hackers

The NFT market Magic Eden appears to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets.Quit, the Vice President of Blockchain at Yuga Labs, stated that this transfer is part of a white hat operation. The related NFTs are currently stored in an address starting with "0x71cF," and the assets are in a secure state. They will be returned in full once the risk is eliminated.

Bitget CEO Gracy Chen stated during a live Q&A on platform security incidents that preliminary investigations found that some related IP addresses matched a VPN service used by a North Korean hacker organization, and the attack patterns were similar to previous actions by North Korean hackers. Therefore, the involvement of this organization in the attack, which involves approximately $351.6 million, cannot be ruled out. The relevant attribution is still in the preliminary investigation stage.Gracy Chen indicated that Bitget currently does not believe this incident was caused by internal personnel. The attackers directly infiltrated the platform's system and transferred funds, without forging user withdrawal requests, and did not obtain the private keys of cold wallets or hot wallets. Investigators are still confirming the specific affected systems and the method of the attackers' intrusion.

According to on-chain analyst PeckShield (@PeckShieldAlert), the same attacker successively exploited vulnerabilities in the SingularityNET bridging contract to illegally mint 260 million AGIX and 53.83 million WMTx on Ethereum.Currently, the attacker holds approximately 16.77 million USD in crypto assets, including 198.3 million AGIX (approximately 14.42 million USD), 649 ETH (approximately 1.67 million USD), and 33.58 million WMTx (approximately 627,000 USD).

MultiversX announced that it has confirmed an attacker attempted to exploit atomicity issues at the virtual machine (VM) level of the mainnet, resulting in invalid state changes on the chain. To prevent further impact, the network has currently suspended operations. The engineering team has prepared a fix and is validating it in a shadow fork environment. If the tests are successful, they will coordinate with validation nodes, exchanges, and infrastructure partners to deploy the fix to the mainnet.Meanwhile, the team is evaluating a targeted recovery plan aimed at preserving the finalized transaction history and legitimate user states while only addressing the invalid changes related to this incident. Users do not need to take any action; they just need to wait for notifications regarding the restoration of normal operations. The official reminder advises users not to submit or rebroadcast transactions, and not to recharge or withdraw EGLD and ESDT through exchanges or cross-chain bridges.

According to The Wall Street Journal, an independent security research team used Anthropic's Claude software to breach a ChatGPT account belonging to an OpenAI employee, allowing them to access and modify the internal code system associated with that employee.The researchers first used Claude to analyze a vulnerability in Discourse, which is used by the OpenAI developer community, and generated executable attack code. They then obtained an authentication token and, due to a permissions configuration issue, accessed a ChatGPT account belonging to an OpenAI employee, while also gaining limited read and modification suggestion permissions for some private GitHub repositories.

The attacker of Liquid Network has returned 3,400 bitcoins after the vulnerability attack on September 6, accounting for about 85% of the transferred assets. They currently still hold 598.5 bitcoins, worth over 45 million dollars. The digital asset infrastructure company Blockstream is responsible for maintaining Liquid Network and has refused to pay a ransom for the remaining assets, demanding the return of the related bitcoins.The network shows that there are 4,234.76 L-BTC in circulation, while the reserve bitcoins are only 3,632.23. The L-BTC to bitcoin exchange function has not yet been restored, and Sideswap indicates that redemption is currently not possible. Blockstream founder Adam Back stated that L-BTC will receive a 1:1 ratio of bitcoin reserve coverage and reminded holders not to sell L-BTC at a discount in the over-the-counter market. As of now, Blockstream has not released an announcement stating that "redemption is online."The attacker's wallet continues to receive on-chain messages and has encountered address poisoning attacks and scam information, with related attacks inducing transfers by generating visually similar addresses.

According to Cointelegraph, a report by Chainalysis shows that in the past 12 months, the number of times attackers stored malware instructions or infrastructure information on public blockchains has surged by 420%, with state-sponsored hackers contributing about two-thirds of the new activity each quarter. Chainalysis linked previously unattributed activities on Tron, Aptos, and BNB Smart Chain to the North Korean-backed organization UNC5342.The report points out that the encoded pointers in Tron and Aptos transactions direct infected devices to the same BSC transaction, which contains encrypted server addresses and configuration data used to connect to remote access and data theft infrastructure. Information on public blockchains remains accessible even after domain names, servers, or code repositories are shut down, enhancing the persistence of malware activities. In 2025, North Korean hackers used similar technology called EtherHiding to implant coin theft code into smart contracts.Additionally, since July 2025, the volume of malicious blockchain writes has increased by 440%, when high-capacity open-source Chinese AI models began to have the ability to generate malicious code. Eric Jardine, head of cybercrime research at Chainalysis, stated that a clear temporal correlation was found, but it could not be proven that the attackers used these models.Chainalysis also identified threat actors suspected of being linked to the Iranian Ministry of Intelligence, writing encoded command and control routing data into the Bitcoin blockchain and sending small payments to well-known addresses historically associated with Satoshi Nakamoto, which are unrelated to the attackers and serve only as a permanent public location for infected devices to receive update instructions.

The hacker group "iamnotavillain" attacked Revolut and demanded 6,000 Monero as ransom, threatening to sell the data of at least 680 customers to the dark web if payment was refused.

