attacks

In a threat intelligence report released on Thursday, Anthropic stated that Russian and Chinese users are leveraging its AI model Claude to automate cyberattacks. Among them, a Russian operator codenamed "JackPoterz" has automated most parts of the attack chain through a customized AI-driven workflow, targeting over 20 organizations, including government departments and intelligence agencies, as well as embassies and diplomatic missions in Ukraine and several European countries.Chinese users are using Claude as the engineering and orchestration layer for vulnerability research, with one workflow producing more than a dozen potential zero-day vulnerabilities in network device firmware within a month. Anthropic pointed out that AI is changing the economics of cyberattacks, allowing a single operator to complete an intrusion in two to three hours and handle dozens of victims in parallel.Additionally, the report revealed that a suspected independent consultant based in Bamako, collaborating with Mali's national intelligence agency, has used Claude as the primary engineering force to build a large-scale domestic surveillance system covering approximately 25 million SIM cards across all three mobile operators in the country. This system is locally deployed and operates using local models, with software design and engineering support provided by Claude, enabling the generation of intelligence profiles on phone numbers without the need for court warrants.

According to CoinDesk, the latest paper released by researchers from institutions such as Theta Labs, the Ethereum Foundation, and StarkWare shows that the resources required for potential quantum attacks on Bitcoin (BTC) and Ethereum (ETH) have decreased by more than 50% compared to the estimates previously published by Google's quantum artificial intelligence team.The quantum circuit design proposed in the study requires only about 1,151 logical qubits and uses approximately 1.3 million Toffoli gate operations to complete the relevant calculations, with a comprehensive score of about 1.5 billion, lower than the approximately 3 billion level previously published by Google.The research primarily optimized the point addition calculation in Shor's algorithm, which theoretically can use sufficiently powerful quantum computers to derive private keys from public keys. Jieyi Long, one of the main authors of the paper and CTO of Theta Labs, stated that quantum attacks are not imminent at the moment, but transitioning to quantum resistance will take years, and remediation cannot be done after an attack occurs.

PeckShield data shows that in August 2026, the cryptocurrency industry experienced 50 major hacking attacks, an increase of 67% compared to July; losses decreased to $136.3 million, a drop of 49.5%. Among them, Tectonicfi lost approximately $74 million, and after Cronos suspended its network, only about $6 million was transferred out.Digital asset security company AEREDIUM launched AERSeal, which aims to replace the single private key controlling privileged smart contract functions with a multi-party authorized threshold signature. This product stores key shares in hardware-certified secure isolated environments and supports Ethereum Virtual Machine and compatible chains. AERSeal does not reconstruct the complete private key but generates signatures through the CGGMP24 threshold signature protocol. AEREDIUM founder and CEO Albert Dadon stated that the product can delegate permissions for minting, upgrading, and other functions to the threshold key, and confirm the transfer completion through on-chain verification; customers can also independently verify the allocated threshold key.

According to CoinDesk, after the U.S. military intensified airstrikes on Iranian targets, Brent crude oil surpassed $93 per barrel, and WTI approached $90 per barrel, pushing the 10-year U.S. Treasury yield up to nearly 4.8%. Risk assets are under pressure, with Bitcoin briefly dropping below $76,500, down more than 1% from midnight, and a nearly 3% correction over the past week.In terms of derivatives, Coinglass data shows that the long-short taker transaction ratio shifted to favor short positions, accounting for about 51.5%, while the overall open interest remained at around 700,000 BTC, indicating that leverage has not significantly increased. The open interest in ETH futures slightly rose alongside a price drop, interpreted as a buildup of short positions. UNI continued to rise, while TRX short positions remained crowded, and the implied volatility of BTC and ETH fell back to previous levels.

Zhao Changpeng recently commented on the emotional and property disputes related to Sun Yuchen, stating that while aggressive marketing can be acceptable, there is no need to use the incident for personal attacks or to affect others' future career development. Instead of disclosing unnecessary details, it is better to resolve the matter directly through legal means. He hopes both parties can handle it properly and respect each other.Zhao Changpeng then added that the cryptocurrency industry should set higher standards for itself. In response, Sun Yuchen expressed agreement, stating, "Mutual respect, proper resolution, and leave the rest to the court; I won't say more."

Mediterranean Shipping Company (MSC) has suspended its Black Sea route service to Russia due to a drone attack.

According to CoinDesk, Ethereum researchers have proposed rebuilding the validator deposit contract to support a new cryptographic system and ultimately stop accepting deposits protected by the existing BLS signatures. This proposal targets the deposit contract, aiming to add a switch that prevents the network from accepting the currently relied-upon signature format.Currently, the contract only accepts BLS keys because their exact size is hardcoded, while the new draft allows for different key sizes, with each deposit tagged by the cryptographic system used, where BLS receives a tag of zero, reserving space for future schemes.If the proposal is approved, it will initially operate with BLS deposits, while other schemes can be registered simultaneously. Future decisions may permanently disable new BLS deposits, at which point validators who have staked using BLS keys will not disappear, but new validators will not be able to join using this method. Ethereum will ultimately need to change separately to inform validators how to check new signatures. This is part of the migration for validators, while another part is already in progress—EIP-8141 framework transaction proposals will allow regular Ethereum accounts to change the cryptographic method for approving transactions without changing their address.The urgency stems from research released in March by Google's Quantum AI research department, which outlined five quantum attack paths against Ethereum, putting over $100 billion in assets at potential risk. The Ethereum Foundation is advancing core protocol changes with a target around 2029. Currently, the amount of ETH staked in Ethereum is approximately 42.4 million, valued at about $10.4 billion.

