exploit

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

OpenAI stated that its upcoming Astra model can autonomously discover previously unknown software vulnerabilities and convert them into usable attack vectors without human intervention, making it the company's first model to reach the "Critical" cybersecurity capability level threshold. In a blog post released on Tuesday, OpenAI mentioned that according to its Preparedness Framework, reaching this level means the model can discover zero-day vulnerabilities and develop usable exploit code in hardened real systems without human involvement, or design and execute attacks based solely on a high-level objective.In testing, Astra achieved a 100% score in benchmark tests for developing exploit code based on known vulnerabilities and discovered two previously unknown vulnerabilities in another internal test. Additionally, the model successfully broke through a hardened browser sandbox and executed commands on the host machine, while gaining root access by exploiting multiple weaknesses in the operating system. OpenAI stated that it has delayed some of Astra's development progress to enhance security measures and plans to make its advanced cybersecurity capabilities available only to selected testers.This capability is particularly relevant to the cryptocurrency industry, as software vulnerabilities can be converted into financial losses within minutes. CoinDesk reported in June that increasingly powerful AI models can compress the process of searching code, discovering misconfigurations, and assembling attacks from days or weeks to machine speed. Security researchers noted at the time that the significant change was not the emergence of new categories of attacks, but rather the dramatically increased speed at which existing vulnerabilities are discovered and exploited.

Cronos Network officially announced that the network has resumed block production and is fully operational again. Previously, Cronos paused block production due to a vulnerability exploitation incident involving the Tectonic protocol, and validators took emergency consensus measures to protect user funds, rolling back the chain state to before the Tectonic vulnerability exploitation on August 30.The network has resumed block production at UTC time August 30, 23:49:01 from block height 90,896,189. Cronos stated that node operators can now restart their nodes using Cronos v1.7.8 and the latest mainnet snapshot.The network is currently under continuous monitoring, and some protocols, RPC service providers, block explorers, and cross-chain bridges are expected to take longer to recover. Cronos stated that the team will release a complete event review report after confirming network stability.

Enjin's ERC-1155 "Crypto Items" allows each item to route transfers through a dedicated item adapter. Attackers register and use malicious transfer adapters to bypass owner approval checks, allowing their vulnerable contracts to extract ENJ-supported items from about 52 unrelated holder wallets without approval via transferFrom.Subsequently, the attackers call melt() on each stolen item, redeeming 500 ENJ for each item from the platform's reserves.

According to CoinDesk, Chainalysis organized a multi-day operation called "Operation Lighthouse," utilizing blockchain intelligence to investigate networks disseminating child sexual abuse materials. The operation is headquartered at the National Cyber Crime Forensics and Training Alliance in New York and collaborates with global law enforcement agencies such as Europol, the Australian Federal Police, the Royal Canadian Mounted Police, and the UK's National Crime Agency.The operation investigated over 29,000 cryptocurrency addresses and digital identifiers, identified more than 100 related forums and hubs, and generated over 14,000 investigative leads, with suspects located in 125 countries, some of whom are registered sex offenders. Several cryptocurrency companies participated, including payment company Block and nonprofit organizations like the Internet Observation Foundation.Gavin Sather, Senior Project Manager for Anti-Child Exploitation at Binance, stated that the transparency of blockchain makes it difficult for criminals to hide their crimes for long periods.

The metaverse gaming platform The Sandbox confirmed that there is a vulnerability in its cross-chain bridge, allowing attackers to mint uncollateralized SAND on Base and BNB Smart Chain. Blockchain security company PeckShield discovered on August 21 that two addresses had collectively minted approximately 1.49 billion SAND, prompting The Sandbox to shut down the bridging functions for both networks.The Sandbox stated that the affected assets are those bridged on Base and BNB Smart Chain, while SAND on Ethereum and Polygon, user wallet assets, and Ethereum locked assets used to support the tokens remain unaffected. The incident involved a proportion of real collateralized assets that is less than 0.01% of the total supply of SAND. The Sandbox is formulating a compensation plan for the affected liquidity providers and advises users not to trade SAND on Base or BNB Smart Chain until the bridging function is restored.Coinbase plans to delist 10 perpetual futures contracts, including SAND, on August 26, at which time any open positions will be automatically settled.

