hacker

According to Bitcoin News monitoring, the white hat hacker group behind the Liquid vulnerability exploitation incident accused Blockstream of spending only $1.5 million, or possibly not spending any funds at all, to secure assets worth $5 billion.In a new on-chain message, the group demanded that Blockstream pay a bug bounty equivalent to 10% of the related assets using its own funds, warning that refusal to pay would result in a 15% loss for holders.The group also stated that it would publish the private key used to decrypt previous conversations with Blockstream. Previously, the group had returned 3,400 BTC to the Liquid Federation, with approximately 600 BTC still not returned.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

PeckShield data shows that in August 2026, the cryptocurrency industry experienced 50 major hacking attacks, an increase of 67% compared to July; losses decreased to $136.3 million, a drop of 49.5%. Among them, Tectonicfi lost approximately $74 million, and after Cronos suspended its network, only about $6 million was transferred out.Digital asset security company AEREDIUM launched AERSeal, which aims to replace the single private key controlling privileged smart contract functions with a multi-party authorized threshold signature. This product stores key shares in hardware-certified secure isolated environments and supports Ethereum Virtual Machine and compatible chains. AERSeal does not reconstruct the complete private key but generates signatures through the CGGMP24 threshold signature protocol. AEREDIUM founder and CEO Albert Dadon stated that the product can delegate permissions for minting, upgrading, and other functions to the threshold key, and confirm the transfer completion through on-chain verification; customers can also independently verify the allocated threshold key.

Balancer stated that the team has sent on-chain messages to the wallets related to the Balancer V1 vulnerability attack on August 31, proposing a plan to return the stolen funds in exchange for a bounty, and promising not to pursue legal responsibility for the act of returning as long as conditions are met. If the other party does not respond by 5 PM on September 9, Balancer will take technical, on-chain, and legal measures to track the attacker. The incident resulted in a loss of approximately $234,000.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

According to security company Huntress, hackers are spreading theft malware to cryptocurrency users by forging Google Docs files, hosting malicious files on GitHub, and impersonating Claude.ai pages. Attackers disguise themselves as senior employees of CoinDesk on the social platform X, luring victims to open Google Docs documents containing malicious code under the pretext of inviting them to an online meeting, thereby guiding users to install the malicious program themselves.Mac users face the threat of Atomic macOS Stealer (AMOS), which can steal browser passwords, cryptocurrency wallet data, and Telegram files; Windows users are pushed fake Google API Connector updates, which, once installed, implant NetSupport RAT and a counterfeit Ledger hardware wallet application. Additionally, hackers are placing false advertisements on search engines like Bing, enticing users to visit counterfeit Claude.ai pages and execute malicious commands. The related malware MacSync and SectopRAT can steal cookies, saved passwords, recovery phrases, and payment card information.Security company Socket also discovered 16 malicious extensions targeting Chrome and Edge, capable of emptying EVM, Solana, and Tron wallet assets.

According to Arkham blockchain data, wallets associated with the North Korean state-sponsored hacking organization Lazarus Group have sold over $30 million in Bitcoin on the decentralized perpetual contract trading platform Hyperliquid in the past three weeks, using the proceeds to purchase Ethereum and Solana, which were then transferred to centralized exchanges such as Kraken, LBank, and KuCoin. Kraken responded that it maintains an industry-leading compliance program, continuously monitoring on-chain activities to identify and block assets related to sanctioned wallets; LBank and KuCoin stated that the associated risks are a continuing challenge faced by the industry as a whole and emphasized that publicly available on-chain data may not reflect compliance measures at the platform level.At this time, the Trump administration is exploring ways to incorporate Hyperliquid into the regulated U.S. financial system. Trump stated earlier this month at a White House event that the chairman of the Commodity Futures Trading Commission, Mike Selig, is developing a path to bring Hyperliquid into the U.S. in a fully compliant and legal manner. According to Bloomberg, Kraken's parent company Payward is in deep negotiations with Hyperliquid Labs to offer perpetual contracts to U.S. traders.Hyperliquid is the leading platform in the decentralized perpetual contract space, allowing users to trade directly from their crypto wallets without the need for traditional brokerage accounts or KYC checks. According to DefiLlama data, its cumulative perpetual contract trading volume has exceeded $5 trillion, with current open contracts of approximately $13.3 billion.

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

According to ZEIT, the Berlin city government suffered a cyber attack two weeks ago, and the hacker group is suspected of implementing ransomware using the stolen data. According to Der Spiegel, the attackers are believed to be the long-active Rhysida hacker group, demanding a payment of 30 bitcoins (approximately 2 million euros) and threatening to release the data.The sensitive information involved may include records of violations and passwords. The Berlin state government has not yet confirmed the extent of the data breach and has not responded to the ransom amount or the identity of the attackers, stating that it will not comment "for reasons of investigative strategy." Berlin's mayor, Kai Wegner, has made it clear that Berlin will not yield to extortion. The main departments affected are transportation and construction management, which were temporarily isolated from the state government's network after the incident.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

Solana's new bank Avici is facing ongoing attacks, with attackers having stolen over $1 million from users. The attackers' wallet holds 10,005.03 SOL (approximately $1.07 million) and about $11,600 in USDC and USDT. The attack method involves first calling the SubmitSignatures of the Avici authorization program, then calling the AddCollateralAdmin of the collateral program, and finally executing WithdrawCollateralAsset to withdraw the balance. Both of Avici's programs are upgradable and share the same standard Solana account instead of multi-signature upgrade permissions.Avici confirmed the incident 1 hour and 53 minutes after the first theft transaction, stating, "We are aware of the issue affecting card balance withdrawals and are working directly with all relevant partners to resolve it." Prior to this, users had reported stolen balances on social media. A real-time tracker established by anonymous on-chain analyst STACC recorded 125 different sending accounts, with transfer amounts ranging from approximately 9 USDC to over 26,000 USDT.As a result, the AVICI token fell 49.4% in 24 hours to $0.2175, with a market cap of approximately $2.84 million, hitting an all-time low. Avici raised funds through MetaDAO in October 2025, with an original cap of $3.5 million, but the final committed amount reached $34.2 million, and the team refunded 89.8% of the committed USDC.

