attacker

Bitget CEO stated that the attacker's address has been publicly listed and is under continuous tracking. Bitget calls on THORChain to refuse service to these addresses. Decentralization is a design principle and should not serve as a shield to facilitate known stolen funds.

According to on-chain detective Specter, by tracking on-chain fund flows, the North Korean hacker organization Lazarus Group may be the behind-the-scenes attacker of the Bitget theft incident. This incident is linked to the AFX attack that occurred in July this year, which resulted in losses of approximately 24 million dollars and was attributed to TraderTraitor associated with Lazarus Group.The stolen XRP from Bitget, after cross-chain transfer, can be directly linked to the stolen funds in the AFX attack.

The Cosmos ecosystem protocol Neutron faced a governance proposal that was manipulated by an attacker. The related address spent approximately 20,199 USDC to buy NTRN and staked 31.6 million NTRN about 12 minutes before the voting ended, ultimately allowing the proposal to pass with an 82% approval rate. Subsequently, the management rights of 11 contracts were transferred to the attacker, and they migrated to malicious code, stealing approximately 4.4 million dollars in assets.To recover the funds, Cosmos Hub validators coordinated a chain halt for nearly 24 hours and 48 minutes, and during the restart process, approximately 1.23 million ATOM were transferred from the attacker's wallet to a new address, with plans to return them to the original holders.

According to Bitcoin.com, Canadian Bitcoin exchange and wallet company Bull Bitcoin stated that due to the Liquid Network attack on September 6, users are currently unable to exchange L-BTC back to Bitcoin through the platform, and the redemption operation is still pending recovery. Bull Bitcoin expects that the related exchange services may resume within 30 days, but stated that this expectation is not a guarantee.Due to reliance on the L-BTC redemption mechanism to balance inventory, the platform has temporarily closed inbound Lightning Network payments. In this attack, the attacker transferred nearly 4,000 Bitcoins out of the protocol, later returning about 3,400; they currently still hold 598.5 Bitcoins, worth over 51 million dollars. Liquid Network stated on September 17 that block production, network transactions, and L-BTC transfers have returned to normal.

According to on-chain detective Specter monitoring, the attackers of this activity provided so-called arbitrage bot tutorials and code through YouTube videos, guiding victims to compile and deploy contracts using a counterfeit Remix development interface.The attackers registered an ENS name containing "Uniswap," disguising the related address as a legitimate source of income for DeFi activities, leading victims to mistakenly believe that the deployed arbitrage bot was profiting through Uniswap. After victims injected their own assets into the contract, the funds were transferred away by the attackers. The attackers currently seem to still be active and hold a significant portion of the stolen funds across two addresses.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

Ethereum developers warn: Attackers can exploit free testnet ETH and one-time builder identities to win Sepolia block auctions and withhold transaction payloads during the Glamsterdam testing period.This attack does not threaten mainnet funds but may disrupt infrastructure testing. The Sepolia public test is scheduled to launch on October 6, with the Hoodi test tentatively set for October 27, and the mainnet activation time is still undetermined.

According to Blockaid monitoring, Flamingo Finance was attacked. The attacker borrowed approximately 18 million USDT through Morpho flash loans, staking Curve USDP LP into the Strategy during the transaction to inflate the price of VaultYUSDT shares, and then redeemed liquidity aUSDT.Currently, the attacker has realized a profit of approximately 345,900 USDT.

The managed cross-chain bridge Long released a post-mortem report on the WETH hacking incident on September 14. On that day at 07:07 UTC, the bridge paid 46.7928 WETH (approximately $118,000) to the attacker's address from the Robinhood Chain treasury. There were no user fund losses, and the treasury has been fully replenished from platform revenue. The bridge has been rebuilt, reinforced, and continues to operate. During the recovery period, some orders were delayed by several hours.The bridge's keeper read the burn events on Arc via RPC to release assets. At that time, the official mainnet endpoint was not online, relying on public RPC. After the backup endpoint was overloaded, the main endpoint provided the keeper with forged withdrawal event logs within a short window, which did not exist on Arc. The keeper's protection at that time was against replay and double spending, and did not question the data source, thus releasing the WETH. Meanwhile, three other forged withdrawals were completely reverted on-chain. The forged events entered through the RPC channel, and the contract, keys, and treasury were not breached.

