attackers

According to the official statement from Osmosis, the proposal for the solution regarding the previous Nomic chain nBTC incident is now online and has officially entered community discussion.According to the proposal, the Osmosis governance community will consider confiscating the previously frozen assets of the attacker and using the accumulated BTC in the community fund pool to cover the remaining collateral gap, in order to restore the full collateral support for Alloyed BTC. Currently, this plan still needs to go through governance discussion and voting, and the asset confiscation or collateral replenishment has not yet been completed.

The official announcement from the Ton Network DePIN project PinGo states that the project has once again encountered a cyber attack, and the attackers have sold some of the involved tokens. Currently, the PinGo team has completed the consolidation of on-chain assets and is actively addressing this security incident.It is reported that Gate has temporarily suspended the recharge of PinGo tokens. The PinGo team stated that they will continue to disclose subsequent information based on the progress of the incident. As a result of the incident, the price of PINGO briefly surged by 70%, with the current quote at 0.03 USD.

Self-proclaimed "white hat hackers" extracted about 4,000 BTC from Liquid Network and have returned 3,400 BTC (approximately $269.2 million) to the federal wallet of the sidechain on Monday, recovering about 85% of the funds. The incident began on Sunday when a customer sent 4,000 L-BTC to SideSwap's peg-out service. The attackers claimed to be "white hat hackers" through Bitcoin transaction messages and demanded that the vulnerability be fixed first. Blockstream then sent a signed message stating that "the bridging node has been patched and funds can be safely returned," after which the attackers transferred the funds. Nevertheless, about 598.5 BTC (approximately $47 million) remains in the related address. Ledger's Chief Technology Officer Charles Guillemet expressed skepticism about the "white hat" claim, stating that if this were a negotiated reward under on-chain crypto contracts, it looked more like extortion. Liquid has disabled the bridging nodes and requested exchanges to suspend L-BTC deposits and withdrawals, but has not yet announced a plan for handling the remaining funds or when normal operations will resume.

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

According to Onchain Lens monitoring, Avici was attacked, resulting in a total loss of approximately $1.02 million. The attacker transferred 10,000 SOL to another wallet and exchanged it for about 1.02 million USDC, then transferred it through a cross-chain bridge and exchanged it for approximately 418 ETH.

Solana's new bank Avici is facing ongoing attacks, with attackers having stolen over $1 million from users. The attackers' wallet holds 10,005.03 SOL (approximately $1.07 million) and about $11,600 in USDC and USDT. The attack method involves first calling the SubmitSignatures of the Avici authorization program, then calling the AddCollateralAdmin of the collateral program, and finally executing WithdrawCollateralAsset to withdraw the balance. Both of Avici's programs are upgradable and share the same standard Solana account instead of multi-signature upgrade permissions.Avici confirmed the incident 1 hour and 53 minutes after the first theft transaction, stating, "We are aware of the issue affecting card balance withdrawals and are working directly with all relevant partners to resolve it." Prior to this, users had reported stolen balances on social media. A real-time tracker established by anonymous on-chain analyst STACC recorded 125 different sending accounts, with transfer amounts ranging from approximately 9 USDC to over 26,000 USDT.As a result, the AVICI token fell 49.4% in 24 hours to $0.2175, with a market cap of approximately $2.84 million, hitting an all-time low. Avici raised funds through MetaDAO in October 2025, with an original cap of $3.5 million, but the final committed amount reached $34.2 million, and the team refunded 89.8% of the committed USDC.

Enjin's ERC-1155 "Crypto Items" allows each item to route transfers through a dedicated item adapter. Attackers register and use malicious transfer adapters to bypass owner approval checks, allowing their vulnerable contracts to extract ENJ-supported items from about 52 unrelated holder wallets without approval via transferFrom.Subsequently, the attackers call melt() on each stolen item, redeeming 500 ENJ for each item from the platform's reserves.

Bubblemaps posted on platform X that attackers exploited a vulnerability in the Cosmos EVM shared module to steal $50 million worth of NES tokens, but ultimately only profited about $60,000. Previously, Cosmos Labs reported security vulnerabilities in its shared Cosmos EVM software, affecting multiple chains built on this module, including Nesa.According to disclosures, the main attacker with an address starting with 0x9AE7 previously spent $250,000 to purchase NES and cross-chain to Nesa Chain, then exploited the vulnerability to inflate the account balance by 200 times and transferred $50 million NES back to Ethereum, with the initial funds coming from Monero. The attacker then dispersed the tokens to multiple wallet addresses, exchanged NES for ETH on a DEX, and deposited the profits into a centralized exchange.Due to the rapid withdrawal of funds from the liquidity pool, most of the attacker’s exchange transactions encountered severe slippage, resulting in an actual expenditure of $255,000 to initiate the attack, cashing out only $315,000, with a net profit of about $60,000.Bubblemaps stated that although another Cosmos EVM chain had also suffered a similar attack of $1.4 million the day before, the differences in funding sources and operational methods suggest that the two incidents may have originated from different attackers. The report also mentioned that the price of NES tokens once plummeted by 90%, but has since significantly rebounded, with the team believing that the rebound is mainly due to arbitrage activities caused by price mismatches between DEX and CEX after the attack.

