Hacks
One Attacker, Two Protocols: Linked Exploits Drain $2M From Fetch.ai and NuNet
A single attacker drained 8.7 million FET (about $1.53 million) from a Fetch.ai token converter contract, then used the same wallet to mint 408.5 million unauthorized NTX through NuNet's deployer account — roughly $2 million combined. SlowMist traces the Fetch.ai root cause to an authorization gap in TokenConversionManagerV3's conversionIn(). Neither team has issued an official statement.
Latest News
Cardano's IOG Warns Users After Official YouTube Channel Hijacked for Suspected Deepfake Hoskinson Giveaway
Input Output Group told users to avoid its YouTube channel on September 18 after an apparent takeover carried a roughly two-hour livestream — dressed as a Project Catalyst town hall — in which a suspected AI-manipulated Charles Hoskinson promised to 'double your wealth' via a QR code. No losses have been verified.
Targeted Cyberattack on Institutional Provider Haruko Hit 15 Clients; Some Hedge-Fund Assets Lost
The London-based crypto technology provider said a group attacked Haruko itself, exploiting a process vulnerability to extract an access token and capture read-only exchange API details from memory. All 15 affected clients were those without IP whitelisting — and a small amount of their funds was stolen, according to people familiar with the incident.
Security Digest: The Trusted Channel — September 19
Today's stories share one mechanism: attackers operating inside channels victims already trust — a recruiter's coding task, an official YouTube channel, a vendor's own access token, a certified police mailbox. Plus the status board: Liquid peg-outs still paused at day 14, Chainflip's restart resets TRON provider balances to on-chain claims, the Revolut extortionists' countdown expires, Kelp DAO and Swiss Bitcoin Pay unchanged — and the Symbiosis root cause lands as a two-bug report.
FBI and Japan's NPA Attribute $10.7M Fake-Recruiter Campaign to North Korea's WaterPlum
A September 18 joint advisory from Japanese, US, Australian and German agencies says WaterPlum — widely known as Contagious Interview — infected 30,000+ devices across 100+ countries and drained at least $10.7 million from crypto wallets between December 2025 and July 2026, using fake job interviews aimed at developers.
Study: 94% of Losses at Audited DeFi Victims Fell Outside Their Audit Scopes
A preprint from ack3-affiliated researchers and Czech Technical University examined 135 DeFi incidents from H1 2026 ($939.86M in losses) and found that where audits existed, 94.4% of reported losses came from attack paths outside every identified audit scope — though two large incidents dominate the figure.
Incident Analysis: The 20-Bit Gap That Let ICON's Withdrawal Path Be Replayed 1,490 Times
ICON Foundation's post-mortem of the August 27 replay exploit traces the loss to an integer-precision defect: the uniqueness check validated unsigned high bits of a serial number while the signature covered only the low 256 bits — a boundary two audits never crossed.
Security Digest: The Assurance Boundary — September 18
Today's edition is organized around one theme: the gap between what was reviewed and what was deployed. Plus the status board — Liquid peg-outs still frozen at day 13, Chainflip reimbursements still unexecuted, Kelp DAO still silent since the freeze expired, Swiss Bitcoin Pay still dark, and SecondFI rolls out a recovery tool in stages.
Beyond Lazarus: Researchers Split North Korea's Crypto-Hunting Apparatus Into Six Clusters
A September 7 joint analysis by Sekoia and Kudelski Security maps North Korea's offensive cyber operations into six distinct clusters — with the former APT38 lineage now concentrated in two units focused on cryptocurrency, Web3 and blockchain targets.
Chainflip's $736K TRON Exploit Was a Memo Problem, Not a Bridge Break
Chainflip lost 736,442.17 USDT after an attacker attached new memos to already-signed TRON transfers, tricking the protocol into paying twice against single deposits. The September 12 incident, confirmed by the protocol itself, exposed an instruction channel most chains never use — and the network is still paused.
