attack

Regarding the previous incident where the FlashLoopAdapter vulnerability caused a loss of approximately 114 ETH from two Safe multi-signatures, Aave founder Stani Kulechov stated that the contract with the vulnerability is not the Aave v3 contract, but rather a third-party external adapter built on top of Aave, which does not affect Aave v3 itself.Previously, SlowMist disclosed that the FlashLoopAdapter has an access control vulnerability, which attackers exploited to bypass permission checks and transfer assets from two Safe multi-signatures that enabled the module, ultimately resulting in a loss of approximately 114.09 ETH.

The Core Lightning team, which develops the open-source Bitcoin Lightning Network node software, has issued an urgent alert stating that reports indicate attackers are targeting nodes that have not installed patches, urging operators still running old versions to upgrade immediately. The team stated: "Emergency security update: If you are using version 26.06.7 or earlier, please upgrade to the latest release as soon as possible."Prior to this, Core Lightning began investigating a potential issue that could affect its experimental features and, in turn, impact user funds on September 16, and approximately six days later, version 26.06.8 was released. This update not only fixed several defects but also provided patches for security vulnerabilities reported responsibly by multiple parties, thanking the Bitcoin Red Team and 12 other individuals and organizations in the release notes, while also acknowledging anonymous reporters.According to the changelog, this round of fixes covers a bug that could cause sender nodes to crash, requests that could exhaust REST interface memory, and a vulnerability that could result in user funds facing confiscation losses when closing payment channels. To provide operators with ample upgrade windows and prevent attackers from taking advantage of reverse engineering and exploitation, this version intentionally obscured some testing content. Additionally, in August of this year, the project initiated a collaborative fixing process after reviewing a large number of AI-generated general vulnerability disclosure reports, and two days later released version 26.06.7 to close confirmed vulnerabilities.

Russian President Vladimir Putin stated that if Kaliningrad is directly attacked, Russia will consider using all weapons owned by the state. Putin said that the recent warning from the Russian Foreign Ministry is a response to the pressure actions by the West. NATO responded by stating that Russia's "irresponsible nuclear rhetoric" is unacceptable and will continue to defend the territory of its allies.

NEAR co-founder Illia Polosukhin stated that NEAR Intents and near.com have resumed operations, but some related services of the affected networks are still restricted.Illia mentioned that the approximately $3.8 million attack exploited vulnerabilities in the Omni deposit and withdrawal infrastructure and the interaction with NEAR Intents smart contracts, with the impact limited to USDT on BSC. The NEAR core protocol, NEAR tokens, and other applications were not affected, and affected users will receive full compensation.

According to Shield's monitoring, NEAR Intents attackers have transferred the stolen funds to Kucoin and bridged them to BTC. The attacker's address has interacted with an address marked as North Korea's LazarusGroup (0x098B7...E2f96).

NEAR Intents released a security notice confirming that it has encountered an attack. Preliminary investigations indicate that the vulnerability originated from a defect in the interaction between the Omni deposit and withdrawal infrastructure and contracts. The contract vulnerability has been fixed, and core services are expected to be restored within 1 hour, with a commitment to fully compensate for the damaged assets.NEAR Intents stated that deposit and withdrawal services for multiple public chains, including BSC, Polygon, and TON, will be additionally suspended for about 12 hours. The relevant cases have been reported, and on-chain tracking has begun.Subsequently, on-chain detective ZachXBT indicated that NEAR Intents' BSC hot wallet experienced multiple abnormal outflows of funds, with the stolen funds transferred to KuCoin and further cross-chain to the Bitcoin network. The amount involved has exceeded 3.8 million USD.

According to Law360, the cryptocurrency asset theft case involving Uranium Finance has begun trial in the U.S. District Court for the Southern District of New York.Prosecutors allege that Maryland cybersecurity consultant Jonathan Spalletta exploited a vulnerability in the protocol's smart contract to launch an attack in 2021, during which approximately $53.3 million was transferred from 26 liquidity pools in a second attack, leading to the protocol ceasing operations. The statements related to this are allegations by the prosecution and not a conclusion of guilt.

CoinBureau cites on-chain investigator ZachXBT, stating that suspected North Korean attackers are using Zcash to obscure the stolen funds from Bitget. Approximately 2,700 ZEC, worth about 3.8 million dollars, have begun to be transferred to Zcash's Ironwood.These stolen ZEC are being moved into a shielding pool, where transaction details can be hidden. In a security incident involving various assets totaling about 388 million dollars, approximately 18,900 ZEC, worth about 28.3 million dollars, were stolen. Previously, Bitget's CEO Gracy Chen expressed that she is "not very optimistic" about recovering the stolen funds.

