incident

Solana Optimistic Network (SOON) announced that the security incident discovered on July 12 has been investigated and resolved. The incident did not involve vulnerabilities in the SOON protocol, sequencer, or user-facing smart contracts, and no user funds were lost. SOON stated that this incident originated from security issues in the off-chain operational environment.According to an investigation by the third-party security company BlockSec, external attackers gained unauthorized access through misconfigured services and further entered part of the internal environment due to insufficient access controls. The impact of the incident was limited to certain operational infrastructure and related processes, and did not involve on-chain user assets, user smart contracts, or SOON network security. After the incident, SOON suspended the sequencer and some services, and initiated a comprehensive security review. During this period, functions such as NFT minting, token claiming, and on-chain withdrawals were temporarily shut down. Currently, SOON has restored NFT minting and token claiming functions, and has resumed mainnet RPC services and block production. The network is now operating normally.

According to on-chain detective Specter monitoring, Wemix Network may have experienced a vulnerability exploitation event exceeding $700,000, with the related address being 0xC921...7EA2.

Onchain Lens stated on the X platform that in the first half of 2026, 224 publicly disclosed crypto hacking incidents resulted in approximately $1.32 billion in losses. The largest losses came from access control failures, phishing attacks, and oracle issues.In terms of attack type breakdown, access control failures involved compromised permissions and privileged access, driving several of the largest attacks, including Kelp DAO with a loss of $292 million, Drift Protocol with a loss of $280 million, Humanity Protocol with a loss of $31 million, Step Finance with a loss of $30 million, Truebit with a loss of $26.5 million, Resolv Labs with a loss of $25 million, AFX with a loss of $24.15 million, and BonkDAO with a loss of $21 million. In terms of phishing and social engineering attacks, social engineering attacks caused $282 million in losses. Regarding oracle issues, Ostium lost $24 million, Blend Protocol lost $10.86 million, and Bonzo lost $9 million. A small number of incidents accounted for the majority of the losses, with compromised permissions and privileged access driving several of the largest attacks.

Across Protocol released a post-incident report on the Relayer security event. The attacker exploited a vulnerability in the Risk Labs Solana off-chain event reading software to fabricate 1,627 false recharge events with a total face value of approximately $41.7 million.The report states that the Relayer completed 581 reimbursements before pausing Solana services, involving about $4.5 million of its own funds, while the remaining approximately $37 million in false recharges have all been rendered invalid.This incident did not involve any smart contract vulnerabilities, and all user transfers were completed or fully refunded on the same day. Across Protocol stated that the losses were limited to the capital of Risk Labs' own relayers, with a net loss of less than $4 million after deducting approximately $500,000 in attacker funds. Currently, Solana's order flow has been completely routed through CCTP, and the ACX token acquisition plan remains unaffected.

On-chain detective ZachXBT stated that the cross-chain protocol TeleSwap suffered a vulnerability attack of approximately $735,000 on July 15, and after the incident, its Bitcoin hot wallet immediately stopped processing transactions.As of now, five days have passed since the incident, and the project team has not made any public disclosures regarding this event. ZachXBT noted that about two hours ago, the attacker transferred the stolen funds to Tornado Cash.

Ostium released an update on the attack incident. Its liquidity provider fund was attacked on July 15, resulting in a loss of 23,752,746 USDC. Preliminary investigations indicate that the attacker compromised the off-chain infrastructure that provides price data to the protocol and submitted disguised illegal price reports, extracting artificially generated profits from the fund by quickly opening and closing multiple large positions.Ostium stated that traders' collateral is stored in independently isolated smart contracts and was not affected by this incident, with all trading positions remaining open. The team paused trading and froze all trading contracts within 60 minutes after the first attack transaction occurred. Currently, Ostium is collaborating with Mandiant, zeroShadow, Collisionless, SEAL 911, and law enforcement agencies, coordinating with trading platforms, bridging contracts, and stablecoin issuers to advance the investigation. The engineering team is focused on repairing and strengthening the relevant infrastructure to support the secure resumption of trading.Ostium indicated that it will notify at least 24 hours in advance before unfreezing the trading contracts. After trading resumes, existing positions will be marked at the price at the time of reopening, unaffected by price fluctuations during the pause. Addressing the affected liquidity providers and securely resuming trading remains the current top priority.

