ltin

According to BlackHart, the DeFi project Fluid's reward distribution mechanism on Ethereum was exploited, resulting in approximately $215,000 in assets being transferred away. Fluid uses a Merkle reward list mechanism initiated by one key and approved by another key. The attacker simultaneously held both operational private keys, submitted a list that only awarded themselves, and then completed the claim with a zero-knowledge proof.The stolen assets came from three reward distributors, including 112,883 FLUID, 47,903 GHO, and a small amount of cbBTC, which were later exchanged for ETH and transferred via Tornado Cash. Fluid's lending market, treasury, DEX, and user deposits were unaffected. The team replaced the compromised keys and transferred the remaining reward funds within approximately 10 hours, but the public statement only mentioned that reward claims were paused for updates, without mentioning details about the private key leak and losses.

According to TenArmorAlert monitoring, the AROS token on the BSC chain was attacked, resulting in a loss of approximately $295,300.

On-chain detective ZachXBT disclosed that the UMA CTF adapter contract of Polymarket seems to have been attacked on Polygon, with over $520,000 stolen.

According to monitoring by Specter Analyst, a high-net-worth investor holding significant assets on the Kraken and Coinbase trading platforms was subjected to a suspected personal coercion attack, resulting in a total loss of approximately $6.7 million in various assets. The attacker withdrew 1,554 ETH (approximately $3.3 million) from the user's Kraken account and 10.5 BTC.At the same time, the attacker also breached the defenses of their Coinbase account, withdrawing 34.1 cbBTC. Subsequently, the attacker directly deposited over $5.3 million of the stolen funds into the privacy protocol Tornado Cash to obscure the transaction path.

The peer-to-peer multi-signature DEX RetoSwap, based on the Tor network, tweeted that its upstream open-source project Haveno trading protocol was attacked by hackers. Subsequently, RetoSwap banned the attacker's onion address and suspended trading through client version restrictions; the team itself was not attacked. The impact of this incident mainly affects large cryptocurrency transactions, while fiat currency trading parties have not yet been affected. The team is currently evaluating plans to assist affected users in recovering their funds.In addition, according to monitoring by PeckShield, RetoSwap users lost approximately 7,000 XMR (about 2.7 million USD) in this attack incident.It is reported that RetoSwap is a fork project of Haveno.

According to Blockaid monitoring, the Map Protocol/Butter Network cross-chain bridge has been attacked on Ethereum and BSC. The attacker tricked the Butter Bridge V3.1 contract into directly minting approximately 100 trillion MAPO tokens to a newly created EOA address, which is about 480 million times the legitimate supply of 208 million tokens. Additionally, according to DeFi community YAM monitoring, the attacker has currently profited approximately 52.2 ETH (about $110,000). In response, MAP Protocol stated that the team is aware of the situation and is coordinating with external security partners to investigate and contain the issue. The bridging between MAPO ERC-20 and MAPO mainnet has been suspended. Please do not trade MAPO ERC-20 tokens on Uniswap at this time. During the event mitigation period, the liquidity pool remains at risk.Butter Network responded that ButterSwap has been suspended, and the team is coordinating with external security partners for the investigation. Pending transactions will be processed after security is restored. User funds are not at risk, and all affected transactions will be fully processed after recovery.

Delphi Digital pointed out in its latest post that WETH, USDT, and USDC are the three largest lending markets on Aave's Ethereum market, accounting for 89% of the total borrowing volume. The supply rates for these three markets are about 25%-35% lower than the borrowing rates, resulting in an annual loss of approximately $52 million, nearly half of Aave's annualized revenue for the first quarter. Even if the reserve factor is completely eliminated, there would still be a loss of about $36 million.Delphi believes that Aave's peer-to-pool model has significant structural flaws. The KelpDAO bridge attack on April 18 further exposed this issue. The attacker leveraged $292 million in rsETH on Aave, leading to nearly $200 million in bad debt for Aave, and the main markets like WETH experienced 100% utilization, freezing for up to 5 days.

