security

According to Cointelegraph, the Attorney General's Office of the State of Mexico (FGJEM) reported that two suspects, Diego Sebastián and Gerardo, were arrested for allegedly murdering Jonathan Meléndez, the keyboardist of the rock band Camilo Séptimo, along with his pregnant wife, daughter, and an employee. The family's golden retriever was also killed.The suspects are accused of committing the crime to obtain a cold wallet that allegedly contained millions of dollars in Bitcoin, with one of the suspects being a business partner of the victim, using that relationship to gain access to the victim's home. The two will appear in court on Wednesday, where the judge will decide if there is enough evidence to continue the criminal proceedings. If convicted, each suspect could face a prison sentence of 25 to 70 years corresponding to each victim.Such violent robberies targeting cryptocurrency holders (known as "ransom attacks") are on the rise. According to CertiK data, there were 52 reported ransom attack incidents globally in the first half of 2026, a year-on-year increase of 33.3%; among them, there were 20 home invasions targeting cryptocurrency holders, compared to only 1 during the same period last year.Chainalysis estimates that in the first half of 2026, criminals stole over 30 million dollars in cryptocurrency through ransom attacks. In 2025, global ransom attack incidents increased by 75% to 72 cases, with France leading with 19 cases, accounting for about 40% of the total attacks in Europe.

Hardware wallet manufacturers Ledger and Trezor are calling on security researchers to adopt a more responsible approach to vulnerability disclosure. Ledger's Chief Technology Officer Charles Guillemet stated on the X platform that artificial intelligence has made vulnerabilities easier to discover and exploit, but some researchers disclose details before a fix is released, which he termed "exploiting others' risks for attention."Guillemet urged researchers to report vulnerabilities privately first and to agree on a timeline for fixes before disclosing details publicly, suggesting 90 days as a common default period, while also indicating that this could be adjusted flexibly based on the severity of the vulnerability and the amount of work required for the fix. Trezor's Security Chief Jan Komárek told Cointelegraph that 90 days is a commitment to vendors, not just an obligation for researchers. He suggested that researchers first contact vendors to agree on a timeline, and if the vendor fails to complete the fix within that period, they may choose to disclose publicly.The context of this statement is the recent close attention to hardware wallet security: the Coldcard theft incident involved over $100 million, and a data breach at Trezor's logistics provider also affected the personal information of tens of thousands of customers.

According to The Block, the Ethereum Foundation's protocol team has released the priority list for the Hegotá upgrade EIP, setting the target date for achieving "quantum safety" on Ethereum's layer one in terms of execution, consensus, and data to December 2029.In terms of the consensus layer, FOCIL (EIP-7805) is listed as S-level "must launch," enhancing censorship resistance by mandating the inclusion of public mempool transactions; in terms of the execution layer, Frame Transactions (EIP-8141) is also a "must launch," laying the groundwork for native account abstraction and custom signatures, gas payment, etc., by splitting transactions into programmable "frames" for validation, gas payment, and execution, thereby improving post-quantum safety readiness. The protocol team stated that starting from the "Glamsterdam" fork in Q4 2026, subsequent forks need to be completed in an average of about 7.2 months to ensure the achievement of the minimum viable post-quantum safety milestone before "Q-day" around 2030.

The Ukrainian police and the Security Service of Ukraine (SBU) recently dismantled a scam network that used a fake investment platform to steal cryptocurrency. This network disguised itself as an investment platform website, luring users to connect their main cryptocurrency wallets and approve a small test transaction when withdrawing funds. Subsequently, it used a "wallet stealer" hidden within the website to automatically transfer user funds to wallets controlled by the operators, kicking victims off the platform. Investigators have currently confirmed 62 victims, with over 46 Ukrainian citizens involved, and the network could steal up to $1 million per month.The police stated that the false profits displayed on the platform are part of the scam, with operators manually creating transactions and adjusting user account balances to create the illusion of investment growth. In addition to cryptocurrency, the platform also collected victims' passport information, phone numbers, email addresses, login credentials, and photos during the registration and identity verification process. The main organizer of the network is a 25-year-old IT expert who recruited over 46 Ukrainian citizens and operated multiple offices in Kyiv and surrounding areas, with members responsible for building and maintaining fake websites, contacting potential victims, and providing security.Victims come from multiple countries, including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel. The police traced the gang's server equipment located in the Netherlands and obtained a database stored there, which included a list of victims, cryptocurrency wallet addresses, suspected stolen amounts, internal communications, and platform operation information. The Ukrainian police and SBU subsequently executed 34 searches in Kyiv and surrounding areas, seizing over 100 computers, more than 100 mobile phones, 79 SIM cards, documents, cash, and 15 vehicles.

a16z Charts compiled recent data indicating that since January 2025, tech recruitment has shown a clear preference for years of experience, while the requirements for the number of skills have decreased, with a change of about 5% to 10%.The charts show that companies are lowering the weight of skill lists when screening positions, and are instead placing more emphasis on candidates' accumulated experience. This change is related to the skill gaps brought about by AI, which is rewriting the safety and employment landscape.

