attacks

The French Minister of Finance confirmed that hackers breached the French Public Finance Directorate system at the end of June and stole personal and corporate taxpayer data. According to the platform FrenchBreaches, which tracks cyberattacks in France, this incident affected approximately 678,437 people, equivalent to about 1% of the French population, but the exact number is still under investigation and has not been finally confirmed.The leaked data reportedly includes sensitive information such as names, birth dates, home addresses, phone numbers, email addresses, tax identification information, and income data. Among them, nearly 27,000 individuals had tax incomes of at least 100,000 euros, 386 exceeded 1 million euros, and another 8 exceeded 10 million euros. Reports indicate that the database has been sold on the dark web market for thousands of euros. The attackers, calling themselves ZeroBytes, claimed they extracted the relevant records using an internal search tool, which was only discovered later when access was cut off.This incident has raised concerns in the cryptocurrency industry, as there has been a noticeable increase in "wrench attack" violent robbery incidents targeting cryptocurrency holders in France in recent years. If high-income individuals' addresses and contact information are leaked, it could provide criminals with a more precise target list.

According to the monitoring by the head of Galaxy Research, it has communicated with over 190 victims of Coldcard vulnerability attacks and has asked victims who have not yet contacted them to reach out via private message so that they can provide tracking information and assist in reporting losses to the relevant authorities.Since August 6, no new attack incidents have been confirmed, but this does not mean that new attacks will not occur, and vigilance is required.

According to Bitcoin News, Boltzhq has shut down due to its five-person team being overwhelmed by increasingly complex AI-assisted attacks. A group of experienced Bitcoin users will take over the service with additional capital and engineering resources.The founder has stepped down. The service is currently still offline, and the new team is working to restart it.

According to Bitcoin.com, cybersecurity company Genians Security Center has released an analysis report stating that the North Korean Reconnaissance General Bureau's hacker organization Kimsuky is building and testing a set of AI-based cyber attack tools. Researchers found traces of the deployment of three local AI platforms: Ollama, GPT4All, and Msty, as well as components of AI development frameworks such as Microsoft Semantic Kernel and LLaMaSharp in their infrastructure, indicating that the organization is systematically developing dedicated AI attack tools rather than just making temporary attempts.Since early 2026, Kimsuky has been using high-quality documents generated by generative AI for spear-phishing attacks targeting virtual assets, financial investments, and game development. The AI-generated professional documents significantly reduce the effectiveness of traditional phishing email detection. The attack vector is a ZIP archive disguised as a legitimate document, containing a malicious LNK file that, when triggered, can silently execute PowerShell commands in the background.

Iranian President Ebrahim Raisi stated that the United States and Israel are using artificial intelligence data to attack Iran.

According to The Block, Immunefi's latest data shows that the cryptocurrency industry lost approximately $110 million due to hacker attacks in July.During the same period, the platform paid researchers $2.32 million for confirmed vulnerability reports, with the number of confirmed and completed bounty reports increasing by 18% month-over-month.The report indicates that its audit competitions can average 6.2 critical vulnerabilities per event, compared to 1.5 for first-level audits; in July, a total of 374 threats were mitigated through the bounty program.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.

Bitcoin developer Kevin Loaec warned that if a Bitcoin fork related to the controversial proposal BIP-110 occurs this weekend, holders may face the risk of real BTC being transferred when selling forked chain tokens.The proposed Bitcoin fork is associated with the controversial BIP-110 proposal and may generate duplicate balances on two chains, leading holders to attempt to sell seemingly free forked coins.Since both chains initially accept the same transactions, selling forked coins could trigger a replay attack, simultaneously spending real Bitcoin from the seller's main chain. Developers stated that there is a lack of built-in replay protection at least until early September, and non-professional users should avoid transferring Bitcoin during the potential fork.

According to Jinshi reports, Ukrainian President Zelensky stated that Ukraine has launched attacks on two Russian oil refineries.

According to Jinshi reports, five sources said that Iran has warned Gulf countries that any new attacks by the United States on Iranian territory will trigger Iran's retaliation against critical energy infrastructure in the region.

According to Bloomberg, informed sources revealed that a recent wave of complex cyberattacks targeted several large asset management firms on Wall Street, with attackers attempting to infiltrate the information systems of the relevant companies. Several large hedge funds globally became targets of the attacks, including Two Sigma Investments, Citadel, and Point72 Asset Management. In addition, several private equity firms were also attacked.It is currently unclear who the attackers are, the methods used in the attacks, and whether any sensitive data has been compromised. Informed sources requested anonymity due to the involvement of undisclosed information. This incident has once again raised market concerns about the cybersecurity risks faced by financial institutions. As asset management companies increasingly rely on complex information systems, algorithmic trading, and cloud infrastructure, the financial industry is becoming a primary target for cyber attackers.

According to Jinshi reports, the media advisor to the King of Bahrain stated that the Bahrain Air Defense Forces are repelling Iranian aerial attacks. In recent hours, Bahrain has successfully repelled multiple Iranian aerial assaults, and air raid alarms have been sounded due to the threat of airstrikes.

