security

The Arbitrum Foundation announced the launch of the Arbitrum Security Program, providing smart contract audit subsidies for teams building projects on the Arbitrum platform, covering applications on the testnet, mainnet projects, projects migrating from other blockchains, and exclusive Arbitrum chains.

On Monday, the oracle network Chainlink released the cross-chain interoperability protocol CCIP 2, making significant upgrades to its communication and cross-chain bridge infrastructure. The new version allows enterprises to add their own security verification checks on top of Chainlink's default network of 16 independent node operators. Enterprises can run their own validators or hire external service providers such as Infosys and Nethermind. Chainlink stated that users should not be forced to become "cross-chain security infrastructure experts."This upgrade comes about five months after the Kelp DAO was hacked in April of this year. The attackers are reportedly linked to the North Korean Lazarus group, stealing approximately $292 million in rsETH by deceiving the single validator relied upon by the Kelp cross-chain bridge, which operates on LayerZero. LayerZero blamed Kelp for using only a single validator, while Kelp stated that LayerZero employees had reviewed its setup and raised no objections. Kelp subsequently announced that it would migrate rsETH to Chainlink.The upgrade also adjusts the security mechanism that Chainlink had previously heavily promoted; its risk management network will no longer operate as an independent review node, with such independent checks now provided by optional validators. This means that users who have not added any validators currently rely on a single validation network, whereas previously they relied on two. Existing Chainlink users have been automatically migrated to the new version, but the company has not disclosed which institutions are using the new validators, only stating that Aave and Maple have begun adopting other features of the upgrade.

NVIDIA (NVDA.O) launched an open intelligent agent security platform, ensuring the safety of intelligent agents throughout the entire process from testing to deployment.

Bitget's Greater China Regional Head, Xie Jiayin, recently addressed community concerns during a live broadcast. He reflected that since Bitget's establishment 8 years ago, user asset security has always been the top priority, successfully resisting multiple attempts of cyber attacks and maintaining a long-term record of secure operations. This incident marks the first security crisis in the platform's 8-year development history.Upon complete tracing, this incident is classified as a special attack targeting a third-party security software supply chain. The attacker exploited vulnerabilities in third-party products to obtain internal network credentials; however, private keys were not leaked, and cold wallet assets were unaffected. Currently, Bitget has partnered with security agencies Mandiant and SlowMist to conduct an independent review and will comprehensively upgrade the monitoring and management standards for third-party components. We are not only committed to promoting a full recovery following this incident but will also contribute to a safer, more robust, and healthier development of the industry through continuous technological iteration and system upgrades.

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

The cross-chain liquidity protocol ThorChain's official announcement states that the network interruption is an emergency security mechanism aimed at protecting the protocol's security. The suspension is not a selective freeze of specific funds, nor is it a targeted exchange against individuals.The announcement mentioned that in the security incident in May 2026, 10.7 million dollars were stolen from the liquidity pool. At that time, the attacker's address was not blacklisted, so it could still trade on ThorChain. ThorChain stated that it is a permissionless blockchain platform designed with the intention of not conducting any censorship.

The Ministry of State Security's WeChat public account published an article titled "Is Virtual Currency Crime Untraceable? Think Again!" stating that virtual currency has become an important tool for criminals engaging in illegal activities. The associated risks include being a "hotbed" for money laundering crimes, a "shelter" for cyber attacks, and an "accomplice" for espionage and theft. The article argues that the so-called "anonymity" of virtual currency is fundamentally a false proposition.The article states that blockchain is open and transparent, on-chain data is immutable, and complete transaction records are preserved, which can provide a basis for full-chain traceability. Address anonymity is merely a temporary separation of wallet addresses from real identities, and fiat currency exchanges leave traces such as device codes and network IPs. The article summarizes this as examining the ledger, checking the chain, and discussing the private key: the entire transaction leaves traces, making it difficult to hide real identities; if the private key is kept by the individual, it cannot be recovered if lost, while if it is entrusted to a platform, there is a risk of platform bankruptcy or disappearance.The article also mentions that in February 2026, the People's Bank of China and several departments reiterated that Bitcoin, Ethereum, Tether, and others should not and cannot be used as circulating currency, and related activities are classified as illegal financial activities, which are strictly prohibited. The article warns to be cautious of high-paying part-time jobs that settle in virtual currency and states that reports can be made through 12339, www.12339.gov.cn, the Ministry of State Security's WeChat public account, or local national security agencies.

