leak

Token Pocket's Chief Business Officer Michael stated that the mnemonic phrase of the Robinhood founder was leaked during a live broadcast. After hackers gained control of the address, they used that address and associated addresses to buy a large amount of the Meme coin at $1, prompting thousands of investors to follow suit, rapidly increasing the market value of the token from about $500,000 to $14 million in a short period.Subsequently, the price of the $1 token fell sharply, with a trading volume of about $20 million within just two hours. After the related addresses were frozen, the hackers quickly moved to the BNB Chain (BSC), using that address and its associated addresses to issue new tokens, and created trading hype through self-buying and selling, ultimately executing a sell-off to cash out. Robinhood's RPC has frozen that address, and nodes do not allow transactions sent from that address to be packaged, so transfers and trades cannot be conducted.

The password management tool LastPass announced that its third-party market intelligence platform Klue experienced a security incident, where hackers stole multiple OAuth tokens held by Klue for various clients (including LastPass) and used these tokens to access LastPass's Salesforce CRM system, potentially leading to the leakage of business contact information and CRM data, including some customers' names, phone numbers, email addresses, home addresses, and support cases.The official reminder: LastPass's products, services, infrastructure, and customer vaults have not been affected, and Gong system data has not been accessed. LastPass has immediately taken measures, including stopping employee access to Klue, rotating exposed API tokens, conducting a detailed investigation, and collaborating with Klue, Salesforce, and law enforcement, while also sharing threat intelligence with the security community through the TIME team and strengthening future protections. Users should remain vigilant against potential phishing emails, calls, or social engineering attacks that may exploit the leaked information, and remember that LastPass will never ask for the master password; all official communications are sent through trusted channels.

According to financial audit documents disclosed by technology critic Ed Zitron and verified by the Financial Times, OpenAI achieved revenue of $13.07 billion in 2025, but total costs and expenses reached $34 billion, resulting in an operating loss of $20.92 billion for the year. Due to OpenAI's structural shift to a for-profit entity that year, it incurred a loss of up to $41.55 billion from the fair value change of convertible equity and warrants. After accounting for interest and other factors and excluding non-controlling interest gains and losses, the final net loss attributable to OpenAI for 2025 amounted to $38.53 billion.Comparative data in the documents indicate that OpenAI's losses are showing a dramatic year-on-year increase. Its revenue in 2024 was $3.7 billion, total costs were $12.48 billion, operating loss was $8.78 billion, and the final net loss attributable to the company was $5.09 billion. By 2025, its core expenses saw R&D costs surge to $19.18 billion, revenue costs were $7.5 billion, and sales and marketing expenses were $5.73 billion. By the end of 2025, OpenAI had slightly over $50 billion in assets, nearly half of which was cash reserves.Additionally, the document disclosed for the first time the financial transactions between OpenAI and its major strategic partners in detail. During 2025, SoftBank paid OpenAI $867 million, while Microsoft paid $303 million. Meanwhile, OpenAI paid Microsoft service fees of up to $17.2 billion in the 2025 calendar year, of which $10.59 billion was accounted for as R&D expenses (widely believed to be for model training costs), and $6.047 billion was related to revenue costs. By the end of 2025, OpenAI still had approximately $3.64 billion in liabilities to Microsoft.

According to monitoring by Blockaid, a key leakage incident occurred on the cross-chain bridge of MILC Media Metaverse on BNB and Ethereum. The attacker exploited a historical bridge administrator wallet to grant administrator privileges to an EOA address they controlled, subsequently extracting MLT tokens from the bridge contract and transferring the administrator control of the cross-chain bridge to the attacker's wallet.Currently, the attacker has obtained approximately 97,003 USDT on BSC and transferred about 39.21 ETH on Ethereum through Rhino.fi, with total losses amounting to approximately $161,000.

On-chain detective ZachXBT released an update on the Humanity $31 million security incident. After further analysis of the flow of funds, ZachXBT believes that the team is likely not involved in "self-theft" or "self-directed performance." The official announcement regarding the private key leak is true, but before the unlocking, the price of H tokens was artificially pumped, resulting in hackers taking advantage of the situation. The private key leak and the previous abnormal price pump should be considered independent events.ZachXBT also questioned whether the team artificially inflated the price of H tokens through suspicious market-making agreements and large over-the-counter transactions before the token unlocking, in order to smoothly offload or alleviate selling pressure ahead of the upcoming unlocking for investors/early contributors (around June 25).

