attack

The French Minister of Finance confirmed that hackers breached the French Public Finance Directorate system at the end of June and stole personal and corporate taxpayer data. According to the platform FrenchBreaches, which tracks cyberattacks in France, this incident affected approximately 678,437 people, equivalent to about 1% of the French population, but the exact number is still under investigation and has not been finally confirmed.The leaked data reportedly includes sensitive information such as names, birth dates, home addresses, phone numbers, email addresses, tax identification information, and income data. Among them, nearly 27,000 individuals had tax incomes of at least 100,000 euros, 386 exceeded 1 million euros, and another 8 exceeded 10 million euros. Reports indicate that the database has been sold on the dark web market for thousands of euros. The attackers, calling themselves ZeroBytes, claimed they extracted the relevant records using an internal search tool, which was only discovered later when access was cut off.This incident has raised concerns in the cryptocurrency industry, as there has been a noticeable increase in "wrench attack" violent robbery incidents targeting cryptocurrency holders in France in recent years. If high-income individuals' addresses and contact information are leaked, it could provide criminals with a more precise target list.

According to the monitoring by the head of Galaxy Research, it has communicated with over 190 victims of Coldcard vulnerability attacks and has asked victims who have not yet contacted them to reach out via private message so that they can provide tracking information and assist in reporting losses to the relevant authorities.Since August 6, no new attack incidents have been confirmed, but this does not mean that new attacks will not occur, and vigilance is required.

According to Bitcoin News, Boltzhq has shut down due to its five-person team being overwhelmed by increasingly complex AI-assisted attacks. A group of experienced Bitcoin users will take over the service with additional capital and engineering resources.The founder has stepped down. The service is currently still offline, and the new team is working to restart it.

According to monitoring by Bitcoin News, new research published by @PraveenPerera shows that Coldcard attackers seem to first identify addresses with vulnerabilities, then sort them by the amount of Bitcoin held, starting to transfer in batches from the addresses with the highest holdings. The transfer software used was relatively crude.One address had 225 spendable UTXOs, and the attackers extracted exactly the latest 200, leaving the earliest 25, which included a UTXO worth 0.16 BTC. This aligns perfectly with the limitation of a blockchain API investigated by researchers, which defaults to returning 200 records, indicating that the attackers may have failed to load the next page of data. The software even spent a UTXO of 294 satoshis, reportedly increasing the transaction fee by about 2040 satoshis, with the spent amount significantly higher than the value of the UTXO itself.The authors of the study believe that the builders of this tool may have a better understanding of the account balance system than of the Bitcoin UTXO model. Although the attackers seem to have obtained the complete seed of the victims, at least 75 BTC still remain in other addresses derived from the same seed. The biggest suspicion currently is that among the 153 stolen addresses, there are still 132.95 BTC, and researchers have been unable to reproduce the seed behind these addresses, so it cannot be ruled out that the attackers obtained undisclosed private device data or candidate data.

According to Lookonchain monitoring, a user lost $100,000 after sending funds without verifying the address copied from the transaction history.Address poisoning attacks are common, so it is essential to carefully verify the wallet address before transferring funds.

According to a report by Decrypt, Israeli cybersecurity company ASecurity released a report stating that a researcher used publicly available AI models to discover multiple vulnerabilities in the Zoom annotation tool in less than 24 hours with fewer than 20 prompts, and constructed an exploitable attack chain. The vulnerabilities are numbered CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, allowing attackers to remotely execute code in meetings without any action from the victim, control their devices, steal data, and activate the microphone or camera.The attack was tested successfully on Windows, macOS, Linux, Android, and iOS versions of Zoom. ASecurity claimed it reached a "national-level" standard, whereas previously constructing such exploitation tools required months of work and a substantial budget from professional teams. ASecurity reported the first vulnerability to Zoom on June 10, and Zoom released fixes between June 22 and July 20, but the server-side protections in end-to-end encrypted meetings could not filter malicious messages, requiring users to update manually. A Zoom spokesperson confirmed that the issue has been resolved and advised users to keep their versions up to date.

According to on-chain detective Specter, the attacker exchanged all assets including WBTC, cbBTC, LDO, USDS, and CRV for DAI and ETH. The same wallet was previously hacked in September 2023 due to malicious token authorization, resulting in a theft of 24.23 million USD, with the attacker ultimately returning about 90% of the stolen funds. The attacker's address is 0x8fEB...F95Ae.

After the Coldcard hardware wallet firmware vulnerability was exploited, approximately 2,100 bitcoins were stolen, resulting in a loss of nearly $130 million. On-chain data shows that long-term holders transferred about 233,000 bitcoins from their wallets in the days before and after the incident, worth approximately $15 billion.Casa CEO Nick Neuman stated that some of the transferred funds came from Coldcard users migrating to multi-signature wallets, and Ledger and Trezor users also took similar measures after the incident. During the same period, about 22,000 bitcoins were transferred to exchanges. Coinkite has requested that users who generated recovery phrases using firmware versions 4.1 to 4.1.9 consider the related wallets compromised and immediately migrate to new recovery phrases. The aforementioned versions cover from March 2021 to July 2026.

Russia's oil production in July was nearly 1 million barrels per day below its OPEC+ quota, with an average daily output of 8.887 million barrels, significantly lower than the monthly target of 9.824 million barrels.Ukraine has been attacking Russian oil infrastructure almost daily, threatening crude oil processing and export volumes, while the global energy market is also under pressure due to the conflict in the Middle East.

