News linked to both this project and an event.
According to Cryptopolitan, cybersecurity firm Adversa AI has disclosed that xAI's AI assistant Grok contains a security vulnerability known as "Encrypted Context Injection." Attackers can embed encrypted commands within standard web pages. When a user requests Grok to summarize such a page, Grok automatically decrypts and executes the hidden command, forwarding the user's name, geographic location, subscription tier, and complete chat history to the attacker's server. The vulnerability was reported to xAI through the HackerOne platform on June 3, 2026. Researcher Rony Utevsky followed up on August 4 and August 10, respectively. However, as of August 19, the vulnerability remains unpatched on Grok.com, and xAI has not provided a timeline for a fix.
According to CryptoSlate, researchers from USENIX Security publicly disclosed a clock attack vulnerability against Solana’s Proof of History (PoH) mechanism on August 12. The vulnerability had been privately reported to the Solana development team as early as December 2025. Research indicates that a malicious scheduler leader could manipulate the PoH logical clock through "re-anchoring," slowing the progression of logical time. This would yield a longer transaction selection window within physical time, allowing the attacker to isolate honest leaders' blocks via the TowerBFT fork-choice mechanism, with the required stake for the attack falling below 33%. The Alpenglow security contest hosted by Anza, which offered a 50,000 SOL prize pool, concluded on August 19. However, the vulnerability was excluded from the evaluation scope because the contest rules explicitly excluded "behaviors that can only be triggered when Alpenglow is inactive." The Solana development team confirmed awareness of the issue, stating that the probability of the worst-case scenario occurring under current conditions is low. They expect the Alpenglow upgrade to fundamentally eliminate the attack's prerequisites. The Alpenglow code is already integrated into the Agave 4.2 client but remains inactive on the mainnet, with full deployment expected alongside Agave 4.3. Until then, the transitional risks associated with this vulnerability have yet to receive public implementation-level analysis or official responses.
As disclosed by security researcher V12 (@v12sec), the Rabby Wallet browser extension contains a silent signature extraction vulnerability that allows attackers to extract wallet signatures via malicious websites without user awareness, thereby draining wallet assets. The conditions required to trigger this vulnerability are extremely limited: users must simultaneously meet two conditions—connecting to a malicious website and manually setting the auto-lock timer to 10 minutes. Other timer settings are unaffected, and the mobile app is also unaffected. Rabby Wallet officially stated that a fix update was released on August 11 following the vulnerability's discovery. No actual exploitation cases have been detected so far. Users are advised to confirm as soon as possible that the extension has been updated to the latest version.
Odaily News: BIP-110 supporters are discussing a hard fork to change the stalled minority chain's mining algorithm from SHA-256d to BLAKE2b. Transaction history before the fork remains shared by both chains. If transaction and signature rules remain consistent, the same transaction could be replayed on the other chain, creating a replay attack.BIP-110's peak miner support was approximately 2.53%. After the consensus rules took effect on August 8, the minority chain produced only two consecutive blocks before stalling, while the Bitcoin main chain continued operating and widening the block height gap. The BIP-110 proposal was subsequently marked as closed, and supporters shifted focus to discussing the BLAKE2b proof-of-work scheme.Bitcoin Knots plans to add a new signature hash option, but RDTS will still maintain compatibility with Bitcoin Core's existing signature hash types. Regular transactions may continue to be valid on both chains. Users will need to use the new option and rely on wallets or hardware signing firmware that support it to achieve asset separation.Luke Dashjr stated on August 18 that Bitcoin should bear the responsibility for replay protection, calling it "Spamcoin." If the BLAKE2b fork proceeds around September 1, exchanges, wallets, and holders will need to distinguish between cross-chain transactions and chain-specific transactions. (Bitcoin.com News)
Odaily News: The KITE Foundation has provided an update on the handling of a token security incident. A new KITE ERC-20 contract has been deployed on the Ethereum mainnet, with the total token supply remaining unchanged. Old KITE tokens will be migrated to the new contract at a 1:1 ratio. Addresses confirmed to be controlled by the attacker will be excluded and will not receive new tokens.The migration snapshot is based on Ethereum mainnet block height 25,692,498. Regular self-custody wallet users will receive the new tokens directly without needing to redeem or authorize anything. Exchange users will have their migration coordinated between the exchange and the KITE team. Cross-chain channels will remain paused until migration and verification are complete.Previously, KITE detected abnormal transfers on August 6 and confirmed it had been attacked by hackers. The team stated that this incident did not result in any asset losses for users or the project, and the impact is currently under control.
