stolen

Bithumb stated that its internal mobile collaboration system DaouOffice was accessed without authorization by external parties, resulting in the theft of some personal information of customers and employees. This incident involves 6,444 customers, of which the data of 5,600 people is in an encrypted state and cannot be read, while 844 customers have confirmed that their personal information has been leaked. Additionally, the information of 715 employees and partners has also been affected.

Blockaid has released two attacker addresses, example attack transactions, affected contracts, and cross-chain bridge addresses. One of the attacker addresses (0xaCA0...5718) currently has a balance of approximately $11,000.

Blockaid stated that it has detected that the Tranche Vault related to Valinor Digital on Avalanche is currently under attack. The attacker is using a flash loan to mint an inflated number of tiered shares, and then redeeming the remaining USDC from the vault.As of the time of posting, the attacker has transferred approximately $1.01 million from the vault through about 2 transactions.

Hardware wallet manufacturer Keystone's device verification keys were stolen, halting shipments and destroying 18,835 unsold devices, with 25,964 buyer records leaked.

According to Bitcoin.com News, Timothy Wadsworth, a man from Rochester, New York, was sentenced to 51 months in prison for conspiracy to commit wire fraud and money laundering, and was ordered to pay approximately $810,000 in restitution.The U.S. Department of Justice stated that between March and May 2020, Wadsworth initiated 310 unauthorized payments totaling approximately $1.6736 million using account information provided by accomplices through the payment service provider Stripe, of which 116 transactions were successful, amounting to approximately $730,700. He then transferred some of the funds to bank accounts under his control and purchased Bitcoin through Coinbase, which he then transferred to his accomplices.

According to monitoring by Blockaid, the WAX multi-chain bridge on the WAX network is under attack, involving WAX, Solana, and Ethereum. The attackers extracted mapped tokens on the WAX chain without paying the corresponding assets, while the bridging contracts on Solana and Ethereum still released the corresponding tokens.The attackers transferred approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC through 5 transactions. It remains to be further confirmed whether the scope of the incident and the losses are still expanding.

Cysic issued a settlement proposal to the attacker who unauthorizedly issued 10 million CYS, requesting that the other party return 275.872 ETH to an address designated by the Cysic Foundation within 72 hours of the on-chain announcement, which accounts for approximately 90% of the confirmed ETH earnings. In exchange, the attacker may retain the remaining approximately 30.652 ETH as a bounty for the vulnerability.Cysic stated that it has restored the key aspects of the attack and preserved relevant technical and on-chain evidence; if the other party fails to return the funds within the deadline, the project team will escalate the matter and seek intervention from law enforcement to promote a comprehensive criminal investigation.

Polkadot has issued a security warning that the browser extension of the third-party wallet Fearless Wallet has been compromised, intermittently leaking user private keys to attackers since February 2025. Investigations revealed that malicious code sends private keys to servers controlled by attackers when users unlock their wallets.According to an announcement from the Polkadot Community Foundation, 8 users have reported suspected unauthorized transactions related to this issue, involving 17,286 DOT. Polkadot urges all users who have used this extension to immediately create a new key pair through other wallets and transfer their assets, as merely changing passwords or switching wallet software will not eliminate the risk. Fearless Wallet is developed by an independent team and is not the official wallet of Polkadot.

Salus Chief Marketing Officer Darcy posted that on October 21 at 23:35:54, they monitored CoinDCX's hot wallet and multiple deposit addresses transferring approximately 15.99 million USDT and 5783.81 TRX to a certain TRON address. The largest single transaction was 15.819002 million USDT.The address subsequently split the funds and transferred them out multiple times, flowing to deposit addresses on exchanges such as Binance, OKX, and Gate.

Digital hardware wallet manufacturer NGRAVE disclosed that attackers hijacked the third-party notification service used by its LIQUID companion app and sent false security alerts to users, resulting in approximately 70 wallet addresses being stolen across 4 blockchains, amounting to about 2.56 million dollars. Among these, the loss in Bitcoin was approximately 1.77 million dollars, XRP about 454,000 dollars, Ethereum assets about 316,000 dollars, and Stellar about 18,000 dollars.The attackers induced users to click on a counterfeit website and enter their 24-word recovery phrase or Perfect Key, subsequently using automated scripts to transfer assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised; the victims voluntarily provided their recovery credentials during the phishing process. Unauthorized access may have begun on October 11. After obtaining an access key, the attackers acquired a broader access key and sent false notifications on October 17; NGRAVE detected anomalies about 1 minute after the notifications appeared, but the first wallet was emptied 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a cryptocurrency security firm and mentioned that affected keys have been replaced, with new dual approval, domain restrictions, and emergency shutdown mechanisms implemented. The company also reminded affected users to create new wallets and contact the support team, as some device information, wallet activity, IP addresses, and approximate locations may have been exposed.

The cryptocurrency exchange OKX has launched OKX Shield in the United States. OKX stated that this mechanism can provide up to $500,000 in protection if a customer's account is hacked.Andrew Cuomo, a member of the OKX board and former governor of New York, said: "This is the level of trust we have in our own system. It's like putting your money where your mouth is, right? What we are doing is exactly that."

