security

Polygon Labs disclosed that it has fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks, with the related fixes privately deployed before public disclosure. According to a forum post released on Wednesday, the team packaged the fixes into the Austin hard fork of the Bor client and the Kyoto hard fork of the Heimdall client, both of which followed the standard process for fixing issues that affect consensus: first validated on the Amoy testnet, and then publicly disclosed once the mainnet was activated and the network was secure.The Austin fork fixed two denial-of-service paths in block processing, including a vulnerability where malicious block producers could crash peer nodes by filling them with oversized field data. The Kyoto fork addressed a broader range of consensus hardening issues, with the most severe vulnerability allowing an attacker to force the entire validator set to perform costly and coordinated work with just one crafted transaction—the cost of constructing the transaction is low, but the network processing cost is high. Polygon emphasized that none of the vulnerabilities were observed to be exploited on the mainnet and have been proactively addressed. The two upgrades are now mandatory for node operators and have taken effect without the need for state migration or resynchronization.This disclosure comes at a critical transformation period for Polygon, which has completed the migration of the traditional MATIC token to POL as part of a comprehensive overhaul of its network architecture. The news did not boost the price of POL; according to CoinGecko data, POL traded at approximately $0.09983 on Sunday, down 2.3% in 24 hours, down about 6.8% over the past week, and down about 60.8% over the past year, with a market capitalization of approximately $1.07 billion.

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.

The Cronos network associated with Crypto.com has suspended operations after detecting an attack on the lending protocol Tectonic. The Cronos Network announced on the X platform that it has identified vulnerabilities on Tectonic and has paused the network. Tectonic also confirmed that it is investigating the related incident and advised users not to interact with the protocol until safety is confirmed. According to DefiLlama data, Tectonic had a total locked value of approximately $121.7 million before the incident, with active loans of about $82.7 million.On-chain researcher Weilin Li attributed the attack to price manipulation of the TONIC token. The attacker bought enough TONIC within 20 minutes to inflate its price by about 100 times, then used the inflated tokens as collateral to borrow other assets from Tectonic, a method similar to the 2022 Mango Markets oracle manipulation attack. Li initially estimated that the attacker profited about $66 million, later discovering that another address controlled by a different attacker contained about $8 million, bringing the total estimate to around $75 million. Li also stated that the attacker only successfully bridged about $6 million to Ethereum, as the suspension of the Cronos network prevented most of the affected assets from flowing out.Crypto.com CEO Kris Marsalek stated that the company's app and exchange were not attacked, and its security team is assisting Tectonic with the investigation.

The semiconductor and AI independent research organization SemiAnalysis released a deep security report on Neocloud (new cloud), revealing various cross-tenant security vulnerabilities discovered during the ClusterMAX 3 testing period. In a four-month test covering 25 vendors and 32 clusters, the team achieved multiple instances of cross-tenant remote code execution (RCE) solely by exploiting publicly known vulnerabilities and basic configuration checks. Affected entities included banks, telecommunications companies, universities, research institutions, AI laboratories, and even a national intelligence agency.Typical issues included: shared Kubernetes control plane leading to tenant metadata visibility, container escape, exposure of BMC/IPMI management networks, incorrect configuration of InfiniBand security keys (P_Key, SA_Key, M_Key), unfortified default trust mode of BlueField DPU, Grafana monitoring dashboards using god-level API keys, and lack of VXLAN isolation in front-end networks. The report specifically pointed out a cascading vulnerability case: a misconfiguration of shared vCluster combined with software versions being two years out of date ultimately completed the POC verification of cross-tenant RCE within an afternoon.Notably, the report questioned the mainstream narrative that "AI has fundamentally changed the pace of cybersecurity": statistics on CVEs for NVIDIA GPU drivers, CUDA, PyTorch, Kubernetes, Docker, and the Linux kernel showed that there was no significant increase in vulnerabilities after the popularization of AI coding models, with most data supporting the "no change hypothesis." The report also detailed the incident where an OpenAI-trained agent attacked Hugging Face, where the AI agent achieved cluster-level privilege escalation through a message board established via Artifactory, which went undetected from May to July. While building POC verification for existing vulnerabilities, the team found that Claude Fable and GPT-5.6 Sol frequently rejected security-related requests, ultimately relying on open-source models such as DeepSeek V4, Kimi K3, and GLM-5.2 to complete the task.SemiAnalysis stated that the core issue in the Neocloud (new cloud) industry is not the new risks brought by AI, but rather the long-term absence of basic patch management, tenant isolation, and security design. They recommended that vendors establish automated security announcement monitoring systems and rectify single points of failure that could expose all users' architectural patterns.

