hacking

Bithumb stated that its internal mobile collaboration system DaouOffice was accessed without authorization by external parties, resulting in the theft of some personal information of customers and employees. This incident involves 6,444 customers, of which the data of 5,600 people is in an encrypted state and cannot be read, while 844 customers have confirmed that their personal information has been leaked. Additionally, the information of 715 employees and partners has also been affected.

GMO Internet was previously attacked, leading to suspected leakage of customer information data. The company refused to pay the ransom and stated plans to compensate customers for their losses.It is reported that GMO Internet operates the cryptocurrency exchange "Z.com EX," which has obtained licenses from the Thai Securities and Exchange Commission and the Thai Ministry of Finance. The exchange has disclosed that it has been acquired, involving the acquisition of all shares of the target company held by shareholders such as GMO Internet and its related subsidiaries. It is currently unclear whether the customer information data is related to the cryptocurrency exchange.

The South Korean police have launched a preliminary investigation into the hacking incidents involving securities companies and cryptocurrency exchanges. Previously, 16 financial institutions, including KB Kookmin Bank, were also attacked by hackers, resulting in the leakage of approximately 100,000 personal information records, including ID numbers, account numbers, and addresses.The police stated that they will compare the methods used in old and new cases to verify their correlation and do not rule out the possibility that they were carried out by the same attacker.

An email from a Federal Election Commission (FEC) official shows that hackers are attempting to infiltrate U.S. election websites.

Binance stated that its security team successfully identified and prevented multiple cyberattacks related to North Korea in the past week, without causing damage to the company's systems or loss of assets. Binance pointed out that North Korean hacker groups have recently been continuously conducting social engineering attack activities named Contagious Interview.This activity uses scenarios such as fake job interviews, code testing, and software installation to lure targets into running malicious programs. Binance reminds users to avoid installing unauthorized software or executing code from unknown sources and stated that it will continue to strengthen security monitoring, threat identification, and internal security management.

Seoul police arrested 7 suspects accused of using generative AI to launch hacking attacks. The Seoul Metropolitan Police Agency stated that about 90 organizations were involved, collectively stealing 8.2 million records, marking the first large-scale arrest of suspects in AI-assisted hacking attacks in South Korea. The targeted victims included hospitals, universities, private tutoring centers, golf courses, and subsidiaries of large corporate groups, all of which held a significant amount of personal information, including names, contact details, and records of ordinary citizens. One funeral service company lost 1.22 million records, and reports indicated that the tutoring center's data also contained information on minors.According to local media reports, the main suspect, 32 years old, studied arts and sports and has no IT background. He told investigators that he self-taught hacking techniques through YouTube and online blogs, while police pointed out that he had worked in a security company conducting simulated attacks from 2019 to 2022. He initially used website vulnerability scanning tools and later introduced AI coding proxies and an automated penetration testing system called Artex at the end of August. Police stated that he hacked into 60 companies over a span of 44 days from August 31 to October 13.The entire attack operation lasted about 13 months, from September 2025 to this October, and the case was filed in June after a victim reported it. Police indicated that such a large-scale attack previously required a hacker group to accomplish, but AI now allows one person to achieve this in a short time. The suspect sent emails to 38 victims, collectively extorting 360 million Korean won, approximately 272,000 US dollars, but the only confirmed payment was 300,000 won, about 210 dollars. The main suspect was detained and transferred to prosecutors last Friday, facing charges of violating South Korea's Information and Communication Network Act, as well as extortion and attempted extortion. Police will continue to investigate the other 6 accomplices and confirm more victims, with 15 institutions already reporting damages.

According to Cointelegraph, security company Hacken disclosed that there were a total of 107 cryptocurrency hacking incidents in the third quarter of 2026, with total losses amounting to $1.18 billion. Approximately $906 million (about 77%) were related to breaches of vendor and developer tools, disclosed but undeployed fixes, and infrastructure outside the audit scope.The losses were mainly concentrated in four incidents: Bitget lost $387 million, Liquid Network lost $320 million, Tectonic lost $120 million, and Coldcard firmware vulnerabilities resulted in losses of about $115 million, totaling about 80% of the losses. The remaining 98 incidents each had losses below $10 million, with a median of $670,000. Smart contract attacks were the most common, totaling 71 incidents with losses of $228 million. This quarter marked the worst losses since the first quarter of 2025. In terms of recovery, about $387 million was returned or reversed, accounting for approximately 33% of the gross losses; the operators also bore $410 million in user losses, with about $384 million still unrecovered.

