vulnerability

Bitget's Greater China Regional Head, Xie Jiayin, recently addressed community concerns during a live broadcast. He reflected that since Bitget's establishment 8 years ago, user asset security has always been the top priority, successfully resisting multiple attempts of cyber attacks and maintaining a long-term record of secure operations. This incident marks the first security crisis in the platform's 8-year development history.Upon complete tracing, this incident is classified as a special attack targeting a third-party security software supply chain. The attacker exploited vulnerabilities in third-party products to obtain internal network credentials; however, private keys were not leaked, and cold wallet assets were unaffected. Currently, Bitget has partnered with security agencies Mandiant and SlowMist to conduct an independent review and will comprehensively upgrade the monitoring and management standards for third-party components. We are not only committed to promoting a full recovery following this incident but will also contribute to a safer, more robust, and healthier development of the industry through continuous technological iteration and system upgrades.

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

Zano, the privacy blockchain, announced a network update stating that the core team discovered a serious vulnerability in the Gateway Address, allowing unauthorized ZANO and fUSD to enter circulation. Investigations show that the wallet's payment keys or the privacy of ordinary transactions were not compromised, and Zano's core consensus mechanism was also unaffected.The team has developed a solution to clear all unauthorized activities by coordinating a network upgrade. To ensure network integrity, the Zano blockchain has been restarted from block height 3,833,000 (i.e., before the 6th hard fork), affecting approximately one month of on-chain historical records. Nodes, miners, stakers, and related services need to adopt the emergency update as soon as possible.The team stated that they will work with affected projects to address the losses and will announce compensation and claims processes, striving to compensate the community. Technical reasons and related code review results will be disclosed in the follow-up.

Bitget stated that the vulnerabilities related to the security incident discovered on September 24 have been confirmed and fixed. The platform will gradually resume withdrawals after completing further security checks. Mandiant, a cybersecurity company under Google, and Slow Mist Technology are assisting in the investigation.The resumption schedule is as follows (UTC):September 28, 8:00: Bitcoin network BTCSeptember 29, 8:00: Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism network ETHSeptember 30, 8:00: Ethereum, BNB Smart Chain, Solana, Tron network USDTOctober 2, 8:00: Other tokens, fiat currencies, and peer-to-peer transactionsBitget mentioned that the suspension of withdrawals is a temporary security measure and is unrelated to the availability of user assets; account balances have not been affected, and the protection fund will cover the financial impact caused by this platform-level incident. The situation is currently under control, and unauthorized transfers will not occur again. Trading and deposit services are still operating normally. Users do not need to take any action in advance; the specific reopening situation will be subject to notifications from the platform and official channels.

Revoke.cash stated that Limit Break's payment processor has a known vulnerability, and users who traded NFTs on the Magic Eden Ethereum marketplace may still retain relevant contract authorizations.The vulnerability has been addressed by white hat security researcher 0xQuit. Currently, NFT assets are expected to be unaffected, but users should still check and revoke affected authorizations to reduce subsequent risks.

The privacy blockchain network Zano disclosed that an inflation vulnerability involving Gateway Addresses has forced it to propose rolling back the blockchain by about 24 hours of history and requires users to immediately cease economic activities related to ZANO and Confidential Assets. Zano has promised to compensate for the losses caused by the rollback but has not yet announced the target block height for the rollback, the fix version, the compensation process, the vulnerability mechanism, and the number of unauthorized created assets.Gateway Addresses went live on August 26 with Hard Fork 6.

Meta's AI product Muse has been reported to have security vulnerabilities that could endanger user data and the safety of virtual environments. The company plans to enhance risk warnings.

