vulnerability

Bitget stated that the vulnerabilities related to the security incident discovered on September 24 have been confirmed and fixed. The platform will gradually resume withdrawals after completing further security checks. Mandiant, a cybersecurity company under Google, and Slow Mist Technology are assisting in the investigation.The resumption schedule is as follows (UTC):September 28, 8:00: Bitcoin network BTCSeptember 29, 8:00: Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism network ETHSeptember 30, 8:00: Ethereum, BNB Smart Chain, Solana, Tron network USDTOctober 2, 8:00: Other tokens, fiat currencies, and peer-to-peer transactionsBitget mentioned that the suspension of withdrawals is a temporary security measure and is unrelated to the availability of user assets; account balances have not been affected, and the protection fund will cover the financial impact caused by this platform-level incident. The situation is currently under control, and unauthorized transfers will not occur again. Trading and deposit services are still operating normally. Users do not need to take any action in advance; the specific reopening situation will be subject to notifications from the platform and official channels.

Revoke.cash stated that Limit Break's payment processor has a known vulnerability, and users who traded NFTs on the Magic Eden Ethereum marketplace may still retain relevant contract authorizations.The vulnerability has been addressed by white hat security researcher 0xQuit. Currently, NFT assets are expected to be unaffected, but users should still check and revoke affected authorizations to reduce subsequent risks.

The privacy blockchain network Zano disclosed that an inflation vulnerability involving Gateway Addresses has forced it to propose rolling back the blockchain by about 24 hours of history and requires users to immediately cease economic activities related to ZANO and Confidential Assets. Zano has promised to compensate for the losses caused by the rollback but has not yet announced the target block height for the rollback, the fix version, the compensation process, the vulnerability mechanism, and the number of unauthorized created assets.Gateway Addresses went live on August 26 with Hard Fork 6.

Meta's AI product Muse has been reported to have security vulnerabilities that could endanger user data and the safety of virtual environments. The company plans to enhance risk warnings.

Magic Eden announced that the vulnerability occurred in the NFT trading protocol Payment Processor V2 maintained by Limit Break. Magic Eden adopted this protocol for EVM network transaction settlements in 2024 but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026. Therefore, NFTs currently listed on Magic Eden are not affected by this vulnerability.NFTs listed through its EVM market between February and October 2024 may be affected, while listings after October 2024 are generally not impacted. The platform is contacting the protocol owner and maintainer Limit Break to explore other risk mitigation measures, including pausing protocol transfers, and will continue to investigate the actual scope of the impact.Magic Eden reminds users who have listed or traded NFTs on its EVM market to revoke relevant contract authorizations on the Ethereum, Polygon, and Base networks. Users can filter the address through revoke.cash and revoke all authorizations marked as "approved for all" for NFTs. Magic Eden emphasizes that revoking authorization cannot recover assets that have already been transferred.Yuga Labs' Vice President of Blockchain Quit stated today that at 9 AM Eastern Time, attackers exploited the Payment Processor V2 vulnerability to steal a large number of NFTs. After contacting the LimitBreak team, the latter quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain is also temporarily unable to be paused. Therefore, the team implemented a white-hat operation, successfully transferring and protecting 23,155 NFTs valued at over 5.7 million dollars.

The NFT market Magic Eden appears to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets.Quit, the Vice President of Blockchain at Yuga Labs, stated that this transfer is part of a white hat operation. The related NFTs are currently stored in an address starting with "0x71cF," and the assets are in a secure state. They will be returned in full once the risk is eliminated.

White hat actors transferred 40.71 bitcoins related to the Coldcard vulnerability into a single transaction, valued at approximately 3.31 million dollars. This transaction aggregated funds from 11 addresses and included OP_RETURN information pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, revealed that a larger aggregation transferred a total of 52.37 bitcoins, involving multiple clusters of attacker addresses, accounting for about 2.8% of the funds involved in the vulnerability. A firmware flaw in Coldcard devices from March 2021 led to insufficient randomness in the mnemonic phrases, with the peak amount of funds involved being approximately 130 million dollars.

