theft

Regarding the issue of abnormal asset transfers from user accounts, the MEXC customer service team responded on September 28, stating that they have completed a preliminary investigation and provided corresponding solutions. They will follow up with users via email for one-on-one communication, updating them on progress and required information, and reminding users to pay attention to their registered email and official channel communications.Previously, a MEXC user posted on X that their account was controlled after someone reset the security items. Between 04:12 and 04:25 on September 27 (Beijing time), 322,110 USDT and 9,133,999 ONE were transferred out, totaling approximately $340,000, just 27 minutes after the 24-hour transfer restriction was lifted. The user stated that MEXC has confirmed the account was hacked and has frozen the account to assist in recovery, but has not revoked the API left by the attacker. They have submitted a formal claim, with the ticket number M2026092712031.

According to monitoring by the head of Galaxy Research, the COLDCARD Seed Entropy theft incident has resulted in 1,830 BTC being stolen, involving three rounds of attacks and over 30 smaller related signs.A total of 256 victims have reported their situations to GLXY Research, with a median loss of 1.1 BTC, and the tracking of the attackers is still ongoing.

Yuga Labs' Vice President of Blockchain, Quit, posted on the X platform stating that the claims portal for the NFT theft incident currently under construction is expected to go live in the next few hours, and a dedicated address nftsaresafu.eth has been created to accept ETH and other token donations.Quit mentioned that in addition to spending a significant amount of time, he paid approximately $7,500 in gas fees last night to handle related matters and thanked the community for their support through channels like X Money.Previously, it was reported that the NFT marketplace Magic Eden appeared to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets, valued at approximately $1.5 million.

According to Cointelegraph, blockchain security company SlowMist stated that its investigation has not linked the recent security warning caused by the iPhone Safari attack to confirmed cryptocurrency theft incidents.SlowMist told Cointelegraph that it has not independently confirmed any victims affected by the specific Safari attack samples it analyzed, and the strongest technical evidence it possesses covers iOS versions 18.4 to 18.6.2. The company stated that the reported impact range of "iOS 13 to 26.5" should be regarded as a preliminary assessment, and it tends to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is obtained.SlowMist pointed out that the Safari attack reused the previously disclosed DarkSword exploit chain technology, which is independent of another investigation involving malicious components embedded in App Store applications called FomoPeek. The Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since November 2025.

ViaBTC founder and CEO Yang Haibo stated: CoinEx is shutting down, but its hot wallet system is still relatively advanced and worth referencing in the industry. He introduced that CoinEx has implemented an MPC-based dual-signature scheme for its hot wallet to eliminate single points of failure.Yang Haibo mentioned that the relevant infrastructure is split into business systems and wallet systems, operated by completely independent teams, each holding one private key. Every withdrawal or transfer must be reviewed in real-time through substantial risk control by both parties, and even if one system is compromised, assets cannot be stolen.He added that the wallet signing process needs to be independently implemented and cannot rely on the native mechanisms of each node, which requires extensive reconstruction. The team spent over a year transforming the vast majority of nearly 300 chains supported by CoinEx one by one.

Malicious iOS application FomoPeek has been found to contain multiple kernel exploit modules that can bypass Apple's sandbox and access sensitive wallet data from other applications, and is linked to a theft incident involving nearly $580,000 in cryptocurrency assets. Blockchain security company SlowMist stated that the application is distributed through the Apple App Store. The company noted that the affected versions were released on September 9 and September 12, and the application contains two malicious modules that can gain higher privileges and access Keychain data and files from other applications.Version 1.3, released on September 17, has removed the related malicious components. SlowMist and the OKX security team investigated and found that the related attack framework includes 8 types of attack methods, supporting iOS versions 12 to 18.7.2 and 26 to 26.1. On-chain analysis shows that a hacker address related to the incident received approximately 580,000 USDT, and the funds were subsequently transferred through multiple addresses and services, with some flowing to FixedFloat, KuCoin, and cce.cash.

Cosmos ecosystem DEX Astroport stated that the attack event that occurred on Neutron may have led to the theft of administrator privileges for the Astroport contract. Neutron has suspended chain operations for investigation.Astroport advises users to withdraw liquidity from all Astroport liquidity pools.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.

