hac

Colosseum announced the launch of the second special hackathon track of the Crypto World's Fair, the Tempo track, which is supported by Tempo.The Tempo track will award a total of $100,000 to the top 10 startups integrated with the Tempo blockchain, and participants can register for the competition through the relevant page.

Zhao Changpeng retweeted on platform X to clarify that his account has not been hacked, stating that he had only unfollowed some inactive accounts that had been inactive for over 30 days, and said "that's all."

Blockchain security company Hacken released an assessment report indicating that approximately half of the circulating USDT (about $91.3 billion on the Tron network) is controlled by a 2-of-3 multi-signature contract, which lacks built-in delays, cancellation processes, or reliable revocation mechanisms. Attackers only need to compromise two signature keys to change contract ownership, mint tokens, freeze addresses, clear frozen balances, or set transfer fees without accessing any user wallets. Hacken also discovered that Tether reuses the same set of six signature keys across three chains: Ethereum, Avalanche, and Celo, posing a risk of cross-chain spread.Meanwhile, stablecoin rating agency Bluechip upgraded Tether's company rating from D to C, citing that KPMG's audit showed Tether's reserves exceeded liabilities by $6.8 billion as of December 31, 2025. This is the first time Bluechip has adopted the expanded SMIDGE methodology, which incorporates Hacken's technical risk analysis. However, Hacken only gave USDT a cybersecurity score of 3.3 out of 10 and pointed out that the USDT smart contract does not have automatic reserve proof checks or a token minting cap. Once signers authorize a transaction, the contract can mint an unlimited number of tokens without a bank reserve proof.Hacken stated that it has not yet completed an equivalent assessment of Circle's USDC, and Bluechip's previous B+ rating for USDC was based on an old methodology, which cannot be directly used for technical comparison.

On September 7, the cryptocurrency exchange WEEX announced that the WEEX Hackathon Phase II AI Wars II officially started today at 00:00 (UTC+8). API players, manual traders, and prediction participants can all join to compete for a prize pool of 600,000 USDT.The event is divided into five rounds, taking place from now until October 9 over five weeks, with one round held from Monday to Friday each week. Participants can choose to join Team AI or Team Human, engaging in trading duels in a real market environment, competing for rankings and rewards based on PnL% performance.Users can earn points through registration, check-ins, likes, sharing, and contract trading tasks, using points to support Team AI or Team Human and predict the winning camp. Successful predictions can earn additional rewards.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

PeckShield data shows that in August 2026, the cryptocurrency industry experienced 50 major hacking attacks, an increase of 67% compared to July; losses decreased to $136.3 million, a drop of 49.5%. Among them, Tectonicfi lost approximately $74 million, and after Cronos suspended its network, only about $6 million was transferred out.Digital asset security company AEREDIUM launched AERSeal, which aims to replace the single private key controlling privileged smart contract functions with a multi-party authorized threshold signature. This product stores key shares in hardware-certified secure isolated environments and supports Ethereum Virtual Machine and compatible chains. AERSeal does not reconstruct the complete private key but generates signatures through the CGGMP24 threshold signature protocol. AEREDIUM founder and CEO Albert Dadon stated that the product can delegate permissions for minting, upgrading, and other functions to the threshold key, and confirm the transfer completion through on-chain verification; customers can also independently verify the allocated threshold key.

Balancer stated that the team has sent on-chain messages to the wallets related to the Balancer V1 vulnerability attack on August 31, proposing a plan to return the stolen funds in exchange for a bounty, and promising not to pursue legal responsibility for the act of returning as long as conditions are met. If the other party does not respond by 5 PM on September 9, Balancer will take technical, on-chain, and legal measures to track the attacker. The incident resulted in a loss of approximately $234,000.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

WEEX Exchange announced that the WEEX Hackathon Season 2 "AI Wars II: The Algorithm Era" is officially launched. AI developers, quantitative traders, teams, and individuals can join Team AI or Team Human to engage in a continuous five-round trading competition in a real market environment, competing for rankings and rewards based on PnL% performance. The total prize pool for the event is 600,000 USDT, with multi-layered incentives designed around different participation methods.From September 3 to 6 is the pre-registration phase, where the first 20,000 registrants can share a 100,000 USDT early bird prize pool. Early registrants can complete event tasks in advance to accumulate activity points for the subsequent competition.

According to security company Huntress, hackers are spreading theft malware to cryptocurrency users by forging Google Docs files, hosting malicious files on GitHub, and impersonating Claude.ai pages. Attackers disguise themselves as senior employees of CoinDesk on the social platform X, luring victims to open Google Docs documents containing malicious code under the pretext of inviting them to an online meeting, thereby guiding users to install the malicious program themselves.Mac users face the threat of Atomic macOS Stealer (AMOS), which can steal browser passwords, cryptocurrency wallet data, and Telegram files; Windows users are pushed fake Google API Connector updates, which, once installed, implant NetSupport RAT and a counterfeit Ledger hardware wallet application. Additionally, hackers are placing false advertisements on search engines like Bing, enticing users to visit counterfeit Claude.ai pages and execute malicious commands. The related malware MacSync and SectopRAT can steal cookies, saved passwords, recovery phrases, and payment card information.Security company Socket also discovered 16 malicious extensions targeting Chrome and Edge, capable of emptying EVM, Solana, and Tron wallet assets.

