leak

According to a report by the Korean News Agency, South Korea's five major commercial banks have all been suspected of being attacked by hackers possibly driven by artificial intelligence, with three of them experiencing customer information leaks. This simultaneous attack on all five banks is unprecedented in South Korea's financial industry.It is reported that BNK Busan Bank suffered a hacker attack that led to the leakage of personal information of 11 outsourced employees; KB Kookmin Bank had information of 119 customers leaked due to the hacker attack, and Hana Bank also stated that information of 89 customers was leaked.

GIWA official account (@GIWA_by_Upbit) issued a statement clarifying that the project's mainnet has not yet been launched and that RPC has never been online, so there is no risk of any RPC leakage. Users are reminded to do their own research (DYOR) and to be wary of FUD and scam information. It is reported that GIWA is an Ethereum L2 project developed by Dunamu, the parent company of Upbit, based on the OP Stack, aiming to achieve a 1-second block time and be compatible with EVM. It is currently still in the testnet phase.

Bitget CEO Gracy Chen publicly stated in a live broadcast regarding the platform's attack incident that the platform is currently preparing to resume withdrawals, but there is no accurate timeline for recovery yet. Bitget's internal and external technical teams are synchronously identifying the issues and formulating solutions, hoping to restore relevant services as soon as possible.Gracy Chen mentioned that the method of attack in this theft incident is different from previous security incidents that occurred at some exchanges. According to the current investigation, the hackers did not implement the attack through key leakage, but rather bypassed certain systems and initiated withdrawals through the system. She stated that key leakage is the worst-case scenario, but this incident is not the same.Due to the involvement of multiple cryptocurrencies and blockchain networks in this incident, Bitget is temporarily unable to directly open withdrawals and needs to confirm that funds are completely safe and develop a more secure handling plan before resuming. Gracy Chen stated that the platform has currently completed comprehensive loss prevention and will not experience further attacks; once the security issues are addressed more definitively, withdrawals will be reopened.

According to monitoring by Scam Sniffer, Duelbits has experienced approximately $4.2 million in fund outflows from hot wallets on the Ethereum, BSC, and Tron networks, suspected to be related to a private key leak.The transferred assets include 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB, and 192,000 TRX. Currently, most of the transferred assets have been converted to ETH.

According to The Information, citing informed sources, China's National Internet Information Office has launched an investigation into AI companies DeepSeek and Moonshot AI, triggered by Anthropic's allegations that the two companies secretly routed sensitive user data to their servers. Reports indicate that regulators visited the offices of both companies, interviewing executives and employees, focusing on whether sensitive data related to law enforcement, military, and state-owned enterprises has flowed into U.S. servers.The trigger for this investigation was Anthropic's fourth threat intelligence report released on September 10. This 154-page document accuses seven Chinese labs—Alibaba, Moonshot AI, DeepSeek, Z.ai, MiniMax, SenseTime, and Xiaomi—of engaging in what it calls "illegal distillation," which involves using the outputs of large models to train smaller models. Anthropic states that distillation itself is a legitimate practice, but it opposes its implementation through fraudulent accounts. The National Internet Information Office initially summoned all seven companies named in the report, but later narrowed the investigation to DeepSeek and Moonshot AI. Anthropic claims that Moonshot AI routed over 23 million interactions to Claude through 5,380 fraudulent accounts, while DeepSeek generated over 12.1 million interactions within a 14-day window in July.The timing of the investigation is quite delicate for both companies.

Crypto KOL Kuai Dong (@_FORAB) posted that the DeepSeek investor meeting has once again experienced information leakage. Since the leak of internal speech recordings in May, the company has required attendees to fly to the Beijing or Hangzhou office, where they must hand over their phones, electronic devices, and backpacks in order to hear CEO Liang Wenfeng speak.Information leaked again just one day after last Sunday’s new meeting. Sources obtained by the information report reveal that DeepSeek's current important priority is to use more domestic chips and mentioned the earliest delivery time for Huawei chips.

SlowMist released a security warning stating that it has recently received multiple reports of FomoPeek users' assets being stolen. After a joint investigation with the OKX security team, it was found that some affected users had previously installed or used FomoPeek versions 1.1 to 1.2, which contained malicious code. SlowMist stated that there are modules in FomoPeek unrelated to normal business, one of which includes a kernel exploit framework targeting the iOS system, supporting eight different attack methods that can automatically select the exploitation method based on device model and iOS version. Affected systems include iOS 12 to 18.7 and iOS 26 to 26.1. If the exploitation is successful, the application may break through the iOS sandbox and access and decrypt Keychain data, leading to the leakage of private keys, mnemonic phrases, login credentials, and other sensitive files. In addition, FomoPeek also connects to hidden servers unrelated to its public services and can receive remote commands. SlowMist indicated that its analysis of captured plaintext traffic shows that the related attack functions are currently enabled and will run automatically on a regular basis. SlowMist recommends that users who have installed or used FomoPeek versions 1.1 to 1.2 immediately check for any anomalies in their assets, generate new private keys and mnemonic phrases on trusted devices that have never installed the application, and transfer assets to new accounts as soon as possible, while also upgrading to the latest iOS version and not continuing to use or reinstall FomoPeek.

WikiLeaks founder Julian Assange returns to social platform X after two years. Today he posted "I'm back," accompanied by a photo of him standing on the streets of Australia, pointing at his mural.