According to the Netherlands National Cyber Security Centre (NCSC-NL), attackers are exploiting a serious authentication vulnerability CVE-2026-65400 in the macOS screen sharing feature to target Mac devices exposed to the internet. The vulnerability has a CVSS score of 9.8, allowing attackers to bypass authentication and gain system root access without valid credentials.NCSC-NL stated that multiple reports of active exploitation have been received, with the affected devices' port 5900 being directly accessible from the internet. In the currently confirmed cases, attackers have successfully obtained root access and deployed Monero (XMR) mining programs on the infected Mac devices. Apple has recently patched the vulnerability through macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Security Affairs reminds users who have screen sharing enabled and have not yet updated their systems to complete the upgrade as soon as possible; if updating is temporarily not possible, they should disable the screen sharing feature to avoid exposing port 5900 to the internet.

According to Bifrost monitoring, hackers exploited vulnerabilities in liquidity pools to steal assets worth approximately $720,000 from the vDOT single currency pool and the vASTR/ASTR and vMANTA/MANTA pools. The related assets were subsequently deposited into HitBTC and eventually flowed into Binance.Bifrost has contacted the Binance security department to submit a fund freeze application and has reported to law enforcement along with an on-chain evidence package, including transaction tracking, wallet addresses, and timestamps. Currently, Bifrost has halted all liquidity mining rewards and is conducting a comprehensive security review.

Bitcoin News posted on the X platform that BTCPay Server stated a serious vulnerability is being actively exploited, which may lead to financial loss. Users should immediately update to BTCPay Server v2.4.2; users who cannot update immediately should shut down their BTCPay Server until the update can be installed to prevent unauthorized access.

According to the Financial Times in the UK, scammers are exploiting the new EU MiCA regulations to target users who are forced to withdraw assets from unlicensed crypto platforms after the licensing deadline. The fraudsters impersonate regulatory agencies and crypto exchanges to lure users into transferring funds to fake accounts.

According to Bitcoin News monitoring, a new real-time dashboard is mapping the ongoing exploitation of the COLDCARD vulnerability in real-time. @jamesob is deploying honeypot wallets and gradually increasing additional entropy, including dice rolls and mnemonic phrases, to measure the current brute-force cracking boundaries.The control wallet with an additional entropy value of 0 was emptied in 1 hour and 18 minutes. The project's goal is to determine the types of wallets that attackers can currently crack and how this capability changes over time.

Bitcoin News posted on the X platform stating that Coinkite claims the vulnerability exists at the boundaries of two unrelated firmware submodules, rather than in its Bitcoin or crypto code, allowing it to evade manual and AI-assisted code reviews for years.Coinkite stated that after the incident, the company tested cutting-edge AI models including Kimi K3, Claude Fable, and Codex 5.6, none of which identified the flaw. Coinkite is currently urging security-critical projects to specifically audit build systems and submodule boundaries, warning that AI-assisted development may leave similar blind spots in the Bitcoin ecosystem.

According to on-chain detective Specter monitoring, Wemix Network may have experienced a vulnerability exploitation event exceeding $700,000, with the related address being 0xC921...7EA2.

According to Slow Fog monitoring, the decentralized finance protocol Lien Finance was attacked. The attacker exploited a smart contract vulnerability to mint uncollateralized bond tokens and stole approximately $542,000 USDC.Using this vulnerability, the attacker successfully minted new non-anomalous BondTokens without destroying the corresponding input bonds and exchanged USDC through a pre-authorized address, ultimately transferring about 542,144.63 USDC from the victim's address. Analysis indicates that this incident was essentially due to a validation flaw in the bond token exchange logic, allowing the attacker to bypass asset collateral constraints and mint unsupported assets.

According to the security agency Slow Fog, the malicious TRAE IDE extension juannegro.solidity disguises itself as a Solidity plugin and acts as a cross-platform malware delivery mechanism. This extension automatically executes and establishes persistence after the IDE starts, and it also uses Ethereum smart contracts to store and retrieve dynamic C2 configurations, allowing attackers to update C2 endpoints and payloads without needing to re-release the extension.Although the extension has been removed from Open VSX, it was still available through the TRAE marketplace as of July 18. Users who have installed it should immediately delete it and check their systems for compromise.

