vulnerabilities

According to a report by Decrypt, a new report released by the Bank for International Settlements shows that advanced AI technology has shortened the time window for banks to fix vulnerabilities before attackers exploit software flaws. It warns that periodic security assessments and scheduled patch updates have increasingly become insufficient to meet the challenges, with the time window from vulnerability discovery to exploitation reduced from weeks to minutes.The report focuses on the banks' response capabilities, arguing that financial institutions must accelerate the speed of software fixes and expedite the related authorization decision-making processes.

Bitcoin News posted on the X platform that Alby confirmed a critical vulnerability exists in Alby Hub v1.7.0 to v1.18.5. If the management API is exposed to the public network, attackers may gain unauthorized access and transfer funds. Currently, it is known that 1 user has been affected, and Alby Hub v1.19.0 and higher versions are not affected.Alby recommends that affected users restrict public access to the management interface, immediately update to v1.24.0, and change the unlock password after the update. Multiple issues reported by Bitcoin Team Red, Project Loupe, and other researchers have also been fixed in the latest version.

Hardware wallet manufacturers Ledger and Trezor are calling on security researchers to adopt a more responsible approach to vulnerability disclosure. Ledger's Chief Technology Officer Charles Guillemet stated on the X platform that artificial intelligence has made vulnerabilities easier to discover and exploit, but some researchers disclose details before a fix is released, which he termed "exploiting others' risks for attention."Guillemet urged researchers to report vulnerabilities privately first and to agree on a timeline for fixes before disclosing details publicly, suggesting 90 days as a common default period, while also indicating that this could be adjusted flexibly based on the severity of the vulnerability and the amount of work required for the fix. Trezor's Security Chief Jan Komárek told Cointelegraph that 90 days is a commitment to vendors, not just an obligation for researchers. He suggested that researchers first contact vendors to agree on a timeline, and if the vendor fails to complete the fix within that period, they may choose to disclose publicly.The context of this statement is the recent close attention to hardware wallet security: the Coldcard theft incident involved over $100 million, and a data breach at Trezor's logistics provider also affected the personal information of tens of thousands of customers.

SideSwap issued a statement saying that at 14:05 UTC today, a customer sent 4000 L-BTC to its peg-out service. The service processed the order as usual, L-BTC was destroyed on Liquid with a valid peg-out authorization, and at 14:28 UTC, Liquid Federation paid 3996 BTC to the customer's Bitcoin address.Blockstream subsequently confirmed that the L-BTC was minted due to a vulnerability in the Elements software. SideSwap's peg-out authorization keys and systems were not compromised, and the service cannot distinguish these tokens from other L-BTC. SideSwap is a non-custodial service, and user wallets are unaffected, with assets controlled by the users' own keys.Liquid has been suspended by the Federation, and SideSwap's exchanges, peg-ins, and peg-outs will be paused until the network is restored. Peg-outs that have been completed on Bitcoin are unaffected. Unfinished peg-ins or peg-outs can send transaction IDs to hello@sideswap.io for separate processing. Please do not send new peg-in or peg-out deposits until the service is restored.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

OpenAI stated that its upcoming Astra model can autonomously discover previously unknown software vulnerabilities and convert them into usable attack vectors without human intervention, making it the company's first model to reach the "Critical" cybersecurity capability level threshold. In a blog post released on Tuesday, OpenAI mentioned that according to its Preparedness Framework, reaching this level means the model can discover zero-day vulnerabilities and develop usable exploit code in hardened real systems without human involvement, or design and execute attacks based solely on a high-level objective.In testing, Astra achieved a 100% score in benchmark tests for developing exploit code based on known vulnerabilities and discovered two previously unknown vulnerabilities in another internal test. Additionally, the model successfully broke through a hardened browser sandbox and executed commands on the host machine, while gaining root access by exploiting multiple weaknesses in the operating system. OpenAI stated that it has delayed some of Astra's development progress to enhance security measures and plans to make its advanced cybersecurity capabilities available only to selected testers.This capability is particularly relevant to the cryptocurrency industry, as software vulnerabilities can be converted into financial losses within minutes. CoinDesk reported in June that increasingly powerful AI models can compress the process of searching code, discovering misconfigurations, and assembling attacks from days or weeks to machine speed. Security researchers noted at the time that the significant change was not the emergence of new categories of attacks, but rather the dramatically increased speed at which existing vulnerabilities are discovered and exploited.

