Hacks
D'CENT App Wallet Flaw Drained 9.3M XRP From 6,160 Addresses as Vendor Urges Immediate Updates
On-chain tracking ties a mid-September drain of 9.3 million XRP — over $9 million — to a signing flaw in D'CENT's App Wallet software, with 1,552 wallets emptied in one two-hour window; D'CENT says users who typed recovery phrases into the app on versions before 8.1.0 are the exposure group.
Latest News
Security Digest: Nostra's 8,000x Oracle Pump Drained $3.5M, a MEV Bot Out-Ran a $7.8M Safe Exploit, and the Week Cost Crypto $20M
The week's smaller security stories in brief: a manipulated NSTR price feed let one account borrow $3.5 million from Nostra on Starknet, the Yoink MEV bot front-ran a $7.8 million rsETH theft on Ethereum, and trackers tally roughly $20 million in incident losses across seven days.
FomoPeek: iOS Malware With a Kernel Exploit Framework Passed Apple's App Store Review — Binance and SlowMist Warn Users
Binance Wallet issued an urgent advisory after SlowMist and OKX found that FomoPeek versions 1.1 and 1.2 — distributed through the official App Store — contained an iOS kernel exploitation framework able to escape the sandbox, decrypt Keychain data and harvest private keys and seed phrases from other apps. Version 1.3 removed the code; anyone who ran the affected versions is advised to rebuild their wallet on a clean device.
Radix Post-Mortem: Three-Year-Old Vault Authorization Bug Drained $1.3M and Forced a 10-Day Halt
The Radix Foundation's public incident report traces the August 31 theft of roughly $1.3 million to a vault-authorization flaw introduced during a June 2023 code cleanup — a defect that survived a 2024 Zellic audit and was only contained after validators deliberately broke network liveness for more than ten days. The Foundation said the attacker appeared to use AI-assisted code-analysis tools to find the gap.
RatHat: Android Malware Ships an AI-Guided Navigation Engine to Drain Banking and Crypto Apps
Zimperium zLabs analyzed a new Android remote-access trojan that enables Wireless Debugging for shell-level access, installs a persistent Go agent, and feeds the live accessibility tree to an AI assistant to navigate infected devices — with credential overlays aimed at banking and cryptocurrency applications. Attribution to China-based operators is suspected, based on Chinese-language AI prompts, and remains unconfirmed.
Security Digest: The Last Meter — September 21
This week's freshest attacks converge on the last meter between a user and their assets: an iOS app that shipped a kernel-exploitation framework through the App Store, an Android RAT that navigates infected phones with an AI assistant, and — in northern France — a family tied up at home while attackers forced a €40,000 transfer. Plus the status board: Liquid, Chainflip, Revolut, Kelp DAO, Swiss Bitcoin Pay and Fetch.ai — no new verified developments.
One Attacker, Two Protocols: Linked Exploits Drain $2M From Fetch.ai and NuNet
A single attacker drained 8.7 million FET (about $1.53 million) from a Fetch.ai token converter contract, then used the same wallet to mint 408.5 million unauthorized NTX through NuNet's deployer account — roughly $2 million combined. SlowMist traces the Fetch.ai root cause to an authorization gap in TokenConversionManagerV3's conversionIn(). Neither team has issued an official statement.
US Treasury Sanctions Iranian Exchange BitBank in Alleged IRGC Bitcoin Pipeline
OFAC designated the Iranian crypto exchange BitBank, its developers and three associates on September 18, alleging the network transferred hundreds of millions of dollars in Bitcoin to the Islamic Revolutionary Guard Corps. The action extends the Operation Economic Outcast campaign that earlier sanctioned Shelbit and Aban — and all allegations remain unadjudicated.
Security Digest: What a Signature Is Worth — September 20
Today's thread is authorization: the Fetch.ai exploit trusted one signature where the contract should have demanded more, the S&P–OpenZeppelin deal prices exactly that kind of assurance, Gyazo's metadata leak shows what happens when the proof behind a link leaks, and Japan's NPA officially attributes the ¥1.7B WaterPlum campaign. Plus the status board: Liquid peg-outs, Chainflip claims, Revolut extortion, Kelp DAO, Swiss Bitcoin Pay — all unchanged.
