hac

According to Protos, AI shopping agent developer ORO disclosed that it suffered losses of approximately $630,000 due to a suspected North Korean hacker attack. The attackers sent spoofed Microsoft Teams links to ORO employees through a compromised Telegram account, inducing them to install malicious extensions, and after nearly a month of data theft, stole 147,000 Alpha tokens on July 13. ORO is highly confident that the attack originated from the North Korean hacker group Sapphire Sleet.ORO also admitted to security negligence—due to insufficient hardware wallet support in the Bittensor protocol, the company "temporarily" set the owner keys to software wallets, violating its internal principle of prioritizing hardware wallets, which led to the keys being stolen from the compromised computer. ORO stated that it is working with exchanges, law enforcement, and Bittensor ecosystem partners to recover the stolen assets and emphasized that its subnet is operating normally, and other wallets, user data, and validator signing keys were not affected.

The Polygon Foundation posted on the X platform that the Ithaca hard fork has been successfully deployed on the Amoy testnet and will go live on the Polygon mainnet at block height 50,185,000 (expected at 22:00 Beijing time on July 29).This upgrade aims to enhance payment reliability: automatic failover during rare stalls of block producers ensures smooth transactions, new protective mechanisms intercept transactions that may cause the network to slow down or become unstable, while providing node operators with clearer visibility to ensure seamless integration of underlying operations. All node operators are required to upgrade as soon as possible to ensure compatibility and network security.

According to News.bitcoin, the Kenyan government is investigating the hacking incident of President William Ruto's official website, where attackers briefly disabled the site and altered the homepage content, demanding a ransom of 5 Bitcoins.William Kabogo, the Cabinet Secretary for the Ministry of Information, Communication and the Digital Economy, stated that the Kenyan law enforcement agency ICT Authority immediately activated the cybersecurity response protocol to control the incident and conduct forensic investigations, temporarily restricting public access to the portal. Currently, there is no evidence that sensitive data has been accessed without authorization, leaked, or lost, and government systems and digital services remain securely operational.

According to an official announcement from Zilliqa, the project team has learned that a security incident occurred with one of its exchange partners, resulting in the theft of some ZIL from cold wallets. The incident is currently under joint investigation by various parties, and the specific scale and cause of the theft have not yet been disclosed.As a precautionary measure, Zilliqa has notified all exchanges to temporarily suspend ZIL deposits and withdrawals to prevent the stolen funds from being transferred or sold through centralized platforms. The team stated that further updates will be released once they have accurate information and reminded users to only pay attention to official channels.

According to Yu Jin monitoring, the hacker who emptied the Bonk treasury of 4.426 trillion BONK through a governance proposal has completed the liquidation, and the last 400 billion BONK (1.17 million USD) has also been deposited into Coinbase.As of now, all 4.426 trillion BONK that he extracted from the Bonk treasury 13 days ago has been transferred to CEX. Due to his selling over the past few days, the price of BONK has dropped by 40%. When he first obtained these BONK, they were worth 21.2 million USD, and after selling while the price was falling, the total cash amount should be around 13.58 million USD.

According to Fortune, Airbnb co-founder and CEO Brian Chesky's X account was hacked this Monday, posting a bullish tweet about "RWA tokenization," which was later deleted.Analysis by the AI detection tool Pangram revealed that the tweet was 100% generated by AI, with users pointing out its lack of commas and other characteristics typical of AI writing. Chesky had previously praised AI technology, but this incident shows that low-quality AI-generated content is becoming an increasingly serious concern for businesses and creators. The X platform security team has secured the account after receiving the report, and Chesky has regained access.

According to monitoring by Specter, an executor wallet of LayerZero is suspected to have been hacked, resulting in a total loss of approximately $2.1 million in assets across multiple blockchain networks.The attackers then transferred the stolen funds across chains to Ethereum via Stargate and Relay.

According to Onchain Lens monitoring, the X account of Noxa Fi is suspected to have been hacked. Users should not connect their wallets, sign any transactions, or interact with any links posted by that account.Currently, there are reports of users having their wallet assets stolen after interacting with that account.

According to Onchain Lens monitoring, the U.S. government will transfer the seized assets related to the Bitfinex hacker case.Data shows that approximately 296,700 Tether USDt (USDT) worth of funds have been transferred from the government-controlled wallet to a Coinbase Prime address, and the market speculates that these funds may be used for over-the-counter (OTC) sales.

According to an announcement from Qubic's official X account (@Qubic), a security incident occurred in the Qubic GitHub organization on July 13, where a compromised account accessed the code repository and extracted sensitive information. The official team has intervened to address the situation.The official team recommends that the following users take immediate action: Network Guardians should immediately rotate their seeds; Web wallet users who unlocked their wallets between 03:00 and 10:00 UTC on that day should migrate to a new identity; if unsure of the last unlock time, migration is also advised; developers should pause pulling or deploying code from the Qubic code repository until the official audit is confirmed to be completed.The official team stated that complete details and subsequent updates will be released on the official Discord channel, reminding users not to trust information from unofficial channels, and warning that no one should request user seeds for any reason. A post-incident report will be published after the situation is resolved.