The hacker group "iamnotavillain" attacked Revolut and demanded 6,000 Monero as ransom, threatening to sell the data of at least 680 customers to the dark web if payment was refused.

According to CoinDesk, hardware wallet manufacturer Trezor confirmed that due to a logistics supplier's information leak, the names, phone numbers, and addresses of an additional 67,000 customers were exposed.Another data breach disclosed about 200,000 records, including government ID numbers and verified wallet addresses. Address data stolen from a hardware wallet manufacturer in 2020 is still being used to send physical mail requesting Bitcoin.

According to CoinDesk, hackers claiming to hold Revolut user data have begun to publicly release related documents, which include passports, selfies, and Bitcoin transaction records.The hackers threatened that if Revolut does not pay the ransom, they will continue to leak data daily. Currently, Revolut has not publicly responded.

Revolut disclosed that an unauthorized third party used a legitimate email address under a government agency's real domain to submit false customer data retrieval requests, resulting in the disclosure of sensitive information for a small number of customers. The company referred to the incident as a "complex external impersonation scam," and has since banned the related email address, stating that its systems and customer funds were not affected.The potentially disclosed information includes names, dates of birth, addresses, email addresses, phone numbers, copies of identification documents such as passports and driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transaction records. Former Mt. Gox CEO Mark Karpelès stated that he is one of the affected individuals. Revolut has not disclosed the number of affected customers, whether the incident involved only a single market, or the government agency to which the impersonated domain belongs. The company has notified relevant government agencies, law enforcement, data protection authorities, and financial regulatory bodies. On-chain investigator ZachXBT speculated that the scale of the incident may be limited, but the target may be high-net-worth users.

On-chain detective ZachXBT posted on his personal channel that Revolut allegedly leaked some users' personal identifiable information (PII) due to failing to recognize a forged government agency information request.According to his disclosure, Revolut previously received a request for customer information retrieval that appeared to come from a real government agency and was sent through the agency's official email domain. Because the email had valid domain authentication information, Revolut believed the request was legitimate and responded accordingly.The potentially involved data includes users' names, birth dates, occupations, addresses, email addresses, and phone numbers, as well as copies of passports or driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transaction records. Revolut stated in the notification sent to users that no biometric facial telemetry data was leaked.ZachXBT indicated that the scale of the incident may currently be limited, but it appears to primarily target high-net-worth users. Several Revolut users received notifications regarding the related security incident yesterday. Revolut officials had previously reminded users to verify suspicious information through in-app customer service to avoid providing personal or financial information.

According to on-chain detective ZachXBT's post on his personal channel, Revolut allegedly failed to identify a fraudulent request, resulting in the personal identification information (PII) of some users being leaked. The leaked information includes copies of passports or driver's licenses and verification selfies, account statements, IBANs, withdrawal records, complete transaction histories including Bitcoin transactions, as well as names, birth dates, occupations, home addresses, email addresses, and phone numbers.ZachXBT stated that the number of affected users may be limited, but it appears to target high-net-worth individuals. It is reported that several Revolut users received related security alert emails yesterday.

According to a report by Malwarebytes, scammers are using the hype around "GTA 6" to set up phishing websites, claiming to sell leaked versions of the game for $50 or 1 SOL, luring visitors to connect their wallets and sign malicious transactions. The website contains approximately 2.4 MB of malicious scripts that can identify wallet assets on seven chains: Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base, and Fantom, and immediately transfer assets or gain permissions for subsequent transfers of tokens and NFTs based on the permissions signed by the victims.Before triggering, the script checks the visitor's IP to evade ten countries, including Armenia and Russia. Malwarebytes advises users to be cautious of any websites claiming to sell leaked versions of GTA 6, to carefully verify the authorization content before signing transactions, and to refuse operations that transfer the entire balance or request token access permissions.

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

According to Security Affairs, Ransomnews researchers have recorded a large-scale Stripe merchant API key leak incident, with keys exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, identifying over 50,000 unique keys in total. Sample tests show that a significant portion is still active, allowing attackers to commit fraud within hours.The report states that on August 18, 2026, a data trading forum released a dataset containing valid Stripe API keys for 659 merchant accounts and approximately 35 GB of customer and payment data. Ransomnews has conducted offline analysis and reported it to Stripe before publication. Stripe itself was not breached; the keys belong to the merchants. Researchers were able to access merchant customer lists, create fraudulent payment links, and complete a $1 test charge within 17 hours after discovering valid keys.Valid keys can list customers and stored payment methods, create charges and payment intents, initiate refunds to attacker-controlled accounts, modify webhook endpoints to intercept payment notifications, and access associated accounts when Stripe Connect is enabled. The main sources of the leak include hardcoded keys in GitHub repositories and unignored .env files, unmasked environment variables in GitHub Actions build logs, and about 12% of over 3,000 misconfigured servers containing usable keys.

According to Cryptopolitan, cybersecurity company Adversa AI disclosed that xAI's AI assistant Grok has a security vulnerability known as "cryptographic context injection." Attackers can hide cryptographic commands within ordinary web pages, and when users request Grok to summarize the page, Grok automatically decrypts and executes the hidden commands, sending the user's name, geographical location, subscription level, and complete chat history to the attacker's server.The vulnerability was reported to xAI through the HackerOne platform on June 3, 2026. Researcher Rony Utevsky followed up on August 4 and 10, but as of August 19, the vulnerability had still not been fixed on Grok.com, and xAI had not provided a patch timeline.