attacker

According to on-chain detective Specter monitoring, the attackers of this activity provided so-called arbitrage bot tutorials and code through YouTube videos, guiding victims to compile and deploy contracts using a counterfeit Remix development interface.The attackers registered an ENS name containing "Uniswap," disguising the related address as a legitimate source of income for DeFi activities, leading victims to mistakenly believe that the deployed arbitrage bot was profiting through Uniswap. After victims injected their own assets into the contract, the funds were transferred away by the attackers. The attackers currently seem to still be active and hold a significant portion of the stolen funds across two addresses.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

Ethereum developers warn: Attackers can exploit free testnet ETH and one-time builder identities to win Sepolia block auctions and withhold transaction payloads during the Glamsterdam testing period.This attack does not threaten mainnet funds but may disrupt infrastructure testing. The Sepolia public test is scheduled to launch on October 6, with the Hoodi test tentatively set for October 27, and the mainnet activation time is still undetermined.

According to Blockaid monitoring, Flamingo Finance was attacked. The attacker borrowed approximately 18 million USDT through Morpho flash loans, staking Curve USDP LP into the Strategy during the transaction to inflate the price of VaultYUSDT shares, and then redeemed liquidity aUSDT.Currently, the attacker has realized a profit of approximately 345,900 USDT.

The managed cross-chain bridge Long released a post-mortem report on the WETH hacking incident on September 14. On that day at 07:07 UTC, the bridge paid 46.7928 WETH (approximately $118,000) to the attacker's address from the Robinhood Chain treasury. There were no user fund losses, and the treasury has been fully replenished from platform revenue. The bridge has been rebuilt, reinforced, and continues to operate. During the recovery period, some orders were delayed by several hours.The bridge's keeper read the burn events on Arc via RPC to release assets. At that time, the official mainnet endpoint was not online, relying on public RPC. After the backup endpoint was overloaded, the main endpoint provided the keeper with forged withdrawal event logs within a short window, which did not exist on Arc. The keeper's protection at that time was against replay and double spending, and did not question the data source, thus releasing the WETH. Meanwhile, three other forged withdrawals were completely reverted on-chain. The forged events entered through the RPC channel, and the contract, keys, and treasury were not breached.

According to the official statement from Osmosis, the proposal for the solution regarding the previous Nomic chain nBTC incident is now online and has officially entered community discussion.According to the proposal, the Osmosis governance community will consider confiscating the previously frozen assets of the attacker and using the accumulated BTC in the community fund pool to cover the remaining collateral gap, in order to restore the full collateral support for Alloyed BTC. Currently, this plan still needs to go through governance discussion and voting, and the asset confiscation or collateral replenishment has not yet been completed.

The official announcement from the Ton Network DePIN project PinGo states that the project has once again encountered a cyber attack, and the attackers have sold some of the involved tokens. Currently, the PinGo team has completed the consolidation of on-chain assets and is actively addressing this security incident.It is reported that Gate has temporarily suspended the recharge of PinGo tokens. The PinGo team stated that they will continue to disclose subsequent information based on the progress of the incident. As a result of the incident, the price of PINGO briefly surged by 70%, with the current quote at 0.03 USD.

Self-proclaimed "white hat hackers" extracted about 4,000 BTC from Liquid Network and have returned 3,400 BTC (approximately $269.2 million) to the federal wallet of the sidechain on Monday, recovering about 85% of the funds. The incident began on Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The attackers claimed to be "white hat hackers" through Bitcoin transaction messages and demanded that the vulnerability be fixed first. Blockstream then sent a signed message stating that "the bridging node has been patched and funds can be safely returned," after which the attackers transferred the funds. Nevertheless, about 598.5 BTC (approximately $47 million) remains in the related address. Ledger's Chief Technology Officer Charles Guillemet expressed skepticism about the "white hat" claim, stating that if this were a negotiated reward under on-chain crypto contracts, it looked more like extortion. Liquid has disabled the bridging nodes and requested exchanges to suspend L-BTC deposits and withdrawals, but has not yet announced a plan for handling the remaining funds or when normal operations will resume.

