wallets

Slow Fog's Yuxian posted on platform X, stating that systems prior to iOS version 27 are being exploited by certain black and gray market groups to steal encrypted wallets from iPhone users.It reminds users to promptly update their iPhone, iPad, Mac, and other devices to the latest version, to be cautious when installing apps from unknown sources, and to be careful when opening unknown links through Safari and in-app browsers.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

The NFT market Magic Eden appears to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets.Quit, the Vice President of Blockchain at Yuga Labs, stated that this transfer is part of a white hat operation. The related NFTs are currently stored in an address starting with "0x71cF," and the assets are in a secure state. They will be returned in full once the risk is eliminated.

The Central Bank of Brazil issued resolutions No. 588 and No. 589, requiring virtual asset service providers (VASP) to report self-custody wallet transactions that amount to or exceed $10,000, and to strengthen anti-money laundering and counter-terrorism financing regulations.Resolution No. 588 stipulates that relevant transaction data will be submitted to the Financial Activities Control Council (COAF). This agency may compile transactions based on this data and establish a self-custody address database to record the asset status of Brazilian users holding cryptocurrencies through authorized centralized exchanges. Resolution No. 589 prohibits conducting business with virtual asset service institutions or entities operating in Brazil without authorization. The new regulations will take effect on October 1, 2026, and currently, only 5 VASPs have applied for licenses to operate in Brazil.

The cryptocurrency trading platform Bitget announced on its official X account that on September 24, 2026, at 18:31 (UTC), its security system detected unauthorized transfers from a small number of hot wallets. The security team has immediately initiated an emergency response procedure and started a comprehensive investigation.Bitget stated that, based on current assessments, approximately $351.6 million in assets are affected. Cold wallets and the vast majority of assets on the platform remain secure and unaffected, and user funds are still protected. The incident falls within the coverage of the user protection fund, which currently holds over $464 million.Bitget mentioned that customer account balances remain accurate, and deposits and transactions continue to operate normally. As a precautionary measure, withdrawals have been temporarily suspended to allow the team to complete a thorough security review. The company has identified and flagged the relevant transfer addresses, formally contacted law enforcement agencies and on-chain security partners, and will restore withdrawals as soon as safety is confirmed, providing subsequent updates through official channels while refraining from speculating on the attack path during the investigation.

According to Lookonchain monitoring, two newly created wallets (possibly belonging to the same whale) withdrew 950 BTC from Binance, worth approximately 72.6 million USD.

Onchain Lens reported that two associated wallets, possibly controlled by the same entity, have staked a total of 212,590 HYPE, worth approximately 20.49 million USD.One wallet staked 106,410 HYPE (about 10.25 million USD), while the other wallet staked 106,180 HYPE (about 10.24 million USD). The relevant addresses are 0x8bddfed1ec21bde1ee812a2a74c07dad69f76aec and 0x1ca9e572e5000e825e2e152f6ec5c511404d5120.

The cryptocurrency wallet application SecondFi tweeted a reminder for users affected by the previous security incident regarding the risks of claiming NIGHT tokens. Some affected users will have a window to claim NIGHT tokens on September 22, but the Midnight Foundation's system only supports claims from the original wallet addresses and cannot switch to other unaffected addresses. The affected wallets have permanently existing security risks. SecondFi advises users not to attempt to claim NIGHT through compromised wallets, or the tokens will face the risk of being stolen.SecondFi also stated that the NIGHT claiming process is independently managed by the Midnight Foundation, and its wallet migration tool and asset recovery tool do not cover NIGHT claims. Affected users should contact the Midnight Foundation directly. Previously, SecondFi experienced a security incident from June 21 to 23, resulting in approximately 16.1 million ADA (about 2.6 million USD) being stolen, involving 374 wallets.

