nvo

According to The Defiant, the Monero exchange service Wagyu has confirmed a data breach, with the leaked content involving Monero exchange order records.Cybersecurity company Hudson Rock discovered that the breach includes 4,580 orders, which associate public chain recharge transactions, Monero receiving addresses, and customer IP addresses.

According to monitoring by TrustSniffer, on October 28, the stablecoin issuer Tether centralized multiple addresses on the TRON network into a USDT blacklist. The monitoring page shows that at least 33 TRON addresses were marked as frozen on that day.The total USDT balance of the related addresses at the time of the freeze warning was approximately 27 million USD, with the largest single address being about 7.8 million USDT. Tether has not publicly explained the specific reasons for this centralized freeze.

According to the Digital Currency Research Society, on October 27, Beijing Bank released a public tender announcement for the procurement project of firewall equipment for digital currency business in 2026 through the official centralized procurement management system. Along with the previously announced procurement projects for IPS, encryption machines, WAF, SSL, signature devices, etc., the bank has officially launched a centralized upgrade of the full-chain security infrastructure for digital renminbi business, covering core security nodes such as intrusion defense, encrypted transmission, web application protection, and identity signing.In April of this year, Beijing Bank became a newly added operational institution for digital renminbi business and connected to the central bank's digital renminbi system. In August, the central bank added 8 more operational institutions, expanding the total to 30. Previously, several newly added operational institutions, such as Huishang Bank, Hangzhou Bank, and Guangxi Beibu Gulf Bank, had initiated tenders for core digital currency systems worth tens of millions. The report pointed out that Beijing Bank's inclusion of various security devices such as firewalls and encryption machines in centralized procurement is a proactive security layout to adapt to the new features of digital renminbi, such as high-concurrency transactions and programmable smart contracts.

The South Korean police have launched a preliminary investigation into the hacking incidents involving securities companies and cryptocurrency exchanges. Previously, 16 financial institutions, including KB Kookmin Bank, were also attacked by hackers, resulting in the leakage of approximately 100,000 personal information records, including ID numbers, account numbers, and addresses.The police stated that they will compare the methods used in old and new cases to verify their correlation and do not rule out the possibility that they were carried out by the same attacker.

On October 21, the payment network Visa announced three capabilities aimed at the growth of commercial cards, the security of virtual cards, and the automation of commercial payments in San Francisco, serving financial institutions, fintech companies, and enterprises. Darren Parslow, Global Head of Visa Commercial Solutions, stated that companies are accelerating the automation of payment-related tasks from identifying vendor opportunities to approving invoices and executing transactions. These capabilities are designed to provide the necessary data, security, and control.The three capabilities are SESA 2.0, Visa Commercial Fraud Solutions, and a live pilot conducted with the billing platform BILL and the accounts receivable platform Billtrust. SESA 2.0 combines AI vendor scoring, Visa commercial payment data, buyer benchmarks, and business value modeling to help identify vendors more likely to accept commercial cards and estimate growth opportunities. Visa claims that since its launch, SESA has helped financial institutions discover over $600 billion in potential cardable spending.Visa Commercial Fraud Solutions covers vendor verification, authenticating commercial virtual card users through 3-D Secure, and transaction-level controls such as spending, merchant category, location, and time. Payment controls have already been provided to eligible issuing institutions in supported countries and regions, while the other two are currently in pilot and are planned for full rollout in 2027. Visa also stated that the pilot with BILL and Billtrust has gone live, allowing trusted AI agents to initiate and assist in completing approved invoice payments through the vendor portal, using tokenized payment credentials without relying on shared vendor portal login credentials.

According to the official announcement from Foundation, regarding the recent phishing email incident, the team’s investigation found that their email system recorded over 23,000 phishing email sending attempts, of which 19,057 were sent via Mailgun, and another 1,503 were sent via Google Workspace.Due to some email accounts receiving multiple emails, and some sending attempts being unsuccessful or intercepted, it is currently not possible to confirm the actual number of affected individuals.

