affected

Regarding the previous incident where the FlashLoopAdapter vulnerability caused a loss of approximately 114 ETH from two Safe multi-signatures, Aave founder Stani Kulechov stated that the contract with the vulnerability is not the Aave v3 contract, but rather a third-party external adapter built on top of Aave, which does not affect Aave v3 itself.Previously, SlowMist disclosed that the FlashLoopAdapter has an access control vulnerability, which attackers exploited to bypass permission checks and transfer assets from two Safe multi-signatures that enabled the module, ultimately resulting in a loss of approximately 114.09 ETH.

MetaMask has released a follow-up statement regarding the previously disclosed infrastructure security incidents, stating that the team is continuously conducting investigations and addressing the issues.MetaMask stated that to ensure user safety, it has collaborated with relevant partners to take preventive measures and is currently withdrawing the affected validator nodes from its non-custodial staking business. According to the investigation results so far, there is no indication that MetaMask wallets or customer funds have been affected.This morning, part of the infrastructure of MetaMask's non-custodial staking business encountered a security incident. As a precaution, the validators operating on Lido have begun to withdraw.

Aave founder Stani posted on the X platform, stating that the team is currently monitoring the progress of the MetaMask Staking infrastructure security incident in collaboration with Lido.Stani mentioned that the Aave market is currently unaffected, and all operations are running normally.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

DyorSwap officially announced that the so-called "GIWA Mainnet" identified by the team earlier is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

DyorSwap officially announced that the so-called "GIWA mainnet" previously identified by the team is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

Bitget stated that the vulnerabilities related to the security incident discovered on September 24 have been confirmed and fixed. The platform will gradually resume withdrawals after completing further security checks. Mandiant, a cybersecurity company under Google, and Slow Mist Technology are assisting in the investigation.The resumption schedule is as follows (UTC):September 28, 8:00: Bitcoin network BTCSeptember 29, 8:00: Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism network ETHSeptember 30, 8:00: Ethereum, BNB Smart Chain, Solana, Tron network USDTOctober 2, 8:00: Other tokens, fiat currencies, and peer-to-peer transactionsBitget mentioned that the suspension of withdrawals is a temporary security measure and is unrelated to the availability of user assets; account balances have not been affected, and the protection fund will cover the financial impact caused by this platform-level incident. The situation is currently under control, and unauthorized transfers will not occur again. Trading and deposit services are still operating normally. Users do not need to take any action in advance; the specific reopening situation will be subject to notifications from the platform and official channels.

OpenSea Chief Technology Officer (CTO) Chris Maddern posted on the X platform in response to the impact of the security incident involving Magic Eden and Limit Break, emphasizing that OpenSea's systems and smart contracts have not been affected. Currently, the affected ERC-721 NFTs have been marked on OpenSea and cannot be sold.For any newly discovered exploited NFTs, OpenSea will also automatically mark them to restrict attackers from obtaining related offers.

Magic Eden announced that the vulnerability occurred in the NFT trading protocol Payment Processor V2 maintained by Limit Break. Magic Eden adopted this protocol for EVM network transaction settlements in 2024 but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026. Therefore, NFTs currently listed on Magic Eden are not affected by this vulnerability.NFTs listed through its EVM market between February and October 2024 may be affected, while listings after October 2024 are generally not impacted. The platform is contacting the protocol owner and maintainer Limit Break to explore other risk mitigation measures, including pausing protocol transfers, and will continue to investigate the actual scope of the impact.Magic Eden reminds users who have listed or traded NFTs on its EVM market to revoke relevant contract authorizations on the Ethereum, Polygon, and Base networks. Users can filter the address through revoke.cash and revoke all authorizations marked as "approved for all" for NFTs. Magic Eden emphasizes that revoking authorization cannot recover assets that have already been transferred.Yuga Labs' Vice President of Blockchain Quit stated today that at 9 AM Eastern Time, attackers exploited the Payment Processor V2 vulnerability to steal a large number of NFTs. After contacting the LimitBreak team, the latter quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain is also temporarily unable to be paused. Therefore, the team implemented a white-hat operation, successfully transferring and protecting 23,155 NFTs valued at over 5.7 million dollars.

Bitget Wallet posted on platform X stating that it operates independently from Bitget Exchange, belonging to a self-custody wallet, where user assets are always on-chain and controlled by the users themselves, isolated from the custodial infrastructure of Bitget Exchange.In response to the recent security incident at Bitget, Bitget Wallet has conducted preventive checks on its internal systems and found no security impact on the Bitget Wallet system or user self-custody assets. Currently, Bitget Wallet is operating normally and reminds users to be vigilant against phishing and impersonation activities, and to obtain the latest information through official channels.

Bitget's Greater China Regional Head, Xie Jiayin, tweeted in response to the previous attack incident, stating that the Bitget Protection Fund (currently over $464 million) can cover the losses from this attack, and user assets are unaffected.At 2:31 AM today, Bitget's security system detected abnormal transfers in some hot wallets. The security team immediately activated the emergency response mechanism. The confirmed situation includes: a preliminary assessment of the amount involved is approximately $351.6 million; the cold wallets and the vast majority of platform assets are intact and unaffected.Measures taken include: activating the emergency response team within minutes of the incident, marking and reporting the addresses involved in the abnormal transfers; temporarily disabling the withdrawal function for security reasons, which will be restored in an orderly manner after the security review is completed; notifying law enforcement and on-chain security agencies to intervene in the investigation. The team will provide continuous updates on the status every hour, and the official report will be released within 24 hours, including a root cause analysis and corrective measures. The official will not speculate on the method of attack until the investigation conclusions are clear.

