keys

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

According to Politico, Poland's major cryptocurrency exchange Zondacrypto is facing a serious fraud investigation. Its former CEO went missing in 2022, taking with him the private keys to a cold wallet containing 4,500 bitcoins (currently worth over $340 million). The current CEO has admitted to being unable to access the wallet and has recently been reported to have fled to Israel. Prosecutors estimate potential losses for customers to be around $97 million.On-chain data shows that the bitcoin balance in the platform's hot wallet has plummeted by 99.7% since mid-2024, with users generally reporting difficulties in withdrawing funds. Polish Prime Minister Tusk estimates that up to 30,000 users may be affected.Tusk publicly accused the platform of being funded by Russian-linked money, used to finance opposition lawmakers to obstruct Poland's cryptocurrency regulatory legislation. He bluntly stated that this is a "Polish version of a Ponzi scheme" and criticized the president for vetoing the localization of the EU MiCA framework twice, making Poland a "paradise for scammers."The platform's board stated that they failed to obtain "verifiable information" from the missing CEO and have collectively resigned. The founder has been missing since 2022, and the previously mentioned "suspect kidnapping allegations" case is still under investigation. This incident is expected to prompt Poland and the EU to strengthen regulatory scrutiny of cryptocurrency exchanges.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

Project Eleven today awarded the Q-Day prize to researcher Giancarlo Lelli, who successfully derived a 15-digit elliptic curve private key from a public key using publicly accessible quantum hardware, marking the largest scale demonstration of its kind to date, a 512-fold increase from the 6-digit demonstration in September 2025.Lelli used a variant of Shor's algorithm for the elliptic curve discrete logarithm problem, which is the mathematical foundation of the Bitcoin signature scheme, with the awarded hardware featuring approximately 70 qubits. Currently, no known quantum computer can crack real Bitcoin wallets, and the security of Bitcoin's 256-bit elliptic curve remains far beyond current quantum capabilities. Notably, Google lowered its resource estimates for ECDLP-256 on March 31 and set a target for the migration to quantum cryptography after 2029, followed by Cloudflare, and the UK's NCSC also set migration milestones from 2028 to 2035.On-chain data shows that approximately 6.93 million BTC are at potential quantum risk due to exposed public keys. The Bitcoin community has proposed BIP 360 and BIP 361 to promote the migration to quantum-resistant output types, but the coordination challenges of a decentralized network remain the biggest hurdle.

The Solana ecosystem DeFi protocol Meteora announcement has noted the latest developments regarding the security incident of the cloud hosting platform Vercel. The environment keys were immediately rotated and logs were checked 12 hours ago, and everything is normal. The official team will continue to monitor the situation to ensure the safety of Meteora and its users.

Orca posted on the X platform that its frontend is hosted on the cloud hosting platform Vercel. In response to the Vercel security incident, all potentially leaked keys and deployment credentials have been rotated out of caution. Orca's on-chain protocol and user funds were not affected. The official team will continue to monitor the situation and will provide updates as more information becomes available.

The exchange Zonda stated that its cold wallet holding 4,503 bitcoins (worth approximately $334 million) is currently inaccessible.Zonda CEO Przemysław Kral issued a video statement claiming that the private key for the wallet was never handed over during the company's transition. The private key was supposed to be transferred by Zonda's founder and former CEO Sylwester Suszek, but Sylwester Suszek has been missing since 2022. Przemysław Kral denied allegations of misappropriating funds and stated that an unusual surge in withdrawal requests was triggered by negative media coverage. Zonda plans to take legal action against false statements and is committed to fulfilling its obligations to customers. The exchange was renamed from BitBay to Zonda in 2021.

This morning, 60,000 ETH were redeemed from Ethereum staking and transferred to Coinbase. According to analysis by Yu Jin, the owner of this ETH is Andrew Keys, co-founder of DARMA Capital, and this ETH has been staked for nearly 5 years.In recent days, these ETH have been largely redeemed and aggregated, then transferred to Coinbase. During the nearly 5 years of staking, these ETH earned approximately 18% in coin-based returns (16,000 ETH, worth 34.2 million USD).

According to official news, the blockchain security agency SlowMist recently released a security assessment report, conducting a special audit of OKX Wallet. The results showed that in the audited version, no behavior was found where the application transmitted sensitive information such as private keys or mnemonic phrases to external servers, and no risk of sensitive data leakage was detected overall.It is reported that this assessment focused on whether there were issues with the external transmission of private keys and mnemonic phrases in OKX Wallet, and the results indicated that the relevant core information was processed locally. The current handling of private keys and mnemonic phrases has become the core of wallet security, and such audit results also provide users with a more direct security reference.

Google's research shows that future quantum computers may only need 9 minutes to crack Bitcoin private keys, which is 1 minute shorter than the average block time of 10 minutes for BTC.The study warns that memory pool attacks could become a real threat and urges an immediate transition to post-quantum cryptography.

Andrej Karpathy posted on the X platform that litellm has encountered a PyPI supply chain attack, where executing pip install litellm can steal SSH keys, AWS/GCP/Azure credentials, Kubernetes configurations, git credentials, environment variables, encrypted wallets, SSL private keys, CI/CD keys, and database passwords.litellm has a monthly download volume of 97 million, and the risk can spread to all projects that depend on litellm, such as dspy. The version with the malicious code was online for less than about 1 hour, and it was discovered due to a flaw in the attack code that caused Callum McMahon's machine to run out of memory and crash. Andrej Karpathy stated that supply chain attacks are the most threatening issue in modern software, as each installation of dependencies can introduce tampered packages deep within the dependency tree, leading him to increasingly prefer reducing dependencies and using LLM to directly implement simple functions.

