mnemonic

According to official news, the Binance wallet plugin now supports mnemonic-derived accounts. By backing up a set of mnemonics, you can derive up to 99 independent accounts.It can protect the security of mnemonics and efficiently manage accounts; multi-chain support allows a single account to be used across chains. The supported plugin version is 1.12.0 and above.

According to official news, the blockchain security agency SlowMist recently released a security assessment report, conducting a special audit of OKX Wallet. The results showed that in the audited version, no behavior was found where the application transmitted sensitive information such as private keys or mnemonic phrases to external servers, and no risk of sensitive data leakage was detected overall.It is reported that this assessment focused on whether there were issues with the external transmission of private keys and mnemonic phrases in OKX Wallet, and the results indicated that the relevant core information was processed locally. The current handling of private keys and mnemonic phrases has become the core of wallet security, and such audit results also provide users with a more direct security reference.

Drift Protocol tweeted that a malicious actor gained unauthorized access through a new type of attack involving durable nonce, quickly taking over the management rights of the Drift security committee. The attack was highly sophisticated, prepared over several weeks, and included the use of durable nonce accounts to pre-sign transactions to delay execution. Current investigations show that the cause of this incident is not due to vulnerabilities in the Drift program or smart contracts; there is no evidence that the mnemonic phrases were stolen; the attacker gained access through unauthorized or forged transaction approvals (possibly involving social engineering).The final result led to approximately $280 million in funds being withdrawn from the protocol. All lending, vault deposits, and trading funds were affected. DSOL (the portion not deposited in Drift, including assets staked to Drift validators) and insurance fund assets were not affected, and the latter is being withdrawn for protection. As a precaution, all remaining protocol functions have been frozen, and the multi-signature has been updated to remove the compromised wallet.

Yuxian, the founder of Slow Fog, posted on the X platform stating that Coinbase has taken down the page requiring users to enter their plaintext mnemonic phrases. He pointed out that the security model of online web pages for wallets is very low, much lower than that of extensions or apps; the practice of collecting plaintext mnemonic phrases on online web pages can easily be imitated by phishing websites and has long been a common phishing technique.

According to Cointelegraph, a subdomain page of Coinbase Commerce prompted users to enter their wallet recovery phrases, raising concerns among security researchers. SlowMist Yu Sin stated that it is incomprehensible why Coinbase would set up such a page, directly asking users to input their recovery phrases in plain text for asset recovery, believing this action poses serious security risks.On-chain analyst ZachXBT pointed out that this page was previously referenced in a help document for Coinbase's Commerce product, which suggested users recover funds by importing their recovery phrases into compatible wallets like Coinbase Wallet or MetaMask, and included a link to the withdrawal tool on that subdomain. Currently, the help document is shown as deleted. ZachXBT also noted that if this page were exploited by malicious actors, it could facilitate social engineering attacks on Coinbase users targeting their recovery phrases.

Binance has issued a security alert, as there have been multiple asset security incidents in the community recently due to device environment issues, reminding users to pay attention to the security of their private keys/seed phrases.The Binance wallet's keyless mode is based on MPC-related technology, which stores key shards in different independent environments, further enhancing the security of asset management and effectively reducing the risk of key leakage and attacks.

According to market news, documents from the High Court of England show that a man accused his estranged wife of obtaining the mnemonic phrase for his Trezor hardware wallet through secret recordings, stealing 2,323 bitcoins (approximately $172 million). The man installed recording devices at home after his daughter warned him that his wife was attempting to steal his bitcoins.The recordings included statements such as "the bitcoins have been transferred to me" and "take everything." His bitcoins were transferred on August 2, 2023, and dispersed to 71 different addresses, with no further transactions occurring afterward. After the man reported to the police, his wife was arrested in 2023. The police seized 10 cryptocurrency cold wallets, but his wife was released after undergoing a no-comment interrogation and being granted bail, with the police stating they would not take further action until new evidence emerged.In November 2025, the man applied for an asset preservation injunction, seeking to declare ownership of the bitcoins and recover the assets. The judge believed the likelihood of his success was "very high" and noted that the wife had the opportunity but did not provide a statement regarding the incident. Given the volatility of bitcoin, the judge stated that a hearing needed to be scheduled as soon as possible.

According to CoinDesk, the South Korean National Tax Service has apologized after a seizure operation inadvertently displayed original photos containing hardware wallet recovery phrases, leading to the theft of $4.8 million in cryptocurrency. The South Korean National Tax Service stated that it failed to recognize the inclusion of sensitive information when providing photos from the seizure site.The South Korean National Tax Service has now requested police intervention to recover the assets and plans to conduct a comprehensive review of security systems and virtual asset management manuals. South Korean Deputy Prime Minister and Minister of Economy and Finance Koo Yun-cheol posted on the X platform that institutions such as the Financial Services Commission and the Financial Supervisory Service will investigate this leak incident and strengthen the regulation of public institutions managing digital assets.

According to a report by South Korea's Asia Economy, the National Tax Service of South Korea released news materials regarding on-site searches of 124 high-profile, habitual tax evaders, revealing现场照片 that included the seized Ledger hardware wallet's mnemonic phrase, with no pixelation applied.Blockchain data expert Jaewoo Cho stated that shortly after the mnemonic phrase was leaked, all 4 million PRTG tokens stored in the wallet were transferred to an unidentified wallet early this morning, with estimated losses reaching approximately 6.4 billion won (about 4.8 million USD).Analysis shows that the thief first deposited a small amount of Ethereum to be used as transaction fees into the wallet, and then transferred all the tokens in three transactions.

