News linked to this event type.
According to monitoring by on-chain analyst Onchain Lens (@OnchainLens), the Pando Rings exploiters have become active again after two months of silence, swapping 3 million DAI for approximately 1,570 ETH (worth about $3 million) via CoW Protocol, and subsequently transferring 800 ETH (about $1.52 million) of them into the mixer Tornado Cash through eight transactions, suspected of laundering funds. Pando Rings previously suffered an oracle manipulation attack in November 2022, losing about $20 million.
Odaily News - Bitcoin News announced on the X platform that BitBox has disclosed two severe hardware wallet vulnerabilities, stating there is currently no evidence that these vulnerabilities have been exploited or led to user fund theft. All disclosed issues have been fixed in firmware v9.26.5, and BitBox urges all users to update immediately. An internal security audit uncovered two severe vulnerabilities, along with new details regarding a previously fixed bootloader vulnerability. One vulnerability affecting BitBox Multi devices could allow a malicious host to execute arbitrary code and install malicious firmware on devices that have not yet completed setup. Another vulnerability in Silent Payments could allow an attacker to exploit a malicious host device to redirect funds to unintended addresses, resulting in Bitcoin being locked and potentially enabling extortion attacks. BitBox also disclosed that the previously fixed bootloader vulnerability could allow attackers to trick users into installing malicious firmware capable of stealing funds.
Odaily News: Sheldon Lee, founder of cryptocurrency exchange BitMart, stated that a post on X claiming users were unable to withdraw funds and that some employees had not received their July salaries is a "fabricated rumor," adding that the exchange's Chinese-language account had been hacked. Critics, including users and on-chain investigator ZachXBT, have demanded that BitMart resume withdrawals or undergo an independent third-party audit. BitMart is gradually winding down operations, with the final trading day set for August 26. Troubled investment firm Echo Base said it had proposed a funded restructuring plan to BitMart but received no response. The firm warned that resolving a large volume of customer claims may require proceedings through the courts. (CoinDesk)
Odaily News: Decentralized lending protocol Compound Finance has completed a leadership overhaul and approved a record $52 million budget. The protocol's total value locked has fallen from a peak of $12 billion in 2021 to $1.2 billion, and it is now seeking to restore growth. Compound Finance is pivoting to serve institutional clients, developing real-world asset products, partner integration solutions, and credit infrastructure to meet the compliance and technical standards of traditional finance. Industry executives say Compound Finance's new leadership team and substantial budget align with the broader shift within the decentralized finance sector toward serving financial institutions. The sector's overall assets had previously declined due to market weakness and security breach incidents. (CoinDesk)
Odaily News GitHub's official status page shows that the platform is currently experiencing service anomalies, with multiple core features seeing degraded availability.According to the latest announcement, GitHub's web interface and API request error rates once reached approximately 20%, while error rates for repository archive downloads and raw repository content downloads stood at around 50%. Additionally, SAML and OIDC authentication, SCIM, and Team Sync features have also been affected.Currently affected services include: Pull Requests performance degradation; Issues performance degradation; Actions (automated workflows) performance degradation; Webhooks performance degradation; API Requests experiencing anomalies; GitHub Copilot experiencing degraded availability.GitHub stated that its team is continuously investigating the root cause of this incident and will provide further updates once more information becomes available.As of now, GitHub has not disclosed the specific cause of this outage, nor has it indicated whether a security incident is involved. This service disruption may impact developers and enterprise users who rely on GitHub for code hosting, continuous integration and deployment, and AI-assisted development.
