Monero
XMRPrivacy-oriented cryptocurrency
News Heat Trend
Project Overview
Monero is an open-source, privacy-oriented cryptocurrency that was launched in 2014. Its blockchain is intentionally configured to be opaque, making transaction details such as the identity of senders and recipients and the amount of each transaction anonymous by disguising the addresses used by participants.
THORChain Resumes Trading After $10.7 Million Attack
Odaily, the decentralized cross-chain liquidity protocol THORChain has resumed trading after being down for over five weeks following a May attack. Signing, swapping, liquidity provider operations, and redemptions have all been restored.On May 15, blockchain investigator ZachXBT and security firm PeckShield identified that the protocol had likely been exploited, prompting THORChain to halt trading. The vulnerability resulted in a loss of approximately $10.7 million from one of its six Asgard vaults, while the other five vaults were unaffected.THORChain stated that each vault has now been verified, and every key share has been cross-checked. Native Monero swaps are currently undergoing end-to-end testing and will be launched subsequently. (The Block)
Foundry, a leading Bitcoin mining pool, has officially launched its Zcash mining pool, already accounting for nearly one-third of newly minted ZEC.
According to Fortune, Foundry, a leading Bitcoin mining pool, officially launched a new mining pool for the privacy coin Zcash on April 13. Mike Colyer, CEO of Foundry, stated that this move aims to address growing institutional demand for privacy coins. The pool has already attracted several institutional miners, and its output now accounts for nearly one-third of all newly minted Zcash globally. Zcash implements transaction privacy via zero-knowledge proof technology while supporting selective disclosure to meet regulatory compliance requirements—making it more appealing to institutions than its competitor Monero. Fueled by this news, Zcash’s price has surged over 75% in the past 30 days, with its current market capitalization standing at approximately $6.3 billion. Foundry currently controls about 31% of the global Bitcoin hash rate, making it the world’s largest Bitcoin mining pool operator.
A whale opens a 4x leveraged long position on XMR, target price $475–$516
According to on-chain analysis platform Lookonchain (@lookonchain), a newly created wallet deposited 3.56 million USDC into Hyperliquid, opened a long position on 36,000 XMR with 4x leverage valued at approximately $14.33 million, and set take-profit orders in the $475 to $516 range; the current XMR price is approximately $397.
Coinsbuy Hacked, Over $7.9 Million in Assets Stolen
According to Specter monitoring, over $7.9 million was stolen from wallets associated with Coinsbuy on Ethereum and TRON, and the attackers subsequently laundered the funds into XMR through exchanges. Coinsbuy stated that, with the support of ChangeNOW, it has successfully frozen stolen funds amounting to up to six figures. Following the incident, Coinsbuy temporarily suspended deposit and withdrawal services, which have now resumed.
value $4.18 million: an address opens a 4x long position with 11,000 XMR, ranking as the second-largest position on Hyperliquid
Odaily News: According to on-chain analyst Ai Yi’s monitoring, an address transferred 2 million USDC as margin and then opened a 4x long position of 10,962.78 XMR, valued at $4.18 million, with an entry price of $383.23. This has become the second-largest XMR position on Hyperliquid. The address has also placed a limit buy order worth $1.082 million between $378.2 and $381.4, indicating plans to add to the position if the price drops further.
OFAC updates ISIS-K sanctions list, adds 134 cryptocurrency wallet addresses; Tether has frozen all TRON address balances
According to Chainalysis, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) updated its sanctions list against ISIS-K (Islamic State Khorasan Branch) on July 1, adding 134 cryptocurrency wallet addresses, of which 131 are on the TRON chain and 3 are Monero addresses. On-chain data shows that the aforementioned TRON wallets have cumulatively received over $1.4 million since 2023 and transferred out over $880,000, with some funds flowing to Syrian crypto exchangers. Currently, Tether has frozen the balances of all 131 TRON addresses. Additionally, on the same day, OFAC also sanctioned two Brazilian individuals and four companies related to the Latin American criminal organization "Primeiro Comando da Capital" (PCC), accusing them of using cryptocurrency to transfer over $30 million in illegal proceeds across borders from the United States to Brazil.