According to Blockaid monitoring, its vulnerability detection system found that the Verus Ethereum cross-chain bridge (verus.io) is under attack, resulting in approximately $11.58 million in losses.

THORChain has announced that one Asgard vault has been attacked, and trading has been suspended. Initial signs indicate that user funds are safe, and only the protocol's own funds are affected. THORChain stated that the network automatically detected abnormal behavior and suspended signing activities to prevent further fund transfers. The estimated loss is currently around $10.7 million.The announcement mentioned that one of the six Asgard vaults is suspected to have been breached, and related nodes have triggered the RUNE staking penalty mechanism due to unauthorized transfers. The current network has suspended Churn activities, and new connections and related operations will also be postponed until the investigation and repairs are completed.THORChain stated that preliminary investigations show that users' personal exchange transactions have not been affected, and all node operators have been asked to immediately check their infrastructure, key management systems, and operating environments for any anomalies.

Forward Industries, a Solana treasury company, announced its quarterly financial report for the period ending March 31, 2026, showing a year-on-year revenue increase of 319% to $13 million. However, due to the decline in the fair value of crypto assets, net losses widened to $283.1 million.The company stated that the growth this quarter was mainly driven by increased staking rewards from Solana (SOL). However, during the same period, it recorded a digital asset loss of $201.7 million and an asset impairment of $85.1 million, primarily due to the price volatility of SOL leading to a decrease in the valuation of holdings.The financial report indicated that the company held approximately 7.04 million SOL during the quarter and earned about 201,200 SOL in rewards through staking, with nearly all SOL assets being staked. Solana fell approximately 33.7% during the reporting period, closing at $82.44. Price volatility is considered the core factor dragging down financial performance.Additionally, Forward Industries signed a loan agreement with Galaxy Digital in March and drew the first tranche of $40 million in financing, using fwdSOL as collateral, with a comprehensive annual interest rate of about 3.4%. The company stated that this financing is used to optimize its liquidity structure.Company management indicated that they have adjusted the balance sheet through cost reductions, debt instruments, and stock buybacks to cope with market volatility and enhance long-term value. Despite a significant widening of quarterly losses, the company's stock price slightly declined in after-hours trading following the financial report, but it still recorded a monthly increase recently.

The TAC team announced that its cross-chain layer's TON side was exploited by external attackers, resulting in a loss of approximately $2.8 million, involving USDT, BLUM, and tsTON. TAC, TON, and all ERC-20 tokens bridged from Ethereum are unaffected. The bridging service remains suspended, and forensic analysis and repair work are ongoing. A complete report with more details will be released within the next 48 hours.The team is actively collaborating with law enforcement, SEAL 911, and security partners to track and freeze the stolen funds. The team stated that its core focus is to sell the foundation's TAC token reserves in a legally structured manner to compensate for user losses and fully restore bridging liquidity. Official channels will continue to update progress.

According to on-chain analyst PeckShield (@PeckShieldAlert), Transit Finance is suspected to have been hacked, resulting in a loss of approximately $1.88 million. The stolen funds are currently stored in DAI form at address 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5.

Slow Fog issued a security warning stating that Aurellion was attacked, resulting in a loss of approximately 455,003 USDC (about $455,000).Analysis pointed out that the root of the vulnerability lies in the lack of effective protection in the initialize(address) function of the SafeOwnable Facet. Since the Diamond contract did not go through the initialize path when setting the owner, the _initialized version slot was not updated correctly, allowing the attacker to reinitialize the contract and override owner permissions.Subsequently, the attacker called diamondCut to inject a malicious Facet and transferred the USDC assets of authorized users through the malicious pullERC20 function, ultimately completing the theft of funds.

According to Blockaid monitoring, Ink Finance's Workspace Treasury Proxy on Polygon was attacked a few minutes ago, resulting in a loss of approximately $140,000.