According to Decrypt, court documents unsealed in the lawsuit between The New York Times and OpenAI and Microsoft show that Microsoft employees discussed whether OpenAI's use of news articles to train its models constituted "the largest labor theft in human history," and could potentially trigger a "doom loop" that leads to a decline in model quality. A 2023 internal Microsoft memo warned that millions of people worldwide would soon view the large model's "consumption" of their works as "an unprecedented and astonishing theft," and stated that large AI models are "products that destroy their own supply chains."Microsoft stated in the documents that these memos were written by Director of Applied Science Brent Hecht and do not represent the company's views, as his role is to provide "different and asymmetric perspectives." Microsoft CEO Satya Nadella testified that "any content behind a paywall should be authorized by those who wish to use it," and stated that if he had known in advance that OpenAI was using paid content for training, he would have exercised Microsoft's rights to demand that the model be retrained.Additionally, an OpenAI employee had mentioned to President Greg Brockman the construction of "hacker methods" to bypass The New York Times paywall, to which Brockman replied, "Nice." Both OpenAI and Microsoft argue that the relevant training falls under fair use. The case was initiated by The New York Times at the end of 2023, and 11 publishers have since joined the lawsuit.

On-chain analyst SomaXBT posted on platform X, stating that suspected Lootbot users have encountered a collective wallet theft incident, with the current loss amount exceeding 600,000 USD (approximately 245 ETH).Initial information indicates that about 50% of the victims are Lootbot subscription users. It is worth mentioning that Lootbot is one of the projects founded by dexter, the founder of the previously soft Rug project gm.ai, originally a trading bot platform in the Telegram ecosystem.

According to CoinDesk, a 22-year-old man from Singapore will plead guilty in one of the largest cryptocurrency thefts in the United States.The scammer posed as customer service representatives from Google and Gemini, tricking an investor into handing over Bitcoin worth $240 million.

According to Apnews, a young cryptocurrency scam gang stole over 4,100 BTC in August 2024 through "social engineering" attacks, which was worth over $240 million at the time.After the theft, gang members quickly began extravagant spending, including purchasing sports cars, renting luxury homes, flying on private jets, and hiring security personnel. Among them, the alleged mastermind, a 22-year-old Singaporean named Malone Lam, reportedly spent over $569,000 in one night at a nightclub in Los Angeles.Investigations revealed that the suspects impersonated employees from Google and the cryptocurrency trading platform Gemini to trick victims into giving up their Google Drive access and security codes, allowing them to transfer the victims' bitcoins. They then moved the funds through multiple trading platforms and money laundering intermediaries. Their lavish lifestyle eventually drew the attention of law enforcement.One suspect was exposed when their IP address was revealed while hiding nearly $30 million in stolen cryptocurrency assets, leading police to trace it back to the luxury home they rented in California. Another suspect was found with $37 million worth of stolen cryptocurrency assets. Lam was accused of using the stolen funds to purchase a $2 million watch and over 30 vehicles including Porsches, Lamborghinis, and Ferraris.Currently, 18 defendants have been charged, and Lam is expected to attend a plea agreement hearing this Tuesday. The U.S. Department of Justice has already issued rulings against several accomplices, and related cases are still ongoing.

The Ukrainian police and the Security Service of Ukraine (SBU) recently dismantled a scam network that used a fake investment platform to steal cryptocurrency. This network disguised itself as an investment platform website, luring users to connect their main cryptocurrency wallets and approve a small test transaction when withdrawing funds. Subsequently, it used a "wallet stealer" hidden within the website to automatically transfer user funds to wallets controlled by the operators, kicking victims off the platform. Investigators have currently confirmed 62 victims, with over 46 Ukrainian citizens involved, and the network could steal up to $1 million per month.The police stated that the false profits displayed on the platform are part of the scam, with operators manually creating transactions and adjusting user account balances to create the illusion of investment growth. In addition to cryptocurrency, the platform also collected victims' passport information, phone numbers, email addresses, login credentials, and photos during the registration and identity verification process. The main organizer of the network is a 25-year-old IT expert who recruited over 46 Ukrainian citizens and operated multiple offices in Kyiv and surrounding areas, with members responsible for building and maintaining fake websites, contacting potential victims, and providing security.Victims come from multiple countries, including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel. The police traced the gang's server equipment located in the Netherlands and obtained a database stored there, which included a list of victims, cryptocurrency wallet addresses, suspected stolen amounts, internal communications, and platform operation information. The Ukrainian police and SBU subsequently executed 34 searches in Kyiv and surrounding areas, seizing over 100 computers, more than 100 mobile phones, 79 SIM cards, documents, cash, and 15 vehicles.