Magic Eden announced that the vulnerability occurred in the NFT trading protocol Payment Processor V2 maintained by Limit Break. Magic Eden adopted this protocol for EVM network transaction settlements in 2024 but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026. Therefore, NFTs currently listed on Magic Eden are not affected by this vulnerability.NFTs listed through its EVM market between February and October 2024 may be affected, while listings after October 2024 are generally not impacted. The platform is contacting the protocol owner and maintainer Limit Break to explore other risk mitigation measures, including pausing protocol transfers, and will continue to investigate the actual scope of the impact.Magic Eden reminds users who have listed or traded NFTs on its EVM market to revoke relevant contract authorizations on the Ethereum, Polygon, and Base networks. Users can filter the address through revoke.cash and revoke all authorizations marked as "approved for all" for NFTs. Magic Eden emphasizes that revoking authorization cannot recover assets that have already been transferred.Yuga Labs' Vice President of Blockchain Quit stated today that at 9 AM Eastern Time, attackers exploited the Payment Processor V2 vulnerability to steal a large number of NFTs. After contacting the LimitBreak team, the latter quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain is also temporarily unable to be paused. Therefore, the team implemented a white-hat operation, successfully transferring and protecting 23,155 NFTs valued at over 5.7 million dollars.

The NFT market Magic Eden appears to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets.Quit, the Vice President of Blockchain at Yuga Labs, stated that this transfer is part of a white hat operation. The related NFTs are currently stored in an address starting with "0x71cF," and the assets are in a secure state. They will be returned in full once the risk is eliminated.

White hat actors transferred 40.71 bitcoins related to the Coldcard vulnerability into a single transaction, valued at approximately 3.31 million dollars. This transaction aggregated funds from 11 addresses and included OP_RETURN information pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, revealed that a larger aggregation transferred a total of 52.37 bitcoins, involving multiple clusters of attacker addresses, accounting for about 2.8% of the funds involved in the vulnerability. A firmware flaw in Coldcard devices from March 2021 led to insufficient randomness in the mnemonic phrases, with the peak amount of funds involved being approximately 130 million dollars.

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

Attackers exploited a signature verification bypass vulnerability in the Kasplex KRC-20 off-chain indexer to transfer 186 million ZEAL and 54.398 billion NACHO without holding the private keys of the bridge custody wallet. They executed five forged transactions to mint the tokens through the Igra Labs EVM layer and Kasplex L2, then sold them to the Zealous Swap liquidity pool. The KAS side of the affected liquidity pool experienced a value loss of 94% to 99.6%.Igra has suspended iKAS withdrawals to Kaspa L1 and Hyperlane transfers, and has warned users to avoid bridging KRC-20 tokens, buying ZEAL or NACHO on the L2 DEX, and adding liquidity to the related pools. The Kaspa L1 consensus and unbridged Igra assets were not affected. Zealous Swap stated that the operators need to fix the indexer and re-index the history, rejecting transactions with empty signatures, abnormal tags, and transactions containing scripts after OP_ENDIF.

The firmware vulnerability of the hardware wallet Coldcard in 2021 led to insufficient randomness in some recovery seeds. Since July 30, attackers have transferred approximately 1,600 to 1,800 Bitcoins from affected wallets, involving thousands of addresses, with a valuation exceeding 100 million dollars. Coldcard manufacturer Coinkite stated that it must be assumed that someone is using AI to review its public firmware. This vulnerability has existed for about five years, and whether AI was involved in the related attacks has not been confirmed.Shielded Labs researcher Taylor Hornby used Claude Opus 4.8 audit agent to discover a vulnerability in the Zcash Orchard shielded pool circuit that began in 2022, which could generate an unlimited amount of counterfeit ZEC without detection during testing. Developers completed the fix within a few days, and no theft of coins has been confirmed.Blockchain analysis company Chainalysis statistics show that the on-chain write volume carrying malware instructions and command control information has increased from an average of about 2.06 times to 11.1 times daily, a growth of 440%.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

According to EU-Startups, Hackuity, an AI-driven vulnerability operations center based in Lyon, France, announced the completion of a €16 million (approximately $19 million) funding round, led by Forgepoint Capital International, with follow-on investments from Bright Pixel, Bpifrance, and Seventure Partners, bringing the total funding to €32 million.The funds will be used for product innovation, enhancement of AI capabilities, and expansion into European and Asian markets. The Hackuity platform integrates data from over 130 security tools and automates vulnerability prioritization and remediation through a proprietary risk scoring engine. It currently serves over 6,000 users, protecting more than 2 million assets and managing 1 billion security findings, with clients including large enterprises such as ENGIE, BPCE, and Orange Cyberdefense.