据 Decrypt 报道，荷兰国家网络安全中心（NCSC）发出警告，攻击者正在积极利用 macOS 屏幕共享功能中的一个身份验证漏洞（CVE-2026-65400，严重性评分 7.1），对将 5900 端口暴露于公网的 Mac 设备发起攻击，成功获取 root 权限后植入门罗币挖矿程序。
Odaily News: The Dutch National Cyber Security Centre (NCSC) has reported that attackers are exploiting a vulnerability in Apple's macOS Screen Sharing feature to take control of devices and install Monero mining programs. Multiple systems with port 5900 exposed to the internet have been compromised, with attackers gaining root access. The vulnerability, tracked as CVE-2026-65400, has a severity score of 7.1 out of 10. It stems from a state management error in the authentication process, allowing remote attackers to bypass login verification without valid credentials. Public proof-of-concept code has already been circulated. Apple has addressed the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The NCSC advises users to update their systems promptly and avoid exposing the Screen Sharing service directly to the internet. (Decrypt)
Glassnode pointed out in its latest market report that although Bitcoin has rebounded slightly after retreating from the $65,000 zone last week, it remains clearly range-bound overall. Spot trading volume and on-chain transaction throughput continue to shrink, with market liquidity and participation willingness at low levels. The derivatives market also shows caution, with leverage expanding moderately, but aggressive taker activity in perpetual contracts continues to lean toward the sell side, reflecting more aggressive distribution behavior. Funding rates remain positive, indicating lingering long-side inclination, while the options market continues to price downside protection at a premium above actual volatility levels.Institutional demand has simultaneously weakened, with declining spot ETF volumes compounded by net outflows. Institutional positions are near their cost basis, limiting unrealized profit potential for regulated investors and causing a temporary pause in accumulation momentum. On-chain profitability is under pressure, with a large portion of supply in loss and realized losses consistently exceeding profit-taking.The report also noted that the broader pace of capital outflows has begun to slow, which could be an early signal that selling pressure is stabilizing. The overall market remains caught between short-term selling pressure and relatively resilient long-term holdings. Weak spot liquidity, deteriorating institutional flows, and elevated loss realization collectively point to a continuation of the consolidation pattern, while the slowing outflow pace suggests the market may be approaching a more balanced state before its next directional move.
Odaily News – Cybersecurity firm Bitdefender has reported that, days after the theatrical release of *The Odyssey*, pirated files disguised as HD WEBRips and Blu-ray rips have begun circulating. These files are actually executables that infect Windows devices upon execution and carry the information-stealing malware Lumma Stealer. Attackers disguise the malware using icons that mimic VLC Media Player or video files. Lumma Stealer can harvest browser passwords, payment information, autofill data, remote desktop credentials, and cryptocurrency wallets, as well as steal authentication cookies, potentially compromising accounts even when multi-factor authentication is enabled. Bitdefender states that its products have blocked related downloads and flagged the command-and-control domains associated with this campaign, which bears strong similarities to an operation in 2025 that distributed the same malware disguised as files for *Mission: Impossible – The Final Reckoning*. (Decrypt)
Odaily News: Bits of Gold, Israel's largest crypto brokerage, stated that hackers obtained the personal information of approximately 200,000 customers through a data breach at a third-party data analytics service provider. The compromised information includes names, national ID numbers, email addresses, phone numbers, IP addresses, bank account details, and public wallet addresses, but does not include funds, passwords, private keys, or ID scans. The incident is part of a recent wave of data breaches in the crypto industry, following similar incidents at SafePal and Trezor, which were also compromised through breaches at external vendors. (CoinDesk)
BitMart founder Sheldon stated that, after verification, the official BitMart Chinese account has been hacked, and the relevant content was not published by current employees.
according to Bitcoin News monitoring, analysis by Galaxy Research (@glxyresearch) has identified distinct characteristics among various groups that exploited weakly secured COLDCARD seeds in their attacks. The 10 largest groups alone transferred approximately 1,700 BTC, with the biggest group moving over 1,080 BTC. Researchers differentiated the attackers based on patterns such as fee strategies, transaction timing, fund consolidation methods, and the destinations of the stolen BTC. Several of the largest groups are still suspected to hold nearly all of the stolen BTC. Victims of COLDCARD attacks can contact @intangiblecoins to assist in gathering evidence and reaching out to relevant authorities.
Odaily News: CZ posted a SafePal security incident alert on platform X, reminding the community to beware of phishing attacks. He also disclosed that SafePal is one of YZi Labs' (formerly Binance Labs) portfolio companies, and YZi Labs is currently a minority shareholder of SafePal.