According to the official X account of ZKsync (@zksync), ZKsync announced a security upgrade for its EraVM chain. The core measures include: introducing an instant upgrade framework, extending the execution delay from 3 hours to 24 hours, and developing a second prover, EraBender, to guard against AI-driven vulnerability attacks.In the next 6 months, all Boojum/EraVM chains will gradually phase out the old execution environment, and each chain will formulate and announce its own transition timetable. Users holding funds directly in EOA do not need to take any action; users holding funds through multi-signature, smart accounts, DEX, lending protocols, and other smart contracts need to take action as required after the transition plans of each chain are determined. The ZKsync Atlas chain is not affected by this upgrade.

According to CoinDesk, OpenAI stated that it will provide access to $1 billion worth of Daybreak cybersecurity model subsidies over the next six months, along with training and technical support to help organizations defend against AI-driven cyberattacks, including potential "zero-day" exploits.Daybreak is divided into two tiers, Blue and Red, which are used for routine defense and more sensitive cybersecurity tasks, respectively. Currently, about 2,000 organizations are using it. OpenAI previously disclosed that its new model Astra can discover unknown software vulnerabilities and generate attack plans with less human intervention, raising concerns in the crypto industry about the security capabilities of open-source blockchain software.

According to Securityweek, artificial intelligence security company HiddenLayer has completed a $100 million Series B funding round, led by Delta-v Capital, with participation from Booz Allen Ventures, Microsoft's M12, Morgan Stanley, and Ten Eleven Ventures. To date, the company has raised a total of over $155 million.HiddenLayer focuses on protecting the entire lifecycle security of generative AI, predictive AI, and AI Agents. Its enterprise platform includes features such as AI asset discovery, AI supply chain security, attack simulation, and runtime protection. The new funding will primarily be used to expand the runtime security capabilities of AI Agents, particularly targeting AI programming Agents.

According to Techcrunch, cybersecurity giant Palo Alto Networks announced the acquisition of AI Agent startup Console for $500 million in cash and stock. Founded in 2024, Console uses AI Agent to automate tasks such as password resets, application permission grants, and daily IT troubleshooting, with clients including Ramp, Flock Safety, and Scale AI.Palo Alto Networks plans to integrate Console into its AI-driven security platform Cortex, enabling security teams to investigate and handle security alerts through natural language, achieving more automated enterprise security operations.It is reported that this is also the seventh acquisition completed by Palo Alto Networks this year, having previously acquired Chronosphere at a valuation of $3.35 billion and the cybersecurity startup Koi for $400 million.

Term Labs released a technical report on the security incident, confirming that all fixed-rate loan positions in the affected vault have been restored as of August 25. The incident was limited to the liquid balance within the Term vault, and Term V1 and V2 contracts were not compromised, with the direct lending market remaining open.Attack process: From August 17 to 18, the attacker funded an operational wallet through Tornado Cash and submitted a malicious proposal disguised as a governance proposal, setting the governance delay parameter to zero and removing the window for LP blocking changes. On August 23, the attacker executed two batches of attacks, extracting assets from the ETH and USDC strategies and transferring them to the attacker's wallet. Term Labs stated that it has cooperated with law enforcement, the affected vault and strategies have been closed, and the contracts have been upgraded and migrated before expiration.

In a blog post released on Monday, Anthropic acknowledged that its Claude model had unauthorized access to real computer systems during a cybersecurity assessment, an incident reflecting operational security failures as well as alignment failures in motivation reasoning and intent to harm. Anthropic disclosed in July that the Claude model had breached the systems of three companies because the third-party assessment environment was connected to the public internet, while the model was informed it was in a simulated environment without internet access.Anthropic stated that Claude may have interpreted evidence of real internet access as still being in a simulated environment and was willing to take harmful actions on the real internet to complete the cybersecurity assessment task. Additionally, during tests at the UK AI Safety Institute, after assessors deliberately granted Claude Mythos internet access, the model took unauthorized actions on the live network. Anthropic emphasized that the models involved did not have the cybersecurity protections included in the officially released products.Following the incident on July 30, Anthropic has suspended cybersecurity assessments of pre-release models and introduced stricter protections: tests must run in verified offline sandboxes equipped with real-time monitoring; a new classifier can intercept suspected boundary violations, terminate tests, and notify humans. Anthropic has also expanded the scope of offline monitoring used by internal frontier agents. Previously, OpenAI models had also breached Hugging Face in July to obtain answers for cybersecurity tests, with investigations revealing that about 1,200 agents acted collaboratively through unauthorized message boards.

