hac

According to anonymous security analyst Spreek, the Initia chain has been hacked, resulting in a large number of tokens being infinitely minted. So far, the hacker has cashed out approximately 2.6 million dollars, and more funds are still being transferred.

According to Digital Asset, the security platform OpenSourceMalware revealed in a program on October 21 that a North Korea-linked hacking group is using a technique called Contagious Interview, luring job seekers in the cryptocurrency industry through LinkedIn to invite them to visit private code repositories and install software packages required for development tasks.The attackers set up a .npmrc configuration file in the repository, causing npm to download dependencies from a specified external package repository instead of the public registry, which could potentially execute malicious code during the installation process and reduce the likelihood of being detected by public security scans. Paul McCarty, co-founder of OpenSourceMalware, stated that this type of technique has been observed recently among attackers. The specific number of victims, affected companies, or the amount of digital asset losses has not yet been disclosed.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

On-chain detective ZachXBT posted that a certain institution was allegedly hacked by the North Korean-linked organization SquidSquad on October 8, resulting in the theft of approximately 2.84 million USD on the BNB Smart Chain (BSC).According to its tracking, the attackers deposited 1,111.2 ETH into Tornado Cash on October 20, then withdrew it to three addresses, and subsequently transferred the funds from Ethereum to Tron via USDT, consolidating them into two addresses. The aforementioned consolidation addresses are all financially linked to addresses previously attributed to North Korea. The funds were then directed to Chinese over-the-counter (OTC) traders through intermediary addresses within minutes, and ZachXBT believes this move may be to evade potential fund freezes by Tether.

Layer-1 blockchain Qubic has restarted the network and initiated the fund recovery process. Previously, attackers exploited a wallet seed vulnerability to transfer approximately 1.4 million USD worth of QU tokens from 1,404 accounts. The network validator Computors has approved the recovery plan, and affected users can submit claims, with a deadline of May 1, 2027.The Qubic block explorer shows that the network resumed processing ticks on October 19 at 20:00, with progress exceeding the previously paused 85,371,949. The vulnerability affects wallet seeds generated by certain Apple devices and browsers. Qubic recommends using version 4.26.4 or above to create new wallets and to transfer funds as soon as possible.

According to on-chain analyst Yu Jin's monitoring, the hacker who stole $285 million in assets from Drift Protocol at the beginning of April transferred 25,710 ETH, worth $61.24 million, through Tornado 3 hours ago.The hacker had exchanged the stolen assets for 131,564 ETH at an average price of $2,154 in early April, and transferred 24,400 ETH through Tornado in July; the current address still holds 81,454 ETH, worth $194 million.

According to NetEase's report on "DeepTech," the open-source AI programming tool OpenCode has officially confirmed it was breached, affecting approximately 1.4% of OpenCode Console users, with some API keys for models stored on the platform potentially leaked. Multiple developers reported unusual charges on accounts used to call models from OpenAI, Anthropic, and others, with some claiming losses of hundreds of dollars and others stating amounts exceeding $1,700. The officials stated that the incident is related to a large-scale distillation attack and are currently working with OpenAI, Anthropic, and Google to address the issue.OpenCode was developed by members of the Anomaly team, with one of the main creators being Dax Raad. The team has previously worked on projects like SST and OpenNext. In addition to local programs, its cloud service Console can centralize API keys from providers like OpenAI, Anthropic, and Google in a workspace and call them on behalf of users; the incident occurred on this cloud service. A notification email stated that the attacker gained unauthorized access to a set of decommissioned old systems, and some third-party model API keys in the Console workspaces may have been exposed. Developer Colin Parsons reported unusual charges of about $281 on his OpenAI account and about $168 on his Anthropic account, while Preston Zeller reported losses of around $1,700. Other users reported unusual charges of about $400 on Anthropic and account restrictions triggered by unusual usage on Google services.OpenCode has notified affected users to revoke and replace their keys and check recent call records. Lydia Hallie, a member of the Anthropic Claude Code team, stated that Anthropic has collaborated with OpenCode and revoked the Claude API keys believed to be affected. Tibo, a member of the OpenAI team, stated that they are working with OpenCode to help affected API users restore access and refund the amounts that were unusually consumed during the attack. Dax Raad clarified that the affected service is OpenCode Console, not the locally running OpenCode, and that keys configured directly in the local tool will not be sent to OpenCode servers. On October 18, he stated on social media that the attacker had been continuously attempting to breach the system for the past 48 hours, and the team is strengthening defenses.

