hackers

According to on-chain analyst PeckShield (@PeckShieldAlert), approximately 19 hours ago, TesseraDao (@TesseraDao) on the BNB Chain was attacked, with hackers maliciously minting 99 million TSR and immediately selling it off, causing the TSR price to plummet by 99%.The attackers then exchanged the obtained TSR for approximately 2.5 million USDT and transferred the funds across chains to Ethereum, where they have completed money laundering operations of 1,285.5 ETH through TornadoCash.

A white hat hacker using the alias "0xflorent" stated on X on Sunday that he has helped recover approximately 1,003 ETH (worth about $2 million) from a faulty smart contract of the Hong Coin (HONG) token sale in 2016, involving 48 investors.Hong Coin was originally designed as a community-operated decentralized venture capital fund, with the token sale starting on August 29, 2016, and ending on October 28 of the same year, but it failed to launch due to not reaching its funding goal. The contract was supposed to automatically refund investors, but a vulnerability in the refund function caused the funds to be locked for nearly a decade.0xflorent collaborated with the HONG creator to exploit an administrator function with an integer overflow vulnerability, resetting the token holders' balances and triggering the refund mechanism through specific inputs, successfully extracting the locked funds. According to Etherscan data, one investor has already received a refund of 96 ETH (approximately $192,500). Previously, on May 24, 0xflorent also recovered 19.33 ETH from another failed token sale project from 2018.

According to The Block, a developer using the pseudonym Florent helped rescue approximately 1003 ETH (worth about $2 million) that had been trapped in the 2016 HongCoin ICO contract for nine years through white hat hacking techniques. The ICO was supposed to automatically refund due to not meeting the funding target, but a coding error caused the funds to be locked. The contract used an old version of the Solidity language, lacking overflow protection mechanisms.Florent discovered that by calling the team's admin function and inputting a specific value, he could reset the holder's balance to 1, thereby releasing the ETH through a refund check. This admin function was restricted to HongCoin's multi-signature address. Florent contacted the team and, after verifying the process on the test network, the team signed the unlock transaction themselves. The entire process took about a week, during which the team signed 41 transactions covering approximately 1000 ETH. So far, two investors have claimed 96.5 ETH and voluntarily paid Florent a white hat reward. Florent stated that his motivation was curiosity and understanding how the old contract worked.

According to monitoring by PeckShieldAlert, the Gravity Bridge hacker has stolen approximately $5.4 million and has laundered part of the stolen assets through ChangeNow and Binance, currently still holding 2,102 ETH (approximately $4.23 million).Previously, according to on-chain analyst Specter, the cross-chain bridge Gravity Bridge was suspected to have been attacked, with its contract keys seemingly leaked, resulting in approximately $5.4 million in assets being stolen. The stolen assets mainly include about $4.3 million in USDC, 274 WETH (approximately $553,000), $434,000 in USDT, and $64,000 in PAYG. Currently, Gravity Bridge officials have not responded.

The court in Qujiang District, Quzhou City, Zhejiang Province, China recently ruled on a hacker case that used government and enterprise websites as a platform for pornography. The defendant, Zhou, illegally controlled over 150 servers (involving 157 government and enterprise units and well-known apps) through website vulnerabilities, batch-injecting malicious files, forcing redirection to overseas pornographic websites, and selling control permissions for profit. To evade tracking, Zhou rented a house and opened accounts using the identities of friends and relatives, arranged for accomplices to operate

According to Onchain Lens monitoring, Echo Protocol was attacked on the Monad chain. The attacker minted 1,000 eBTC ($76.7 million) and withdrew funds from Curvance through a previously tested attack path.Currently, the attacker has deposited 45 eBTC ($34.5 million) into Curvance as collateral, borrowed about 11.29 WBTC ($867,700), and cross-chained to Ethereum, sending 385 ETH (approximately $818,000) to TornadoCash after exchanging for ETH. The attacker still controls a large amount of minted eBTC.

According to monitoring by PeckShield, Verus's Verus-Ethereum Bridge has been hacked, with lost assets including 103.6 tBTC, 1625 ETH, and 147,000 USDC. The hacker subsequently exchanged the stolen assets for approximately 5402.4 ETH. The attacker's address obtained an initial fund of 1 ETH about 14 hours ago through the mixing protocol Tornado Cash.