Balancer announced that a vulnerability was found in the old Balancer v1 contract, which could lead to LP funds being drained.The related liquidity pools have been deprecated and cannot be paused, and users are advised to withdraw their liquidity as soon as possible. Other Balancer products are not affected.

Polygon Labs disclosed that it has fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks, with the related fixes privately deployed before public disclosure. According to a forum post released on Wednesday, the team packaged the fixes into the Austin hard fork of the Bor client and the Kyoto hard fork of the Heimdall client, both of which followed the standard process for fixing issues that affect consensus: first validated on the Amoy testnet, and then publicly disclosed once the mainnet was activated and the network was secure.The Austin fork fixed two denial-of-service paths in block processing, including a vulnerability where malicious block producers could crash peer nodes by filling them with oversized field data. The Kyoto fork addressed a broader range of consensus hardening issues, with the most severe vulnerability allowing an attacker to force the entire validator set to perform costly and coordinated work with just one crafted transaction—the cost of constructing the transaction is low, but the network processing cost is high. Polygon emphasized that none of the vulnerabilities were observed to be exploited on the mainnet and have been proactively addressed. The two upgrades are now mandatory for node operators and have taken effect without the need for state migration or resynchronization.This disclosure comes at a critical transformation period for Polygon, which has completed the migration of the traditional MATIC token to POL as part of a comprehensive overhaul of its network architecture. The news did not boost the price of POL; according to CoinGecko data, POL traded at approximately $0.09983 on Sunday, down 2.3% in 24 hours, down about 6.8% over the past week, and down about 60.8% over the past year, with a market capitalization of approximately $1.07 billion.

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.

The cryptocurrency payment platform Rain stated that its monitoring system detected a vulnerability affecting a small number of programs using outdated versions of Solana contracts, while other programs were not affected. Rain immediately launched an investigation to determine the scope of the incident.The Rain team has successfully upgraded all programs using outdated versions of Solana contracts, and the related issues have been resolved. Rain will continue to monitor the situation and has hired a third-party forensic expert to conduct an investigation, while also cooperating with law enforcement and relevant regulatory agencies. All affected users will receive full compensation, and Rain has begun the remediation process and is committed to completing the handling swiftly and responsibly.

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to CoinDesk, the developers of the Bitcoin Lightning Network payment software Core Lightning (CLN) issued an urgent warning to node operators after the team received a large number of AI-generated security reports, revealing several real vulnerabilities. The development team advised operators not to directly shut down the machine power but to restart the software in "--offline" mode, which stops communication with other Lightning Network nodes while still keeping it operational to continuously monitor the Bitcoin blockchain and protect the funds in the payment channels.The Core Lightning team began receiving a large number of AI-generated vulnerability reports since early August, some of which have been confirmed to be valid. Developers will keep the details confidential for two weeks to complete the patch development and plan to release a signed patch version for operators to verify the source. The source code and vulnerability details will be made public after the confidentiality period ends.This is the second AI-related security incident in the Lightning Network this month. Earlier in early August, BTCPay Server experienced a vulnerability that led to the leakage of credentials for some Lightning Network nodes and theft of funds. Additionally, the "Bitcoin Red Team," composed of 16 developers, used AI models to scan 390 Bitcoin code repositories at the end of July, discovering nearly 5,000 issues, 85 of which were rated as critical.

The Ethereum client Besu has fixed five security vulnerabilities discovered by the blockchain security company CertiK in version 26.7.1 released on July 27, and published four detailed security announcements on August 14. The details of the vulnerabilities were disclosed later to allow node operators to complete the upgrade deployment.Jialiang Chang, CertiK's Director of Security Engineering and Senior Audit Partner, stated that the arrangement of releasing patches first and details later provides an 18-day buffer period, allowing node operators to identify affected deployments, test the new version, and coordinate with validators or consortium participants to complete the upgrade. The relevant vulnerabilities involve block broadcasting processing, future height consensus proposal caching, WebSocket subscription limits, and JSON-RPC filter creation. If not fixed, attackers could exhaust node memory or thread resources, affecting node availability and consensus processing.CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network using the Chain Scan method, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand around-the-clock multi-node testing for public chain networks.