According to the official statement from Osmosis, the proposal for the solution regarding the previous Nomic chain nBTC incident is now online and has officially entered community discussion.According to the proposal, the Osmosis governance community will consider confiscating the previously frozen assets of the attacker and using the accumulated BTC in the community fund pool to cover the remaining collateral gap, in order to restore the full collateral support for Alloyed BTC. Currently, this plan still needs to go through governance discussion and voting, and the asset confiscation or collateral replenishment has not yet been completed.

The official announcement from the Ton Network DePIN project PinGo states that the project has once again encountered a cyber attack, and the attackers have sold some of the involved tokens. Currently, the PinGo team has completed the consolidation of on-chain assets and is actively addressing this security incident.It is reported that Gate has temporarily suspended the recharge of PinGo tokens. The PinGo team stated that they will continue to disclose subsequent information based on the progress of the incident. As a result of the incident, the price of PINGO briefly surged by 70%, with the current quote at 0.03 USD.

Self-proclaimed "white hat hackers" extracted about 4,000 BTC from Liquid Network and have returned 3,400 BTC (approximately $269.2 million) to the federal wallet of the sidechain on Monday, recovering about 85% of the funds. The incident began on Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The attackers claimed to be "white hat hackers" through Bitcoin transaction messages and demanded that the vulnerability be fixed first. Blockstream then sent a signed message stating that "the bridging node has been patched and funds can be safely returned," after which the attackers transferred the funds. Nevertheless, about 598.5 BTC (approximately $47 million) remains in the related address. Ledger's Chief Technology Officer Charles Guillemet expressed skepticism about the "white hat" claim, stating that if this were a negotiated reward under on-chain crypto contracts, it looked more like extortion. Liquid has disabled the bridging nodes and requested exchanges to suspend L-BTC deposits and withdrawals, but has not yet announced a plan for handling the remaining funds or when normal operations will resume.

According to a report by Decrypt, Galaxy Research stated that the third wave of attackers on the Coldcard hardware wallet has recently transferred 97.09 BTC, worth approximately 7.7 million dollars at current prices, accounting for about 45% of the stolen Bitcoin in this wave.Among them, the attackers transferred about 20.5 BTC to Ethereum via THORChain cross-chain on September 2; subsequently, they moved some funds into the CoinJoin mixing process to increase the difficulty of tracking the funds. Currently, 11 of the 293 2-of-2 multi-signature addresses established by the attackers in the third wave have been emptied.The report indicated that this Coldcard security incident originated from a firmware vulnerability introduced in 2021, which significantly reduced the randomness of wallet mnemonic phrase generation, allowing attackers to potentially reconstruct private keys offline and steal funds. As of now, approximately 82% of the stolen BTC in the entire Coldcard attack incident has not yet been transferred.Galaxy Research believes that if the newly discovered suspected victim addresses are included in the statistics, the total amount of stolen BTC may reach about 1,806, worth approximately 144 million dollars.

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to on-chain detective Specter monitoring, Balancer is suspected to have encountered a V1 attack, with an attacker continuously transferring funds, currently profiting $250,000. The related address is 0x112...E0aE.

According to market news, the Tectonic attacker marked address has deposited 2,658.9 ETH (approximately 6.65 million USD) into TornadoCash.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

The security company Defimon issued an alert stating that a governance takeover attack against YAM Finance has been detected. After self-delegating approximately 504,000 YAM (about 3.3% of the total supply, slightly above the legal voting threshold), the attacker submitted YamGovernorAlpha proposal #45, which is described as empty ("0x"), with the sole action being to call the setPendingAdmin method of the YAM Timelock contract, pointing to the attacker's address.It has been disclosed that if the proposal is voted through and executed, the attacker will become the pendingAdmin, and then can fully control the Timelock through acceptAdmin, which includes management rights over all YAM protocol contracts and the DAO treasury, involving a risk amount of approximately $337,000. As the protocol is currently in a dormant state, Defimon Alerts reminds users holding YAM to vote against the proposal before block height 25897343 (about 34 hours remaining).

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.