attack

Cosmos ecosystem DEX Astroport stated that the attack event that occurred on Neutron may have led to the theft of administrator privileges for the Astroport contract. Neutron has suspended chain operations for investigation.Astroport advises users to withdraw liquidity from all Astroport liquidity pools.

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

According to the monitoring by the head of Galaxy Research, the Coldcard white hat funds will come from the merger of 52.37 BTC from Wave 2, Footprints AA, AU, and AX into a new address, which recorded the OP_RETURN message "claim:cryptorecoverytrust dot com" in block number 967,948.These white hat funds account for 2.8% of the Coldcard vulnerability attack funds.

According to on-chain analyst PeckShield (@PeckShieldAlert), the same attacker successively exploited vulnerabilities in the SingularityNET bridging contract to illegally mint 260 million AGIX and 53.83 million WMTx on Ethereum.Currently, the attacker holds approximately 16.77 million USD in crypto assets, including 198.3 million AGIX (approximately 14.42 million USD), 649 ETH (approximately 1.67 million USD), and 33.58 million WMTx (approximately 627,000 USD).

MultiversX announced that it has confirmed an attacker attempted to exploit atomicity issues at the virtual machine (VM) level of the mainnet, resulting in invalid state changes on the chain. To prevent further impact, the network has currently suspended operations. The engineering team has prepared a fix and is validating it in a shadow fork environment. If the tests are successful, they will coordinate with validation nodes, exchanges, and infrastructure partners to deploy the fix to the mainnet.Meanwhile, the team is evaluating a targeted recovery plan aimed at preserving the finalized transaction history and legitimate user states while only addressing the invalid changes related to this incident. Users do not need to take any action; they just need to wait for notifications regarding the restoration of normal operations. The official reminder advises users not to submit or rebroadcast transactions, and not to recharge or withdraw EGLD and ESDT through exchanges or cross-chain bridges.

According to Onchain Lens monitoring, an attack cluster transferred approximately 1.54 million dollars' worth of FET from Fetch AI's token converter on Ethereum.The cluster also received approximately 452,000 dollars in newly minted NTX from Nunet Global deployers. As of now, the total confirmed amount involved is approximately 2.01 million dollars.

According to on-chain detective Specter monitoring, the attackers of this activity provided so-called arbitrage bot tutorials and code through YouTube videos, guiding victims to compile and deploy contracts using a counterfeit Remix development interface.The attackers registered an ENS name containing "Uniswap," disguising the related address as a legitimate source of income for DeFi activities, leading victims to mistakenly believe that the deployed arbitrage bot was profiting through Uniswap. After victims injected their own assets into the contract, the funds were transferred away by the attackers. The attackers currently seem to still be active and hold a significant portion of the stolen funds across two addresses.

The Chief Information Security Officer of Slow Fog, 23pds, posted on platform X stating that the black and gray industries have established an attack chain against iOS users: clicking on links to extract private keys and mnemonic phrases; when users access web pages using Safari, they gain JS layer read and write capabilities through WebKit/JSC memory corruption; bypassing PAC to obtain native call capabilities; escaping the WebContent sandbox; escalating privileges in the kernel to gain root access, stealing Keychain and wallet data.The affected versions are iOS 13 to 26.5, and it is recommended that iOS users upgrade as soon as possible.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

According to The Wall Street Journal, Google's Gemini model autonomously attacked the systems of three companies during cybersecurity testing, marking the first known instance of Google AI executing such behavior independently.

According to CoinDesk, the crypto technology provider Haruko was targeted in a cyber attack earlier this week, affecting 15 clients. The attack exposed clients' read-only exchange API details and trading data. According to insiders, some hedge fund clients with weaker security protections may have had a small amount of funds stolen.Adam Carlile, co-founder and Chief Technology Officer of Haruko, stated in an email sent to clients that this was a targeted attack initiated by an organization, and the affected clients were all non-whitelisted clients. The attackers exploited a vulnerability in one of Haruko's processes to extract user access tokens, thereby obtaining data such as read-only exchange API information stored in process memory; clients' login credentials were not compromised. Haruko has fixed the vulnerability and refreshed the server-side keys, and plans to release a complete technical review report.Based in London, Haruko provides portfolio, risk management, and trading data infrastructure for institutional digital asset companies. The platform connects centralized exchanges, custodians, blockchains, and DeFi protocols, currently serving over 80 clients globally and integrating with more than 100 centralized trading platforms, 30 blockchains, and 250 on-chain protocols. Its listed clients include Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, among others, with GSR stating that it was not affected by this incident.

The DeBot team member Cat released a security incident progress announcement, confirming that the previous wallet security incident was an APT (Advanced Persistent Threat) attack, and no related financial losses have been found so far.The announcement stated that after analysis by multiple security teams and cloud service providers, there are signs of system intrusion, and the related private keys still pose a security risk. Therefore, the platform will continue to implement automatic fund isolation. Currently, DeBot is operating in a fully isolated environment, and users can still trade and withdraw normally, but other operations involving private keys have been suspended and will be gradually restored after the security audit is completed. A brand new security solution is being upgraded and is being audited by the Slow Mist team and cloud service providers. DeBot stated that this incident exposed security issues within the project, and the team will further upgrade security measures.

