affected

OpenCode stated that a security incident related to a large-scale model distillation attack occurred, affecting approximately 1.4% of OpenCode Console users.The affected range mainly involves some users connected to external model providers. OpenCode has notified all affected accounts via email; users who did not receive a notification are not included in this impact.

Co-founder Edison released an update regarding the recent data breach incident involving encrypted cards. Edison stated that the compliance and operations team is contacting affected users, has reported to relevant agencies such as the Personal Data Protection Commission (PDPC), and has formally filed a police report. They are currently working closely with law enforcement, and the encrypted card business continues to operate normally.

Ledger Support released an update stating that it has confirmed the presence of unauthorized hardware implants in the device of one affected user. They are currently contacting the affected user and continuing to investigate the matter. Ledger is calling on anyone with information to provide leads and has stated that it is cooperating with relevant law enforcement agencies to hold those involved accountable. As a precaution, CryptoBilis has confirmed the suspension of sales of all hardware wallet inventory until the investigation is complete, and Ledger is actively communicating with them regarding follow-up measures.Ledger stated that there are currently no signs that its security infrastructure, systems, or services have been compromised. For users who purchased Ledger devices from this dealer, if the initialization setup has not yet been completed, it is advised not to start the setup; if the setup has been completed, they should consider transferring assets to a new Ledger signing device using new recovery phrases.Ledger emphasizes that security threats are constantly evolving, and the company is continuously improving security measures and advancing more sophisticated tamper-proof solutions. It also reminds users to be vigilant against scams that take advantage of this situation and to obtain the latest information only through official Ledger channels. Ledger will not ask users for their 24-word recovery phrase.

The on-chain guarantee protocol Firelight stated that some deposit addresses failed the fund screening, and the related funds have been unstaked and returned to the original addresses, involving 87 addresses and a total of 117,500 FXRP. Firelight mentioned that the current mechanism screens blacklisted addresses or addresses sanctioned by OFAC during fund deployment and throughout the entire cycle. If an address is flagged during deployment or within the cycle, the funds will remain in the protocol until the cycle ends and will not generate rewards, but can still participate in the guarantee module for the remaining time of that cycle.After the cycle ends, the funds will be returned, and the related wallets will be prohibited from accessing again. Firelight stated that this practice is unsustainable and will roll back the blacklist process in the coming days and unfreeze the affected wallets; the time and steps for retrieving funds will be announced separately. Security, KYC, and institutional standards remain unchanged, and Firelight will develop a new plan that does not affect users in the coming weeks and will seek community input before any changes. Flare co-founder Hugo Philion stated that due to compliance policies, 84 Flare addresses have been unstaked by Firelight, and he personally will issue equivalent subsidies to those addresses that are not sanctioned and not widely blacklisted.

Ark Protocol project Second disclosed that its server was exploited on Monday, resulting in a loss of 0.75 Bitcoin of its own funds, approximately $62,300. The team stated that user funds were not affected and repairs were completed within a few hours.The attacker subsequently continued to attempt to extract more funds from the project and launched a denial-of-service attack. Second stated on Tuesday that the attack could lead to a decrease in the ability of wallets based on Bark to receive Lightning Network transfers. Second indicated that the vulnerability occurred in the boarding process of the Ark server, allowing the attacker to register and exit related boards solely with their own signature, while spending the same batch of VTXO in the nodes through the Lightning Network. The attacker also attempted to use Bitcoin related to the security vulnerability of Blink Wallet from September 19, but was unsuccessful.

According to the Financial Times, American companies are feeling the impact of a bond sell-off. As U.S. Treasury yields rise, some companies are being forced to reconsider their borrowing plans.Investors indicate that if yields remain high, more default cases may be seen.

Regarding the previous incident where the FlashLoopAdapter vulnerability caused a loss of approximately 114 ETH from two Safe multi-signatures, Aave founder Stani Kulechov stated that the contract with the vulnerability is not the Aave v3 contract, but rather a third-party external adapter built on top of Aave, which does not affect Aave v3 itself.Previously, SlowMist disclosed that the FlashLoopAdapter has an access control vulnerability, which attackers exploited to bypass permission checks and transfer assets from two Safe multi-signatures that enabled the module, ultimately resulting in a loss of approximately 114.09 ETH.

MetaMask has released a follow-up statement regarding the previously disclosed infrastructure security incidents, stating that the team is continuously conducting investigations and addressing the issues.MetaMask stated that to ensure user safety, it has collaborated with relevant partners to take preventive measures and is currently withdrawing the affected validator nodes from its non-custodial staking business. According to the investigation results so far, there is no indication that MetaMask wallets or customer funds have been affected.This morning, part of the infrastructure of MetaMask's non-custodial staking business encountered a security incident. As a precaution, the validators operating on Lido have begun to withdraw.