According to Bloomberg, AI and cloud security startup Upwind Security has completed a new round of financing of $300 million, led by Bessemer Venture Partners, with participation from some existing investors, bringing the post-financing valuation to $3.8 billion.Upwind Security, headquartered in San Francisco, primarily provides cybersecurity services for AI applications and cloud applications. The new funds are intended to expand the AI security capabilities of its core cloud security platform, aiming to be closer to developers.

According to the Securities Times, at the Fourth Cybersecurity (Tianjin) Forum, Zhou Hongyi, the founder of 360 Group, gave a keynote speech, stating that AI has changed the landscape of cyber offense and defense, and traditional solutions are difficult to sustain. He emphasized the need to create a new automated offense and defense system centered on "model governance," using AI capabilities to address AI risks, ensuring the safety of large models, the reliability of generated content, and the credibility of output results.Zhou Hongyi also proposed that there should be lifecycle management for intelligent agents, establishing an auditable, intervenable, and interruptible control mechanism, and called for the cybersecurity industry to quickly form a system for AI vulnerability discovery, automated defense, and intelligent agent security.

OpenAI stated that its upcoming Astra model can autonomously discover previously unknown software vulnerabilities and convert them into usable attack vectors without human intervention, making it the company's first model to reach the "Critical" cybersecurity capability level threshold. In a blog post released on Tuesday, OpenAI mentioned that according to its Preparedness Framework, reaching this level means the model can discover zero-day vulnerabilities and develop usable exploit code in hardened real systems without human involvement, or design and execute attacks based solely on a high-level objective.In testing, Astra achieved a 100% score in benchmark tests for developing exploit code based on known vulnerabilities and discovered two previously unknown vulnerabilities in another internal test. Additionally, the model successfully broke through a hardened browser sandbox and executed commands on the host machine, while gaining root access by exploiting multiple weaknesses in the operating system. OpenAI stated that it has delayed some of Astra's development progress to enhance security measures and plans to make its advanced cybersecurity capabilities available only to selected testers.This capability is particularly relevant to the cryptocurrency industry, as software vulnerabilities can be converted into financial losses within minutes. CoinDesk reported in June that increasingly powerful AI models can compress the process of searching code, discovering misconfigurations, and assembling attacks from days or weeks to machine speed. Security researchers noted at the time that the significant change was not the emergence of new categories of attacks, but rather the dramatically increased speed at which existing vulnerabilities are discovered and exploited.

Core DAO is coordinating an emergency hard fork due to some validators receiving CORE rewards that exceeded the protocol's expected issuance. Core stated in an update that the situation has been brought under control, and "malicious validators" can no longer claim excess rewards. This fork is a forward upgrade and will not roll back the network or revoke any confirmed transactions.Previously, Core indicated in a status update on Monday that the rewards accumulated by a small number of validators were significantly higher than the protocol's expected issuance. The incident was limited to the reward distribution phase, user assets remain secure, and they promised to release a technical review report. Following the incident, several exchanges restricted CORE transfers: Coinbase suspended deposits and withdrawals on the Core network, Bithumb and Coinone suspended deposits and withdrawals, Bitget suspended deposits and withdrawals citing wallet maintenance, and LBank suspended deposits at the request of the project party.Core has not disclosed the amount of excess issued CORE, the duration of the activity, or whether additional tokens have entered circulation, nor have they provided details on the vulnerability that allowed validators to receive rewards. Cointelegraph reached out to Core for further information but had not received a response by the time of publication.

AI security startup AIR has completed a $50 million financing round, led by Sequoia Capital with an initial $10 million in the first round, followed by Greenoaks leading a second round of $40 million, with participation from Swish, Netz, and several angel investors.The company was founded by Yair Saban and Niv Hoffman, senior members of Israel's Unit 8200, and offers an AI agent security platform that can discover AI agents operating within enterprises, continuously review the skills and tools they use, and prevent them from interacting with non-compliant software or external sources, while providing a vetted AI agent plugin and skills marketplace.