attack

Keystone hardware wallet announced that the Nexus App recently experienced a network attack, causing some users to be unable to use the app normally for a period of time. The team has responded quickly and strengthened server security. According to the current investigation results, no evidence has been found that user assets or personal information have been affected.Nexus App version 1.3.7 has further strengthened security measures and is now available on Google Play, while the iOS version is still awaiting App Store review. The official recommendation is for users to update as soon as possible and to confirm that the app developer is "Yanssie HK Limited" before installation to guard against counterfeit applications. Before the iOS version goes live, users can use third-party wallets supported by Keystone for signing.

According to Loopscale monitoring, the platform has restored the priority loan function, and all loans can have additional collateral; except for loans funded by the USDC Genesis Vault, all other loans can be repaid, and borrowers can retrieve their collateral after full repayment. The collateral withdrawal function for loans related to the USDC Genesis Vault remains temporarily closed, and treasury withdrawals and other protocol functions continue to be restricted.The team is working with partners to advance the security recovery efforts. Loopscale stated that it has identified and controlled two paths exploited by the attackers during this incident. The attackers first exploited a misconfiguration of asset pricing parameters, leading to collateral deposited in the SOL Genesis Vault being incorrectly valued as another asset, resulting in approximately $412,000 in under-collateralized loans. Subsequently, the attackers sold a loan with abnormally high interest rates to the USDC Genesis Vault through atomic transaction combinations, artificially inflating its net asset value (NAV) and extracting approximately $521,000 in redemption funds; this operation was intercepted by the system within 30 seconds after the transaction was generated. Loopscale stated that user deposits will not suffer losses as a result.

The Indian Computer Emergency Response Team (CERT-In) issued a security advisory stating that the hacker group "Crafty Falcon" is utilizing publicly available artificial intelligence tools to conduct high-speed automated intrusions, having breached non-bank lending institutions, fintech companies, and cryptocurrency exchanges. The agency described the related threats as "ongoing and persistently active."The advisory specifically named four intrusion tools: ARTEX, PentAGI, Cairn, and CyberStrikeAI. Cybersecurity researchers indicated that at least two of these tools are associated with China. CrowdStrike previously stated that ARTEX, developed in China, has been used to attack South Korean banks since the end of September, and a hacker group linked to China has used this tool to target over 200 organizations in at least 14 countries. CERT-In did not specify the attackers or the operational location of the group, nor did it state that the attacks were state-sponsored or led; all of the aforementioned tools are available for free.

The cryptocurrency derivatives trading tool platform SignalPlus announced that it was attacked in the early hours of November 4, originating from a third-party Telegram account that was hacked, affecting a small number of accounts that had not enabled IP whitelisting.The team stated that they quickly identified and controlled the intrusion. As a precautionary measure, they have revoked all associated API keys with their centralized trading platform partners and temporarily suspended terminal services. The official statement indicated that the total loss was less than $82,000, and affected users will receive full compensation. They expect to fully restore services in the coming days, with subsequent updates and operational guidelines to be released through official channels.This evening, Binance also issued a statement indicating that it has taken precautionary measures regarding the potential security issues reported by the third-party platform SignalPlus, actively revoking all API keys associated with SignalPlus.Binance emphasized that its own system was not affected and that user funds are secure. Binance reminded SignalPlus users to log directly into their Binance accounts to check their positions and open orders, and not to rebind API keys until the issues with SignalPlus are completely resolved. They also advised to always enable IP whitelisting.

According to GCSA monitoring, the Global Cybersecurity Alliance (GCSA) has released three independent technical investigation reports, disclosing several recent security risks related to digital assets. Attackers impersonated security@ku.com to lure users into downloading remote control programs. GCSA found that the relevant domain names had not previously configured DMARC; after notification, KuCoin has completed rectification and enabled DMARC isolation policies.After the original MCP toolkit referenced in Bitkub's official documentation was taken down, a third party re-registered the npm package name. The installation method without a fixed version and the risk of plaintext keys may lead to credential leakage; there is currently no actual evidence of theft, and Bitkub has not yet responded to the notification.The TranchePool treasury within the Avalanche ecosystem was attacked due to a cross-day settlement logic flaw, where attackers utilized flash loans and repeated withdrawals to transfer approximately 1.0134 million USDC within 202 seconds. This incident is categorized as a vulnerability in the upper application, and the underlying network was not affected. GCSA stated that it has reported the clues to the relevant platforms and published the original analysis and evidence for industry reference.