According to on-chain detective Specter, ZachXBT disclosed that the Bitget attackers concealed the stolen funds through Zcash (ZEC), and other stolen funds also began to flow into ZEC, including funds from the Cryptobills Ledger incident and $12 million from the Triple-A hacker attack.Threat actors are using ZEC to transfer stolen funds.

According to Cointelegraph, security company Hacken disclosed that there were a total of 107 cryptocurrency hacking incidents in the third quarter of 2026, with total losses amounting to $1.18 billion. Approximately $906 million (about 77%) were related to breaches of vendor and developer tools, disclosed but undeployed fixes, and infrastructure outside the audit scope.The losses were mainly concentrated in four incidents: Bitget lost $387 million, Liquid Network lost $320 million, Tectonic lost $120 million, and Coldcard firmware vulnerabilities resulted in losses of about $115 million, totaling about 80% of the losses. The remaining 98 incidents each had losses below $10 million, with a median of $670,000. Smart contract attacks were the most common, totaling 71 incidents with losses of $228 million. This quarter marked the worst losses since the first quarter of 2025. In terms of recovery, about $387 million was returned or reversed, accounting for approximately 33% of the gross losses; the operators also bore $410 million in user losses, with about $384 million still unrecovered.

According to a report by BBC, multiple X platform accounts under the Irish police (An Garda Síochána) were hacked, including @GardaTraffic with 600,000 followers and @GardaInfo with nearly 300,000 followers. The hackers removed the original brand information from the accounts and posted cryptocurrency promotional content, while also altering the account's geographical location to Amsterdam.Some posts have been flagged by the platform as being associated with banned accounts. The Irish police have been contacted for comments, and the investigation into the incident is still ongoing.

On October 13, 2026, dating app Bumble Inc. (NASDAQ: BMBL) announced that it has reached a definitive agreement to be acquired by Ithaca Holdings, a holding company with a long-term investment in technology businesses, in an all-cash transaction valued at $1.3 billion. Common stockholders will receive $6.05 in cash for each share of Class A common stock, representing a premium of approximately 138% over the unaffected closing price on October 9, 2026, and a premium of approximately 119% over the volume-weighted average price as of that date.The special committee, with the assistance of independent legal and financial advisors, determined that the transaction is in the best interests of common stockholders and recommended that the board approve it. The board unanimously approved the transaction, with founder Whitney Wolfe Herd recusing herself from the deliberation and vote. A Blackstone affiliate and Wolfe Herd subsequently provided written consent to approve the transaction, constituting the required shareholder approval; shareholders will receive an information statement in accordance with Delaware law and federal securities laws.Upon completion, Ithaca co-CEOs Ravi Gupta and John Hegeman will serve as co-CEOs of Bumble and will work alongside Wolfe Herd. Bumble will be privatized, with offices in London, Austin, and New York City, and is expected to remain based in Austin. The company plans to file its third quarter Form 10-Q with the U.S. Securities and Exchange Commission by November 9, 2026, and will not issue an earnings press release or hold a conference call due to the transaction.

According to monitoring by PeckShield, hackers minted 19 million THEO tokens on the Base chain, then exchanged them for 700.8 ETH (approximately 1.76 million USD), and transferred the ETH to the Ethereum mainnet via a cross-chain bridge.As a result of this incident, the THEO token has fallen by 92% in the past 24 hours.

