3+ week, 6+ day ago   (734+ words) SafePal disclosed on Aug. 16 that an authorization flaw in an order-tracking plugin exposed customer order information belonging to approximately 39,798 people. The affected records covered orders placed between March 2, 2025, and April 11, 2026, and included names, email addresses, shipping addresses, phone numbers and…...

1+ mon, 1+ week ago   (621+ words) Ostium has concluded that its July exploit originated from compromised off-chain infrastructure rather than a flaw in its smart contracts, after an investigation found the attacker manipulated price reporting to drain 23.75 million USDC from the protocol’s liquidity vault. According to…...

1+ mon, 2+ week ago   (445+ words) North Korea-linked hacking group BlueNoroff is using fake Zoom and Microsoft Teams meetings to profile cryptocurrency users before delivering malware. Cybersecurity firm JUMPSEC said it recovered and analysed source code from an active phishing kit after its operators exposed JavaScript…...

1+ mon, 3+ week ago   (639+ words) Balance Coin (BLC), an algorithmic stablecoin designed to track the U.S. dollar, lost more than 99% of its value after blockchain security firms reported a suspected exploit involving 42DAO. PeckShield said the incident caused about $915,000 in losses and linked the BLC collapse to…...

1+ mon, 3+ week ago   (622+ words) Kaspersky has exposed OkoBot, a year-old malware operation that uses roughly 20 modules to steal crypto wallet recovery phrases and has affected users across at least five countries. Kaspersky researchers discovered that the malware has remained active for more than a…...

1+ mon, 3+ week ago   (600+ words) A TrustedVolumes attacker has returned 1,122 ETH worth about $2 million while keeping another $2 million as a self-declared bounty. According to Com Feed monitoring, the Ethereum transfer represents a partial recovery from the May exploit, which initially drained about $5.87 million from a…...

1+ mon, 4+ week ago   (684+ words) Ostium has halted trading after an exploit tied to a compromised oracle signer key drained nearly $18 million USDC from its liquidity vault, according to blockchain security firm Blockaid. Blockaid reported that the attacker gained control of an oracle signer private…...

2+ mon, 3+ day ago   (584+ words) A malicious update to an Injective developer package has exposed private keys and seed phrases after being downloaded more than 300 times, Socket has found. According to security firm Socket, version 1.20.21 of the @injectivelabs/sdk-ts npm package, which has about 50,000 weekly…...

2+ mon, 3+ day ago   (554+ words) The Ethereum Foundation has revealed that the biggest challenge in AI-assisted security research has become proving which reported vulnerabilities are genuine rather than finding potential bugs. According to the Ethereum Foundation’s Protocol Security team, recent experiments with coordinated AI agents…...

2+ mon, 1+ week ago   (471+ words) Gnosis Pay has revealed that a software flaw dating back to October 2023 enabled the $1.5 million exploit of its card safe infrastructure, while confirming that all affected users have been fully reimbursed. According to a postmortem published by Gnosis Pay on…...