keys

According to market news, FoundationHQ stated that attackers sent over 23,000 phishing emails after exploiting leaked API keys and accessing customer data, including addresses and phone numbers.

Hardware wallet manufacturer Keystone's device verification keys were stolen, halting shipments and destroying 18,835 unsold devices, with 25,964 buyer records leaked.

According to a statement from Keystone Hardware Wallet, its official website was breached on October 20 due to a vulnerability in third-party monitoring tools, resulting in the acquisition of approximately 25,964 purchase records containing personal information, 12,873 unpaid checkout records, and device WebAuth authentication keys. Mnemonic phrases, private keys, and payment information were not affected.Keystone will destroy 18,835 devices containing old keys from its inventory, suspend shipments from the official website, and switch to pre-sales, while reminding users that there is no need to transfer assets and to be wary of scams such as "recalls."

Cryptocurrency hardware wallet manufacturer Keystone disclosed that its website experienced a security breach, allowing unauthorized third parties to access customer names, contact information, shipping addresses, and order details. Keystone stated that it has blocked access, fixed the vulnerability, and launched an investigation, while also notifying affected customers, but did not disclose the number of individuals impacted.Security researcher Taylor Monahan warned that the leaked shipping addresses could expose customers to targeted scams and personal attacks. Keystone stated in 2023 that it would shorten the retention period for customer data to 180 days, but some customers reported receiving breach notifications more than two years after purchasing their devices.

Hardware wallet manufacturer Keystone has confirmed that its website suffered a security breach, resulting in the leakage of some customers' address information and order details. The company stated that it took immediate action upon discovering the vulnerability and successfully prevented unauthorized access.Currently, Keystone has completed the vulnerability repair work and emphasized that this incident did not affect users' payment details, mnemonic phrases, or private keys. The company stated that it will continue to strengthen security measures.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

Zipcoin announced that it has ceased operations, stating that the project’s code repository and related keys have been fully compromised, and attackers may control the project’s wallets and infrastructure. The team indicated that they attempted to migrate the code and rotate credentials in the past 12 hours but failed to find a viable security solution.Zipcoin also disclosed that the project was affected by the UNCX incident on October 15, where hackers stole approximately 1.1% of the supply of multiple Ethereum tokens, including ZC, PAAL, and EDGEN, and sold them on the open market. The team subsequently attempted to buy back tokens from the market to compensate for the token shortfall corresponding to future team commitments.

According to Slow Fog's disclosure, LiteLLM has once again encountered a supply chain attack, with the malicious version litellm@1.107.0 affecting PyPI packages and Docker images, including floating tags such as latest and main-stable.The injected malicious code will automatically execute upon Python startup, stealing sensitive data such as cloud credentials, AI API keys, SSH private keys, and supporting remote code execution. The affected versions have been removed or replaced. Slow Fog recommends that users avoid using version 1.107.0, rebuild the affected environment from a clean image, rotate potentially leaked credentials, and pin the version to 1.106.2.

According to security researcher Spreek (@spreekaway), the management keys of swETH and rswETH under Swell DAO are suspected to have been leaked, and attackers are raising the uncollateralized NAV (Net Asset Value) by up to 1% per hour. Currently, four malicious upgrade contracts have been detected and have not yet been queued for execution through multi-signature; if executed, they could steal approximately 2,500 ETH.Additionally, according to analysis by ADL (@ADLXBT), the management keys control the proxy administrator permissions. Once controlled by attackers, they can direct the swETH/rswETH proxy to malicious implementation contracts, triggering minting or withdrawal functions, thereby inflating the NAV without asset backing. Spreek stated that whether this incident is related to the Railway platform remains speculative; it is currently just a coincidence in timing, with no conclusive evidence available.

According to an official announcement from Railway, the cloud deployment platform Railway detected abnormal activity in the system that stores customer environment variables. Preliminary investigations indicate that an unauthorized third party may have accessed encrypted environment variables and obtained decrypted content from some of those variables, which may include API keys, database credentials, and image repository credentials.Railway believes this incident is part of a recent series of attacks targeting platform companies, aimed at infiltrating AI inference service providers, and has notified upstream service providers to proactively revoke keys. Currently, Railway has suspended all deployments and recommends that all users immediately rotate the environment variables, API keys, and private repository credentials stored on the platform, and check relevant service logs.

According to Slow Fog's Yu Xian monitoring, Qubic Wallet may have leaked most of its private keys, which can be restored through 6 connections.

The Zakura team, which operates the Zcash network, released a technical article stating that they plan to allocate a unique viewing key for each ZEC exchange completed through NEAR Intents, in order to block future quantum computers from exploiting public refund addresses to piece together user payment histories. NEAR Intents supports cross-chain token exchanges, and when users exchange the privacy coin ZEC for USDC, the service will publish a Zcash address for the user on the NEAR public blockchain, which will be used to return any unused ZEC.The Zcash address contains a public key generated by the wallet's viewing key, which cannot be reverse-engineered by ordinary computers, but large quantum computers running Shor's algorithm could theoretically deduce the key from the address. Zcash wallets can generate multiple seemingly unrelated addresses, but they typically share the same viewing key. Once an attacker cracks it, they can associate all payments received by the account and read the amounts and notes. Zakura's solution allocates a unique viewing key for each exchange, while the spending key remains in the user's main account. Even if the future refund address is compromised, the attacker would only be able to see payments related to that specific exchange.This design also addresses a practical issue: wallets conducting hundreds of exchanges would generate hundreds of keys, requiring each key to scan the entire Zcash chain during backup recovery. Zakura's solution is a privately queryable database that uses private information retrieval technology, so when the wallet inquires about the refund destination, the database will not know the address being queried. Zakura claims that wallets built on its open-source library (including Vizor) will be able to add this feature in the coming weeks, and hardware wallets will follow after firmware support, ahead of the January quantum-resistant payment target set by Zcash developers this month.

