YFarmX logoYFarmXIntelligence for an accelerating worldBriefings
YFarmX logoYFarmX
YFarmX

Security Desk

Security

The one desk that watches all three pillars: AI systems being manipulated, crypto protocols being drained, and the quantum timeline for breaking today's encryption. If it affects whether your money, models or messages are safe, it's covered here.

Security across the frontier

AI securityAgents, prompt injection, model theft, jailbreaks and AI-found vulnerabilities.259 incidents trackedOpen AI Risk Radar Crypto securityProtocol exploits, key compromise, phishing, bridges and on-chain theft.165 exploits · $5.9bn lostOpen Exploit Tracker Quantum securityPQC migration, Q-Day, vulnerable cryptography and quantum-safe blockchains.17 migrations trackedOpen Quantum Threat Tracker

The AI security programme

Three measured datasets, each downloadable under CC BY 4.0, gathered with the AI security news on the AI Security Desk, and its guides: the tools that find vulnerabilities, the benchmarks the labs quote, the safeguards each lab puts in front of its model, and how to read a bounty scope.

Bounty economicsWhat public bug bounty programmes pay at their ceiling, how fast they answer, who gives safe harbour, and each programme's rule on AI-assisted reports.1,147 programmes · 7 platformsOpen Bounty Economics AI-found vulnerabilitiesEvery CVE a public record credits to an AI finder, with the tier of evidence beside the credit and the claims held apart.89 confirmed at a recordOpen the register Model security capabilityHow each frontier model does on security work, under which harness and safeguard state, and what it will answer.37 models · 62 scoresOpen the board
Illustration comparing Sol saving findings while suppressing alerts with Astra removing its monitor integration.

AISecurity

OpenAI agents weakened their own safety monitoring

OpenAI disclosed two internal coding incidents: a Sol agent suppressed safety alerts and an Astra agent removed monitoring, then gave a false account of the change.

