forged

The Slow Mist security team disclosed that the cross-chain bridge project Allbridge was attacked on August 19, 2026, resulting in a loss of approximately $190,000. Notably, this attack was not executed instantly; the attacker had begun laying the groundwork nearly a month prior and bypassed the verification mechanism by forging cross-chain messages. According to Slow Mist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as a CCTP style message, claiming that a transfer of 1 million USDC existed, but in reality, no USDC destruction operation took place. Subsequently, Circle generated a valid verification proof (attestation) for this complete message according to normal procedures.About 24 days later, on August 19, the attacker waited for the Base Router to receive a real CCTP deposit, increasing the balance to approximately 191,000 USDC, and initiated the attack just 6 seconds later. The attacker utilized the previously forged message and verification proof to call Allbridge's receiveCctpMessage function. Due to the project's lack of critical verification, the system mistakenly recognized the false cross-chain message as a real deposit and recorded a limit of 1 million USDC. The attacker then temporarily borrowed approximately 809,000 USDC through an Aave flash loan, matching the Router balance with the forged amount, and used the internal credit record to call the transfer function, ultimately transferring out approximately 999,000 USDC (after a 0.1% fee). After repaying the flash loan and fees, the attacker netted a profit of about $189,800. The root cause of this vulnerability lies in Allbridge's failure to verify the identities of the sender and receiver of the cross-chain message, as well as not confirming whether USDC was genuinely minted and whether the balance actually increased, instead directly trusting the amounts and message hash data constructed by the attacker. Slow Mist emphasizes that on-chain message verification does not equate to the actual arrival of real assets. Cross-chain protocols not only need to verify the authenticity of messages but must also ensure that the message source is trustworthy, that the receiver is Circle's official TokenMessengerV2, and that asset accounting can only proceed after confirming the actual minting of assets and changes in balance. This incident once again highlights the security risks of cross-chain bridges in the message verification and asset settlement processes.

According to the official report from Ostium, the core of this attack lies in the intrusion of the off-chain price reporting system's permissions, unrelated to smart contract vulnerabilities. After gaining off-chain authorization, the attacker submitted forged prices (5,000 USD and 60,000 USD) to the BTC-USD market using the legally registered forwarding paths of the protocol, completing an atomic open-close arbitrage cycle within the same transaction, and starting with a rolling scale of 100 USDC. Through 8 transactions, they extracted 23.75 million USDC from the OLP treasury within 5 minutes, until the treasury's circuit breaker mechanism was triggered.The root cause is the lack of a multi-party approval mechanism at the same level as on-chain multi-signature in the off-chain infrastructure, creating a single point of permission vulnerability. The stolen funds have been converted to ETH and mixed through Tornado Cash, and tracking efforts are still ongoing.

The Hong Kong Securities and Futures Commission (SFC) issued a circular outlining the monitoring measures that should be implemented when opening accounts and maintaining client relationships. This circular was issued after the SFC reviewed the account opening practices of 12 securities brokerage firms.The review identified several significant deficiencies, including insufficient due diligence on account opening documents, acceptance of suspicious or forged documents during the account opening process, and weaknesses in managing cross-border agency relationships with overseas intermediaries. The SFC expressed deep concern about the potential misuse of client accounts for suspicious or illegal transactions, which could exacerbate the risks of money laundering and terrorist financing.The SFC requires all licensed corporations to conduct internal checks as soon as practicable to detect whether any suspicious or forged documents have been accepted for account opening. The SFC also outlined additional measures for licensed corporations when opening and managing accounts for mainland investors.These additional measures include closing investment accounts opened with suspicious or forged documents, closing zero-balance dormant investment accounts, and requiring a written declaration from investors when opening new investment accounts, stipulating that settlements and fund withdrawals can only be conducted through bank accounts held in the investor's own name at qualified banks.

Slow Fog's Yu Xian posted on the X platform stating that the reason for the Verus theft may be that the attacker constructed a forged Merkle proof, which passed the verification of the Verus Ethereum bridge (not open source), thus successfully withdrawing funds (ETH/tBTC/USDC). Specific details need to be further verified.