Dragonfly partner Haseeb responded on Twitter to OpenZeppelin co-founder Manuel Aráoz's previous pessimistic view on DeFi security, stating that with models like GLM 5.2, Fable, and GPT 5.6 now online and actively used by attackers, DeFi has not experienced the anticipated "hacker apocalypse."Chart data shows that based on current year-to-date figures and operating rates, the annualized amount stolen in DeFi by 2026 is approximately $1.89 billion, with a cumulative theft of about $986 million this year, which is lower than the levels of 2025 and still within historical ranges.Haseeb believes that the deeper change currently is that while the number of hacker attacks has increased, the scale of individual attacks has decreased more rapidly, with attackers increasingly targeting smaller protocols and abandoned projects, while larger protocols have completed more security enhancements, thus the overall safety of funds has not significantly worsened.

According to official social media news, the HTX Genesis Hackathon, hosted by HTX DAO and B.AI, and co-organized by OpenCSG and TinTinLand, has recently determined the Top 15 teams. In addition, community voting is about to begin, and users can go to the HTX DAO official website to stake and vote for their favorite teams.It is reported that the total prize pool for the HTX Genesis Hackathon reaches 20,000 USDT, and provides over $100,000 in computing power support. Participating teams will innovate around the application scenarios of $HTX, B.AI ecological applications and computing power services, AI Agent finance, on-chain asset management, trading infrastructure, DAO tools, and smart financial operating systems.

Token Pocket's Chief Business Officer Michael stated that the mnemonic phrase of the Robinhood founder was leaked during a live broadcast. After hackers gained control of the address, they used that address and associated addresses to buy a large amount of the Meme coin at $1, prompting thousands of investors to follow suit, rapidly increasing the market value of the token from about $500,000 to $14 million in a short period.Subsequently, the price of the $1 token fell sharply, with a trading volume of about $20 million within just two hours. After the related addresses were frozen, the hackers quickly moved to the BNB Chain (BSC), using that address and its associated addresses to issue new tokens, and created trading hype through self-buying and selling, ultimately executing a sell-off to cash out. Robinhood's RPC has frozen that address, and nodes do not allow transactions sent from that address to be packaged, so transfers and trades cannot be conducted.

According to monitoring by Lookonchain, a hacker issued a token called $SCATMAN and promoted it after hacking the official X accounts of SpaceXAI and Starlink.Subsequently, the hacker sold all 100 trillion $SCATMAN tokens minted for 59 ETH (approximately $108,000). Another wallet controlled by the hacker also sold 59.28 million $SCATMAN for 14.7 ETH (approximately $27,000). The hacker's total profit was approximately $135,000.

According to on-chain analyst Yu Jin's monitoring, two hacker addresses coincidentally made large purchases of ETH using DAI today. The hacker who stole funds from Coinbase users bought 4049.7 ETH for 7.378 million DAI (average price of about 1822 USD) in the early morning. The second address (which transferred ETH from Tornado Cash and exchanged it for DAI last November) purchased 2405 ETH for 4.34 million DAI two hours ago (average price of about 1804 USD).

According to Onchain Lens monitoring, two wallets (0x18B...E66, 0x565...e55) suspected to be associated with the same entity and possibly belonging to hackers spent 11.59 million DAI to purchase 6,358 ETH, with a purchase price of $1,823.

According to on-chain data, 181,000 SOL held by a certain early investor (OG) in Solana, previously disclosed by on-chain detective ZachXBT, was stolen, valued at approximately $14.2 million at current prices.The attacker subsequently sold all 181,000 SOL and transferred the funds across chains to the Ethereum network, ultimately exchanging them for 7,918 ETH.Currently, the attacker has completed the asset transfer and exchange operation from Solana to Ethereum. The specific reasons for the incident and the method of fund theft have not yet been disclosed.

According to analyst Specter, the Hedera network is suspected to be under attack, with attackers transferring over $3.7 million to Ethereum via a cross-chain bridge.The stolen funds, after being cross-chained from the Hedera network through LayerZero, are currently being exchanged from WBTC to ETH.

On-chain detective ZachXBT posted that an early whale address related to the initial allocation of the Solana genesis block was suspected to have been attacked a few hours ago, with approximately 180,900 SOL (about 14.2 million USD) stolen.ZachXBT stated that in collaboration with the on-chain investigation agency Specter Investigation, they discovered abnormal unstaking and cross-chain operations to Ethereum while tracking unusual fund flows, and subsequently confirmed that the related assets had been transferred.Currently, the involved victim address and several suspected theft addresses have been made public, and the specific method of attack and the whereabouts of the funds are still under further investigation.

According to The Block, a report from Immunefi shows that in the first half of 2026, cryptocurrency projects suffered cumulative losses of approximately $972 million due to 207 hacking incidents. Although the number of attacks reached a historic high, the total losses remained below $1 billion and were less than half of the losses in the first half of 2025.The report pointed out that losses from attacks in the DeFi sector have decreased by 74% from the peak of $2.62 billion in 2022, dropping to about $680.3 million, with the median single loss decreasing by 75% during the same period. Immunefi believes that this decline is related to ongoing security coverage, bug bounty programs, audit competitions, and more researchers discovering vulnerabilities early.In addition, the sources of risk are shifting from purely smart contract vulnerabilities to infrastructure failures, private key leaks, cross-chain configuration errors, and weak points in privileged access.