News linked to both this project and an event.
Odaily reports: Multiple tech companies have urgently blocked 8 intermediate certificates with security vulnerabilities issued by Indian digital certificate authority eMudhra Limited. Due to flaws in the private key generation process of the affected certificates, attackers could exploit forged certificates to impersonate legitimate websites and intercept, read, or tamper with user communications.Mozilla cryptography engineer Dennis Jackson stated in an incident report that after receiving the vulnerability report on October 17, Mozilla independently recovered the relevant private keys, confirming that the generation mechanism has serious flaws and is highly exploitable.Mozilla subsequently blocked the affected certificates in Firefox through OneCRL and released browser updates for desktop and Android on October 20. Cloudflare also updated protections for services including Cloudflare One, WARP client, and Cloudflare Tunnel on Tuesday. According to Mozilla's disclosure, Chrome blocked the relevant certificates on Saturday, Apple devices completed blocking on Monday, and Microsoft platforms took corresponding measures on Tuesday. (Cointelegraph)
According to the Arbitrum Security Council report, Arbitrum took emergency action at around 23:30 Beijing Time on October 2 to temporarily halt the activation of new Stylus contracts on Arbitrum One and Nova, in order to mitigate the risk of AI-assisted attacks utilizing custom WebAssembly programs.
Zano disclosed a validation flaw in the Gateway Addresses introduced by Hard Fork 6. An attacker minted approximately 18.4 million ZANO in a single transaction on August 29, then minted an equal amount again on September 25, and minted fUSD in the same manner.The project team stated that the value of the illicit tokens involved exceeds $200 million, with potentially affected activity involving 117,941 outputs and 65,301 transactions. Zano has restored the chain state from block 3,833,000 and disabled Gateway Addresses. All affected balances will be fully restored, and the ZANO supply and issuance schedule will remain unchanged. (Bitcoin.com News)
Decentralized exchange protocol Balancer announced that community voting has approved the BIP-928 ordered liquidation proposal, while the fork proposal BIP-929 was not approved. The protocol's liquidity pools will operate normally until October 30, after which they will transition to a "withdrawal-only" mode and the bug bounty program will be simultaneously terminated. V3 vaults are expected to pause on November 30. Due to the non-custodial nature of the smart contracts, liquidity providers can withdraw funds at any time, and relevant withdrawal guidelines will be published prior to October 30.
Odaily News: Today, THORChain officially posted on X platform stating, "We have noticed the recent Bitget hack and are deeply saddened by it. We can imagine this is a difficult time for everyone in the industry. (However,) THORChain is as decentralized and permissionless as Bitcoin, Ethereum, and BNB Chain. When dealing with known stolen funds, what responsibility should Bitcoin, Ethereum, and BNB Chain bear?" Subsequently, it called out OKX CEO Star and Bitget CEO Gracy.However, crypto community members in the comments pointed out that when THORChain previously suffered an attack, it once suspended services for 39 days, and they are deeply ashamed of the differentiated treatment between the two situations.
Odaily reports: Privacy blockchain network Zano has disclosed that an inflation vulnerability involving Gateway Addresses has forced it to plan a rollback of approximately 24 hours of blockchain history, and has urged users to immediately cease all economic activity related to ZANO and Confidential Assets.Zano has promised to compensate for losses caused by the rollback, but has not yet announced the target block height for the rollback, the patched version, the compensation process, the mechanics of the vulnerability, or the amount of unauthorized assets created. Gateway Addresses went live on August 26 with Hard Fork 6. (Bitcoin.com News)
Odaily News: Canadian Bitcoin exchange and wallet company Bull Bitcoin stated that due to the Liquid Network attack on September 6, users are temporarily unable to redeem L-BTC back to Bitcoin through the platform, and redemption operations are still pending resumption.Bull Bitcoin expects the related redemption service to potentially resume within 30 days, but stated that this expectation is not guaranteed. Due to its reliance on the L-BTC redemption mechanism to balance inventory, the platform has temporarily closed inbound Lightning Network payments.In this attack, the attacker transferred out nearly 4,000 Bitcoin from the protocol, later returning approximately 3,400; currently still holding 598.50 Bitcoin, valued at over $51 million. Liquid Network stated on September 17 that block production, network transactions, and L-BTC transfers have returned to normal. (Bitcoin.com News)
According to an official tweet from Cronos Network, the Cronos network was previously affected by a vulnerability exploit targeting the Tectonic protocol. Validator consensus triggered an emergency halt to block production to protect user assets. The on-chain state has been rolled back to pre-exploit levels, and the network resumed block production at 07:49 Beijing Time on August 31, 2026, starting from block height 90,896,189. Node operators can now upgrade to Cronos v1.7.8 and use the latest mainnet snapshot to restart their nodes. The network remains under continuous monitoring, with select protocols, RPC providers, block explorers, and cross-chain bridges gradually recovering. A full post-mortem report will be released by the team in the near future.
