attacker

According to Onchain Lens monitoring, Avici was attacked, resulting in a total loss of approximately $1.02 million. The attacker transferred 10,000 SOL to another wallet and exchanged it for about 1.02 million USDC, then transferred it through a cross-chain bridge and exchanged it for approximately 418 ETH.

Solana's new bank Avici is facing ongoing attacks, with attackers having stolen over $1 million from users. The attackers' wallet holds 10,005.03 SOL (approximately $1.07 million) and about $11,600 in USDC and USDT. The attack method involves first calling the SubmitSignatures of the Avici authorization program, then calling the AddCollateralAdmin of the collateral program, and finally executing WithdrawCollateralAsset to withdraw the balance. Both of Avici's programs are upgradable and share the same standard Solana account instead of multi-signature upgrade permissions.Avici confirmed the incident 1 hour and 53 minutes after the first theft transaction, stating, "We are aware of the issue affecting card balance withdrawals and are working directly with all relevant partners to resolve it." Prior to this, users had reported stolen balances on social media. A real-time tracker established by anonymous on-chain analyst STACC recorded 125 different sending accounts, with transfer amounts ranging from approximately 9 USDC to over 26,000 USDT.As a result, the AVICI token fell 49.4% in 24 hours to $0.2175, with a market cap of approximately $2.84 million, hitting an all-time low. Avici raised funds through MetaDAO in October 2025, with an original cap of $3.5 million, but the final committed amount reached $34.2 million, and the team refunded 89.8% of the committed USDC.

Enjin's ERC-1155 "Crypto Items" allows each item to route transfers through a dedicated item adapter. Attackers register and use malicious transfer adapters to bypass owner approval checks, allowing their vulnerable contracts to extract ENJ-supported items from about 52 unrelated holder wallets without approval via transferFrom.Subsequently, the attackers call melt() on each stolen item, redeeming 500 ENJ for each item from the platform's reserves.

Bubblemaps posted on platform X that attackers exploited a vulnerability in the Cosmos EVM shared module to steal $50 million worth of NES tokens, but ultimately only profited about $60,000. Previously, Cosmos Labs reported security vulnerabilities in its shared Cosmos EVM software, affecting multiple chains built on this module, including Nesa.According to disclosures, the main attacker with an address starting with 0x9AE7 previously spent $250,000 to purchase NES and cross-chain to Nesa Chain, then exploited the vulnerability to inflate the account balance by 200 times and transferred $50 million NES back to Ethereum, with the initial funds coming from Monero. The attacker then dispersed the tokens to multiple wallet addresses, exchanged NES for ETH on a DEX, and deposited the profits into a centralized exchange.Due to the rapid withdrawal of funds from the liquidity pool, most of the attacker’s exchange transactions encountered severe slippage, resulting in an actual expenditure of $255,000 to initiate the attack, cashing out only $315,000, with a net profit of about $60,000.Bubblemaps stated that although another Cosmos EVM chain had also suffered a similar attack of $1.4 million the day before, the differences in funding sources and operational methods suggest that the two incidents may have originated from different attackers. The report also mentioned that the price of NES tokens once plummeted by 90%, but has since significantly rebounded, with the team believing that the rebound is mainly due to arbitrage activities caused by price mismatches between DEX and CEX after the attack.

According to monitoring by PeckShield, the Term Labs attacker's address deposited 300 ETH into Tornado Cash, worth approximately $741,000.

The KITE Foundation reports on the progress of the token security incident disposal. A new KITE ERC-20 contract has been deployed on the Ethereum mainnet, with the total token supply remaining unchanged. Old KITE tokens will be migrated to the new contract at a 1:1 ratio, and it has been confirmed that addresses controlled by the attacker will be excluded and will not receive new tokens.The migration snapshot is based on the Ethereum mainnet block height of 25,692,498. Regular self-custody wallet users will directly receive new tokens without the need for exchange or authorization; exchange users will have their migration coordinated by the exchange and the KITE team. The cross-chain channel will remain suspended until the migration and verification are completed. Previously, KITE discovered abnormal transfers on August 6 and confirmed that it had been hacked. The team stated that this incident did not result in asset losses for users or the project party, and the current impact has been controlled.

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.

According to monitoring by Bitcoin News, new research published by @PraveenPerera shows that Coldcard attackers seem to first identify addresses with vulnerabilities, then sort them by the amount of Bitcoin held, starting to transfer in batches from the addresses with the highest holdings. The transfer software used was relatively crude.One address had 225 spendable UTXOs, and the attackers extracted exactly the latest 200, leaving the earliest 25, which included a UTXO worth 0.16 BTC. This aligns perfectly with the limitation of a blockchain API investigated by researchers, which defaults to returning 200 records, indicating that the attackers may have failed to load the next page of data. The software even spent a UTXO of 294 satoshis, reportedly increasing the transaction fee by about 2040 satoshis, with the spent amount significantly higher than the value of the UTXO itself.The authors of the study believe that the builders of this tool may have a better understanding of the account balance system than of the Bitcoin UTXO model. Although the attackers seem to have obtained the complete seed of the victims, at least 75 BTC still remain in other addresses derived from the same seed. The biggest suspicion currently is that among the 153 stolen addresses, there are still 132.95 BTC, and researchers have been unable to reproduce the seed behind these addresses, so it cannot be ruled out that the attackers obtained undisclosed private device data or candidate data.