Tether Freezes $72 Million USDT Amid Suspected Large-Scale Money Laundering Operation
According to on-chain investigator ZachXBT, on June 11, the TRON chain address TA6YHq...zCoQ received 120.2 million USDT and subsequently initiated multiple rapid transfers: over $12 million was sent to KuCoin’s deposit address; approximately $8 million was transferred to several instant-exchange platforms; and more than $8 million was bridged to the Bitcoin and Ethereum networks via the Near Intents cross-chain bridge. Additionally, this address placed a large number of Monero (XMR) buy orders, causing XMR’s price to spike briefly from $330 to $420. Minutes ago, Tether blacklisted and froze 72 million USDT in the address TBzrPE...Ak9W, which is directly linked to TA6YHq.
Whale Loracle's long positions suffer total loss of $6.65 million, with ZEC long position losing over $3.2 million
According to Onchain Lens monitoring, as ZEC and HYPE continue to decline, whale Loracle's 10x leveraged long position in ZEC has suffered losses exceeding $3.2 million, and the 2x leveraged long position in HYPE has lost $1.567 million. The whale also holds long positions in NEAR, TON, ASTER, and XMR, with total losses amounting to $6.65 million.
Hackers exploit macOS Screen Sharing vulnerability to compromise Macs and implant Monero mining programs.
据 Decrypt 报道，荷兰国家网络安全中心（NCSC）发出警告，攻击者正在积极利用 macOS 屏幕共享功能中的一个身份验证漏洞（CVE-2026-65400，严重性评分 7.1），对将 5900 端口暴露于公网的 Mac 设备发起攻击，成功获取 root 权限后植入门罗币挖矿程序。
Hackers Exploit macOS Screen Sharing Vulnerability to Gain Root Access and Mine Monero
Odaily News: The Dutch National Cyber Security Centre (NCSC) has reported that attackers are exploiting a vulnerability in Apple's macOS Screen Sharing feature to take control of devices and install Monero mining programs. Multiple systems with port 5900 exposed to the internet have been compromised, with attackers gaining root access. The vulnerability, tracked as CVE-2026-65400, has a severity score of 7.1 out of 10. It stems from a state management error in the authentication process, allowing remote attackers to bypass login verification without valid credentials. Public proof-of-concept code has already been circulated. Apple has addressed the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The NCSC advises users to update their systems promptly and avoid exposing the Screen Sharing service directly to the internet. (Decrypt)
Coinsbuy Hacked, Over $7.9 Million in Assets Stolen
According to Specter monitoring, over $7.9 million was stolen from wallets associated with Coinsbuy on Ethereum and TRON, and the attackers subsequently laundered the funds into XMR through exchanges. Coinsbuy stated that, with the support of ChangeNOW, it has successfully frozen stolen funds amounting to up to six figures. Following the incident, Coinsbuy temporarily suspended deposit and withdrawal services, which have now resumed.
$282 Million in Bitcoin and Litecoin Stolen in Trezor Impersonation Support Scam
Odaily News, January 10 - A Bitcoin and Litecoin holder provided a 12-word recovery phrase to attackers impersonating Trezor support personnel, resulting in the theft of approximately $282 million in assets, including about $139 million in Bitcoin and $153 million in Litecoin. Blockchain forensics firm ZeroShadow stated that the incident stemmed from a social engineering attack, not a compromise of wallet software or private key infrastructure. The stolen funds were split via the THORChain cross-chain bridge within minutes and converted into Monero through instant exchange services. ZeroShadow's monitoring team flagged and froze approximately $700,000 in funds within 20 minutes. Under the BIP39 standard, a 12-word recovery phrase contains approximately 128 bits of entropy, while a 24-word phrase contains 256 bits of entropy. Chainalysis estimates that up to 23% of all mined Bitcoin is permanently inaccessible due to lost keys, involving millions of BTC, with causes including forgotten recovery phrases, damaged backups, and a lack of inheritance planning.
