vulnerabilities

Slow Fog's Yuxian posted on platform X, stating that systems prior to iOS version 27 are being exploited by certain black and gray market groups to steal encrypted wallets from iPhone users.It reminds users to promptly update their iPhone, iPad, Mac, and other devices to the latest version, to be cautious when installing apps from unknown sources, and to be careful when opening unknown links through Safari and in-app browsers.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

The Google Product Security Team has disclosed an internal AI agent called PageBreak, used to test the security of its first-party web applications. This agent is built on Google's Gemini model and began a pilot program in November 2025, transitioning to a formal project in January 2026, with the goal of autonomously scaling vulnerability discovery and reducing manual input.Unlike common AI scanning tools, PageBreak hands over hypotheses to specialized validators after discovering suspicious defects, attempting actual exploitation in a real-time running copy of the application, and only reports once confirmed exploitable, with a false positive rate close to zero. Google claims that PageBreak has identified over 500 XSS vulnerabilities in its first-party web applications, which can be used to hijack login sessions, steal data, or impersonate users.Google stated that the security team has been overwhelmed in recent years by a large number of AI-generated vulnerability reports that appear reasonable but are not valid, making it a major challenge to distinguish real defects from hallucinations. When testing applications built using the next-generation high-assurance framework, PageBreak found only two vulnerabilities. The next step for Google is to integrate PageBreak with the automated remediation agent CodeMender, providing confirmed vulnerabilities with accompanying fixes.

Binance Wallet Security Announcement: iPhone users please check if you have installed the FomoPeek application. Binance has noted a recent security incident disclosed by the community. According to security companies such as SlowMist, the third-party application FomoPeek (versions 1.1-1.2) contains malicious code that can exploit vulnerabilities in the iOS system to gain maximum permissions on the device and may access sensitive data stored on the device, including private keys, mnemonic phrases, login credentials, chat records, files, etc. Please note that such malware directly attacks the device itself. If the attack is successful, all application data on the affected device may be accessed.Please check the following:Are you using an iPhone or iPad running iOS 26.x or earlier?Have you installed the FomoPeek application?If both of the above apply to you, it is recommended to take the following steps immediately:Delete the FomoPeek application and do not reinstall it.Update the iOS system to the latest version.For users with self-hosted wallets: Create a new wallet on a device that has never installed the application and transfer assets to the new wallet address.If you notice any unusual asset activity, please retain the affected device and relevant evidence, and contact customer service for further investigation.At the same time, all users are reminded: Do not install applications from untrusted sources and keep your device software up to date.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

Bitcoin News posted on the X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the security landscape of Bitcoin. Large language models have significantly reduced the cost of discovering vulnerabilities, allowing attackers to potentially find catastrophic vulnerabilities for just a few hundred dollars in computing costs.For Bitcoin Core, Project Loupe, the Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or severe vulnerabilities have been found. Gögge stated that relying on stronger models to discover vulnerabilities before attackers is not a sustainable security strategy. Developers should build testing infrastructure that can proactively prevent entire classes of vulnerabilities through automated testing, fuzz testing, and property-based testing. Key components of Bitcoin Core have accumulated over 100 years of CPU fuzz testing and have undergone decades of Bitcoin node network simulation.

According to Cointelegraph, the European Union's Cyber Resilience Act (CRA) officially came into effect on September 11, requiring cryptocurrency hardware and software wallet providers to submit early warning reports within 24 hours upon discovering actively exploited vulnerabilities or serious security flaws, and to submit complete notifications within 72 hours. Manufacturers must also submit final reports within 14 days after taking corrective or mitigating measures, while serious incidents must be reported within one month.The European Commission stated that the new reporting requirements aim to better protect consumers and businesses from cyber threats, applicable to all "products with digital elements" sold in the EU market, and are built upon the EU's broader cybersecurity strategy. According to the penalty provisions of the final draft, companies that fail to comply with Articles 13 and 14 may face administrative fines of up to €15 million (approximately $17.3 million) or 2.5% of their global annual turnover, whichever is higher; providing incorrect, incomplete, or misleading information may also incur fines of up to €5 million.Before the implementation of this measure, several hardware wallet manufacturers recently disclosed incidents of user data breaches. On September 4, Trezor revealed that a data breach involving its logistics provider ShipMonk affected approximately 67,000 U.S. customers, exceeding the initial estimate of 14,000; this week, Trezor and BitBox also warned users to be cautious of phishing emails disguised as urgent security notifications. In June, the Layer-1 blockchain network Zilliqa warned of vulnerabilities in its Ledger application, where attackers could exploit publicly available on-chain data to recover user private keys.

