theft

On-chain data analysis firm Bitquery linked the approximately $459,000 asset theft incident involving Tradewiz to a wallet that completed 27 transactions through the trading bot previously. Investigation statistics show that the incident affected 20,933 wallets, with losses involving SOL, tokens, and deposits recovered after closing token accounts; the valuation is based on a SOL price of $120.Bitquery discovered that major fund transfers began 41 minutes after Tradewiz's trading activity stopped; about 73% of the SOL in this round of transfers was moved afterward. Tradewiz stated that the incident involved the private key leak of the SOL PVP export function and promised to compensate users for their losses; subsequent updates indicated that the first batch of refunds had been issued, and claims need to be verified. Tradewiz also suspended EVM services for security checks and stated that the police are assisting in tracking the assets and have contacted exchanges for identity and account verification information.Bitquery traced some of the early funds coming from MEXC withdrawals, later shifting to Kucoin deposit addresses; these connections do not indicate that the two exchanges participated in the theft.

According to Insurance Journal, blockchain analysis company Elliptic disclosed that it has tracked over 50 security incidents related to North Korea, with a total of approximately $1.2 billion stolen this year.Some of the stolen funds from Bitget overlap with the associated addresses from last year's $1.5 billion theft incident at Bybit exchange. Initial on-chain money laundering patterns indicate that the Bitget incident was carried out by the hacker organization TraderTraitor.

The U.S. Attorney's Office for the District of Massachusetts has filed a civil forfeiture lawsuit seeking to seize 110,300 USDT from a Binance account. The case involves phishing text messages impersonating Coinbase, which led to the theft of 33.7 bitcoins from a beneficiary and their family trust within the same Coinbase account, valued at approximately $900,000 at the time.Investigators stated that from June 5 to June 15, 2023, 11.2 stolen bitcoins were traced to the Binance account, which were then quickly exchanged for Monero. When the FBI requested to freeze the account, it held approximately 758.55 Monero; Binance transferred 110,300 USDT to a government-controlled wallet on August 3, 2026.

NVIDIA CEO Jensen Huang stated in an interview with CNBC's "Squawk Box" on Monday that training or learning with competitors' products is part of competition, and he refused to label AI model distillation as theft. When asked if distillation is not robbery, Huang said that it is competition. He mentioned that people can test others' products, and NVIDIA's products are sometimes taken apart to the bare bones to understand how they work; he would prefer that others do not learn from NVIDIA products, but competition makes everything better. If one does not want others to use their products, they can identify customers and discontinue services.U.S. officials have accused Chinese AI companies of using distillation, which involves training models with outputs from other models, extracting capabilities from U.S. systems. U.S. Treasury Secretary Scott Bansen stated in July that this practice is theft and threatened to impose sanctions on overseas companies that utilize distillation to extract capabilities from U.S. models. The White House did not immediately respond to CNBC's request for comment, and U.S. officials are considering measures against overseas companies that use distillation.Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency accused Chinese AI companies of conducting industrial-scale knowledge distillation activities, violating the terms of use for U.S. companies. AI company Anthropic stated earlier this month that it found Alibaba's Qwen series models and DeepSeek engaging in illegal distillation. The Chinese side denied these accusations.

Regarding the issue of abnormal asset transfers from user accounts, the MEXC customer service team responded on September 28, stating that they have completed a preliminary investigation and provided corresponding solutions. They will follow up with users via email for one-on-one communication, updating them on progress and required information, and reminding users to pay attention to their registered email and official channel communications.Previously, a MEXC user posted on X that their account was controlled after someone reset the security items. Between 04:12 and 04:25 on September 27 (Beijing time), 322,110 USDT and 9,133,999 ONE were transferred out, totaling approximately $340,000, just 27 minutes after the 24-hour transfer restriction was lifted. The user stated that MEXC has confirmed the account was hacked and has frozen the account to assist in recovery, but has not revoked the API left by the attacker. They have submitted a formal claim, with the ticket number M2026092712031.

According to monitoring by the head of Galaxy Research, the COLDCARD Seed Entropy theft incident has resulted in 1,830 BTC being stolen, involving three rounds of attacks and over 30 smaller related signs.A total of 256 victims have reported their situations to GLXY Research, with a median loss of 1.1 BTC, and the tracking of the attackers is still ongoing.

