atta

According to Digital Asset, the security platform OpenSourceMalware revealed in a program on October 21 that a North Korea-linked hacking group is using a technique called Contagious Interview, luring job seekers in the cryptocurrency industry through LinkedIn to invite them to visit private code repositories and install software packages required for development tasks.The attackers set up a .npmrc configuration file in the repository, causing npm to download dependencies from a specified external package repository instead of the public registry, which could potentially execute malicious code during the installation process and reduce the likelihood of being detected by public security scans. Paul McCarty, co-founder of OpenSourceMalware, stated that this type of technique has been observed recently among attackers. The specific number of victims, affected companies, or the amount of digital asset losses has not yet been disclosed.

According to on-chain analyst PeckShield (@PeckShieldAlert), the address marked as the Cysic attacker has deposited 300 ETH (approximately $721,140) and 30.4 BNB (approximately $22,590) into Tornado Cash.According to the Cysic Foundation, a security incident occurred on October 17 involving the Cysic cross-chain bridge, where the attacker unauthorizedly minted 10 million CYS on the BNB Chain.

According to monitoring by Blockaid, the WAX multi-chain bridge on the WAX network is under attack, involving WAX, Solana, and Ethereum. The attackers extracted mapped tokens on the WAX chain without paying the corresponding assets, while the bridging contracts on Solana and Ethereum still released the corresponding tokens.The attackers transferred approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC through 5 transactions. It remains to be further confirmed whether the scope of the incident and the losses are still expanding.

Cysic issued a settlement proposal to the attacker who unauthorizedly issued 10 million CYS, requesting that the other party return 275.872 ETH to an address designated by the Cysic Foundation within 72 hours of the on-chain announcement, which accounts for approximately 90% of the confirmed ETH earnings. In exchange, the attacker may retain the remaining approximately 30.652 ETH as a bounty for the vulnerability.Cysic stated that it has restored the key aspects of the attack and preserved relevant technical and on-chain evidence; if the other party fails to return the funds within the deadline, the project team will escalate the matter and seek intervention from law enforcement to promote a comprehensive criminal investigation.

SlowMist released a security alert stating that NEM suffered an attack, resulting in a loss of approximately $821,920. The root cause lies in NemTokenV2 recording the tokens transferred to the liquidity pool (LP) as sell volume without verifying the exchange settlement.The attacker exploited this vulnerability, executing the transfer, calling skim() to clear the incoming tokens, and calling flushLpSellRecycle() a total of 42 times, destroying the original reserves of the liquidity pool and lowering the NEM reserve balance, and then selling the remaining NEM at an inflated price to withdraw USDT.

The privacy coin project Pirate Chain has released a mandatory update v6.14, requiring all nodes, mining pools, and exchanges to discontinue the old version and upgrade immediately. Attackers exploited two validation vulnerabilities to mint approximately 39.82 million counterfeit ARRR in the transparent coinbase pool, temporarily increasing the supply by about 20%. Both vulnerabilities have been fixed.After reaching a consensus among the community, mining pools, exchanges, and dPoW notarization nodes, the chain has been rolled back to block 4,176,944 before the attack, and all counterfeit tokens have been removed. Balances have been restored to their state before the attack, with the maximum supply remaining at 200 million coins. The new version will automatically re-index the entire chain upon its first launch, and a complete technical review report will be released later.

According to Slow Fog's disclosure, LiteLLM has once again encountered a supply chain attack, with the malicious version litellm@1.107.0 affecting PyPI packages and Docker images, including floating tags such as latest and main-stable.The injected malicious code will automatically execute upon Python startup, stealing sensitive data such as cloud credentials, AI API keys, SSH private keys, and supporting remote code execution. The affected versions have been removed or replaced. Slow Fog recommends that users avoid using version 1.107.0, rebuild the affected environment from a clean image, rotate potentially leaked credentials, and pin the version to 1.106.2.

According to security researcher Spreek (@spreekaway), the management keys of swETH and rswETH under Swell DAO are suspected to have been leaked, and attackers are raising the uncollateralized NAV (Net Asset Value) by up to 1% per hour. Currently, four malicious upgrade contracts have been detected and have not yet been queued for execution through multi-signature; if executed, they could steal approximately 2,500 ETH.Additionally, according to analysis by ADL (@ADLXBT), the management keys control the proxy administrator permissions. Once controlled by attackers, they can direct the swETH/rswETH proxy to malicious implementation contracts, triggering minting or withdrawal functions, thereby inflating the NAV without asset backing. Spreek stated that whether this incident is related to the Railway platform remains speculative; it is currently just a coincidence in timing, with no conclusive evidence available.

