keys

According to Decrypt, Michael Gubbins, the head of the Criminal Assets Bureau in Ireland, revealed to the Sunday Independent that organized crime gangs are renting private vaults to store cryptocurrency wallet private keys and mnemonic phrases along with cash, luxury watches, passports, and other valuables. This situation has been reported to the government's Anti-Money Laundering Steering Committee, which is preparing to implement new EU anti-money laundering rules in Ireland.The new EU regulations will take effect next summer, prohibiting cash transactions over 10,000 euros and requiring businesses to identify individuals for cash expenditures of 3,000 euros and above. Gubbins stated that crime gangs believe cryptocurrency offers anonymity, but the use of cryptocurrency in Ireland is still quite primitive, with cash remaining the primary form of payment for criminal activities such as drug trafficking.The bureau is handling its largest cryptocurrency seizure in history, involving 6,000 bitcoins confiscated from a cannabis grower in 2019, with the private keys written on paper and hidden in a tackle box, which was later lost. With the assistance of Europol, the bureau has cracked the first of 12 wallets in March, with over 130 million euros already liquidated from assets totaling 360 million euros.

Blockchain security company Hacken released an assessment report indicating that approximately half of the circulating USDT (about $91.3 billion on the Tron network) is controlled by a 2-of-3 multi-signature contract, which lacks built-in delays, cancellation processes, or reliable revocation mechanisms. Attackers only need to compromise two signature keys to change contract ownership, mint tokens, freeze addresses, clear frozen balances, or set transfer fees without accessing any user wallets. Hacken also discovered that Tether reuses the same set of six signature keys across three chains: Ethereum, Avalanche, and Celo, posing a risk of cross-chain spread.Meanwhile, stablecoin rating agency Bluechip upgraded Tether's company rating from D to C, citing that KPMG's audit showed Tether's reserves exceeded liabilities by $6.8 billion as of December 31, 2025. This is the first time Bluechip has adopted the expanded SMIDGE methodology, which incorporates Hacken's technical risk analysis. However, Hacken only gave USDT a cybersecurity score of 3.3 out of 10 and pointed out that the USDT smart contract does not have automatic reserve proof checks or a token minting cap. Once signers authorize a transaction, the contract can mint an unlimited number of tokens without a bank reserve proof.Hacken stated that it has not yet completed an equivalent assessment of Circle's USDC, and Bluechip's previous B+ rating for USDC was based on an old methodology, which cannot be directly used for technical comparison.

According to Bitcoin.com, Fidelity Digital Assets has released an analysis report indicating that future quantum computers may derive Bitcoin private keys from exposed public keys, threatening asset security. Existing Bitcoin transactions rely on elliptic curve digital signature algorithms or Schnorr signatures, and sufficiently powerful quantum computers running Shor's algorithm could break this cryptographic assumption.The report evaluates the SHRINCS post-quantum signature scheme as a potential upgrade path—providing a compact 48-byte public key, with state signature sizes ranging from 548 to 4,619 bytes, and a 5,777-byte stateless fallback path to address state loss. However, quantum-resistant signatures will significantly increase transaction data size, consume more block space, reduce network throughput, and drive up transaction fees during congestion. Implementing such upgrades will require new consensus rules (possibly through a soft fork) and broad support from wallets, miners, exchanges, and custodians. In July of this year, Fidelity co-funded a $15 million Bitcoin security program with eight other institutions, covering anti-quantum research.

Predict.fun posted on platform X that it has launched the Predict Developer Dashboard, a self-service portal for creating applications, generating keys, and managing usage and rate limits. Through this interface, users can manually request higher usage-based tiers and import existing keys.Predict.fun has also implemented "trade burst" limits to restrict the number of calls for creating and canceling orders per second. New applications have this limit enabled by default, while existing applications will have this limit applied the next time the user requests rate limits.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

Arthur Hayes updated on the X platform stating: The FLOP airdrop eligibility will depend on users' testnet activities. The testnet token faucet will be launched on Technocore.chat, and users will need to access it through the DID keys provided by the AI agent.Previously, Hayes revealed that the FLOP is planned for a large-scale airdrop in the fourth quarter of 2026, with an expected 20% of the total token supply to be airdropped to testnet participants, distributed over 10 years------this may be adjusted later, and the purpose of announcing this figure is to collect user feedback. The FLOP token is expected to become one of the top two tokens in the cryptocurrency market.