According to Salus monitoring, Tether has blacklisted 9 addresses related to the CoinDCX security incident and frozen 2,212,850.3 USDT.The investigation began when investigator Darcy discovered an unusual transfer of approximately 15.99 million USDT. CoinDCX co-founder Sumit Gupta initially claimed that no security breach had occurred. Subsequently, Salus raised questions based on the transfer situation of the "proof of reserves" addresses and the TRX distribution pattern, prompting the parties involved to respond and providing Tether with verifiable on-chain evidence, allowing it to take appropriate action.

Chinese national Zheng Zhao was extradited from the Netherlands to the United States and appeared in court on October 23 in the Central District of California. He is suspected of participating in an investment fraud and money laundering case involving 174 American victims, with funds exceeding $36.9 million.The U.S. Department of Justice (DOJ) stated that the fraudulent activities were operated by a scam center in Cambodia. Prosecutors claimed that over $36.9 million was transferred into an account at Deltec Bank in the Bahamas controlled by accomplices, and then exchanged for the stablecoin USDT and transferred to a digital asset wallet in Cambodia. Eight other co-defendants have pleaded guilty; Zheng Zhao faces charges of conspiracy to commit money laundering, which could result in a maximum sentence of 20 years in prison if convicted.

Slow Fog's Yu Xian posted on platform X, stating that Slow Fog's MistEye global threat intelligence hunting has discovered over 1,500 DarkSword phishing sites deployed across the internet, involving e-commerce, fake Binance, fake OKX, fake wallets, gaming, and cryptocurrency exchange businesses.

According to a notice from the U.S. Department of Justice, a Chinese citizen has been extradited for allegedly participating in a cryptocurrency fraud case targeting U.S. citizens, with the amount involved reaching millions of dollars. The man appeared in court for the first time after being extradited back to the U.S. from the Netherlands, where he is charged with participating in an international cryptocurrency investment fraud scheme.The scheme was carried out by a fraud operation located in Cambodia, with victims including 174 identified U.S. citizens. The man has been ordered to be detained; his formal arraignment is scheduled for November 30 at the federal district court in downtown Los Angeles.

Zero-Knowledge Proof Infrastructure Succinct has fixed a security vulnerability in its SP1 that could allow invalid proofs to be deemed valid.According to The Defiant, the flaw existed in the native Rust verification path from version 6.0 to 6.8.0, while on-chain Groth16 and Plonk verification executed by the Solidity verifier were not affected.

According to Bitcoin.com, the Colombian Attorney General's Office announced on Wednesday that, in coordination with U.S. intelligence agencies, it has arrested 8 individuals suspected of using cryptocurrency to launder money for drug trafficking organizations. Police and military conducted simultaneous operations in four locations: Cúcuta, Maicao, Barranquilla, and Bogotá.Among those arrested were 7 individuals, including the gang leader Guillermo Carpio Cárdenas (nicknamed "Gallo"). The U.S. District Court for the District of Puerto Rico has charged that the gang used deposit networks, cryptocurrency tokens, and small transaction splitting (smurfing) to conceal the source of drug money and evade monitoring by financial intelligence agencies.Another suspect, Nassim Orfale Vasquez, was arrested in Barranquilla and has been indicted by the U.S. District Court for the Southern District of New York. According to the IRS, he has handled over $42 million in suspicious cryptocurrency transactions since 2018, and authorities are investigating whether there are larger money laundering organizations in Colombia's coastal regions.

The White House announced that Trump invoked the Defense Production Act, listing oil exploration, production, and other activities as critical defense resources, and authorized the federal government to promote capacity expansion through procurement and funding support. Trump stated that limited financing and supply chain constraints made it difficult for businesses to meet demand, thus exempting certain requirements of the act to accelerate capacity expansion.