AI Agent Economic Settlement Agreement AEON announced the integration with two major mobile payment platforms in Pakistan, Easypaisa and JazzCash, allowing users to make payments using cryptocurrency, while merchants complete local fiat settlements in Pakistani Rupees (PKR).Currently, AEON has processed amounts exceeding 500 million and continues to expand its local payment network, providing infrastructure support for AI Agent to autonomously complete payments and settlements in more real-world business scenarios globally.

According to a report by the Korean Yonhap News Agency, the Busan Police Agency disclosed that someone illegally accessed the account of a text message sending agency used by the marketing department of a composite shopping center in the Sasang District of Busan, sending bulk scam messages to over 260,000 unspecified individuals, claiming "the cryptocurrency wallet has been updated" and inducing quick installation.Once users click on the attached link, they may encounter phishing attacks (Smishing) that could lead to the theft of virtual assets. The police have currently blocked access to the relevant accounts and are conducting a tracking investigation into the illegal intruder.

According to Bitcoin News, the Chief Technology Officer of BlueWallet stated that they screened 904 iOS applications labeled as non-custodial cryptocurrency wallets in the App Store and analyzed 494 of them, ultimately marking 45 as potentially having serious or high-risk security issues, with 23 being of potential serious risk and 22 being high risk.The issues mainly include suspected uploading of mnemonic phrases or private keys to servers, insufficient randomness in generated wallets, storing keys on the server side, using hard-coded encryption keys, and loading unsigned JavaScript code that can interact with sensitive wallet data. The Chief Technology Officer of BlueWallet cautioned that the analysis results may contain false positives, and applications not appearing on the list are not necessarily safe. When it comes to storing large amounts of Bitcoin, merely passing the App Store review and the application's reputation are not sufficient grounds to trust the software.

Bubblemaps posted on platform X that the main wallet addresses for LAPTOP are mostly new wallets, with 60% of the addresses having no on-chain activity prior."New wallets" refer to addresses that have received funds only in the past 10 days, and most of the wallets mentioned above received funds today.

Crypto KOL Rune posted that during the process of claiming the LAPTOP airdrop, a newly created wallet with direct fund transfers appeared. The new wallet 0x8DA...A18d claimed 4276 LAPTOP for free, then sold them and obtained about 400,000 USD.Subsequently, this wallet transferred 0.02 ETH to another newly created wallet 0xc27...b591. The latter also claimed 4276 LAPTOP for free and sold them immediately; due to the price drop since the previous address sold, this transaction only yielded about 200,000 USD.Rune described that the on-chain activities related to LAPTOP are becoming "strange," but it has not confirmed whether the two wallets are controlled by the same entity.

Cobo co-founder and CEO Shen Yu recalled that he has a deep shadow over ZEC. When ZEC's mainnet launched in 2016, BitMEX set the price ceiling at 10 BTC, which also became the historical high point for ZEC.He stated that shortly after starting to mine on the night of the launch, the transformer of the GPU mining farm was struck by lightning, and since then, ZEC has not appeared in his personal wallet again.

The Federal Bureau of Investigation (FBI) tracked and seized over $560,000 in cryptocurrency originally intended for Hamas by combining blockchain analysis, human intelligence, and court orders. The investigation involved shared wallets, cross-chain bridges, exchanges, and stablecoin accounts. Three seizure operations occurred in March, June, and October 2025.Investigators found that multiple donation addresses associated with Hamas's military wing, Al Qassam Brigades, used the same Gas wallet to pay transaction fees, and visualized funds flowing from donation wallets to operational wallets and related infrastructure through Reactor. In the June 2025 case, funds circulated through new addresses, accounts, over-the-counter brokers, and suspected money mule accounts; in October, the network switched to one-time donation wallets and cross-chain bridges. Court orders required Tether to destroy USDT from specified addresses and to reissue equivalent assets to law enforcement wallets, while Binance was instructed to transfer the balances of three accounts.

According to Lookonchain monitoring, 7 miner wallets transferred 350 bitcoins 6 hours ago, worth 28 million dollars. These bitcoins were obtained by the aforementioned miners through mining in March 2010.