According to Lookonchain monitoring, the Lazarus Group hackers transferred 244.148 Bitcoins, worth 19.42 million dollars.

According to GMGN monitoring, the Solana ecosystem's meme coin CYBERLEEK, issued by the GTA 6 hacker, has risen over 40% in the past 4 hours, with a market cap recovering to $14.5 million.The hacker organization claiming to be Cyberleek launched the Solana chain meme coin CYBERLEEK by leaking clips of the game "GTA 6," and claims to release a PC download client for GTA 6, allowing everyone to play this $2 billion blockbuster without spending a dime (the client claim has now been debunked). On August 22, Cyberleek publicly destroyed about 270 million developer-reserved tokens, accounting for approximately 27% of the total supply, claiming it "proves they won't dump and run," but still retains a large number of tokens and continues to profit from transaction fees.For more detailed reports, see "The hacker who leaked GTA 6 issued a coin, rising 20 times in one day." According to market news, meme coins generally have no practical use cases, and price fluctuations are significant, so investment should be approached with caution.

According to Bloomberg, the Taiwanese research institution TeamT5 stated that the scale of cyberattacks linked to China has significantly increased after incorporating DeepSeek and other open-source AI models into their operations. Since they began delegating daily tasks to AI and using it to develop more advanced malware, the number of attacks carried out by the relevant organizations has more than doubled.Researchers noted that it is not always possible to accurately identify the specific AI models used by attackers, but products related to DeepSeek are popular among hacker groups in the country due to their high performance and ease of customization. The report indicates that experienced attackers are leveraging relatively limited AI tools to scale up their operations and achieve breakthroughs, highlighting the attackers' ability to use basic AI tools to target overseas objectives.

Regarding the recent attack on the payment public chain Keeta, Keeta Network CEO Ty sent a letter to the attackers stating that the investigation has made substantial progress and evidence has been collected that can identify the attackers. This includes information on the IP addresses related to the attack, the VPN and VPS infrastructure used, the user agents and technical environment that initiated unauthorized requests, relevant email addresses, the software used, and the infrastructure service providers. The relevant evidence has been preserved and submitted to the authorities.The attackers are required to return all funds obtained from this attack within 72 hours, with repayment acceptable in KTA, ETH, or USDC. If the full amount is returned, a certain reward will be offered, and the matter will be resolved without pursuing legal responsibility. If the deadline is exceeded and the funds are not returned, all rights to pursue legal action and fund recovery will be reserved. Ty previously stated that the root cause of the security incident has been confirmed and patches are being tested. The issue is an isolated problem with the affected components and does not impact Keeta's anchor system or any external connection systems. All KTA on Base has not been affected. The Keeta mainnet will remain in read-only status until the patches are fully tested and appropriate additional safeguards are implemented before resuming full operation. The team is actively assessing the best way to fully compensate all affected users.

According to Cryptopolitan, attackers released malicious versions of three widely used Rust packages through a supply chain attack, with a library named arrayref being used by about three-quarters of Rust development environments. The malicious update hid a backdoor that could automatically steal login information when users compiled projects; users who compiled the affected versions may have exposed their computers and keys.Wiz researchers pointed out that the command and control path of the arrayref attack overlaps with the Mastra operation used by the North Korean hacker groups Sapphire Sleet and UNC1069, with IP addresses sharing the same security certificate and using the same hosting provider, Hostwinds. The attackers only added a misspelled proc-macro1 dependency, mimicking the popular proc-macro2, without modifying the original code, allowing it to pass tests and builds. The attack was removed 86 minutes after release but had already been downloaded extensively. The affected packages are widely used in Solana and Ethereum tools. The Rust team believes the maintainer's actions were not malicious, and their device or credentials may have been compromised.

According to on-chain analyst Yu Jin's monitoring, the hacker spent $7.954 million again 6 hours ago to buy 3,386 ETH. Over the past day, the hacker has spent a total of $46.49 million to purchase 21,659 ETH, with an average price of $2,146, currently showing an unrealized profit of $4.14 million.

According to Decrypt, the U.S. Department of Justice has filed charges against 17 hackers allegedly affiliated with Iran's Mabna Institute, accusing them of participating in years-long cyber attack activities, including the 2017 breach of U.S. cable network HBO, where they stole data and demanded approximately $6 million in ransom paid in Bitcoin. Prosecutors claim that the organization conducted hacking attacks on behalf of the Iranian Islamic Revolutionary Guard Corps and other Iranian government clients, targeting hundreds of universities, businesses, and government agencies worldwide, stealing at least 31.5 TB of academic data and intellectual property.The organization also targeted over 100,000 professor accounts, breaching about 8,000 accounts across 144 U.S. universities and 178 foreign universities. The U.S. State Department is offering a reward of up to $10 million for information leading to the whereabouts of five of the defendants. In recent months, the U.S. Treasury has imposed sanctions on several Iranian cryptocurrency exchanges and frozen over $131 million in cryptocurrency assets related to the Iranian central bank and the Revolutionary Guard.