According to monitoring by PeckShield, the Term Labs attacker's address deposited 300 ETH into Tornado Cash, worth approximately $741,000.

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.

According to on-chain detective Specter, the attacker exchanged all assets including WBTC, cbBTC, LDO, USDS, and CRV for DAI and ETH. The same wallet was previously hacked in September 2023 due to malicious token authorization, resulting in a theft of 24.23 million USD, with the attacker ultimately returning about 90% of the stolen funds. The attacker's address is 0x8fEB...F95Ae.

According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) software after attackers exploited a serious vulnerability to obtain credentials and transfer funds.BTCPay stated that this restriction prevents external wallets like Zeus from connecting through the BTCPay Server domain. BTCPay mentioned that Lightning payments can continue, and they plan to restore remote access options when they deem it safe.

According to Onchain Lens monitoring, addresses related to the Solana OG attackers (0xd229...9D15, 0x501...f051) transferred 2,290 ETH to Tornado Cash, worth 4,390,000 USD.This operation occurred nearly a month after the involved $14.2 million attack incident; the same address cluster also used Tornado Cash two weeks ago.

Bitcoin News posted on the X platform that new community honeypot tests show that attackers are still prioritizing wallets that are most easily exploited due to the Coldcard Mk3 RNG vulnerability.Researcher @ColeTU injected funds into 5 affected Mk3 wallets: 1 using only the vulnerable mnemonic, 3 protected by BIP39 passphrases of 1, 2, and 3 words respectively, and another using a random account number. After 14 hours, only the unprotected wallet using just the mnemonic had its funds transferred away. According to @jamesob's real-time tripwire dashboard, currently only 2 out of 17 honeypot wallets have been emptied. The emptied wallets have been confirmed not to have added extra entropy, while all wallets protected by dice rolls, passphrases, multisig, or other complexities remain untouched.The test results indicate that attackers are currently focusing on the wallets that are easiest to brute-force rather than investing resources in strengthening targets, but affected users should still migrate their funds immediately instead of relying on temporary protections.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

According to Bitcoin News monitoring, a new real-time dashboard is mapping the ongoing exploitation of the COLDCARD vulnerability in real-time. @jamesob is deploying honeypot wallets and gradually increasing additional entropy, including dice rolls and mnemonic phrases, to measure the current brute-force cracking boundaries.The control wallet with an additional entropy value of 0 was emptied in 1 hour and 18 minutes. The project's goal is to determine the types of wallets that attackers can currently crack and how this capability changes over time.

Galaxy Research Director Alex Thorn stated that the attack incidents surrounding the Coldcard wallet are still evolving, with more small attackers and imitators emerging, targeting the remaining Coldcard recovery phrases.Alex Thorn mentioned that by assisting in confirming the identity of a user whose deposits were involved in the attack, the related funds had already been transferred out before they could be frozen on the Duel platform, and the funds involved do not belong to the three main waves of attacks previously identified by Galaxy Research.Previously, the Bitcoin hardware wallet Coldcard was attacked, and the stolen funds have risen to 1367.05 BTC, worth approximately 8.86 million USD, involving 4585 addresses. Galaxy Research Director Alex Thorn stated that the attacks are still ongoing, and users who have not yet migrated their funds should immediately transfer their assets out of the addresses generated by Coldcard.

According to monitoring by Bitcoin News, Chainalysis stated that an analysis of the Coldcard exploit event involving over $38 million shows that the attackers deliberately targeted the highest value wallets, including one holding $1.8 million, indicating that the victims had been profiled before the asset transfers began. Approximately $30 million was stolen in the first 10 minutes, and then about 500 wallets were emptied within 25 minutes.Clay Garrett from Block stated that investigators also confirmed that the attackers used a paid account from a well-known blockchain service provider to query the victims' addresses during the operation. The provider's internal logs matched the request times and order, but Block stated that no evidence was found indicating that the company knowingly assisted in the theft. Relevant information has been shared with the authorities.