cio

According to Bitcoin News monitoring, security researchers have found that versions 1.1 and 1.2 of FomoPeek distributed through the Apple App Store contain an iOS exploit framework that can escape the application sandbox, capable of extracting keychain data, wallet files, and mnemonic phrases. SlowMist has linked this application to multiple theft incidents and traced nearly $580,000 worth of stolen USDT flowing into a main address.Users who have installed either version should consider the keys accessible on their iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.

SlowMist released a security warning stating that it has recently received multiple reports of FomoPeek users' assets being stolen. After a joint investigation with the OKX security team, it was found that some affected users had previously installed or used FomoPeek versions 1.1 to 1.2, which contained malicious code. SlowMist stated that there are modules in FomoPeek unrelated to normal business, one of which includes a kernel exploit framework targeting the iOS system, supporting eight different attack methods that can automatically select the exploitation method based on device model and iOS version. Affected systems include iOS 12 to 18.7 and iOS 26 to 26.1. If the exploitation is successful, the application may break through the iOS sandbox and access and decrypt Keychain data, leading to the leakage of private keys, mnemonic phrases, login credentials, and other sensitive files. In addition, FomoPeek also connects to hidden servers unrelated to its public services and can receive remote commands. SlowMist indicated that its analysis of captured plaintext traffic shows that the related attack functions are currently enabled and will run automatically on a regular basis. SlowMist recommends that users who have installed or used FomoPeek versions 1.1 to 1.2 immediately check for any anomalies in their assets, generate new private keys and mnemonic phrases on trusted devices that have never installed the application, and transfer assets to new accounts as soon as possible, while also upgrading to the latest iOS version and not continuing to use or reinstall FomoPeek.

On September 14, blockchain intelligence company TRM Labs released a report revealing that fake YouTube tutorials lured 224 victims into deploying and funding malicious smart contracts under the guise of building AI-based crypto arbitrage bots, resulting in the theft of 274.6 ETH. TRM identified a total of 234 contracts deployed by the victims, with funds ultimately flowing into six collection addresses controlled by the operators. The stolen ETH was worth approximately $517,000 at the time of the transfer, with a median loss of 1 ETH per incident.Unlike common wallet theft attacks, this scam did not involve phishing links, spoofed domains, or malicious authorization prompts. Victims chose the tutorials themselves, copied the code, deployed the contracts, and funded them from their own wallets, with each step authorized by the victims themselves. As a result, wallet security warnings and phishing blacklists could not be triggered. TRM discovered nine nearly identical YouTube tutorials disguised as different creators, using AI-generated virtual hosts and voiceovers, promising to build fully automated crypto trading bots with Claude, and guiding victims to a compiler website controlled by the operators, some of which mimicked the commonly used Remix development environment.In one variant analyzed by TRM, a backend script would discard the source code pasted by the victims and retrieve another contract from the operator's server, with the clean code displayed on the screen never being on-chain. The replaced contract accepted deposits and transferred any balance over 0.05 ETH to the operators when the victims pressed Start or Withdraw, with no arbitrage logic or AI functionality included in the contract.

CoinGlass data shows that due to the overnight announcement of the interest rate hike decision by the Federal Reserve, the prices of gold and silver once plunged about 3% from their intraday highs and are currently still in a downward trend. Tether Gold (XAUT) is currently priced at $4,281.15, with a 24-hour decline of 0.77%; silver (XAG) is currently priced at $63.41, with a 24-hour decline of 1.78%. During the period of significant market fluctuations, the trading volume of Gate precious metal contracts surged: the trading volume of Gate silver contracts reached $253 million in 24 hours, ranking second in the industry; the holding amount of Gate XAUT gold is approximately $127 million, also ranking second in the industry.