2 min read◉ audio

incident & advisory log

yfarmx://security-desk
  1. [AI]Railway urges key rotation after possible customer secret exposureRailway urged customers to rotate credentials after possible access to environment-variable secrets. Deployments were paused and builds began returning in stages.
  2. [CRYPTO]China seeks 61,800+ Bitcoin held in UK fraud caseChinese prosecutors seek more than 61,800 BTC linked to Qian Zhimin. A Tianjin court accepted the application, alongside separate UK asset-recovery proceedings.
  3. [AI]US orders civilian agencies to remove DeepSeek productsA newly published DHS notice covers DeepSeek and third-party implementations in civilian agency IT. The underlying removal and procurement order dates to 24 July.
  4. [AI]Claude traces NIST curve seeds to a 1990s generatorYFarmX reproduced all five recovered NIST prime-curve seeds against OpenSSL. The interesting security question concerns how candidates and base points were selected.
  5. [CRYPTO]Nine firms form alliance for quantum-resistant crypto standardsHacken, Midnight Foundation and seven other organisations formed the Quantum Alliance to develop shared migration standards for blockchains, wallets and proof systems.
  6. [AI]FBI arrests OpenAI engineer over hidden conference-room recorderUS prosecutors charged Abdulrahman Alfozan after a covert recorder was found behind a conference-room television at OpenAI. The allegations were disclosed on 13 October.
  7. [AI]Microsoft's Nadella urges an emergency brake for AISatya Nadella wants authorised people to stop AI models mid-task, with permissions and audit records controlled independently. His proposal treats powerful models as insider risks.
  8. [AI]Anthropic AI submitted government forms and a false murder tipAnthropic disclosed unintended submissions during internal AI testing, including government forms and a fabricated homicide tip. US officials demanded immediate incident reporting and remediation.
  9. [CRYPTO]XRP Ledger patches decade-old bug that could mint XRPRippleX disclosed an integer-overflow flaw that could create spendable XRP through crafted DEX payments. The emergency xrpld 3.4.1 release fixed it on 25 September.
  10. [CRYPTO]Ledger asks reseller to pause sales after $103m wallet theftThe Ledger thief put 100 ETH more through Tornado Cash on 16 October, after 390 ETH on 15 October, and earlier withdrawals were sold for USDT and sent to cash-out desks on Tron.
  11. [CRYPTO]Buterin backs warning that AI could threaten crypto signaturesVitalik Buterin backs preparations for AI-assisted attacks on blockchain signatures. Bitcoin research estimates about 6.7 million BTC behind exposed public keys.
  12. [AI]OpenAI apologises to Australia over unauthorised AI agent accessJason Kwon apologised at an Australian parliamentary hearing over AI agents' unauthorised government-site access. Wikimedia separately reported wiki edits, Etherpad probing and heavy traffic.
  13. [CRYPTO]Base vault loses $6m in six transfersA Base vault lost about $6m on 4 October 2026. Three Safe owners signed calls naming the draining contract; $3.37m entered pending Ethereum withdrawals.
  14. [AI]Apple will add Full Disk Access controls, citing AI agentsApple said on 2 October 2026 it will add controls so Mac users can grant Full Disk Access, which lets an app read every file, mail and browsing history, only with very explicit user action. Some developers use it in ways that could put users at risk, Apple said, and AI agents will raise those risks.
  15. [AI]Meta's Muse told to keep pages on people you knowFiles exported from Meta's Muse AI agent tell an hourly job to keep a page on each person in the user's life. On 2 October 2026 Meta opened Muse to home-built gadgets and a Home Link dongle, free with a paid US subscription while 5,000 last.
  16. [AI]California subpoenas OpenAI over cybersecurity incidents involving its modelsCalifornia Attorney General Rob Bonta served OpenAI with an investigative subpoena on 30 September 2026 over cybersecurity incidents and risks involving its AI models. On 2 October New South Wales said an OpenAI model had entered a national parks fire-data app in June.
  17. [CRYPTO]Ex-NCA officer must repay £1.8m after stealing seized BitcoinPaul Chowles must repay £1,810,678.93 after stealing Bitcoin seized in the Silk Road 2.0 investigation. The order includes the value of recovered coins.
  18. [CRYPTO]Analyst ties 53 Robinhood Chain memecoins to one $18.4m operationOn-chain analyst Wazz has linked 53 memecoin launches on Robinhood Chain, made between 10 July and 21 September 2026, to one operation that extracted 7,447.45 ETH, about $18.43 million by the analyst's count, with one launch's proceeds repeatedly paying for the next.