The cryptocurrency wallet Rabby Wallet posted on platform X that the team has fixed a vulnerability after discovering it and released an update on August 11. The mobile application is not affected.The conditions that triggered the vulnerability are extremely limited: the wallet must be connected to a malicious website, and the user must manually set the auto-lock timer to 10 minutes (other settings are not affected). No exploitation in the wild has been found so far.

The cross-chain liquidity protocol Maya Protocol was attacked on August 18, with the attacker exploiting six interconnected software vulnerabilities to create false account balances, stealing approximately 20.83 BTC (about $1.34 million) and other assets, resulting in a total direct loss of about $1.65 million. The incident led to the suspension of trading on the MAYAChain network, with its token CACAO plummeting nearly 89% from $0.115 to $0.013, before recovering to around $0.03.Technical reviews show that the attack began when MAYAChain mistakenly judged a transaction to be lost and triggered a compensation mechanism, but the mechanism miscalculated, adding about 49 million CACAO to a small liquidity pool, while the protocol's reserves only held about 168,000 CACAO. After the transfer failed, the system incorrectly saved the new balance, and the attacker subsequently deposited a very small amount into the liquidity pool, acquiring over 99% of the pool's share and immediately withdrawing 48.87 million CACAO, which was then exchanged for Bitcoin, Ethereum, and other assets.The incident caused the total value of the Maya Protocol liquidity pool to decrease by about $10.9 million, of which approximately $6.4 million was due to the depreciation of CACAO, and about $2.9 million came from arbitrage trading. The team expressed hope that the attacker would return the funds in the form of a bug bounty; otherwise, they would seek to recover losses through investments in channels like Aztec Chain. Maya Protocol has not yet announced a specific time for resuming trading. This incident once again exposed the security risks within the complex logic of DeFi protocols.

Decred official X account (@decredproject) released a security notice, stating that a security vulnerability has been discovered in the Decred (DCR) network, and a patch will be released on August 18 at 10 AM Eastern Time.For security reasons, the official recommends that users suspend voting and mining operations until the upgrade is completed. An announcement will be synchronized on the official X account as soon as the patch is released.

Payward (the parent company of Kraken) stated that in the coming weeks, it will use Claude Mythos 5 to scan for vulnerabilities in all Payward environments, and the findings will be directly incorporated into its existing security program.

Bitcoin News posted on the X platform that after two weeks of using cutting-edge AI to scan almost the entire Bitcoin open-source ecosystem for vulnerabilities, Bitcoin Red Team member @callebtc stated, "The easily discoverable vulnerabilities have been addressed," and maintainers are verifying "a large number" of serious and high-risk vulnerabilities.@callebtc indicated that the main findings include: decades of accumulated open-source technical debt are being exposed alongside AI capabilities that can discover vulnerabilities at speeds and scales unattainable by human researchers; Lightning seems particularly vulnerable, with its complexity meaning its security status is "worse than average"; unmaintained Bitcoin projects should be considered vulnerable until their security is confirmed.Projects that began building AI security and auditing processes months ago are now in a completely different position compared to those that have been waiting until now. The Bitcoin Red Team has now completed a foundational scan of almost the entire Bitcoin open-source ecosystem. Easily discoverable vulnerabilities have mostly been addressed, but as AI capabilities improve, external red team testing may need to continue indefinitely. Despite discovering and reporting "a large number" of real serious and high-risk vulnerabilities, @callebtc believes this process will ultimately make Bitcoin stronger. The same AI security review will soon expand to areas far beyond Bitcoin.

The Bitcoin wallet Electrum has released version 4.8.1, with the official statement claiming that this update includes "important security fixes" and urging users to upgrade as soon as possible.Developers involved in reproducible builds have provided independent signatures for the binary packages on the download page to verify the consistency between the release package and the source code.

According to Decrypt, a volunteer security team stated that it scanned 150 Bitcoin code repositories using cutting-edge artificial intelligence models and discovered a dozen vulnerabilities. The team has built multiple AI-based review systems, targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects. Team members claim that, on average, each person can find about one serious vulnerability per hour, and in the past 12 hours, they have submitted security reports to multiple projects, but specific affected projects have not yet been made public.