Independent researcher Jonas Wiedermann-Moeller discovered that OpenAI's malicious AI agents hijacked two Hugging Face user accounts and probed the platform's network vulnerabilities as early as May 13, nearly two months before the publicly disclosed intrusion incident in July. An internal incident report released by OpenAI last month disclosed only a small part of this, specifically that an agent stole a user's login credentials to access a biology-related document, while the new findings point to ongoing reconnaissance activities.According to Reuters, these agents used the hijacked accounts to send malformed files to the servers of the open-source AI repository Hugging Face, and researchers believe this appears to be an attempt to map the network to find intrusion pathways. Researchers reviewing the evidence did not find that the activities in May caused an actual intrusion, but Wiedermann-Moeller believes missing this signal is significant. He stated that if this behavior had been detected in May, it might have prevented a later, larger-scale incident. Hugging Face, which is currently being acquired by NVIDIA for $12.93 billion, has not disclosed whether it was aware of this new information.Researchers from Nightingale Collective also linked a spam attack on the code repository RubyGems on May 11 to OpenAI agents, which temporarily forced the platform to suspend new account registrations for four days.

Cybersecurity company Hudson Rock disclosed that the Reddit verified account of the streaming service HBO Max was hijacked earlier this month and deployed 108 malicious ads within approximately 48 hours. These ads used a non-existent HBO Max native macOS application as bait, luring users to open Terminal or PowerShell and paste malicious commands, a technique known as ClickFix.Researchers named this operation PasteSwitch, and its delivery system adapts based on the visitor's device and the advertised software. Observed Mac payloads include MacSync and Atomic macOS (AMOS) information-stealing trojans, targeting browser credentials, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet recovery phrases. The malware also utilized Binance Smart Chain contracts as variable C2 address delivery points and was associated with a cryptocurrency clipboard hijacker that replaces clipboard wallet addresses.According to Malwarebytes, Reddit administrators have suspended the related ads and initiated a security investigation following reports. The report did not specify how the account was compromised or the number of victims, nor was there evidence found that the HBO Max streaming service itself was breached. The ClickFix technique has previously been used multiple times in attacks targeting cryptocurrency users, including approximately 2,000 compromised WordPress sites and malicious activities disguised as CAPTCHA.

According to BBX data, yesterday and in recent days, global listed treasury companies and digital asset trading platforms disclosed the latest developments in strategic mergers and acquisitions and fiat currency clearing infrastructure. The core information is as follows:Stack BTC plans to acquire precious metals dealer Direct Bullion for up to £12 million: Stack BTC, a Bitcoin treasury company under former UK Chancellor Kwasi Kwarteng, announced that it has officially signed a non-binding letter of intent to fully acquire the well-known UK precious metals dealer Direct Bullion for up to £12 million (approximately $16 million). The company clearly stated that this acquisition aims to obtain ample and stable cash flow income through the physical precious metals sales business and plans to continuously use all net cash flow generated by this business to increase its Bitcoin holdings in the secondary market.Banking Circle deepens cooperation with OSL Group, adding five major mainstream currency channels: Next-generation financial infrastructure service provider Banking Circle announced further deepened strategic cooperation with Hong Kong-listed stablecoin payment and trading platform OSL Group (00863.HK). Based on the existing euro clearing business between the two parties, Banking Circle has officially added multi-currency payment and clearing channels for five major fiat currencies: Australian Dollar (AUD), British Pound (GBP), Hong Kong Dollar (HKD), Singapore Dollar (SGD), and US Dollar (USD) for OSL, fully supporting OSL in accelerating the expansion of its B2B cross-border payment landscape for global institutional clients.

Bitwise Chief Investment Officer Matt Hougan published a statement discussing U.S. cryptocurrency policy, stating that the U.S. originally had the opportunity to make the cryptocurrency industry safer, promote investment, and ensure it continues to lead the global financial markets for the next 50 years, but is currently sacrificing this opportunity for short-term political gains.