According to Catcher Predict monitoring, the "Shanghai Rolex Masters: Alex De Minaur vs. Karen Khachanov" event on the prediction market Polymarket has seen significant fluctuations in the "Over" option of the sub-market "Shanghai Rolex Masters: Alex De Minaur vs. Karen Khachanov First Set O/U 8.5," dropping from 99.95% an hour ago to the current 51% (a fluctuation of 48.95%). Please note the impact of related breaking news.

According to Bernama, a man's cryptocurrency wallet in Perak, Malaysia is suspected to have been hacked, resulting in a loss of approximately 12.47 million ringgit (about 3.05 million USD). The Perak police chief stated that the victim discovered on the afternoon of October 9 that his crypto assets had been transferred out without authorization.Preliminary investigations show that the relevant transactions were conducted through the blockchain network. The police are collaborating with the Commercial Crime Investigation Department's cryptocurrency division to trace the flow of funds and investigate the individuals involved. The case is currently being investigated under Section 420 of the Malaysian Penal Code regarding fraud, and the specific method of attack has not been disclosed.

According to on-chain analyst Ember (@EmberCN), a wallet received 263 ETH from Tornado Cash yesterday, then sold it for 643,000 USDC and deposited it into Hyperliquid.The address opened a short position of 305.5 BTC at a price of $83,068 with a maximum leverage of 40 times, with a position size of approximately $25.38 million, and the liquidation price is $84,088, currently with an unrealized profit of about $160,000.

According to Lookonchain monitoring, a suspected hacker wallet (0xf15d...bddf) sold 262.78 ETH 40 minutes ago, obtaining 643,000 USDC and depositing it into Hyperliquid. It then shorted 305.51 BTC with 40x leverage, with a nominal value of 25.4 million dollars and a liquidation price of 84,086.03 dollars.

Ark Protocol project Second disclosed that its server was exploited on Monday, resulting in a loss of 0.75 Bitcoin of its own funds, approximately $62,300. The team stated that user funds were not affected and repairs were completed within a few hours.The attacker subsequently continued to attempt to extract more funds from the project and launched a denial-of-service attack. Second stated on Tuesday that the attack could lead to a decrease in the ability of wallets based on Bark to receive Lightning Network transfers. Second indicated that the vulnerability occurred in the boarding process of the Ark server, allowing the attacker to register and exit related boards solely with their own signature, while spending the same batch of VTXO in the nodes through the Lightning Network. The attacker also attempted to use Bitcoin related to the security vulnerability of Blink Wallet from September 19, but was unsuccessful.

X-Agent officially announced the award results of the X-Agent AI MCP Hackathon 2026. This hackathon featured two main tracks: Open Innovation and the OlaXBT × X-Agent Trading Challenge. The champions of each track will receive 500 USDT + 15,000 X-Points, and the Top 5 teams from both tracks will also receive corresponding X-Points rewards based on their final rankings.Among them, Sumplus Model Desk won the championship in the Open Innovation track, while Strategy Increment won the championship in the OlaXBT × X-Agent Trading Challenge track. The total rewards for this event reached 1,000 USDT + 100,000 X-Points.It is noteworthy that X-Points, as an important record mechanism for contributions and participation in the X-Agent ecosystem, is expected to provide opportunities for token airdrop rewards in the future, further enhancing the potential value of the Hackathon rewards.X-Agent stated that all winning teams will receive further notifications via GitHub. Through this Hackathon, X-Agent will continue to promote developers in advancing real AI capabilities from the validation stage to MCP productization, Agent distribution, and commercialization.

According to a report by the Korean News Agency, South Korea's five major commercial banks have all been suspected of being attacked by hackers possibly driven by artificial intelligence, with three of them experiencing customer information leaks. This simultaneous attack on all five banks is unprecedented in South Korea's financial industry.It is reported that BNK Busan Bank suffered a hacker attack that led to the leakage of personal information of 11 outsourced employees; KB Kookmin Bank had information of 119 customers leaked due to the hacker attack, and Hana Bank also stated that information of 89 customers was leaked.