recover

Theo dõi của Bitcoin News, lô Bitcoin này có giá trị hơn 4 triệu USD, chiếm khoảng 2.8% tổng số Bitcoin liên quan đến lỗ hổng Coldcard. Crypto Recovery Trust sẽ xác minh quyền sở hữu quỹ và cố gắng hoàn trả.Giám đốc nghiên cứu của Galaxy Digital, Alex Thorn, cho biết, còn có 3.0134 BTC đã được chuyển vào địa chỉ này trong cùng một giao dịch, nhưng nguồn gốc của nó vẫn chưa được xác nhận.

Các nhà hành động mũ trắng sẽ chuyển 40.71 Bitcoin liên quan đến lỗ hổng Coldcard vào một giao dịch, trị giá khoảng 3.31 triệu USD. Giao dịch này tập hợp quỹ từ 11 địa chỉ và kèm theo thông tin OP_RETURN hướng đến Crypto Recovery Trust.Alex Thorn, người đứng đầu Galaxy Research, tiết lộ rằng việc tập hợp quy mô lớn hơn đã chuyển tổng cộng 52.37 Bitcoin, liên quan đến nhiều cụm địa chỉ của kẻ tấn công, chiếm khoảng 2.8% quỹ liên quan đến lỗ hổng này. Lỗi firmware của thiết bị Coldcard vào tháng 3 năm 2021 đã dẫn đến việc ngẫu nhiên hóa cụm từ không đủ, với quỹ liên quan đạt đỉnh khoảng 130 triệu USD.

Theo dõi từ Bitcoin News, DART cho biết họ đã cứu được hơn 50 BTC từ các ví bị ảnh hưởng bởi lỗ hổng COLDCARD cùng với các nhà nghiên cứu mũ trắng độc lập, và đã hoàn tất việc chuyển giao trước khi các kẻ tấn công độc hại đánh cắp. DART là một tổ chức phục hồi tài sản kỹ thuật số, hợp tác với các nhà nghiên cứu mũ trắng để bảo vệ các quỹ có lỗ hổng và phối hợp để trả lại hợp pháp cho chủ sở hữu.Các nhà nghiên cứu mũ trắng không yêu cầu phần thưởng và sẽ trả lại Bitcoin cho chủ sở hữu. Số BTC được cứu đã được chuyển vào Crypto Recovery Trust. Quỹ tín thác này được thành lập theo luật của bang Wyoming, nhằm giữ các tài sản kỹ thuật số đã được phục hồi và sẽ được trả lại sau khi xác nhận và kiểm tra chủ sở hữu hợp pháp.Quỹ tín thác sẽ ghi lại quá trình phục hồi, tách biệt BTC với quỹ của DART và các nhà nghiên cứu, thực hiện phân tích blockchain, kiểm tra quyền sở hữu và sàng lọc trừng phạt, đồng thời cung cấp quy trình trả lại hợp pháp cho các chủ sở hữu đã được xác minh. Nếu có tranh chấp về quyền sở hữu, hoặc các quỹ liên quan đến trừng phạt hoặc thủ tục hình sự, BTC sẽ được xử lý theo quy trình pháp lý áp dụng. DART cho biết, các tài sản có lỗ hổng khác và các manh mối phục hồi vẫn đang được xem xét.

Binance Research stated that the recent weakening of the cryptocurrency market may not be due to the cryptocurrency assets themselves, but rather due to the high concentration of funds in the U.S. stock market. It pointed out that the CBOE Discrete Index rose to 42, the third highest in history, reflecting the concentration of funds within the S&P 500 index towards a few popular themes, which has marginalized Bitcoin.

