keys

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

According to Bitcoin News monitoring, security researchers have found that versions 1.1 and 1.2 of FomoPeek distributed through the Apple App Store contain an iOS exploit framework that can escape the application sandbox, capable of extracting keychain data, wallet files, and mnemonic phrases. SlowMist has linked this application to multiple theft incidents and traced nearly $580,000 worth of stolen USDT flowing into a main address.Users who have installed either version should consider the keys accessible on their iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.

SlowMist released a security warning stating that it has recently received multiple reports of FomoPeek users' assets being stolen. After a joint investigation with the OKX security team, it was found that some affected users had previously installed or used FomoPeek versions 1.1 to 1.2, which contained malicious code. SlowMist stated that there are modules in FomoPeek unrelated to normal business, one of which includes a kernel exploit framework targeting the iOS system, supporting eight different attack methods that can automatically select the exploitation method based on device model and iOS version. Affected systems include iOS 12 to 18.7 and iOS 26 to 26.1. If the exploitation is successful, the application may break through the iOS sandbox and access and decrypt Keychain data, leading to the leakage of private keys, mnemonic phrases, login credentials, and other sensitive files. In addition, FomoPeek also connects to hidden servers unrelated to its public services and can receive remote commands. SlowMist indicated that its analysis of captured plaintext traffic shows that the related attack functions are currently enabled and will run automatically on a regular basis. SlowMist recommends that users who have installed or used FomoPeek versions 1.1 to 1.2 immediately check for any anomalies in their assets, generate new private keys and mnemonic phrases on trusted devices that have never installed the application, and transfer assets to new accounts as soon as possible, while also upgrading to the latest iOS version and not continuing to use or reinstall FomoPeek.

According to Decrypt, Michael Gubbins, the head of the Criminal Assets Bureau in Ireland, revealed to the Sunday Independent that organized crime gangs are renting private vaults to store cryptocurrency wallet private keys and mnemonic phrases along with cash, luxury watches, passports, and other valuables. This situation has been reported to the government's Anti-Money Laundering Steering Committee, which is preparing to implement new EU anti-money laundering rules in Ireland.The new EU regulations will take effect next summer, prohibiting cash transactions over 10,000 euros and requiring businesses to identify individuals for cash expenditures of 3,000 euros and above. Gubbins stated that crime gangs believe cryptocurrency offers anonymity, but the use of cryptocurrency in Ireland is still quite primitive, with cash remaining the primary form of payment for criminal activities such as drug trafficking.The bureau is handling its largest cryptocurrency seizure in history, involving 6,000 bitcoins confiscated from a cannabis grower in 2019, with the private keys written on paper and hidden in a tackle box, which was later lost. With the assistance of Europol, the bureau has cracked the first of 12 wallets in March, with over 130 million euros already liquidated from assets totaling 360 million euros.

Blockchain security company Hacken released an assessment report indicating that approximately half of the circulating USDT (about $91.3 billion on the Tron network) is controlled by a 2-of-3 multi-signature contract, which lacks built-in delays, cancellation processes, or reliable revocation mechanisms. Attackers only need to compromise two signature keys to change contract ownership, mint tokens, freeze addresses, clear frozen balances, or set transfer fees without accessing any user wallets. Hacken also discovered that Tether reuses the same set of six signature keys across three chains: Ethereum, Avalanche, and Celo, posing a risk of cross-chain spread.Meanwhile, stablecoin rating agency Bluechip upgraded Tether's company rating from D to C, citing that KPMG's audit showed Tether's reserves exceeded liabilities by $6.8 billion as of December 31, 2025. This is the first time Bluechip has adopted the expanded SMIDGE methodology, which incorporates Hacken's technical risk analysis. However, Hacken only gave USDT a cybersecurity score of 3.3 out of 10 and pointed out that the USDT smart contract does not have automatic reserve proof checks or a token minting cap. Once signers authorize a transaction, the contract can mint an unlimited number of tokens without a bank reserve proof.Hacken stated that it has not yet completed an equivalent assessment of Circle's USDC, and Bluechip's previous B+ rating for USDC was based on an old methodology, which cannot be directly used for technical comparison.