Recently, there has been a significant price deviation of fiat currency-pegged stablecoins in South Korean virtual asset exchanges. The Japanese yen stablecoin JPYC surged to four times its benchmark price after its listing, the euro stablecoin EURC skyrocketed over 400% in a single day on Bithumb, and the US dollar stablecoin PYUSD also showed a noticeable premium.Analysis suggests that the aforementioned fluctuations are due to insufficient circulation in the early listing phase combined with concentrated buying, unrelated to the issuer's asset preparation. Industry experts point out that relying solely on reserves cannot prevent price distortions in the secondary market, calling for the establishment of initial circulation guarantees, market maker (MM) and liquidity provider (LP) mechanisms during the design phase of the original Korean won stablecoin system, as well as the introduction of measures such as public disclosure of price deviation rates and restrictions on market orders.

Slow Fog's Yuxian stated on platform X that the Bitget theft incident has a wide spread, involves a huge amount of money, and the related funds were quickly linked to North Korean hackers. Institutions such as Circle and Tether have promptly assisted in freezing the related funds, with Circle freezing the USDC held by the hackers.Regarding THORChain, Yuxian pointed out that when THORChain previously experienced a theft incident, it also quickly intervened in its so-called "decentralized" platform; however, in response to this major security incident in the industry, it claimed "decentralization and non-interference" and compared itself to Bitcoin and Ethereum, while continuing to earn fees from the hackers' large cross-chain transactions.He stated that decentralization should not just be a slogan; after a major security incident occurs, the key is to distinguish which issues need to be collectively addressed by the industry. He also believes that platforms like THORChain should not be easily compared to Bitcoin and Ethereum, as there are significant differences in the degree of decentralization and mechanisms of different systems.

MistTrack disclosed that following the $1.46 billion hacking incident at Bybit last year, where nearly $1.2 billion in stolen funds were transferred via THORChain, Bitget has recently experienced another significant security incident, with stolen funds suspected to have once again flowed through THORChain.In response, THORChain officials stated that their protocol, like Bitcoin, Ethereum, and BNB Chain, belongs to a decentralized and permissionless network.

Bitget's Chinese region head, Xie Jiayin, issued a statement indicating that Bitget will ensure users can withdraw funds in an orderly manner in a sufficiently secure environment. Thank you all for your patience. Please understand that due to the different methods of theft, in order to absolutely eliminate all potential risks, the handling of this case is also different from others.Xie Jiayin also stated that he will have a live broadcast with Bitget CEO Gracy Chen at 3:30 PM on Monday (30 minutes before the withdrawal starts) to discuss this security incident and answer questions raised by the community.

Revoke.cash stated that Limit Break's payment processor has a known vulnerability, and users who traded NFTs on the Magic Eden Ethereum marketplace may still retain relevant contract authorizations.The vulnerability has been addressed by white hat security researcher 0xQuit. Currently, NFT assets are expected to be unaffected, but users should still check and revoke affected authorizations to reduce subsequent risks.

OpenSea Chief Technology Officer (CTO) Chris Maddern posted on the X platform in response to the impact of the security incident involving Magic Eden and Limit Break, emphasizing that OpenSea's systems and smart contracts have not been affected. Currently, the affected ERC-721 NFTs have been marked on OpenSea and cannot be sold.For any newly discovered exploited NFTs, OpenSea will also automatically mark them to restrict attackers from obtaining related offers.

