leak

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

According to Security Affairs, Ransomnews researchers have recorded a large-scale Stripe merchant API key leak incident, with keys exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, identifying over 50,000 unique keys in total. Sample tests show that a significant portion is still active, allowing attackers to commit fraud within hours.The report states that on August 18, 2026, a data trading forum released a dataset containing valid Stripe API keys for 659 merchant accounts and approximately 35 GB of customer and payment data. Ransomnews has conducted offline analysis and reported it to Stripe before publication. Stripe itself was not breached; the keys belong to the merchants. Researchers were able to access merchant customer lists, create fraudulent payment links, and complete a $1 test charge within 17 hours after discovering valid keys.Valid keys can list customers and stored payment methods, create charges and payment intents, initiate refunds to attacker-controlled accounts, modify webhook endpoints to intercept payment notifications, and access associated accounts when Stripe Connect is enabled. The main sources of the leak include hardcoded keys in GitHub repositories and unignored .env files, unmasked environment variables in GitHub Actions build logs, and about 12% of over 3,000 misconfigured servers containing usable keys.

According to Cryptopolitan, cybersecurity company Adversa AI disclosed that xAI's AI assistant Grok has a security vulnerability known as "cryptographic context injection." Attackers can hide cryptographic commands within ordinary web pages, and when users request Grok to summarize the page, Grok automatically decrypts and executes the hidden commands, sending the user's name, geographical location, subscription level, and complete chat history to the attacker's server.The vulnerability was reported to xAI through the HackerOne platform on June 3, 2026. Researcher Rony Utevsky followed up on August 4 and 10, but as of August 19, the vulnerability had still not been fixed on Grok.com, and xAI had not provided a patch timeline.

Investor Gavin Baker stated in Friday's All-In Podcast that marginally, Anthropic's share is flowing towards OpenAI, open-source models, and Grok, but its growth remains very rapid. Baker mentioned that if the $65 billion related data is accurate, then someone leaked this information to assist Anthropic's upcoming IPO roadshow, allowing it to claim a higher annual recurring revenue (ARR) after expanding capacity from July to September.Baker pointed out that following statements related to Anthropic's potential IPO roadshow in September or October, given OpenAI's aggressive approach to locking in computing power and almost certainly capturing significant market share, the market should subsequently see leaks from OpenAI to demonstrate its faster growth. He stated that there will be a lot of speculation surrounding this IPO.Baker also noted that the $65 billion data is impressive for the capacity-limited Anthropic and the entire AI industry, even though Anthropic may be losing some market share. He also mentioned that the number of Codex users has nearly doubled in the past five weeks.

On-chain detective Specter posted on the X platform, stating that considering the time period covered by the stolen data, this could mean that the data breach occurred as early as April, and no later than early May. However, the parties involved chose to remain silent until recently, roughly at the same time Trezor announced its own data breach.Some users had already received phishing attacks and suffered asset losses at that time, but the parties involved did not maintain transparency, warn users, or provide risk alerts, instead denying the data breach.

SafePal stated that its order tracking plugin has a security vulnerability, leading to unauthorized access to some customer information.This incident involves approximately 39,798 users, with affected customers being those who placed orders between March 2, 2025, and April 11, 2026.The leaked information includes names, email addresses, shipping addresses, phone numbers, and purchase details, but does not involve mnemonic phrases, private keys, wallet passwords, bank card information, or government-issued identification numbers.SafePal stated that the relevant vulnerability has been fixed, and affected users have been notified individually. At the same time, the official has launched a query page where users can confirm whether they are affected by entering their order number and shipping country.

