ltin

According to on-chain analyst PeckShield (@PeckShieldAlert), the same attacker successively exploited vulnerabilities in the SingularityNET bridging contract to illegally mint 260 million AGIX and 53.83 million WMTx on Ethereum.Currently, the attacker holds approximately 16.77 million USD in crypto assets, including 198.3 million AGIX (approximately 14.42 million USD), 649 ETH (approximately 1.67 million USD), and 33.58 million WMTx (approximately 627,000 USD).

According to Forbes, a warning jointly issued by multiple agencies including the Federal Bureau of Investigation (FBI) and the National Police Agency (NPA) of Japan indicates that the North Korea-linked hacker group WaterPlum (also known as Contagious Interview) will launch attacks on global IT developers from December 2025 to July 2026 by disguising itself as companies in the AI, cryptocurrency, or NFT sectors and offering fake job positions.Attackers contact job seekers on social media and recruitment platforms, luring them into downloading malicious files under the pretext of technical interviews or programming tests. They successfully infected over 30,000 devices, covering more than 100 countries and regions, and stole data from over 7,000 cryptocurrency wallets. Related funds of at least $10.71 million have flowed into wallets controlled by the attackers.

Recently, the meme coin market has been booming, and on-chain trading has become increasingly active. However, with the warming market, meme coin display pages have frequently shown highly disguised phishing links, and the "novel" attack methods have caused several seasoned traders to fall victim. Crypto KOLs @insidecalls and @cladzsol recently revealed that while scanning chains, they clicked on the meme coin homepage, which resulted in a "cloudfare verification" prompt. After completing the verification as instructed, the victim's on-chain funds were stolen. Among them, @cladzsol lost approximately $600,000 in assets.According to market news, on several recently popular meme coin display pages, the homepage redirects to a "cloudfare verification" page, which is actually a phishing link. If users follow the prompts, their computer systems will download and execute malicious scripts, leading to asset loss. This phenomenon is so rampant that it may be related to the delayed review processes of mainstream trading aggregation platforms like DexScreener. Currently, the display logic of relevant platforms is to directly reference the "official website" or social media links filled in the token metadata. These fields can be updated by token creators or those who later claim "community takeover." Hackers are exploiting this review loophole to transform meme coin display pages into new "fishing grounds" for phishing attacks. Users may inevitably click on unfamiliar links during the chain scanning process; if a "cloudfare verification" or other highly suspicious page appears, they should close it immediately to avoid interaction and protect their asset security.

According to a survey by the Financial Times, the Polish state-owned energy company Orlen had prepaid $230 million to the Dubai trader Hannon International for the purchase of approximately 6 million barrels of Venezuelan crude oil, but ultimately received only about 500,000 barrels of fuel oil. During the transaction, part of the funds was converted into USDT and delivered to the Venezuelan side through intermediaries.Hannon stated that at least $132 million in USDT was given to two intermediaries, after which the two intermediaries went missing. After accounting for expenses such as tanker leasing and legal fees, the Polish government estimates that Orlen's total loss amounts to at least $424 million. Orlen is currently seeking to recover the advance payment through arbitration.

According to Blockaid monitoring, an attack was discovered on an unidentified user's Safe multi-signature wallet on Ethereum. The attacker introduced a custom Uni V4 LP Safe module into a liquidity pool they created through a public keeper multicall, and then the hook unpacked aEthrsETH into rsETH, completing the extraction of Yoink MEV within the block. Currently, two transactions have been confirmed to cause approximately 7.73 million dollars in rsETH losses.

According to SlowMist monitoring, the BSC chain project BeatXswap suffered a price manipulation attack, resulting in a loss of approximately 2.985 million BTX (about $77,500).The attacker borrowed 6 million BTX through a flash loan and sold it into the Uniswap V3 pool to lower the price. They then exploited a vulnerability in the contract that used only the V3 pool's instant price as the sole pricing basis (without TWAP protection and without deviation limits), depositing USDT in two transactions to trigger liquidity mining and withdrew BTX from the LP position.

The cross-chain liquidity protocol Symbiosis is currently under attack on the BSC chain, resulting in an actual loss of approximately $336,000 WBTC.

According to Lookonchain monitoring, as the price of ZEC fell, two ZEC long positions were completely liquidated, totaling 3,848.5 ZEC (approximately 4.33 million USD).

According to Hyperbot data, due to the drop in Bitcoin prices, Huang Licheng's Bitcoin long position was completely liquidated about 1 hour ago, resulting in a loss of approximately $260,000. Currently, Huang Licheng's overall position is valued at approximately $87.11 million, with an unrealized loss of $1.469 million:25x leveraged Ethereum long position holds 33,000 ETH, with a position value of $80.124 million, and an unrealized loss of $1.076 million;10x leveraged HYPE long position holds 86,000 HYPE, with a position value of $6.99 million, and an unrealized loss of $393,000.

According to Blockaid monitoring, it has detected that the DeFi risk management protocol Cozy on Optimism has been attacked, resulting in a loss of approximately $170,000.