Bybit CEO Ben Zhou recently stated in an interview with Wu Shuo that Bybit has covered the losses caused by previous attacks from North Korean hackers through operational income such as transaction fees by the end of last year. He believes that there will still be trading platforms that encounter hacker attacks in the future, and the security system should be designed with the premise of "assuming it will definitely be hacked."Regarding competition, Ben Zhou believes that the golden period for the expansion of global trading platforms has passed, and the industry will further consolidate. Regional trading platforms with licenses and local operational capabilities still have opportunities. He revealed that Bybit's profits have declined year-on-year this year, and traditional asset trading businesses such as stocks are currently not enough to offset the impact brought by the cryptocurrency business.In terms of the U.S. market, he stated that Bybit is still waiting for the right opportunity to enter and is more inclined to cooperate with local institutions that have a retail user base. The core strategy for the next year will focus on regional development and deep localization. He also discussed the differences between the Bitget security incident and the Bybit theft incident, as well as the data security challenges brought by the large-scale application of AI within the platform.

Qubic announced that between 23:42 yesterday and 01:26 today UTC, attackers exploited a vulnerability in the randomness of some wallet Seeds, accessing and transferring approximately 29.4 trillion QU from 1,404 Qubic wallets. The issue lies in the Seed generation mechanism, not in the Qubic protocol itself.The affected Seeds include those created in any browser on iPhone or iPad before October 18, 2026, those created in Mac Safari on the same date, and those created through the Qubic iOS App before July 2025. The network has been paused at tick 85,371,949, with 87.1% of the stolen funds remaining on the Qubic network and frozen, while the remaining 12.9% has been transferred to MEXC, and the related receiving accounts have also been frozen.Qubic stated that the Seed generation issue has been fixed in version 4.26.4, and subsequent handling will be determined by the Computor quorum according to network rules. A complete technical report will be released after the fund recovery plan is finalized.

According to reports from Strait News, in March 2025, Zheng Mouyi, Zou Moumou, and others exploited the weak regulation and difficulty of evidence collection in offline USDT over-the-counter trading to plan a "black eat black" robbery crime under the guise of virtual currency offline trading.The gang raised over 340,000 yuan and invited virtual currency merchants for offline transactions. During the transaction, after the merchant transferred over 40,000 USDT into the virtual wallet controlled by the gang, Zheng Mouyi sprayed the victim's eyes with chili water on the spot and, along with others, violently seized all the transaction funds. After the incident, six involved individuals divided the stolen money. The day after the incident, the public security authorities quickly arrested all involved individuals, recovering most of the stolen funds and returning them to the victim.The Jin'an District Prosecutor's Office legally prosecuted Zheng Mouyi, Zou Moumou, and four others for robbery. In 2026, the court heard the case and sentenced the five defendants to fixed-term imprisonment ranging from five years and seven months to ten years and four months for the crime of robbery.

According to Bitcoin News monitoring, Bitcoin News released a podcast where former Mt. Gox CEO Mark Karpelès discussed the largest supply chain attack in the history of the cryptocurrency industry with Foundation CEO Zach Herbert.Mark Karpelès stated that he discovered a spy implant three weeks before the funds were stolen and contacted Ledger, but received no response. The implant was equipped with a hidden cellular modem that could directly read the mnemonic phrases displayed on the screen and bypass Ledger's own checks; even setting a passphrase would not prevent the mnemonic phrases from being stolen.Mark Karpelès mentioned that if he had $5 million, he could create an implant that would only be detectable through X-rays. The show also discussed the hardware wallet dealer model, the Malaysian dealer behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, reasons why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The show timeline indicated that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.

According to Bitcoin News, the Bitcoin Lightning Network development kit LDK has fixed multiple security vulnerabilities, including a channel reconnection vulnerability that could be exploited by malicious counterparties, leading to the theft of funds. The LDK official released versions 0.1.13, 0.2.7, and 0.3-rc3 on October 3, recommending operators interacting with untrusted channel counterparties in production environments to upgrade. Currently, the related disclosures have not confirmed any actual losses caused by these vulnerabilities.

According to CoinDesk, several blockchain analysis companies estimate that the assets stolen by attackers from hundreds of wallets associated with the authorized dealer CryptoBilis sold Ledger devices could be as high as $94.5 million. Ledger has not yet confirmed this total.Hardware wallet company Ledger discovered that unauthorized hardware was implanted in at least one affected device; stablecoin issuer Tether has frozen $10 million USDT related to the theft, and investigators are still tracking the flow of funds. Ledger advises CryptoBilis customers not to set up devices that have not yet been used; customers who are already using the related devices should transfer their assets to new devices and generate new recovery phrases.

According to Lookonchain monitoring, a certain address's old wallet has been safely running for 8 years. After being dormant for more than 4 years, it transferred to a new wallet one month ago, and then CryptoBillis Ledger Drainer stole all 59 ETH from that wallet, worth $146,800.

According to on-chain analyst Yu Jin's monitoring, trader @frogmanhaha's wallet (0x14...5794, 9wMS...ov8z) was suspected to have been hacked about 5 hours ago, with 9 types of assets worth approximately 4 million dollars being transferred, sold, and exchanged for ETH, BNB, and SOL, and then dispersed through tools like Privacy Cash and Chainflip.The stolen assets mainly include 1.43 million BP, worth about 1.77 million dollars; 13.96 million MarsCoin, worth about 1.55 million dollars; and 3.7 million Cash Cat, worth about 510,000 dollars.

According to monitoring by the security company Blockaid, a certain vault on the Base chain is under attack. The attacker added a brand new contract to the vault's whitelist, then borrowed aBaswstETH from it and transferred it to the attacker's contract.The attack is still ongoing, and approximately 4 transactions have resulted in about 2.02 million dollars worth of assets being stolen.