According to a report by Decrypt, Galaxy Research stated that the third wave of attackers on the Coldcard hardware wallet has recently transferred 97.09 BTC, worth approximately 7.7 million dollars at current prices, accounting for about 45% of the stolen Bitcoin in this wave.Among them, the attackers transferred about 20.5 BTC to Ethereum via THORChain cross-chain on September 2; subsequently, they moved some funds into the CoinJoin mixing process to increase the difficulty of tracking the funds. Currently, 11 of the 293 2-of-2 multi-signature addresses established by the attackers in the third wave have been emptied.The report indicated that this Coldcard security incident originated from a firmware vulnerability introduced in 2021, which significantly reduced the randomness of wallet mnemonic phrase generation, allowing attackers to potentially reconstruct private keys offline and steal funds. As of now, approximately 82% of the stolen BTC in the entire Coldcard attack incident has not yet been transferred.Galaxy Research believes that if the newly discovered suspected victim addresses are included in the statistics, the total amount of stolen BTC may reach about 1,806, worth approximately 144 million dollars.

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to on-chain detective Specter monitoring, Balancer is suspected to have encountered a V1 attack, with an attacker continuously transferring funds, currently profiting $250,000. The related address is 0x112...E0aE.

According to market news, the Tectonic attacker marked address has deposited 2,658.9 ETH (approximately 6.65 million USD) into TornadoCash.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

The security company Defimon issued an alert stating that a governance takeover attack against YAM Finance has been detected. After self-delegating approximately 504,000 YAM (about 3.3% of the total supply, slightly above the legal voting threshold), the attacker submitted YamGovernorAlpha proposal #45, which is described as empty ("0x"), with the sole action being to call the setPendingAdmin method of the YAM Timelock contract, pointing to the attacker's address.It has been disclosed that if the proposal is voted through and executed, the attacker will become the pendingAdmin, and then can fully control the Timelock through acceptAdmin, which includes management rights over all YAM protocol contracts and the DAO treasury, involving a risk amount of approximately $337,000. As the protocol is currently in a dormant state, Defimon Alerts reminds users holding YAM to vote against the proposal before block height 25897343 (about 34 hours remaining).

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.

Blockchain security company Blockaid reported that it has detected an exploit on More Markets (More Labs) on the Flow EVM. The attacker successfully drained More Markets' WFLOW lending reserves by exploiting Ankr's bound LST (liquid staking token) and the E-Mode mechanism.According to Blockaid's monitoring, the attacker transferred approximately 15.5 million WFLOW from the mFlowWFLOW reserves, with the detected impact amounting to about 9.3 million USD. The related attack transaction cluster also includes fund transfer operations following the exploit. The specific losses from the incident and the whereabouts of the attacker’s funds are still under further confirmation.

According to Onchain Lens monitoring, Avici was attacked, resulting in a total loss of approximately $1.02 million. The attacker transferred 10,000 SOL to another wallet and exchanged it for about 1.02 million USDC, then transferred it through a cross-chain bridge and exchanged it for approximately 418 ETH.

Solana's new bank Avici is facing ongoing attacks, with attackers having stolen over $1 million from users. The attackers' wallet holds 10,005.03 SOL (approximately $1.07 million) and about $11,600 in USDC and USDT. The attack method involves first calling the SubmitSignatures of the Avici authorization program, then calling the AddCollateralAdmin of the collateral program, and finally executing WithdrawCollateralAsset to withdraw the balance. Both of Avici's programs are upgradable and share the same standard Solana account instead of multi-signature upgrade permissions.Avici confirmed the incident 1 hour and 53 minutes after the first theft transaction, stating, "We are aware of the issue affecting card balance withdrawals and are working directly with all relevant partners to resolve it." Prior to this, users had reported stolen balances on social media. A real-time tracker established by anonymous on-chain analyst STACC recorded 125 different sending accounts, with transfer amounts ranging from approximately 9 USDC to over 26,000 USDT.As a result, the AVICI token fell 49.4% in 24 hours to $0.2175, with a market cap of approximately $2.84 million, hitting an all-time low. Avici raised funds through MetaDAO in October 2025, with an original cap of $3.5 million, but the final committed amount reached $34.2 million, and the team refunded 89.8% of the committed USDC.

Enjin's ERC-1155 "Crypto Items" allows each item to route transfers through a dedicated item adapter. Attackers register and use malicious transfer adapters to bypass owner approval checks, allowing their vulnerable contracts to extract ENJ-supported items from about 52 unrelated holder wallets without approval via transferFrom.Subsequently, the attackers call melt() on each stolen item, redeeming 500 ENJ for each item from the platform's reserves.