att

Self-proclaimed "white hat hackers" extracted about 4,000 BTC from Liquid Network and have returned 3,400 BTC (approximately $269.2 million) to the federal wallet of the sidechain on Monday, recovering about 85% of the funds. The incident began on Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The attackers claimed to be "white hat hackers" through Bitcoin transaction messages and demanded that the vulnerability be fixed first. Blockstream then sent a signed message stating that "the bridging node has been patched and funds can be safely returned," after which the attackers transferred the funds. Nevertheless, about 598.5 BTC (approximately $47 million) remains in the related address. Ledger's Chief Technology Officer Charles Guillemet expressed skepticism about the "white hat" claim, stating that if this were a negotiated reward under on-chain crypto contracts, it looked more like extortion. Liquid has disabled the bridging nodes and requested exchanges to suspend L-BTC deposits and withdrawals, but has not yet announced a plan for handling the remaining funds or when normal operations will resume.

According to Apnews, a young cryptocurrency scam gang stole over 4,100 BTC in August 2024 through "social engineering" attacks, which was worth over $240 million at the time.After the theft, gang members quickly began extravagant spending, including purchasing sports cars, renting luxury homes, flying on private jets, and hiring security personnel. Among them, the alleged mastermind, a 22-year-old Singaporean named Malone Lam, reportedly spent over $569,000 in one night at a nightclub in Los Angeles.Investigations revealed that the suspects impersonated employees from Google and the cryptocurrency trading platform Gemini to trick victims into giving up their Google Drive access and security codes, allowing them to transfer the victims' bitcoins. They then moved the funds through multiple trading platforms and money laundering intermediaries. Their lavish lifestyle eventually drew the attention of law enforcement.One suspect was exposed when their IP address was revealed while hiding nearly $30 million in stolen cryptocurrency assets, leading police to trace it back to the luxury home they rented in California. Another suspect was found with $37 million worth of stolen cryptocurrency assets. Lam was accused of using the stolen funds to purchase a $2 million watch and over 30 vehicles including Porsches, Lamborghinis, and Ferraris.Currently, 18 defendants have been charged, and Lam is expected to attend a plea agreement hearing this Tuesday. The U.S. Department of Justice has already issued rulings against several accomplices, and related cases are still ongoing.

According to a report by Decrypt, Galaxy Research stated that the third wave of attackers on the Coldcard hardware wallet has recently transferred 97.09 BTC, worth approximately 7.7 million dollars at current prices, accounting for about 45% of the stolen Bitcoin in this wave.Among them, the attackers transferred about 20.5 BTC to Ethereum via THORChain cross-chain on September 2; subsequently, they moved some funds into the CoinJoin mixing process to increase the difficulty of tracking the funds. Currently, 11 of the 293 2-of-2 multi-signature addresses established by the attackers in the third wave have been emptied.The report indicated that this Coldcard security incident originated from a firmware vulnerability introduced in 2021, which significantly reduced the randomness of wallet mnemonic phrase generation, allowing attackers to potentially reconstruct private keys offline and steal funds. As of now, approximately 82% of the stolen BTC in the entire Coldcard attack incident has not yet been transferred.Galaxy Research believes that if the newly discovered suspected victim addresses are included in the statistics, the total amount of stolen BTC may reach about 1,806, worth approximately 144 million dollars.

According to Blockaid monitoring, it has detected that the DeFi risk management protocol Cozy on Optimism has been attacked, resulting in a loss of approximately $170,000.

Blockchain Rocket announced that an on-chain attack occurred on September 5, resulting in a loss of approximately $287,000 in funds. The attacker exploited dormant perpetual markets on Rocket, placing artificially inflated price orders through disposable accounts and trading with themselves, generating false profits on the accounts while causing the disposable accounts to go bankrupt. The attacker then withdrew approximately $287,000 in profits from the Bridge.Currently, all deposits, withdrawals, and trading have been suspended. The team is working with security firms and law enforcement agencies, coordinating with exchanges, cross-chain bridges, and stablecoin issuers to track and freeze the stolen funds. The official statement indicates that a recovery plan is being developed, prioritizing refunds for small accounts, with specific details to be announced as soon as possible.

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to on-chain detective Specter monitoring, Balancer is suspected to have encountered a V1 attack, with an attacker continuously transferring funds, currently profiting $250,000. The related address is 0x112...E0aE.

Base co-founder Jesse Pollak clarified in a post on platform X that his account was attacked, and the attacker published a scam token ticker through third-party applications connected to the account. Jesse stated that the related posts have been deleted, all third-party application connections have been removed, and he has regained full control of the account, reminding users to be cautious about security.According to a screenshot of the deleted post, after gaining control of Jesse Pollak's account, the attacker published a token named BASEMEME and described it as "the first meme coin with actual utility," along with the trading entry and contract address for o1.exchange. The market value of this meme coin is currently reported at $257,000.