Aave founder Stani posted on the X platform, stating that the team is currently monitoring the progress of the MetaMask Staking infrastructure security incident in collaboration with Lido.Stani mentioned that the Aave market is currently unaffected, and all operations are running normally.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

DyorSwap officially announced that the so-called "GIWA Mainnet" identified by the team earlier is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

DyorSwap officially announced that the so-called "GIWA mainnet" previously identified by the team is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

Bitget stated that the vulnerabilities related to the security incident discovered on September 24 have been confirmed and fixed. The platform will gradually resume withdrawals after completing further security checks. Mandiant, a cybersecurity company under Google, and Slow Mist Technology are assisting in the investigation.The resumption schedule is as follows (UTC):September 28, 8:00: Bitcoin network BTCSeptember 29, 8:00: Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism network ETHSeptember 30, 8:00: Ethereum, BNB Smart Chain, Solana, Tron network USDTOctober 2, 8:00: Other tokens, fiat currencies, and peer-to-peer transactionsBitget mentioned that the suspension of withdrawals is a temporary security measure and is unrelated to the availability of user assets; account balances have not been affected, and the protection fund will cover the financial impact caused by this platform-level incident. The situation is currently under control, and unauthorized transfers will not occur again. Trading and deposit services are still operating normally. Users do not need to take any action in advance; the specific reopening situation will be subject to notifications from the platform and official channels.

OpenSea Chief Technology Officer (CTO) Chris Maddern posted on the X platform in response to the impact of the security incident involving Magic Eden and Limit Break, emphasizing that OpenSea's systems and smart contracts have not been affected. Currently, the affected ERC-721 NFTs have been marked on OpenSea and cannot be sold.For any newly discovered exploited NFTs, OpenSea will also automatically mark them to restrict attackers from obtaining related offers.

Magic Eden announced that the vulnerability occurred in the NFT trading protocol Payment Processor V2 maintained by Limit Break. Magic Eden adopted this protocol for EVM network transaction settlements in 2024 but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026. Therefore, NFTs currently listed on Magic Eden are not affected by this vulnerability.NFTs listed through its EVM market between February and October 2024 may be affected, while listings after October 2024 are generally not impacted. The platform is contacting the protocol owner and maintainer Limit Break to explore other risk mitigation measures, including pausing protocol transfers, and will continue to investigate the actual scope of the impact.Magic Eden reminds users who have listed or traded NFTs on its EVM market to revoke relevant contract authorizations on the Ethereum, Polygon, and Base networks. Users can filter the address through revoke.cash and revoke all authorizations marked as "approved for all" for NFTs. Magic Eden emphasizes that revoking authorization cannot recover assets that have already been transferred.Yuga Labs' Vice President of Blockchain Quit stated today that at 9 AM Eastern Time, attackers exploited the Payment Processor V2 vulnerability to steal a large number of NFTs. After contacting the LimitBreak team, the latter quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain is also temporarily unable to be paused. Therefore, the team implemented a white-hat operation, successfully transferring and protecting 23,155 NFTs valued at over 5.7 million dollars.

Bitget Wallet posted on platform X stating that it operates independently from Bitget Exchange, belonging to a self-custody wallet, where user assets are always on-chain and controlled by the users themselves, isolated from the custodial infrastructure of Bitget Exchange.In response to the recent security incident at Bitget, Bitget Wallet has conducted preventive checks on its internal systems and found no security impact on the Bitget Wallet system or user self-custody assets. Currently, Bitget Wallet is operating normally and reminds users to be vigilant against phishing and impersonation activities, and to obtain the latest information through official channels.

Bitget's Greater China Regional Head, Xie Jiayin, tweeted in response to the previous attack incident, stating that the Bitget Protection Fund (currently over $464 million) can cover the losses from this attack, and user assets are unaffected.At 2:31 AM today, Bitget's security system detected abnormal transfers in some hot wallets. The security team immediately activated the emergency response mechanism. The confirmed situation includes: a preliminary assessment of the amount involved is approximately $351.6 million; the cold wallets and the vast majority of platform assets are intact and unaffected.Measures taken include: activating the emergency response team within minutes of the incident, marking and reporting the addresses involved in the abnormal transfers; temporarily disabling the withdrawal function for security reasons, which will be restored in an orderly manner after the security review is completed; notifying law enforcement and on-chain security agencies to intervene in the investigation. The team will provide continuous updates on the status every hour, and the official report will be released within 24 hours, including a root cause analysis and corrective measures. The official will not speculate on the method of attack until the investigation conclusions are clear.

Bitcoin News posted on the X platform stating that Blink claims all account balances affected by the security incident have been restored to pre-incident levels. The software vulnerability had allowed attackers to transfer funds from dozens of accounts and obtain account information for approximately 3,400 other users.Blink stated that no funds were stolen from these 3,400 accounts, and the attackers did not obtain users' names, identification documents, or addresses; the company has contacted the affected users and will release a complete incident review.

The cryptocurrency wallet application SecondFi tweeted a reminder for users affected by the previous security incident regarding the risks of claiming NIGHT tokens. Some affected users will have a window to claim NIGHT tokens on September 22, but the Midnight Foundation's system only supports claims from the original wallet addresses and cannot switch to other unaffected addresses. The affected wallets have permanently existing security risks. SecondFi advises users not to attempt to claim NIGHT through compromised wallets, or the tokens will face the risk of being stolen.SecondFi also stated that the NIGHT claiming process is independently managed by the Midnight Foundation, and its wallet migration tool and asset recovery tool do not cover NIGHT claims. Affected users should contact the Midnight Foundation directly. Previously, SecondFi experienced a security incident from June 21 to 23, resulting in approximately 16.1 million ADA (about 2.6 million USD) being stolen, involving 374 wallets.