Cryptocurrency hardware wallet manufacturer Ledger announced the launch of Ledger Agent Intent, which is now open for free to all signature devices compatible with Ledger. The AI agent can monitor the market and provide portfolio optimization suggestions, allowing users to review and approve relevant actions on their Ledger devices, while the private keys remain under the user's control.Agent Intent will be directly integrated with OpenClaw, allowing users to register the OpenClaw agent and authorize actions on their Ledger Atom devices, with the OpenClaw application pre-installed on the device. This tool also supports Pay.sh from the Solana Foundation, and requests made by the agent can enter a unified queue for users to choose the timing for signing.Ledger collaborates with Venice AI to address privacy issues and stated that user data will not be used for training models by third parties.

Co-founder of Glassnode, Rafael Schultze-Kraft, stated based on on-chain data that approximately 6.26 million BTC public keys have been exposed, accounting for 31.2% of the current supply, up from 24.8% at the beginning of 2021.Among them, about 4.33 million were exposed due to address reuse, and approximately 1.94 million are related to script types. He emphasized that this statistic does not indicate that quantum attacks are realistically feasible, nor can it be used to assess the security status of exchanges or custodians.

BasedApp disclosed a data breach, with unauthorized parties accessing its internal operating system, exposing customer KYC data. The exposed items listed in the post include names, dates of birth, nationalities, addresses, passport or NRIC numbers, email addresses, phone numbers, and wallet addresses associated with the aforementioned identity information.The post also mentioned that someone gained administrator access to the BasedApp team's AI-agent backend through Google Quick Login, exposing the Telegram bot token, AI API key, OpenClaw gateway token, and OpenAI keys.

According to Glassnode data, over 6 million Bitcoins are under publicly visible public keys on the blockchain, accounting for 31.2% of the circulating supply, which is about 5 to 6 percentage points higher than the low point in 2023. Rafael Schultze-Kraft, co-founder of Glassnode, stated that since the company's report in May, the exposed supply has increased by 222,000 BTC (approximately 18.2 billion USD), while the total Bitcoin supply during the same period has only grown by 64,000 BTC.Among them, exchanges contributed an incremental 123,000 BTC, currently holding 1.79 million BTC that are publicly visible. There are significant differences among institutions: Coinbase has an exposure ratio of 10%, while Binance reaches as high as 83%; Fidelity holds about 375,000 BTC with an exposure ratio of only 2%, Grayscale is at 49%, Revolut is at 99%, and Robinhood is at 100%. According to this statistical method, the holdings of the governments of the United States, the United Kingdom, and El Salvador do not show exposure.Public keys can be reused through addresses or become visible directly in certain Bitcoin output types, including early pay-to-public-key outputs and Taproot. A sufficiently capable quantum computer or hypothetical mathematical breakthroughs could allow attackers to derive the corresponding private keys.

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

According to Bitcoin News monitoring, security researchers have found that versions 1.1 and 1.2 of FomoPeek distributed through the Apple App Store contain an iOS exploit framework that can escape the application sandbox, capable of extracting keychain data, wallet files, and mnemonic phrases. SlowMist has linked this application to multiple theft incidents and traced nearly $580,000 worth of stolen USDT flowing into a main address.Users who have installed either version should consider the keys accessible on their iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.

SlowMist released a security warning stating that it has recently received multiple reports of FomoPeek users' assets being stolen. After a joint investigation with the OKX security team, it was found that some affected users had previously installed or used FomoPeek versions 1.1 to 1.2, which contained malicious code. SlowMist stated that there are modules in FomoPeek unrelated to normal business, one of which includes a kernel exploit framework targeting the iOS system, supporting eight different attack methods that can automatically select the exploitation method based on device model and iOS version. Affected systems include iOS 12 to 18.7 and iOS 26 to 26.1. If the exploitation is successful, the application may break through the iOS sandbox and access and decrypt Keychain data, leading to the leakage of private keys, mnemonic phrases, login credentials, and other sensitive files. In addition, FomoPeek also connects to hidden servers unrelated to its public services and can receive remote commands. SlowMist indicated that its analysis of captured plaintext traffic shows that the related attack functions are currently enabled and will run automatically on a regular basis. SlowMist recommends that users who have installed or used FomoPeek versions 1.1 to 1.2 immediately check for any anomalies in their assets, generate new private keys and mnemonic phrases on trusted devices that have never installed the application, and transfer assets to new accounts as soon as possible, while also upgrading to the latest iOS version and not continuing to use or reinstall FomoPeek.

According to Decrypt, Michael Gubbins, the head of the Criminal Assets Bureau in Ireland, revealed to the Sunday Independent that organized crime gangs are renting private vaults to store cryptocurrency wallet private keys and mnemonic phrases along with cash, luxury watches, passports, and other valuables. This situation has been reported to the government's Anti-Money Laundering Steering Committee, which is preparing to implement new EU anti-money laundering rules in Ireland.The new EU regulations will take effect next summer, prohibiting cash transactions over 10,000 euros and requiring businesses to identify individuals for cash expenditures of 3,000 euros and above. Gubbins stated that crime gangs believe cryptocurrency offers anonymity, but the use of cryptocurrency in Ireland is still quite primitive, with cash remaining the primary form of payment for criminal activities such as drug trafficking.The bureau is handling its largest cryptocurrency seizure in history, involving 6,000 bitcoins confiscated from a cannabis grower in 2019, with the private keys written on paper and hidden in a tackle box, which was later lost. With the assistance of Europol, the bureau has cracked the first of 12 wallets in March, with over 130 million euros already liquidated from assets totaling 360 million euros.