attacker

According to GCSA monitoring, the Global Cybersecurity Alliance (GCSA) has released three independent technical investigation reports, disclosing several recent security risks related to digital assets. Attackers impersonated security@ku.com to lure users into downloading remote control programs. GCSA found that the relevant domain names had not previously configured DMARC; after notification, KuCoin has completed rectification and enabled DMARC isolation policies.After the original MCP toolkit referenced in Bitkub's official documentation was taken down, a third party re-registered the npm package name. The installation method without a fixed version and the risk of plaintext keys may lead to credential leakage; there is currently no actual evidence of theft, and Bitkub has not yet responded to the notification.The TranchePool treasury within the Avalanche ecosystem was attacked due to a cross-day settlement logic flaw, where attackers utilized flash loans and repeated withdrawals to transfer approximately 1.0134 million USDC within 202 seconds. This incident is categorized as a vulnerability in the upper application, and the underlying network was not affected. GCSA stated that it has reported the clues to the relevant platforms and published the original analysis and evidence for industry reference.

On-chain detective ZachXBT issued a community alert based on personal judgment, stating that a certain EU entity was suspected to have been attacked on November 1, with multiple centralized exchange accounts being hacked, resulting in losses exceeding $106 million. The attacker withdrew the stolen funds in the form of USDC and USDT.Monitoring has shown that in the past 24 hours, the attacker has continuously exchanged USDC for ETH and transferred it to instant exchange platforms such as WellWallet and Kyrrex, then converted the funds into Monero (XMR) through Wagyu, while also utilizing cross-chain bridges to transfer funds across multiple blockchain networks. ZachXBT disclosed 11 involved addresses and reminded the community to pay attention to the relevant flow of funds.

Gate has identified and frozen two related accounts, and the relevant information has entered the due diligence process, and will cooperate with law enforcement and subsequent investigations.

The Newton Foundation stated that the attacker in the Binance theft incident seemingly made an operational error earlier today, transferring approximately 8 million NEWT and 17 other tokens directly into the NEWT token contract address, with the total value of the related tokens amounting to about 3.5 million USD at current prices. This includes tokens such as ANIME, ANKR, ARPA, BARD, FTT, LQTY, SIGN, and WOO.The foundation emphasized that the NEWT token contract itself was not attacked. Upon inspection, the contract is immutable, has no owner or administrator, and all management rights were relinquished on-chain in 2025, with upgrade functions permanently disabled. Therefore, no one, including the foundation, can retrieve the tokens that were directly transferred into the contract.The foundation stated that these tokens are now permanently locked, out of the attacker’s control, and cannot be sold on the market anymore. The relevant investigation results have been communicated to Binance, and the foundation will continue to provide assistance.

According to on-chain detective ZachXBT, approximately 45 minutes ago, about $6.3 billion in stolen funds from Binance and about $388 million in stolen funds from Bitget were transferred via THORChain and mixed at the same address, indicating that the two incidents may have been carried out by the same attacker.ZachXBT stated that the Bitget incident was previously linked to the North Korea-related TraiderTraitor, which also overlaps with cases such as Kelp DAO. The mixing address is 0x151....eb7.

According to on-chain analyst Specter, First Digital has blacklisted the attacker address holding approximately 3.4 million FDUSD.

According to Lookonchain monitoring, after the Binance attacker completed the sale of all 217.5 million ENA (worth 33.93 million USD), another trader began to go long on ENA.A newly created wallet address (0xedc0) deposited 2 million USDC into Hyperliquid and opened a long position of 22.78 million ENA with 3x leverage, worth approximately 4.09 million USD.

The Binance attacker has completed the sale of 7 tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, exchanging a total of 70,480 ETH, worth approximately 158.25 million USD.Among them, 7.02 million UNI were sold, worth 39.63 million USD; 217.5 million ENA, worth 33.93 million USD; 7.77 trillion PEPE, worth 31.66 million USD; 2.57 million LINK, worth 26.05 million USD; 127,953 AAVE, worth 14.27 million USD; 21.85 million ONDO, worth 6.62 million USD; and 17.32 million WLD, worth 6.09 million USD.

