stolen

The cross-chain protocol Chainflip disclosed that an attack incident targeting Tron USDT occurred yesterday. It has been confirmed that 736,442.17 USDT was stolen through 6 unauthorized payments, and an additional 115,654.41 USDT from user exchanges remains in the vault due to payment failures, while other funds were unaffected.Chainflip stated that the attacker exploited a vulnerability in the Tron transaction memo mechanism, attaching a custom memo to transactions that had already been signed by validators, causing the system to recognize the same deposit as a separate exchange and refund it again, ultimately leading to funds being paid out multiple times. The attacker executed 8 operations within approximately 90 minutes, gradually increasing the amounts. Chainflip claims to have completed a repair plan and has flagged the stolen funds to relevant authorities in an attempt to recover them, with operations expected to resume as early as Monday, and they will be responsible for compensating affected users for their losses.

Blockstream tweeted that it will not pay a ransom for the return of the stolen Bitcoin from the Liquid Network, stating that acquiring assets without authorization and refusing to return them constitutes theft, which does not fall under responsible disclosure or white hat behavior.Blockstream stated that if the stolen funds are not returned, it will cooperate with law enforcement agencies, exchanges, service providers, and forensic experts to track, recover the assets, and identify the responsible parties through all legal means, while emphasizing that Bitcoin transactions are transparent and relevant evidence will not disappear. Blockstream is the main developer and technical provider of the Liquid Network. Liquid Network stated that "approximately 4,000 BTC were taken by white hat hackers," and the sidechain has therefore suspended operations.

Cardano ecosystem project Empowa disclosed that two interconnected unauthorized asset transfer incidents occurred involving its three project wallets. Between November 2025 and June 2026, approximately 143,710 ADA was transferred out in 18 transactions from one project treasury wallet, which was also registered and claimed by unknown individuals using the private key corresponding to the Midnight airdrop, of which about 36,000 NIGHT has been transferred away.From June to August 2026, approximately 4.24 million EMP was transferred out from the other two project wallets, some of which have been sold through Minswap, VyFi, and others. Empowa stated that the funds from the two incidents ultimately flowed to the same intermediary wallet, indicating control by the same party, but the identity of the individuals operating these private keys cannot currently be confirmed. The project team has hired a professional blockchain investigation agency and plans to seek KYC information through the centralized exchanges where the relevant funds ultimately entered.

A Hyperliquid user account was unauthorizedly controlled, approximately 738,600 USDC was transferred away, and another 10,287 HYPE was unstaked. The victim account belongs to a certain address, and part of the stolen funds flowed to addresses suspected to be related to Bitget. As of the time of verification, 10,287 HYPE remains in the staked balance and has not yet entered the withdrawal queue.If the attacker continues to initiate cWithdraw, the related assets will be further transferred after a 7-day waiting period. In two recent similar cases, staked assets were stolen again due to the lack of an emergency pause mechanism that users could trigger, resulting in losses exceeding 1.1 million dollars. Related suggestions include launching a Guardian or Recovery mechanism that users can pre-enable, temporarily pausing withdrawals, transfers, and authorization changes, suspending automatic expiration, and requiring time locks and evidence review for recovery, with records on the blockchain.

On-chain investigator ZachXBT posted on X accusing user "Mr Austin Fine" (account "@xmrfine") of exchanging the stolen cryptocurrency assets of victim Malone for luxury goods in exchange for fees, stating that he "may be a whistleblower." ZachXBT indicated that until the victim is compensated, he will consider him "disassociated," which will negatively impact all current and future brand collaborations.ZachXBT later added that he has traced part of the funds on-chain flowing through Monero to purchase cars from the luxury car dealer TBTFW in Los Angeles.