A white hat hacker using the alias "0xflorent" stated on X on Sunday that he has helped recover approximately 1,003 ETH (worth about $2 million) from a faulty smart contract of the Hong Coin (HONG) token sale in 2016, involving 48 investors.Hong Coin was originally designed as a community-operated decentralized venture capital fund, with the token sale starting on August 29, 2016, and ending on October 28 of the same year, but it failed to launch due to not reaching its funding goal. The contract was supposed to automatically refund investors, but a vulnerability in the refund function caused the funds to be locked for nearly a decade.0xflorent collaborated with the HONG creator to exploit an administrator function with an integer overflow vulnerability, resetting the token holders' balances and triggering the refund mechanism through specific inputs, successfully extracting the locked funds. According to Etherscan data, one investor has already received a refund of 96 ETH (approximately $192,500). Previously, on May 24, 0xflorent also recovered 19.33 ETH from another failed token sale project from 2018.

According to The Block, a developer using the pseudonym Florent helped rescue approximately 1003 ETH (worth about $2 million) that had been trapped in the 2016 HongCoin ICO contract for nine years through white hat hacking techniques. The ICO was supposed to automatically refund due to not meeting the funding target, but a coding error caused the funds to be locked. The contract used an old version of the Solidity language, lacking overflow protection mechanisms.Florent discovered that by calling the team's admin function and inputting a specific value, he could reset the holder's balance to 1, thereby releasing the ETH through a refund check. This admin function was restricted to HongCoin's multi-signature address. Florent contacted the team and, after verifying the process on the test network, the team signed the unlock transaction themselves. The entire process took about a week, during which the team signed 41 transactions covering approximately 1000 ETH. So far, two investors have claimed 96.5 ETH and voluntarily paid Florent a white hat reward. Florent stated that his motivation was curiosity and understanding how the old contract worked.

Kelp DAO announced on Monday that after losing $293 million due to an attack by North Korea's Lazarus Group on April 18, rsETH has been fully restored after five weeks of repairs. Kelp DAO stated that the final batch of 20,373.7 rsETH has been sent to the LayerZero smart contract responsible for cross-chain transfers, officially concluding the operational phase of the rsETH recovery plan.Multiple crypto protocols contributed funds through the DeFi United initiative to assist in restoring the support for rsETH. The first batch of 25,000 rsETH was transferred on May 13, and withdrawals were reopened the next day. Currently, minting, redemption, and reward operations are all functioning normally. This attack caused a chain reaction in the DeFi lending market, with the attacker borrowing WETH using a large amount of stolen rsETH as collateral on Aave, resulting in Aave incurring $190 million in bad debt. The TVL dropped from $26.4 billion to below $14 billion and has since remained in the range of $13.9 billion to $15.1 billion without showing signs of recovery. In April, there were 25 crypto hacking incidents, resulting in total losses of $630 million.

According to official news, KelpDAO stated that the last batch of 20,373.72 rsETH has been transferred to the rsETH OFT adapter earlier, thus completing the operational part of the rsETH recovery plan. KelpDAO also attached the relevant transaction information.

CITIC Securities believes that the U.S. and Iran are increasingly close to reaching an agreement, and the market has basically priced this as the baseline scenario. The biggest change after reaching an agreement will be the simultaneous replenishment of supply and demand and a rapid warming of economic activity. Currently, some economic indicators are noticeably weak, reflecting a delay in demand ahead of the U.S.-Iran agreement and the resumption of navigation in the Strait of Hormuz. Micro entities are waiting rather than rushing to replenish inventory and start operations, which is an abnormal disturbance. As the agreement is reached and navigation in the Strait is restored, supply and demand will return to normal, and economic activity will show significant improvement after June. Changes in macro variables will also alter the environmental assumptions of market strategies, leading to a gradual balancing of styles. The reduction of large funds is nearing its end, and after macro stability is achieved, allocation funds will gradually return, driving the recovery of some undervalued sectors. In terms of allocation, continue to actively reduce volatility and reconstruct the barbell structure of AI + energy.