Cobo co-founder Shen Yu released a video reviewing the suspected theft incident at Binance from an on-chain perspective. Shen Yu stated that the attacker broadcast a transaction containing 50 authorization requests at 4:20 AM on October 30, and about 3 minutes later began to transfer assets in bulk, involving multiple chains such as Ethereum and Tron. Based on the prices at that time, the total amount of transferred assets was estimated to be around 5.8 billion USD.The attacker utilized the EIP-7702 authorization mechanism to carry out the asset transfer, having previously prepared a transfer list covering 64 types of tokens and conducted two rehearsals using a test wallet, with the last rehearsal occurring about 3.5 hours before the official attack. During the attack process, the attacker also exchanged part of the USDT and other freezeable assets for ETH to evade the issuer's freezing measures.Shen Yu disclosed that as of now, Tether has frozen 1.38 billion USDT, Circle has frozen 823 million USDC, Ripple has frozen 40.54 million RLUSD and other tokens. Of the approximately 3.75 billion USD in assets transferred on the Ethereum chain, about 2.4 billion USD has already been frozen; of the approximately 630 million USD in assets transferred on the Tron chain, about 380 million USD has been frozen. Shen Yu believes the core issue may lie in the signing process, and no contract vulnerabilities have been found so far. Whether it is a private key leak or a signing system exploitation remains to be further confirmed by Binance, and he reminded all trading platforms to investigate the risks of signing unexpected authorizations. The estimated 5.8 billion USD is the total amount of multi-chain transferred assets based on the prices at that time, not the confirmed final stolen loss.

According to market news, FoundationHQ stated that attackers sent over 23,000 phishing emails after exploiting leaked API keys and accessing customer data, including addresses and phone numbers.

Web3 infrastructure and payment network Diamante announced that its ecosystem has experienced a security breach involving unauthorized activities by malicious actors. Upon discovery, the team immediately activated emergency security protocols and coordinated with exchange partners, market makers, liquidity providers, and listing partners to suspend affected withdrawals and transfers, restrict unauthorized asset movement, and prevent further exploitation.Diamante stated that the investigation has identified the suspected attackers and is coordinating with law enforcement agencies, government entities, and jurisdictional partners in multiple countries to seek legal action and asset recovery. A comprehensive incident review has been initiated to determine the cause of the breach, the sequence of events, the scope of affected assets, and to strengthen the infrastructure. Diamante is committed to ensuring that every affected participant is fully compensated and will continue to update the incident scope, asset recovery progress, and protective measures upon obtaining verified information.

According to monitoring by PeckShield, the address labeled as the X100 exploit has deposited 821.2 ETH into Tornado Cash, worth approximately 1.89 million USD.X100 ($X) suffered a flash loan governance attack on October 24, 2026, resulting in a loss of about 4.75 million USD, and the price of the $X token dropped 96% within 24 hours.

According to Slow Fog monitoring, Yapeswap suffered an attack, resulting in a loss of approximately $21,900. The root of the incident lies in the WorkersUnion governance mechanism, where the quorum requirement is zero, allowing a proposal that received only about 0.000055% voting support to transfer the feeToSetter authority of YapeFactory to the attacker.The attacker subsequently deployed a malicious Registry contract, causing latestVault() to return a forged vault address, while vaults() still listed the real vault. YapePair accounted for the deposits to be transferred as farm assets, but did not receive redeemable shares, ultimately leading to a loss of funds. This incident involves contracts such as YapeFactory, YapePair, and YapeWrapper.

