wallet

According to Onchain Lens monitoring, the Morgan Stanley Bitcoin ETF wallet (bc1qt...vdqg) received 51.57 BTC from Coinbase Prime, worth approximately 4.12 million USD.In the past 3 days, the wallet has accumulated inflows of 80.22 BTC, worth approximately 6.45 million USD.

Blink Wallet, a Bitcoin wallet, announced a monthly idle fee of $1 for custodial accounts that have not logged into the app for 12 consecutive months. This adjustment was initiated at the beginning of September through a change in the terms of service and push notifications were sent to inactive users, with the first deduction completed in mid-October. According to a blog post released by the company, users who log back in within 12 months will have the deducted fees refunded.This fee applies only to custodial accounts and aims to alleviate the burden that inactive accounts place on the startup. The announcement stated that these accounts incur ongoing costs related to ledger and infrastructure maintenance, record verification retention, compliance monitoring and reporting, as well as support for claims, which were previously shared by active users through regular in-app transaction fees. Sources told Bitcoin Magazine that approximately 100,000 accounts met the criteria for inactivity at the time of the first deduction, with a total balance exceeding $800,000. The first deduction collected about $45,000, primarily from accounts that had been idle for over a year with small Bitcoin balances. Blink Wallet originated from the Bitcoin adoption wave in El Salvador, initially named Bitcoin Beach Wallet, and was an early custodial Lightning Network wallet that introduced the Stable Sats feature to hedge value against the US dollar. The wallet was spun off from the founding company Galoy in October 2024, operated by Lukas Duczko and a new board, with Duczko holding a controlling stake, while Galoy continues as a service provider and minority shareholder, also establishing the Bitcoin Beach Fund.In recent years, custodial wallets have faced overall pressure, with Wallet of Satoshi, Alby, and Blue Wallet successively halting custodial wallet services and shifting to self-custody infrastructures like Spark. The EU MiCA regulations regarding licensing and KYC compliance requirements are an important backdrop. Blink launched a self-custody wallet supported by Spark in June 2026, and its user base is still adapting to this transition. On September 19, hackers withdrew 6.61 Bitcoins from custodial wallet users through compromised management tools, and the company's investors subsequently announced that they would fully compensate affected users.

The vulnerability bounty platform Immunefi's CEO Mitchell Amador warned that internet users still face the risk of cyberattacks triggered by PHP vulnerabilities, especially small websites that are slow to adopt emergency upgrades, which may take weeks to patch. He stated, "The vulnerability apocalypse" is coming as planned, where the cost of discovering vulnerabilities becomes cheap while the cost of fixing them remains high. He advised users to treat any websites they log into in the coming weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting to encrypted wallets, and revoke token authorizations that are unrecognizable.Previously, the PHP Foundation admitted that it delayed fixing a critical security vulnerability first discovered in 2024 due to resource shortages. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website still needs to complete the upgrade on its own. Cloudflare CEO Matthew Prince stated that within 24 hours of the PHP vulnerability being publicly disclosed, the web recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs, PHP supports about 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites.The FBI's Cyber Division also warned that these vulnerabilities could allow malicious actors to "remotely execute code in the PHP core, potentially compromising sensitive data and networks." Amador warned in an interview with Cointelegraph in June that the proliferation of cutting-edge AI models has changed the cybersecurity landscape, giving attackers an advantage, leading to the emergence of the "vulnerability apocalypse," and triggering a resurgence of DeFi hacking attacks. Immunefi is the world's largest vulnerability bounty platform, having paid out $140 million in bounties to 650 protocols to date.

On October 24, the Bitcoin lightweight wallet Electrum disclosed a malicious server attack targeting transaction fee increases and fixed it in version 4.8.3, corresponding to GitHub security advisory GHSA-6jp4-8v48-cc5v. Users may inadvertently sign funds over to the attacker when performing regular fee increases on transactions. Developers stated that the issue arose after users reported losing funds after signing fee increases.The results of two reports differed: one person discovered that transactions in the wallet history were replaced after broadcasting a payment and claimed that the original payment did not enter the Bitcoin peer-to-peer network and was withheld by the server; another person, Raju-K12, reported losing funds due to the fee increase on the replaced transaction. In the attack, the malicious server withheld new transactions broadcasted by the client and inserted a conflicting transaction into the history, replacing the original output with the attacker's address. The replacement transaction was signed invalidly at that time, but the lightweight client did not verify these signatures before displaying unconfirmed transactions; after the user manually increased the fee and signed through RBF, the attacker received the funds. Both individuals claimed that the last four digits of the attacker's address were the same as those of the legitimate receiving address. The announcement did not disclose the amount stolen, transaction identifiers, or the attacker's address.The patch corresponds to commit 90fe308, which checks the signatures of the wallet's own inputs before writing memory pool transactions to local history, but does not overwrite inputs from external addresses of the wallet and does not perform complete consensus verification. The announcement suggests that users who have not upgraded should verify the output address and amount each time they sign; clients connected to their own or trusted servers are not affected by this attack. On the timeline, the issue was first privately disclosed on October 11, received reports of fee loss on October 18, the fixed version was tagged on October 23, and the binary and public disclosure occurred on October 24.