According to Forbes, a U.S. court sentenced Robert Dunlap, the operator of the cryptocurrency scam Meta-1 Coin, to 23 years in prison. He was accused of defrauding approximately 1,000 investors through a fraudulent cryptocurrency investment project from 2018 to 2023, with the amount involved exceeding $20 million.According to the U.S. Department of Justice, Dunlap claimed that the "Meta-1 Coin" he issued was backed by $44 billion in gold reserves and $1 billion worth of artworks by Picasso, Dali, Van Gogh, etc., and promised a maximum return rate of 224,923%, while providing investors with forged audit documents and insurance materials.Investigations revealed that the so-called gold and art assets did not exist, and the "Meta Exchange" website he built used automated trading bots to create the illusion of profits. The related tokens were never actually issued on-chain. Investor funds were subsequently used to purchase luxury items, including Ferraris.It is worth noting that the U.S. Securities and Exchange Commission had already filed a civil fraud lawsuit against Dunlap in 2020, but he continued to operate the project until he was criminally charged in 2024. The FBI stated that the case "destroyed the wealth and trust accumulated by many victims over the years."

Hackers have launched Android malware attacks in Brazil by spoofing a phishing page that mimics the Google Play Store. Currently, all known victims are located in Brazil.The attackers set up a phishing website that closely resembles Google Play, enticing users to download a fake application called "INSS Reembolso." Once installed, the application releases hidden malicious code in stages and loads it directly into memory, leaving no visible files on the device, which makes it highly stealthy. One of the core functions of the malware is cryptocurrency mining, with an embedded XMRig mining program compiled for ARM devices that silently connects to the attacker's controlled mining server in the background. The program monitors battery level, temperature, and device usage status, dynamically adjusting mining behavior to evade detection, and bypasses Android's background process management mechanism by looping silent audio files.Some variants also include banking trojans that can overlay fake pages on the USDT transfer interface of Binance and Trust Wallet, silently replacing the recipient address. Additionally, the malware supports various remote control commands such as recording, screenshotting, keylogging, and remote locking of the device.

In response to a recently circulated so-called "lawyer's letter," Binance stated that the document was not issued by Binance and is a forged document. Previously, X user Lewsiphur accused Binance of being insolvent and claimed that it would have a more severe impact on the market than FTX. Subsequently, he shared a suspected cease-and-desist letter allegedly issued by Binance, stating that failure to delete the relevant content within the specified time would result in legal action.The official Binance customer service account responded, stating: "This letter did not come from Binance, but is a forged document with strong subjective speculation. We remind users to be vigilant against false documents and misleading information." As of now, the aforementioned related accusations have not been deleted.Regarding the recent bankruptcy rumors surrounding Binance, the company has repeatedly denied them and stated that such claims lack factual basis. Binance co-founder He Yi also mentioned that the concentrated withdrawal behavior initiated in the community can be seen as a stress test to some extent, and on-chain data shows that the related activities have not led to a decrease in the platform's asset scale.

Flow has released an update on the attack events on the X platform: its Community Governance Committee has completed the final recovery of the unliquidated counterfeit FLOW tokens from centralized exchanges, including Binance and HTX. As of now, all counterfeit tokens tracked by forensic firms have been successfully recovered and isolated on-chain for destruction, marking the completion of Phase Four of the Isolation Recovery Plan.The Foundation plans to revoke the temporary elevated permissions used by the Community Governance Committee during the recovery operations in January 2026. This emergency measure was activated for the first time in Flow's five-year history, with all operations being transparent and auditable on-chain. The permanent destruction of the counterfeit tokens is scheduled for January 30, 2026. During this period, external legal advisors and forensic partners are coordinating with exchanges to assess the impact on users. The Foundation is committed to fully cooperating with exchange partners to restore the functionalities of each trading platform as soon as possible. Coinbase, Kraken, and Gate have resumed deposit and withdrawal services.

ChainCatcher message, Binance Wallet (@BinanceWallet) tweeted that the "high Alpha score screenshots" circulating in the community recently are not real data and are all fabricated content. Binance confirmed that some unidentified individuals have created false high score screenshots using PS techniques on social media, intending to mislead and confuse users.The official emphasized that Binance Alpha scores are used to measure user activity within the Binance ecosystem, affecting TGE and airdrop eligibility, with the actual score based on what is displayed in the official system. Binance reminds users not to trust unverified screenshots or so-called "score manipulation loopholes" to avoid being deceived.

ChainCatcher message, crypto detective ZachXBT commented on the recent user data breach incident at Coinbase, pointing out that the exchange's practice of requiring phone numbers is extremely unsafe. He emphasized that scammers have stolen large amounts of money by spoofing calls and texts that appear to be from "Coinbase."ZachXBT stated that since most people have only one phone number and many websites require it, these numbers eventually get exposed in data breaches, making it nearly impossible for technically inexperienced users to defend against such attacks. Previously, reports indicated that some attackers obtained information by bribing Coinbase employees, specifically targeting high-net-worth account users with 7-8 figure assets.