The Solana-based crypto debit card infrastructure Rain was hacked due to vulnerabilities in outdated contracts, resulting in approximately $1.1 million in funds being stolen. The affected crypto bank Avici's token AVICI dropped from a 24-hour high of $0.43 to a historical low of $0.217, a decline of 49%, before recovering to around $0.378.Avici confirmed that the attack only affected the card funds contract used for recharge consumption, and its self-custody wallets were not impacted, promising to fully refund the affected balances. In this incident, 1,685 Avici users lost approximately $500,800; another crypto bank, Tria, also had 636 users affected, with losses exceeding $430,000. The discrepancy between the approximately $1.1 million tracked on-chain and the losses reported by Avici indicates that other protocols supported by Rain were also attacked.Transaction data shows that the attacker repeatedly submitted signature authorizations, adding themselves as administrators of the card collateral account and withdrawing balances. The stolen stablecoins were exchanged for SOL, cross-chain to Ethereum, and ultimately flowed into the mixer Tornado Cash. Avici has filed a report with the FBI's Internet Crime Complaint Center. This incident also exposed issues with the custody transfer behind some self-custody crypto cards: although users control their wallets, the funds used for consumption are transferred to third-party contracts.

Polygon disclosed multiple previously undisclosed security vulnerabilities that were recently fixed through two hard forks, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial of service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that these vulnerabilities were fixed through the Austin and Kyoto hard forks, and the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most serious issue involved Heimdall, where a carefully crafted transaction could force validators to perform excessive processing work, thereby disrupting the network. The Austin hard fork also fixed two denial of service risks in Bor that could slow down block processing or cause node crashes.Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively deployed before the details were made public. Nodes running outdated client versions have fallen out of consensus after the hard fork activation height and must upgrade to rejoin the standard network. All Polygon PoS nodes are required to upgrade to Bor v2.1.0, and validators and full nodes must upgrade to Heimdall v0.11.0, both upgrades are now effective on the mainnet.

The Interchain Foundation stated that it is committed to supporting the development of the Cosmos ecosystem and recognizes the impact of recent Cosmos EVM events on teams that rely on Cosmos technology for deployment.To this end, the ICF is establishing a discretionary funding program to support affected chains collaborating on remediation efforts. As part of the same program, the foundation will invest resources alongside the community to further enhance security practices, infrastructure, and incident response capabilities across the ecosystem.The foundation will continue to invest in the resilience and security of Cosmos, with more details on the new funding program to be announced in the coming days.

Bitcoin News posted on the X platform that Core Lightning version 26.06.7 has been released, fixing multiple vulnerabilities disclosed responsibly over the past three weeks. The AI-generated security reports for the open-source Bitcoin project have recently increased, and specific vulnerability information will be kept confidential for two weeks to allow node operators to complete upgrades before the technical details and source code are disclosed.Developers warn that immediate disclosure of the fixes could allow attackers to reverse-engineer the vulnerabilities and subsequently attack nodes that have not yet been updated. All Core Lightning node operators should upgrade immediately. Currently, the Docker image is not available, and developers explicitly warn users not to wait for the Docker image.

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to Bitcoin News, Sparrow Wallet v2.5.4 has been released after extensive AI-assisted review, containing multiple security enhancement updates aimed at reducing users' reliance on external servers such as Electrum.Additionally, this version strengthens Ledger, Keycard, Trezor, Payjoin, PSBT, and multi-signature handling, removes Bitcoin Core credentials and other confidential information from debug logs, restricts existing wallet and backup directory permissions to owner access only, closes local DNS resolution leaks when using Tor, and enhances wallet import, signing, downloading, and server response verification. This update expands Sparrow Wallet's scope for independently verifying transaction data, hardware devices, and other inputs, reducing reliance on external servers for data provision.

GoPlus Security issued a security alert stating that realio[.]fund, a subsidiary of Realio Network, was attacked. The attacker took over the platform's signature system and transferred assets from the treasury and custodial wallets on Ethereum, BNB Chain, Algorand, Stellar, and the Realio native chain.This incident involved approximately 127.9 million RIO, valued at around 6.2 million dollars, and the attacker has currently cashed out about 317,000 dollars.