PeckShield data shows that in August 2026, the cryptocurrency industry experienced 50 major hacking attacks, an increase of 67% compared to July; losses decreased to $136.3 million, a drop of 49.5%. Among them, Tectonicfi lost approximately $74 million, and after Cronos suspended its network, only about $6 million was transferred out.Digital asset security company AEREDIUM launched AERSeal, which aims to replace the single private key controlling privileged smart contract functions with a multi-party authorized threshold signature. This product stores key shares in hardware-certified secure isolated environments and supports Ethereum Virtual Machine and compatible chains. AERSeal does not reconstruct the complete private key but generates signatures through the CGGMP24 threshold signature protocol. AEREDIUM founder and CEO Albert Dadon stated that the product can delegate permissions for minting, upgrading, and other functions to the threshold key, and confirm the transfer completion through on-chain verification; customers can also independently verify the allocated threshold key.

According to Onchain Lens monitoring, after Elon Musk replied to the SLINK post from Shivon Zilis's hacked account, multiple traders rushed into the token. Just four traders lost about $807,000. The market capitalization of $SLINK once soared to about $80 million, then plummeted to about $2 million, a drop of over 97% from its peak.

According to Slow Mist monitoring, Float Protocol suffered a flash loan attack, resulting in a loss of approximately $28,000 (10.71 ETH). The attacker manipulated the Uniswap V3 spot price (slot0) through a flash loan, leading to incorrect pricing of LP shares in the Hypervisor contract, with key functions lacking TWAP/oracle verification and slippage protection mechanisms.The attacker distorted the values of currentTick() and getTotalAmounts() by making large trades in the V3 liquidity pool, then repeatedly deposited and withdrew the inflated share value to arbitrage.

Cosmos Labs released a technical report, admitting that it previously misjudged an integer underflow vulnerability in the Cosmos EVM, which led to attacks on six blockchain networks between August 20 and 25, resulting in a total theft of approximately $5.7 million in tokens. The attacker exploited the vulnerability to underflow account balances to the maximum value of 2^256-1, then performed a reverse operation to transfer the inflated balance out, thereby stealing tokens from the target accounts without creating tokens out of thin air.The report shows that researchers submitted the defect through a bug bounty program on April 25, but testers were unable to reproduce it on the existing Cosmos chain configuration, so Cosmos Labs silently patched it in May. Independent researchers confirmed in early August that the vulnerability affected all Cosmos EVM chains, and Cosmos Labs released a patch on August 19, but the first attack occurred about 20 hours later.In terms of specific losses, MANTRA lost 720.9 million tokens (approximately $3.6 million), TAC lost nearly 3 billion TAC, and KiiChain lost about 148 million KII. Both MANTRA and KiiChain criticized Cosmos Labs for not notifying the affected chains in advance and suggesting a shutdown, with KiiChain stating that the patch would take several days to deploy while a shutdown would only take a few minutes. Cosmos Labs stated that it has coordinated responses with 40 chains and assisted 13 chains in completing repairs or shutdowns before being attacked.

Ajna stated that the protocol was attacked due to a vulnerability, and they are currently investigating abnormal fund flows. They recommend that users withdraw all funds, repay loans, and suspend interactions with the protocol.This incident involves liquidity pools such as syrupUSDC, wstETH, rETH, cbETH, WBTC, WETH/USDC, sDAI, with losses of approximately $775,000, attributed to a liquidation accounting manipulation attack.

According to monitoring by Onchain Lens, the Hyperliquid trader pension-usdt.eth's short position of $191.6 million in ETH held over the past two months was ultimately liquidated, resulting in a loss of approximately $23.93 million.Nevertheless, the trader has still accumulated an overall profit of about $17.22 million.

The blockchain gaming platform The Sandbox stated that it will compensate users who held bridged SAND on Base or BNB Smart Chain at a 1:1 ratio before the bridge vulnerability attack, with compensation provided in Ethereum-based SAND from the project treasury, and there will be no token issuance. This attack resulted in the theft of approximately 14.744 million SAND from the Ethereum treasury, valued at about $700,000.The application process is expected to open within two weeks and will last for two weeks; over 72% of the balances held by two centralized exchanges that meet the compensation criteria will be directly compensated to affected customers. The Sandbox indicated that the attacker exploited a configuration vulnerability in the SAND contracts on Base and BNB Chain, becoming the sole validator of bridge messages and minting unbacked tokens. Additionally, over 339 trillion unbacked SAND was minted on the two networks but has been isolated and cannot be cross-chain or exchanged; SAND on Ethereum and Polygon remains unaffected, and the compromised bridge contracts will be permanently disabled.

According to TenArmorAlert monitoring, the CCC token on the BSC chain was attacked, resulting in a loss of approximately $117,000.The attack exploited the contract's sell() function to destroy CCC tokens from the LP pool, causing abnormal price fluctuations.

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to monitoring by Blockaid, its vulnerability detection system has found suspicious activity on the Base chain related to Moonwell. Attackers manipulated the MAMO collateral price to borrow cbBTC from the mCBTC market.The currently observed impact is the transfer of 50.6 cbBTC (worth over 4 million USD).