GitBook released a security incident review on November 2, stating that attackers exploited a vulnerability in its single sign-on process to forge employee login sessions, allowing them to query improperly configured GitHub App authentication information within the organization, access internal code repositories, and obtain Cloudflare API keys, ultimately gaining full production environment permissions through service accounts.GitBook disabled the relevant internal service accounts to cut off the attack within hours, resulting in the platform being offline for approximately 16 hours, and fully restored on November 3 at 11:56 UTC. The attackers remained in the production environment for a total of about 3 hours and 25 minutes. GitBook has rotated all infrastructure and revoked customer keys and API tokens.GitBook stated that current indications show the attack targeted a single customer rather than the platform as a whole, and no other customer content has been found to be tampered with. However, since the attackers could access customer data within the platform, they are treating it as if all customer data may have been exposed, including API tokens, integration keys, session signing keys, assistant Q&A records, and authorized repository permissions for GitHub and GitLab applications. Billing information, passwords, and IP addresses were not affected.GitBook noted that the speed and precision of the attack heavily relied on automation and AI. Slow Mist's Chief Information Security Officer 23pds forwarded the review, stating that the targeted entity was Trade.xyz. Trade.xyz previously indicated that the document anomaly stemmed from an intrusion into GitBook's infrastructure, and there were no signs of their own infrastructure being compromised, and they will migrate away from GitBook within a few days.

The Solana-based lending protocol Loopscale stated that it has been continuously targeted by attackers over the past week, with the protocol's API receiving more than 30,000 malicious requests daily, but all user funds deposited are currently safe.After the security system detected a significant escalation in the attacks, the team quickly suspended protocol activities to mitigate the impact. The attack attempts primarily targeted the SOL and USDC Genesis Vaults, and the related vaults have been replenished, with no losses reported for user deposits.Loopscale stated that it will not resume normal operations until the scope of the attack is fully clarified and further security enhancements are completed. The protocol interface will be reopened soon, and the repayment function will be restored as quickly as possible to reduce the risk of unexpected liquidations. The team has disclosed four associated addresses and stated that it is working with federal law enforcement and security professionals, and will continue to release important updates.

The French mutual credit bank Akeia was attacked by hackers, and some of the stolen funds have been intercepted. The hackers transferred money through bank accounts and exchanged it for cryptocurrency, with the involved funds possibly exceeding 100 million euros. The Paris prosecutor's office has launched an investigation.

According to a report by Reuters, after Binance suffered a $6.3 billion hacking attack last week, the U.S. Federal Reserve and the Office of the Comptroller of the Currency (OCC) began contacting banks on Monday to inquire whether their systems had experienced any unusual activity or service disruptions, in order to assess the risk of security incidents in the cryptocurrency market spreading to the traditional financial system.Insiders stated that several banks are conducting security diagnostics on their internal systems and evaluating whether there are vulnerabilities that similar attack methods could exploit. The cybersecurity team of a major U.S. bank has contacted Binance and is in the process of drafting an internal report, which may lead to a review of systems and updates to cybersecurity measures.Binance stated that it is currently maintaining close contact with global regulators and promptly reporting on this security incident. The Federal Reserve and OCC declined to comment. Insiders also pointed out that the rapid evolution of AI models has increased the difficulty for banks to defend against hacking attacks, and banks are investing significant resources to review and patch cybersecurity code.

TenArmorAlert posted on platform X stating: Its system detected a suspicious attack involving the TENDRIL/USDT pool on BSC, resulting in a loss of approximately $309,000.

India's CERT-In stated that an attack activity named CRAFTY FALCON is escalating, with attackers stealing cryptocurrency wallet keys and transferring funds.

On November 4, the French banking group Crédit Mutuel Arkéa announced details of a previously disclosed theft of funds revealed by ZachXBT. The bank stated that the attackers gained access through a platform of an unnamed third-party service provider, and then used the bank's own accounts to transfer funds to other financial institutions, with the related funds potentially being exchanged for cryptocurrency through specialized platforms.The bank denied that the attack entry point was located in its online bank Fortuneo and stated that customer assets were unaffected. Regarding the previously reported stolen amount of approximately 118 million euros (133 million dollars), the bank did not confirm the specific figure but acknowledged its magnitude, with some funds already frozen and the final loss still being assessed.