The governance company of Cardano, Intersect, stated on the X platform that EMURGO is unable to allocate the necessary resources to execute the Token2049 event due to its recent focus on handling the SecondFi security incident. After discussions among three parties, the responsibility for the event has officially been transferred to the Cardano Foundation.EMURGO submitted a transfer request to Intersect, which received agreement from all parties after discussions with the Cardano Foundation. Intersect stated that this decision was based on the urgency of the event timeline and the need to avoid delivery uncertainties. The Cardano Foundation has agreed to deliver the event within the approved scope, and both EMURGO and Intersect recognize its past execution capabilities. The delivery work for Token2049 has now officially been handed over, and the event is still scheduled to take place in October.Previously, in June, it was reported that SecondFi disclosed a security incident affecting approximately 16 million ADA (around 2.42 million USD at the time); however, SlowMist indicated that user losses from SecondFi could exceed 20 million USD.

According to The Block, a report from Immunefi shows that in the first half of 2026, cryptocurrency projects suffered cumulative losses of approximately $972 million due to 207 hacking incidents. Although the number of attacks reached a historic high, the total losses remained below $1 billion and were less than half of the losses in the first half of 2025.The report pointed out that losses from attacks in the DeFi sector have decreased by 74% from the peak of $2.62 billion in 2022, dropping to about $680.3 million, with the median single loss decreasing by 75% during the same period. Immunefi believes that this decline is related to ongoing security coverage, bug bounty programs, audit competitions, and more researchers discovering vulnerabilities early.In addition, the sources of risk are shifting from purely smart contract vulnerabilities to infrastructure failures, private key leaks, cross-chain configuration errors, and weak points in privileged access.

Cardano wallet service provider SecondFi released the latest update on the theft incident, stating that "isolation mode" will be launched this week, allowing users to check if their wallet addresses are involved in the related incident and submit tickets; next week, they plan to introduce a secure wallet export feature to provide a safer wallet migration path for users of different technical levels.SecondFi reiterated that it will provide potential asset recovery solutions for wallets confirmed to be affected through the process, expected to use a zero-knowledge proof-based recovery tool with set qualifications and terms; the official also reminded users that they will not request private keys or mnemonic phrases, and users should only operate through official website support and designated verification tools.

According to official news, the stablecoin protocol Reflect, supported by a16z, announced the launch of an independent voluntary recovery plan for USDC+ position holders affected by the Drift (now Velocity) April hacking incident: a 180-day window is now open, during which holders can voluntarily sell their positions to Palindrome Engineering at a price of 0.2 USDC + 80 Reflect Credit (RC) per unit, with complete on-chain settlement.The plan is funded in advance by Palindrome and is completely independent of the Drift recovery process. Participation means waiving the right to pursue claims against Drift in exchange for immediate certainty of liquidity; those who do not participate can still support Drift's DFX recovery channel.

According to Jinshi reports, the United States has carried out military strikes against Iran on June 27 local time.

The password management tool LastPass announced that its third-party market intelligence platform Klue experienced a security incident, where hackers stole multiple OAuth tokens held by Klue for various clients (including LastPass) and used these tokens to access LastPass's Salesforce CRM system, potentially leading to the leakage of business contact information and CRM data, including some customers' names, phone numbers, email addresses, home addresses, and support cases.The official reminder: LastPass's products, services, infrastructure, and customer vaults have not been affected, and Gong system data has not been accessed. LastPass has immediately taken measures, including stopping employee access to Klue, rotating exposed API tokens, conducting a detailed investigation, and collaborating with Klue, Salesforce, and law enforcement, while also sharing threat intelligence with the security community through the TIME team and strengthening future protections. Users should remain vigilant against potential phishing emails, calls, or social engineering attacks that may exploit the leaked information, and remember that LastPass will never ask for the master password; all official communications are sent through trusted channels.