Fake Cloudflare Checks Push Malware to Meme Coin Traders — One Reports $600K Loss
Phishing pages impersonating Cloudflare verification screens are being planted in token metadata fields on aggregator listings, then instructing victims to run a payload with administrator privileges on Windows. One trader reported losing about $600,000. The campaign skips wallet approvals entirely — it asks for code execution instead.
Security Digest: Attackers Are Routing Around On-Chain Defenses — September 17
Today's two research stories share one theme: campaigns that never touch a wallet approval. Plus the status board — Liquid at day 12 with 598.5 BTC still held, the Kelp freeze window expired with no announced resolution, Chainflip still paused, and follow-up reporting puts the Revolut breach at about 680 high-value accounts.
TRM Labs: Fake AI Trading Bot Tutorials Turn Victims Into Their Own Drainer Operators
Nine near-identical YouTube tutorials promising a Claude-built arbitrage bot walked 224 victims into deploying and funding malicious contracts themselves — 274.60 ETH, about $517,000, drained between February and August 2026. No phishing link, no spoofed domain, no approval prompt: wallet defenses never fire.
DOJ Charges Two Former Robinhood Engineers Over Alleged Listing Front-Running on Hyperliquid
Federal prosecutors in Manhattan say Hefu Chai and Huaisong Xiang misappropriated confidential information about upcoming Robinhood Crypto listings and traded perpetual futures ahead of public announcements. The case is a reminder that listing calendars are among an exchange's most sensitive security assets — and that trading-venue integrity now reaches into DeFi.
Attacker Drains $7.8M in rsETH From Ethereum Safe — and an MEV Bot Takes It First
A leveraged rsETH position was drained from a Gnosis Safe through an over-permissioned custom module routed into an attacker-controlled Uniswap v4 pool. A generalized MEV bot front-ran the exploit in the same block and captured the tokens, and Kelp DAO froze the receiving address. Security firms are unanimous: this was module-authorization abuse, not a flaw in Safe core.
The rsETH Theft Is the Latest Warning About Smart-Wallet Modules
The $7.8M loss reconstructed by Blockaid, SlowMist and BlockSec came down to one over-permissioned helper contract the Safe owner had whitelisted. The pattern — attacks moving to the edges around well-reviewed core contracts — has been visible since Bybit, and it has specific implications for how modules should be reviewed, scoped and monitored.
Security Digest: The Ongoing-Incident Tracker for September 16
One lead story — the rsETH Safe-module theft front-run by an MEV bot — plus a consolidated status board for every major security incident still in motion: Liquid Network peg-outs frozen, Symbiosis hunting its attacker, Swiss Bitcoin Pay offline, the Revolut extortion, and the Kelp DAO freeze watch.
DOJ Moves to Forfeit $61M in Crypto Tied to Alleged Iranian Oil Laundering Through Binance
Prosecutors in Manhattan filed a civil forfeiture complaint against nearly $61 million in cryptocurrency they allege is proceeds of black-market sales of sanctioned Iranian oil, moved through Binance accounts by two China-based companies as part of a network that handled over $1.5 billion.
Revolut Attackers Reportedly Demand 10,000 BTC as Customer Data Leaks Continue
The actors behind the fraudulent government data request have escalated to extortion, reportedly demanding roughly $780 million in Bitcoin and threatening daily data dumps. Revolut has not confirmed the demand or authenticated the leaked files.
Security Digest: Solana Mobile Confirms Brevo Account Access, Liquid Peg-Outs Enter Week Two, Symbiosis Hunt Goes On
The day's smaller security stories in brief: Solana Mobile is the second big crypto name confirmed in the Brevo SSO breach, the Liquid Network begins its second week with peg-outs still frozen, and Symbiosis shifts from white-hat bounty to informant reward. Plus a status board on the Revolut extortion.
Swiss Bitcoin Pay Takes All Servers Offline After Suspected Intrusion
The Swiss non-custodial Bitcoin payment processor detected likely unauthorized access to its internal systems and shut down its entire infrastructure as a precaution. Emails, Bitcoin addresses, IBANs, transaction histories and hashed passwords may have been exposed; the company says funds and private keys are unaffected.