According to Slow Fog's disclosure, Core Lightning (CLN) has an experimental feature vulnerability that may put user funds at risk. Core Lightning's official statement indicates that they are investigating the vulnerability and recommend that all nodes with experimental features enabled immediately disable them and wait for a patch. High-risk options include --experimental-dual-fund, --experimental-splicing, and --experimental-peer-storage.Slow Fog stated that similar issues were fixed in August, where remote peers could specify arbitrary or even zero fees in channel opening or fund adjustment protocols. Local nodes would sign and write to the database without additional verification, potentially forcing nodes to incur abnormal fees or even trigger a crash loop, leading to long-term offline status for the nodes.Node operators are advised to immediately disable or remove all experimental parameters; do not completely shut down the nodes, but use offline mode to retain on-chain monitoring capabilities to prevent peers from forcefully closing channels while the node is offline; verify signatures after the official patch is released before upgrading, and be cautious of fake patch links shared by impersonating official accounts.

According to the Slow Mist security team, the BonfireSwap router contract suffered a loss of approximately $50,000 due to a lack of access control in the transfer function. This function did not verify whether the caller was the from address, nor did it check the caller's authorization for the assets of the from address. As a result, attackers could set users who had pre-authorized the router as the from address and themselves as the to address, thereby stealing the victim's TOKEN and exchanging it through the same token pool.Slow Mist stated that a total of 41 TOKEN holders who had authorized the router were affected; the vulnerable contract address is 0x17e801e17cefc6334059189c178d4783830e03d3.

According to Slow Fog monitoring, GitLab CE/EE has a serious path traversal vulnerability CVE-2026-85706, with a CVSS score of 10. An unauthenticated attacker can read any file on the affected GitLab server through the Repository Commits API. GitLab has released a security patch.Affected versions include those from 18.7 up to but not including 19.1.8, from 19.2 up to but not including 19.2.6, and from 19.3 up to but not including 19.3.2. Self-managed GitLab users should upgrade immediately to 19.1.8, 19.2.6, or 19.3.2, and check logs and potentially exposed credentials after patching.

According to Cointelegraph, the cross-chain liquidity protocol Symbiosis announced that it has recovered 15 BTC (approximately $1.1 million) from its Bitcoin bridge vulnerability and deposited it into a multi-signature wallet controlled by the team. The vulnerability occurred last Friday, where the attacker exploited the protocol's flaw to mint 46.1 billion uncollateralized tokens, resulting in a profit of 4.3 WBTC (approximately $336,000).Symbiosis had previously offered a 20% white hat bounty to the attacker for the return of the assets, but the deadline has passed, and the attacker has not responded. The protocol is now offering a 20% bounty to anyone who can provide clues to help recover the assets, while also promising to announce a compensation plan for affected liquidity providers. The affected Bitcoin bridging function remains suspended.

The on-chain security platform Blockaid discovered a vulnerability in the Bitcoin bridge of the cross-chain protocol Symbiosis, where attackers minted approximately 2^62 syBTC to a newly created externally owned account, valued at about 46.1 billion dollars when calculated to 8 decimal places, and sold about 4.39 WBTC on Uniswap V4 on Ethereum, realizing a cash-out of approximately 336,000 dollars.Symbiosis stated that the attack occurred around 4:28 AM on September 11, and the team has suspended the BTC routing, while other routings remain operational and unaffected. The team has recovered about 15 Bitcoins and deposited them into a multi-signature wallet controlled by the team, while offering a 20% white hat bounty on the funds to the attackers, with a deadline of September 13.In recent weeks, Liquid Network, Nomic, and Symbiosis have all experienced security incidents involving the expansion of supply by minting tokens without real asset backing. As of September 13, Symbiosis has not publicly disclosed a technical review of BridgeV2, the final loss amount, or confirmation on whether the attackers accepted the bounty.