On October 25, according to official news, the ninth phase of the decentralized stablecoin USDD's collaboration with Binance Wallet for the Strategy event will go live on October 27 at 8:00 AM (Singapore time) and will last until December 16 at 07:59. This phase will offer a reward pool equivalent to a total of $700,000 in USDD. Users can participate by depositing at least 100 USDT in the Binance Wallet Strategy section and will automatically qualify for the reward distribution.It is reported that current participants do not need to take any additional actions to automatically join the ninth phase of the event. The entry point for the event is the Binance Wallet Strategy page. For more details, please visit: https://usdd.io.

Cryptocurrency hardware wallet manufacturer Keystone disclosed that its website experienced a security breach, allowing unauthorized third parties to access customer names, contact information, shipping addresses, and order details. Keystone stated that it has blocked access, fixed the vulnerability, and launched an investigation, while also notifying affected customers, but did not disclose the number of individuals impacted.Security researcher Taylor Monahan warned that the leaked shipping addresses could expose customers to targeted scams and personal attacks. Keystone stated in 2023 that it would shorten the retention period for customer data to 180 days, but some customers reported receiving breach notifications more than two years after purchasing their devices.

According to Lookonchain monitoring, three wallet addresses suspected to belong to the same whale have deposited a total of 494,310 HYPE (approximately 37.83 million USD) into Coinbase in the past 24 hours, showing signs of selling.

Hardware wallet manufacturer Keystone has confirmed that its website suffered a security breach, resulting in the leakage of some customers' address information and order details. The company stated that it took immediate action upon discovering the vulnerability and successfully prevented unauthorized access.Currently, Keystone has completed the vulnerability repair work and emphasized that this incident did not affect users' payment details, mnemonic phrases, or private keys. The company stated that it will continue to strengthen security measures.

According to monitoring by Arkham, the address marked as the Polygon multi-signature wallet "0xFA5" has transferred a total of 52,928,000 POL to the staking contract address, valued at approximately 4.82 million USD.Market analysis suggests that the recent increase in Polygon staking activities is related to the rise in APY, which may also provide some support for POL and alleviate its downward price pressure.

According to CoinDesk, asset management giant Franklin Templeton recently added approximately 150 million dollars worth of tokenized money market fund shares to the XRP Ledger (XRPL), increasing the total supply of sgBENJI tokens on the network from about 48 million to 193 million.Based on the transaction record of 1.039 dollars per share, the total value is approximately 200 million dollars.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

ether.fi announced the acquisition of the cryptocurrency wallet Zeal Wallet. Zeal users can currently migrate directly within the Zeal app to ether.fi.After the migration, users can utilize the lending, yield, stock, and gold trading services provided by ether.fi. This announcement has not yet disclosed the specific acquisition amount and transaction terms.

According to Onchain Lens monitoring, BlackRock ETF-related wallets transferred 3,215 BTC to Coinbase Prime in the past 2 hours, worth approximately 262.41 million USD, and 38,882 ETH, worth approximately 93.22 million USD, with a total transfer amount of about 355.63 million USD.

Blockchain security company Socket discovered 16 counterfeit Rabby and OKX wallet extensions on the Firefox browser. According to Socket, Mozilla removed these extensions before October 5.Socket pointed out that removing these malicious extensions does not ensure the safety of wallet users whose mnemonic phrases have already been compromised.

On October 23, Binance wallet web developer Jackson.ll (@0xOar) posted that there are more ways to use Agent ID, but users should carefully check the risk warnings. He stated that enabling developer mode for Agent means that unverified contract transactions can be signed, and the related potential risks need to be noted. It is recommended to close it as soon as possible after completing the operation or wait for verified developer products.Binance co-founder He Yi subsequently retweeted the post. Previously, several exclusive Binance Agent wallet projects had appeared on the market, and some projects required enabling developer mode.

According to Lookonchain monitoring, 40 newly created wallets have withdrawn 9,458 BTC from Wintermute since October 1, worth $772 million.

According to Onchain Lens monitoring, Fidelity's FBTC ETF wallet (bc1qfse...5cww9k) purchased and withdrew 282.63 BTC from Binance, worth 23.08 million USD.

Zhao Changpeng stated that no cryptocurrency wallet can achieve absolute security, and there is no software without vulnerabilities or technology that is 100% secure.He pointed out that any action carries risks, and so does inaction; it is inevitable to encounter problems, setbacks, and challenges that need to be addressed during the process. Zhao Changpeng advised users to stay informed about the latest developments, manage risks effectively, and actively solve problems.

CoinDCX released further clarification regarding the on-chain activities of the TQKJQ wallet, stating that after the security incident in July 2025, the affected wallet addresses have been deactivated, but some users are still depositing funds to the old addresses. The platform's original periodic fund collection process was ineffective for a period of time, and the related issues were discovered this morning, resulting in some operational losses, which will be borne by CoinDCX.CoinDCX stated that despite some users depositing funds to the deactivated addresses, the relevant user accounts have still received the corresponding credits. The platform claims that customer assets continue to be stored in independent cold wallets, and the currently active wallets and user addresses have not been affected, with the platform's trading operations running normally. CoinDCX also reminds users to verify the latest deposit addresses only through the official app or website to avoid transferring funds to deactivated addresses.Previously, on-chain detective ZachXBT had questioned why the deposit address TQKJQ was still in use for about 10 months after the security incident, with approximately $15.8 million of user deposits unaccounted for.

Bitcoin News posted on the X platform that DOOM has been successfully ported to the Trezor hardware wallet and is running on it.