keys

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

Programmer Stefan Thomas holds an IronKey encrypted USB drive containing the private keys for 7,002 bitcoins, which were earned as a reward for his 2011 educational video "What is Bitcoin?" Recently valued at approximately $111,000 each, this amounts to about $777 million.The IronKey device is set to permanently lock and delete its contents after 10 incorrect password attempts. Thomas has tried 8 times and has only 2 attempts left. The manufacturer Kingston stated that there are no backup passwords or alternative recovery methods aside from the original password set by the user. Thomas has sought assistance from the digital forensics company Naxo and security researcher Chris Tarnovsky, and he previously declined Unciphered due to having reached a verbal agreement with both teams. As of the end of 2025, the IronKey remains stored in a Swiss vault, with no confirmation of a successful recovery by mid-2026.

SlowMist issued a security alert, detecting a coordinated malicious npm supply chain attack. The attackers utilized fake trading bot repositories and DeFi-themed npm packages to deploy JavaScript information stealers, targeting npm users, DeFi developers, and trading bot users.This attack involved 30 malicious npm packages, among which stake-math@3.5.4 appeared as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository. This repository presented approximately 2300 highly homogeneous bulk-generated forks, mostly concentrated under the poly-stocks account, with signals being exceptionally clear. The sensitive data that attackers could steal is extensive, including cryptocurrency wallet libraries, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager libraries, private keys, mnemonic phrases, and API tokens exposed in source code.SlowMist recommends that developers immediately remove the affected npm packages, audit package.json and package-lock.json, and check CI logs for any of the 30 malicious packages; consider any system that has executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.

Humanity Protocol founder Terence Kwok posted on the X platform confirming a security incident, stating that this incident involves the private key leak of a Humanity Foundation member. For safety reasons, users are advised not to interact with cross-chain bridges or any liquidity pools until safety is confirmed. The team is working with security experts and exchange partners to resolve the issue.According to previous reports, associated addresses of Humanity Protocol have been stolen for over 31 million dollars.

The Huobi HTX VIP private class "AI + Trading from Theory to Practice" was held in Shanghai, where early Bitcoin miner and pyra.io CTO Tian Jia shared the development of quantum computing and the impact of AI on trading.He believes that the average time it takes to threaten "Bitcoin addresses with exposed public keys" is 7 to 8 years, with a range of 5 to 15 years. The required number of logical qubits is between 1200 and 2400, while the number of physical qubits is less than 500,000. Additionally, Bitcoin also has defensive measures; it can migrate to PQC, or post-quantum cryptography, although there are significant challenges, such as the locking issue of Satoshi's coin.

According to Cryptopolitan, the Digital Asset Exchange Alliance (DAXA) in South Korea has introduced new compliance standards requiring exchanges to revoke API keys suspected of being improperly shared among users. The new regulations aim to combat market manipulation, false orders, and other behaviors that exploit shared or leaked API credentials.According to the new guidelines, DAXA member exchanges will take strict measures when suspicious API sharing behavior is detected. After enhanced monitoring and user warnings, users will be required to undergo mandatory re-authentication. Upbit, Bithumb, Coinone, Korbit, and Gopax are all regulated by DAXA, and these exchanges will also implement an IP whitelist system to restrict API access only from approved addresses. The Financial Supervisory Service of Korea stated that automated trading currently accounts for about 30% of domestic cryptocurrency trading volume.

In response to the unauthorized access event of the internal code repository disclosed by GitHub, Zhao Changpeng reminded, "If the code contains an API Key, even if it is in a private repository, it should be reviewed and replaced immediately."

Echo Protocol announced that its eBTC deployment on Monad experienced unauthorized activity, resulting in abnormal minting and financial losses. Preliminary investigations indicate that the issue stemmed from the compromise of the administrator keys related to the Monad deployment, with approximately $816,000 in assets currently confirmed to be affected.Echo stated that the Monad network itself was not affected and continues to operate normally. The team has regained control of the administrator keys and has destroyed the remaining 955 eBTC held by the attacker. The project further clarified: the current incident appears to be limited to the Monad deployment; there is no evidence to suggest that the Aptos side has been affected; aBTC on Aptos and eBTC on Monad are independent, non-bridgeable assets; the current related risk exposure on Aptos is approximately $71,000.As an additional precaution, Echo has suspended the cross-chain functionality of the Monad deployment and has begun upgrading the related EVM bridging contracts and permission control mechanisms, while reminding users not to interact with any unofficial claims, refund, or recovery pages.