S&P Global to Acquire OpenZeppelin, Folding Smart Contract Audits Into Credit Ratings
S&P Global has agreed to acquire the smart contract security firm OpenZeppelin and will run it as a business unit reporting to S&P Global Ratings. Terms were undisclosed. The deal merges code-level security assurance with issuer-level ratings under one division — the clearest signal yet that on-chain code quality is being treated as rated credit infrastructure.
Cardano's IOG Warns Users After Official YouTube Channel Hijacked for Suspected Deepfake Hoskinson Giveaway
Input Output Group told users to avoid its YouTube channel on September 18 after an apparent takeover carried a roughly two-hour livestream — dressed as a Project Catalyst town hall — in which a suspected AI-manipulated Charles Hoskinson promised to 'double your wealth' via a QR code. No losses have been verified.
Targeted Cyberattack on Institutional Provider Haruko Hit 15 Clients; Some Hedge-Fund Assets Lost
The London-based crypto technology provider said a group attacked Haruko itself, exploiting a process vulnerability to extract an access token and capture read-only exchange API details from memory. All 15 affected clients were those without IP whitelisting — and a small amount of their funds was stolen, according to people familiar with the incident.
Security Digest: The Trusted Channel — September 19
Today's stories share one mechanism: attackers operating inside channels victims already trust — a recruiter's coding task, an official YouTube channel, a vendor's own access token, a certified police mailbox. Plus the status board: Liquid peg-outs still paused at day 14, Chainflip's restart resets TRON provider balances to on-chain claims, the Revolut extortionists' countdown expires, Kelp DAO and Swiss Bitcoin Pay unchanged — and the Symbiosis root cause lands as a two-bug report.
FBI and Japan's NPA Attribute $10.7M Fake-Recruiter Campaign to North Korea's WaterPlum
A September 18 joint advisory from Japanese, US, Australian and German agencies says WaterPlum — widely known as Contagious Interview — infected 30,000+ devices across 100+ countries and drained at least $10.7 million from crypto wallets between December 2025 and July 2026, using fake job interviews aimed at developers.
Study: 94% of Losses at Audited DeFi Victims Fell Outside Their Audit Scopes
A preprint from ack3-affiliated researchers and Czech Technical University examined 135 DeFi incidents from H1 2026 ($939.86M in losses) and found that where audits existed, 94.4% of reported losses came from attack paths outside every identified audit scope — though two large incidents dominate the figure.
Incident Analysis: The 20-Bit Gap That Let ICON's Withdrawal Path Be Replayed 1,490 Times
ICON Foundation's post-mortem of the August 27 replay exploit traces the loss to an integer-precision defect: the uniqueness check validated unsigned high bits of a serial number while the signature covered only the low 256 bits — a boundary two audits never crossed.
Security Digest: The Assurance Boundary — September 18
Today's edition is organized around one theme: the gap between what was reviewed and what was deployed. Plus the status board — Liquid peg-outs still frozen at day 13, Chainflip reimbursements still unexecuted, Kelp DAO still silent since the freeze expired, Swiss Bitcoin Pay still dark, and SecondFI rolls out a recovery tool in stages.
Beyond Lazarus: Researchers Split North Korea's Crypto-Hunting Apparatus Into Six Clusters
A September 7 joint analysis by Sekoia and Kudelski Security maps North Korea's offensive cyber operations into six distinct clusters — with the former APT38 lineage now concentrated in two units focused on cryptocurrency, Web3 and blockchain targets.
Chainflip's $736K TRON Exploit Was a Memo Problem, Not a Bridge Break
Chainflip lost 736,442.17 USDT after an attacker attached new memos to already-signed TRON transfers, tricking the protocol into paying twice against single deposits. The September 12 incident, confirmed by the protocol itself, exposed an instruction channel most chains never use — and the network is still paused.
Fake Cloudflare Checks Push Malware to Meme Coin Traders — One Reports $600K Loss
Phishing pages impersonating Cloudflare verification screens are being planted in token metadata fields on aggregator listings, then instructing victims to run a payload with administrator privileges on Windows. One trader reported losing about $600,000. The campaign skips wallet approvals entirely — it asks for code execution instead.
Security Digest: Attackers Are Routing Around On-Chain Defenses — September 17
Today's two research stories share one theme: campaigns that never touch a wallet approval. Plus the status board — Liquid at day 12 with 598.5 BTC still held, the Kelp freeze window expired with no announced resolution, Chainflip still paused, and follow-up reporting puts the Revolut breach at about 680 high-value accounts.