According to official news, the Ethereum Foundation's "Trillion Dollar Security" (1TS) has announced a special grant to the Freedom of the Press Foundation (FPF) to support the ongoing development of the open-source tool WEBCAT, aimed at addressing the long-standing front-end code verification security gap in Ethereum wallets and decentralized applications (DApps).WEBCAT (Web-based Code Assurance and Transparency) is an open-source tool designed to help browsers verify whether the code loaded by a website matches the version publicly released by the developer.This funding will promote the expansion of WEBCAT to Ethereum wallets and application scenarios, enabling users to verify whether the front-end pages they access have been tampered with.The Ethereum Foundation stated that while HTTPS can verify the website a user is connected to and encrypt communication, it cannot prove that the front-end code actually running on the website is the same version released by the developer. If an attacker controls the website's front-end code, they may modify the transaction receiving address without the user's knowledge or induce the user to sign transactions that do not match the content displayed on the page.The Ethereum Foundation noted that front-end attacks have become a significant security risk for blockchain infrastructure, with malicious modifications to web interfaces potentially leading to supply chain attacks, DNS hijacking subsequent attacks, and user interface deception.WEBCAT was initially developed by the Freedom of the Press Foundation to enhance the code credibility of secure communication systems like SecureDrop.With this expansion into the Ethereum ecosystem, it will complement security measures such as "Clear Signing" in the 1TS program: the former helps wallets confirm that the application front-end has not been tampered with, while the latter helps users understand the transaction content they are approving.

Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently due to a user embedding illegal pornographic content in a public group. The app was restored within hours.Durov mentioned that the attackers exploited a technical vulnerability to insert AI-modified illegal content into old messages in active groups, hiding the content by editing historical messages, making it difficult for regular group members to discover and report it in a timely manner. Such attacks are classified as "takedown extortion," where attackers use automated accounts to embed violations in public groups and report them to platforms like Apple, attempting to force group administrators to pay a ransom, or else the community would be banned due to platform rules.Durov further explained that Telegram continuously combats illegal content through user reports, AI filtering, content hashing, and other mechanisms. This incident is not a systemic issue of the platform but rather a targeted attack exploiting rule loopholes by the attackers.He also warned that Apple's direct removal of the app without prior contact with Telegram could pose risks to all mobile applications that provide user-generated content (UGC), and platform developers need to enhance their defenses against malicious reporting and "takedown attacks."

According to Bloomberg, citing informed sources, Chinese officials are concerned that cutting-edge AI models from the U.S., such as Anthropic's Mythos, could be used as offensive cyber tools to launch cyberattacks against China. At the same time, the Chinese side questions why Anthropic does not allow Chinese companies to use the relevant models normally, yet cannot rule out the possibility of these capabilities being used to attack China. Anthropic has long advocated for the U.S. to tighten restrictions on advanced chips and AI capabilities related to China, and last year it stopped providing services to companies controlled by China.The report states that the Chinese side is currently not prepared to take immediate action, but if the U.S. further restricts Chinese AI companies, relevant departments are studying response plans, which may include imposing sanctions on U.S. AI companies or placing them on a restricted list. Currently, neither Anthropic nor relevant departments have publicly responded to this.

Boltzhq has indefinitely suspended its exchange service following reports of an increase in AI-assisted attacks and multiple controlled exploitations.Due to its non-custodial design, user funds have never been at risk, but wallets relying on Boltz for Lightning Network exchanges, including AquaBitcoin and BULLBITCOIN, experienced service interruptions during the deployment of alternative infrastructure.

According to monitoring by Galaxy's research director, a suspected organized Coldcard attack is occurring, with similar transactions still waiting for confirmation in the mempool. Previously confirmed transactions show RBF enabled. During the period from block 960,778 to 960,792, 218 transactions occurred within approximately 2.5 hours, involving 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC; all transactions had no inputs earlier than the Coldcard firmware boundary.The clearing rate per block during this period was 13.8 times, compared to a pre-incident control window of 0.3 times per block, approximately 45 times higher. The transaction topology was 1:1, with each victim address corresponding to a new destination address, and only one destination address received two clearings, with no aggregation addresses appearing. Some funds have been cleared to second-hop addresses.

Hugging Face CEO Clément Delangue posted on the X platform in response to recent concerns about AI-driven cyberattacks. He pointed out that open models have helped defend against multiple attacks and that in the future, they could fend off millions of attacks daily, believing that AI will fundamentally strengthen cybersecurity.Delangue proposed three recommendations: mandatory sharing of traces from intelligent agent attacks and incident disclosure; keeping AI cyberattacks illegal and imposing severe penalties; and equipping defenders with open models to narrow the gap in offensive and defensive capabilities. He advocated for accelerating AI development rather than slowing it down at this stage.

According to Jinshi reports, Israel does not intend to stop its attacks on Gaza unless Hamas disarms.