theft

The Rosen Law Firm, a U.S. investor rights law firm, is investigating potential securities claims on behalf of Balancer (BAL) token investors, alleging that Balancer may have issued misleading business information to the public. This investigation stems from a Bloomberg report on November 3, which indicated that the DeFi protocol Balancer had been attacked, resulting in over $100 million in digital assets being stolen.According to monitoring by security firms PeckShield and Cyvers, the total losses from this incident are approximately $128 million. The Rosen Law Firm is currently preparing to file a class action lawsuit to seek recovery of investors' losses.

According to Arbitrum's news early this morning, Arbitrum has successfully regained control of the Arbitrum Governance (@arbitrumdao_gov) account, which can now interact securely. The official statement indicates that they are reviewing their security protocols to prevent similar incidents in the future.Previously reported by ChainCatcher, the official X account of Arbitrum Governance was compromised.

According to The Block, the cross-chain liquidity protocol CrossCurve (formerly known as EYWA) has confirmed that its cross-chain bridge protocol "is under attack" due to a vulnerability in its smart contract being exploited, resulting in approximately $3 million in funds being stolen across multiple networks. Blockchain security firm Defimon Alerts discovered that the attack vector was a gateway validation bypass vulnerability in CrossCurve's ReceiverAxelar contract.Analysis shows that anyone can use a forged cross-chain message to call the contract's expressExecute function, thereby bypassing the expected gateway validation and triggering unauthorized token unlocks on the protocol's PortalV2 contract. The protocol is supported by Curve Finance founder Michael Egorov, who previously raised $7 million.

According to Pie Shield monitoring, the hacker John (Lick), suspected of participating in the $90 million theft from the U.S. government in 2024, has begun depositing funds into Tornado Cash, with 11,037 ETH (approximately $33 million) already transferred to the mixer.Pie Shield stated that this individual is also related to a series of thefts targeting unidentified victims between November and December 2025.

"On-chain detective" ZachXBT posted on X platform revealing that John Daghita, who stole over $40 million in cryptocurrency from the U.S. government, is the son of the CEO of CMDSS, a company that has received contracts from the U.S. government to handle seized cryptocurrency.

Scroll announced on the X platform that the X account of its co-founder @shenhaichen has been compromised, and they are actively working to recover the account. Please do not interact with any links or direct messages.

BNB Chain's Chief Growth Officer Nina Rong posted that the theft of the BNB Chain Coinmarketcap account was due to a vulnerability that previously existed on the Coinmarketcap community platform. Immediate measures have been taken to ensure account security, and additional security measures have been implemented to prevent similar incidents from occurring again.

BNB Chain's Growth Execution Director Nina Rong posted that reports have been received regarding the theft of the BNB Chain Coinmarketcap account. They are currently verifying the details with the security and internal audit teams, and advised to exercise caution regarding any investment decisions posted on social media.

On-chain detective ZachXBT posted on social media that hacker John is boasting about a wallet address containing assets worth $23 million, which is associated with over $90 million allegedly stolen from the U.S. government, as well as several other unconfirmed victim cases during the period from November to December 2025.

According to PieShield monitoring, cryptocurrency-related thefts have reached an all-time high, primarily driven by systemic vulnerabilities in centralized infrastructure and a strategic shift towards targeted social engineering attacks. The total losses in 2025 exceeded $4.04 billion, an increase of approximately 34.2% compared to the $3.01 billion stolen in 2024. This includes: losses from cryptocurrency hacks amounting to $2.67 billion (an increase of approximately 24.2% year-on-year), and fraud losses reaching $1.37 billion (an increase of approximately 64.2% year-on-year). Approximately $334.9 million of the stolen cryptocurrency has been recovered or frozen, compared to $488.5 million in 2024.

According to BlockSec monitoring, a suspicious transaction occurred on the Arbitrum chain involving the FutureSwapX contract, with an estimated loss of approximately $395,000.BlockSec stated that they have attempted to contact the team but have not yet received a response. It appears that the attacker stole funds through multiple changePosition operations, ultimately withdrawing USDC. Since the contract is not open source, the exact root cause still requires further investigation. Based on on-chain behavior, it is suspected that this incident may be related to unexpected fluctuations in stable balances during early position updates, which led to the release of USDC when positions were reduced or closed.