Odaily News: A bitcoin wallet created in 2012 has moved 212 BTC after remaining dormant for 14 years, valued at $13.72 million based on the price at the time of transfer. The wallet address was created on August 10, 2012. These bitcoins were originally worth $2,346, with a per-coin price of $11.07; at the article's quoted price of $64,761, if sold in full, the holder would realize a gain of 584,725%. The wallet owner's identity remains unknown. The 212 BTC has been transferred from a legacy P2PKH wallet to an unlabeled Bech32 wallet, arriving in multiple batches before being consolidated. A Coldcard vulnerability led to the theft of nearly 2,000 BTC, which may have prompted some long-term holders to move their assets, but this address has not been linked to any known entity. (Bitcoin.com News)
Odaily News: Peer-to-peer cryptocurrency trading platform NoOnes announced that it will begin gradually winding down operations after running for over three years. The company stated that it had been continuously seeking to resolve and lift the sanctions imposed on NoOnes, but ultimately failed. The sanctions caused the platform to lose key partners, and blockchain monitoring firms also flagged transactions associated with NoOnes as high-risk, making it increasingly difficult for the platform to continue normal operations. According to the plan, the business contraction began on August 17, and the P2P marketplace will close at 23:59 UTC on August 21. Services such as Swap, NoOnes Visa, fiat withdrawals, the gift card store, and the Bitcoin Lightning Network will also be discontinued progressively. After that, the platform will only support withdrawals, and users will still be able to log in, view balances, and withdraw remaining assets. The company advises users to complete asset withdrawals as soon as possible, no later than August 23. Previously, on January 26, 2025, NoOnes revealed that the platform had suffered a major security breach earlier that month, resulting in losses of approximately $8 million in crypto assets. CEO Ray Youssef confirmed the news after on-chain detective ZachXBT disclosed the hacking incident on his Telegram channel.
The official Decred X account (@decredproject) issued a security notice stating that a security vulnerability was discovered in the Decred (DCR) network. The patch will be released on the morning of August 18, Eastern Time. For security reasons, users are advised to pause voting and mining operations before completing the upgrade. An announcement will be posted on the official X account immediately after the patch is released.
Odaily News: Sheldon Lee, founder of cryptocurrency exchange BitMart, stated that a post on X claiming users were unable to withdraw funds and that some employees had not received their July salaries is a "fabricated rumor," adding that the exchange's Chinese-language account had been hacked. Critics, including users and on-chain investigator ZachXBT, have demanded that BitMart resume withdrawals or undergo an independent third-party audit. BitMart is gradually winding down operations, with the final trading day set for August 26. Troubled investment firm Echo Base said it had proposed a funded restructuring plan to BitMart but received no response. The firm warned that resolving a large volume of customer claims may require proceedings through the courts. (CoinDesk)
Odaily News, Tornado Cash founder Roman Storm stated that if the logic behind the U.S. Department of Justice's (DOJ) case against him holds, tech companies Google and OpenAI should also be held liable for North Korean hackers abusing their products. Those involved reportedly used ChatGPT to write code and Google Gemini for forgery and image manipulation. Storm was convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business. He pointed out that the Tornado Cash case could set a legal precedent where software developers are penalized for criminal acts committed by users, emphasizing that criminals should be held accountable rather than the developers of tools. The CLARITY Act for digital asset markets is intended to provide protections for software developers by distinguishing developer liability from the potential misuse of protocols for illegal activities. However, although a final motion for consideration of the bill has been scheduled for a vote, its current chances of passage remain low. (Bitcoin News)
Odaily News: According to monitoring by Galaxy's Head of Research, since July 31, they have communicated with over 190 victims of the Coldcard vulnerability attack, and have asked victims who have not yet been in touch to reach out via direct message so they can provide tracking information and assist in reporting losses to relevant authorities. Since August 6, no new attacks have been confirmed, but this does not mean that new attacks cannot occur, and vigilance should be maintained.