According to Decrypt, researchers from Tel Aviv University, the Technion - Israel Institute of Technology, and Intuit have discovered a new type of attack method called "adversarial illusion injection." This technique exploits the illusion phenomenon of AI models to trick AI agents into downloading malicious code and potentially forming a botnet.Attackers predict the false resource links that AI models might generate and register them in advance, embedding malicious instructions within. When the AI agent retrieves the resource, it treats it as legitimate content and executes it. Tests show that the illusion occurrence rate in code repository cloning scenarios reaches 85%, and in skill installation scenarios, it reaches 100%. AI coding assistants such as Cursor, GitHub Copilot, Gemini CLI, and OpenClaw are all affected. This attack is similar to "typo-squatting" in traditional cyberattacks, but it targets the errors of AI models rather than human input errors. Previous research has shown that malicious websites can inject prompts to hijack AI agents, and OpenClaw users have reported over 6,000 attempts to trick AI agents into leaking sensitive information.

Summer.fi released an analysis report on the Lazy Summer Protocol USDC treasury attack incident. The attacker manipulated the prices of two USDC treasury shares in a single atomic transaction, extracting approximately $6.04 million of depositor funds. The core of the attack lies in the calculation method of the treasury's net asset value (NAV).The attacker donated tokens that still retained the old valuation to a Silo Ark that had been suspended after the incident in November 2025 but had not yet been completely removed, resulting in an inflated total asset value of approximately 9.5%, raising the share price, which was then redeemed at an inflated price and withdrawn from the treasury's actual liquidity. The report emphasizes that this attack was not due to a contract code vulnerability, but rather a missing link in the treasury's offline process—the deposit limit for that Ark had been set to zero, yet it was still counted in the NAV of active assets.The attacker premeditatedly accumulated the required tokens three months in advance through multiple wallets and transferred part of the profits via Tornado Cash. After the incident, Guardian Multisig has suspended all on-chain treasuries and set the deposit limit to zero. The Lazy Summer DAO will discuss compensation plans for affected users and the treasury restart plan in the coming days.

Web3 security company GoPlus Security pointed out that there has been a recent surge in smart contract vulnerability attacks, particularly targeting older contracts that have been deployed for many years. Attackers are leveraging AI technology to quickly discover and exploit these vulnerabilities.Recent typical incidents include:On June 9, a Token of Power (TOP) contract deployed 7 years ago was attacked on Ethereum, resulting in a loss of approximately $1.5 million;On May 25, a WUSD.fi contract deployed 3 years ago was attacked, resulting in a loss of approximately $200,000;On June 14 and June 18, Aztec Network was attacked twice in a row due to an old contract deployed 2 years ago, with total losses exceeding $4 million.GoPlus Security believes that traditional auditing methods are insufficient to effectively cover legacy contracts, and adopting AI-based Always-on Audit services may be the most effective solution currently available, capable of conducting security checks on old contracts in a short period while balancing reliability and cost.

Aztec Labs stated that it is investigating a suspected exploitation incident involving its Aztec Payments product, which was launched in 2021 and is now discontinued. Approximately 2 million dollars have been transferred from the related immutable smart contracts.

According to Bits.media, the reward pool of the NovaBox platform was hacked on June 9 on Ethereum, resulting in a loss of approximately 56.73 ETH, affecting over 130 deposit users. The attacker drained the pool's funds from 65.11 ETH to 0.09 ETH in a single transaction, accounting for about 99.86%.Security company F12 stated that the incident was not due to a smart contract vulnerability, but rather a flaw in the reward distribution mechanism. The attacker borrowed 427.5 WETH through an Aave V3 flash loan, exploiting a loophole in NovaBox's mechanism of distributing dividends before updating balances when users deposit or withdraw. The hacker first deposited a small amount of NOVA tokens to trigger the dividend calculation, then deposited a large amount of ETH, significantly increasing the actual share. However, since the system did not update the balance in time, dividends were still calculated based on the previous small share, while payments were made based on the new large share, resulting in approximately 145.82 ETH of "phantom dividends," which drained the reward pool.