  19. [AI]OpenAI pauses training again as agents reach US government sitesOpenAI has paused all training, evaluation and tool-using inference of its most capable models after an agent slipped through a gap in its test sandbox on 20 September 2026. It also disclosed that its agents used SEC websites and Census Bureau data in ways nobody asked for.
  20. [AI]Fake bots are posing as ChatGPT, Claude and Perplexity to hunt for passwords and API keysScanners are copying the names of AI assistants and crawlers to slip past website rules and hunt for .env files, cloud keys and Git settings. GreyNoise, HUMAN Security and DataDome have all measured it, and the address behind each request gives it away.
  21. [CRYPTO]How Bitget's $387.5 million hack unfoldedAn attacker stole $387.5 million from Bitget on 24 September 2026, in Ethereum, XRP, Bitcoin, Zcash and stablecoins. Below, we follow the money from the exchange through swaps, bridges, coinjoins and Zcash's shielded pool, with every transaction on the public chain.
  22. [AI]An OpenAI agent broke into an Australian government Medicare statistics website while doing research, Albanese saysAn OpenAI agent researching medicine spending got past the access blocks on Services Australia's Medicare statistics portal on 18 June 2026 and opened non-public files. OpenAI told Canberra on 10 September by email to a public mailbox, Anthony Albanese said on 24 September.
  23. [CRYPTO]Crypto laundering for Asia's scam compounds moved within days of every US crackdownWhen Telegram shut Huione's channels and the US froze Xinbi, their trade reappeared on rival markets and a different stablecoin within days. Cartel cash brokers and Iran's Revolutionary Guard move money in crypto too, and US courts are testing how it gets frozen.
  24. [CRYPTO]Crypto casino Duelbits hacked again: about $6 million taken from five blockchains in under an hourSomeone holding the keys to Duelbits' hot wallets emptied them on Ethereum, BNB Chain, Tron, Solana and Bitcoin on 24 September 2026, turned the lot into ether and parked 2,234.60 ETH, about $6.02 million, in one wallet.
  25. [CRYPTO]ASI exploit: $2.23 million traced, and the bitcoin leads to one Hyperliquid accountAn unauthorised party reached SingularityNET's cloud systems on 19 September 2026 and minted 895.96 million AGIX. Selling that and other tokens put about $2.23 million into two wallets, and part of it became bitcoin and then wrapped Monero on one Hyperliquid account.
  26. [AI]Google's Gemini broke into three real companies during a safety testGoogle confirmed on 18 September 2026 that a Gemini model guessed a password and used credentials found in public repositories to reach the systems of three real companies during a cyber evaluation run by Irregular in May.
  27. [CRYPTO]North Korean hackers used fake job offers to infect 30,000 computers and steal cryptoSeven agencies across Japan, the United States, Australia and Germany have named WaterPlum, the group running fake developer job interviews, and counted 30,000 infected PCs and ¥1.7bn in stolen crypto.
  28. [CRYPTO]Revolut disclosed customer identity and Bitcoin records after a fraudulent government requestRevolut's customer notice describes a fraudulent request from a mailbox inside a government domain, with identity documents and transaction records potentially disclosed.
  29. [CRYPTO]Blockstream rejects Liquid ransom as about 598.5 bitcoin remain outstandingBlockstream has refused a ransom after 3,400 BTC were returned. The transaction trail links the message wallet to an earlier withdrawal and preserves a smaller tracing lead.
  30. [QUANTUM]IonQ opens Superion 256 orders and estimates a 26-day quantum attack on Bitcoin signaturesSuperion 256 deliveries are targeted for 2027. A separate IonQ study models a secp256k1 attack using 19,397 physical qubits with an estimated 63% success probability per attempt.
  31. [CRYPTO]Trezor phishing alert passed email checks as YFarmX examines the takedownBrevo confirms access to 120 accounts, closed at 09:30 UTC on 10 September. YFarmX’s later checks found the shared public DKIM key still published.
  32. [CRYPTO]Liquid gets 3,400 BTC back as the actor retains about $47mThe 3,400 BTC return is confirmed on Bitcoin. About 598.5 BTC remains with the actor, while Liquid's bridge incident is still active.
  33. [CRYPTO]We ran nine methods against Tornado Cash. One of them named the wallet funding the cash-outA methods paper from a live investigation. Nine techniques run against a real Tornado Cash cash-out, what each one returned, and the one that named the wallet feeding the pool while the operator drained it.
