exploit

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

According to Bitcoin News, researchers claim that Tailscale has a serious vulnerability, where users with approved access can exploit its built-in SSH to gain root access to devices, and the attack may spread to other devices on the network.Users running nodes with Tailscale should disable Tailscale SSH and update promptly after the patch is released. Tailscale has not yet responded.

According to BlockSec monitoring, a suspicious transaction by X100 Global on Ethereum resulted in a loss of approximately 4.75 million USD, with the related attack stemming from a vulnerability in the governance mechanism design: the attacker used a flash loan to borrow funds to purchase X tokens, allocated the tokens to two controlled contracts, and then deposited them into the Freezer, thereby controlling 2 out of 3 senator seats in the same transaction, and subsequently immediately passed and executed a malicious treasury proposal.Specifically, the attacker first created and provided liquidity to the X-USDT trading pool on PancakeSwap V3, then used the obtained majority governance seats to approve the exchange of 400,000 X tokens into that trading pool, setting the minimum output amount to 0, ultimately receiving only about 35.68 USDT. Subsequently, the attacker withdrew liquidity, sold part of the recovered X tokens through the existing Uniswap V3 X-USDT trading pool, and repaid the flash loan.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

Bitcoin core developer Antoine Poinsot announced an adjustment to the security vulnerability disclosure policy in the Bitcoin development mailing list. He stated that in the past, vulnerabilities were often kept secret for a long time to allow users to complete upgrades before details were made public, but this also led to fixes not being backported to older versions, requiring users to wait for the next major release. Poinsot pointed out that large language models make some vulnerabilities very easy to rediscover, and the protection that continued delays in fixing can provide is now quite limited.According to the new policy, vulnerabilities deemed "easy to discover" will be fixed as soon as possible in all maintained major versions, with security announcements released simultaneously. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through simple LLM prompts. Other vulnerabilities will still follow the disclosure timeline based on severity: low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium to high-severity vulnerabilities will be disclosed two weeks after the last affected version reaches its end of life (usually one year after the fix is released in a new major version). Critical vulnerabilities are not covered by the standard policy and may require ad hoc procedures.Bitcoin ecosystem security researcher Luke de Wolf stated that he previously disagreed with Poinsot's security strategy but believes this update is a good adjustment. In August of this year, the volunteer-based Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with only about one-fifth being reproducible at that time. In the same month, Core Lightning developers urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports, while keeping technical details confidential for two weeks.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

The XRP Ledger recently fixed a payment system vulnerability that could be traced back to 2015. This vulnerability could allow attackers to bypass the system's calculation limits on token exchange amounts through a specially designed payment transaction, generating and spending large amounts of XRP out of thin air, undermining the mechanism that caps the total supply of XRP at 10 billion.It was disclosed that attackers could create hundreds of accounts, allowing these accounts to post offers to exchange a small amount of tokens for a large amount of XRP, and then execute a transaction simultaneously. Due to a flaw in the software's calculation of the total transaction amount, the seller's account could receive the full XRP, while the buyer's account would need to pay almost nothing. Researchers Cayden Liao and Veria AI reported the vulnerability on September 22, and RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network. The development team released version 3.4.1 of xrpld on September 25 to fix the vulnerability.

Security company CertiK's analysis shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker taking away 200 ETH, worth over $500,000. CertiK stated that the root cause was the lack of access control for the 0x8804d1de function in the keeper implementation contract.This contract was involved in the "Black Thursday" liquidation crisis in March 2020, when it won ETH with zero bids, with four transactions of 50 ETH each remaining unsettled. The attacker took this batch of funds and transferred them out in amounts of 10 ETH each via Tornado Cash. Although this contract is not currently a core part of the Sky ecosystem, old contracts with remaining funds may still become targets for attacks.

Immunefi Security Chief Gonçalo Magalhães stated that an unnamed Base treasury suffered a vulnerability exploit of approximately 6 million dollars, while there were still about 31.7 million dollars in assets within the treasury at the time of the incident.According to the briefing, the attacker added a malicious contract to the treasury's lending whitelist through a Safe multi-signature wallet, subsequently withdrawing 1,783 aBaswstETH, which were then exchanged for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães pointed out that the whitelist's restricted addresses appeared secure, but approved addresses could withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remedial measures.

The Chief Information Security Officer of Slow Fog Security, 23pds, stated that Alex Shevchenko, the General Manager of NEAR Intents, indicated that the exploiters of the NEAR Intents vulnerability transferred 1 BNB to the recovery wallet and left a message expressing willingness to cooperate and requested the other party to provide a Signal contact.This transfer came from the same address that previously moved approximately 3.8 million USD. About an hour ago, that address also transferred 0.295 ETH on the Ethereum network and sent the same message.