The founder of cryptocurrency exchange BitMart, Sheldon Xia, stated that the company's security team is currently severely understaffed. Employees are threatened and former employees are suspected of retaliation, making it more difficult for technical staff to stay; he mentioned that the team is still doing its best to protect data and assets.Blockchain analytics company Bitquery identified approximately $391,000 in suspected transfers from wallets related to BitMart, involving three blockchains. Bitquery stated that the funds are flowing to a wallet also involved in the attack on the Brazilian trading platform Mercado Bitcoin.

According to French media Cryptoast, France's Crédit Mutuel Arkéa has confirmed that it was attacked, and someone used this to conduct fraudulent transactions. The bank stated that the incident has been brought under control, and customers have not suffered any financial losses, but the amount of the losses has not been disclosed.Earlier reports indicated that analysts pointed out that the online banking service Fortuneo under the group may have suffered fraud losses exceeding 133 million dollars, with funds being laundered through cryptocurrency channels.

Binance CEO He Yi once again responded to discussions regarding security incidents and internal device management, stating that the rule against personal use of work computers in the employee code is to prevent hacking, and there is strict monitoring on downloads. This year, over 50 attacks have been intercepted.He Yi stated that offense and defense is a continuously evolving process, and the failure of this monitoring was due to hackers also evolving.

Binance founder Zhao Changpeng retweeted a lengthy statistical article regarding public opinion on Binance, stating that this is "another attack against Binance." The statistics cover approximately 78 hours from October 30 to November 2, during which 1,083 accounts posted 11,700 hostile messages about the Binance hacking incident, garnering approximately 20.93 million exposures, of which 3,354 were deemed false information.The statistics show that the related narratives shifted with Binance's official response points, including "insider," "insolvency," and "afraid to withdraw." Among the 641 most active accounts, 452 had collaborative associations; 89% of the accounts rarely mentioned Binance, with posting frequency during the incident rising to 24.6 times the baseline. During Binance's withdrawal recovery phase, mobilization posts such as "immediate withdrawal" and "bank run" reached a peak of 11.2 posts per hour.

The founder of the cryptocurrency exchange BitMart, Sheldon Xia, announced the closure and is advancing the restructuring and liquidation process. He confirmed that BitMart also suffered a hacker attack yesterday, with a relatively small amount involved. The team has quickly launched an investigation and strengthened security defenses.Preliminary investigations indicate that yesterday's hacker attack may have been carried out by the same organization that attacked the Brazilian Bitcoin market Mercado Bitcoin yesterday.

The founder of the blockchain security company Slow Mist, Yu Xian, posted on the X platform stating that many people, after watching the disclosure of the theft process by Binance, believe that the involved engineer made basic mistakes and had excessive permissions.Yu Xian indicated that such incidents belong to Advanced Persistent Threats (APT), involving human exploitation, intelligence reconnaissance, evasion of malicious code, trust chain exploitation, targeted lateral poisoning, cloud environment penetration, risk control bypass, and 0-day vulnerabilities, among other aspects. One cannot only focus on the initial social engineering phase.

According to market news, TenArmorAlert stated: its system detected suspicious attacks involving the InsurancePool and CoreVault contracts on BSC, resulting in a loss of approximately $112,300.

According to Bitcoin.com News, Brazilian cryptocurrency exchange Mercado Bitcoin disclosed on November 2 that it experienced a security incident, with approximately 38 million dollars in digital assets stolen. Additionally, Arkham Intelligence analyst Emmett Gallic estimated that the suspicious transfer amount exceeded 46 million dollars, and these two figures have yet to be verified.The exchange stated that users would not suffer asset losses due to this incident. The platform has suspended deposits, withdrawals, and platform services, and has notified the relevant authorities. Preliminary analysis indicates that the attackers may have controlled the transaction authorization signature credentials. According to Bitquery analysis, the suspicious transfers involved multiple chains including Ethereum, Bitcoin, Solana, Stellar, Arbitrum, Tron, and Polygon, with the specific method of intrusion yet to be determined.Mercado Bitcoin stated that it has collaborated with Tether, Circle, Paxos, BRL1, and Chainalysis to freeze 11 million dollars in assets and has identified other funds that can be frozen. The platform has not yet announced a specific time for restoring services.