According to Odaily, an investigation into the security vulnerability exploit of the Cosmos EVM module reveals that the primary attacker (0x9AE7) purchased $250,000 worth of NES and bridged it to Nesa Chain, exploiting a balance vulnerability to inflate holdings to 200 times their original size, then bridged approximately $50 million worth of NES back to Ethereum. The attacker's initial funding for the wallet originated from Monero. Through multiple wallets, the attacker exchanged NES for ETH on DEXs and deposited the proceeds into centralized exchanges. Due to rapid liquidity withdrawal, most exchanges suffered extreme slippage, and the attacker ultimately sold for only $315,000, netting a profit of approximately $60,000 after deducting costs.
Odaily News, SlowMist Security Team disclosed that the cross-chain bridge project Allbridge suffered an attack on August 19, 2026, with losses of approximately $190,000. Notably, this attack was not executed instantaneously—the attacker began laying the groundwork nearly a month in advance, bypassing the verification mechanism through forged cross-chain messages.According to SlowMist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as CCTP-style, claiming a transfer of 1 million USDC, despite no actual USDC burn operation occurring. Subsequently, Circle generated a valid attestation for this complete message following standard procedures.Approximately 24 days later, on August 19, the attacker waited for the Base Router to receive a genuine CCTP deposit, bringing its balance to approximately 191,000 USDC, then launched the attack just 6 seconds later. Using the previously forged message and attestation, the attacker called Allbridge's receiveCctpMessage function. Due to the project's lack of critical validation, the system mistook the fraudulent cross-chain message for a genuine deposit and recorded a 1 million USDC credit.Subsequently, the attacker borrowed approximately 809,000 USDC temporarily via an Aave flash loan to match the Router's balance with the forged amount, then utilized the internal credit record to call the transfer function, ultimately moving out approximately 999,000 USDC (after deducting a 0.1% fee). After repaying the flash loan and fees, the attacker netted approximately $189,800 in profit. The root cause of this vulnerability lies in Allbridge's failure to verify the identity of the cross-chain message sender and receiver, as well as its failure to confirm whether USDC was genuinely minted or whether the balance actually increased—instead directly trusting the amount and message hash data constructed by the attacker.SlowMist emphasized that on-chain message verification does not equate to actual asset arrival. Cross-chain protocols must not only verify message authenticity but also ensure the message source is trustworthy, confirm the receiver is Circle's official TokenMessengerV2, and only record assets after confirming actual minting and balance changes. This incident once again highlights the security risks in cross-chain bridges' message verification and asset settlement processes.
Odaily News: Peer-to-peer cryptocurrency trading platform NoOnes announced that it will begin gradually winding down operations after running for over three years. The company stated that it had been continuously seeking to resolve and lift the sanctions imposed on NoOnes, but ultimately failed. The sanctions caused the platform to lose key partners, and blockchain monitoring firms also flagged transactions associated with NoOnes as high-risk, making it increasingly difficult for the platform to continue normal operations. According to the plan, the business contraction began on August 17, and the P2P marketplace will close at 23:59 UTC on August 21. Services such as Swap, NoOnes Visa, fiat withdrawals, the gift card store, and the Bitcoin Lightning Network will also be discontinued progressively. After that, the platform will only support withdrawals, and users will still be able to log in, view balances, and withdraw remaining assets. The company advises users to complete asset withdrawals as soon as possible, no later than August 23. Previously, on January 26, 2025, NoOnes revealed that the platform had suffered a major security breach earlier that month, resulting in losses of approximately $8 million in crypto assets. CEO Ray Youssef confirmed the news after on-chain detective ZachXBT disclosed the hacking incident on his Telegram channel.