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

Attackers exploited a signature verification bypass vulnerability in the Kasplex KRC-20 off-chain indexer to transfer 186 million ZEAL and 54.398 billion NACHO without holding the private keys of the bridge custody wallet. They executed five forged transactions to mint the tokens through the Igra Labs EVM layer and Kasplex L2, then sold them to the Zealous Swap liquidity pool. The KAS side of the affected liquidity pool experienced a value loss of 94% to 99.6%.Igra has suspended iKAS withdrawals to Kaspa L1 and Hyperlane transfers, and has warned users to avoid bridging KRC-20 tokens, buying ZEAL or NACHO on the L2 DEX, and adding liquidity to the related pools. The Kaspa L1 consensus and unbridged Igra assets were not affected. Zealous Swap stated that the operators need to fix the indexer and re-index the history, rejecting transactions with empty signatures, abnormal tags, and transactions containing scripts after OP_ENDIF.

The firmware vulnerability of the hardware wallet Coldcard in 2021 led to insufficient randomness in some recovery seeds. Since July 30, attackers have transferred approximately 1,600 to 1,800 Bitcoins from affected wallets, involving thousands of addresses, with a valuation exceeding 100 million dollars. Coldcard manufacturer Coinkite stated that it must be assumed that someone is using AI to review its public firmware. This vulnerability has existed for about five years, and whether AI was involved in the related attacks has not been confirmed.Shielded Labs researcher Taylor Hornby used Claude Opus 4.8 audit agent to discover a vulnerability in the Zcash Orchard shielded pool circuit that began in 2022, which could generate an unlimited amount of counterfeit ZEC without detection during testing. Developers completed the fix within a few days, and no theft of coins has been confirmed.Blockchain analysis company Chainalysis statistics show that the on-chain write volume carrying malware instructions and command control information has increased from an average of about 2.06 times to 11.1 times daily, a growth of 440%.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

According to EU-Startups, Hackuity, an AI-driven vulnerability operations center based in Lyon, France, announced the completion of a €16 million (approximately $19 million) funding round, led by Forgepoint Capital International, with follow-on investments from Bright Pixel, Bpifrance, and Seventure Partners, bringing the total funding to €32 million.The funds will be used for product innovation, enhancement of AI capabilities, and expansion into European and Asian markets. The Hackuity platform integrates data from over 130 security tools and automates vulnerability prioritization and remediation through a proprietary risk scoring engine. It currently serves over 6,000 users, protecting more than 2 million assets and managing 1 billion security findings, with clients including large enterprises such as ENGIE, BPCE, and Orange Cyberdefense.

According to Slow Fog's disclosure, Core Lightning (CLN) has an experimental feature vulnerability that may put user funds at risk. Core Lightning's official statement indicates that they are investigating the vulnerability and recommend that all nodes with experimental features enabled immediately disable them and wait for a patch. High-risk options include --experimental-dual-fund, --experimental-splicing, and --experimental-peer-storage.Slow Fog stated that similar issues were fixed in August, where remote peers could specify arbitrary or even zero fees in channel opening or fund adjustment protocols. Local nodes would sign and write to the database without additional verification, potentially forcing nodes to incur abnormal fees or even trigger a crash loop, leading to long-term offline status for the nodes.Node operators are advised to immediately disable or remove all experimental parameters; do not completely shut down the nodes, but use offline mode to retain on-chain monitoring capabilities to prevent peers from forcefully closing channels while the node is offline; verify signatures after the official patch is released before upgrading, and be cautious of fake patch links shared by impersonating official accounts.

According to the Slow Mist security team, the BonfireSwap router contract suffered a loss of approximately $50,000 due to a lack of access control in the transfer function. This function did not verify whether the caller was the from address, nor did it check the caller's authorization for the assets of the from address. As a result, attackers could set users who had pre-authorized the router as the from address and themselves as the to address, thereby stealing the victim's TOKEN and exchanging it through the same token pool.Slow Mist stated that a total of 41 TOKEN holders who had authorized the router were affected; the vulnerable contract address is 0x17e801e17cefc6334059189c178d4783830e03d3.

According to Slow Fog monitoring, GitLab CE/EE has a serious path traversal vulnerability CVE-2026-85706, with a CVSS score of 10. An unauthenticated attacker can read any file on the affected GitLab server through the Repository Commits API. GitLab has released a security patch.Affected versions include those from 18.7 up to but not including 19.1.8, from 19.2 up to but not including 19.2.6, and from 19.3 up to but not including 19.3.2. Self-managed GitLab users should upgrade immediately to 19.1.8, 19.2.6, or 19.3.2, and check logs and potentially exposed credentials after patching.