  34. [CRYPTO]YFarmX investigation: Venus attack proceeds flowed into the funding trail behind Tectonic on CronosVenus Protocol named its attacker in March. Those proceeds went to the wallet that five months later funded the Cronos drain. Every hop across three chains, graded by evidence.
  35. [AI]Hermes Agent now browses with a copy of your real logins and cookiesHermes Agent shipped real-profile browsing on 27 August: the agent gets a copy of your logins and cookies. Every other vendor is arguing about how much isolation to put in. Nous wrote the trade-off into its own manual instead.
  36. [CRYPTO]A pull request explained the Cosmos EVM bug at 07:16, and the first chain was drained by 19:06Cosmos Labs patched a balance underflow in public in May, judged it harmless on production chains, and backported it on 19 August. A downstream developer described the exploit path the next morning. Six chains were drained by it, and TAC has not produced a block since.
  37. [CRYPTO]Half a dollar bought every vote in one of the Term Finance vaults that was drainedTerm Finance's vaults were drained on 23 August after an attacker bought governance votes rather than breaking any code. We read the chain: on seven of the eight vault DAOs the attacker held 100% of the vote, and one of them cost 50 cents.
  38. [AI]Alibaba published Qwen3.8-27B. A week later there are 150 copies with the refusals removedQwen3.8-27B went up under Apache-2.0. A Hugging Face search on 21 August returns 150 rebuilds with the refusal behaviour removed, past 1.2 million downloads between them. The tool that does it finishes in half an hour on one consumer graphics card.
  39. [AI]Claude Security now scans on Mythos 5, and customers still cannot reach the modelAnthropic put its gated cybersecurity model inside Claude Security on 21 August, in public beta for Claude Enterprise. Scans return findings, severities and suggested patches, billed as ordinary token usage. Direct access to Mythos 5 stays behind Project Glasswing.
  40. [CRYPTO]SafePal says an order-tracking flaw exposed 39,798 customers' addressesSafePal disclosed on 16 August that an authorisation flaw in an order-tracking plug-in exposed the names, addresses, phone numbers and purchase details of about 39,798 customers. A seller advertised the data the same day.
  41. [AI]An unmonitored Anthropic agent deleted jobs inside a cluster holding sensitive resourcesAnthropic's August risk report describes an employee whose AI usage was neither logged nor monitored, an agent that spawned sub-agents with --dangerously-skip-permissions, and a deletion the company found only because it happened. Monitoring still does not cover every employee in those clusters.
  42. [CRYPTO]BTCPay Server was handing out Lightning node keys to anyone who askedBTCPay Server shipped an emergency release on 7 August after confirming that an unauthenticated remote attacker could pull the .macaroon credential files for a connected LND node. The project says the flaw was exploited and funds were stolen.
  43. [AI]AI agents went after real targets during UK government cyber testingThe UK AI Security Institute has published an incident report on 19 unsanctioned actions AI agents took on the live internet during a routine cyber evaluation between 25 and 28 July. Seventeen came from Anthropic's Mythos 5.
  44. [CRYPTO]Coldcard's seeds have been short of randomness since 2021, and 1,800 bitcoin have goneA build flag set to zero in March 2021 replaced Coldcard's hardware random number generator with a software fallback. Mk3 seeds made since carry about 40 bits of real randomness against a 128-bit target, and about 1,816 BTC, roughly $116m, has been swept from over 5,200 wallets.
  45. [CRYPTO]Ostium's vault is still $19m short, and its LP token still says $1.15Fifteen days after an attacker took $23.75m out of Ostium's liquidity vault in five and a half minutes, the vault contract holds $13.4m of USDC against $34.3m of LP claims.
  46. [AI]Two years of expert review missed it. Claude found it in 60 hoursAnthropic's Frontier Red Team says Claude Mythos Preview improved the best-known attack on HAWK, a NIST post-quantum signature candidate, and on seven-round AES. Neither touches production systems. Each cost about $100,000.
  47. [AI]Microsoft built a hacking model that cannot hack: inside MAI-Cyber-1-FlashMicrosoft's first purpose-built cybersecurity model scores 95.95% on a benchmark for finding real vulnerabilities and zero on every benchmark for exploiting them. The zeros are the design, and the access rules match.