Monad officially released a new MIP (Monad Improvement Proposal), themed around Flexible and Upgradeable Account Authentication. The core of this proposal is to allow accounts to change keys without changing addresses, thereby enhancing the flexibility and security of account management.Through this mechanism, accounts can smoothly upgrade to quantum-resistant cryptographic schemes to address potential threats posed by future quantum computing. The proposal has been officially announced, and the community can further review relevant technical details and discussions.

According to Security Affairs, Ransomnews researchers have recorded a large-scale Stripe merchant API key leak incident, with keys exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, identifying over 50,000 unique keys in total. Sample tests show that a significant portion is still active, allowing attackers to commit fraud within hours.The report states that on August 18, 2026, a data trading forum released a dataset containing valid Stripe API keys for 659 merchant accounts and approximately 35 GB of customer and payment data. Ransomnews has conducted offline analysis and reported it to Stripe before publication. Stripe itself was not breached; the keys belong to the merchants. Researchers were able to access merchant customer lists, create fraudulent payment links, and complete a $1 test charge within 17 hours after discovering valid keys.Valid keys can list customers and stored payment methods, create charges and payment intents, initiate refunds to attacker-controlled accounts, modify webhook endpoints to intercept payment notifications, and access associated accounts when Stripe Connect is enabled. The main sources of the leak include hardcoded keys in GitHub repositories and unignored .env files, unmasked environment variables in GitHub Actions build logs, and about 12% of over 3,000 misconfigured servers containing usable keys.

According to monitoring by Catcher Predict, in the prediction market Polymarket for the event "Cincinnati Open: Sara Bejlek vs. Madison Keys," the "Sara Bejlek" option in the sub-market "Cincinnati Open: Sara Bejlek vs. Madison Keys" has experienced a dramatic fluctuation in winning probability, soaring from 19.5% an hour ago to the current 82.5% (a fluctuation of 63%). Please note the impact of related breaking news.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

Bitcoin News posted on the X platform that Bitcoin developers have launched a new visualization tool to explain how entropy works and how to generate randomness for Bitcoin private keys.The tool covers true random number generators (TRNG), pseudo-random number generators (PRNG), rolling dice, and flipping coins.

A wallet security incident involving approximately $130 million in Bitcoin losses is reigniting discussions in the crypto industry about asset custody models: should Bitcoin holders rely on personal self-custody or turn to institutional custody? Hardware wallet manufacturer Coldcard had a vulnerability in its firmware in 2021 that led to some mnemonic phrases generated by the device being predictably risky. This vulnerability was discovered years later, and approximately 5,200 addresses and about 2,000 BTC have been stolen, with losses amounting to around $130 million.After the incident, some investors began to turn to Wall Street custody products. Data shows that the U.S. spot Bitcoin ETF saw a net inflow of about $626 million within days of the incident. Bloomberg ETF analyst Eric Balchunas stated that such security incidents could further drive funds into ETFs. However, the Bitcoin core community still insists on the self-custody concept. Casa co-founder Jameson Lopp stated that recent events should not undermine users' confidence in self-custody and pointed out that third-party custody also carries risks. Bitcoin Core early developer Peter Todd also believes that self-custody has a better long-term safety record than centralized institutions.Onramp co-founder Michael Tanguma believes that both options have flaws. He stated that concentrating a large amount of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Tanguma proposed a "multi-institution custody" solution, where multiple regulated institutions hold keys through a multi-signature mechanism, requiring multiple institutions to jointly sign any transaction to reduce single points of failure. However, this model has also sparked controversy. Critics argue that while multi-institution custody enhances security, it also introduces permissioned management, conflicting with the decentralized ideals originally pursued by Bitcoin. As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is seeking new custody solutions suitable for long-term wealth management. The Coldcard vulnerability incident once again highlights that achieving a balance between security, decentralization, and usability remains a core challenge facing the Bitcoin ecosystem.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.

