hijacking

A family in the northern French town of Vendin-le-Vieil was invaded and taken hostage by four masked men early Sunday morning. According to BFMTV, the suspects entered the house around 4 AM, binding the couple and their two children with tape, and held them for over three hours. The 40-year-old father, an IT expert in the local cryptocurrency industry, was taken to another room, beaten, and forced to give up access codes, resulting in approximately 40,000 euros (about 46,000 dollars) worth of cryptocurrency being transferred away.According to the Béthune prosecutor's office, the four suspects fled the scene by car and are still at large. The 12-year-old daughter was struck in the face with a car key during the incident, and the victims are in a state of shock; they have been sent for forensic examination and are receiving support from the victims' assistance association. The case has been filed under organized gang kidnapping and extortion and is being jointly investigated by the regional judicial police and the French Cybercrime Office.France is the country most severely affected by such "ransom attacks" globally. Records from the national prosecutor's office for organized crime show that over 70 kidnapping and illegal detention incidents related to cryptocurrency have occurred in the first eight months of 2026, with 88 people already prosecuted in earlier crackdowns this year. Previous similar cases often targeted wealthy individuals, including the father of a cryptocurrency millionaire, the wife of a co-founder of The Sandbox, and the CEO of Binance France, while the victim in this case is merely an ordinary IT professional. Chainalysis reported that global ransom attacks in 2026 resulted in approximately 30 million dollars in losses, while CertiK stated that losses over six months reached 124 million dollars, a 12-fold increase.

According to Cryptopolitan, a new type of macOS malware named Reaper is spreading through fake download pages of applications like WeChat and Miro, targeting the theft of cryptocurrency wallet data, browser passwords, and sensitive documents. This malware exploits the AppleScript URL to trigger the system's built-in script editor, hiding malicious code through ASCII art and spaces. After users click the run button, a fake Apple security update pop-up lures victims into entering their computer passwords.Reaper targets desktop cryptocurrency applications such as Ledger Live, Trezor Suite, and Exodus, modifying the internal code of wallets to intercept future transactions and redirect funds. It also steals saved credentials from Chrome, Firefox, and Edge, extracting files like .docx, .pdf, and .wallet from the desktop and documents folder. Reaper also installs a backdoor disguised as a Google software update directory for persistent attacks. Security experts advise users to verify download links, avoid entering passwords in unexpected pop-ups, and immediately close the page if a website requests to open the script editor.

According to Cointelegraph, Bitcoin journalist Joe Nakamoto stated that approximately 70% of violent kidnapping incidents (wrench attacks) targeting cryptocurrency holders and their families occur in France. Since 2026, there have been 41 cryptocurrency-related kidnappings in France, averaging one every two and a half days.Nakamoto attributes this to the centralized storage of KYC (Know Your Customer) data. In the 2020 data breach incident involving hardware wallet manufacturer Ledger, the personal information, home addresses, and emails of over 270,000 users were exposed, providing criminals with precise attack targets. Casa CEO Jameson Lopp stated, "France is the canary in the coal mine, revealing how the surveillance system built by financial regulation can directly harm Bitcoin holders."In response to such threats, industry experts recommend that holders use custodial services with security features that can trigger asset freezes and notify law enforcement in the event of an attack; they also suggest preparing a "decoy" wallet with a small amount of funds and maintaining a low profile in public to avoid exposing holding information.

CoW DAO announced that its domain registrar was subjected to a social engineering attack on April 14, during which the attacker briefly controlled the official domain for about 4.5 hours and directed users to a phishing website, thereby inducing them to sign malicious transactions. The project team emphasized that the CoW Protocol itself was not compromised, but some user assets were affected during that time window.In response to this incident, the CoW DAO community governance proposal CIP-86 has been approved, establishing a discretionary compensation fund to reimburse affected users for their losses. The official reminder states that eligible users must submit their claims by May 14, including affected wallet addresses, asset information, transaction hashes, and names, and apply via email at help@cow.fi, with the email subject clearly stating "Discretionary Grant Claim for".

According to The Block, the Ethereum Name Service (ENS) gateway eth.limo experienced a DNS hijacking attack last Friday evening. The project released a post-incident analysis report on Saturday, tracing the attack back to a social engineering attack against the domain registrar EasyDNS.eth.limo stated that DNSSEC validation rejected the attackers' domain server changes, and no users have been found to be actually affected. In response to the recent breaches at the DNS level affecting crypto frontends, eth.limo plans to migrate to EasyDNS's stricter security services, which no longer support account recovery features.EasyDNS CEO Mark Jeftovic has publicly acknowledged the vulnerability, stating that this is the first successful social engineering attack against customers in its 28-year history.