According to a report by Malwarebytes, scammers are using the hype around "GTA 6" to set up phishing websites, claiming to sell leaked versions of the game for $50 or 1 SOL, luring visitors to connect their wallets and sign malicious transactions. The website contains approximately 2.4 MB of malicious scripts that can identify wallet assets on seven chains: Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base, and Fantom, and immediately transfer assets or gain permissions for subsequent transfers of tokens and NFTs based on the permissions signed by the victims.Before triggering, the script checks the visitor's IP to evade ten countries, including Armenia and Russia. Malwarebytes advises users to be cautious of any websites claiming to sell leaked versions of GTA 6, to carefully verify the authorization content before signing transactions, and to refuse operations that transfer the entire balance or request token access permissions.

According to monitoring by Catcher Predict, in the event "GTA VI First Week View Count" on the prediction market Polymarket, the "Yes" option in the sub-market "20-22M" experienced a sharp fluctuation in winning probability, soaring from 56.5% an hour ago to the current 81% (a fluctuation of 24.5%). Please note the impact of relevant breaking news.

According to SlowMist's monitoring, the GebProxyActions contract suffered a loss of approximately 5.9436 ETH due to a lack of caller access control. Affected users previously called GebProxyActions.quitSystem directly instead of through a DSProxy delegated call, resulting in ownsSAFE[safe] being set to the GebProxyActions contract.The attacker directly called GebProxyActions.quitSystem(manager, safe, dst), bypassing the safeAllowed check of GebSafeManager and transferring the collateral to themselves.

According to The Defiant, the Fogo mainnet has stopped producing blocks for about 46 hours since Saturday afternoon due to an attack on the Fogo Foundation, resulting in 4 million FOGO tokens (approximately 10.3% of the circulating supply) being transferred to the attacker's address. The foundation initially stated that the chain itself was unaffected, but 15 hours later, the network was actively paused, and plans were made to restrict the related addresses through an upgrade. Currently, the Fogo official explorer shows the last block as 718,525,971, and the RPC endpoint returns a 502 error, while the on-chain TVL tracked by DefiLlama has been frozen at $987,000 for three consecutive days.This downtime is attributed to Fogo's validator design: the chain is managed by a council of 7 voting validators, with the foundation staking evenly among 7 operators, allowing for coordination to pause and implement a client-level address blacklist within minutes. On the exchange side, both KuCoin and Gate have disabled FOGO deposits and withdrawals but retained trading, with a 24-hour spot trading volume of approximately $2.3 million. Meanwhile, a Twitter account impersonating the Fogo Foundation, @FcgoFNDN, posted a false compensation voting link, and Fogo officials reminded users to rely only on information from official channels.Fogo is the second network to actively pause over the weekend, following Cronos, which rolled back its state due to an attack on the Tectonic lending protocol. Fogo raised approximately $7 million by selling 2% of its supply through Binance before launching its mainnet in January, with a valuation of $350 million. The foundation has not yet disclosed details of the attack, compensation plans, or a restart timeline.

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.

On-chain detective Specter posted on the X platform, stating that considering the time period covered by the stolen data, this could mean that the data breach occurred as early as April, and no later than early May. However, the parties involved chose to remain silent until recently, roughly at the same time Trezor announced its own data breach.Some users had already received phishing attacks and suffered asset losses at that time, but the parties involved did not maintain transparency, warn users, or provide risk alerts, instead denying the data breach.