Humanity Protocol founder Terence Kwok posted on the X platform confirming a security incident, stating that this incident involves the private key leak of a Humanity Foundation member. For safety reasons, users are advised not to interact with cross-chain bridges or any liquidity pools until safety is confirmed. The team is working with security experts and exchange partners to resolve the issue.According to previous reports, associated addresses of Humanity Protocol have been stolen for over 31 million dollars.

GoPlus posted on platform X that the Meta account recovery feature has been exposed to a high-risk design flaw, which could directly leak users' phone numbers, email addresses, and PII (Personally Identifiable Information). Attackers only need to input the META username without any login or verification to directly obtain the complete PII linked to the user, such as email addresses and phone numbers. This could pose significant risks to users, including: large-scale phishing attacks, SIM card swapping attacks, account takeover and identity theft, and targeted social engineering attacks.Recommendations: Remove or change the leaked email/phone number as a recovery method; modify related account passwords and enable 2FA; do not click on any emails or messages related to "account anomalies," "verification," or "password reset"; set up multi-channel verification, which can be verified through official documents or other official social media channels.

Superfortune, incubated by Manta, recently released an update on the X platform regarding a security incident, stating that the attack was not carried out by internal personnel and that no team members were involved. The claim about the team secretly selling tokens is incorrect. The team has also not had any contact with Web3Port.The investigation confirmed that the attack was not due to address poisoning, but rather a leak of the signer's private key. The attacker independently held the private key and submitted a transaction with a forged address 43 minutes after the correct transaction. The forged address shares the first and last four characters with the correct address (starting with 0x70AE and ending with 5C15) to disguise itself in the Safe interface preview. The stolen funds are fully traceable and are currently stored in three cold wallets on Ethereum, containing approximately 2784 ETH, along with about 170,000 USDT that were cross-chain transferred out.The attacker also created a large number of counterfeit addresses and sent false transfer events to these addresses using Unicode-forged token symbols in an attempt to confuse tracking. This counterfeit address construction technique is the same as the method used when attacking this project. The attacker had pre-built a large-scale infrastructure, indicating that this was an industrialized operation rather than an opportunistic attack.

According to on-chain data, the private key of the StakeDAO deployer was leaked on Arbitrum, and the attacker minted approximately 54.5 trillion vsdCRV, partially exchanging it for 43.7 ETH.

According to Polymarket's Vice President of Engineering Josh Stevens, with the assistance of ZachXBT, BitcoinVN, and ChangeNOW, $164,000 in funds have been frozen in the Polymarket private key leak incident, accounting for approximately 28.6% of the total amount transferred, which is $573,200. Josh stated that this incident did not affect Polymarket or the UMA smart contract, user funds are safe, and the platform is operating normally. Investigations show that the incident originated from a private key that had existed for about 6 years, which was used for internal recharge configuration, leading to funds being continuously sent to the affected address. The relevant team is continuing to track the flow of the remaining stolen funds.

Polymarket staff Shantikiran Chanal posted on platform X that they have noted a security report related to reward distribution, and user funds and market settlements are in a secure state. The investigation points to a wallet used for internal operations experiencing a private key leak, rather than an issue with the contract or core infrastructure. More updates will be released later.Previously, ZachXBT stated that the Polymarket UMA CTF Adapter contract was suspected to have been attacked on Polygon, with over $520,000 currently leaked.

According to TechCrunch, Trump Mobile has been reported to have a user data breach involving personal information such as customer email addresses and mailing addresses, which is still accessible online.YouTube creators Coffeezilla and penguinz0 stated that after ordering the Trump Gold T1 phone, they received alerts from security researchers indicating that their personal information had appeared in the leaked data set. Coffeezilla mentioned that the leaked content almost covered all basic identity information, with the exception of credit card numbers, and warned users not to place orders on the platform. The two indicated that the leaked data likely originated from publicly accessible systems, and they have not yet received an official response or fix from Trump Mobile, leaving the issues unresolved.Based on the order numbers in the leaked data, the actual number of reservations is estimated to be around 30,000 units, far below the previously expected pre-sale scale of about 590,000. Analysts believe that this incident further raises doubts about Trump Mobile's product delivery and basic security capabilities.