According to Cointelegraph, Galaxy Research has updated the tracking data of the Coldcard hardware wallet attack, confirming that 1,789.28 BTC (worth approximately $114.7 million at the time of the incident) was stolen from 8,865 addresses. Alex Thorn, head of Galaxy Research, stated that 87.3% (approximately 1,561 BTC) remains unspent in addresses controlled by the attackers, with all Bitcoin stolen in the first three waves of attacks still untouched.In subsequent attacks, some Bitcoin has been transferred through CoinJoin mixing transactions and small splits. The statistics are based on 221 victim reports, covering losses of 790.72 BTC, with a median loss of 1.04 BTC, and more than half of the reports involve losses exceeding 1 BTC. Galaxy has shared the attackers' addresses with exchanges, compliance companies, and law enforcement agencies, hoping that funds can be frozen when they flow into centralized intermediaries.

Bloomberg senior ETF analyst Eric Balchunas posted on the X platform that Bitcoin spot ETFs recently recorded the strongest weekly inflow since April of this year, with a net inflow of approximately $1 billion, marking the third-best performance since last October's "Silent IPO" event. Several products, including BlackRock's iShares Bitcoin Trust ETF (IBIT) and Fidelity's Fidelity Wise Origin Bitcoin Fund (FBTC), have seen inflows for multiple trading days following the Coldcard wallet incident.Eric Balchunas added that while a causal relationship cannot be fully confirmed, the strong correlation between fund flows and the timing of events is "hard to ignore." If it is ultimately proven that the Coldcard incident becomes the starting point for the next Bitcoin rally, it would be somewhat ironic—because attacks on Bitcoin cold storage wallets are typically viewed as one of the worst security incidents, yet market sentiment may shift as a result. Recent ETF fund inflows indicate that institutional investors' demand for Bitcoin allocation is recovering, and the market is reassessing the impact of previous security incidents.

Cryptoquant released a report stating that on July 31, as Coldcard users rushed to transfer funds, on-chain activity surged dramatically. The number of daily active Bitcoin addresses soared from 645,000 on July 30 to nearly 1 million, the highest level since December 10, 2024, almost entirely driven by sending addresses. The total amount of transfers below 1 BTC on that day reached 39,600 BTC, slightly below the 39,900 BTC recorded after the FTX collapse; the total amount of transfers below $100,000 reached $3.2 billion, a new high since November 21, 2024.Long-term holder spending jumped from 269,000 BTC on July 30 to 406,000 BTC, the highest since January 14. The exchange recharge volume for small holders surged to the highest level since February 6. The mempool transactions increased from 33,000 to about 96,000, the highest since June 20. Analysis indicates that a large number of users have taken action to migrate funds, but an unknown number of holders still face risks.

The Securities and Exchange Commission (SEC) of Thailand has filed a criminal complaint against the cryptocurrency exchange Bitkub Online and two former directors, Sakolkorn Sakavee and Thaweesap Rawan, accusing them of submitting false financial reports between May and October 2021. The case has been handed over to the Economic Crime Suppression Division (ECD) of Thailand for investigation, and the prosecution will decide whether to formally charge them.The SEC stated that Bitkub suffered a cyber attack in May 2021, resulting in the theft of 16 types of digital assets, with losses exceeding $50 million. Regulatory investigations revealed that Bitkub did not reflect the relevant losses in its daily net capital report Form DA 1 from May 10 to October 30, 2021. The SEC alleged that the relevant executives made false statements in the company's official documents, leading regulators to believe that customer assets were intact and that the company had not suffered financial losses. Bitkub subsequently completed the acquisition of alternative assets in late October 2021, but the SEC believes that the reports during this period constituted false statements.In a statement on July 23, Bitkub asserted that existing customer holdings are secure and accounts are complete. Bitkub stated that its co-founders purchased alternative assets in the same quantity and currency to cover the losses and claimed that the cyber theft incident was reported to law enforcement on May 10, 2021.

According to South Korean media Daily NK, North Korean authorities arrested an elite hacker group on July 12, which is suspected of infiltrating the internal networks of the North Korean central bank and foreign trade bank, stealing national trade funds and laundering money through cryptocurrency. Sources say the group's leader is a veteran from the cyber warfare unit under the North Korean Reconnaissance General Bureau, who recruited talented IT graduates from Kim Chaek University of Technology and Pyongyang University of Science and Technology, using encrypted communications and wireless devices to commit crimes.They split the stolen funds into small amounts and transferred them to overseas cryptocurrency wallets, exchanged them for cash through intermediaries, and then converted them into dollars and other currencies in border areas. Pyongyang officials launched an investigation after discovering anomalies in foreign currency payment approvals and records of overseas IP access, ultimately raiding a safe house and arresting suspects who were laundering money, seizing equipment worth hundreds of thousands of dollars. This case has caused a stir among the elite and military circles in Pyongyang, with senior officials in the Reconnaissance General Bureau and the science and education sector worried about being implicated. North Korea has long been accused of stealing billions of dollars in cryptocurrency assets through hacker organizations like the Lazarus Group, but this incident rarely shows that its own financial system has also become a target of internal attacks.

