News linked to both this project and an event.
Odaily News: The Dutch National Cyber Security Centre (NCSC) has reported that attackers are exploiting a vulnerability in Apple's macOS Screen Sharing feature to take control of devices and install Monero mining programs. Multiple systems with port 5900 exposed to the internet have been compromised, with attackers gaining root access. The vulnerability, tracked as CVE-2026-65400, has a severity score of 7.1 out of 10. It stems from a state management error in the authentication process, allowing remote attackers to bypass login verification without valid credentials. Public proof-of-concept code has already been circulated. Apple has addressed the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The NCSC advises users to update their systems promptly and avoid exposing the Screen Sharing service directly to the internet. (Decrypt)
According to Specter monitoring, over $7.9 million was stolen from wallets associated with Coinsbuy on Ethereum and TRON, and the attackers subsequently laundered the funds into XMR through exchanges. Coinsbuy stated that, with the support of ChangeNOW, it has successfully frozen stolen funds amounting to up to six figures. Following the incident, Coinsbuy temporarily suspended deposit and withdrawal services, which have now resumed.
Odaily News, January 10 - A Bitcoin and Litecoin holder provided a 12-word recovery phrase to attackers impersonating Trezor support personnel, resulting in the theft of approximately $282 million in assets, including about $139 million in Bitcoin and $153 million in Litecoin. Blockchain forensics firm ZeroShadow stated that the incident stemmed from a social engineering attack, not a compromise of wallet software or private key infrastructure. The stolen funds were split via the THORChain cross-chain bridge within minutes and converted into Monero through instant exchange services. ZeroShadow's monitoring team flagged and froze approximately $700,000 in funds within 20 minutes. Under the BIP39 standard, a 12-word recovery phrase contains approximately 128 bits of entropy, while a 24-word phrase contains 256 bits of entropy. Chainalysis estimates that up to 23% of all mined Bitcoin is permanently inaccessible due to lost keys, involving millions of BTC, with causes including forgotten recovery phrases, damaged backups, and a lack of inheritance planning.
According to Chainalysis, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) updated its sanctions list against ISIS-K (Islamic State Khorasan Branch) on July 1, adding 134 cryptocurrency wallet addresses, of which 131 are on the TRON chain and 3 are Monero addresses. On-chain data shows that the aforementioned TRON wallets have cumulatively received over $1.4 million since 2023 and transferred out over $880,000, with some funds flowing to Syrian crypto exchangers. Currently, Tether has frozen the balances of all 131 TRON addresses. Additionally, on the same day, OFAC also sanctioned two Brazilian individuals and four companies related to the Latin American criminal organization "Primeiro Comando da Capital" (PCC), accusing them of using cryptocurrency to transfer over $30 million in illegal proceeds across borders from the United States to Brazil.
Odaily, the decentralized cross-chain liquidity protocol THORChain has resumed trading after being down for over five weeks following a May attack. Signing, swapping, liquidity provider operations, and redemptions have all been restored.On May 15, blockchain investigator ZachXBT and security firm PeckShield identified that the protocol had likely been exploited, prompting THORChain to halt trading. The vulnerability resulted in a loss of approximately $10.7 million from one of its six Asgard vaults, while the other five vaults were unaffected.THORChain stated that each vault has now been verified, and every key share has been cross-checked. Native Monero swaps are currently undergoing end-to-end testing and will be launched subsequently. (The Block)
RetoSwap, a Monero ecosystem P2P trading platform, announced that its Haveno trading protocol has been exploited by attackers. The team has urgently suspended trading by raising the minimum required client version to 2.0.0 and blocking the attackers’ Onion addresses. RetoSwap emphasized that its own infrastructure was not compromised; this incident stems from a vulnerability in the Haveno protocol. In May this year, RetoSwap disclosed a prior attack in which attackers exploited a protocol vulnerability to steal approximately 7,000 XMR—valued at roughly $2.7 million at the time.
According to the THORChain blog, ZEC is in the queue for launch on THORChain. However, due to a recent vulnerability disclosed in Zcash—whose existing patch impacts integrators’ normal operations—THORChain must first complete a minor code modification to its Bifrost module before proceeding. The development team stated that the change is minimal but must be completed prior to ZEC’s launch. Monero (XMR) is currently expected to launch by the end of this month, with ZEC scheduled to follow.
According to on-chain analyst PeckShield (@PeckShieldAlert), RetoSwap—a peer-to-peer, decentralized exchange for Monero (XMR)—was exploited by hackers leveraging a vulnerability in the Haveno trading protocol, resulting in the theft of users’ funds totaling 7,000 XMR (approximately $2.7 million). Following the incident, the RetoSwap team responded swiftly, blacklisting the attacker’s onion address at 02:33 UTC and pausing all platform trading by enforcing an upgrade to client version 2.0.0. The attack has now been contained.
privacy project Monero has released the graphical wallet software GUI version 0.18.5.0 "Fluorine Fermi". This update is a recommended upgrade version, primarily including numerous bug fixes and feature optimizations. Key highlights of this release include:Migration of the P2Pool installation path to LocalAppData on Windows systemsFix for an edge case in URI parsingProhibition of creating offline transactions in scenarios involving long payment IDsEscaping untrusted text during QR code scanning to enhance securityUpgrade of P2Pool to v4.15Numerous detail bug fixes and stability improvementsMonero officials stated that this version has been open-sourced on GitHub. Users can download and upgrade through official channels to obtain the latest security fixes and stability improvements.
According to the official announcement, HTX has launched the “Spring Travel Season” trading competition. From now until May 9 at 18:00 (UTC+8), users who register and participate in spot trading of BTC, ETH, SOL, XMR, or LTC—or USDT-denominated perpetual contracts of DOGE, PEPE, XAG, TRUMP, or XMR—and complete designated tasks will accumulate “Miles.” Prizes totaling $50,000 will be distributed among participants based on their Mile rankings. Additionally, users who fulfill both the spot holding requirements and complete daily contract trading check-ins for the entire duration will qualify for a lottery draw, sharing an extra $1,500 prize pool.
According to Fortune, Foundry, a leading Bitcoin mining pool, officially launched a new mining pool for the privacy coin Zcash on April 13. Mike Colyer, CEO of Foundry, stated that this move aims to address growing institutional demand for privacy coins. The pool has already attracted several institutional miners, and its output now accounts for nearly one-third of all newly minted Zcash globally. Zcash implements transaction privacy via zero-knowledge proof technology while supporting selective disclosure to meet regulatory compliance requirements—making it more appealing to institutions than its competitor Monero. Fueled by this news, Zcash’s price has surged over 75% in the past 30 days, with its current market capitalization standing at approximately $6.3 billion. Foundry currently controls about 31% of the global Bitcoin hash rate, making it the world’s largest Bitcoin mining pool operator.