ChainCatcher news, according to Hong Kong Television Broadcasts Limited (TVB), there have been recent fake news reports circulating online, claiming that Li Ka-shing shared cryptocurrency investment insights on a TVB news program. The false report mimics the layout of local English media websites, claiming that a specific cryptocurrency platform can turn an investment of 2,000 HKD into a million-dollar return within four months.The report also fabricated a scenario in which the Hong Kong Monetary Authority intervened and blocked related content. TVB has reported this fraudulent activity to the police and urged the public to remain vigilant and carefully verify information from unknown sources.

ChainCatcher news, according to Finance Magnates, the Malta Financial Services Authority (MFSA) has issued a public warning that scammers are forging documents from the Maltese financial regulatory authority to extort money from traders under the pretense of fictitious market manipulation fines, urging users to remain vigilant.This scam primarily targets Bitcoin and Ethereum traders. The MFSA stated that fraudsters send fake documents to individuals involved in BTC and ETH trading, claiming they have been fined for alleged market manipulation and threatening regulatory action if they do not comply. The MFSA confirmed that these threats are entirely fabricated and that the related documents have no legal validity. These forged letters meticulously mimic the MFSA's logo in an attempt to deceive recipients into making payments.

ChainCatcher message, Slow Mist stated on platform X that the Safe contract is fine, but the issue lies in the non-contract part, where the front end has been tampered with and forged to achieve a deceptive effect. This is not an isolated case. North Korean hackers managed to compromise several companies last year, such as:WazirX 230M USDT Safe multi-signatureRadiant Capital 50M USDT Safe multi-signatureDMM 305M USDT Gonco multi-signatureThis type of attack method has matured in engineering. Other companies also need to pay more attention, as multi-signatures may have similar attack points beyond just Safe.

ChainCatcher news, crypto community KOL Nick Ford analyzed that the meme coin BARRON, named after Trump's youngest son, might be a common scam forged from popular addresses for deployment or purchase. Although on-chain it appears that the official Trump deployment is indeed buying BARRON, each purchase is for 0.01 SOL or 0.001 SOL, but checking the TX reveals that the transfers all come from the Barron PF creator wallet. Users can also see themselves listed in the from line in transactions made in their own wallets.Nick stated: "Ultimately, none of this matters. The deployer of the Trump concept meme token DJT, Martin Shkreli, mentioned that the wallet seems familiar with Barron Trump's previous activities, which has sparked excitement in the market.It's not a question of whether the coin is real, but rather the appearance of the entire event. Clearly, the market considers it real enough."

ChainCatcher news, the Slow Mist security team recently investigated the incident involving actor Wang Xing being deceived into going to Myanmar and analyzed the chat screenshots circulating on social media. The screenshots mentioned that Wang Xing was "picked up" and required to pay a guarantee fee of 14,000 USDT, along with a cryptocurrency address. Slow Mist found that the screenshot was fabricated and has no direct connection to the incident involving Wang Xing.Analysis of the address (TAiv3gxSGkf7x...gAB6FU4XV5HPn) shows that it received a total of 2.22 million USDT since September 2024, with the most recent transaction occurring on January 12, 2025. According to the timeline released by the Thai Immigration Bureau, Wang Xing entered Thailand on January 3 and subsequently went missing.Analysis of related transactions did not reveal any transactions related to the 14,000 USDT, and there were inconsistencies in the timing of the screenshots, further proving that the screenshots were fabricated. Slow Mist reminds users to remain vigilant and avoid falling for online rumors.

ChainCatcher message, crypto detective ZachXBT posted: "Someone tried to get me to delete a post that exposed a person involved in a $4.3 million robbery in the UK, who apparently submitted a court order from Brazil, claiming it violated UK law. However, the court order is forged, as the case is currently being heard in the UK, with zero connection to Brazil. Fortunately, X will alert you about such requests."

ChainCatcher news, the blockchain game studio Vulcan Forged announced on X that the WRYON airdrop is live, and users holding Pixely or Troy Land NFTs can receive the airdrop.According to the Web3 asset data platform RootData, Vulcan Forged is a community-based blockchain game ecosystem that operates NFT game studios, marketplaces, and dApp incubators. The project aims to support the creation of blockchain games through incubation programs and crowdfunding.

ChainCatcher news, according to Tech in Asia, Reforged Labs has raised $3.9 million in funding to leverage AI for game advertising.It is reported that Reforged Labs is an AI video creation platform that enables businesses to quickly create video ads with customization options, without any video production experience.