According to Law360, the cryptocurrency asset theft case involving Uranium Finance has begun trial in the U.S. District Court for the Southern District of New York.Prosecutors allege that Maryland cybersecurity consultant Jonathan Spalletta exploited a vulnerability in the protocol's smart contract to launch an attack in 2021, during which approximately $53.3 million was transferred from 26 liquidity pools in a second attack, leading to the protocol ceasing operations. The statements related to this are allegations by the prosecution and not a conclusion of guilt.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

According to the monitoring by the head of Galaxy Research, the Coldcard white hat funds will come from the merger of 52.37 BTC from Wave 2, Footprints AA, AU, and AX into a new address, which recorded the OP_RETURN message "claim:cryptorecoverytrust dot com" in block number 967,948.These white hat funds account for 2.8% of the Coldcard vulnerability attack funds.

Binance Wallet Security Announcement: iPhone users please check if you have installed the FomoPeek application. Binance has noted a recent security incident disclosed by the community. According to security companies such as SlowMist, the third-party application FomoPeek (versions 1.1-1.2) contains malicious code that can exploit vulnerabilities in the iOS system to gain maximum permissions on the device and may access sensitive data stored on the device, including private keys, mnemonic phrases, login credentials, chat records, files, etc. Please note that such malware directly attacks the device itself. If the attack is successful, all application data on the affected device may be accessed.Please check the following:Are you using an iPhone or iPad running iOS 26.x or earlier?Have you installed the FomoPeek application?If both of the above apply to you, it is recommended to take the following steps immediately:Delete the FomoPeek application and do not reinstall it.Update the iOS system to the latest version.For users with self-hosted wallets: Create a new wallet on a device that has never installed the application and transfer assets to the new wallet address.If you notice any unusual asset activity, please retain the affected device and relevant evidence, and contact customer service for further investigation.At the same time, all users are reminded: Do not install applications from untrusted sources and keep your device software up to date.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

According to SlowMist monitoring, a Brazilian banking malware operation, active since at least May 2025, known as REF9334, has recently been disclosed. Its KREMLIN malware ecosystem uses a multi-stage loader and malicious browser extensions to steal credentials, session tokens, and sensitive data. The malicious extensions can be installed into Chrome and Edge without user approval by bypassing the Chromium integrity mechanisms, including Secure Preferences, HMAC, and App-Bound encrypted hashes.The operation also uses Ethereum smart contracts as "dead letter parsers" to dynamically update C2 endpoints and payload hosting locations. After registering the network Canary domain name, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. SlowMist recommends that security teams monitor related malware, browser extension activities, and infrastructure associated with this operation.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

OpenAI stated that its upcoming Astra model can autonomously discover previously unknown software vulnerabilities and convert them into usable attack vectors without human intervention, making it the company's first model to reach the "Critical" cybersecurity capability level threshold. In a blog post released on Tuesday, OpenAI mentioned that according to its Preparedness Framework, reaching this level means the model can discover zero-day vulnerabilities and develop usable exploit code in hardened real systems without human involvement, or design and execute attacks based solely on a high-level objective.In testing, Astra achieved a 100% score in benchmark tests for developing exploit code based on known vulnerabilities and discovered two previously unknown vulnerabilities in another internal test. Additionally, the model successfully broke through a hardened browser sandbox and executed commands on the host machine, while gaining root access by exploiting multiple weaknesses in the operating system. OpenAI stated that it has delayed some of Astra's development progress to enhance security measures and plans to make its advanced cybersecurity capabilities available only to selected testers.This capability is particularly relevant to the cryptocurrency industry, as software vulnerabilities can be converted into financial losses within minutes. CoinDesk reported in June that increasingly powerful AI models can compress the process of searching code, discovering misconfigurations, and assembling attacks from days or weeks to machine speed. Security researchers noted at the time that the significant change was not the emergence of new categories of attacks, but rather the dramatically increased speed at which existing vulnerabilities are discovered and exploited.

Cronos Network officially announced that the network has resumed block production and is fully operational again. Previously, Cronos paused block production due to a vulnerability exploitation incident involving the Tectonic protocol, and validators took emergency consensus measures to protect user funds, rolling back the chain state to before the Tectonic vulnerability exploitation on August 30.The network has resumed block production at UTC time August 30, 23:49:01 from block height 90,896,189. Cronos stated that node operators can now restart their nodes using Cronos v1.7.8 and the latest mainnet snapshot.The network is currently under continuous monitoring, and some protocols, RPC service providers, block explorers, and cross-chain bridges are expected to take longer to recover. Cronos stated that the team will release a complete event review report after confirming network stability.