Odaily News: BNB Smart Chain (BSC) has announced that the Pasteur hard fork will officially go live on the mainnet at 10:30 AM Beijing time on August 25 (02:30 UTC on August 25). Node operators are required to upgrade their clients to v1.7.7 in advance.This upgrade includes three improvements—BEP-682, BEP-695, and BEP-675—focusing on enhancing cross-chain security, validator governance mechanisms, and network throughput. Among them, BEP-682 will strengthen the BNB Chain cross-chain bridge verification mechanism, preventing permission bypass risks caused by duplicate signature counting by validators, thereby improving the security of cross-chain asset transfers. BEP-695 optimizes the validator key rotation mechanism, ensuring that old keys no longer retain management privileges after exit, while also fixing potential vulnerabilities related to slashing and governance voting.In terms of performance, BEP-675 reduces the time consumption caused by validators repeatedly executing transactions by optimizing the block construction process. In BNB Chain's internal QANet test environment, this solution increased throughput from 1,237 TPS to 2,324 TPS. While maintaining the 450-millisecond block time and the 100 million Gas block limit unchanged, the average Gas usage per block rose from 46.35 million to 84.15 million.BNB Chain stated that this upgrade is primarily aimed at validators and block builders, designed to provide greater capacity during network peak periods and advance the throughput expansion goals outlined in BNB Chain's roadmap for the second half of 2026.
: Cardano ecosystem wallet project SecondFi has announced the launch of a wallet migration tool and revealed a recovery plan for assets affected by the June 2026 security incident. As the project will cease operations, users are required to migrate remaining assets still held in SecondFi wallets. The migration tool is expected to go live on August 13, supporting the transfer of eligible ADA, Cardano native tokens, and NFTs to new Cardano wallets created with service providers of the users' choosing. Currently, the tool only supports Cardano network assets; non-Cardano assets must be transferred separately through corresponding network and wallet processes. SecondFi stated that the migration tool has passed an independent security assessment by security firm Bitdefender. For affected assets, SecondFi plans to launch a recovery portal before September 10, where users can verify wallet ownership via zero-knowledge proofs (ZK Proof) and submit asset claims. SecondFi reminds users to only rely on information published through official channels, including @secondfiapp, @secondfi_jp, and the official support website, to guard against phishing sites and impersonating accounts.
Harmony released an incident update stating that on August 12, 2026, Beijing time, an unauthorized issuance event of the native token ONE occurred on the Harmony mainnet. Officials confirmed that the initial abnormal issuance volume was 4 billion ONE, completed through two empty block entries; additionally, on-chain reconstruction results show that the total forged cross-shard issuance volume could reach 3.0100001 trillion ONE, involving 6 forged cross-shard transactions and 4 attacker wallets, and the team is still further verifying the two sets of data.
According to Decrypt, Trezor's logistics partner ShipMonk suffered a data breach, leaking the personal information of a total of 13,689 customers. Among them, the names, phone numbers, email addresses, and home addresses of 11,742 individuals were fully obtained, while partial information of another 1,947 individuals was affected. The affected users were all customers who placed orders between May 10 and August 8 in the US, UK, Sweden, Colombia, Brazil, Italy, or Portugal. Trezor emphasized that its own system was not compromised, and devices, private keys, and wallet backups were all unaffected. It reminded users to be vigilant against phishing attacks and never enter wallet backup information online.