X-Agent announced that the X-Agent AI MCP Hackathon 2026 will officially launch on September 2, calling for global developers and teams to submit practical, verifiable Agent and MCP applications. This event is an online global competition supported by OlaXBT.The hackathon features two tracks: the Open Innovation Track encourages participants to develop any practical API-driven Agent or MCP capabilities around AI, crypto assets, data, automation, and Agent infrastructure; the OlaXBT × X-Agent Trading Challenge allows participating teams to access the OlaXBT Nexus MCP, supporting their use of strategy development, backtesting, performance analysis, and market data capabilities to validate trading strategies and build related Agent or MCP applications.The total rewards for this event include USDT and X-Points. The first-place team in each track will receive a reward of 500 USDT; the top five teams in each track will collectively earn X-Points. X-Points can be used to participate in the X-Agent airdrop token $XAGT exchange. Award-winning and selected projects will also have the opportunity to receive support for MCP standardization, ecological exposure, market integration, and paid call commercialization. The registration and development period for the event is from September 2 to September 19, with technical reviews and evaluations taking place from September 20 to October 1, and the winners' list is expected to be announced between October 2 and 4. Participating projects must be submitted through the official GitHub repository.

According to Arkham blockchain data, wallets associated with the North Korean state-sponsored hacking organization Lazarus Group have sold over $30 million in Bitcoin on the decentralized perpetual contract trading platform Hyperliquid in the past three weeks, using the proceeds to purchase Ethereum and Solana, which were then transferred to centralized exchanges such as Kraken, LBank, and KuCoin. Kraken responded that it maintains an industry-leading compliance program, continuously monitoring on-chain activities to identify and block assets related to sanctioned wallets; LBank and KuCoin stated that the associated risks are a continuing challenge faced by the industry as a whole and emphasized that publicly available on-chain data may not reflect compliance measures at the platform level.At this time, the Trump administration is exploring ways to incorporate Hyperliquid into the regulated U.S. financial system. Trump stated earlier this month at a White House event that the chairman of the Commodity Futures Trading Commission, Mike Selig, is developing a path to bring Hyperliquid into the U.S. in a fully compliant and legal manner. According to Bloomberg, Kraken's parent company Payward is in deep negotiations with Hyperliquid Labs to offer perpetual contracts to U.S. traders.Hyperliquid is the leading platform in the decentralized perpetual contract space, allowing users to trade directly from their crypto wallets without the need for traditional brokerage accounts or KYC checks. According to DefiLlama data, its cumulative perpetual contract trading volume has exceeded $5 trillion, with current open contracts of approximately $13.3 billion.

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

According to ZEIT, the Berlin city government suffered a cyber attack two weeks ago, and the hacker group is suspected of implementing ransomware using the stolen data. According to Der Spiegel, the attackers are believed to be the long-active Rhysida hacker group, demanding a payment of 30 bitcoins (approximately 2 million euros) and threatening to release the data.The sensitive information involved may include records of violations and passwords. The Berlin state government has not yet confirmed the extent of the data breach and has not responded to the ransom amount or the identity of the attackers, stating that it will not comment "for reasons of investigative strategy." Berlin's mayor, Kai Wegner, has made it clear that Berlin will not yield to extortion. The main departments affected are transportation and construction management, which were temporarily isolated from the state government's network after the incident.

The Solana-based crypto debit card infrastructure Rain was hacked due to vulnerabilities in outdated contracts, resulting in approximately $1.1 million in funds being stolen. The affected crypto bank Avici's token AVICI dropped from a 24-hour high of $0.43 to a historical low of $0.217, a decline of 49%, before recovering to around $0.378.Avici confirmed that the attack only affected the card funds contract used for recharge consumption, and its self-custody wallets were not impacted, promising to fully refund the affected balances. In this incident, 1,685 Avici users lost approximately $500,800; another crypto bank, Tria, also had 636 users affected, with losses exceeding $430,000. The discrepancy between the approximately $1.1 million tracked on-chain and the losses reported by Avici indicates that other protocols supported by Rain were also attacked.Transaction data shows that the attacker repeatedly submitted signature authorizations, adding themselves as administrators of the card collateral account and withdrawing balances. The stolen stablecoins were exchanged for SOL, cross-chain to Ethereum, and ultimately flowed into the mixer Tornado Cash. Avici has filed a report with the FBI's Internet Crime Complaint Center. This incident also exposed issues with the custody transfer behind some self-custody crypto cards: although users control their wallets, the funds used for consumption are transferred to third-party contracts.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

According to Lookonchain monitoring, the Lazarus Group hackers transferred 244.148 Bitcoins, worth 19.42 million dollars.