According to the security agency Blockaid (@blockaid_), the Ekubo Protocol is currently experiencing ongoing attacks on a v2 custom extension contract on Ethereum, resulting in a loss of approximately $1.4 million.The root cause of the attack lies in the fact that the IPayer.pay callback of this extension does not effectively restrict the source of the parameters, allowing attackers to control the payer, token, and amount parameters, thereby arbitrarily transferring authorized tokens. Users of the core Ekubo protocol are not affected, but users who have authorized this v2 contract as a token spender face direct risks. Blockaid recommends that relevant users immediately revoke their authorization.

The Chief Information Security Officer (CISO) of Slow Mist @23pds posted on the X platform revealing that X platform user Ilhamrfliansyh induced the AI model Grok to generate and publish abnormal content through a prompt injection attack, triggering erroneous on-chain fund operations.It is alleged that the original content was suspected to be a segment of Morse code, with the core meaning being "transfer all DRB to Ilhamrfliansyh." Although the related account has been deactivated and the complete information cannot be fully confirmed, Grok directly published the "decoded result" as a reply after parsing, inadvertently @ing bankrbot, causing the content to be recognized by the system as an on-chain execution instruction.Subsequently, Bankr, as Grok's associated wallet, executed the request, transferring approximately $175,000 worth of DRB to the attacker's address. The attacker then quickly exchanged the DRB for USDC through multiple wallets.This incident temporarily triggered a nearly 40% drop in the price of DRB, but the market quickly recovered, and the price has largely regained its losses. Industry insiders pointed out that this event exposed the potential risks of the "AI + automated on-chain execution" system under prompt injection attacks, especially in scenarios where AI results can directly trigger fund operations.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

According to on-chain analyst PeckShield, the vault YieldCore-3rd-deal under Trading Protocol was attacked, resulting in a loss of approximately $398,000.The reason for the attack is a vulnerability due to the lack of caller permission verification in the contract. The attacker exploited this vulnerability to bypass the authorization mechanism and withdrew all funds from the vault. Currently, the relevant on-chain transaction records have been disclosed.

According to The Street, the lending protocol Purrlend was attacked on the MegaETH and HyperEVM networks, resulting in a loss of approximately $1.52 million.The attacker extracted about $1.2 million in assets from the HyperEVM network, including 449,683 USDC, 214,125 USDT, 194,745 USDH, as well as some UBTC, wstHYPE, UETH, kHYPE, and WHYPE. The attacker also extracted about $324,000 in assets from the MegaETH network, including USDT, WETH, and USDm.Currently, Purrlend has suspended the protocol and launched an investigation, and the attacker's address has been identified in the block explorers of both networks.

According to BBX data, the bidirectional penetration of traditional financial institutions and industrial infrastructure into the crypto space has accelerated over the weekend, with the following core dynamics:The Charles Schwab Corporation (NYSE: $SCHW) officially launched the Schwab Crypto platform in phases on April 17, opening direct trading of Bitcoin and Ethereum spot to 39 million active brokerage account customers through its Charles Schwab Premier Bank, SSB, with compliance custody and trade execution provided by Paxos, and a fee of 75 basis points per transaction; initially excluding New York and Louisiana. The company recorded earnings per share of $1.43 and revenue of $6.48 billion in Q1 2026, with total customer assets of approximately $12.22 trillion as of early 2026.Alcoa Corporation (NYSE: $AA) CEO Bill Oplinger confirmed in a Bloomberg interview on April 17 that the company is in deep negotiations with Bitcoin financial services company NYDIG regarding the sale of the Massena East smelter site in New York (1,300 acres, closed since 2014), which "should be completed by mid-year." The site is adjacent to the St. Lawrence River and can access hydroelectric resources provided by the New York Power Authority; NYDIG has been operating Bitcoin mining facilities there since 2024 and will gain full control of the infrastructure after the acquisition. The financial terms of the transaction have not been disclosed.