Cronos confirmed in a post-mortem report that the attack on the lending platform Tectonic on August 30 involved $120.4 million in borrowing activities. The validators made the "difficult decision" to roll back the on-chain history, successfully recovering approximately $111.2 million (about 92% of the affected funds), while about $9.19 million flowed out before the network was paused and could not be recovered. The attacker leveraged weak DEX liquidity to inflate the price of Tectonic token TONIC by about 100 times within minutes and borrowed $120.4 million through a single transaction across nine markets. The validators paused the network about two hours later, restoring the chain to the last block before the suspicious activity, with block production resuming approximately 11 hours after the attack. The rollback involved reversing 1 hour and 54 minutes of on-chain history, totaling 10,961 blocks, with all transactions within that window being canceled, regardless of whether they were involved in the attack. Cronos stated that the alternative would have been to restart the network without restoring the previous state, which would have left the stolen assets in the hands of the attacker. This rollback closely followed Harmony's announcement of a similar plan, while Flow abandoned its rollback proposal last December due to community opposition. The validator cap for Cronos is 100, which facilitated quick coordination for the pause and restart, but also indicated that the network's finality in emergencies depends on validator consensus.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

According to Pie Shield citing Specter monitoring, the escrow contract of the fixed-rate lending protocol Notional Finance is suspected to have been attacked, resulting in a loss of approximately $1.7 million in DAI and USDC.The attacker subsequently exchanged the stolen funds for about 689.2 ETH and further deposited the funds into Tornado Cash. Currently, the reasons for the attack and the final scale of the losses are still pending further confirmation from the project team.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

Fogo's official announcement states that the Fogo mainnet has been restarted and is operating normally. A total of 400 million FOGO tokens were stolen in this incident, of which 237 million have been recovered and permanently removed from the total supply.The official statement indicates that they are working with centralized exchanges and law enforcement to continue recovering the remaining affected assets. The investigation is still ongoing, and further information will be released through this official channel; please rely solely on updates from this channel.

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

The sandwich attack bot operated by JaredfromSubway.eth has extracted a total of 117,007 ETH since March 2023, amounting to approximately $295 million at current prices. In June 2026, an anonymous attacker deployed 66 counterfeit token contracts, using the bot's automated trading logic to steal at least $7.5 million in ETH and stablecoins, transferring the funds to Tornado Cash; the related assets have not yet been recovered.Sandwich attacks are a form of Maximum Extractable Value (MEV): the bot monitors large transactions in the Ethereum public mempool, buys before the target transaction, and sells after the transaction drives up the price, extracting profits from the price difference. As of August 28, the main contract of the bot has received a total of 117,007 ETH.MEV-Boost block construction is concentrated among a few participants, with relay.ultrasound.money, Titan Relay, and bloXroute relays forwarding approximately 85% to 88% of the relevant blocks within a 24-hour window; Titan's builders independently assemble 50.3% of the blocks. The monthly extraction amount from sandwich attacks has decreased from about $10 million at the end of 2024 to about $2.5 million in October 2025.

The blockchain gaming platform The Sandbox stated that it will compensate users who held bridged SAND on Base or BNB Smart Chain at a 1:1 ratio before the bridge vulnerability attack, with compensation provided in Ethereum-based SAND from the project treasury, and there will be no token issuance. This attack resulted in the theft of approximately 14.744 million SAND from the Ethereum treasury, valued at about $700,000.The application process is expected to open within two weeks and will last for two weeks; over 72% of the balances held by two centralized exchanges that meet the compensation criteria will be directly compensated to affected customers. The Sandbox indicated that the attacker exploited a configuration vulnerability in the SAND contracts on Base and BNB Chain, becoming the sole validator of bridge messages and minting unbacked tokens. Additionally, over 339 trillion unbacked SAND was minted on the two networks but has been isolated and cannot be cross-chain or exchanged; SAND on Ethereum and Polygon remains unaffected, and the compromised bridge contracts will be permanently disabled.