Trust Wallet issued a security alert on platform X, stating that it will never ask users for their recovery phrases or private keys. If such a situation arises, it is not Trust Wallet. If you have any questions, you should immediately pause transactions and contact Trust Wallet through official channels.Previously, Trust Wallet faced a security incident due to a vulnerability in the browser extension version 2.68, resulting in a total asset theft of approximately $8.5 million.

The Chief Information Security Officer of Slow Fog Technology @im23pds posted a reminder that a new type of "2FA security verification" phishing scam has recently emerged targeting MetaMask wallets.Scammers impersonate the MetaMask security alert page to lure users into completing a so-called two-factor authentication process, which is actually aimed at stealing their mnemonic phrases. The process usually includes a forged security alert page, a fake 2FA verification interface, and countdown prompts, ultimately guiding users to input their wallet mnemonic phrases.

The Chief Information Security Officer of Slow Fog Technology, 23pds, stated on social media, "Users of wallets with continuously stolen versions must first disconnect from the internet, then export the mnemonic phrase to transfer assets. Otherwise, opening the wallet online may lead to theft. Wallets with backed-up mnemonic phrases must transfer assets first before upgrading the wallet."

The Chief Information Security Officer of Slow Fog Technology, 23pds, stated on social media, "Users of wallets with a continuously stolen version must first disconnect from the internet, then export the mnemonic phrase to transfer assets. Otherwise, opening the wallet online may lead to theft. Wallets with backed-up mnemonic phrases must transfer assets first before upgrading the wallet."

According to a report by Caijing Magazine, the main suspect in the laundering case involving 60,000 BTC, Qian Zhimin, escaped with a laptop that has a built-in cryptocurrency wallet. After several searches by the British police, multiple electronic devices, including phones, computers, and USB drives, were seized. One of the USB drives contained photos of pages from Qian Zhimin's notebook, while the relevant pages of the notebook were suspected to have been torn out before the police confiscated them.The photos of the pages recorded the startup password for the black computer and several mnemonic phrases, such as "number + love," and also included hints for the numbers, which made it possible to recover the previously seized bitcoins.

According to the GoPlus Chinese community, a malicious Chrome extension named "Safery: Ethereum Wallet" has been discovered, which is stealing user assets. This extension was released on November 12, 2024, disguised as a simple and secure Ethereum wallet, but it contains a built-in backdoor.The attack method is highly covert: the malicious extension encodes the user's mnemonic phrase into a Sui address and broadcasts microtransactions through a Sui wallet controlled by the attacker to steal the mnemonic phrase. The attacker's email is kifagusertyna@gmail[.]com. Currently, this malicious extension has not been removed from the Chrome Web Store.

According to reports from users on platform X, an imToken wallet user encountered the theft of 112 BNB while participating in the Binance TGE event.Security expert Slow Mist's Yu Xian @evilcos conducted a preliminary analysis of on-chain data and found that the hacker address (0x8AeB0171742AC50d20884997F9f5009a233216D5) has caused financial losses for at least 7 users. The attack pattern indicates that the hacker may have conducted a planned attack by obtaining the mnemonic phrase or private key, with victims typically having their assets transferred shortly after depositing large amounts of funds. The security team has begun to mark and blacklist the relevant hacker addresses and is continuously monitoring the situation.

ChainCatcher news, according to Cryptopolitan, the Australian Federal Police have dismantled a cryptocurrency wallet containing $6.4 million, believed to be the illegal proceeds of an organized crime group.This operation is part of a broader crackdown on encrypted communication networks that are believed to be exploited by criminal enterprises. The Australian Federal Police revealed that they decrypted the wallet's mnemonic phrase and seized a total of $6.4 million in funds. Additionally, police arrested 32-year-old Sydney resident Jay Je Yoon Jung, who is accused of developing Ghost, a highly encrypted communication platform. Police stated that the platform was specifically designed for criminal organizations.

ChainCatcher message, in response to community users claiming that the FTX fake compensation email mentioned needing to download a tool to generate XPUB, Slow Mist founder Yuxian responded on platform X: "This malicious tool appears to be pieced together using AI, and the intent to steal mnemonic phrases is very, very clear. The malicious Telegram bot is ftxsexxerbot."

ChainCatcher news, according to Cointelegraph, Kaspersky has discovered a new virus named SparkKitty, specifically targeting iOS and Android cryptocurrency applications, stealing mnemonic phrase screenshots from users' photo albums. Affected applications include "Coin" on the App Store and the SOEX messaging app, which has over ten thousand downloads on Google Play.This virus originates from the same source as the previously discovered SparkCat, with active time tracing back to early 2024, primarily attacking users in Southeast Asia and China.

According to ChainCatcher, as reported by Cryptonews, due to the increasing kidnapping threats faced by cryptocurrency holders, the Bitcoin investor family "Taihuttu family" has revealed that they have abandoned hardware wallets and instead dispersed their cryptocurrency mnemonic phrases across four continents.Taihuttu stated that over the past eight months, they have adopted a hybrid storage system: splitting the encrypted mnemonic phrases, with some engraved on fireproof steel plates hidden across four continents, while the rest is stored using blockchain-based encryption services. Even when threatened with a gun, he can only provide a limited amount of assets from his mobile wallet.This decision stems from the rise in physical attacks targeting cryptocurrency holders. Recently, Moroccan police arrested a suspect in the kidnapping of a cryptocurrency executive; the father of a cryptocurrency millionaire in France was brutally attacked; and a tourist in New York was kidnapped and tortured for two weeks, with the kidnappers attempting to obtain his Bitcoin credentials.Currently, approximately 65% of the Taihuttu family's crypto assets are stored in cold wallets across four continents, while the remainder is kept in multi-signature wallets or decentralized exchanges for trading and daily expenses.