MacOS Malware Exposed: Can Hijack Telegram Sessions and Steal Crypto Wallet Data
security researchers have discovered an information-stealing malware targeting MacOS devices that is attacking crypto users. It can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Affected wallets and applications include: Exodus, Atomic, Electrum, Wasabi, Monero, and others.Security experts advise that users with potentially infected devices should immediately treat them as "untrusted devices," terminate all active Telegram sessions, and change both their Telegram two-factor authentication password and desktop app password. Additionally, users should not enter seed phrases, private keys, or wallet passwords on the infected device, and should generate a new wallet and migrate their assets. (FinanceFeeds)
THORChain Resumes Trading After $10.7 Million Attack
Odaily, the decentralized cross-chain liquidity protocol THORChain has resumed trading after being down for over five weeks following a May attack. Signing, swapping, liquidity provider operations, and redemptions have all been restored.On May 15, blockchain investigator ZachXBT and security firm PeckShield identified that the protocol had likely been exploited, prompting THORChain to halt trading. The vulnerability resulted in a loss of approximately $10.7 million from one of its six Asgard vaults, while the other five vaults were unaffected.THORChain stated that each vault has now been verified, and every key share has been cross-checked. Native Monero swaps are currently undergoing end-to-end testing and will be launched subsequently. (The Block)
Hackers Exploit macOS Screen Sharing Vulnerability to Gain Root Access and Mine Monero
Odaily News: The Dutch National Cyber Security Centre (NCSC) has reported that attackers are exploiting a vulnerability in Apple's macOS Screen Sharing feature to take control of devices and install Monero mining programs. Multiple systems with port 5900 exposed to the internet have been compromised, with attackers gaining root access. The vulnerability, tracked as CVE-2026-65400, has a severity score of 7.1 out of 10. It stems from a state management error in the authentication process, allowing remote attackers to bypass login verification without valid credentials. Public proof-of-concept code has already been circulated. Apple has addressed the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The NCSC advises users to update their systems promptly and avoid exposing the Screen Sharing service directly to the internet. (Decrypt)
Coinsbuy Hacked, Over $7.9 Million in Assets Stolen
According to Specter monitoring, over $7.9 million was stolen from wallets associated with Coinsbuy on Ethereum and TRON, and the attackers subsequently laundered the funds into XMR through exchanges. Coinsbuy stated that, with the support of ChangeNOW, it has successfully frozen stolen funds amounting to up to six figures. Following the incident, Coinsbuy temporarily suspended deposit and withdrawal services, which have now resumed.
$282 Million in Bitcoin and Litecoin Stolen in Trezor Impersonation Support Scam
Odaily News, January 10 - A Bitcoin and Litecoin holder provided a 12-word recovery phrase to attackers impersonating Trezor support personnel, resulting in the theft of approximately $282 million in assets, including about $139 million in Bitcoin and $153 million in Litecoin. Blockchain forensics firm ZeroShadow stated that the incident stemmed from a social engineering attack, not a compromise of wallet software or private key infrastructure. The stolen funds were split via the THORChain cross-chain bridge within minutes and converted into Monero through instant exchange services. ZeroShadow's monitoring team flagged and froze approximately $700,000 in funds within 20 minutes. Under the BIP39 standard, a 12-word recovery phrase contains approximately 128 bits of entropy, while a 24-word phrase contains 256 bits of entropy. Chainalysis estimates that up to 23% of all mined Bitcoin is permanently inaccessible due to lost keys, involving millions of BTC, with causes including forgotten recovery phrases, damaged backups, and a lack of inheritance planning.
OFAC updates ISIS-K sanctions list, adds 134 cryptocurrency wallet addresses; Tether has frozen all TRON address balances
According to Chainalysis, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) updated its sanctions list against ISIS-K (Islamic State Khorasan Branch) on July 1, adding 134 cryptocurrency wallet addresses, of which 131 are on the TRON chain and 3 are Monero addresses. On-chain data shows that the aforementioned TRON wallets have cumulatively received over $1.4 million since 2023 and transferred out over $880,000, with some funds flowing to Syrian crypto exchangers. Currently, Tether has frozen the balances of all 131 TRON addresses. Additionally, on the same day, OFAC also sanctioned two Brazilian individuals and four companies related to the Latin American criminal organization "Primeiro Comando da Capital" (PCC), accusing them of using cryptocurrency to transfer over $30 million in illegal proceeds across borders from the United States to Brazil.