The hacker Ilya Lichtenstein from the Bitfinex Bitcoin theft case announced on the X platform that he has been released early, attributing this to the First Step Act signed by President Trump in 2018, which allows prisoners to earn sentence reductions by participating in rehabilitation programs.It is reported that Lichtenstein was sentenced to 5 years in prison in November 2024 for assisting in the laundering of nearly 120,000 bitcoins (worth about $4.5 billion at the time of the crime), while his wife Heather Morgan (online alias Razzlekhan) was sentenced to 18 months for aiding and abetting the crime and was released in October 2025.

According to monitoring by ZachXBT, currently, hundreds of wallets have been subjected to small-scale thefts (with each victim losing less than $2,000) across multiple EVM chains, but the root cause has yet to be determined.So far, these wallets have been drained of approximately $107,000, and the total losses continue to rise.

According to The Block, a report by Chainalysis shows that North Korean hackers stole a record amount of cryptocurrency in 2025, totaling over $2.17 billion, which includes nearly $1.5 billion in Ethereum stolen from the Bybit platform, marking the largest single cryptocurrency hacking incident in history.Additionally, North Korean hackers have been accused of carrying out a recent $37 million attack on the South Korean exchange Upbit. Despite facing international sanctions, North Korea's cyberattacks continue to escalate, with hacker groups like Lazarus constantly optimizing their strategies to exploit vulnerabilities in the global blockchain and cryptocurrency space.Andrew Fierman, the head of national security intelligence at Chainalysis, pointed out that relying solely on sanctions is far from sufficient; coordinated action from the entire industry is needed to combat North Korea's increasingly sophisticated hacking and money laundering ecosystem. The regime is expected to continue relying on cryptocurrency hacking as a primary source of income.

A traffic police officer in Ufa, Russia, was sentenced to 7 years in prison for stealing approximately 20 million rubles (equivalent to several hundred thousand dollars) in Bitcoin. The case dates back to 2022, when the officer illegally obtained access to the mobile phones of two detainees while handling a case, transferring BTC through a messaging app and a cryptocurrency wallet, accompanied by violent evidence collection. The court sentenced him to 7 years in a regular security prison, ordered him to compensate the victims approximately 20 million rubles, and stripped him of his police rank.

According to CoinTelegraph, data from blockchain security company CertiK shows that cryptocurrency hackers stole $3.3 billion in 2025, with supply chain vulnerabilities becoming the most destructive threat, causing losses of $1.45 billion in just two incidents. The average loss per hacking incident was $5.3 million, a 66% increase from the previous year.However, the data also shows a sharp decline in the number of security incidents, with 162 fewer incidents year-on-year, indicating that protocol-level security is improving, forcing attackers away from simple code vulnerabilities and towards phishing and infrastructure-level attacks. The report states that phishing scams have become the second largest threat, with cryptocurrency investors losing a total of $722 million across 248 incidents.

Binance co-founder He Yi posted on the X platform that her rarely used WeChat was hacked early this morning. Some users who viewed her Moments and WeChat messages blindly bought a meme coin due to their trust in her and incurred losses. She personally will allocate BNB to airdrop to users who traded this meme coin using Binance's non-custodial wallet and the Alpha platform during the time her WeChat was hacked and experienced absolute losses. The airdrop will be completed within 24 hours.She, the official Binance account, and Binance employees will not recommend any meme coins, as such content lacks long-term viability and the tokens have no price support. She hopes everyone pays attention to discerning online information and engages in responsible investment behavior, as there will be no similar subsidies in the future.

The founder of Slow Fog, Yu Xian, analyzed the "He Yi WeChat account theft" incident, stating that this account theft likely occurred because hackers took control of a user's long-abandoned phone number, thereby taking over the identity infrastructure linked to the WeChat account. Another common risk is social engineering attacks involving verification codes: after obtaining the leaked account password, hackers impersonate the user to request a 6-digit verification code from two of the user's frequently contacted WeChat friends, thus completing the account theft.Yu Xian pointed out that the prerequisites for the attack include matching account passwords from already leaked data and prior collection of information about the victim's frequently contacted friends (including users with whom there has only been interaction in group chats). Attackers often choose to execute their plans late at night, which is common in OTC scams targeting cryptocurrency users.He reminded users to be cautious when adding unfamiliar WeChat friends, to change their passwords in a timely manner, and to pay attention to various risk alerts from WeChat.