According to Cointelegraph, Ravencoin was attacked due to a consensus vulnerability, causing the price to drop to a historical low of $0.002754, down about 22% from the 24-hour high. The vulnerability allowed weak nodes to accept invalid blocks, with the first known exploit occurring at block height 4,487,776.Mining pools 2Miners and RavenMiner, which control the majority of the network's hash power, are building a competing chain that excludes the affected branch. If this chain becomes dominant, the network may undergo a chain reorganization of about three days, and transactions confirmed after block 4,487,775 may be reversed. Ravencoin has advised exchanges to suspend deposits and withdrawals until the chain stabilizes, and Upbit and Bitget have already suspended RVN transfers.

According to GoPlus security alerts, a user lost approximately 100,000 USDT due to an address poisoning attack. The attacker conducted small transactions using malicious addresses with similar ending digits, waiting for the user to make a mistake while copying and pasting.Address poisoning attacks have been fully automated, including discovering poisoning opportunities, creating counterfeit coins with the same name or implementing small-scale poisoning, and mixing coins for money laundering. The victim's address received over four hundred poisoning transactions after executing the last transaction 69 days ago.

On August 9, the cross-chain bridge connecting the XRP Ledger and Coreum was attacked, with the attacker stealing approximately 199,900 XRP through a validation logic vulnerability, causing the bridged asset balance to drop from about 200,400 XRP to 493.5 XRP. This attack did not involve private key leakage and did not target the XRP Ledger protocol itself.The attacker forged deposit operations, causing the bridging system to recognize them as real deposits and triggering the other end of the bridging wallet to send real XRP to them. On-chain data shows that the attacker completed the fund transfer through 94 multi-signature authorization transactions within 97 minutes. These transactions required 17 signatures from 28 relay node keys, allowing the attacker to bypass the validation mechanism of the bridging system. As of August 11, the Coreum cross-chain bridge remains in a suspended state, and the Coreum Development Foundation has not yet released an official incident report. The security of the XRP mainnet and user private keys has not been affected.

According to Cyvers Alert monitoring, an address poisoning attack was discovered, resulting in a loss of approximately 100,000 USDT for the victim. About 66 days ago, the attacker implemented address poisoning on the victim's wallet by sending transactions to create a malicious address record similar to a normal interaction address. The victim did not verify the complete wallet address and mistakenly transferred funds to the attacker's address.After the incident, to avoid potential freezing risks, the attacker exchanged the stolen USDT for ETH and currently holds about 52.8 ETH in the wallet. Cyvers reminds users to always verify the complete wallet address when making on-chain transfers and not to rely solely on address records in transaction history.At the same time, security agencies recommend using AI-based on-chain security tools for real-time detection of abnormal transaction behaviors to reduce risks such as address poisoning and phishing attacks. Address poisoning attacks have become one of the common scams in the cryptocurrency asset field in recent years, with attackers often exploiting users' habits of copying historical transaction addresses to mislead them into transferring assets through forged similar addresses.

According to Bitcoin.com, cybersecurity company Genians Security Center has released an analysis report stating that the North Korean Reconnaissance General Bureau's hacker organization Kimsuky is building and testing a set of AI-based cyber attack tools. Researchers found traces of the deployment of three local AI platforms: Ollama, GPT4All, and Msty, as well as components of AI development frameworks such as Microsoft Semantic Kernel and LLaMaSharp in their infrastructure, indicating that the organization is systematically developing dedicated AI attack tools rather than just making temporary attempts.Since early 2026, Kimsuky has been using high-quality documents generated by generative AI for spear-phishing attacks targeting virtual assets, financial investments, and game development. The AI-generated professional documents significantly reduce the effectiveness of traditional phishing email detection. The attack vector is a ZIP archive disguised as a legitimate document, containing a malicious LNK file that, when triggered, can silently execute PowerShell commands in the background.

Iranian President Ebrahim Raisi stated that the United States and Israel are using artificial intelligence data to attack Iran.

According to The Block, Immunefi's latest data shows that the cryptocurrency industry lost approximately $110 million due to hacker attacks in July.During the same period, the platform paid researchers $2.32 million for confirmed vulnerability reports, with the number of confirmed and completed bounty reports increasing by 18% month-over-month.The report indicates that its audit competitions can average 6.2 critical vulnerabilities per event, compared to 1.5 for first-level audits; in July, a total of 374 threats were mitigated through the bounty program.

According to CCTV News, recently, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control, relying on the National Computer Virus Collaborative Analysis Platform (https://virus.cverc.org.cn), discovered multiple incidents of users being attacked by the "Sorry" ransomware virus within our country. After the user's important files were encrypted, the file names were changed to the original file name + .sorry suffix string. The attackers also left a ransom note on the user's host, demanding that the user download an encrypted communication tool to contact them.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.

The pricing logic in the ethFromDefund() redemption function of the USM contract defund() has flaws. This function calculates the consideration for a single redemption using the arithmetic average of the current FUM selling price and the estimated terminal FUM selling price, but this algorithm lacks split invariance.After adding the state contraction coefficient adjShrinkFactor associated with a single redemption and the integer rounding mechanism, the total amount of Ethereum that can be extracted from splitting an equal amount of FUM assets into 64 small redemption operations will be significantly higher than that obtained from a one-time large redemption.

According to monitoring by PeckShield, wallets associated with Coinsbuy are suspected to have been attacked, involving the TRON and Ethereum networks, with estimated losses of approximately 7.9 million dollars.The attackers subsequently transferred part of the stolen funds through platforms such as ChangeNOW, FixedFloat, and BingX.