Taiko released a security incident update on platform X, stating that the incident has been brought under control, the cross-chain bridge and vault have been suspended, and funds can no longer be withdrawn. The cross-chain bridge is offline in both directions, and pending transactions are in a suspended state rather than lost. More information will be announced soon.

Taiko posted on platform X stating that all Proposers (nodes responsible for producing new blocks) have suspended block production. Taiko mentioned that the team is currently investigating the breach of the chain state validation mechanism and is continuously assessing the scope of the incident's impact and subsequent response measures. Previously, Taiko confirmed that its chain state validation mechanism had been compromised and advised users to immediately withdraw funds from cross-chain bridges deployed on Taiko.

The cross-chain protocol Axelar Network released a statement regarding the recent security incident related to Secret Network, stating that there is a misunderstanding within the community about the event. Both Axelar and the Inter-Blockchain Communication Protocol (IBC) were not attacked or compromised. The affected token smart contracts were neither developed, deployed, nor maintained by Axelar, and Axelar's firewall mechanism also prevented the impact from spreading to other chains.It is reported that the exploited contract is a forked version based on CW20-ICS20, but the developers removed two core security checks, resulting in an "infinite minting" vulnerability. By deleting the verification mechanisms originally used to prevent such issues, this fork altered the original trust model of the contract and did not undergo a new security audit.Axelar Network explained that anyone can deploy contracts for cross-chain asset wrapping through IBC, and similar contracts have also been used to wrap tokens from other chains into Secret Network. However, the Secret side fork version in this incident has vulnerabilities due to the removal of key security checks. This incident is not a unique logical flaw, nor is it an issue with the IBC protocol itself, but rather a security risk introduced by modifications to third-party contracts.

In response to rumors regarding the attack on the BNB Chain OLPC/LABUBU liquidity pool, PancakeSwap's official announcement stated that the platform has noted the news related to this security incident. After preliminary verification, PancakeSwap's own smart contracts do not have security vulnerabilities. The project team is still continuously investigating the complete causes of the incident and will promptly share the latest investigation progress once more clues are obtained. Meanwhile, the official reminds users that all relevant event information should be based on content released through PancakeSwap's official channels.

The Zodiac team released a security incident analysis report regarding the impact on the Zodiac Roles Modifier, disclosing that the root cause of the vulnerability lies in a flaw in the ERC-1271 transaction signature verification logic: the system only determines the validity of the signature based on the returned "magic value" without verifying whether the call itself was successful, which may disguise a failed verification as a valid signature, bypassing the module authentication mechanism.

DeFi structured protocol Thetanuts Finance issued a statement in response to the security incident involving its Vault. Preliminary investigations indicate that the relevant Vault is an old version contract that was deprecated and migrated years ago, and it is not associated with any currently running contracts or products. Further details are still under investigation, and a complete post-incident analysis report will be released once more information is available.Earlier reports suggested that Thetanuts Finance may have suffered an attack, with preliminary estimates of losses around $2.1 million.

Syscoin released a bridge security incident report, disclosing details of the UTXO-to-NEVM bridge vulnerability incident, which reportedly led to approximately 5 billion SYS being unauthorizedly released on the UTXO side. The related funds have since been returned to the official recovery address and destroyed through the standard OP_RETURN method, making them unusable by the protocol again. The on-chain reported SYS supply has been restored to the expected value, and the bridge function remains suspended while the team completes the final review and fixes.Syscoin pointed out that it will fix the cross-layer parsing defects. The core lesson from this incident is that cross-layer systems must uniformly standardize data processing, and any ambiguous bridge proof should be considered a default failure.

Syscoin released a bridge security incident report, disclosing details of the UTXO-to-NEVM bridging vulnerability incident. It is reported that this incident led to approximately 5 billion SYS being unauthorizedly released on the UTXO side. The related funds have since been returned to the official recovery address and destroyed through the standard OP_RETURN method, making them unusable by the protocol again, and the on-chain reported SYS supply has been restored to the expected value. The bridging function is currently still suspended, and the team is completing the final review and repair.