THORChain Resumes Trading After $10.7 Million Attack
Odaily, the decentralized cross-chain liquidity protocol THORChain has resumed trading after being down for over five weeks following a May attack. Signing, swapping, liquidity provider operations, and redemptions have all been restored.On May 15, blockchain investigator ZachXBT and security firm PeckShield identified that the protocol had likely been exploited, prompting THORChain to halt trading. The vulnerability resulted in a loss of approximately $10.7 million from one of its six Asgard vaults, while the other five vaults were unaffected.THORChain stated that each vault has now been verified, and every key share has been cross-checked. Native Monero swaps are currently undergoing end-to-end testing and will be launched subsequently. (The Block)
RetoSwap Attacked Due to Haveno Protocol Vulnerability; Minimum Client Version Upgraded
RetoSwap, a Monero ecosystem P2P trading platform, announced that its Haveno trading protocol has been exploited by attackers. The team has urgently suspended trading by raising the minimum required client version to 2.0.0 and blocking the attackers’ Onion addresses. RetoSwap emphasized that its own infrastructure was not compromised; this incident stems from a vulnerability in the Haveno protocol. In May this year, RetoSwap disclosed a prior attack in which attackers exploited a protocol vulnerability to steal approximately 7,000 XMR—valued at roughly $2.7 million at the time.
Related news
Hackers exploit macOS Screen Sharing vulnerability to compromise Macs and implant Monero mining programs.
据 Decrypt 报道，荷兰国家网络安全中心（NCSC）发出警告，攻击者正在积极利用 macOS 屏幕共享功能中的一个身份验证漏洞（CVE-2026-65400，严重性评分 7.1），对将 5900 端口暴露于公网的 Mac 设备发起攻击，成功获取 root 权限后植入门罗币挖矿程序。
Hackers Exploit macOS Screen Sharing Vulnerability to Gain Root Access and Mine Monero
Odaily News: The Dutch National Cyber Security Centre (NCSC) has reported that attackers are exploiting a vulnerability in Apple's macOS Screen Sharing feature to take control of devices and install Monero mining programs. Multiple systems with port 5900 exposed to the internet have been compromised, with attackers gaining root access. The vulnerability, tracked as CVE-2026-65400, has a severity score of 7.1 out of 10. It stems from a state management error in the authentication process, allowing remote attackers to bypass login verification without valid credentials. Public proof-of-concept code has already been circulated. Apple has addressed the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The NCSC advises users to update their systems promptly and avoid exposing the Screen Sharing service directly to the internet. (Decrypt)
A whale opens a 4x leveraged long position on XMR, target price $475–$516
According to on-chain analysis platform Lookonchain (@lookonchain), a newly created wallet deposited 3.56 million USDC into Hyperliquid, opened a long position on 36,000 XMR with 4x leverage valued at approximately $14.33 million, and set take-profit orders in the $475 to $516 range; the current XMR price is approximately $397.
Coinsbuy Hacked, Over $7.9 Million in Assets Stolen
According to Specter monitoring, over $7.9 million was stolen from wallets associated with Coinsbuy on Ethereum and TRON, and the attackers subsequently laundered the funds into XMR through exchanges. Coinsbuy stated that, with the support of ChangeNOW, it has successfully frozen stolen funds amounting to up to six figures. Following the incident, Coinsbuy temporarily suspended deposit and withdrawal services, which have now resumed.
value $4.18 million: an address opens a 4x long position with 11,000 XMR, ranking as the second-largest position on Hyperliquid
Odaily News: According to on-chain analyst Ai Yi’s monitoring, an address transferred 2 million USDC as margin and then opened a 4x long position of 10,962.78 XMR, valued at $4.18 million, with an entry price of $383.23. This has become the second-largest XMR position on Hyperliquid. The address has also placed a limit buy order worth $1.082 million between $378.2 and $381.4, indicating plans to add to the position if the price drops further.
$282 Million in Bitcoin and Litecoin Stolen in Trezor Impersonation Support Scam
Odaily News, January 10 - A Bitcoin and Litecoin holder provided a 12-word recovery phrase to attackers impersonating Trezor support personnel, resulting in the theft of approximately $282 million in assets, including about $139 million in Bitcoin and $153 million in Litecoin. Blockchain forensics firm ZeroShadow stated that the incident stemmed from a social engineering attack, not a compromise of wallet software or private key infrastructure. The stolen funds were split via the THORChain cross-chain bridge within minutes and converted into Monero through instant exchange services. ZeroShadow's monitoring team flagged and froze approximately $700,000 in funds within 20 minutes. Under the BIP39 standard, a 12-word recovery phrase contains approximately 128 bits of entropy, while a 24-word phrase contains 256 bits of entropy. Chainalysis estimates that up to 23% of all mined Bitcoin is permanently inaccessible due to lost keys, involving millions of BTC, with causes including forgotten recovery phrases, damaged backups, and a lack of inheritance planning.