Galxe released a security update stating that a leaked internal key affected the retired Galxe SpaceStation V2 contract. Galxe emphasized that this incident did not affect the security of any user wallets or funds, and even if users had previously interacted with the relevant contract, their wallet assets are "completely safe."The platform stated that the issue is limited to the relevant contract level, and the root cause has been confirmed. They are currently updating security controls and will publish a complete report after the investigation is completed.

The slow fog余弦 social media stated that the high-risk iOS attack framework DarkSword has been publicly leaked on channels such as GitHub and is being used for large-scale espionage attacks targeting cryptocurrency wallet holders.This attack program targets devices running iOS versions 18.4 to 18.7, utilizing vulnerabilities in the Safari browser through malicious web pages to achieve remote code execution, thereby stealing users' sensitive data. Attackers launch attacks using bait web pages that impersonate pornographic live streams, Tron energy stations, refund processes, and more.iPhone users running older versions of iOS, once they access such web pages using the Safari browser (even if they do not close the page), may have sensitive information such as plaintext private keys and mnemonic phrases stolen by malicious JavaScript code when unlocking the wallet app, which is then transmitted in real-time through channels like Telegram bots.

According to GoPlus, there have been two new public key leakage incidents in the past 36 hours, with a total loss of $238,000. Among them, 0xUnihax0r lost $200,000, and he had previously uploaded a trading bot and Telegram; the stolen address of @Eli5defi is linked to a previous large-scale private key leakage incident involving 574 addresses. GoPlus suggests that, in light of such centralized large-scale private key leaks, it is advisable to immediately check for risks according to the private key leakage self-inspection checklist.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

According to official news, Syndicate Labs disclosed that its cross-chain bridge contract was maliciously upgraded on two chains due to a private key leak. The attacker transferred and sold approximately 18.5 million SYND (about $330,000) and around $50,000 worth of user tokens. The incident only affected specific chains, while others were not impacted.Syndicate Labs stated that this attack involved multi-stage reconnaissance, infrastructure mapping, and careful execution, demonstrating a high level of technical complexity, and ruled out the involvement of internal personnel. The root cause was that the private key was stored in a password management tool without an additional layer of encryption, and the upgrade process did not utilize multi-signature or hardware signature mechanisms, nor did it have early warning and circuit breaker measures for contract upgrades.Syndicate Labs announced that it will fully compensate all affected users, including returning 18.5 million SYND and providing additional compensation, while also fully compensating affected application chain clients. The company has initiated security upgrade measures, including strengthening private key encryption, tightening access permissions, and plans to introduce hardware or multi-signature mechanisms and upgrade path monitoring to prevent similar incidents from occurring again.

The Berachain Foundation issued a warning on platform X that the Wasabi Protocol has triggered a cross-chain security incident due to the leakage of the deployer's private key, affecting multiple blockchains including Berachain.To prevent the spread of risk, Berachain has suspended and blacklisted all affected Wasabi Reward Vaults within the network, immediately stopping the distribution of BGT staking rewards to compromised contracts and blocking the flow of new BGT into the damaged contracts. The official request for all users who have interacted with Berachain and Wasabi is to immediately revoke token authorization for the specified contracts to avoid the risk of asset theft. Berachain also emphasized that the BGT reward funds within the native RewardVaults are safe and users can claim them normally; this incident does not affect core ecological rights.

The decentralized prediction market platform Polymarket is suspected to have been hacked, with the threat actor xorcat posting over 300,000 data records and a corresponding exploit toolkit on a well-known cybercrime forum.It is reported that the attacker extracted data through undisclosed API endpoints, pagination bypass, and CORS misconfigurations in Polymarket Gamma and CLOB API. The leaked content includes: 10,000 users' complete personal information (including names, proxy wallets, and base addresses), 4,111 comments, 1,000 reports (including 58 ETH addresses and administrator verification address identifiers), 48,536 Gamma market metadata, over 250,000 active CLOB market fixed product market maker addresses, and 9,000 social graph data of followers.The toolkit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (Axios NO_PROXY bypass, CVSS 9.9, which can trigger server-side request forgery), CVE-2024-51479 (Next.js middleware authentication bypass, CVSS 7.5), and CORS misconfigurations. Additionally, the toolkit includes automated continuous pull scripts and a complete red team report.

Orca posted on the X platform that its frontend is hosted on the cloud hosting platform Vercel. In response to the Vercel security incident, all potentially leaked keys and deployment credentials have been rotated out of caution. Orca's on-chain protocol and user funds were not affected. The official team will continue to monitor the situation and will provide updates as more information becomes available.