According to Lookonchain monitoring, in the past 24 hours, a certain whale has accumulated purchases of various tokens worth approximately 7.22 million USD, including: 378,129 LIT (approximately 1.4 million USD), 6.61 million ENA (approximately 1.34 million USD), 3 million ONDO (approximately 1.34 million USD), 1.154 million AERO (approximately 948,000 USD), 241.8 ETH (approximately 591,000 USD), 2,944 QNT (approximately 589,000 USD), 61,252 UNI (approximately 443,000 USD), 1,387 TAO (approximately 368,000 USD), and 4.33 billion PEPE (approximately 195,000 USD).

According to The Defiant, Blockaid data shows that from January to August 2026, the 60 cryptocurrency attack incidents it tracked involved approximately $1.18 billion in funds, with victims recovering about $9.8 million, accounting for less than 1%.The report pointed out that all frozen or returned funds were achieved through on-chain governance or validator actions, and the blacklist mechanism of stablecoin issuers did not recover any funds in these 60 incidents.

U.S. presidential envoy Wittekov will meet with Russian President Putin on October 21, and Trump's son-in-law Kushner will participate via video. Previously, the U.S., Ukraine, and Europe had detailed discussions on security guarantees and other aspects of a comprehensive peace framework, reaching a high level of consensus.

Tether CEO Paolo Ardoino posted on the X platform that U.S. Senator Richard Blumenthal's "analysis" of the Tether sanctions report overlooked one point: since 2023, Tether has, on average, frozen related addresses 4 weeks ahead of the formal sanctions identified by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) and the Israeli National Bureau for Counter Terror Financing (NBCTF), and in 99% of cases, the freeze was completed before Chainalysis marked the related addresses.He stated that Tether's actions have led to a 94% decrease in stablecoin trading volume related to Iran. Previously, on September 28, Blumenthal released a report from the U.S. Senate Permanent Subcommittee on Investigations, stating that among 846 sanctioned wallets related to Iran and its proxies, 84% almost exclusively used USDT for transactions, and he wrote to the U.S. Department of the Treasury and the Department of Justice requesting an investigation into Tether.

According to the official event report from UNCX Network, on October 14, attackers exploited a set of public vesting operations of Smart Token Vesting V2, creating a discrepancy between the token balance in the pool and the recorded shares, allowing the controlled positions to withdraw excess tokens.The attack affected four networks: Ethereum, BNB Chain, Base, and Robinhood, involving 10 tokens and a total of 11 confirmed withdrawal transactions, with a verified economic value of approximately $807,609, of which about $567,500 was from the BNB Chain. The involved calls did not use administrator privileges.After the incident, white hats returned 82,143,476 X tokens and 23.8682 ETH, and currently, there are no significant tokens pending disposal. UNCX stated that it is working with legal advisors to review technical evidence and subsequent handling.

According to on-chain detective Specter, ZachXBT disclosed that the Bitget attackers concealed the stolen funds through Zcash (ZEC), and other stolen funds also began to flow into ZEC, including funds from the Cryptobills Ledger incident and $12 million from the Triple-A hacker attack.Threat actors are using ZEC to transfer stolen funds.

According to CryptoSlate, Microsoft and the cybersecurity organization Health-ISAC have obtained a court order in the United States to seize and redirect the domains supporting three services: YAM Store, CoGUI, and Iron Man. These three services sell stolen accounts and phishing tools to fraudsters. Since January of this year, they have assisted in sending over 1 billion phishing messages, targeting more than 75,000 institutions across over 150 countries, generating tens of millions of dollars in revenue for the operators.Microsoft has disabled over 20,000 accounts associated with YAM Store and continues to block more than 100,000 counterfeit and fraudulent domains. According to Microsoft's investigation, these services accept payments in USDT (Tron network) and ETH, and Cloudflare stated that buyers can also use USDC for payments. Blockchain analytics company TRM Labs assisted investigators in locating and freezing related assets, but the amount frozen has not been disclosed.