The open-source data visualization tool Grafana stated on platform X that it recently discovered an unauthorized attacker had obtained a token that could access the Grafana Labs GitHub environment and used it to download the code repository.An investigation confirmed that this incident did not involve customer data or personal information leakage, and no impact on customer systems or business operations was found. After the incident, forensic analysis was immediately initiated, and it is believed that the source of the credential leak has been identified. Additional security measures have also been deployed to strengthen environmental protection.Furthermore, Grafana disclosed that the attacker attempted to demand a ransom to prevent the code repository from being made public, but the company ultimately decided to refuse to pay the ransom and will release more information about the incident review after the investigation is completed.

According to a report by Cointelegraph, a report released by cybersecurity company CrowdStrike shows that losses from cryptocurrency assets caused by North Korean hackers and threat actors exceeded $2 billion in 2025, a 51% increase year-on-year, despite a decrease in the number of attacks. CrowdStrike stated that North Korean hackers are the largest threat organization targeting cryptocurrency users, and the stolen funds are almost certainly used to finance the regime's military programs.Attackers prioritize high-value targets, mainly focusing on Web3 projects and cryptocurrency exchanges, as stolen funds are easier to cash out and transfer anonymously. In April of this year, the Ethereum Foundation identified 100 North Korean hackers, and the Drift Protocol was infiltrated by North Korean tech workers, resulting in a loss of $280 million, with these threat actors establishing face-to-face relationships through third-party intermediaries.

According to a notice from Transit Finance, a security incident recently occurred in the project due to historical vulnerabilities in an old version of the smart contract deployed on TRON, which was deprecated in 2022, affecting a small number of users after being exploited.The team stated that after discovering the issue, they urgently completed investigation, isolation, and repair, and on May 12, further auditing and rectification were carried out. The currently used contract version has not been affected, has been running safely for over four years, and continues to undergo security audits and monitoring.Transit stated that affected users will receive full compensation, and specific plans will be announced through official channels. They also reminded users to be wary of counterfeit official messages and not to disclose private keys or mnemonic phrases.

According to Decrypt, Microsoft's threat intelligence department disclosed that attackers implanted malicious code into the Mistral AI package distributed through the PyPI platform. This malicious code automatically runs when developers use it on Linux systems, downloading a malicious file named transformers.pyz and executing it in the background, with the filename deliberately mimicking the widely used Hugging Face Transformers library to confuse users.Microsoft pointed out that this malware primarily steals developer login credentials and access tokens, and it avoids Russian systems. Some of the code can randomly delete device files located in Israel or Iran. This attack is related to the "Shai-Hulud" supply chain attack campaign that started in September. Mistral responded that investigations show the attack originated from compromised developer devices, and the company's infrastructure was not breached.

Web3 security company CertiK has released the "Skynet North Korea Cyber Threat Report." The data shows that since 2016, North Korean hacker groups have plundered approximately $6.75 billion in digital assets. In 2025 alone, the losses from thefts they orchestrated reached as high as $2.06 billion, accounting for nearly 60% of the total losses in the global cryptocurrency industry for the entire year (including the $1.5 billion Bybit theft case). As of early 2026, this threat trend continues, with losses accounting for about 55%.The report emphasizes that the attack patterns of North Korean hackers have undergone a fundamental shift, evolving from simple code vulnerability exploitation to a national-level attack system that combines social engineering, deep supply chain attacks, and "physical infiltration." In the recent Drift protocol incident, attackers even spent six months lurking at offline industry conferences, establishing trust through real funds and interpersonal interactions before executing their attack.CertiK security experts warn that in the face of such systemic attacks, simple technical defenses have become weak. Cryptocurrency institutions urgently need to fully implement a "zero trust" hiring model, strengthen third-party supply chains, establish fund circuit breaker mechanisms, and collaborate with professional security organizations to build a comprehensive lifecycle defense system covering code audits, round-the-clock risk monitoring, and on-chain anti-money laundering/KYT (Know Your Transaction) fund tracking.