Bitcoin News posted on the X platform stating that France disclosed this month that its tax administration department was hacked, with approximately 678,000 individuals and businesses' related data stolen. The stolen data reportedly includes names, addresses, income, and property information.An analysis of the alleged database found that 26,805 records showed incomes exceeding 100,000 euros, including 386 records over 1 million euros. According to CertiK data, in the first half of 2026, France accounted for 33 out of 52 verified cryptocurrency wrench attacks globally. French prosecutors also accused a tax department employee of using the government database to identify cryptocurrency investors and selling personal information to criminals involved in personal attacks and extortion.The latest data breach incident has no publicly linked personal attack events, but the sensitive financial and location data of hundreds of thousands of individuals may no longer be under government control.

According to on-chain detective Specter, last week there were 3 independent incidents involving over $40 million in stolen cryptocurrency, with each victim losing tens of millions of dollars. Specter stated that a large amount of funds entered the market last week, and social engineering, phishing links, and wallet theft scams continue to persist.Specter reminds that cryptocurrency is not an industry where one can simply buy assets and ignore them; asset security is part of the investment, and one should pay attention to the latest attack incidents, wallet exploitations, and phishing activities in a timely manner. If not active on crypto Twitter or security forums, one should at least follow a reliable source that continuously publishes security updates.

The cross-chain liquidity protocol Maya Protocol was attacked on August 18, with the attacker exploiting six interconnected software vulnerabilities to create false account balances, stealing approximately 20.83 BTC (about $1.34 million) and other assets, resulting in a total direct loss of about $1.65 million. The incident led to the suspension of trading on the MAYAChain network, with its token CACAO plummeting nearly 89% from $0.115 to $0.013, before recovering to around $0.03.Technical reviews show that the attack began when MAYAChain mistakenly judged a transaction to be lost and triggered a compensation mechanism, but the mechanism miscalculated, adding about 49 million CACAO to a small liquidity pool, while the protocol's reserves only held about 168,000 CACAO. After the transfer failed, the system incorrectly saved the new balance, and the attacker subsequently deposited a very small amount into the liquidity pool, acquiring over 99% of the pool's share and immediately withdrawing 48.87 million CACAO, which was then exchanged for Bitcoin, Ethereum, and other assets.The incident caused the total value of the Maya Protocol liquidity pool to decrease by about $10.9 million, of which approximately $6.4 million was due to the depreciation of CACAO, and about $2.9 million came from arbitrage trading. The team expressed hope that the attacker would return the funds in the form of a bug bounty; otherwise, they would seek to recover losses through investments in channels like Aztec Chain. Maya Protocol has not yet announced a specific time for resuming trading. This incident once again exposed the security risks within the complex logic of DeFi protocols.

Bitcoin News posted on the X platform that Prince Filip learned during his vacation that COLDCARD was hacked. As a Mk3 user, he was at risk of having all his Bitcoin stolen at any moment.

According to monitoring by Bitcoin News, new research published by @PraveenPerera shows that Coldcard attackers seem to first identify addresses with vulnerabilities, then sort them by the amount of Bitcoin held, starting to transfer in batches from the addresses with the highest holdings. The transfer software used was relatively crude.One address had 225 spendable UTXOs, and the attackers extracted exactly the latest 200, leaving the earliest 25, which included a UTXO worth 0.16 BTC. This aligns perfectly with the limitation of a blockchain API investigated by researchers, which defaults to returning 200 records, indicating that the attackers may have failed to load the next page of data. The software even spent a UTXO of 294 satoshis, reportedly increasing the transaction fee by about 2040 satoshis, with the spent amount significantly higher than the value of the UTXO itself.The authors of the study believe that the builders of this tool may have a better understanding of the account balance system than of the Bitcoin UTXO model. Although the attackers seem to have obtained the complete seed of the victims, at least 75 BTC still remain in other addresses derived from the same seed. The biggest suspicion currently is that among the 153 stolen addresses, there are still 132.95 BTC, and researchers have been unable to reproduce the seed behind these addresses, so it cannot be ruled out that the attackers obtained undisclosed private device data or candidate data.