global Cybersecurity Alliance (GCSA) has released three independent technical investigation reports, disclosing several recent security risks related to digital assets. Attackers impersonated security@ku.com to lure users into downloading remote control programs. GCSA found that the relevant domain names had not previously configured DMARC; after notification, KuCoin has completed rectification and enabled DMARC isolation policies.

After the original MCP toolkit referenced in Bitkub's official documentation was taken down, a third party re-registered the npm package name. The installation method without a fixed version and the risk of plaintext keys may lead to credential leakage; there is currently no actual evidence of theft, and Bitkub has not yet responded to the notification.

The TranchePool treasury within the Avalanche ecosystem was attacked due to a cross-day settlement logic flaw, where attackers utilized flash loans and repeated withdrawals to transfer approximately 1.0134 million USDC within 202 seconds. This incident is categorized as a vulnerability in the upper application, and the underlying network was not affected. GCSA stated that it has reported the clues to the relevant platforms and published the original analysis and evidence for industry reference.