attackers

Blockchain security company Blockaid stated that it has detected an exploit on More Markets (More Labs) on Flow EVM. The attacker successfully drained More Markets' WFLOW lending reserves by exploiting Ankr's bound LST (liquid staking token) and the E-Mode mechanism.According to Blockaid's monitoring, the attacker transferred approximately 15.5 million WFLOW from the mFlowWFLOW reserves, with the detected impact amounting to about 9.3 million USD. The related attack transaction cluster also includes fund transfer operations after the exploit. The specific losses of the incident and the whereabouts of the attacker’s funds are still under further confirmation.

According to Onchain Lens monitoring, Avici was attacked, resulting in a total loss of approximately $1.02 million. The attacker transferred 10,000 SOL to another wallet and exchanged it for about 1.02 million USDC, then transferred it through a cross-chain bridge and exchanged it for approximately 418 ETH.

Solana's new bank Avici is facing ongoing attacks, with attackers having stolen over $1 million from users. The attackers' wallet holds 10,005.03 SOL (approximately $1.07 million) and about $11,600 in USDC and USDT. The attack method involves first calling the SubmitSignatures of the Avici authorization program, then calling the AddCollateralAdmin of the collateral program, and finally executing WithdrawCollateralAsset to withdraw the balance. Both of Avici's programs are upgradable and share the same standard Solana account instead of multi-signature upgrade permissions.Avici confirmed the incident 1 hour and 53 minutes after the first theft transaction, stating, "We are aware of the issue affecting card balance withdrawals and are working directly with all relevant partners to resolve it." Prior to this, users had reported stolen balances on social media. A real-time tracker established by anonymous on-chain analyst STACC recorded 125 different sending accounts, with transfer amounts ranging from approximately 9 USDC to over 26,000 USDT.As a result, the AVICI token fell 49.4% in 24 hours to $0.2175, with a market cap of approximately $2.84 million, hitting an all-time low. Avici raised funds through MetaDAO in October 2025, with an original cap of $3.5 million, but the final committed amount reached $34.2 million, and the team refunded 89.8% of the committed USDC.

Enjin's ERC-1155 "Crypto Items" allows each item to route transfers through a dedicated item adapter. Attackers register and use malicious transfer adapters to bypass owner approval checks, allowing their vulnerable contracts to extract ENJ-supported items from about 52 unrelated holder wallets without approval via transferFrom.Subsequently, the attackers call melt() on each stolen item, redeeming 500 ENJ for each item from the platform's reserves.

Bubblemaps posted on platform X that attackers exploited a vulnerability in the Cosmos EVM shared module to steal $50 million worth of NES tokens, but ultimately only profited about $60,000. Previously, Cosmos Labs reported security vulnerabilities in its shared Cosmos EVM software, affecting multiple chains built on this module, including Nesa.According to disclosures, the main attacker with an address starting with 0x9AE7 previously spent $250,000 to purchase NES and cross-chain to Nesa Chain, then exploited the vulnerability to inflate the account balance by 200 times and transferred $50 million NES back to Ethereum, with the initial funds coming from Monero. The attacker then dispersed the tokens to multiple wallet addresses, exchanged NES for ETH on a DEX, and deposited the profits into a centralized exchange.Due to the rapid withdrawal of funds from the liquidity pool, most of the attacker’s exchange transactions encountered severe slippage, resulting in an actual expenditure of $255,000 to initiate the attack, cashing out only $315,000, with a net profit of about $60,000.Bubblemaps stated that although another Cosmos EVM chain had also suffered a similar attack of $1.4 million the day before, the differences in funding sources and operational methods suggest that the two incidents may have originated from different attackers. The report also mentioned that the price of NES tokens once plummeted by 90%, but has since significantly rebounded, with the team believing that the rebound is mainly due to arbitrage activities caused by price mismatches between DEX and CEX after the attack.

According to monitoring by PeckShield, the Term Labs attacker's address deposited 300 ETH into Tornado Cash, worth approximately $741,000.

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.

According to on-chain detective Specter, the attacker exchanged all assets including WBTC, cbBTC, LDO, USDS, and CRV for DAI and ETH. The same wallet was previously hacked in September 2023 due to malicious token authorization, resulting in a theft of 24.23 million USD, with the attacker ultimately returning about 90% of the stolen funds. The attacker's address is 0x8fEB...F95Ae.

According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) software after attackers exploited a serious vulnerability to obtain credentials and transfer funds.BTCPay stated that this restriction prevents external wallets like Zeus from connecting through the BTCPay Server domain. BTCPay mentioned that Lightning payments can continue, and they plan to restore remote access options when they deem it safe.