DeFi project Steakhouse Financial disclosed yesterday that it encountered a phone social engineering attack targeting OVH Cloud, where the attacker changed the DNS A records of the main site and app subdomains to point to a malicious IP, and attempted to initiate a 5-day domain transfer. The related changes have been revoked, the DNS records have been cleared, and they are working with OVH to resolve the issue. All vaults and contracts were unaffected, depositor funds are safe, and no other service accounts were compromised. Please do not interact with the official website and emails until the issue is resolved; a detailed post-incident report will be released as soon as possible.Early this morning, Steakhouse Financial stated that during the period when the official website domain DNS records were cleared, the vault could still be accessed directly through Morpho, and all functions such as deposits and withdrawals were operating normally. Confirmation will be provided once the front end is restored.

Hackers have launched Android malware attacks in Brazil by spoofing a phishing page that mimics the Google Play Store. Currently, all known victims are located in Brazil.The attackers set up a phishing website that closely resembles Google Play, enticing users to download a fake application called "INSS Reembolso." Once installed, the application releases hidden malicious code in stages and loads it directly into memory, leaving no visible files on the device, which makes it highly stealthy. One of the core functions of the malware is cryptocurrency mining, with an embedded XMRig mining program compiled for ARM devices that silently connects to the attacker's controlled mining server in the background. The program monitors battery level, temperature, and device usage status, dynamically adjusting mining behavior to evade detection, and bypasses Android's background process management mechanism by looping silent audio files.Some variants also include banking trojans that can overlay fake pages on the USDT transfer interface of Binance and Trust Wallet, silently replacing the recipient address. Additionally, the malware supports various remote control commands such as recording, screenshotting, keylogging, and remote locking of the device.

According to DL News, police in the Île-de-France region of France arrested two teenagers (aged 15 and 17) and a 35-year-old man, all suspected of carrying out two armed kidnappings targeting cryptocurrency holders on March 10 in the Île-de-France region.Reports indicate that the first incident occurred in the Essonne department in the southern suburbs of Paris, where the suspects, wearing masks and carrying small explosive devices, attempted to break into the home of a cryptocurrency holder but failed. About 30 minutes later, another incident took place in the Seine-et-Marne department, where the suspects successfully broke into the home of a female cryptocurrency holder, kidnapped her family, and stole jewelry; it has not been disclosed whether cryptocurrency assets were also stolen.The police subsequently tracked the suspects' vehicle, deploying about 100 armed special police officers and two police helicopters to pursue them, intercepting the vehicle after approximately 6 hours and discovering the stolen jewelry inside. Prosecutors have charged the three individuals with extortion, organized crime, armed robbery, property damage, and kidnapping. Currently, the 17-year-old suspect and the 35-year-old man are in custody awaiting trial, while the 15-year-old suspect is under judicial supervision, and prosecutors have appealed this decision.

The RWA tokenization platform OpenEden announced on X platform that it has fully restored DNS control over its official domain and its subdomains, and platform operations have returned to normal.OpenEden stated that its official website experienced unauthorized record modifications at the DNS level, leading to domain hijacking. After a joint investigation with security partners and infrastructure service providers, it was confirmed that this incident did not affect any smart contracts, internal systems were not compromised, core applications remain intact, and reserve assets were also unaffected. All reserve assets can be independently verified through Chainlink's Proof of Reserve, and measures to enhance domain and infrastructure security will be strengthened.

ClawdBot (now renamed Moltbot) founder Peter Steinberger posted on social media that the issue of his GitHub account being hijacked has been resolved, and this issue only affected personal accounts, not organizational accounts. He specifically reminded users to be wary of about 20 impersonating X scam accounts.

According to 23pds, the Chief Information Security Officer of Slow Fog Technology, a new type of security vulnerability has emerged in the Snap Store application store on the Linux platform. Hackers are taking over application publisher accounts by hijacking expired domain names and embedding malicious code into cryptocurrency wallet applications.Attackers monitor and register developer accounts in the Snap Store associated with expired domain names, using these domain emails to trigger password resets, thereby taking over the established publisher identity with long-term credibility. The tampered applications disguise themselves as well-known cryptocurrency wallets such as Exodus, Ledger Live, or Trust Wallet, with interfaces nearly indistinguishable from the originals.Currently, it has been confirmed that the publisher domains storewise[.]tech and vagueentertainment[.]com have been hijacked. These malicious applications lure users into entering their "wallet recovery mnemonic." Once users submit this information, sensitive data will be sent to the attackers' servers, resulting in the theft of digital assets.

According to Slow Mist's Yu Sin, some users may not have received the Monad airdrop and are advised to check whether the wallet address bound on the airdrop claim page claim.monad.xyz is the expected address.Yu Sin stated that if the bound address is not what the user expected, they may have encountered a similar issue as user Onefly (@Onefly) — the wallet address was bound to a hacker's address, causing the official airdrop to be sent to the hacker. Yu Sin revealed that a white hat hacker had previously synced a related vulnerability with him, which has a prerequisite: if someone hijacks the user's session on the Monad airdrop claim page, they can change the claim wallet address without further confirmation.