According to Bitcoin.com, Fidelity Digital Assets has released an analysis report indicating that future quantum computers may derive Bitcoin private keys from exposed public keys, threatening asset security. Existing Bitcoin transactions rely on elliptic curve digital signature algorithms or Schnorr signatures, and sufficiently powerful quantum computers running Shor's algorithm could break this cryptographic assumption.The report evaluates the SHRINCS post-quantum signature scheme as a potential upgrade path—providing a compact 48-byte public key, with state signature sizes ranging from 548 to 4,619 bytes, and a 5,777-byte stateless fallback path to address state loss. However, quantum-resistant signatures will significantly increase transaction data size, consume more block space, reduce network throughput, and drive up transaction fees during congestion. Implementing such upgrades will require new consensus rules (possibly through a soft fork) and broad support from wallets, miners, exchanges, and custodians. In July of this year, Fidelity co-funded a $15 million Bitcoin security program with eight other institutions, covering anti-quantum research.

Predict.fun posted on platform X that it has launched the Predict Developer Dashboard, a self-service portal for creating applications, generating keys, and managing usage and rate limits. Through this interface, users can manually request higher usage-based tiers and import existing keys.Predict.fun has also implemented "trade burst" limits to restrict the number of calls for creating and canceling orders per second. New applications have this limit enabled by default, while existing applications will have this limit applied the next time the user requests rate limits.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

Arthur Hayes updated on the X platform stating: The FLOP airdrop eligibility will depend on users' testnet activities. The testnet token faucet will be launched on Technocore.chat, and users will need to access it through the DID keys provided by the AI agent.Previously, Hayes revealed that the FLOP is planned for a large-scale airdrop in the fourth quarter of 2026, with an expected 20% of the total token supply to be airdropped to testnet participants, distributed over 10 years------this may be adjusted later, and the purpose of announcing this figure is to collect user feedback. The FLOP token is expected to become one of the top two tokens in the cryptocurrency market.

Monad officially released a new MIP (Monad Improvement Proposal), themed around Flexible and Upgradeable Account Authentication. The core of this proposal is to allow accounts to change keys without changing addresses, thereby enhancing the flexibility and security of account management.Through this mechanism, accounts can smoothly upgrade to quantum-resistant cryptographic schemes to address potential threats posed by future quantum computing. The proposal has been officially announced, and the community can further review relevant technical details and discussions.

According to Security Affairs, Ransomnews researchers have recorded a large-scale Stripe merchant API key leak incident, with keys exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, identifying over 50,000 unique keys in total. Sample tests show that a significant portion is still active, allowing attackers to commit fraud within hours.The report states that on August 18, 2026, a data trading forum released a dataset containing valid Stripe API keys for 659 merchant accounts and approximately 35 GB of customer and payment data. Ransomnews has conducted offline analysis and reported it to Stripe before publication. Stripe itself was not breached; the keys belong to the merchants. Researchers were able to access merchant customer lists, create fraudulent payment links, and complete a $1 test charge within 17 hours after discovering valid keys.Valid keys can list customers and stored payment methods, create charges and payment intents, initiate refunds to attacker-controlled accounts, modify webhook endpoints to intercept payment notifications, and access associated accounts when Stripe Connect is enabled. The main sources of the leak include hardcoded keys in GitHub repositories and unignored .env files, unmasked environment variables in GitHub Actions build logs, and about 12% of over 3,000 misconfigured servers containing usable keys.

According to monitoring by Catcher Predict, in the prediction market Polymarket for the event "Cincinnati Open: Sara Bejlek vs. Madison Keys," the "Sara Bejlek" option in the sub-market "Cincinnati Open: Sara Bejlek vs. Madison Keys" has experienced a dramatic fluctuation in winning probability, soaring from 19.5% an hour ago to the current 82.5% (a fluctuation of 63%). Please note the impact of related breaking news.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

Bitcoin News posted on the X platform that Bitcoin developers have launched a new visualization tool to explain how entropy works and how to generate randomness for Bitcoin private keys.The tool covers true random number generators (TRNG), pseudo-random number generators (PRNG), rolling dice, and flipping coins.