On Tuesday, the Ukrainian National Police and Security Service announced the dismantling of a fake investment platform network based in Kyiv. This gang stole cryptocurrency from users in over 20 countries through built-in wallet theft tools. Investigators have currently confirmed 62 victims, including citizens from Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada, and Israel. The organizers recruited more than 46 Ukrainians, operating multiple offices in Kyiv and surrounding areas, where developers were responsible for building the fake platform and resisting bans, while other members handled customer service and security.According to the Ukrainian Security Service, the organizer is a 25-year-old IT expert, and the gang's peak monthly revenue reached up to $1 million. The scam began with advertisements for cryptocurrency investment projects on Telegram. After users registered, they connected their wallets and invested funds, while gang members manually forged transactions to show a continuously increasing balance in the user backend. When users requested withdrawals, the platform required them to connect their main wallet and approve a small "test" transaction under the pretext of verification. This authorization immediately triggered the built-in theft tool on the website, transferring assets to wallets controlled by the gang and locking the victims' accounts.Investigators tracked down server equipment storing the gang's database in the Netherlands, which recorded victim information, wallet addresses, stolen amounts, internal communications, and platform operation data, as well as user passports, phone numbers, emails, login passwords, and photos. Police executed 34 searches in Kyiv and surrounding areas, seizing over 100 computers, more than 100 mobile phones, 79 SIM cards, one GSM gateway, cash, and 15 vehicles.

The Securities and Exchange Commission of Thailand (SEC) has officially approved the travel rule for crypto assets, requiring digital asset operators to verify the ownership or control of wallets when customers send or receive crypto assets to self-custody wallets, and to retain transaction-related information for at least five years for regulatory review. Pornanong Budsaratragoon, Secretary-General of the Thai SEC, stated that the rule aims to reduce the risk of digital asset operators being used for money laundering and terrorist financing.The new regulations were finalized after two rounds of public consultations this year, with the first round presenting a draft in March and a notification draft released in June. The Thai SEC stated that most stakeholders expressed support. As the travel rule is implemented, Thailand is considering expanding the access to regulated crypto products. On Monday, the Thai SEC proposed allowing intermediaries to offer specific crypto derivatives traded on regulated overseas exchanges to retail investors.In the days prior, regulators also advanced the draft rules for spot Bitcoin and Ethereum exchange-traded funds (ETFs) and simultaneously sought opinions on the foreign digital asset custodians used by funds investing in crypto assets. Thailand's move aligns with global regulatory trends, as the Financial Action Task Force (FATF) estimates that by 2026, 83% of surveyed jurisdictions will have enacted travel rule legislation.

According to Cointelegraph, cybersecurity company Morphisec has revealed that a counterfeit desktop application disguised as "Claude Opus 5 Free Desktop" from Anthropic is being used to spread the Windows malware RevStealer. This software can steal data from over 50 types of cryptocurrency wallets, while also collecting sensitive information such as browser passwords, cookies, VPN configurations, message logs, and screenshots.RevStealer has anti-detection mechanisms that perform environmental checks on the target device before execution; if it detects characteristics of a debugging or virtual environment, it will stop running. In addition, Russian cybersecurity company Kaspersky has also disclosed another new malware framework targeting cryptocurrency investors called OkoBot, which can harvest wallet files, inject malicious extensions, and capture wallet application windows to steal assets.

According to Digitalasset, the South Korean National Tax Service plans to introduce commercial tracking programs used by domestic and foreign investigative agencies to track and analyze the flow of funds between digital asset wallets, in order to close the tax loophole for virtual assets in personal wallets.The South Korean government stated that digital assets held in personal wallets and overseas exchanges are subject to taxation as long as there is income generated from transfers or loans. The overseas exchanges will respond through the Crypto Asset Automatic Information Exchange Framework (CARF).