Yuga Labs' Vice President of Blockchain, Quit, posted on the X platform stating that the claims portal for the NFT theft incident currently under construction is expected to go live in the next few hours, and a dedicated address nftsaresafu.eth has been created to accept ETH and other token donations.Quit mentioned that in addition to spending a significant amount of time, he paid approximately $7,500 in gas fees last night to handle related matters and thanked the community for their support through channels like X Money.Previously, it was reported that the NFT marketplace Magic Eden appeared to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets, valued at approximately $1.5 million.

According to Cointelegraph, blockchain security company SlowMist stated that its investigation has not linked the recent security warning caused by the iPhone Safari attack to confirmed cryptocurrency theft incidents.SlowMist told Cointelegraph that it has not independently confirmed any victims affected by the specific Safari attack samples it analyzed, and the strongest technical evidence it possesses covers iOS versions 18.4 to 18.6.2. The company stated that the reported impact range of "iOS 13 to 26.5" should be regarded as a preliminary assessment, and it tends to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is obtained.SlowMist pointed out that the Safari attack reused the previously disclosed DarkSword exploit chain technology, which is independent of another investigation involving malicious components embedded in App Store applications called FomoPeek. The Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since November 2025.

ViaBTC founder and CEO Yang Haibo stated: CoinEx is shutting down, but its hot wallet system is still relatively advanced and worth referencing in the industry. He introduced that CoinEx has implemented an MPC-based dual-signature scheme for its hot wallet to eliminate single points of failure.Yang Haibo mentioned that the relevant infrastructure is split into business systems and wallet systems, operated by completely independent teams, each holding one private key. Every withdrawal or transfer must be reviewed in real-time through substantial risk control by both parties, and even if one system is compromised, assets cannot be stolen.He added that the wallet signing process needs to be independently implemented and cannot rely on the native mechanisms of each node, which requires extensive reconstruction. The team spent over a year transforming the vast majority of nearly 300 chains supported by CoinEx one by one.

Malicious iOS application FomoPeek has been found to contain multiple kernel exploit modules that can bypass Apple's sandbox and access sensitive wallet data from other applications, and is linked to a theft incident involving nearly $580,000 in cryptocurrency assets. Blockchain security company SlowMist stated that the application is distributed through the Apple App Store. The company noted that the affected versions were released on September 9 and September 12, and the application contains two malicious modules that can gain higher privileges and access Keychain data and files from other applications.Version 1.3, released on September 17, has removed the related malicious components. SlowMist and the OKX security team investigated and found that the related attack framework includes 8 types of attack methods, supporting iOS versions 12 to 18.7.2 and 26 to 26.1. On-chain analysis shows that a hacker address related to the incident received approximately 580,000 USDT, and the funds were subsequently transferred through multiple addresses and services, with some flowing to FixedFloat, KuCoin, and cce.cash.

Cosmos ecosystem DEX Astroport stated that the attack event that occurred on Neutron may have led to the theft of administrator privileges for the Astroport contract. Neutron has suspended chain operations for investigation.Astroport advises users to withdraw liquidity from all Astroport liquidity pools.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.

According to Decrypt, court documents unsealed in the lawsuit between The New York Times and OpenAI and Microsoft show that Microsoft employees discussed whether OpenAI's use of news articles to train its models constituted "the largest labor theft in human history," and could potentially trigger a "doom loop" that leads to a decline in model quality. A 2023 internal Microsoft memo warned that millions of people worldwide would soon view the large model's "consumption" of their works as "an unprecedented and astonishing theft," and stated that large AI models are "products that destroy their own supply chains."Microsoft stated in the documents that these memos were written by Director of Applied Science Brent Hecht and do not represent the company's views, as his role is to provide "different and asymmetric perspectives." Microsoft CEO Satya Nadella testified that "any content behind a paywall should be authorized by those who wish to use it," and stated that if he had known in advance that OpenAI was using paid content for training, he would have exercised Microsoft's rights to demand that the model be retrained.Additionally, an OpenAI employee had mentioned to President Greg Brockman the construction of "hacker methods" to bypass The New York Times paywall, to which Brockman replied, "Nice." Both OpenAI and Microsoft argue that the relevant training falls under fair use. The case was initiated by The New York Times at the end of 2023, and 11 publishers have since joined the lawsuit.

