exploit

Cosmos ecosystem NFT marketplace Talis Protocol stated on October 31 on X that attackers exploited vulnerabilities in its market and auction contracts on Injective, resulting in approximately 5,700 hosted NFTs being extracted and sold into public collection bids.Talis indicated that it has suspended new listings and auctions on Injective and will return over 26,000 NFTs in the contract to their holders. As a precaution, new listings and auctions on other chains have also been suspended. Please do not buy, list, or bid on Talis until the fixes are confirmed safe; users can still cancel unexecuted bids. If listings or auctions disappear, please check your wallet.The project stated that the repaired contracts are ready and are undergoing pre-deployment review, with a timeline to be announced later. The team has recorded each affected NFT, the holders before the theft, and each transaction bid, and is formulating a plan to return the NFTs to their original holders and compensate the bidders. A list of affected NFTs will be published, and please do not purchase these NFTs in the meantime.Talis also stated that it will not request wallet connections to claim any content via private messages, and a complete post-incident explanation will be released later.RootData shows that Talis Protocol was established in 2021 and completed a $2.35 million private fundraising round in November of the same year.

On October 31, the DeFi strategy platform Troves on Starknet announced that its xWBTC/WBTC treasury was exploited that day, resulting in an initial loss of approximately 8.6 BTC. Troves stated that, according to the investigation as of the time of the announcement, the exploitation was limited to that treasury, and no impact on other Troves treasuries had been found.Troves mentioned that the exploitation involved an old rebalancing contract that retained permissions even after being replaced. The team has revoked the relevant contract permissions and proactively paused the affected and potentially exposed treasuries. The team is continuing to verify the extent of the exposure and is tracking funds with security partners to assess possible recovery options.Troves later updated that approximately 40 minutes after discovering the exploitation, the problematic old contract was revoked, and all rebalancing permissions on its LST treasury were revoked. As a precaution, the three treasuries xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC are currently in a paused state. Troves provides automated DeFi strategies on Starknet, and the team stated that a detailed post-analysis and options for affected depositors will be announced after verification.

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

According to Bitcoin News, researchers claim that Tailscale has a serious vulnerability, where users with approved access can exploit its built-in SSH to gain root access to devices, and the attack may spread to other devices on the network.Users running nodes with Tailscale should disable Tailscale SSH and update promptly after the patch is released. Tailscale has not yet responded.

According to BlockSec monitoring, a suspicious transaction by X100 Global on Ethereum resulted in a loss of approximately 4.75 million USD, with the related attack stemming from a vulnerability in the governance mechanism design: the attacker used a flash loan to borrow funds to purchase X tokens, allocated the tokens to two controlled contracts, and then deposited them into the Freezer, thereby controlling 2 out of 3 senator seats in the same transaction, and subsequently immediately passed and executed a malicious treasury proposal.Specifically, the attacker first created and provided liquidity to the X-USDT trading pool on PancakeSwap V3, then used the obtained majority governance seats to approve the exchange of 400,000 X tokens into that trading pool, setting the minimum output amount to 0, ultimately receiving only about 35.68 USDT. Subsequently, the attacker withdrew liquidity, sold part of the recovered X tokens through the existing Uniswap V3 X-USDT trading pool, and repaid the flash loan.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

Bitcoin core developer Antoine Poinsot announced an adjustment to the security vulnerability disclosure policy in the Bitcoin development mailing list. He stated that in the past, vulnerabilities were often kept secret for a long time to allow users to complete upgrades before details were made public, but this also led to fixes not being backported to older versions, requiring users to wait for the next major release. Poinsot pointed out that large language models make some vulnerabilities very easy to rediscover, and the protection that continued delays in fixing can provide is now quite limited.According to the new policy, vulnerabilities deemed "easy to discover" will be fixed as soon as possible in all maintained major versions, with security announcements released simultaneously. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through simple LLM prompts. Other vulnerabilities will still follow the disclosure timeline based on severity: low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium to high-severity vulnerabilities will be disclosed two weeks after the last affected version reaches its end of life (usually one year after the fix is released in a new major version). Critical vulnerabilities are not covered by the standard policy and may require ad hoc procedures.Bitcoin ecosystem security researcher Luke de Wolf stated that he previously disagreed with Poinsot's security strategy but believes this update is a good adjustment. In August of this year, the volunteer-based Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with only about one-fifth being reproducible at that time. In the same month, Core Lightning developers urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports, while keeping technical details confidential for two weeks.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

The XRP Ledger recently fixed a payment system vulnerability that could be traced back to 2015. This vulnerability could allow attackers to bypass the system's calculation limits on token exchange amounts through a specially designed payment transaction, generating and spending large amounts of XRP out of thin air, undermining the mechanism that caps the total supply of XRP at 10 billion.It was disclosed that attackers could create hundreds of accounts, allowing these accounts to post offers to exchange a small amount of tokens for a large amount of XRP, and then execute a transaction simultaneously. Due to a flaw in the software's calculation of the total transaction amount, the seller's account could receive the full XRP, while the buyer's account would need to pay almost nothing. Researchers Cayden Liao and Veria AI reported the vulnerability on September 22, and RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network. The development team released version 3.4.1 of xrpld on September 25 to fix the vulnerability.

