atta

Self-proclaimed "white hat hackers" extracted about 4,000 BTC from Liquid Network and have returned 3,400 BTC (approximately $269.2 million) to the federal wallet of the sidechain on Monday, recovering about 85% of the funds. The incident began on Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The attackers claimed to be "white hat hackers" through Bitcoin transaction messages and demanded that the vulnerability be fixed first. Blockstream then sent a signed message stating that "the bridging node has been patched and funds can be safely returned," after which the attackers transferred the funds. Nevertheless, about 598.5 BTC (approximately $47 million) remains in the related address. Ledger's Chief Technology Officer Charles Guillemet expressed skepticism about the "white hat" claim, stating that if this were a negotiated reward under on-chain crypto contracts, it looked more like extortion. Liquid has disabled the bridging nodes and requested exchanges to suspend L-BTC deposits and withdrawals, but has not yet announced a plan for handling the remaining funds or when normal operations will resume.

According to a report by Decrypt, Galaxy Research stated that the third wave of attackers on the Coldcard hardware wallet has recently transferred 97.09 BTC, worth approximately 7.7 million dollars at current prices, accounting for about 45% of the stolen Bitcoin in this wave.Among them, the attackers transferred about 20.5 BTC to Ethereum via THORChain cross-chain on September 2; subsequently, they moved some funds into the CoinJoin mixing process to increase the difficulty of tracking the funds. Currently, 11 of the 293 2-of-2 multi-signature addresses established by the attackers in the third wave have been emptied.The report indicated that this Coldcard security incident originated from a firmware vulnerability introduced in 2021, which significantly reduced the randomness of wallet mnemonic phrase generation, allowing attackers to potentially reconstruct private keys offline and steal funds. As of now, approximately 82% of the stolen BTC in the entire Coldcard attack incident has not yet been transferred.Galaxy Research believes that if the newly discovered suspected victim addresses are included in the statistics, the total amount of stolen BTC may reach about 1,806, worth approximately 144 million dollars.

According to Blockaid monitoring, it has detected that the DeFi risk management protocol Cozy on Optimism has been attacked, resulting in a loss of approximately $170,000.

Blockchain Rocket announced that an on-chain attack occurred on September 5, resulting in a loss of approximately $287,000 in funds. The attacker exploited dormant perpetual markets on Rocket, placing artificially inflated price orders through disposable accounts and trading with themselves, generating false profits on the accounts while causing the disposable accounts to go bankrupt. The attacker then withdrew approximately $287,000 in profits from the Bridge.Currently, all deposits, withdrawals, and trading have been suspended. The team is working with security firms and law enforcement agencies, coordinating with exchanges, cross-chain bridges, and stablecoin issuers to track and freeze the stolen funds. The official statement indicates that a recovery plan is being developed, prioritizing refunds for small accounts, with specific details to be announced as soon as possible.

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to on-chain detective Specter monitoring, Balancer is suspected to have encountered a V1 attack, with an attacker continuously transferring funds, currently profiting $250,000. The related address is 0x112...E0aE.

Base co-founder Jesse Pollak clarified in a post on platform X that his account was attacked, and the attacker published a scam token ticker through third-party applications connected to the account. Jesse stated that the related posts have been deleted, all third-party application connections have been removed, and he has regained full control of the account, reminding users to be cautious about security.According to a screenshot of the deleted post, after gaining control of Jesse Pollak's account, the attacker published a token named BASEMEME and described it as "the first meme coin with actual utility," along with the trading entry and contract address for o1.exchange. The market value of this meme coin is currently reported at $257,000.

PeckShield data shows that in August 2026, the cryptocurrency industry experienced 50 major hacking attacks, an increase of 67% compared to July; losses decreased to $136.3 million, a drop of 49.5%. Among them, Tectonicfi lost approximately $74 million, and after Cronos suspended its network, only about $6 million was transferred out.Digital asset security company AEREDIUM launched AERSeal, which aims to replace the single private key controlling privileged smart contract functions with a multi-party authorized threshold signature. This product stores key shares in hardware-certified secure isolated environments and supports Ethereum Virtual Machine and compatible chains. AERSeal does not reconstruct the complete private key but generates signatures through the CGGMP24 threshold signature protocol. AEREDIUM founder and CEO Albert Dadon stated that the product can delegate permissions for minting, upgrading, and other functions to the threshold key, and confirm the transfer completion through on-chain verification; customers can also independently verify the allocated threshold key.