Odaily News: Following the full implementation of the EU's MiCA regulation on July 1, over 1,700 unlicensed crypto platforms have been ordered to cease operations and guide users toward licensed platforms; currently, only 323 companies hold valid authorizations. Approximately 10 million users need to migrate their assets, and scammers are taking advantage of this by impersonating regulators and licensed exchanges, sending fake migration notices to lure users into transferring assets to fraudulent platforms. The French Financial Markets Authority (AMF) stated that scammers have been posing as its employees to defraud funds under the guise of collecting "management fees." The European Securities and Markets Authority (ESMA) confirmed that its identity and logos have been misused. The Dutch Authority for the Financial Markets (AFM) warned that migration from unlicensed exchanges has itself become an attack surface, advising users to verify service providers through ESMA's official register and to remain vigilant against unsolicited contact requesting fund transfers.
Odaily News: Crypto wallet service provider SafePal recently issued a security announcement stating that the company discovered a vulnerability in its order tracking plugin, which led to unauthorized access to certain customer information.SafePal stated that the incident affects approximately 39,798 users, involving customers who placed orders between March 2, 2025, and April 11, 2026. The leaked information includes names, email addresses, shipping addresses, phone numbers, and order-related data such as purchase records.The company emphasized that the incident did not involve users' wallet security data, including seed phrases, private keys, wallet passwords, other wallet credentials, bank account information, payment card numbers, and government-issued identification documents, all of which remain unaffected.SafePal stated that the relevant vulnerability has now been fixed, and additional security measures have been implemented to strengthen the order system's protection. Affected users have received individual notifications via email. Users can also check whether they have been affected through the official page by entering their order number and shipping country.SafePal reminds users to remain vigilant, not to disclose seed phrases, private keys, or passwords to anyone, and to be cautious of phishing emails or fraudulent activities such as impersonated customer service that may arise in connection with this incident.
DeFiLlama's anonymous founder 0xngmi stated that the team postponed the release of the official mobile app due to the long-standing presence of phishing apps impersonating DeFiLlama on the Apple App Store. Apple removed them only after the team submitted evidence that the malicious apps were stealing funds.
Odaily News, DefiLlama founder 0xngmi, of the crypto data analytics platform, stated that the team spent months asking Apple to remove phishing apps impersonating DefiLlama from the App Store, which delayed the mobile app's launch until all such counterfeit apps had been removed. 0xngmi noted that after the team downloaded one of the malicious apps and documented a small crypto wallet being stolen, Apple removed it within days. In 2024, the App Store also saw counterfeit apps impersonating Rabby Wallet and Curve Finance; in November 2023, a fake Ledger Live app on the Microsoft Store siphoned off $588,000 across 38 transactions. (Cointelegraph)
: SafePal has officially announced that its order tracking plugin contained a security vulnerability, resulting in unauthorized access to some customer order information. Approximately 39,800 customers were affected, all of whom placed orders between March 2, 2025, and April 11, 2026. The leaked information includes names, email addresses, shipping addresses, phone numbers, and purchase details. Users' wallets, seed phrases, and private keys were not affected, and the incident does not involve seed phrases, private keys, wallet passwords, bank account information, payment card numbers, or government-issued identification documents. The issue has now been resolved. SafePal has implemented additional security measures and is notifying all affected customers individually by email. Users can check whether they were affected through the official verification page by entering their order number and shipping country.
Odaily News, Tornado Cash founder Roman Storm stated that if the logic behind the U.S. Department of Justice's (DOJ) case against him holds, tech companies Google and OpenAI should also be held liable for North Korean hackers abusing their products. Those involved reportedly used ChatGPT to write code and Google Gemini for forgery and image manipulation. Storm was convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business. He pointed out that the Tornado Cash case could set a legal precedent where software developers are penalized for criminal acts committed by users, emphasizing that criminals should be held accountable rather than the developers of tools. The CLARITY Act for digital asset markets is intended to provide protections for software developers by distinguishing developer liability from the potential misuse of protocols for illegal activities. However, although a final motion for consideration of the bill has been scheduled for a vote, its current chances of passage remain low. (Bitcoin News)
Bitcoin News posted on X platform saying that Prince Filip learned about the COLDCARD hack while on vacation. As an Mk3 user, he faced the risk of his entire Bitcoin holdings being stolen at any moment.