stolen

According to on-chain detective Specter, last week there were 3 independent incidents involving over $40 million in stolen cryptocurrency, with each victim losing tens of millions of dollars. Specter stated that a large amount of funds entered the market last week, and social engineering, phishing links, and wallet theft scams continue to persist.Specter reminds that cryptocurrency is not an industry where one can simply buy assets and ignore them; asset security is part of the investment, and one should pay attention to the latest attack incidents, wallet exploitations, and phishing activities in a timely manner. If not active on crypto Twitter or security forums, one should at least follow a reliable source that continuously publishes security updates.

The cross-chain liquidity protocol Maya Protocol was attacked on August 18, with the attacker exploiting six interconnected software vulnerabilities to create false account balances, stealing approximately 20.83 BTC (about $1.34 million) and other assets, resulting in a total direct loss of about $1.65 million. The incident led to the suspension of trading on the MAYAChain network, with its token CACAO plummeting nearly 89% from $0.115 to $0.013, before recovering to around $0.03.Technical reviews show that the attack began when MAYAChain mistakenly judged a transaction to be lost and triggered a compensation mechanism, but the mechanism miscalculated, adding about 49 million CACAO to a small liquidity pool, while the protocol's reserves only held about 168,000 CACAO. After the transfer failed, the system incorrectly saved the new balance, and the attacker subsequently deposited a very small amount into the liquidity pool, acquiring over 99% of the pool's share and immediately withdrawing 48.87 million CACAO, which was then exchanged for Bitcoin, Ethereum, and other assets.The incident caused the total value of the Maya Protocol liquidity pool to decrease by about $10.9 million, of which approximately $6.4 million was due to the depreciation of CACAO, and about $2.9 million came from arbitrage trading. The team expressed hope that the attacker would return the funds in the form of a bug bounty; otherwise, they would seek to recover losses through investments in channels like Aztec Chain. Maya Protocol has not yet announced a specific time for resuming trading. This incident once again exposed the security risks within the complex logic of DeFi protocols.

Bitcoin News posted on the X platform that Prince Filip learned during his vacation that COLDCARD was hacked. As a Mk3 user, he was at risk of having all his Bitcoin stolen at any moment.

According to monitoring by Bitcoin News, new research published by @PraveenPerera shows that Coldcard attackers seem to first identify addresses with vulnerabilities, then sort them by the amount of Bitcoin held, starting to transfer in batches from the addresses with the highest holdings. The transfer software used was relatively crude.One address had 225 spendable UTXOs, and the attackers extracted exactly the latest 200, leaving the earliest 25, which included a UTXO worth 0.16 BTC. This aligns perfectly with the limitation of a blockchain API investigated by researchers, which defaults to returning 200 records, indicating that the attackers may have failed to load the next page of data. The software even spent a UTXO of 294 satoshis, reportedly increasing the transaction fee by about 2040 satoshis, with the spent amount significantly higher than the value of the UTXO itself.The authors of the study believe that the builders of this tool may have a better understanding of the account balance system than of the Bitcoin UTXO model. Although the attackers seem to have obtained the complete seed of the victims, at least 75 BTC still remain in other addresses derived from the same seed. The biggest suspicion currently is that among the 153 stolen addresses, there are still 132.95 BTC, and researchers have been unable to reproduce the seed behind these addresses, so it cannot be ruled out that the attackers obtained undisclosed private device data or candidate data.

According to on-chain detective Specter, the attacker exchanged all assets including WBTC, cbBTC, LDO, USDS, and CRV for DAI and ETH. The same wallet was previously hacked in September 2023 due to malicious token authorization, resulting in a theft of 24.23 million USD, with the attacker ultimately returning about 90% of the stolen funds. The attacker's address is 0x8fEB...F95Ae.

