exploitation

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

Bitcoin core developer Antoine Poinsot announced an adjustment to the security vulnerability disclosure policy in the Bitcoin development mailing list. He stated that in the past, vulnerabilities were often kept secret for a long time to allow users to complete upgrades before details were made public, but this also led to fixes not being backported to older versions, requiring users to wait for the next major release. Poinsot pointed out that large language models make some vulnerabilities very easy to rediscover, and the protection that continued delays in fixing can provide is now quite limited.According to the new policy, vulnerabilities deemed "easy to discover" will be fixed as soon as possible in all maintained major versions, with security announcements released simultaneously. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through simple LLM prompts. Other vulnerabilities will still follow the disclosure timeline based on severity: low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium to high-severity vulnerabilities will be disclosed two weeks after the last affected version reaches its end of life (usually one year after the fix is released in a new major version). Critical vulnerabilities are not covered by the standard policy and may require ad hoc procedures.Bitcoin ecosystem security researcher Luke de Wolf stated that he previously disagreed with Poinsot's security strategy but believes this update is a good adjustment. In August of this year, the volunteer-based Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with only about one-fifth being reproducible at that time. In the same month, Core Lightning developers urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports, while keeping technical details confidential for two weeks.

According to The Defiant, THORChain announced that its v3.21 upgrade will fix the FIN contract vulnerability on Rujira and allow the previously paused application layer to restart. The network has set the upgrade target at block height 28,366,100, with an expected time around October 23. After the restart, trading, lending, borrowing, and automated trading on Rujira will resume. Rujira's products run through smart contracts within THORChain, rather than on an independent blockchain, and the application layer can pause these contracts without affecting the underlying layer of THORChain.According to Rujira, the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding a position. The team paused the application layer with the support of node operators, and only one position from the Rujira team itself was affected, with no loss of user funds. Rujira attributed the vulnerability to a flaw in the position transfer function, rather than the trading logic of the liquidity strategy. On September 27, Rujira stated that the fix is located at the underlying layer and has been scheduled for the v3.21 upgrade.Regarding the restart window, Rujira proposed a conditional grace period in its plan on October 15: if the application layer is ready to resume, any credit account position with a loan-to-value ratio above 100% and meeting liquidation conditions will request node operators to pause the credit account contract for an additional 24 hours, allowing borrowers to replenish collateral before liquidation resumes. Borrowers can replenish collateral through Rujira Borrow or by directly transferring assets to the credit account address. Rujira indicated on October 10 that positions still deemed unsafe after the grace period may be liquidated when the liquidator triggers the process.

According to the security agency Blockaid, the token vesting pool of UNCX was attacked, resulting in a loss of approximately $86,000.The attack transaction involved a total of five different tokens, and the affected Ethereum contract currently still holds about $3.25 million in assets.

Immunefi Security Chief Gonçalo Magalhães stated that an unnamed Base treasury suffered a vulnerability exploit of approximately 6 million dollars, while there were still about 31.7 million dollars in assets within the treasury at the time of the incident.According to the briefing, the attacker added a malicious contract to the treasury's lending whitelist through a Safe multi-signature wallet, subsequently withdrawing 1,783 aBaswstETH, which were then exchanged for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães pointed out that the whitelist's restricted addresses appeared secure, but approved addresses could withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remedial measures.

According to CoinDesk, Chainalysis organized a multi-day operation called "Operation Lighthouse," utilizing blockchain intelligence to investigate networks disseminating child sexual abuse materials. The operation is headquartered at the National Cyber Crime Forensics and Training Alliance in New York and collaborates with global law enforcement agencies such as Europol, the Australian Federal Police, the Royal Canadian Mounted Police, and the UK's National Crime Agency.The operation investigated over 29,000 cryptocurrency addresses and digital identifiers, identified more than 100 related forums and hubs, and generated over 14,000 investigative leads, with suspects located in 125 countries, some of whom are registered sex offenders. Several cryptocurrency companies participated, including payment company Block and nonprofit organizations like the Internet Observation Foundation.Gavin Sather, Senior Project Manager for Anti-Child Exploitation at Binance, stated that the transparency of blockchain makes it difficult for criminals to hide their crimes for long periods.

According to on-chain detective Specter monitoring, Wemix Network may have experienced a vulnerability exploitation event exceeding $700,000, with the related address being 0xC921...7EA2.