On-chain analyst SomaXBT posted on platform X, stating that suspected Lootbot users have encountered a collective wallet theft incident, with the current loss amount exceeding 600,000 USD (approximately 245 ETH).Initial information indicates that about 50% of the victims are Lootbot subscription users. It is worth mentioning that Lootbot is one of the projects founded by dexter, the founder of the previously soft Rug project gm.ai, originally a trading bot platform in the Telegram ecosystem.

According to CoinDesk, a 22-year-old man from Singapore will plead guilty in one of the largest cryptocurrency thefts in the United States.The scammer posed as customer service representatives from Google and Gemini, tricking an investor into handing over Bitcoin worth $240 million.

According to Apnews, a young cryptocurrency scam gang stole over 4,100 BTC in August 2024 through "social engineering" attacks, which was worth over $240 million at the time.After the theft, gang members quickly began extravagant spending, including purchasing sports cars, renting luxury homes, flying on private jets, and hiring security personnel. Among them, the alleged mastermind, a 22-year-old Singaporean named Malone Lam, reportedly spent over $569,000 in one night at a nightclub in Los Angeles.Investigations revealed that the suspects impersonated employees from Google and the cryptocurrency trading platform Gemini to trick victims into giving up their Google Drive access and security codes, allowing them to transfer the victims' bitcoins. They then moved the funds through multiple trading platforms and money laundering intermediaries. Their lavish lifestyle eventually drew the attention of law enforcement.One suspect was exposed when their IP address was revealed while hiding nearly $30 million in stolen cryptocurrency assets, leading police to trace it back to the luxury home they rented in California. Another suspect was found with $37 million worth of stolen cryptocurrency assets. Lam was accused of using the stolen funds to purchase a $2 million watch and over 30 vehicles including Porsches, Lamborghinis, and Ferraris.Currently, 18 defendants have been charged, and Lam is expected to attend a plea agreement hearing this Tuesday. The U.S. Department of Justice has already issued rulings against several accomplices, and related cases are still ongoing.

The Ukrainian police and the Security Service of Ukraine (SBU) recently dismantled a scam network that used a fake investment platform to steal cryptocurrency. This network disguised itself as an investment platform website, luring users to connect their main cryptocurrency wallets and approve a small test transaction when withdrawing funds. Subsequently, it used a "wallet stealer" hidden within the website to automatically transfer user funds to wallets controlled by the operators, kicking victims off the platform. Investigators have currently confirmed 62 victims, with over 46 Ukrainian citizens involved, and the network could steal up to $1 million per month.The police stated that the false profits displayed on the platform are part of the scam, with operators manually creating transactions and adjusting user account balances to create the illusion of investment growth. In addition to cryptocurrency, the platform also collected victims' passport information, phone numbers, email addresses, login credentials, and photos during the registration and identity verification process. The main organizer of the network is a 25-year-old IT expert who recruited over 46 Ukrainian citizens and operated multiple offices in Kyiv and surrounding areas, with members responsible for building and maintaining fake websites, contacting potential victims, and providing security.Victims come from multiple countries, including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel. The police traced the gang's server equipment located in the Netherlands and obtained a database stored there, which included a list of victims, cryptocurrency wallet addresses, suspected stolen amounts, internal communications, and platform operation information. The Ukrainian police and SBU subsequently executed 34 searches in Kyiv and surrounding areas, seizing over 100 computers, more than 100 mobile phones, 79 SIM cards, documents, cash, and 15 vehicles.

According to a report by Malwarebytes, scammers are using the hype around "GTA 6" to set up phishing websites, claiming to sell leaked versions of the game for $50 or 1 SOL, luring visitors to connect their wallets and sign malicious transactions. The website contains approximately 2.4 MB of malicious scripts that can identify wallet assets on seven chains: Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base, and Fantom, and immediately transfer assets or gain permissions for subsequent transfers of tokens and NFTs based on the permissions signed by the victims.Before triggering, the script checks the visitor's IP to evade ten countries, including Armenia and Russia. Malwarebytes advises users to be cautious of any websites claiming to sell leaked versions of GTA 6, to carefully verify the authorization content before signing transactions, and to refuse operations that transfer the entire balance or request token access permissions.