The UK Bitcoin Treasury Company Stack BTC (STAK) proposed to acquire the precious metals dealer Direct Bullion for up to £12 million (approximately $16 million) and plans to use the operating cash flow generated from precious metal sales to support Bitcoin accumulation. This non-binding agreement includes £3 million in cash, approximately £4 million in shares, and £5 million in performance-linked cash payments, with a minimum share issuance price of 6 pence and a lock-up period of four years.As Stack director Paul Withers controls the seller Direct Bullion, this transaction constitutes a related party transaction and is classified as a reverse acquisition, which still requires due diligence and the signing of a final agreement. Direct Bullion achieved revenue of £52.1 million and a post-tax profit of £2.15 million for the fiscal year ending January 2026. This acquisition will be Stack's first transaction under the strategy of "acquiring profitable companies to fund Bitcoin purchases." Stack BTC currently holds approximately 68 Bitcoins (around $5.2 million), and its stock price fell by 1% on the day the news was announced.Nigel Farage invested £215,000 through his company Thorn In The Side, holding approximately 6.3% of Stack. Previously, Reform UK received donations of $48.5 million each from crypto billionaires Christopher Harborne and Ben Delo within 24 hours, totaling approximately $97 million, setting a record for political donations in the UK.

Kelp stated that the team detected potential suspicious activity from an address (0xc70f...0ea0) that received rsETH a few hours ago. As a precaution, a 24-hour wallet-level temporary pause has been implemented on this address, during which rsETH cannot be transferred in or out of the address.

Decentralized Trading Infrastructure 0x stated that this year it has routed 81.92 million transactions with a trading volume of 4.267 billion USD, with approximately 70% touching Uniswap liquidity. 0x indicated that there has been an increase in malicious Uniswap v4 hooks recently, which provide one price in quote requests and another price at settlement, profiting from users by deceiving aggregators, wallets, and trading applications.After analyzing 84,163 hooks across 6 chains, 0x reported that only 19.4% are safe, 54.2% are malicious, and 26.4% may be malicious. Transactions routed through malicious v4 hooks can result in actual amounts received being up to 50% less than the quoted price. The article cites examples where the Base chain ETH/NVDAc pool hooks have accumulated fees of approximately 143,000 USD, and the BNB chain USDT/WBNB pool hooks have accumulated about 18,600 USD.0x stated that routing parties must ensure that the quoted amounts in pools are consistent with actual execution behavior, applications must have the capability to quickly eliminate suspicious routes, and users should be aware that optimal quotes are only useful when the route is safe. 0x has implemented measures such as detection and pool audits to prevent such pools from appearing in routing.

Bitcoin payment service provider Swiss Bitcoin Pay stated that a malicious user has likely gained access to its internal systems. As a precaution, Swiss Bitcoin Pay has temporarily shut down its servers to investigate and protect its infrastructure. Currently, it is believed that the accessed information may include customer email addresses, Bitcoin addresses and IBANs, transaction history, and hashed passwords, but it is unclear if any other information was accessed.User funds are secure, and all amounts owed to users will be fully refunded. There is currently no date for reopening, and the team is working to complete security hardening as soon as possible.

GoPlus Chinese Community issued a security alert stating that a newly activated external account address has initiated a malicious governance proposal against Ampleforth. The proposal, titled "Application for Completed Work Funding for SPOT Ecosystem Analysis Tool," attempts to transfer 2.5 million USDC from the treasury to the proposer, an amount that nearly accounts for all the liquid funds in the treasury.

According to Defimon monitoring, the Ampleforth governance system Governor Bravo has a suspicious proposal 54, involving approximately 2.5 million dollars of treasury funds. This incident has been classified as an access control risk and a malicious governance proposal, and the related funds have not yet been transferred out.The Ampleforth time-lock contract currently holds about 2.538 million USDC, so this proposal involves nearly all treasury assets. The proposer disclosed that they wrote the proposal themselves and plan to vote through a delegated address holding 87,238 FORTH, which accounts for about 0.57% of the supply, slightly above the proposal threshold of 75,000 FORTH. The quorum for the proposal is 600,000 FORTH, which, at the current price of FORTH at 0.22 dollars, is worth approximately 132,000 dollars.