According to monitoring by Bitcoin News, Nunchuk stated that some keys on the Nunchuk platform are generated by Coldcard Mk4, but these keys will not be used directly.Nunchuk will derive independent keys through custom logic, making them less susceptible to lookup table attacks based on leaked Coldcard seeds. Nunchuk added that, given enough time, it believes attackers may eventually incorporate these derived keys as well.

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

Programmer Stefan Thomas holds an IronKey encrypted USB drive containing the private keys for 7,002 bitcoins, which were earned as a reward for his 2011 educational video "What is Bitcoin?" Recently valued at approximately $111,000 each, this amounts to about $777 million.The IronKey device is set to permanently lock and delete its contents after 10 incorrect password attempts. Thomas has tried 8 times and has only 2 attempts left. The manufacturer Kingston stated that there are no backup passwords or alternative recovery methods aside from the original password set by the user. Thomas has sought assistance from the digital forensics company Naxo and security researcher Chris Tarnovsky, and he previously declined Unciphered due to having reached a verbal agreement with both teams. As of the end of 2025, the IronKey remains stored in a Swiss vault, with no confirmation of a successful recovery by mid-2026.

SlowMist issued a security alert, detecting a coordinated malicious npm supply chain attack. The attackers utilized fake trading bot repositories and DeFi-themed npm packages to deploy JavaScript information stealers, targeting npm users, DeFi developers, and trading bot users.This attack involved 30 malicious npm packages, among which stake-math@3.5.4 appeared as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository. This repository presented approximately 2300 highly homogeneous bulk-generated forks, mostly concentrated under the poly-stocks account, with signals being exceptionally clear. The sensitive data that attackers could steal is extensive, including cryptocurrency wallet libraries, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager libraries, private keys, mnemonic phrases, and API tokens exposed in source code.SlowMist recommends that developers immediately remove the affected npm packages, audit package.json and package-lock.json, and check CI logs for any of the 30 malicious packages; consider any system that has executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.

Humanity Protocol founder Terence Kwok posted on the X platform confirming a security incident, stating that this incident involves the private key leak of a Humanity Foundation member. For safety reasons, users are advised not to interact with cross-chain bridges or any liquidity pools until safety is confirmed. The team is working with security experts and exchange partners to resolve the issue.According to previous reports, associated addresses of Humanity Protocol have been stolen for over 31 million dollars.

The Huobi HTX VIP private class "AI + Trading from Theory to Practice" was held in Shanghai, where early Bitcoin miner and pyra.io CTO Tian Jia shared the development of quantum computing and the impact of AI on trading.He believes that the average time it takes to threaten "Bitcoin addresses with exposed public keys" is 7 to 8 years, with a range of 5 to 15 years. The required number of logical qubits is between 1200 and 2400, while the number of physical qubits is less than 500,000. Additionally, Bitcoin also has defensive measures; it can migrate to PQC, or post-quantum cryptography, although there are significant challenges, such as the locking issue of Satoshi's coin.

According to Cryptopolitan, the Digital Asset Exchange Alliance (DAXA) in South Korea has introduced new compliance standards requiring exchanges to revoke API keys suspected of being improperly shared among users. The new regulations aim to combat market manipulation, false orders, and other behaviors that exploit shared or leaked API credentials.According to the new guidelines, DAXA member exchanges will take strict measures when suspicious API sharing behavior is detected. After enhanced monitoring and user warnings, users will be required to undergo mandatory re-authentication. Upbit, Bithumb, Coinone, Korbit, and Gopax are all regulated by DAXA, and these exchanges will also implement an IP whitelist system to restrict API access only from approved addresses. The Financial Supervisory Service of Korea stated that automated trading currently accounts for about 30% of domestic cryptocurrency trading volume.