Toncoin announced that its bridge-v3 cross-chain bridge is scheduled to officially and permanently close on September 1, 2026. During the transition period before the closure, all proportionally charged cross-chain fees have been canceled, and users who have used the bridge are reminded to check their wallets as soon as possible and complete the withdrawal of any unprocessed or unrecovered assets before the deadline.If you hold Wrapped TON in Ethereum or BNB Smart Chain, you should rebridge to the TON network before the deadline. If you hold tokens such as jUSDT, jUSDC, jDAI, jWBTC, etc., you need to bridge back to the Ethereum network. Users must complete all asset migrations before the deadline to avoid assets being unable to operate across chains. After September 1, the cross-chain bridge will stop all transfer functions.

THORChain has released its fourth update regarding the attack incident on May 15, and the proposal ADR028 has been announced, with voting for node operators now open.According to the recovery plan, the protocol will first absorb losses through its own liquidity, with the remaining portion to be shared by synthetic asset holders; the specific distribution ratio of the two is still under evaluation. The protocol's own liquidity will be reduced to zero, and will be gradually replenished through system revenue. This plan will not issue or sell RUNE, nor will it dilute any holders.On the technical side, GG20 will be temporarily retained and has completed patch upgrades. Trading will resume after the vulnerabilities are fixed and node rotation is successfully conducted, with a future release pace that is slower and more security-conscious. Innocent nodes located in the same vault as the attacker will be protected, while the attacker nodes will be fully confiscated. The recovered RUNE will be paired with the recovered assets, and any excess will be destroyed.The protocol also offers a white hat bounty to the attacker to recover funds; if some are returned, the recovery plan will be adjusted proportionally. THORChain remains neutral and permissionless, and there will be no review of the attacker's Swap transactions after trading resumes. Node operators are currently voting on the proposal direction, and the numbers in the ADR are only indicative, with adjustments to be made through Mimir later.

The TON Network expansion project TAC has disclosed that a security incident occurred with the TON-TAC asset bridge on May 11. Four days later, approximately 80% of the affected assets have been returned. TAC today released a post-incident analysis report detailing the events. The root cause of the vulnerability was a lack of a single verification in the sorter software: the attacker deployed a counterfeit Jetton wallet on TON, and the sorter accepted the counterfeit tokens because it did not verify the code hash of the sender's wallet. The total loss was approximately $2.86 million, involving USDT, BLUM, and tsTON. Following a public appeal, about 90% of the assets were returned to the multi-signature address controlled by TAC on May 14, with the remaining 10% retained by the attacker.The cross-chain bridge remains paused, awaiting independent review of the repaired sorter software by the auditing party and TON partners. Cross-chain operations will resume once the verification of the repaired software is completed and the gap is filled with recovered assets and TAC Foundation token reserves. Due to the need for multi-party coordination, a precise timeline cannot be provided. The remaining funding gap will be filled by the TAC Foundation treasury, ensuring that users and protocols incur no financial losses. TAC reminds users that official updates are only published through this account and Telegram, and any unsolicited "recovery" or "support" private messages are scams.

Drift Protocol stated on platform X that after the protocol is restored online, users who have staked in the Insurance Fund will be able to withdraw their corresponding shares normally. The Insurance Fund is designed to maintain the protocol's solvency in the event of liquidation or bankruptcy. Since the protocol was paused before losses were completed through normal liquidation or bankruptcy processes, the Insurance Fund was not affected by the related vulnerabilities or attacks.Drift Protocol added that the assets of the protocol's own Insurance Fund will be used to support system restart and user recovery, and plans to publicly disclose the relevant on-chain addresses so that the community can track the use of funds and subsequent deployments.