According to a report by Decrypt, a new report released by the Bank for International Settlements shows that advanced AI technology has shortened the time window for banks to fix vulnerabilities before attackers exploit software flaws. It warns that periodic security assessments and scheduled patch updates have increasingly become insufficient to meet the challenges, with the time window from vulnerability discovery to exploitation reduced from weeks to minutes.The report focuses on the banks' response capabilities, arguing that financial institutions must accelerate the speed of software fixes and expedite the related authorization decision-making processes.

Bitcoin News posted on the X platform that Alby confirmed a critical vulnerability exists in Alby Hub v1.7.0 to v1.18.5. If the management API is exposed to the public network, attackers may gain unauthorized access and transfer funds. Currently, it is known that 1 user has been affected, and Alby Hub v1.19.0 and higher versions are not affected.Alby recommends that affected users restrict public access to the management interface, immediately update to v1.24.0, and change the unlock password after the update. Multiple issues reported by Bitcoin Team Red, Project Loupe, and other researchers have also been fixed in the latest version.

Hardware wallet manufacturers Ledger and Trezor are calling on security researchers to adopt a more responsible approach to vulnerability disclosure. Ledger's Chief Technology Officer Charles Guillemet stated on the X platform that artificial intelligence has made vulnerabilities easier to discover and exploit, but some researchers disclose details before a fix is released, which he termed "exploiting others' risks for attention."Guillemet urged researchers to report vulnerabilities privately first and to agree on a timeline for fixes before disclosing details publicly, suggesting 90 days as a common default period, while also indicating that this could be adjusted flexibly based on the severity of the vulnerability and the amount of work required for the fix. Trezor's Security Chief Jan Komárek told Cointelegraph that 90 days is a commitment to vendors, not just an obligation for researchers. He suggested that researchers first contact vendors to agree on a timeline, and if the vendor fails to complete the fix within that period, they may choose to disclose publicly.The context of this statement is the recent close attention to hardware wallet security: the Coldcard theft incident involved over $100 million, and a data breach at Trezor's logistics provider also affected the personal information of tens of thousands of customers.

SideSwap issued a statement saying that at 14:05 UTC today, a customer sent 4000 L-BTC to its peg-out service. The service processed the order as usual, L-BTC was destroyed on Liquid with a valid peg-out authorization, and at 14:28 UTC, Liquid Federation paid 3996 BTC to the customer's Bitcoin address.Blockstream subsequently confirmed that the L-BTC was minted due to a vulnerability in the Elements software. SideSwap's peg-out authorization keys and systems were not compromised, and the service cannot distinguish these tokens from other L-BTC. SideSwap is a non-custodial service, and user wallets are unaffected, with assets controlled by the users' own keys.Liquid has been suspended by the Federation, and SideSwap's exchanges, peg-ins, and peg-outs will be paused until the network is restored. Peg-outs that have been completed on Bitcoin are unaffected. Unfinished peg-ins or peg-outs can send transaction IDs to hello@sideswap.io for separate processing. Please do not send new peg-in or peg-out deposits until the service is restored.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

OpenAI stated that its upcoming Astra model can autonomously discover previously unknown software vulnerabilities and convert them into usable attack vectors without human intervention, making it the company's first model to reach the "Critical" cybersecurity capability level threshold. In a blog post released on Tuesday, OpenAI mentioned that according to its Preparedness Framework, reaching this level means the model can discover zero-day vulnerabilities and develop usable exploit code in hardened real systems without human involvement, or design and execute attacks based solely on a high-level objective.In testing, Astra achieved a 100% score in benchmark tests for developing exploit code based on known vulnerabilities and discovered two previously unknown vulnerabilities in another internal test. Additionally, the model successfully broke through a hardened browser sandbox and executed commands on the host machine, while gaining root access by exploiting multiple weaknesses in the operating system. OpenAI stated that it has delayed some of Astra's development progress to enhance security measures and plans to make its advanced cybersecurity capabilities available only to selected testers.This capability is particularly relevant to the cryptocurrency industry, as software vulnerabilities can be converted into financial losses within minutes. CoinDesk reported in June that increasingly powerful AI models can compress the process of searching code, discovering misconfigurations, and assembling attacks from days or weeks to machine speed. Security researchers noted at the time that the significant change was not the emergence of new categories of attacks, but rather the dramatically increased speed at which existing vulnerabilities are discovered and exploited.