The Google Product Security Team has disclosed an internal AI agent called PageBreak, used to test the security of its first-party web applications. This agent is built on Google's Gemini model and began a pilot program in November 2025, transitioning to a formal project in January 2026, with the goal of autonomously scaling vulnerability discovery and reducing manual input.Unlike common AI scanning tools, PageBreak hands over hypotheses to specialized validators after discovering suspicious defects, attempting actual exploitation in a real-time running copy of the application, and only reports once confirmed exploitable, with a false positive rate close to zero. Google claims that PageBreak has identified over 500 XSS vulnerabilities in its first-party web applications, which can be used to hijack login sessions, steal data, or impersonate users.Google stated that the security team has been overwhelmed in recent years by a large number of AI-generated vulnerability reports that appear reasonable but are not valid, making it a major challenge to distinguish real defects from hallucinations. When testing applications built using the next-generation high-assurance framework, PageBreak found only two vulnerabilities. The next step for Google is to integrate PageBreak with the automated remediation agent CodeMender, providing confirmed vulnerabilities with accompanying fixes.

Meta's AI product Muse has been reported to have security vulnerabilities that could endanger user data and the safety of virtual environments. The company plans to enhance risk warnings.

Bitget TradFi Chief Growth Officer Xie Jiayin issued an update on the platform's security incident, stating that the withdrawal time will be announced before noon tomorrow. The security team has identified the hacker's attack path and methods, and has grasped the details of how the attacker bypassed security measures, coming very close to tracing the source of the attack. The incident investigation by third-party security teams Mandiant and SlowMist is still ongoing, with a detailed report pending from the security team.On-chain tracking confirms that approximately $387.5 million has been transferred to the hacker's address, previously estimated at $351.6 million. This revision includes ZEC and TRX, and no other unauthorized transfers have been found. Xie Jiayin stated that the stolen funds at the platform level will be fully covered by the Bitget User Protection Fund, ensuring that user assets are not subject to any losses.Bitget has officially launched a fund recovery bounty program, offering a 5% bounty for voluntarily freezing the attacker’s funds and a 5% bounty for voluntarily recovering funds. The bounty also applies to assistance already provided. The platform has published the attacker's address, a real-time tracking dashboard, and a submission portal, with relevant information also available for submission through Bybit's Lazarus bounty platform.

According to Cointelegraph, blockchain security company SlowMist stated that its investigation has not linked the recent security warning caused by the iPhone Safari attack to confirmed cryptocurrency theft incidents.SlowMist told Cointelegraph that it has not independently confirmed any victims affected by the specific Safari attack samples it analyzed, and the strongest technical evidence it possesses covers iOS versions 18.4 to 18.6.2. The company stated that the reported impact range of "iOS 13 to 26.5" should be regarded as a preliminary assessment, and it tends to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is obtained.SlowMist pointed out that the Safari attack reused the previously disclosed DarkSword exploit chain technology, which is independent of another investigation involving malicious components embedded in App Store applications called FomoPeek. The Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since November 2025.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.

Bitget CEO Gracy Chen stated that Bitget is conducting a comprehensive investigation into the recent platform security incident in collaboration with independent third-party expert Mandiant and Slow Mist. The platform will continue to release the latest updates through official channels.He emphasized that ensuring user safety is Bitget's top priority at the moment, and user balances remain intact. The Bitget User Protection Fund will cover the impacts caused by this platform-level incident. The Bitget Wallet is a self-custody wallet, using infrastructure that is completely separate and independent from Bitget Exchange, and therefore was not affected by this incident.Currently, the recharge, trading, and reward functions of Bitget Exchange are still operating normally. The withdrawal function remains suspended during additional security checks and will be reopened as soon as the platform confirms it can be safely restored.

The NFT market Magic Eden appears to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets.Quit, the Vice President of Blockchain at Yuga Labs, stated that this transfer is part of a white hat operation. The related NFTs are currently stored in an address starting with "0x71cF," and the assets are in a secure state. They will be returned in full once the risk is eliminated.