On August 9, the cross-chain bridge connecting the XRP Ledger and Coreum was attacked, with the attacker stealing approximately 199,900 XRP through a validation logic vulnerability, causing the bridged asset balance to drop from about 200,400 XRP to 493.5 XRP. This attack did not involve private key leakage and did not target the XRP Ledger protocol itself.The attacker forged deposit operations, causing the bridging system to recognize them as real deposits and triggering the other end of the bridging wallet to send real XRP to them. On-chain data shows that the attacker completed the fund transfer through 94 multi-signature authorization transactions within 97 minutes. These transactions required 17 signatures from 28 relay node keys, allowing the attacker to bypass the validation mechanism of the bridging system. As of August 11, the Coreum cross-chain bridge remains in a suspended state, and the Coreum Development Foundation has not yet released an official incident report. The security of the XRP mainnet and user private keys has not been affected.

According to The Block, supporters of the open-source Bitcoin payment processor BTCPay Server have pledged to establish a bounty for recovery: 10% of the recovered funds will be awarded, with a maximum of 3 BTC if the full amount is recovered.BTCPay disclosed last Friday that a serious vulnerability is being actively exploited and urged users to upgrade as soon as possible. This vulnerability allows attackers to obtain LND administrator credentials, thereby gaining full control over connected Lightning wallets. BTCPay stated that on-chain wallets (including hot wallets) are not affected and did not disclose the total amount of losses or the number of affected nodes.

Coinsbuy confirmed a security incident, with unauthorized withdrawals from the platform wallet. The company stated that it has covered customer losses with its own reserves and is offering a reward of $100,000.

Cryptocurrency exchange Bybit has filed a civil lawsuit in the United States District Court for the District of Columbia, suing North Korea, the North Korean Reconnaissance General Bureau, and the hacker group Lazarus Group, regarding a theft incident of approximately $1.5 billion in February 2025. Bybit stated that the judge has approved a preliminary injunction prohibiting the transfer or disposal of identified stolen assets during the case proceedings, and believes that Bybit has a high likelihood of success on the merits.The lawsuit also lists unknown individuals and entities holding or transferring the relevant funds as John Doe defendants. Bybit disclosed that approximately $48.4 million has been recovered, and about $30.5 million has been frozen across more than 28 exchanges and custodians, together accounting for approximately 5% of the stolen amount. The attackers transferred about 500,000 ETH from Bybit's cold wallet in February 2025, with most of the funds subsequently exchanged for Bitcoin via Thorchain and transferred through mixing services. Bybit stated that the case is progressing in parallel with a criminal investigation.

In 2025, the amount of cryptocurrency theft reached $3.4 billion, with Bybit suffering a loss of $1.5 billion, accounting for 44% of the total for the year. In the first half of 2026, there were 212 related incidents, resulting in losses of approximately $1.1 billion, with about 55% involving the Lazarus-linked group. KelpDAO was attacked in April, resulting in a loss of $293 million.Stolen funds typically undergo a three-phase transfer process lasting about 45 days: the first 5 days involve exchanging through DeFi protocols and entering mixing services, followed by cross-chain bridging and flowing through trading platforms with lower KYC requirements. During the 20 to 45 days period, funds are further cashed out in batches through non-KYC platforms, instant exchangers, and over-the-counter trading networks. Once funds cross multiple blockchains, mixing services, and jurisdictions, tracking may still be possible, but the difficulty of recovery significantly increases. The recovery rate of stolen funds from Bybit is less than 5%; Tether and Circle can freeze USDT and USDC addresses, and attackers typically exchange stablecoins for Ethereum or Bitcoin within minutes after the attack.

According to Bifrost monitoring, hackers exploited vulnerabilities in liquidity pools to steal assets worth approximately $720,000 from the vDOT single currency pool and the vASTR/ASTR and vMANTA/MANTA pools. The related assets were subsequently deposited into HitBTC and eventually flowed into Binance.Bifrost has contacted the Binance security department to submit a fund freeze application and has reported to law enforcement along with an on-chain evidence package, including transaction tracking, wallet addresses, and timestamps. Currently, Bifrost has halted all liquidity mining rewards and is conducting a comprehensive security review.