According to the Slow Fog Security Team, they have detected an attack activity disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2.The attackers exploited six vulnerabilities codenamed DarkSword to form a complete attack chain, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write, allowing them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground.The Slow Fog team stated that the aforementioned six vulnerabilities have now been patched by Apple, and the current attack belongs to the reuse of n-day vulnerability chains. Simply visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

According to Pie Shield citing Specter monitoring, the escrow contract of the fixed-rate lending protocol Notional Finance is suspected to have been attacked, resulting in a loss of approximately $1.7 million in DAI and USDC.The attacker subsequently exchanged the stolen funds for about 689.2 ETH and further deposited the funds into Tornado Cash. Currently, the reasons for the attack and the final scale of the losses are still pending further confirmation from the project team.

According to market news, the Tectonic attacker marked address has deposited 2,658.9 ETH (approximately 6.65 million USD) into TornadoCash.

U.S. Attorney General Todd Blanche posted on the X platform that this week cybercriminals launched password recovery attacks against hundreds of thousands of X users. The X platform successfully thwarted this attack to prevent user accounts from being hijacked, and the Department of Justice is working closely with X to track down the attackers.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

According to CoinDesk, after the U.S. military intensified airstrikes on Iranian targets, Brent crude oil surpassed $93 per barrel, and WTI approached $90 per barrel, pushing the 10-year U.S. Treasury yield up to nearly 4.8%. Risk assets are under pressure, with Bitcoin briefly dropping below $76,500, down more than 1% from midnight, and a nearly 3% correction over the past week.In terms of derivatives, Coinglass data shows that the long-short taker transaction ratio shifted to favor short positions, accounting for about 51.5%, while the overall open interest remained at around 700,000 BTC, indicating that leverage has not significantly increased. The open interest in ETH futures slightly rose alongside a price drop, interpreted as a buildup of short positions. UNI continued to rise, while TRX short positions remained crowded, and the implied volatility of BTC and ETH fell back to previous levels.

The security company Defimon issued an alert stating that a governance takeover attack against YAM Finance has been detected. After self-delegating approximately 504,000 YAM (about 3.3% of the total supply, slightly above the legal voting threshold), the attacker submitted YamGovernorAlpha proposal #45, which is described as empty ("0x"), with the sole action being to call the setPendingAdmin method of the YAM Timelock contract, pointing to the attacker's address.It has been disclosed that if the proposal is voted through and executed, the attacker will become the pendingAdmin, and then can fully control the Timelock through acceptAdmin, which includes management rights over all YAM protocol contracts and the DAO treasury, involving a risk amount of approximately $337,000. As the protocol is currently in a dormant state, Defimon Alerts reminds users holding YAM to vote against the proposal before block height 25897343 (about 34 hours remaining).

The automated market maker Aquifer on Solana was attacked, resulting in a loss of approximately $2.5 million. Aquifer subsequently issued a "white hat" offer on-chain, requesting the attacker to return at least 80% of the stolen assets to the designated Solana and Ethereum recovery addresses by September 3 at 22:00, and may retain up to 20% as a bounty.If the attacker complies, the project team promises not to file a civil lawsuit against them.

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.

Flow blockchain officially announced that at approximately 06:18 UTC today, there was a vulnerability in Ankr's ankrFLOW liquid staking contract, allowing attackers to create about 8.6 million uncollateralized ankrFLOW. This is not a vulnerability of the Flow EVM or the Flow protocol and does not affect the Flow token economics.The attackers subsequently used ankrFLOW as collateral to deplete approximately 15.5 million WFLOW reserves on the MORE Markets lending protocol, valued at about $410,000, and made a profit of about $246,000 after slippage. Some reports incorrectly stated that the impact was around $9.3 million. Ankr and MORE Markets have suspended the related contracts, and some exchanges have proactively suspended FLOW deposits.The Flow Foundation will work with Ankr to replenish the stolen WFLOW reserves and rebalance the liquidity pool. The Flow network is operating normally, and ankrFLOW staking and MORE Markets lending will be suspended until Ankr deploys a fix upgrade. User funds are safe, and no action is required.