According to Cointelegraph, the cross-chain liquidity protocol Symbiosis announced that it has recovered 15 BTC (approximately $1.1 million) from its Bitcoin bridge vulnerability and deposited it into a multi-signature wallet controlled by the team. The vulnerability occurred last Friday, where the attacker exploited the protocol's flaw to mint 46.1 billion uncollateralized tokens, resulting in a profit of 4.3 WBTC (approximately $336,000).Symbiosis had previously offered a 20% white hat bounty to the attacker for the return of the assets, but the deadline has passed, and the attacker has not responded. The protocol is now offering a 20% bounty to anyone who can provide clues to help recover the assets, while also promising to announce a compensation plan for affected liquidity providers. The affected Bitcoin bridging function remains suspended.

The on-chain security platform Blockaid discovered a vulnerability in the Bitcoin bridge of the cross-chain protocol Symbiosis, where attackers minted approximately 2^62 syBTC to a newly created externally owned account, valued at about 46.1 billion dollars when calculated to 8 decimal places, and sold about 4.39 WBTC on Uniswap V4 on Ethereum, realizing a cash-out of approximately 336,000 dollars.Symbiosis stated that the attack occurred around 4:28 AM on September 11, and the team has suspended the BTC routing, while other routings remain operational and unaffected. The team has recovered about 15 Bitcoins and deposited them into a multi-signature wallet controlled by the team, while offering a 20% white hat bounty on the funds to the attackers, with a deadline of September 13.In recent weeks, Liquid Network, Nomic, and Symbiosis have all experienced security incidents involving the expansion of supply by minting tokens without real asset backing. As of September 13, Symbiosis has not publicly disclosed a technical review of BridgeV2, the final loss amount, or confirmation on whether the attackers accepted the bounty.

According to SlowMist's security alert, the AtomicQueue contract of ether.fi was exploited due to the lack of access control in the solve() function, resulting in approximately 15.45 ETH being stolen.The attacker created malicious requests using updateAtomicRequest(), forcing the victim's address to act as the solver. Subsequently, AtomicQueue called the victim's finishSolve and executed want.transferFrom, abusing the victim's existing ERC-20 authorization to transfer funds. SlowMist has privately disclosed the attacker’s address and the vulnerability contract address to the ether.fi team.

According to Bitcoin News monitoring, DART stated that it, along with independent white hat researchers, has recovered over 50 BTC from wallets affected by the COLDCARD entropy vulnerability, completing the transfer before malicious attackers could steal them. DART is a digital asset recovery organization that collaborates with white hat researchers to protect vulnerable funds and coordinates their legal return to the owners.The white hat researchers did not request a bounty and will return the Bitcoin to the owners. The recovered BTC has been transferred to the Crypto Recovery Trust. This trust is a dedicated statutory trust established under Wyoming state law to hold recovered digital assets and return them after confirming and verifying the legitimate owners.The trust will document the recovery process, separating the BTC from DART and the researchers' funds, conducting blockchain analysis, ownership verification, and sanctions screening, and providing a legal return process for verified owners. If there is a dispute over ownership, or if the related funds are involved in sanctions or criminal proceedings, the BTC will be handled according to applicable legal procedures. DART stated that other vulnerable assets and recovery leads are still under review.

Liquid Network has released the latest update stating that the emergency version Elements v23.3.4 is now online. Functionary nodes have immediately begun upgrading and all Liquid node operators are advised to synchronize updates. This version addresses the previously discovered Proof verification cache vulnerability and strengthens the cache keys used for Range Proof.Regarding network recovery, Blockstream states that it is still formulating a recovery plan, which is expected to proceed in three phases: restoring block production while continuing to suspend Peg operations; replaying verified valid transactions; and restoring Peg operations after the network status is fully restored and funds are confirmed to be returned. Currently, the first two phases are being tested in parallel, and any phase will only advance once safety is confirmed. Liquid Network indicates that Elements v23.3.4 has completed multiple rounds of internal and external reviews, with participants including the Bitcoin Red Team, Alpen Labs, and other teams.At the same time, Liquid Network reminds users to be vigilant against fraudulent upgrade websites exploiting this incident. Information should only be obtained through official Liquid Network and Blockstream channels, and users should never send funds to strangers or disclose private keys or recovery phrases.