Onchain Lens stated on the X platform that in the first half of 2026, 224 publicly disclosed crypto hacking incidents resulted in approximately $1.32 billion in losses. The largest losses came from access control failures, phishing attacks, and oracle issues.In terms of attack type breakdown, access control failures involved compromised permissions and privileged access, driving several of the largest attacks, including Kelp DAO with a loss of $292 million, Drift Protocol with a loss of $280 million, Humanity Protocol with a loss of $31 million, Step Finance with a loss of $30 million, Truebit with a loss of $26.5 million, Resolv Labs with a loss of $25 million, AFX with a loss of $24.15 million, and BonkDAO with a loss of $21 million. In terms of phishing and social engineering attacks, social engineering attacks caused $282 million in losses. Regarding oracle issues, Ostium lost $24 million, Blend Protocol lost $10.86 million, and Bonzo lost $9 million. A small number of incidents accounted for the majority of the losses, with compromised permissions and privileged access driving several of the largest attacks.

According to The Block, a report from Immunefi shows that in the first half of 2026, cryptocurrency projects suffered cumulative losses of approximately $972 million due to 207 hacking incidents. Although the number of attacks reached a historic high, the total losses remained below $1 billion and were less than half of the losses in the first half of 2025.The report pointed out that losses from attacks in the DeFi sector have decreased by 74% from the peak of $2.62 billion in 2022, dropping to about $680.3 million, with the median single loss decreasing by 75% during the same period. Immunefi believes that this decline is related to ongoing security coverage, bug bounty programs, audit competitions, and more researchers discovering vulnerabilities early.In addition, the sources of risk are shifting from purely smart contract vulnerabilities to infrastructure failures, private key leaks, cross-chain configuration errors, and weak points in privileged access.

According to official news, the stablecoin protocol Reflect, supported by a16z, announced the launch of an independent voluntary recovery plan for USDC+ position holders affected by the Drift (now Velocity) April hacking incident: a 180-day window is now open, during which holders can voluntarily sell their positions to Palindrome Engineering at a price of 0.2 USDC + 80 Reflect Credit (RC) per unit, with complete on-chain settlement.The plan is funded in advance by Palindrome and is completely independent of the Drift recovery process. Participation means waiving the right to pursue claims against Drift in exchange for immediate certainty of liquidity; those who do not participate can still support Drift's DFX recovery channel.

According to monitoring by PeckShield, there were a total of 40 major hacking incidents in the cryptocurrency sector in June 2026, with total losses reaching 75.87 million USD, a decrease of 7.13% compared to May's 81.70 million USD.Among them, Humanity Protocol suffered an attack of 31 million USD, ranking first; Syscoin Bridge and JaredFromSubway.eth MEV bot lost 10 million USD and 7.5 million USD respectively.It is worth noting that the attackers of Humanity Protocol are laundering money through multiple chains such as BTC, Solana, Hyperliquid, and BNB Chain, and the funds are mixed with the earnings of the KelpDAO attackers, suggesting a possible connection. In addition, Aztec Bridge and Aztec Connect were attacked in the same month, with total losses of approximately 4 million USD.

According to the Korea Herald, the five major virtual asset trading platforms in South Korea (Upbit, Bithumb, Coinone, Korbit, Gopax) have experienced a total of 57 hacking and system failure incidents over the past six years (from 2020 to April 2026), with a total compensation amount of approximately 7 billion Korean won (about 5.1 million USD). By exchange, the number of incidents is as follows: Upbit 26 incidents, Bithumb 14 incidents, Gopax 8 incidents, Coinone 6 incidents, Korbit 3 incidents.Among them, Bithumb compensated approximately 2.5 billion Korean won (about 1.8 million USD) for the BTC misissue incident in February this year, Upbit compensated approximately 790 million Korean won (about 570,000 USD) for a hacking incident in November 2025, and compensated approximately 3.2 billion Korean won (about 2.3 million USD) for a system incident on December 3, 2024. It is worth noting that the standards for compiling incident reports by exchanges and the scale and form of compensation vary. For example, Gopax counts errors that occur when viewing the asset list as system failures, while Bithumb only counts situations where all customers encounter difficulties using core services for more than 10 minutes as system failures.In addition, Bithumb also provided some applicants who suffered losses due to system failures with free fee vouchers instead of cash compensation. The compensation amounts for system failures are as follows: Upbit approximately 3.21 billion Korean won, Bithumb approximately 3.2 billion Korean won, Coinone approximately 49 million Korean won. Korbit and Gopax did not provide any compensation.

According to monitoring by PeckShield, there were a total of 40 major hacking incidents in the cryptocurrency sector in May, with total losses of approximately $81.7 million, a decrease of 87.4% compared to $647 million in April. Among them, cross-chain protocols remain the main target of attacks, with 8 major cross-chain attacks causing losses of $33.28 million, accounting for 41% of the total losses for the month.Significant loss events include SUPERFORTUNE AI (approximately $15.18 million), Verus-Ethereum Bridge (approximately $11.58 million, already refunded), and THORChain (approximately $10 million), among others.