According to on-chain detective Specter, the attacker exchanged all assets including WBTC, cbBTC, LDO, USDS, and CRV for DAI and ETH. The same wallet was previously hacked in September 2023 due to malicious token authorization, resulting in a theft of 24.23 million USD, with the attacker ultimately returning about 90% of the stolen funds. The attacker's address is 0x8fEB...F95Ae.

According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) software after attackers exploited a serious vulnerability to obtain credentials and transfer funds.BTCPay stated that this restriction prevents external wallets like Zeus from connecting through the BTCPay Server domain. BTCPay mentioned that Lightning payments can continue, and they plan to restore remote access options when they deem it safe.

According to Onchain Lens monitoring, addresses related to the Solana OG attackers (0xd229...9D15, 0x501...f051) transferred 2,290 ETH to Tornado Cash, worth 4,390,000 USD.This operation occurred nearly a month after the involved $14.2 million attack incident; the same address cluster also used Tornado Cash two weeks ago.

According to on-chain detective Specter, the same attacker is running similar phishing activities targeting Ledger. The relevant screenshots were taken two days ago, and the sponsored advertisement has now been removed.As of now, these activities have stolen over 3 million dollars.

According to Shield's monitoring, the wallet address marked as the attacker of the Aztec Network Private Rollup Bridge has deposited 300 ETH into Tornado Cash again, worth approximately $572,000. So far, the attacker has transferred a total of 500 ETH to Tornado Cash.Previously, Aztec Network suffered a security attack in June 2026, resulting in a loss of approximately $2.165 million in crypto assets. This transfer of funds may further complicate the tracking of the stolen assets.

According to GoPlus monitoring, a user on the Base chain lost 500,000 USDC due to a phishing attack. When the attacker exchanged the stolen funds for WETH, the script did not set slippage protection, routing to a Uniswap V4 WETH/USDC pool with almost no liquidity, resulting in only 67.9 ETH (worth $129,000) being exchanged for 500,000 USDC, of which $370,000 was earned by an MEV bot.The MEV bot only paid 0.03 USDC to front-run the transaction but incurred 3.5 ETH in gas fees for this. Subsequently, the victim sent an on-chain message to the attacker and the MEV address, stating that they had identified the attacker and were willing to pay a 10% bounty for a refund.

According to monitoring by PeckShield, the attacker-controlled address 0x920d...9708 stole approximately 500,000 USDC from the Base chain victim wallet 0x3a53...0B5c.However, during the subsequent process of exchanging USDC for ETH, the attacker did not set sufficient slippage protection, and the transaction was front-run by MEV bots for arbitrage. Ultimately, the attacker only obtained about 67 WETH, worth approximately $129,000, losing over 75% of the stolen funds.

Bitcoin News posted on the X platform that new community honeypot tests show that attackers are still prioritizing wallets that are most easily exploited due to the Coldcard Mk3 RNG vulnerability.Researcher @ColeTU injected funds into 5 affected Mk3 wallets: 1 using only the vulnerable mnemonic, 3 protected by BIP39 passphrases of 1, 2, and 3 words respectively, and another using a random account number. After 14 hours, only the unprotected wallet using just the mnemonic had its funds transferred away. According to @jamesob's real-time tripwire dashboard, currently only 2 out of 17 honeypot wallets have been emptied. The emptied wallets have been confirmed not to have added extra entropy, while all wallets protected by dice rolls, passphrases, multisig, or other complexities remain untouched.The test results indicate that attackers are currently focusing on the wallets that are easiest to brute-force rather than investing resources in strengthening targets, but affected users should still migrate their funds immediately instead of relying on temporary protections.

According to on-chain detective Specter, the Triple-A attacker exchanged DAI for 2,620 ETH before depositing funds into Tornado Cash, and has now deposited $4,990,000 into Tornado Cash, with 100 ETH pool deposited in 26 transactions and 10 ETH pool deposited in 2 transactions.The attacker still holds approximately $6.7 million in DAI.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

According to Bitcoin News monitoring, a new real-time dashboard is mapping the ongoing exploitation of the COLDCARD vulnerability in real-time. @jamesob is deploying honeypot wallets and gradually increasing additional entropy, including dice rolls and mnemonic phrases, to measure the current brute-force cracking boundaries.The control wallet with an additional entropy value of 0 was emptied in 1 hour and 18 minutes. The project's goal is to determine the types of wallets that attackers can currently crack and how this capability changes over time.

According to monitoring by Chainalysis, yesterday Hexagate detected that the LpdFi protocol was attacked, resulting in a loss of approximately $700,000. The attacker borrowed about $44 million in a flash loan, artificially inflated the price of LPD tokens by 71 times on the DEX, and then used tokens worth only about $2 million to fake a deposit of approximately $140 million in the protocol.One second later (just crossing the daily interest settlement boundary of the protocol), the attacker collected the interest for the inflated position for an entire day, triggering the protocol to liquidate its entire liquidity pool and pay out the stolen funds. After repaying all loans, the attacker made a profit of about $700,000 and immediately transferred the funds through Relay and TornadoCash.