Binance has issued a security alert, as there have been multiple asset security incidents in the community recently due to device environment issues, reminding users to pay attention to the security of their private keys/seed phrases.The Binance wallet's keyless mode is based on MPC-related technology, which stores key shards in different independent environments, further enhancing the security of asset management and effectively reducing the risk of key leakage and attacks.

According to on-chain analysis platform Lookonchain, Ethereum OG Andrew Keys (@AK_EtherMachine) sold 618 ETH today, worth approximately $1.27 million.

AI agent developer CoinFello has released the open-source skill OpenClaw, allowing AI agents to securely connect to MetaMask and execute on-chain transactions without ever accessing the user's private keys.This skill is built on the MetaMask smart account suite, utilizing ERC-4337 smart accounts and the ERC-7710 delegation mechanism. Users can grant AI agents the minimum permissions required to perform specific tasks, effectively mitigating the risks of prompt injection attacks that existing AI agent wallets commonly face.CoinFello's Chief Technology Officer Brett Cleary stated, "If we want agents to meaningfully participate in the on-chain economy, we need a security model that is better than directly handing over private keys."Supported features include ERC-20 token swaps, cross-EVM bridging, NFT interactions, staking, lending, and multi-step trading strategies, all triggered by natural language commands. This skill is released under the MIT License.

According to 23pds, the Chief Information Security Officer of Slow Fog Technology, an intelligence system has discovered a malicious npm package named "@openclaw-ai/openclawai" that is implementing a multi-layer attack.This malicious package disguises itself as a legitimate command-line tool called OpenClaw Installer, aimed at stealing sensitive user information, including system credentials, cryptocurrency wallet private keys, browser data, SSH keys, and Apple Keychain database, among others.

Security research organization Ctrl-Alt-Intel disclosed that a group of hackers suspected to be linked to North Korea has targeted staking platforms, exchange software vendors, and cryptocurrency exchanges.The attackers exploited the React2Shell vulnerability (CVE-2025-55182) and compromised cloud environments using obtained AWS access credentials, enumerating resources such as S3, EC2, RDS, EKS, and ECR, and extracting keys and credentials from Secrets Manager, Terraform files, Kubernetes configurations, and Docker containers. Researchers stated that the attackers downloaded 5 Docker images and stole source code, including components related to ChainUp clients.The attack infrastructure involved a South Korean server 64.176.226[.]36 and the domain itemnania[.]com. The report indicated that this activity is consistent with North Korean-related attack characteristics, but the attribution confidence level is moderate, and the source of the AWS credentials remains unclear.

The founder of Slow Fog, Yu Xian, reposted a security reminder. Currently, the ClawHub market of OpenClaw has discovered 1,184 malicious skills that can steal SSH keys, encrypted wallets, browser passwords, and open reverse shells. A single attacker has uploaded 677 packages. The top-ranked skill has 9 vulnerabilities and has been downloaded thousands of times.Yu Xian reminds users that text is no longer just text, but instructions. It is recommended to use AI tools in isolated environments, as many OpenClaw skills pose potential risks. Furthermore, Web3 security smart contracts are only part of the issue; the real causes of incidents are far beyond just contracts. A few days ago, Moonwell was hacked for $1.78 million, with the faulty code coming from Co-Authored-By: Claude Opus 4.6.

XION recently published an article introducing its new infrastructure and application scenarios. XION announced the official launch of the DKIM module and the ZK module, becoming the first blockchain to directly store email authentication keys (DKIM) on-chain, as well as the first consumer-grade L1 public chain to implement zero-knowledge verification at the protocol level.XION pointed out that existing email verification solutions (including projects like zkEmail) rely on centralized DNS servers to obtain encryption keys. When email service providers rotate keys, the old verifications become invalid, and there are no historical records available. XION's DKIM module permanently stores these keys in the on-chain state, completely eliminating the reliance on centralized DNS infrastructure. Its ZK module implements zero-knowledge proof verification at the protocol level, achieving an efficiency that is 10 times that of smart contract solutions. The two work together, allowing users to prove any information in an email without exposing the email itself.XION stated that currently about 61% of employees who witness misconduct remain silent, as traditional options are often "anonymous but ignored" or "speak up but risk unemployment." With the above infrastructure, XION has realized various application scenarios, including:Anonymous reporting and workplace evaluations (proving employment status without exposing personal information)Wallet recovery without mnemonic phrases (using email as a backup key)Purchase behavior and certificate verification (without excessive sharing of personal information)Trust-based ticket resale and insurance claims, etc.It supports Gmail and Apple Mail from launch, covering approximately 3.8 billion email users globally (accounting for over 90% of the global email market). Currently, the XION platform has over 800,000 monthly active users, with more than 150 brands including Uber, Amazon, and BMW already onboarded. The official statement claims this is a verification infrastructure built for the existing internet, "capable of verifying anything while leaking zero information."

The Chief Information Security Officer of Slow Fog, 23pds, stated on the X platform that the Clawdbot gateway has exposure risks, with hundreds of API keys and private chat records vulnerable to attack.Unauthenticated instances are exposed on the internet, and there are multiple code flaws that could lead to credential theft and remote code execution.

According to the announcement from Paradex, the internal system of the Mithril trading bot was breached by attackers, resulting in the leakage of approximately 57 user sub-keys. Although these sub-keys cannot be used for withdrawals, they have trading permissions for accounts and are commonly used to connect third-party applications with trading bots. Paradex has suspended all XP transfers and revoked the sub-keys associated with Mithril.Affected users are limited to accounts that have authorized the Mithril bot. The official reminder advises users to be cautious when authorizing third-party services and to assess the risks themselves.