According to a report by Fabien Arnaud from the French media Midi Libre, a resident in Saint-Jean-de-Védas near Montpellier, France, was the victim of a home invasion and extortion related to cryptocurrency. The police acted quickly after the incident and have arrested three suspects.It is reported that the victim had previously encountered a similar violent extortion related to cryptocurrency on April 11 of this year.

The on-chain tracking platform MistTrack under Slow Mist has monitored that the attacker of the security incident on the cryptocurrency exchange Bitget previously attempted to transfer the stolen funds to the cross-chain DEX protocol Chainflip for relocation, but was directly refused deposit by the relevant brokers.On-chain processing results show that the funds were not frozen by the protocol party, but were directly returned along the original route, and the attacker failed to successfully utilize this channel to complete the transfer. MistTrack stated that it will continue to track the subsequent on-chain movements of this batch of stolen funds.

Ari Paul, founder and chief investment officer of the cryptocurrency asset management company BlockTower Capital, posted on X that Coinbase "lost" $25 million of its company's funds years ago, and it was later discovered that the other party was actually covering up large-scale and repeated hacking attacks, and the relevant funds have still not been returned.Ari Paul stated that his team has tracked at least a dozen other affected institutions, with the concealed amount exceeding $1 billion. He mentioned that currently, they can only disclose this information because multiple legal proceedings are still ongoing.

Bitget's Greater China Regional Head, Xie Jiayin, recently addressed community concerns during a live broadcast. He reflected that since Bitget's establishment 8 years ago, user asset security has always been the top priority, successfully resisting multiple attempts of cyber attacks and maintaining a long-term record of secure operations. This incident marks the first security crisis in the platform's 8-year development history.Upon complete tracing, this incident is classified as a special attack targeting a third-party security software supply chain. The attacker exploited vulnerabilities in third-party products to obtain internal network credentials; however, private keys were not leaked, and cold wallet assets were unaffected. Currently, Bitget has partnered with security agencies Mandiant and SlowMist to conduct an independent review and will comprehensively upgrade the monitoring and management standards for third-party components. We are not only committed to promoting a full recovery following this incident but will also contribute to a safer, more robust, and healthier development of the industry through continuous technological iteration and system upgrades.

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

Bitget CEO stated that the attacker's address has been publicly listed and is under continuous tracking. Bitget calls on THORChain to refuse service to these addresses. Decentralization is a design principle and should not serve as a shield to facilitate known stolen funds.

Cosmos Labs disclosed that on September 22, Neutron encountered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. The Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out, Hub validators temporarily paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address. When the network was restored, these were transferred to a 4/6 multi-signature address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu through a one-time change. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. The current multi-signature address holds approximately 1.227 million ATOM, which can only be returned after authorization from a Cosmos Hub governance proposal. The related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.

According to Cointelegraph, blockchain security company SlowMist stated that its investigation has not linked the recent security warning caused by the iPhone Safari attack to confirmed cryptocurrency theft incidents.SlowMist told Cointelegraph that it has not independently confirmed any victims affected by the specific Safari attack samples it analyzed, and the strongest technical evidence it possesses covers iOS versions 18.4 to 18.6.2. The company stated that the reported impact range of "iOS 13 to 26.5" should be regarded as a preliminary assessment, and it tends to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is obtained.SlowMist pointed out that the Safari attack reused the previously disclosed DarkSword exploit chain technology, which is independent of another investigation involving malicious components embedded in App Store applications called FomoPeek. The Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since November 2025.

According to monitoring by Blockaid, Limit Break on Ethereum is currently facing ongoing attacks. The attackers are using Limit Break Payment Processor V2 to impersonate NFT holders and purchase authorized NFTs at a zero price. Currently, about 3 transactions have resulted in approximately 1.7 million dollars worth of NFTs being stolen.Blockaid reminds users who have authorized Payment Processor V2 as an NFT Operator to immediately revoke the relevant authorization. Simply canceling orders or Master Nonce will not lift this permission.

KelpDAO stated on platform X that it has filed a lawsuit against LayerZero and its co-founder Bryan Pellegrino, seeking accountability for the rsETH cross-chain bridge attack incident that occurred earlier this year. The lawsuit claims that LayerZero failed to adequately disclose its inherent technical weaknesses and risks; failed to prevent its security infrastructure from being compromised; and that LayerZero had previously reviewed and approved Kelp's deployment and configuration in writing.Officials stated that LayerZero has publicly attributed responsibility to itself in recent months. Since the occurrence of the attack, the team has taken action to ensure the safety of user assets, including migrating the rsETH cross-chain bridge to a more secure cross-chain standard.LayerZero co-founder and CEO Bryan Pellegrino tweeted that KelpDAO's related claims lack basis and that he will respond and defend in Vancouver.Previously, LayerZero released an incident report indicating that on April 18, 2026, the KelpDAO rsETH cross-chain bridge built on LayerZero was attacked, resulting in a loss of approximately 116,500 rsETH, valued at around $292 million.