Odaily News: Bitcoin News posted on X platform that Trezor stated its customer data was exposed due to a security breach at logistics provider ShipMonk. Customers who received orders within 90 days before August 8 in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal may be affected. The exposed data includes full names, shipping addresses, phone numbers, email addresses, and order numbers. Trezor stated that its systems were not compromised and devices remain secure, but reminded affected customers to beware of sophisticated phishing attacks leveraging the leaked information.
Odaily News: The cross-chain bridge connecting XRP Ledger and Coreum was attacked on August 9. The attacker exploited a validation logic vulnerability to steal approximately 199,900 XRP, reducing the bridge's asset balance from roughly 200,400 XRP to 493.5 XRP. The attack did not involve private key leaks and did not target the XRP Ledger protocol itself. The attacker forged deposit operations, causing the bridge system to recognize them as legitimate deposits and triggering the bridge wallet on the other end to send real XRP. On-chain data shows that the attacker completed the fund transfer through 94 multi-signature authorization transactions within 97 minutes. These transactions required signatures from 17 of the 28 relay node keys, allowing the attacker to bypass the bridge's validation mechanism. As of August 11, the Coreum cross-chain bridge remains suspended, and the Coreum Development Foundation has not yet released an official incident report. The XRP mainnet and user private keys remain unaffected and secure.
Odaily News, Oraichain stated that yesterday's incident stemmed from a vulnerability in the EVM cross-chain transfer path, resulting in the unauthorized minting of ORAI. Since 04:00 UTC on August 9, the network has been suspended, with bridge contracts, cross-chain paths, and public interfaces also restricted. The relevant vulnerability path has been identified and addressed, and associated fund transfer routes have been restricted. The team is working with partners and centralized exchanges to limit further movement of funds and protect affected assets. Currently, investigations and account reconciliations are still ongoing, and the team is preparing to restore the standard supply of ORAI, including burning unauthorized minted balances, as well as reconciling and repairing affected protocol states.
Coinsbuy confirmed a security incident on August 9 involving unauthorized withdrawals from the platform wallet. The company stated it has covered customer losses with its own reserves and offered a $100,000 bounty.
Odaily News: On August 5, the minority staff of the U.S. Senate Committee on Banking, Housing, and Urban Affairs stated that the July 22 version of the CLARITY Act fails to meet five minimum standards. The bill, numbered H.R. 3633, aims to divide digital asset regulatory authority between the U.S. Securities and Exchange Commission (SEC) and the U.S. Commodity Futures Trading Commission (CFTC). The analysis suggests that the bill's two-tier system could remove certain blockchain assets from SEC oversight, allowing issuing companies to self-certify exemptions from securities regulation. Healthy Markets and five labor organizations have raised concerns over pension protections and securities law loopholes, while minority staff also noted that investors' private right of action and state and tribal enforcement powers could be weakened. Minority staff stated that DeFi-related companies could be exempt from anti-illegal financing obligations even if they earn millions of dollars from platform transactions; some crypto mixers may circumvent U.S. sanctions by exploiting the "Tornado Cash loophole." The Independent Community Bankers of America (ICBA) and the Conference of State Bank Supervisors (CSBS) warned that stablecoin yields could drain deposits from community banks, and the Systemic Risk Council has flagged related banking activities as potential bailout risks. Minority staff noted that Donald Trump alone earned over $1.4 billion from crypto businesses in 2025, with related enforcement solely under the purview of his Attorney General, and that obligations would terminate upon his departure from office. Elizabeth Warren and Richard Blumenthal, citing $3.8 billion in investor losses, have separately called on the SEC to investigate Trump memecoin. The Senate is scheduled to hold a cloture vote on September 15 on the motion to proceed, with the bill needing 60 votes to advance. (Bitcoin.com News)