Security company CertiK's analysis shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker taking away 200 ETH, worth over $500,000. CertiK stated that the root cause was the lack of access control for the 0x8804d1de function in the keeper implementation contract.This contract was involved in the "Black Thursday" liquidation crisis in March 2020, when it won ETH with zero bids, with four transactions of 50 ETH each remaining unsettled. The attacker took this batch of funds and transferred them out in amounts of 10 ETH each via Tornado Cash. Although this contract is not currently a core part of the Sky ecosystem, old contracts with remaining funds may still become targets for attacks.

Immunefi Security Chief Gonçalo Magalhães stated that an unnamed Base treasury suffered a vulnerability exploit of approximately 6 million dollars, while there were still about 31.7 million dollars in assets within the treasury at the time of the incident.According to the briefing, the attacker added a malicious contract to the treasury's lending whitelist through a Safe multi-signature wallet, subsequently withdrawing 1,783 aBaswstETH, which were then exchanged for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães pointed out that the whitelist's restricted addresses appeared secure, but approved addresses could withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remedial measures.

The Chief Information Security Officer of Slow Fog Security, 23pds, stated that Alex Shevchenko, the General Manager of NEAR Intents, indicated that the exploiters of the NEAR Intents vulnerability transferred 1 BNB to the recovery wallet and left a message expressing willingness to cooperate and requested the other party to provide a Signal contact.This transfer came from the same address that previously moved approximately 3.8 million USD. About an hour ago, that address also transferred 0.295 ETH on the Ethereum network and sent the same message.

According to Law360, the cryptocurrency asset theft case involving Uranium Finance has begun trial in the U.S. District Court for the Southern District of New York.Prosecutors allege that Maryland cybersecurity consultant Jonathan Spalletta exploited a vulnerability in the protocol's smart contract to launch an attack in 2021, during which approximately $53.3 million was transferred from 26 liquidity pools in a second attack, leading to the protocol ceasing operations. The statements related to this are allegations by the prosecution and not a conclusion of guilt.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

According to the monitoring by the head of Galaxy Research, the Coldcard white hat funds will come from the merger of 52.37 BTC from Wave 2, Footprints AA, AU, and AX into a new address, which recorded the OP_RETURN message "claim:cryptorecoverytrust dot com" in block number 967,948.These white hat funds account for 2.8% of the Coldcard vulnerability attack funds.

Binance Wallet Security Announcement: iPhone users please check if you have installed the FomoPeek application. Binance has noted a recent security incident disclosed by the community. According to security companies such as SlowMist, the third-party application FomoPeek (versions 1.1-1.2) contains malicious code that can exploit vulnerabilities in the iOS system to gain maximum permissions on the device and may access sensitive data stored on the device, including private keys, mnemonic phrases, login credentials, chat records, files, etc. Please note that such malware directly attacks the device itself. If the attack is successful, all application data on the affected device may be accessed.Please check the following:Are you using an iPhone or iPad running iOS 26.x or earlier?Have you installed the FomoPeek application?If both of the above apply to you, it is recommended to take the following steps immediately:Delete the FomoPeek application and do not reinstall it.Update the iOS system to the latest version.For users with self-hosted wallets: Create a new wallet on a device that has never installed the application and transfer assets to the new wallet address.If you notice any unusual asset activity, please retain the affected device and relevant evidence, and contact customer service for further investigation.At the same time, all users are reminded: Do not install applications from untrusted sources and keep your device software up to date.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

According to SlowMist monitoring, a Brazilian banking malware operation, active since at least May 2025, known as REF9334, has recently been disclosed. Its KREMLIN malware ecosystem uses a multi-stage loader and malicious browser extensions to steal credentials, session tokens, and sensitive data. The malicious extensions can be installed into Chrome and Edge without user approval by bypassing the Chromium integrity mechanisms, including Secure Preferences, HMAC, and App-Bound encrypted hashes.The operation also uses Ethereum smart contracts as "dead letter parsers" to dynamically update C2 endpoints and payload hosting locations. After registering the network Canary domain name, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. SlowMist recommends that security teams monitor related malware, browser extension activities, and infrastructure associated with this operation.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.