The U.S. Attorney's Office for Connecticut stated that three men from St. Louis, Sedric Louis, John Davis, and Martel Williams, have been charged with conspiracy to interfere with commerce by robbery, allegedly planning to break into a residence and force the victims to transfer cryptocurrency related to a theft of hundreds of millions of dollars in Bitcoin. Each faces a maximum of 20 years in prison.Prosecutors allege that the three traveled to Connecticut from August 21 to 24, 2024, rented a car, and prepared items such as air guns and walkie-talkies, monitoring their target and the target's parents for two consecutive days before abandoning the plan due to concerns that residential cameras would record their movements. Subsequently, another group from Florida executed the same plan and six individuals were arrested on August 25 in connection with a carjacking involving a Lamborghini Urus. Louis and Davis have been held since their arrest on June 25 and pleaded not guilty to the charges on July 30 in federal court in Bridgeport; Williams was released on bail after making the same plea on July 17. Prosecutors stated that the kidnapping target was the parent of an individual involved in the theft of hundreds of millions of dollars in Bitcoin, and the indictment does not constitute evidence of guilt.

According to on-chain detective Specter, the same attacker is running similar phishing activities targeting Ledger. The relevant screenshots were taken two days ago, and the sponsored advertisement has now been removed.As of now, these activities have stolen over 3 million dollars.

Bitcoin News posted on the X platform that a Trezor user claimed their life savings were stolen after clicking on a Google sponsored search result impersonating Trezor. The phishing page was hosted on Google Sites and allegedly tricked victims into entering their wallet recovery seed.Trezor stated that it is upgrading its response to the report, working to remove the website, and reminding users to never enter their wallet backups or recovery phrases on any website or online form. Google sponsored phishing ads remain a persistent attack vector faced by cryptocurrency users.

According to GoPlus monitoring, a user on the Base chain lost 500,000 USDC due to a phishing attack. When the attacker exchanged the stolen funds for WETH, the script did not set slippage protection, routing to a Uniswap V4 WETH/USDC pool with almost no liquidity, resulting in only 67.9 ETH (worth $129,000) being exchanged for 500,000 USDC, of which $370,000 was earned by an MEV bot.The MEV bot only paid 0.03 USDC to front-run the transaction but incurred 3.5 ETH in gas fees for this. Subsequently, the victim sent an on-chain message to the attacker and the MEV address, stating that they had identified the attacker and were willing to pay a 10% bounty for a refund.

DefiLlama data shows that in July, hackers stole $247 million in crypto assets, making it the second highest month since 2026, only behind April's $644 million; this amount is a significant increase compared to June's $75 million and May's $60 million.Galaxy Digital stated that the Coldcard vulnerability was the largest attack event of the month, confirming three rounds of attacks involving 7,300 wallets, with at least $100 million in Bitcoin stolen; it also identified a suspected fourth round of attacks, which could bring total losses to about $130 million. The DefiLlama hacker tracker estimates that the losses related to this vulnerability amount to $115 million.Other attacks in July included a $9 million attack on the decentralized finance protocol Bonzo Lend, the theft of $2.6 million from the Cardano-based wallet SecondFi, the theft of $24 million from the Arbitrum-based perpetual trading platform AFX, and the theft of $7.5 million from the Verus Ethereum Bridge.

According to monitoring by PeckShield, the attacker-controlled address 0x920d...9708 stole approximately 500,000 USDC from the Base chain victim wallet 0x3a53...0B5c.However, during the subsequent process of exchanging USDC for ETH, the attacker did not set sufficient slippage protection, and the transaction was front-run by MEV bots for arbitrage. Ultimately, the attacker only obtained about 67 WETH, worth approximately $129,000, losing over 75% of the stolen funds.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

Bitcoin News posted on the X platform that new evidence shows the anonymous switck account that wrote the LibNgU code may actually be Peter Gray, co-founder and CTO of Coinkite, as the code is at the core of the COLDCARD entropy failure incident.Researchers claim that Gray's GPG key signed dozens of switck submissions, and other identifiers seem to link the two identities. Bitcoin developer James O'Beirne stated that he warned Coinkite in May 2025 that the RNG implementation of LibNgU looked suspicious and suggested removing it, but he said the response was that any issues should have already been discovered. Screenshots also show that as early as April 2021, users had already questioned the rewrite of LibNgU.If these findings are accurate, it means that the engineer who introduced the code was later associated with the theft of over 1,800 BTC and had received direct warnings about the RNG implementation more than a year before the vulnerability was publicly disclosed.