Dragonfly Managing Partner Haseeb Qureshi stated that there is a wave of attacks in the cybersecurity field that is "similar to the COVID-19 pandemic." He believes that on-chain hacking incidents are the "canary in the coal mine" for cybersecurity, as on-chain is the easiest place for cyber attacks to be monetized.He cited data from DefiLlama Research indicating that the number of on-chain hacking incidents has surged, but the annualized scale of stolen amounts is roughly equivalent to that of 2025, with losses per incident decreasing. He noted that most small protocols have been compromised, while large protocols are strengthening their defenses with AI tools. He anticipates that similar situations will also arise in the broader internet space.

According to CCTV News reports, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control recently discovered multiple incidents of users encountering the "Weaxor" ransomware attack within our country, relying on the National Computer Virus Collaborative Analysis Platform.After the user's important files are encrypted, the file names are changed to the original file name with the ".weax" suffix added. The attackers leave a ransom note on the host, demanding that users contact them and pay the ransom.

U.S. President Trump stated that there will be no bombing of Iran before the midterm elections. Meanwhile, the U.S. is evacuating some non-emergency personnel from Saudi Arabia, reducing troop strength at some bases in the Middle East, and increasing aircraft carrier and amphibious forces. The Israeli military reportedly deployed dozens of fighter jets near the Iranian border this week before turning back, and the target list for strikes is also being updated.The U.S. State Department has ordered the evacuation of non-emergency government employees and their families only within Saudi Arabia, citing attacks on Saudi civilian targets related to Iranian-backed Houthi forces. Additionally, reports indicate that U.S. military forces have quietly reduced troop levels in Jordan, Qatar, and Kuwait in recent days. The Wall Street Journal states that the U.S. is dispatching another aircraft carrier to the Middle East, with a third carrier strike group coming from the Pacific, and is sending an amphibious assault ship carrying Marines. If the new forces arrive and existing vessels are not rotated out, the total number of U.S. naval vessels in the region is expected to exceed 24, currently around 20.Israeli Prime Minister Netanyahu is reportedly continuing to advocate for a large-scale strike against Iran, and U.S. officials even suspect that Israel is deliberately provoking Iran to fire. Israeli Channel 12 cited U.S. sources stating that earlier this week, dozens of Israeli fighter jets and refueling aircraft flew over Syria and Iraq, approaching the Iranian border, with a flight path highly similar to that of an attack on Iran, turning back before entering Iranian airspace, which Israel claims was a drill and a deterrent. Pakistan, Qatar, and others are intensifying mediation, but the U.S. demands discussions on the nuclear program, while Iran hopes to first discuss reopening the Strait of Hormuz, with no breakthroughs in negotiations yet.

According to Salus monitoring, the attackers of Drift Protocol transferred 4,600 ETH, worth approximately 11.23 million USD, to Tornado Cash in 46 transactions from another long-dormant wallet between 15:00 and 15:19 Beijing time. This wallet had not made any outgoing transactions for about 202 days and still held 20,285.82 ETH at the time of monitoring.Salus stated that another wallet previously tracked had deposited an additional 6,110 ETH into Tornado Cash on top of the previously disclosed 19,600 ETH, bringing the total deposits of that wallet to 25,710 ETH. The two tracked wallets have cumulatively deposited 30,310 ETH into Tornado Cash.

According to The Defiant, Blockaid data shows that from January to August 2026, the 60 cryptocurrency attack incidents it tracked involved approximately $1.18 billion in funds, with victims recovering about $9.8 million, accounting for less than 1%.The report pointed out that all frozen or returned funds were achieved through on-chain governance or validator actions, and the blacklist mechanism of stablecoin issuers did not recover any funds in these 60 incidents.

Eight TLS certificates issued by eMudhra in India were found to have extremely weak private keys, allowing attackers to impersonate almost any website. Major browsers have blocked the affected certificates, but millions of servers, Linux systems, and connected devices may still need updates.A cryptography expert warned that the scale of this cleanup may exceed that of the Heartbleed vulnerability in 2014, and there is currently no confirmation of any malicious exploitation.