PeckShield data shows that in August 2026, the cryptocurrency industry experienced 50 major hacking attacks, an increase of 67% compared to July; losses decreased to $136.3 million, a drop of 49.5%. Among them, Tectonicfi lost approximately $74 million, and after Cronos suspended its network, only about $6 million was transferred out.Digital asset security company AEREDIUM launched AERSeal, which aims to replace the single private key controlling privileged smart contract functions with a multi-party authorized threshold signature. This product stores key shares in hardware-certified secure isolated environments and supports Ethereum Virtual Machine and compatible chains. AERSeal does not reconstruct the complete private key but generates signatures through the CGGMP24 threshold signature protocol. AEREDIUM founder and CEO Albert Dadon stated that the product can delegate permissions for minting, upgrading, and other functions to the threshold key, and confirm the transfer completion through on-chain verification; customers can also independently verify the allocated threshold key.

Connecticut Attorney General William Tong and State Banking Commissioner Jorge Perez issued a consumer alert: a resident lost $200,000 after depositing it into an unregulated DeFi crypto trading platform, and is currently unable to recover the funds. The alert lists seven offshore DeFi platforms: GMX, Gains Network, dYdX, Aevo, Drift Protocol, Vertex Protocol, and Hyperliquid, but does not state that the affected resident used any of them.Connecticut officials pointed out that some platforms offer leverage of 50x, 100x, and up to 250x; the related perpetual contracts also involve risks of liquidation, funding rates, smart contracts, and oracle risks. The alert also mentions perpetual contracts related to Apple, Tesla, Nvidia, and SpaceX, stating that they correspond to synthetic prices rather than actual stocks. Officials remind residents to verify the registration status of crypto services, keep records of transactions and communications, and report suspected fraud in a timely manner.

According to the Slow Fog Security Team, they have detected an attack activity disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2.The attackers exploited six vulnerabilities codenamed DarkSword to form a complete attack chain, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write, allowing them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground.The Slow Fog team stated that the aforementioned six vulnerabilities have now been patched by Apple, and the current attack belongs to the reuse of n-day vulnerability chains. Simply visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

According to monitoring by Catcher Predict, in the prediction market Polymarket for the event "Athletics vs. Seattle Mariners," the "Athletics" option in the sub-market "Athletics vs. Seattle Mariners" has experienced a dramatic fluctuation in winning probability, soaring from 23.5% an hour ago to the current 57% (a fluctuation of 33.5%). Please note the impact of relevant breaking news.

According to Politico, Texas Attorney General Ken Paxton has long advocated for strict enforcement of gambling laws, but after his political action committee received a $5,000 donation from the prediction market platform Kalshi in May 2025, and he personally received a $7,000 donation from Kalshi CEO Tarek Mansour in June of the same year, he did not participate in several legal actions initiated by other state attorneys general aimed at restricting Kalshi's operations.

According to GMGN data, the top 5 tokens with net inflow of KOL in the past 24 hours are as follows:dog (G2Xh....ump): net inflow of $2,000, increased by 206.6% in the past 24 hours, currently priced at $0.0001.biketyson (CbyT....ump): net inflow of $2,000, increased by 16165.1% in the past 24 hours, currently priced at $0.0005.TripleT (J8PS....ump): net inflow of $1,000, increased by 51.3% in the past 24 hours, currently priced at $0.0136.AERO (45p6....ump): net inflow of $549, increased by 52.4% in the past 24 hours, currently priced at $0.0001.MEGUSTA (EzX3....ump): net inflow of $460, increased by 13.6% in the past 24 hours, currently priced at $0.0001.

According to Pie Shield citing Specter monitoring, the escrow contract of the fixed-rate lending protocol Notional Finance is suspected to have been attacked, resulting in a loss of approximately $1.7 million in DAI and USDC.The attacker subsequently exchanged the stolen funds for about 689.2 ETH and further deposited the funds into Tornado Cash. Currently, the reasons for the attack and the final scale of the losses are still pending further confirmation from the project team.

According to market news, the Tectonic attacker marked address has deposited 2,658.9 ETH (approximately 6.65 million USD) into TornadoCash.

According to monitoring by Ai Yi, XXAntiWar has transferred all 17.57 million cow tokens to the Binance Alpha wallet, worth approximately 1.45 million USD.In the past half hour, the aforementioned tokens have been transferred. Since the tokens will enter the Proxy aggregation address after being recharged to the Binance Alpha wallet, subsequent on-chain movements are currently not visible, and the specific use is still unclear.

U.S. Attorney General Todd Blanche posted on the X platform that this week cybercriminals launched password recovery attacks against hundreds of thousands of X users. The X platform successfully thwarted this attack to prevent user accounts from being hijacked, and the Department of Justice is working closely with X to track down the attackers.