According to Decrypt, Google's Threat Analysis Group confirmed that cybercriminals used an AI model to discover and exploit a zero-day vulnerability in a popular open-source web management tool that could bypass two-factor authentication. Google stated that this is the first time the company has confirmed AI-assisted zero-day vulnerability development in a real-world environment. Before attackers could exploit it on a large scale, Google worked with the affected vendor to patch the vulnerability. Google's report noted that the vulnerability was a logic error, where the software trusted a condition that could bypass two-factor authentication. Unlike traditional scanners that look for crashes or error codes, AI analyzed the expected behavior of the software and detected logical contradictions, allowing attackers to bypass security checks without compromising encryption.

Renegade posted on platform X that a legacy V1 version of the protocol was attacked earlier this morning, resulting in a loss of approximately $209,000. White hat hackers have returned about $190,000, and all affected users will receive full compensation.The team confirmed that the issue only exists in the V1 Arbitrum deployment, and other deployments (V1 Base, V2 Arbitrum, V2 Base) are safe. All infrastructure supporting V1 Arbitrum transactions has been suspended, with no further risk to funds, and integrators do not need to take any action.

According to the latest report from TRM Labs, North Korean hackers stole nearly $600 million worth of cryptocurrency in the attacks on Drift Protocol and Kelp DAO, accounting for 76% of the total losses. TRM Labs estimates that since 2017, hackers associated with North Korea have stolen over $6 billion from cryptocurrency protocols and projects.The report shows that the share of losses caused by North Korean hackers in global cryptocurrency hacking attack losses has increased from less than 10% in 2020 and 2021 to 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025.

North Korean hackers had months of offline contact and infiltration with employees of Drift Protocol before launching one of the largest social engineering attacks in the history of the cryptocurrency industry, resulting in a loss of approximately $285 million.Data from blockchain security company TRM Labs shows that North Korean hackers have accounted for 76% of all cryptocurrency hacking losses in 2026 to date.

The latest report from blockchain intelligence agency TRM Labs shows that approximately 76% of global cryptocurrency hacking losses are related to organizations associated with North Korea, with a total stolen amount of about $577 million.North Korea's share of global crypto theft continues to rise: 22% in 2022, 37% in 2023, 39% in 2024, rising to 64% in 2025, and further increasing to 76% in 2026. Since 2017, the total illegal profits have exceeded $6 billion. The report points out that these losses mainly stem from two major incidents in April: a $292 million attack on KelpDAO and a $285 million theft from Drift Protocol, with the two attacks accounting for about 3% of all hacking incidents during the same period.

In the past ten years, the cumulative loss was $17.1 billion, involving 518 incidents; in the past five years, the loss was approximately $15.2 billion, involving over 450 incidents; in the past year, the loss was about $2.5 billion, involving over 140 incidents. Recent losses indicate that crypto attacks have shifted from smart contract vulnerabilities to private key leaks and access control.

According to on-chain analyst Yu Jin's monitoring, the KelpDAO hacker exchanged all 75,700 ETH for BTC through THORChain yesterday. The hacker who stole $98 million in assets from Balancer last November also exchanged ETH for BTC through THORChain today.Today, the Balancer hacker has already exchanged 7,000 ETH for 204.7 BTC ($15.88 million) and is still continuing. Currently, the Balancer hacker holds 15,000 ETH ($34.65 million) on the ETH chain and 204.7 BTC ($15.88 million) on the BTC chain.

According to official news, KelpDAO stated that over the past few days, the team has been continuously advancing the handling of related events with the support of partners, allies, and the community. Discussions are progressing in a positive direction, and efforts are being accelerated to reach a suitable solution. The project party emphasized that it always adheres to the core principle of "user first," and subsequent measures will be gradually implemented with the aim of safeguarding the overall interests of users.In the past four days, the Kelp team has been working around the clock in collaboration with multiple parties, maintaining close communication with all relevant parties, and making substantial progress on several potential solutions. This includes measures taken by the Arbitrum Security Council to freeze the stolen funds, as well as SEAL 911 participating in the preliminary investigation to provide objective and clear analytical support for the incident.Kelp stated that the current focus of work remains on protecting user asset security and strengthening the protocol itself. This incident is not only of critical significance to the project but also has enlightening value for the entire industry. The team will continue to disclose subsequent progress through official channels and thanks the ecological partners and community for their ongoing support.Previous reports indicated that the KelpDAO hacker has essentially laundered $175 million in ETH into BTC.