A wallet security incident involving approximately $130 million in Bitcoin losses is reigniting discussions in the crypto industry about asset custody models: should Bitcoin holders rely on personal self-custody or turn to institutional custody? Hardware wallet manufacturer Coldcard had a vulnerability in its firmware in 2021 that led to some mnemonic phrases generated by the device being predictably risky. This vulnerability was discovered years later, and approximately 5,200 addresses and about 2,000 BTC have been stolen, with losses amounting to around $130 million.After the incident, some investors began to turn to Wall Street custody products. Data shows that the U.S. spot Bitcoin ETF saw a net inflow of about $626 million within days of the incident. Bloomberg ETF analyst Eric Balchunas stated that such security incidents could further drive funds into ETFs. However, the Bitcoin core community still insists on the self-custody concept. Casa co-founder Jameson Lopp stated that recent events should not undermine users' confidence in self-custody and pointed out that third-party custody also carries risks. Bitcoin Core early developer Peter Todd also believes that self-custody has a better long-term safety record than centralized institutions.Onramp co-founder Michael Tanguma believes that both options have flaws. He stated that concentrating a large amount of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Tanguma proposed a "multi-institution custody" solution, where multiple regulated institutions hold keys through a multi-signature mechanism, requiring multiple institutions to jointly sign any transaction to reduce single points of failure. However, this model has also sparked controversy. Critics argue that while multi-institution custody enhances security, it also introduces permissioned management, conflicting with the decentralized ideals originally pursued by Bitcoin. As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is seeking new custody solutions suitable for long-term wealth management. The Coldcard vulnerability incident once again highlights that achieving a balance between security, decentralization, and usability remains a core challenge facing the Bitcoin ecosystem.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.

According to monitoring by Bitcoin News, Nunchuk stated that some keys on the Nunchuk platform are generated by Coldcard Mk4, but these keys will not be used directly.Nunchuk will derive independent keys through custom logic, making them less susceptible to lookup table attacks based on leaked Coldcard seeds. Nunchuk added that, given enough time, it believes attackers may eventually incorporate these derived keys as well.

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

Programmer Stefan Thomas holds an IronKey encrypted USB drive containing the private keys for 7,002 bitcoins, which were earned as a reward for his 2011 educational video "What is Bitcoin?" Recently valued at approximately $111,000 each, this amounts to about $777 million.The IronKey device is set to permanently lock and delete its contents after 10 incorrect password attempts. Thomas has tried 8 times and has only 2 attempts left. The manufacturer Kingston stated that there are no backup passwords or alternative recovery methods aside from the original password set by the user. Thomas has sought assistance from the digital forensics company Naxo and security researcher Chris Tarnovsky, and he previously declined Unciphered due to having reached a verbal agreement with both teams. As of the end of 2025, the IronKey remains stored in a Swiss vault, with no confirmation of a successful recovery by mid-2026.

SlowMist issued a security alert, detecting a coordinated malicious npm supply chain attack. The attackers utilized fake trading bot repositories and DeFi-themed npm packages to deploy JavaScript information stealers, targeting npm users, DeFi developers, and trading bot users.This attack involved 30 malicious npm packages, among which stake-math@3.5.4 appeared as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository. This repository presented approximately 2300 highly homogeneous bulk-generated forks, mostly concentrated under the poly-stocks account, with signals being exceptionally clear. The sensitive data that attackers could steal is extensive, including cryptocurrency wallet libraries, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager libraries, private keys, mnemonic phrases, and API tokens exposed in source code.SlowMist recommends that developers immediately remove the affected npm packages, audit package.json and package-lock.json, and check CI logs for any of the 30 malicious packages; consider any system that has executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.