According to Onchain Lens monitoring, addresses related to the Solana OG attackers (0xd229...9D15, 0x501...f051) transferred 2,290 ETH to Tornado Cash, worth 4,390,000 USD.This operation occurred nearly a month after the involved $14.2 million attack incident; the same address cluster also used Tornado Cash two weeks ago.

Bitcoin News posted on the X platform that new community honeypot tests show that attackers are still prioritizing wallets that are most easily exploited due to the Coldcard Mk3 RNG vulnerability.Researcher @ColeTU injected funds into 5 affected Mk3 wallets: 1 using only the vulnerable mnemonic, 3 protected by BIP39 passphrases of 1, 2, and 3 words respectively, and another using a random account number. After 14 hours, only the unprotected wallet using just the mnemonic had its funds transferred away. According to @jamesob's real-time tripwire dashboard, currently only 2 out of 17 honeypot wallets have been emptied. The emptied wallets have been confirmed not to have added extra entropy, while all wallets protected by dice rolls, passphrases, multisig, or other complexities remain untouched.The test results indicate that attackers are currently focusing on the wallets that are easiest to brute-force rather than investing resources in strengthening targets, but affected users should still migrate their funds immediately instead of relying on temporary protections.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

According to Bitcoin News monitoring, a new real-time dashboard is mapping the ongoing exploitation of the COLDCARD vulnerability in real-time. @jamesob is deploying honeypot wallets and gradually increasing additional entropy, including dice rolls and mnemonic phrases, to measure the current brute-force cracking boundaries.The control wallet with an additional entropy value of 0 was emptied in 1 hour and 18 minutes. The project's goal is to determine the types of wallets that attackers can currently crack and how this capability changes over time.

Galaxy Research Director Alex Thorn stated that the attack incidents surrounding the Coldcard wallet are still evolving, with more small attackers and imitators emerging, targeting the remaining Coldcard recovery phrases.Alex Thorn mentioned that by assisting in confirming the identity of a user whose deposits were involved in the attack, the related funds had already been transferred out before they could be frozen on the Duel platform, and the funds involved do not belong to the three main waves of attacks previously identified by Galaxy Research.Previously, the Bitcoin hardware wallet Coldcard was attacked, and the stolen funds have risen to 1367.05 BTC, worth approximately 8.86 million USD, involving 4585 addresses. Galaxy Research Director Alex Thorn stated that the attacks are still ongoing, and users who have not yet migrated their funds should immediately transfer their assets out of the addresses generated by Coldcard.

According to monitoring by Bitcoin News, Chainalysis stated that an analysis of the Coldcard exploit event involving over $38 million shows that the attackers deliberately targeted the highest value wallets, including one holding $1.8 million, indicating that the victims had been profiled before the asset transfers began. Approximately $30 million was stolen in the first 10 minutes, and then about 500 wallets were emptied within 25 minutes.Clay Garrett from Block stated that investigators also confirmed that the attackers used a paid account from a well-known blockchain service provider to query the victims' addresses during the operation. The provider's internal logs matched the request times and order, but Block stated that no evidence was found indicating that the company knowingly assisted in the theft. Relevant information has been shared with the authorities.

Robinhood CEO Vlad Tenev posted on the X platform that his X account was hacked last week. The attacker used social engineering to deceive X customer service, bypassing standard security features such as two-factor authentication and login notifications, and posted false content about meme coins.The X security team has assisted in removing the related posts and restoring account access, and additional security measures have been implemented for the account.

According to monitoring by PeckShield, the attacker’s marked address has returned 331.8 ETH, approximately 623,900 USD, to the Across Protocol Hub Pool Owner multi-signature address.

According to on-chain analyst Onchain Lens (@OnchainLens), the Summer Fi vulnerability attacker has transferred most of the stolen funds. The attacker obtained 6.017 million DAI from the vulnerability on July 6 and has since continued to mix and transfer funds through Tornado Cash.Currently, two related addresses still have a small amount of funds remaining: the original wallet (0x7bf7...bdca) has 11.3 ETH (approximately $21,600) left, and the second wallet (0x46e0...eba7) has 282.9 ETH (approximately $543,500) left.

According to Ember monitoring, the Bonk treasury attacker transferred 400 billion BONK to Coinbase again about 5 hours ago, worth approximately 1.11 million USD. Of the 44.26 trillion BONK transferred due to the governance attack, 24.26 trillion have already been transferred to CEX. Since the attack, the price of BONK has dropped by 41%.

According to Com Feed monitoring, the Trusted Volumes attacker has returned 1,122 ETH, worth approximately 2 million dollars, while retaining about 2 million dollars as a "bounty."Previously, the attacker exploited vulnerabilities to steal approximately 5.8 million dollars.