According to Bloomberg, Belgian prosecutors stated on September 7 that a Chinese man, who also holds Belgian nationality, was arrested on May 10 at Brussels Airport while attempting to board a flight back to Beijing on suspicion of engaging in espionage activities against a Belgian semiconductor company. The investigation may point to the illegal transfer of specialized intellectual property and trade secrets related to gallium nitride chip production abroad.The investigation is related to the bankruptcy case of Belgan BV, which announced its bankruptcy in July 2024. Prosecutors indicated that there are signs suggesting that the man held a senior research position at the Belgian company while also serving as a director of a Chinese company engaged in similar manufacturing activities. This Chinese company was established a few months after he joined the Belgian company and was funded by a Chinese investment fund. This is the latest in a series of suspected espionage cases in Belgium.

The Financial Crimes Enforcement Network (FinCEN) of the U.S. Department of the Treasury released an analysis and alert on Thursday, linking approximately $12.7 billion in suspicious financial activities to cryptocurrency investment scams operated by Southeast Asian parks. About 1,300 institutions submitted 33,904 suspicious activity reports covering the period from September 2023 to December 2025. Cryptocurrency-focused money service businesses submitted 55% of the reports, involving $5.5 billion; banks submitted 41%, involving $6.4 billion; and securities firms accounted for the remaining $784.5 million.The number of reports has been growing at an average monthly rate of 10.9%, with the amount involved increasing by 18%. Scammers used at least 22 types of digital assets, with Ethereum, USDT, and USDC being the most common. On-chain analysis shows that regardless of the asset victims initially purchased, the funds are almost always converted into stablecoins, with nearly all converted to USDT, and then transferred through DeFi protocols or exchanges outside the U.S. Scammers also reused collection addresses across multiple victims, which is one way some institutions identified this pattern.The report indicates that about 25% involved elderly individuals, which is comparable to the 24.4% of the population that is over 60 years old, leading FinCEN to conclude that the elderly are not disproportionately targeted. The FBI estimates that in 2024, the U.S. population over 60 lost $4.8 billion to scams. These parks are primarily located in Cambodia, Laos, and Myanmar, and U.S. authorities have seized over $25 million related to the associated scams this year.

According to The Defiant, Securitize has announced a partnership with Socios.com, where Securitize will provide regulated securities issuance, investor onboarding, and ownership record services for Socios.com’s plan to sell tokenized minority equity in professional sports clubs.The token product branded as Socios Equity Tokens will be subject to applicable securities laws, league requirements, club approvals, and jurisdictional restrictions. Fan Tokens and Socios Equity Tokens will function as separate products, with the former used for participation and utility, while the latter represents regulated financial rights.Carlos Domingo, co-founder and CEO of Securitize, stated that professional sports clubs represent an important asset class that has largely remained private and difficult to access. Securitize's regulated infrastructure in the U.S. and Europe can provide clubs and their owners with new ways to issue and manage equity. Alexandre Dreyfus, founder and CEO of Chiliz Group, mentioned that the collaboration with Securitize will explore entering the next phase through regulated tokenized equity.It is reported that this plan is expected to become the first tokenized project launched by Securitize under the EU DLT pilot regime, which only accepts issuers with a market capitalization of less than 500 million euros. Securitize received authorization from Spain's CNMV for DLT trading and settlement systems in November 2025.

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.

Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after installing a transcription application using a download link provided in the Claude chat window. The link pointed to a counterfeit website and bundled malware that attempted to steal all information from his device upon execution. Numa Lunah mentioned that he cleared and reinstalled the affected laptop and found no sensitive information leaked.Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide written by him and contained instructions to re-download the malware and steal credentials every time it was loaded. Microsoft Defender Experts had warned that attackers had shifted from search engine optimization poisoning to large language model response poisoning, with related tactics including recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Crypto industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.