According to the Hunan Daily, on February 9 at around 8 PM, the public security agency in Baojing, Hunan Province, China, received a report from a victim, Mr. Liu, from another province who had been scammed. He claimed that he was defrauded while purchasing virtual currency USDT online, with a total loss of 100,000 yuan. After receiving the report, the Baojing County Public Security Bureau dispatched a team of elite officers to form a special investigation group and began investigating the case overnight.The investigating officers used various investigative methods to ultimately identify the suspect as Shi. Upon investigation, it was found that the suspect Shi had no fixed income and did not possess qualifications for virtual currency trading. To defraud others, he collected screenshots of others trading coins online, forged false profit records, and impersonated a senior "coin dealer" to gain their trust. Victim Mr. Liu believed him and transferred 100,000 yuan to the account designated by Shi. After receiving the payment, Shi did not deliver the virtual currency; instead, he used part of the funds for gambling and squandered the rest, splitting and hiding the remaining funds.The investigating officers quickly identified Shi's identity and activities by accurately analyzing the flow of funds and comprehensively securing evidence related to the case. They decisively acted on the night of the report and successfully apprehended Shi. The next day, the case was officially filed for investigation. After solving the case, the police consistently adhered to the principle of "solving the case and recovering losses equally," patiently conducted legal policy education, and actively mobilized the suspect's family to cooperate in the restitution, ultimately recovering the full amount of 100,000 yuan involved in the case. On the morning of May 14, the 100,000 yuan of fraudulently obtained funds was fully returned to victim Mr. Liu. Currently, the suspect Shi has been subjected to criminal coercive measures for suspected fraud, and the case is under further investigation.

According to Fortune magazine, Eisen announced the completion of a $10 million Series A financing round, led by MissionOG, bringing its total funding to $18.5 million. Previously, the company completed an $8.5 million seed round, led by Index Ventures, which had not been publicly disclosed. Institutions such as First Round Capital, Cowboy Ventures, Homebrew, and Restive Ventures also participated.Eisen provides a service to financial service platforms for handling the "unclaimed property transfer" process, while also helping to locate clients and prevent funds from being transferred to state governments in the U.S. after becoming unclaimed. The company's co-founder Osgood (formerly a product manager at Coinbase) is particularly focused on the field of crypto assets. An increasing number of states are beginning to view crypto assets as transferable unclaimed property. Although the amounts may be small individually, the overall scale is quite substantial: U.S. states collectively hold about $70 billion in funds through the escheatment mechanism, which are assets legally turned over to state governments after accounts have been inactive for a long time.

Kelp stated on platform X that it has collaborated with multiple DeFi protocols to complete the liquidation of the attacker’s positions, and the recovery process of rsETH has made significant progress. Among them, Compound has participated in coordination multiple times over the past four weeks and provided about 3,000 ETH in support, while jointly completing the liquidation with Aave, recovering a total of approximately 17,426.2 rsETH. Euler Finance has liquidated the attacker’s positions within its protocol and plans to return the excess ETH to the DeFi ecosystem fund.

According to Cointelegraph, Casa co-founder Jameson Lopp warned that a new phishing technique has emerged, where attackers abuse legitimate Google recovery forms to hide malicious links within lengthy messages filled with a lot of blank space.

According to the official announcement, Websea officially opened withdrawals on May 18 at 16:00 (UTC+8), marking the platform's entry into a substantial and comprehensive recovery phase. The resumption of withdrawals is being carried out in an orderly manner with the support of strategic investors. According to previous news, the platform has reached a strategic cooperation intention with a Middle Eastern family fund to fully support the platform's long-term operation and development.At the same time, the platform will advance the Proof of Reserves (PoR) process construction and plans to conduct regular disclosures, enhancing the transparency and verifiability of the platform's assets through a combination of on-chain verification and third-party audits. The platform has also publicly disclosed reserve funds and hot wallet addresses for user inquiry and supervision.Websea CMO Herbert R. Sim stated that the opening of withdrawals is an important milestone in the full restoration of operational order. In the future, the platform will promote withdrawals to be fully and completely open based on business recovery and market conditions, and will continue to improve the risk control and asset protection system, pushing the platform into a more robust development phase.