According to a joint alert issued by the Japanese National Police Agency, FBI, ASD/ACSC, BND, and BfV, the North Korean-backed cyber attack organization "WaterPlum" (also known as Contagious Interview) targets job seekers by disguising itself as an AI, cryptocurrency, and NFT company to post fake job listings. This lures job seekers into downloading NPM packages containing malware such as BeaverTail, InvisibleFerret, and OtterCookie, which then steal cryptocurrency wallet information and confidential data.As of July 2026, the organization has infected over 30,000 devices in more than 100 countries and regions worldwide, stealing information from over 7,000 cryptocurrency wallets, with the wallets under its control receiving at least approximately 1.7 billion yen (about 10.71 million USD) in cryptocurrency. The Japanese National Police Agency has discovered and dismantled a "notebook farm" established by local "supporters" for the first time in the country, where North Korean IT laborers remotely control PCs within the supporters' residences to conduct business, with the related amount involved reaching several hundred million yen.The police and FBI assess that WaterPlum and some North Korean IT laborers are under the unified command of the 313 Bureau of the Ministry of Military Industry of the Workers' Party of Korea, with the profits directly flowing into North Korea's national funding pool. The police remind IT technicians and corporate issuers to remain vigilant and avoid executing third-party code in unverified environments.

Ethereum developers warn: Attackers can exploit free testnet ETH and one-time builder identities to win Sepolia block auctions and withhold transaction payloads during the Glamsterdam testing period.This attack does not threaten mainnet funds but may disrupt infrastructure testing. The Sepolia public test is scheduled to launch on October 6, with the Hoodi test tentatively set for October 27, and the mainnet activation time is still undetermined.

According to Blockaid monitoring, Flamingo Finance was attacked. The attacker borrowed approximately 18 million USDT through Morpho flash loans, staking Curve USDP LP into the Strategy during the transaction to inflate the price of VaultYUSDT shares, and then redeemed liquidity aUSDT.Currently, the attacker has realized a profit of approximately 345,900 USDT.

According to SlowMist monitoring, a Brazilian banking malware operation, active since at least May 2025, known as REF9334, has recently been disclosed. Its KREMLIN malware ecosystem uses a multi-stage loader and malicious browser extensions to steal credentials, session tokens, and sensitive data. The malicious extensions can be installed into Chrome and Edge without user approval by bypassing the Chromium integrity mechanisms, including Secure Preferences, HMAC, and App-Bound encrypted hashes.The operation also uses Ethereum smart contracts as "dead letter parsers" to dynamically update C2 endpoints and payload hosting locations. After registering the network Canary domain name, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. SlowMist recommends that security teams monitor related malware, browser extension activities, and infrastructure associated with this operation.

According to Bitcoin News monitoring, JAN3 stated that its newly launched exchange infrastructure Indra experienced a denial-of-service attack, and the team temporarily disabled forward exchanges during the investigation. Ongoing exchanges may experience delays.Indra, developed by JAN3, aims to replace Boltz in Aqua, allowing users to transfer Bitcoin between Lightning and Liquid, but Liquid anchoring operations are still restricted.

An MEV bot named Yoink on Ethereum front-ran an exploit attack targeting the Safe wallet, which PeckShield referred to as an approximately $7.81 million rsETH attack. On-chain records show that the Yoink transaction received 2,900 rsETH and sent 2,882.37 rsETH to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, which currently has a balance of 2,882.36740883 rsETH.The same transaction also sent 17.63 rsETH to the Uniswap v4 Pool Manager, which sent 18.95 ETH to the Yoink contract, which then transferred 18.93 ETH to the block builder. The Yoink transaction and the original attack transaction both occurred in Ethereum block 25980525, with the Yoink transaction at the top of the block, and the original transaction executed a rollback, consistent with the front-running judgment of security researchers.BlockSec attributed the vulnerability to a flaw in the authorization checks of the executor contract associated with the enabled Safe module, allowing calls controlled by the attacker to be executed through a trusted executor. Blockaid stated that the attacker exploited a public keeper multi-call to direct a custom Uniswap v4 liquidity module to a hook pool created by the attacker, which subsequently unpacked aEthrsETH into rsETH.

The managed cross-chain bridge Long released a post-mortem report on the WETH hacking incident on September 14. On that day at 07:07 UTC, the bridge paid 46.7928 WETH (approximately $118,000) to the attacker's address from the Robinhood Chain treasury. There were no user fund losses, and the treasury has been fully replenished from platform revenue. The bridge has been rebuilt, reinforced, and continues to operate. During the recovery period, some orders were delayed by several hours.The bridge's keeper read the burn events on Arc via RPC to release assets. At that time, the official mainnet endpoint was not online, relying on public RPC. After the backup endpoint was overloaded, the main endpoint provided the keeper with forged withdrawal event logs within a short window, which did not exist on Arc. The keeper's protection at that time was against replay and double spending, and did not question the data source, thus releasing the WETH. Meanwhile, three other forged withdrawals were completely reverted on-chain. The forged events entered through the RPC channel, and the contract, keys, and treasury were not breached.