Balancer announced that a vulnerability was found in the old Balancer v1 contract, which could lead to LP funds being drained.The related liquidity pools have been deprecated and cannot be paused, and users are advised to withdraw their liquidity as soon as possible. Other Balancer products are not affected.

Polygon Labs disclosed that it has fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks, with the related fixes privately deployed before public disclosure. According to a forum post released on Wednesday, the team packaged the fixes into the Austin hard fork of the Bor client and the Kyoto hard fork of the Heimdall client, both of which followed the standard process for fixing issues that affect consensus: first validated on the Amoy testnet, and then publicly disclosed once the mainnet was activated and the network was secure.The Austin fork fixed two denial-of-service paths in block processing, including a vulnerability where malicious block producers could crash peer nodes by filling them with oversized field data. The Kyoto fork addressed a broader range of consensus hardening issues, with the most severe vulnerability allowing an attacker to force the entire validator set to perform costly and coordinated work with just one crafted transaction—the cost of constructing the transaction is low, but the network processing cost is high. Polygon emphasized that none of the vulnerabilities were observed to be exploited on the mainnet and have been proactively addressed. The two upgrades are now mandatory for node operators and have taken effect without the need for state migration or resynchronization.This disclosure comes at a critical transformation period for Polygon, which has completed the migration of the traditional MATIC token to POL as part of a comprehensive overhaul of its network architecture. The news did not boost the price of POL; according to CoinGecko data, POL traded at approximately $0.09983 on Sunday, down 2.3% in 24 hours, down about 6.8% over the past week, and down about 60.8% over the past year, with a market capitalization of approximately $1.07 billion.

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.

The cryptocurrency payment platform Rain stated that its monitoring system detected a vulnerability affecting a small number of programs using outdated versions of Solana contracts, while other programs were not affected. Rain immediately launched an investigation to determine the scope of the incident.The Rain team has successfully upgraded all programs using outdated versions of Solana contracts, and the related issues have been resolved. Rain will continue to monitor the situation and has hired a third-party forensic expert to conduct an investigation, while also cooperating with law enforcement and relevant regulatory agencies. All affected users will receive full compensation, and Rain has begun the remediation process and is committed to completing the handling swiftly and responsibly.

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to CoinDesk, the developers of the Bitcoin Lightning Network payment software Core Lightning (CLN) issued an urgent warning to node operators after the team received a large number of AI-generated security reports, revealing several real vulnerabilities. The development team advised operators not to directly shut down the machine power but to restart the software in "--offline" mode, which stops communication with other Lightning Network nodes while still keeping it operational to continuously monitor the Bitcoin blockchain and protect the funds in the payment channels.The Core Lightning team began receiving a large number of AI-generated vulnerability reports since early August, some of which have been confirmed to be valid. Developers will keep the details confidential for two weeks to complete the patch development and plan to release a signed patch version for operators to verify the source. The source code and vulnerability details will be made public after the confidentiality period ends.This is the second AI-related security incident in the Lightning Network this month. Earlier in early August, BTCPay Server experienced a vulnerability that led to the leakage of credentials for some Lightning Network nodes and theft of funds. Additionally, the "Bitcoin Red Team," composed of 16 developers, used AI models to scan 390 Bitcoin code repositories at the end of July, discovering nearly 5,000 issues, 85 of which were rated as critical.

The Ethereum client Besu has fixed five security vulnerabilities discovered by the blockchain security company CertiK in version 26.7.1 released on July 27, and published four detailed security announcements on August 14. The details of the vulnerabilities were disclosed later to allow node operators to complete the upgrade deployment.Jialiang Chang, CertiK's Director of Security Engineering and Senior Audit Partner, stated that the arrangement of releasing patches first and details later provides an 18-day buffer period, allowing node operators to identify affected deployments, test the new version, and coordinate with validators or consortium participants to complete the upgrade. The relevant vulnerabilities involve block broadcasting processing, future height consensus proposal caching, WebSocket subscription limits, and JSON-RPC filter creation. If not fixed, attackers could exhaust node memory or thread resources, affecting node availability and consensus processing.CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network using the Chain Scan method, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand around-the-clock multi-node testing for public chain networks.