The French Minister of Finance confirmed that hackers breached the French Public Finance Directorate system at the end of June and stole personal and corporate taxpayer data. According to the platform FrenchBreaches, which tracks cyberattacks in France, this incident affected approximately 678,437 people, equivalent to about 1% of the French population, but the exact number is still under investigation and has not been finally confirmed.The leaked data reportedly includes sensitive information such as names, birth dates, home addresses, phone numbers, email addresses, tax identification information, and income data. Among them, nearly 27,000 individuals had tax incomes of at least 100,000 euros, 386 exceeded 1 million euros, and another 8 exceeded 10 million euros. Reports indicate that the database has been sold on the dark web market for thousands of euros. The attackers, calling themselves ZeroBytes, claimed they extracted the relevant records using an internal search tool, which was only discovered later when access was cut off.This incident has raised concerns in the cryptocurrency industry, as there has been a noticeable increase in "wrench attack" violent robbery incidents targeting cryptocurrency holders in France in recent years. If high-income individuals' addresses and contact information are leaked, it could provide criminals with a more precise target list.

According to Lookonchain, the whale address "TLBL" has once again experienced a significant asset security incident, with total losses exceeding $50 million.Previously, this address lost approximately $24 million due to a phishing attack two years ago; in the latest incident, it is suspected that over $26 million in assets from three wallets were completely transferred out due to a private key leak. This incident has once again raised market concerns about the security management risks of high-net-worth on-chain addresses.

According to Forbes, the Federal Communications Commission (FCC) officially announced on July 27, 2026, a ban on the import of foreign-made AI humanoid robots, citing national security threats. The FCC classified these devices as "Trojan horses"—their high-precision sensors can continuously collect sensitive data from users' homes and businesses and transmit it to foreign entities, posing a risk of being used for mass surveillance or intelligence activities, and the related devices may also be remotely controlled.Although the ban targets all foreign manufacturers, it actually has the most significant impact on China, as China currently holds a large share of the global AI humanoid robot market. Promoting the development of domestic manufacturing is also an important secondary objective of this ban.

Binance co-founder CZ retweeted user Rager's experience about hardware wallet failures on the X platform. CZ stated that protecting the wallet backup seed phrase is a highly challenging task.The seed phrase cannot be seen by others, or it may be copied or exploited, and it must not be accidentally damaged by fire, flood, or other incidents, while also preventing hackers from gaining access. More importantly, users themselves must not lose the seed phrase.

The decentralized asset management protocol Swan Treasury on BNBChain suffered a loss of approximately $625,000 due to a private key leak. The attacker forged a valid signature using their own address to purchase STY at a 100x discount and bought approximately 687,000 STY with about 19,700 USDT through a PancakeSwap flash loan.Subsequently, they forged claim() and transfer signatures on a brother contract, dumping STY into the STY/USDT pool and profiting approximately 625,000 USDT. Each ecrecover in the transaction was resolved to an exact hardcoded signer, confirming that the key itself had been leaked, rather than a flaw in the signature logic.

According to X platform blogger @MaxForAI, a screenshot of the DeepSeek Harness internal testing recruitment is circulating on social media. The screenshot shows that the DeepSeek Harness plans to start internal testing later this week, with the first batch of users being selected from small group chats. Selected individuals must submit personal information and sign a "Confidentiality Commitment Letter." The screenshot also specifically reminds that any leaks will result in disqualification and affect future opportunities for selection in the DeepSeek model and product internal testing. If the news is true, the official version of DeepSeek V4 and the Harness product are expected to be launched soon.

According to Bloomberg, DeepSeek announced the suspension of its second round of financing and verbally notified some potential investors that it would not sign investment agreements as expected. This suspension partly stems from founder Liang Wenfeng's dissatisfaction with the leak of a 4-hour internal transcript during its first financing deal, where he made 52 statements in an investor meeting regarding DeepSeek's organizational culture, open-source logic, technology roadmap, and views on the competitive landscape of the industry. The nearly 4-hour meeting record recently went viral on social media, including statements such as "The biggest gap between China and the U.S. in AI is computing power resources." Both DeepSeek and Liang Wenfeng have not confirmed the authenticity of the leaked record.DeepSeek stated that it may still choose to resume the transaction process in the future and has begun preparations for an initial public offering, with the IPO potentially being filed as early as this year.DeepSeek completed its first round of external financing in June 2026, raising over 50 billion yuan, approximately 7.4 billion dollars, with a post-investment valuation of about 50-59 billion dollars. It adopted a special structure, with most funds entering a limited partnership managed by Liang Wenfeng, where investors have no voting rights and are locked in for 5 years. Liang Wenfeng himself contributed about 20 billion yuan as the largest contributor, with participation from Tencent, CATL, JD.com, NetEase, and the Chinese National AI Fund. DeepSeek subsequently initiated discussions for its second round of financing in mid-July, targeting a valuation of about 71 billion dollars.