DeFiLlama's anonymous founder 0xngmi stated that the team postponed the release of the official mobile app due to the long-standing presence of phishing apps impersonating DeFiLlama on the Apple App Store. Apple removed them only after the team submitted evidence that the malicious apps were stealing funds.
据 CNBC 报道，OpenAI 表示，因担忧未发布模型 Astra 可能具备自主发起网络攻击的能力，公司已暂停部分内部活动，并加强高能力模型的隔离测试、监控与检测措施。与此同时，Meta、Anthropic 等机构近期也出现涉及 AI 系统的安全事件，推动美国与欧盟加快前沿模型监管与风险控制措施的制定。
According to Cointelegraph, AnchorWatch CEO and Bitcoin Red Team founder Rob Hamilton stated that after integrating OpenAI Trust & Cyber capabilities into the Bitcoin Red Team's security research work, he faced access restrictions the next day and was forced to switch back to using Chinese open-source AI models to continue research. The Bitcoin Red Team has currently discovered 1,288 critical and high-risk vulnerabilities in the Bitcoin ecosystem, and research work significantly accelerated after the Coldcard hardware wallet was hacked (over $100 million in Bitcoin stolen). Hamilton commented on this: "Black-hat hackers face no restrictions, while white-hat researchers dedicated to reducing risk are excluded."
According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes due to attackers exploiting a critical vulnerability in LND (Lightning Network Daemon) to steal node credentials and transfer funds. Version 2.4.2 has upgraded to LND 0.21.1 and automatically rotates macaroon credentials in standard installations. The project team reminds operators to check for abnormal payments, channel closures, and balance changes as soon as possible; if nodes are exposed via self-built reverse proxies, Tor services, or port forwarding, relevant credentials must also be manually replaced. Currently, Foundation and Citadel21 have reported node fund losses, but the specific scale of losses has not yet been disclosed.
Bloomberg analyst Eric Balchunas says the Coldcard security vulnerability enhances the appeal of spot Bitcoin ETFs, with the incident involving approximately $88.6 million in losses.
ZEUS stated that its infrastructure has been temporarily taken offline due to a cybersecurity incident. Currently, the relevant attacks have been mitigated, and the platform will resume service operations after completing a comprehensive audit of all systems. ZEUS emphasized that user funds have not been lost and are not at risk.
Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently, after a user implanted illegal pornographic content in a public group. The app was restored within hours.Durov said the attacker exploited a technical vulnerability to insert AI-modified illegal content into old messages within active groups, hiding the content by editing historical messages, making it difficult for regular group members to detect and report in time. This type of attack constitutes "takedown extortion," where attackers use automated accounts to implant violative content in public groups and report it to platforms like Apple, attempting to force group administrators to pay a ransom, or else exploit platform rules to get the community banned.Durov added that Telegram continuously combats illegal content through mechanisms such as user reports, AI filtering, and content hashing. This incident is not a systemic issue with the platform, but rather a targeted attack exploiting rule loopholes. He also warned that Apple's removal of the app without prior contact with Telegram could pose a risk to all mobile applications offering user-generated content (UGC), and platform developers need to strengthen their defenses against malicious reporting and "takedown attacks."
Odaily News: Bitcoin News posted on X platform, stating that Boltzhq has indefinitely suspended its swap service after reporting an increase in AI-assisted attacks and multiple contained exploits. Due to its non-custodial design, user funds were never at risk, but wallets relying on Boltz for Lightning Network swaps, including AquaBitcoin and BULLBITCOIN, experienced service disruptions while alternative infrastructure is being deployed.
Odaily news "On-chain detective" ZachXBT posted in his personal channel, stating that Telegram continues to allow scam advertisements to be displayed to subscribers in his channel, impacting user experience and posing potential security risks.ZachXBT stated that if users are Telegram Premium members and wish to support upgrading his channel, they can help it reach the required level by using the channel's Boost function, thereby unlocking the ability to disable ads. Currently, the channel needs to reach Level 50 to enable the ad-disabling option.ZachXBT has long focused on scams, hacker attacks, and on-chain fund tracking within the crypto industry, and has repeatedly exposed incidents involving phishing attacks, fake projects, and fund theft.This time, he raised concerns about Telegram's advertising mechanism, arguing that the platform allowing scam advertisements to appear in crypto community channels may increase the risk of users encountering malicious links and fraudulent activities.