1inch collaborates with HackenProof to release the vulnerability bounty report for the first half of 2026. The report shows that from January to June 2026, 1inch received a total of 1,055 reports submitted by security researchers across 6 core vulnerability bounty programs on HackenProof, of which 32 received rewards.Among them, the 1inch Aqua vulnerability bounty program received 472 reports submitted by 217 researchers, with 9 vulnerabilities rewarded, including 1 high-risk vulnerability, as well as several medium and low-risk vulnerabilities. The related issues involve logical inconsistencies, unit mismatches, execution boundary cases, and tool-related problems, all of which have been fixed.

The development team of Term Finance, Term Labs, announced that after the governance attack incident, all Term Meta Vaults have been permanently closed, DAO governance rights have been revoked, but the withdrawal channel remains open. In an update on August 23, Term stated that this closure is irreversible and permanently prevents subsequent deposits, but did not disclose the scale of the remaining assets in the vault, only indicating that it will "explore pathways" to address any gaps, and the amount that depositors can recover remains undecided.Blockchain security company PeckShield estimates that the attacker stole approximately 2,843 ETH (worth about $6.87 million at the time) and 1.68 million USDC (which was later exchanged for about 1.68 million DAI), with total losses estimated at around $8.5 million. On-chain records confirm the related transfers: one transaction transferred 2,841.74 WETH to an address labeled "Term Finance Exploiter 1" by Etherscan, while another transaction transferred 1.68 million USDC to an address labeled "Term Finance Exploiter 2".Yearn stated that Term's vault contract uses its V3 architecture, but the attack occurred on Term's custom governance wrapper, which is not applicable to standard Yearn vaults. Term indicated that, according to the current investigation, its underlying protocol and direct lending market were not affected and is working with external security teams for remediation and recovery, but did not provide any compensation commitments or timelines.

According to Bloomberg, AI security startup Alice announced the completion of a $140 million financing round, led by the private equity firm Apax Partners through its fund Apax Digital, with investments from cybersecurity company SentinelOne and Samsung Electronics. After this round of financing, the company's valuation is close to $1 billion.Alice primarily provides security protection for AI models, helping enterprises reduce the risks of AI systems being abused, attacked, and exhibiting abnormal behavior. Currently, the company has partnered with leading AI industry firms including Anthropic and Google.

On August 25, Anthropic requested its employees at the San Francisco office to work from home starting this week due to the possibility of a strike by the company's security personnel. However, the union representing these security personnel stated that they were not aware of this.According to a source familiar with the matter, Anthropic received a notice last week from its security service provider, Allied Universal, indicating that the company's employees might strike. Subsequently, Anthropic informed its employees to avoid going to the San Francisco office on Monday and Tuesday, just in case.

The blockchain network BNB Chain has enabled the Pasteur hard fork on the BNB Smart Chain (BSC) mainnet. The upgrade involves cross-chain bridge validation, validator authorization, staking, and governance security, while enhancing block capacity without changing the 450 milliseconds block time.This upgrade includes BEP-682, BEP-695, and BEP-675, which respectively involve duplicate validator entries, validator key rotation and penalty governance, and block submission processes. In the internal testing environment QANet, the new process increased throughput from 1,237 transactions per second to 2,324 transactions per second, but the related data comes from controlled tests and not mainnet measurement results.

Cosmos Labs announced that an ongoing security incident has affected users of the Cosmos EVM module. The security and engineering team at Cosmos Labs is actively responding to the incident and has advised validators on the Cosmos EVM chain in contact with them to suspend the operation of their chain.Cosmos Labs appreciates the swift response from all teams using Cosmos EVM and stated that an incident report will be released after the situation is resolved. If relevant teams are using Cosmos EVM and have questions, they can contact security@cosmoslabs.io.

According to security company Salus monitoring, a user lost approximately 550,000 USDC after clicking on a Google sponsored ad that led to a counterfeit Hyperliquid website. This case utilized specialized "coin theft service" infrastructure associated with the Inferno system. The relevant services attract customers through Telegram accounts, offering malicious scripts, automatic theft, cross-chain withdrawals, and automatic profit sharing functions.In this case, the phishing gang was responsible for purchasing ads, deploying counterfeit entry points, and providing the final collection address; after the theft of coins was successful, the backend automatically completed the fund splitting. The total amount involved by the relevant gang is approximately 52.74 million USD, which has been linked to multiple significant phishing incidents, such as on September 23, 2025, when the original attacker of UXLINK encountered a second authorization phishing, resulting in about 542 million UXLINK; on April 15, 2026, the official domain of CoW.fi was hijacked, with associated losses of 316,000 USDC; on July 9, 2026, a fake DApp/fake airdrop authorization phishing stole about 1 million USDT. Salus stated that the relevant evidence and high-risk addresses have been submitted to the appropriate authorities for handling.