According to Blockaid monitoring, Flamingo Finance was attacked. The attacker borrowed approximately 18 million USDT through Morpho flash loans, staking Curve USDP LP into the Strategy during the transaction to inflate the price of VaultYUSDT shares, and then redeemed liquidity aUSDT.Currently, the attacker has realized a profit of approximately 345,900 USDT.

According to CoinDesk, hackers claiming to hold Revolut user data have begun to publicly release related documents, which include passports, selfies, and Bitcoin transaction records.The hackers threatened that if Revolut does not pay the ransom, they will continue to leak data daily. Currently, Revolut has not publicly responded.

The on-chain security platform Blockaid discovered a vulnerability in the Bitcoin bridge of the cross-chain protocol Symbiosis, where attackers minted approximately 2^62 syBTC to a newly created externally owned account, valued at about 46.1 billion dollars when calculated to 8 decimal places, and sold about 4.39 WBTC on Uniswap V4 on Ethereum, realizing a cash-out of approximately 336,000 dollars.Symbiosis stated that the attack occurred around 4:28 AM on September 11, and the team has suspended the BTC routing, while other routings remain operational and unaffected. The team has recovered about 15 Bitcoins and deposited them into a multi-signature wallet controlled by the team, while offering a 20% white hat bounty on the funds to the attackers, with a deadline of September 13.In recent weeks, Liquid Network, Nomic, and Symbiosis have all experienced security incidents involving the expansion of supply by minting tokens without real asset backing. As of September 13, Symbiosis has not publicly disclosed a technical review of BridgeV2, the final loss amount, or confirmation on whether the attackers accepted the bounty.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

Balancer stated that the team has sent on-chain messages to the wallets related to the Balancer V1 vulnerability attack on August 31, proposing a plan to return the stolen funds in exchange for a bounty, and promising not to pursue legal responsibility for the act of returning as long as conditions are met. If the other party does not respond by 5 PM on September 9, Balancer will take technical, on-chain, and legal measures to track the attacker. The incident resulted in a loss of approximately $234,000.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

According to security company Huntress, hackers are spreading theft malware to cryptocurrency users by forging Google Docs files, hosting malicious files on GitHub, and impersonating Claude.ai pages. Attackers disguise themselves as senior employees of CoinDesk on the social platform X, luring victims to open Google Docs documents containing malicious code under the pretext of inviting them to an online meeting, thereby guiding users to install the malicious program themselves.Mac users face the threat of Atomic macOS Stealer (AMOS), which can steal browser passwords, cryptocurrency wallet data, and Telegram files; Windows users are pushed fake Google API Connector updates, which, once installed, implant NetSupport RAT and a counterfeit Ledger hardware wallet application. Additionally, hackers are placing false advertisements on search engines like Bing, enticing users to visit counterfeit Claude.ai pages and execute malicious commands. The related malware MacSync and SectopRAT can steal cookies, saved passwords, recovery phrases, and payment card information.Security company Socket also discovered 16 malicious extensions targeting Chrome and Edge, capable of emptying EVM, Solana, and Tron wallet assets.

According to Arkham blockchain data, wallets associated with the North Korean state-sponsored hacking organization Lazarus Group have sold over $30 million in Bitcoin on the decentralized perpetual contract trading platform Hyperliquid in the past three weeks, using the proceeds to purchase Ethereum and Solana, which were then transferred to centralized exchanges such as Kraken, LBank, and KuCoin. Kraken responded that it maintains an industry-leading compliance program, continuously monitoring on-chain activities to identify and block assets related to sanctioned wallets; LBank and KuCoin stated that the associated risks are a continuing challenge faced by the industry as a whole and emphasized that publicly available on-chain data may not reflect compliance measures at the platform level.At this time, the Trump administration is exploring ways to incorporate Hyperliquid into the regulated U.S. financial system. Trump stated earlier this month at a White House event that the chairman of the Commodity Futures Trading Commission, Mike Selig, is developing a path to bring Hyperliquid into the U.S. in a fully compliant and legal manner. According to Bloomberg, Kraken's parent company Payward is in deep negotiations with Hyperliquid Labs to offer perpetual contracts to U.S. traders.Hyperliquid is the leading platform in the decentralized perpetual contract space, allowing users to trade directly from their crypto wallets without the need for traditional brokerage accounts or KYC checks. According to DefiLlama data, its cumulative perpetual contract trading volume has exceeded $5 trillion, with current open contracts of approximately $13.3 billion.

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

According to ZEIT, the Berlin city government suffered a cyber attack two weeks ago, and the hacker group is suspected of implementing ransomware using the stolen data. According to Der Spiegel, the attackers are believed to be the long-active Rhysida hacker group, demanding a payment of 30 bitcoins (approximately 2 million euros) and threatening to release the data.The sensitive information involved may include records of violations and passwords. The Berlin state government has not yet confirmed the extent of the data breach and has not responded to the ransom amount or the identity of the attackers, stating that it will not comment "for reasons of investigative strategy." Berlin's mayor, Kai Wegner, has made it clear that Berlin will not yield to extortion. The main departments affected are transportation and construction management, which were temporarily isolated from the state government's network after the incident.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.