Last month, comments from Liang Wenfeng during the DeepSeek investor meeting have recently circulated. Liang Wenfeng clearly stated that DeepSeek's goal is AGI, rather than becoming the next super app. They will not engage in 3D, video generation, or world modeling, nor will they close source code, stating, "Restraint is a strategy used to increase the probability of achieving AGI." He believes that products are merely "by-products" on the path to AGI, with the current focus on Coding Agent and continuous learning capabilities. The next phase aims to achieve autonomous model iteration, with the endpoint pointing towards embodied intelligence.In terms of commercialization, Liang Wenfeng stated that they only seek to earn "reasonable profits" and do not set profit maximization as their pricing goal. DeepSeek is "still far from a complete shift to commercialization." He assesses that the gap between AI in China and the U.S. mainly lies in resources rather than talent, stating, "Using a fraction of the computing power can narrow the gap to 6 months, 3 months." Regarding industry competition, he believes that open source is "the sweet point for companies of this scale," while also predicting that domestic large models will ultimately converge to "two large companies and two small companies." Liang Wenfeng also mentioned that maintaining team stability is the only non-negotiable core principle, and the company is driven by vision, with "a group of ordinary people achieving extraordinary things."

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

Solv Protocol announced on platform X that on July 13, the BTC+ contract on the BNB Smart Chain suffered a security incident. After investigation, it was found that the attacker compromised the deployer's private key and upgraded the BTC+ minting proxy contract on BSC, minting unauthorized BTC+ tokens. The team completed the emergency response within three hours, isolating the malicious contract and freezing, destroying, or isolating all unauthorized BTC+. All underlying BTC assets are safe.As a precaution, the subscription and redemption of BTC+ have been suspended, with a recovery expected within two weeks. BTC+ has never established an official liquidity pool on any DEX, and users should only obtain and hold BTC+ through official Solv channels. The team has upgraded the deployer's security measures, rotated all affected access credentials and signing keys, and initiated a comprehensive external re-audit, with a detailed post-incident analysis report to be released subsequently.

OneKey founder Wang Yishi (@ohyishi) posted on the X platform to remind that, in addition to screenshots possibly being recorded, third-party input methods may also continuously read the user's clipboard content. These actions could lead to the leakage of sensitive information such as mnemonic phrases.Several netizens subsequently commented that after opening Pinduoduo without saving images or only copying relevant content, the platform's recommendation page displayed product information highly related to the previous screen content or clipboard content, raising doubts about the app's behavior of reading the screen or clipboard.However, the related claims currently mainly come from user tests and feedback on social platforms, and there has not yet been an official public response from Pinduoduo.

Token Pocket's Chief Business Officer Michael stated that the mnemonic phrase of the Robinhood founder was leaked during a live broadcast. After hackers gained control of the address, they used that address and associated addresses to buy a large amount of the Meme coin at $1, prompting thousands of investors to follow suit, rapidly increasing the market value of the token from about $500,000 to $14 million in a short period.Subsequently, the price of the $1 token fell sharply, with a trading volume of about $20 million within just two hours. After the related addresses were frozen, the hackers quickly moved to the BNB Chain (BSC), using that address and its associated addresses to issue new tokens, and created trading hype through self-buying and selling, ultimately executing a sell-off to cash out. Robinhood's RPC has frozen that address, and nodes do not allow transactions sent from that address to be packaged, so transfers and trades cannot be conducted.