Bitcoin News posted on the X platform stating that Blink claims all account balances affected by the security incident have been restored to pre-incident levels. The software vulnerability had allowed attackers to transfer funds from dozens of accounts and obtain account information for approximately 3,400 other users.Blink stated that no funds were stolen from these 3,400 accounts, and the attackers did not obtain users' names, identification documents, or addresses; the company has contacted the affected users and will release a complete incident review.

The cryptocurrency wallet application SecondFi tweeted a reminder for users affected by the previous security incident regarding the risks of claiming NIGHT tokens. Some affected users will have a window to claim NIGHT tokens on September 22, but the Midnight Foundation's system only supports claims from the original wallet addresses and cannot switch to other unaffected addresses. The affected wallets have permanently existing security risks. SecondFi advises users not to attempt to claim NIGHT through compromised wallets, or the tokens will face the risk of being stolen.SecondFi also stated that the NIGHT claiming process is independently managed by the Midnight Foundation, and its wallet migration tool and asset recovery tool do not cover NIGHT claims. Affected users should contact the Midnight Foundation directly. Previously, SecondFi experienced a security incident from June 21 to 23, resulting in approximately 16.1 million ADA (about 2.6 million USD) being stolen, involving 374 wallets.

The Chief Information Security Officer of Slow Fog, 23pds, posted on platform X stating that the black and gray industries have established an attack chain against iOS users: clicking on links to extract private keys and mnemonic phrases; when users access web pages using Safari, they gain JS layer read and write capabilities through WebKit/JSC memory corruption; bypassing PAC to obtain native call capabilities; escaping the WebContent sandbox; escalating privileges in the kernel to gain root access, stealing Keychain and wallet data.The affected versions are iOS 13 to 26.5, and it is recommended that iOS users upgrade as soon as possible.

Revolut disclosed that an unauthorized third party used a legitimate email address under a government agency's real domain to submit false customer data retrieval requests, resulting in the disclosure of sensitive information for a small number of customers. The company referred to the incident as a "complex external impersonation scam," and has since banned the related email address, stating that its systems and customer funds were not affected.The potentially disclosed information includes names, dates of birth, addresses, email addresses, phone numbers, copies of identification documents such as passports and driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transaction records. Former Mt. Gox CEO Mark Karpelès stated that he is one of the affected individuals. Revolut has not disclosed the number of affected customers, whether the incident involved only a single market, or the government agency to which the impersonated domain belongs. The company has notified relevant government agencies, law enforcement, data protection authorities, and financial regulatory bodies. On-chain investigator ZachXBT speculated that the scale of the incident may be limited, but the target may be high-net-worth users.

Term Labs released a technical report on the security incident, confirming that all fixed-rate loan positions in the affected vault have been restored as of August 25. The incident was limited to the liquid balance within the Term vault, and Term V1 and V2 contracts were not compromised, with the direct lending market remaining open.Attack process: From August 17 to 18, the attacker funded an operational wallet through Tornado Cash and submitted a malicious proposal disguised as a governance proposal, setting the governance delay parameter to zero and removing the window for LP blocking changes. On August 23, the attacker executed two batches of attacks, extracting assets from the ETH and USDC strategies and transferring them to the attacker's wallet. Term Labs stated that it has cooperated with law enforcement, the affected vault and strategies have been closed, and the contracts have been upgraded and migrated before expiration.

According to the Ontology blog, its core development team discovered potential security vulnerabilities during routine security checks. Due to a high emphasis on the security and integrity of the mainnet, Ontology has immediately suspended block production on the Ontology mainnet to allow the technical team and validators to conduct a comprehensive security review of the network and related components. Ontology stated that no security incidents have been confirmed at this time, and there are no indications that user assets have been lost or stolen. ONT, ONG, and other on-chain assets are currently assessed to be unaffected; this suspension is a preventive security measure rather than a response to confirmed asset losses or ongoing attacks.During the review period, block production will remain suspended, and on-chain transactions cannot be processed. Users do not need to transfer or take any action regarding their ONT, ONG, and other on-chain assets, but should avoid conducting time-sensitive on-chain transactions until the network officially confirms its restoration. The duration of the suspension has not yet been determined, and the team will prioritize the comprehensiveness of the security review over speed; block production will not resume until the network has been thoroughly assessed and confirmed to be secure. The Ontology team is collaborating with validators and ecosystem partners to address this matter and will update progress through official channels, with a separate announcement to be made before and after the network restoration.

Blockstream stated that Jade is not affected by the Coldcard random number generator vulnerability and has released firmware 1.41 after receiving extensive AI-assisted security reviews. Jade indicated that it has undergone dozens of automated AI scans and multiple manual reviews, focusing on sensitive areas such as random number generation and transaction signing.The new firmware enhances stack protection, updates dependencies, audits sensitive memory cleanup processes, and upgrades the Jade runtime environment. Blockstream claims that Jade's random number generation mechanism uses multiple entropy sources, including hardware chip noise, timing data, sensor data, and camera noise, and mixes them using SHA-512 to prevent a single entropy source failure from affecting seed generation. The team stated that other lower-severity findings are still being addressed, and firmware 1.42 is expected to be released in a shorter development cycle.