According to Bloomberg, Kraken stated that some customers were temporarily unable to access their accounts after receiving tiny amounts of cryptocurrency from wallets associated with the sanctioned competitor HTX. Kraken referred to these transfers as "dust attacks," believing their purpose may be to trigger compliance reviews on the platform by spreading sanctioned funds.Data from Etherscan and Arkham Intelligence shows that from August 17 to 24, the wallet sent nearly 12,000 small transfers to addresses related to Kraken, most of which were worth only a few cents or a few dollars.Kraken stated that it has restored account access for affected customers while continuing to withhold the relevant sanctioned funds as required and is cooperating with authorities to limit the impact. HTX denied initiating these transfers and stated that it is investigating, with possible reasons including source identification errors or malicious activities by third parties.

According to Bloomberg, the Taiwanese research institution TeamT5 stated that the scale of cyberattacks linked to China has significantly increased after incorporating DeepSeek and other open-source AI models into their operations. Since they began delegating daily tasks to AI and using it to develop more advanced malware, the number of attacks carried out by the relevant organizations has more than doubled.Researchers noted that it is not always possible to accurately identify the specific AI models used by attackers, but products related to DeepSeek are popular among hacker groups in the country due to their high performance and ease of customization. The report indicates that experienced attackers are leveraging relatively limited AI tools to scale up their operations and achieve breakthroughs, highlighting the attackers' ability to use basic AI tools to target overseas objectives.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

The cryptocurrency wallet Rabby Wallet posted on platform X that the team has fixed a vulnerability after discovering it and released an update on August 11. The mobile application is not affected.The conditions that triggered the vulnerability are extremely limited: the wallet must be connected to a malicious website, and the user must manually set the auto-lock timer to 10 minutes (other settings are not affected). No exploitation in the wild has been found so far.

According to the monitoring by the head of Galaxy Research, attacks targeting Coldcard are still ongoing. Users who continue to use Coldcard should remain vigilant and verify their device settings.They continue to assist victims and gather intelligence about the attackers, and they express hope that victims seeking help to track stolen funds can contact them via private message.

On-chain detective Specter posted on the X platform, stating that considering the time period covered by the stolen data, this could mean that the data breach occurred as early as April, and no later than early May. However, the parties involved chose to remain silent until recently, roughly at the same time Trezor announced its own data breach.Some users had already received phishing attacks and suffered asset losses at that time, but the parties involved did not maintain transparency, warn users, or provide risk alerts, instead denying the data breach.

The French Minister of Finance confirmed that hackers breached the French Public Finance Directorate system at the end of June and stole personal and corporate taxpayer data. According to the platform FrenchBreaches, which tracks cyberattacks in France, this incident affected approximately 678,437 people, equivalent to about 1% of the French population, but the exact number is still under investigation and has not been finally confirmed.The leaked data reportedly includes sensitive information such as names, birth dates, home addresses, phone numbers, email addresses, tax identification information, and income data. Among them, nearly 27,000 individuals had tax incomes of at least 100,000 euros, 386 exceeded 1 million euros, and another 8 exceeded 10 million euros. Reports indicate that the database has been sold on the dark web market for thousands of euros. The attackers, calling themselves ZeroBytes, claimed they extracted the relevant records using an internal search tool, which was only discovered later when access was cut off.This incident has raised concerns in the cryptocurrency industry, as there has been a noticeable increase in "wrench attack" violent robbery incidents targeting cryptocurrency holders in France in recent years. If high-income individuals' addresses and contact information are leaked, it could provide criminals with a more precise target list.

According to the monitoring by the head of Galaxy Research, it has communicated with over 190 victims of Coldcard vulnerability attacks and has asked victims who have not yet contacted them to reach out via private message so that they can provide tracking information and assist in reporting losses to the relevant authorities.Since August 6, no new attack incidents have been confirmed, but this does not mean that new attacks will not occur, and vigilance is required.

According to Bitcoin News, Boltzhq has shut down due to its five-person team being overwhelmed by increasingly complex AI-assisted attacks. A group of experienced Bitcoin users will take over the service with additional capital and engineering resources.The founder has stepped down. The service is currently still offline, and the new team is working to restart it.

According to Bitcoin.com, cybersecurity company Genians Security Center has released an analysis report stating that the North Korean Reconnaissance General Bureau's hacker organization Kimsuky is building and testing a set of AI-based cyber attack tools. Researchers found traces of the deployment of three local AI platforms: Ollama, GPT4All, and Msty, as well as components of AI development frameworks such as Microsoft Semantic Kernel and LLaMaSharp in their infrastructure, indicating that the organization is systematically developing dedicated AI attack tools rather than just making temporary attempts.Since early 2026, Kimsuky has been using high-quality documents generated by generative AI for spear-phishing attacks targeting virtual assets, financial investments, and game development. The AI-generated professional documents significantly reduce the effectiveness of traditional phishing email detection. The attack vector is a ZIP archive disguised as a legitimate document, containing a malicious LNK file that, when triggered, can silently execute PowerShell commands in the background.

Iranian President Ebrahim Raisi stated that the United States and Israel are using artificial intelligence data to attack Iran.

According to The Block, Immunefi's latest data shows that the cryptocurrency industry lost approximately $110 million due to hacker attacks in July.During the same period, the platform paid researchers $2.32 million for confirmed vulnerability reports, with the number of confirmed and completed bounty reports increasing by 18% month-over-month.The report indicates that its audit competitions can average 6.2 critical vulnerabilities per event, compared to 1.5 for first-level audits; in July, a total of 374 threats were mitigated through the bounty program.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.