Summer.fi released an analysis report on the Lazy Summer Protocol USDC treasury attack incident. The attacker manipulated the prices of two USDC treasury shares in a single atomic transaction, extracting approximately $6.04 million of depositor funds. The core of the attack lies in the calculation method of the treasury's net asset value (NAV).The attacker donated tokens that still retained the old valuation to a Silo Ark that had been suspended after the incident in November 2025 but had not yet been completely removed, resulting in an inflated total asset value of approximately 9.5%, raising the share price, which was then redeemed at an inflated price and withdrawn from the treasury's actual liquidity. The report emphasizes that this attack was not due to a contract code vulnerability, but rather a missing link in the treasury's offline process—the deposit limit for that Ark had been set to zero, yet it was still counted in the NAV of active assets.The attacker premeditatedly accumulated the required tokens three months in advance through multiple wallets and transferred part of the profits via Tornado Cash. After the incident, Guardian Multisig has suspended all on-chain treasuries and set the deposit limit to zero. The Lazy Summer DAO will discuss compensation plans for affected users and the treasury restart plan in the coming days.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has monitored and found that attackers are using exploit tools targeting Apple Inc.'s terminal products to carry out cyber attack activities, which can lead to serious harms such as information theft and system control. The affected range includes Apple terminal products such as iPhone and iPad running iOS 13 to 17.2.1.Attackers induce users to use the Safari browser to visit web pages containing malicious code through methods such as SMS, email, or web poisoning, comprehensively utilizing security vulnerabilities present in the terminal devices to implant remote control Trojans into the victim's terminal products, stealing sensitive user information, gaining maximum privileges, and taking control.It is recommended that users of Apple terminal products conduct risk assessments, and promptly fix vulnerabilities through version upgrades and patch installations (refer to the Apple Security Updates). Pay attention to system update notifications and the latest security update announcements released by Apple, upgrade to the latest secure version in a timely manner, strengthen security awareness, avoid clicking on unknown links, and prevent the risk of cyber attacks.

According to Cointelegraph, Google's Threat Analysis Group recently disclosed a new iOS exploit kit named "Coruna," which is being used for cryptocurrency theft targeting iPhone users. This kit primarily targets devices running iOS versions 13 to 17.2.1 and includes 23 exploit scripts and 5 complete attack chains, some of which are previously unknown vulnerabilities.It can carry out attacks through counterfeit cryptocurrency-related websites. Reportedly, when users access these malicious sites using vulnerable iOS devices, the attack code automatically runs, scanning for sensitive information on the device, particularly text containing keywords such as mnemonic phrases, backup phrases, and bank account details, and attempts to steal assets from cryptocurrency applications like Uniswap and MetaMask.Google researchers strongly recommend that iPhone users immediately update their devices to the latest iOS version. If updating is not possible, they should enable Apple's "Lockdown Mode" to enhance protection.

ChainCatcher message, the official Sui ecosystem yield protocol Typus Finance stated on social media that about 2 hours ago, its TLP contract was exploited due to a lack of permission verification in the oracle. To protect all users, the official has immediately suspended the operation of all Typus smart contracts.Currently, a comprehensive investigation is underway with the emergency technical support provided by the Sui Foundation, and any progress will be promptly updated.

ChainCatcher news, according to decrypt, U.S. President Trump has signed the bipartisan "Take It Down Act" into law. This legislation classifies the non-consensual online publication of intimate images (including real images or AI-generated images) and deepfake pornographic content as a criminal offense, and requires major tech platforms to remove such content within 48 hours of receiving a notice.First Lady Melania Trump called the legislation a "national victory" for protecting children from online exploitation. Victims of deepfakes and revenge porn will now be protected under U.S. federal law.

ChainCatcher news, according to Cointelegraph, Fideum co-founder and CEO Anastasija Plotnikova stated that meme coins are violating the fundamental spirit of cryptocurrency decentralization, increasingly being used to exploit retail investors amid a growing number of rug pulls. She added, "Meme coins have evolved from community-driven social experiments into a chaotic situation dominated by retail investors extracting value, where internal circles, stock price manipulation, and targeted groups have replaced the organic and collectible nature of the original meme coin community, creating an unhealthy competitive environment."Anastasija Plotnikova believes that some behaviors are clearly illegal and fall under the jurisdiction of law enforcement agencies, and she supports the enforcement of certain projects.

ChainCatcher message, Slow Mist's Chief Information Security Officer 23pds posted on social media, "The notorious cryptocurrency theft software Rhadamanthys Crypto Stealer officially announced today that it has started supporting BTC popular wallet UniSat Wallet for extension wallet theft and exploitation. Users need to be aware of security risks and beware of Google AD phishing and private message poisoning phishing." (source link)

ChainCatcher news, security company CertiK tweeted: "We are actively investigating the Merlin (zkSync ecosystem DEX) incident. Current investigation results point to potential private key management issues rather than exploitation of vulnerabilities. If any wrongdoing is found, we will cooperate with the relevant authorities and share the information."Previously reported, Merlin was hacked and $1.82 million in funds was stolen. It is reported that Merlin announced an audit by CertiK on April 24 and launched the MAGE public sale yesterday at 23:00. (Source link)

ChainCatcher news, according to PeckShield statistics, in February 2023, over 200 exploitation incidents were monitored, with a total stolen amount of 35.3 million USD, of which about 141 exploitations occurred on February 11. The largest security incident was the exploitation of BonqDAO, resulting in a loss of 120 million USD, while the attacker profited approximately 2 million USD. As of February 28, 2023, 935,000 ETH and 6,000 BNB have been transferred to Tornado Cash. (source link)