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

According to Politico, Poland's major cryptocurrency exchange Zondacrypto is facing a serious fraud investigation. Its former CEO went missing in 2022, taking with him the private keys to a cold wallet containing 4,500 bitcoins (currently worth over $340 million). The current CEO has admitted to being unable to access the wallet and has recently been reported to have fled to Israel. Prosecutors estimate potential losses for customers to be around $97 million.On-chain data shows that the bitcoin balance in the platform's hot wallet has plummeted by 99.7% since mid-2024, with users generally reporting difficulties in withdrawing funds. Polish Prime Minister Tusk estimates that up to 30,000 users may be affected.Tusk publicly accused the platform of being funded by Russian-linked money, used to finance opposition lawmakers to obstruct Poland's cryptocurrency regulatory legislation. He bluntly stated that this is a "Polish version of a Ponzi scheme" and criticized the president for vetoing the localization of the EU MiCA framework twice, making Poland a "paradise for scammers."The platform's board stated that they failed to obtain "verifiable information" from the missing CEO and have collectively resigned. The founder has been missing since 2022, and the previously mentioned "suspect kidnapping allegations" case is still under investigation. This incident is expected to prompt Poland and the EU to strengthen regulatory scrutiny of cryptocurrency exchanges.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

Project Eleven today awarded the Q-Day prize to researcher Giancarlo Lelli, who successfully derived a 15-digit elliptic curve private key from a public key using publicly accessible quantum hardware, marking the largest scale demonstration of its kind to date, a 512-fold increase from the 6-digit demonstration in September 2025.Lelli used a variant of Shor's algorithm for the elliptic curve discrete logarithm problem, which is the mathematical foundation of the Bitcoin signature scheme, with the awarded hardware featuring approximately 70 qubits. Currently, no known quantum computer can crack real Bitcoin wallets, and the security of Bitcoin's 256-bit elliptic curve remains far beyond current quantum capabilities. Notably, Google lowered its resource estimates for ECDLP-256 on March 31 and set a target for the migration to quantum cryptography after 2029, followed by Cloudflare, and the UK's NCSC also set migration milestones from 2028 to 2035.On-chain data shows that approximately 6.93 million BTC are at potential quantum risk due to exposed public keys. The Bitcoin community has proposed BIP 360 and BIP 361 to promote the migration to quantum-resistant output types, but the coordination challenges of a decentralized network remain the biggest hurdle.

The Solana ecosystem DeFi protocol Meteora announcement has noted the latest developments regarding the security incident of the cloud hosting platform Vercel. The environment keys were immediately rotated and logs were checked 12 hours ago, and everything is normal. The official team will continue to monitor the situation to ensure the safety of Meteora and its users.

Orca posted on the X platform that its frontend is hosted on the cloud hosting platform Vercel. In response to the Vercel security incident, all potentially leaked keys and deployment credentials have been rotated out of caution. Orca's on-chain protocol and user funds were not affected. The official team will continue to monitor the situation and will provide updates as more information becomes available.

The exchange Zonda stated that its cold wallet holding 4,503 bitcoins (worth approximately $334 million) is currently inaccessible.Zonda CEO Przemysław Kral issued a video statement claiming that the private key for the wallet was never handed over during the company's transition. The private key was supposed to be transferred by Zonda's founder and former CEO Sylwester Suszek, but Sylwester Suszek has been missing since 2022. Przemysław Kral denied allegations of misappropriating funds and stated that an unusual surge in withdrawal requests was triggered by negative media coverage. Zonda plans to take legal action against false statements and is committed to fulfilling its obligations to customers. The exchange was renamed from BitBay to Zonda in 2021.

This morning, 60,000 ETH were redeemed from Ethereum staking and transferred to Coinbase. According to analysis by Yu Jin, the owner of this ETH is Andrew Keys, co-founder of DARMA Capital, and this ETH has been staked for nearly 5 years.In recent days, these ETH have been largely redeemed and aggregated, then transferred to Coinbase. During the nearly 5 years of staking, these ETH earned approximately 18% in coin-based returns (16,000 ETH, worth 34.2 million USD).

According to official news, the blockchain security agency SlowMist recently released a security assessment report, conducting a special audit of OKX Wallet. The results showed that in the audited version, no behavior was found where the application transmitted sensitive information such as private keys or mnemonic phrases to external servers, and no risk of sensitive data leakage was detected overall.It is reported that this assessment focused on whether there were issues with the external transmission of private keys and mnemonic phrases in OKX Wallet, and the results indicated that the relevant core information was processed locally. The current handling of private keys and mnemonic phrases has become the core of wallet security, and such audit results also provide users with a more direct security reference.

Google's research shows that future quantum computers may only need 9 minutes to crack Bitcoin private keys, which is 1 minute shorter than the average block time of 10 minutes for BTC.The study warns that memory pool attacks could become a real threat and urges an immediate transition to post-quantum cryptography.

Andrej Karpathy posted on the X platform that litellm has encountered a PyPI supply chain attack, where executing pip install litellm can steal SSH keys, AWS/GCP/Azure credentials, Kubernetes configurations, git credentials, environment variables, encrypted wallets, SSL private keys, CI/CD keys, and database passwords.litellm has a monthly download volume of 97 million, and the risk can spread to all projects that depend on litellm, such as dspy. The version with the malicious code was online for less than about 1 hour, and it was discovered due to a flaw in the attack code that caused Callum McMahon's machine to run out of memory and crash. Andrej Karpathy stated that supply chain attacks are the most threatening issue in modern software, as each installation of dependencies can introduce tampered packages deep within the dependency tree, leading him to increasingly prefer reducing dependencies and using LLM to directly implement simple functions.

Binance has issued a security alert, as there have been multiple asset security incidents in the community recently due to device environment issues, reminding users to pay attention to the security of their private keys/seed phrases.The Binance wallet's keyless mode is based on MPC-related technology, which stores key shards in different independent environments, further enhancing the security of asset management and effectively reducing the risk of key leakage and attacks.