According to Aerodrome, the domain hijacking attack that the agreement previously encountered was fully mitigated in less than 4 hours, with user losses amounting to approximately $700,000.It is reported that within 2 minutes of the first malicious transaction being detected, major wallets such as MetaMask and Coinbase Wallet began displaying warnings. Losses were limited to users who connected and signed transactions during the active period of the malicious website. Currently, the team is working with security consultants and corporate registrars, and the domain is expected to be migrated and reopened next week. Additionally, the Aero and Velo foundations are developing plans to provide grants proportional to the losses for affected users.

The DeFi protocol Balancer is currently under attack, with losses exceeding $116.6 million across multiple chains, and the attack on Balancer is still ongoing.According to the on-chain AI analysis tool CoinBob, the historical security incidents of Balancer are as follows:June 2020 Flash Loan Attack: Attackers exploited a compatibility issue between the deflationary token (STA/STONK) and Balancer's smart contracts, repeatedly calling swapExactAmountIn to drain the liquidity pool, ultimately profiting $523,600.August 2023 V2 Pool Vulnerability: The Balancer V2 pool suffered multiple flash loan attacks due to a code vulnerability, with total losses reaching $2.1 million. The team urgently paused the affected pools and advised users to withdraw their funds, but some funds that were not withdrawn in time were still exploited.September 2023 Frontend Hijacking Attack: Hackers gained control of Balancer's frontend through BGP/DNS hijacking, tricking users into authorizing malicious contracts, resulting in a loss of $238,000. On-chain detective ZachXBT traced the funds to address 0x645710Af050E26bB96e295bdfB75B4a878088d7E.2023 Euler Incident Impact: Due to a vulnerability in Euler Finance, Balancer's bbeUSD pool suffered a loss of $11.9 million, accounting for 65% of the pool's TVL. The team took protective measures to limit liquidity withdrawals.2024 Velocore Attack Association: The Velocore vulnerability exploited Balancer-style CPMM pools, resulting in a loss of $6.8 million. Balancer's technical architecture was indirectly implicated due to cross-protocol integration.

ChainCatcher message, cryptocurrency developer Zak Cole disclosed that a new type of phishing attack is targeting the X (formerly Twitter) accounts of members of the crypto community. This attack disguises itself as an authorization request from the Google Calendar app, tricking users into granting full account control permissions. Attackers exploit the application authorization mechanism of the X platform, completely bypassing passwords and two-factor authentication.MetaMask security researchers have confirmed that this attack is active in the wild. Users are advised to visit the connected apps page on X to check and revoke any suspicious "Calendar" app authorizations to ensure account security.

According to ChainCatcher news reported by Decrypt, Charles O. Parks III, a man from Nebraska, USA (online name "CP3O"), has been sentenced to one year and one day in prison for orchestrating an illegal "crypto hijacking" scheme worth $3.5 million. He illegally mined by stealing cloud computing resources, profiting nearly $1 million, which he used to purchase luxury goods.Parks has paid a $500,000 fine and a Mercedes-Benz, with the amount of restitution pending. It is reported that he disguised himself as an educational platform to deceive cloud service providers into granting him computing resources for mining Ethereum, Litecoin, and Monero, and laundered money through exchanges and banks.

ChainCatcher news, according to Cointelegraph, Ukrainian police recently arrested a 35-year-old man, accusing him of carrying out a large-scale cryptocurrency hijacking operation.According to a police statement, the man had been hacking into over 5,000 client accounts of an international hosting company since 2018, unauthorizedly using their server resources for cryptocurrency mining, resulting in losses of approximately $4.4 million for the company. During a search of the suspect's residence, multiple computer devices, mobile phones, bank cards, as well as cryptocurrency wallets and hacking software were discovered. The suspect currently faces charges of unauthorized interference with electronic information network operations, which could result in a maximum sentence of 15 years in prison. The investigation into the case is still ongoing.

ChainCatcher message, Slow Mist founder Yu Xian stated that the current DNS hijacking issue with Curve has not yet been resolved, and the attackers are also phishing for mnemonic phrases through fake wallet pop-ups, making their methods even more covert.This issue once again points to the domain service provider iwantmyname, which also caused a similar incident in 2022.

ChainCatcher news, according to Cointelegraph, the DeFi protocol Curve Finance has issued an urgent warning that its official website curve.fi has suffered a DNS hijacking attack, redirecting users to a malicious phishing site. This is the second security threat the platform has faced within a week, following the hacking of its official X account on May 5.Blockchain security company Blockaid detected that attackers may have implemented a front-end attack by tampering with DNS resolution records, advising users to immediately stop all transaction signing operations. The Curve team has contacted the domain registrar for urgent handling and confirmed that the smart contracts are unaffected, but they remind users that there is still a risk of asset theft when interacting with the platform.