According to BlockSec monitoring, a suspicious transaction by X100 Global on Ethereum resulted in a loss of approximately 4.75 million USD, with the related attack stemming from a vulnerability in the governance mechanism design: the attacker used a flash loan to borrow funds to purchase X tokens, allocated the tokens to two controlled contracts, and then deposited them into the Freezer, thereby controlling 2 out of 3 senator seats in the same transaction, and subsequently immediately passed and executed a malicious treasury proposal.Specifically, the attacker first created and provided liquidity to the X-USDT trading pool on PancakeSwap V3, then used the obtained majority governance seats to approve the exchange of 400,000 X tokens into that trading pool, setting the minimum output amount to 0, ultimately receiving only about 35.68 USDT. Subsequently, the attacker withdrew liquidity, sold part of the recovered X tokens through the existing Uniswap V3 X-USDT trading pool, and repaid the flash loan.

According to the security agency Blockaid's monitoring, X100 on Ethereum has been attacked. As of their alert at 22:49, the attack is still ongoing, and two transactions have siphoned off approximately 4.85 million USDT.Blockaid stated that an attacker seized two of the project's three "Senate" (governance seats) and sold 400,000 X tokens from the treasury into a liquidity pool they created themselves. Subsequently, another attacker destroyed the Uniswap V3 liquidity position held by the "Freezer" contract. Blockaid has released the relevant attack addresses and example transactions.

According to on-chain analyst PeckShield (@PeckShieldAlert), the address marked as the Cysic attacker has deposited 300 ETH (approximately $721,140) and 30.4 BNB (approximately $22,590) into Tornado Cash.According to the Cysic Foundation, a security incident occurred on October 17 involving the Cysic cross-chain bridge, where the attacker unauthorizedly minted 10 million CYS on the BNB Chain.

Cysic issued a settlement proposal to the attacker who unauthorizedly issued 10 million CYS, requesting that the other party return 275.872 ETH to an address designated by the Cysic Foundation within 72 hours of the on-chain announcement, which accounts for approximately 90% of the confirmed ETH earnings. In exchange, the attacker may retain the remaining approximately 30.652 ETH as a bounty for the vulnerability.Cysic stated that it has restored the key aspects of the attack and preserved relevant technical and on-chain evidence; if the other party fails to return the funds within the deadline, the project team will escalate the matter and seek intervention from law enforcement to promote a comprehensive criminal investigation.

SlowMist released a security alert stating that NEM suffered an attack, resulting in a loss of approximately $821,920. The root cause lies in NemTokenV2 recording the tokens transferred to the liquidity pool (LP) as sell volume without verifying the exchange settlement.The attacker exploited this vulnerability, executing the transfer, calling skim() to clear the incoming tokens, and calling flushLpSellRecycle() a total of 42 times, destroying the original reserves of the liquidity pool and lowering the NEM reserve balance, and then selling the remaining NEM at an inflated price to withdraw USDT.

According to security researcher Spreek (@spreekaway), the management keys of swETH and rswETH under Swell DAO are suspected to have been leaked, and attackers are raising the uncollateralized NAV (Net Asset Value) by up to 1% per hour. Currently, four malicious upgrade contracts have been detected and have not yet been queued for execution through multi-signature; if executed, they could steal approximately 2,500 ETH.Additionally, according to analysis by ADL (@ADLXBT), the management keys control the proxy administrator permissions. Once controlled by attackers, they can direct the swETH/rswETH proxy to malicious implementation contracts, triggering minting or withdrawal functions, thereby inflating the NAV without asset backing. Spreek stated that whether this incident is related to the Railway platform remains speculative; it is currently just a coincidence in timing, with no conclusive evidence available.

According to Salus monitoring, the attackers of Drift Protocol transferred 4,600 ETH, worth approximately 11.23 million USD, to Tornado Cash in 46 transactions from another long-dormant wallet between 15:00 and 15:19 Beijing time. This wallet had not made any outgoing transactions for about 202 days and still held 20,285.82 ETH at the time of monitoring.Salus stated that another wallet previously tracked had deposited an additional 6,110 ETH into Tornado Cash on top of the previously disclosed 19,600 ETH, bringing the total deposits of that wallet to 25,710 ETH. The two tracked wallets have cumulatively deposited 30,310 ETH into Tornado Cash.