Digital hardware wallet manufacturer NGRAVE disclosed that attackers hijacked the third-party notification service used by its LIQUID companion app and sent false security alerts to users, resulting in approximately 70 wallet addresses being stolen across 4 blockchains, amounting to about 2.56 million dollars. Among these, the loss in Bitcoin was approximately 1.77 million dollars, XRP about 454,000 dollars, Ethereum assets about 316,000 dollars, and Stellar about 18,000 dollars.The attackers induced users to click on a counterfeit website and enter their 24-word recovery phrase or Perfect Key, subsequently using automated scripts to transfer assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised; the victims voluntarily provided their recovery credentials during the phishing process. Unauthorized access may have begun on October 11. After obtaining an access key, the attackers acquired a broader access key and sent false notifications on October 17; NGRAVE detected anomalies about 1 minute after the notifications appeared, but the first wallet was emptied 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a cryptocurrency security firm and mentioned that affected keys have been replaced, with new dual approval, domain restrictions, and emergency shutdown mechanisms implemented. The company also reminded affected users to create new wallets and contact the support team, as some device information, wallet activity, IP addresses, and approximate locations may have been exposed.

According to monitoring by the blockchain security agency Salus, the Aztec Connect attacker made 30 transactions on October 19, depositing 1,255.8 ETH (approximately 3.01 million USD) into Tornado Cash. The batches consisted of 12 transactions of 100 ETH, 5 transactions of 10 ETH, 5 transactions of 1 ETH, and 8 transactions of 0.1 ETH.On June 14, the attacker exploited a settlement verification vulnerability in the deprecated Aztec Connect contract to steal approximately 2.19 million USD in assets, including 908.987 ETH as well as DAI, wstETH, and Yearn vault tokens. After holding the funds for about four months, the attacker redeemed the vault tokens on October 19, converting the token assets into an additional 346.767 ETH. The balances of the 6 stolen ERC-20 tokens have all been reduced to zero.

The synthetic perpetual contract protocol Papertrade, built on Hyperliquid, announced that its platform token PAPER will remain non-transferable due to the risk of perpetual contract attacks. The platform stated that holders of PAPER tokens obtained through trading losses can stake them to receive USDC distribution rewards.Papertrade is a fully on-chain, user-owned synthetic perpetual contract protocol that supports up to 1000x leverage with no market impact. Currently, the platform has not disclosed a specific timeline for when the PAPER token can be transferred or sold, which means holders are temporarily unable to trade or transfer their tokens on the secondary market and can only earn rewards through staking.

Three men from Bristol, England, broke into a man's home in the early hours of May 15, assaulted the victim, and demanded a large amount of cryptocurrency. The victim sustained head injuries and was hospitalized, while the three men failed to obtain any cryptocurrency. Terroll Paul, Mohamed Samagassi, and Pierre Madzou all pleaded guilty to aggravated burglary and were sentenced at Bristol Crown Court on October 15. Paul was sentenced to 6 years, Madzou to 5 and a half years, and Samagassi to 5 years.The victim's underage sister called the police, and the three were subsequently arrested at the scene. The police did not disclose the amount of cryptocurrency demanded by the three men. The case falls under "ransom attacks," where criminals use violence or threats to force cryptocurrency holders to hand over digital assets. Data from blockchain security company CertiK shows that in the first six months of 2026, such attacks globally resulted in losses of $124 million, a 12-fold increase year-on-year.

OpenCode stated that a security incident related to a large-scale model distillation attack occurred, affecting approximately 1.4% of OpenCode Console users.The affected range mainly involves some users connected to external model providers. OpenCode has notified all affected accounts via email; users who did not receive a notification are not included in this impact.

According to the official event report from UNCX Network, on October 14, attackers exploited a set of public vesting operations of Smart Token Vesting V2, creating a discrepancy between the token balance in the pool and the recorded shares, allowing the controlled positions to withdraw excess tokens.The attack affected four networks: Ethereum, BNB Chain, Base, and Robinhood, involving 10 tokens and a total of 11 confirmed withdrawal transactions, with a verified economic value of approximately $807,609, of which about $567,500 was from the BNB Chain. The involved calls did not use administrator privileges.After the incident, white hats returned 82,143,476 X tokens and 23.8682 ETH, and currently, there are no significant tokens pending disposal. UNCX stated that it is working with legal advisors to review technical evidence and subsequent handling.