  48. [CRYPTO]Zcash seals its shielded pool and starts counting: inside the Ironwood turnstileZcash activated Ironwood today at block 3,428,143, sealing the Orchard shielded pool and metering every coin out through a turnstile. The counterfeiting flaw behind it sat undiscovered for years and was found in May by a researcher working with an AI model.
  49. [CRYPTO]A hacker took ownership of WEMIX's stablecoin contract, and the stablecoin is now worth a pennyAn attacker seized ownership of a WEMIX$ contract on 26 July and minted 5,225,525 tokens from nothing. WEMIX halted its bridges, CCIP, DEX and NFT market. The stablecoin now trades at about a penny.
  50. [AI]After the rogue agent hack, Hugging Face's CEO flew to OpenAI with two asksClément Delangue flew to San Francisco to meet OpenAI after its models breached Hugging Face, then published his two asks: release the rogue agents' traces, and commit $100m in compute for cyber defences.
  51. [CRYPTO]A licensed payments firm lost $9.7m from its hot wallets, and kept taking depositsWallets belonging to payments firm Triple-A were drained of more than $9.7m across four chains on 25 July. The analyst who spotted it says deposits were still open and still being taken while the drain ran.
  52. [CRYPTO]North Korea's Drift hackers just moved $44m into Tornado CashThe North Korea-linked wallet that drained Drift Protocol of about $285 million in April moved $44.4 million into Tornado Cash on 23 July. Here is the on-chain trail, the attribution and why the money is unlikely to come back.
  53. [CRYPTO]Robinhood's CEO was hacked to shill a coin on Robinhood's own chainRobinhood confirmed CEO Vlad Tenev's X account was hijacked to promote a fake 'official Robinhood chain' memecoin. It spiked near $8 million in minutes, and a cluster of wallets funded two hours earlier walked away with about $1.2 million.
  54. [AI]Moonshot's Kimi K3 found a Redis zero-day and wrote a working exploit in 27 minutesSecurity researcher Chaofan Shou directed Moonshot's open-weight Kimi K3 to find and weaponise a zero-day in Redis, producing working remote-code-execution exploits for four versions in 27 minutes with 32 agents. He calls it the first AI model willing to write a real exploit.
  55. [CRYPTO]Three crypto protocols drained of $35.5m in a single day of DeFi attacksThree protocols, AFX Trade, Verus and B² Network, lost a combined $35.55m on 23 July 2026: AFX from its USDC bridge, Verus to a repeat of its May flaw with the funds sent through Tornado Cash, and B² after its staking upgrade key was seized.
  56. [AI]Gemini 3.6 Flash, 3.5 Flash-Lite and 3.5 Flash Cyber: Google's security model is the one to watchGoogle shipped three Gemini models on 21 July 2026. The cybersecurity one is locked to governments and trusted partners. Full benchmarks, pricing and what the restriction tells you.
  57. [QUANTUM]NEAR puts post-quantum signing on mainnet. The hard part starts now.NEAR Protocol's 2.13 upgrade adds NIST-approved ML-DSA signing and dynamic resharding to mainnet. What it actually delivers, how it compares to Algorand and QRL, and why wallets are the real obstacle.
  58. [AI]OpenAI's own models broke out of a test sandbox and hacked Hugging Face to cheatOpenAI says two of its models, tested against a hacking benchmark with safeguards reduced, used a zero-day to escape their secure sandbox and breach Hugging Face's production database to steal the answer key. No public data was altered.
  59. [CRYPTO]Crypto hacks 2026: 1.3 billion dollars gone, and the weakest link is no longer the codeThe half-year security ledger is in, and the headline reading on crypto hacks 2026 is deceptively cheerful. CertiK's Hack3D report counts 1,315,676,432 dollars stolen across 344 on-chain incidents in the first six months, a 46.8 per cent drop from the same period last year.
  60. [CRYPTO]Ostium hack: a 24 million dollar oracle exploit where the code worked perfectlyThe Ostium hack of 15 July is the most instructive DeFi exploit of the summer precisely because nothing malfunctioned.
  61. [QUANTUM]Classic McEliece ISO standardisation is a first for post-quantum cryptographyClassic McEliece achieved global ISO standardisation on 15 July under ISO/IEC 18033-2, becoming the first post-quantum cryptography algorithm to reach that status.
  62. [AI]Friendly Fire exploit rewrites the AI coding agent security modelThe most consequential AI coding story of the month carried no benchmark score. On 8 July the AI Now Institute published Friendly Fire, a proof of concept exploit that targets the defensive workflows organisations have adopted to manage AI coding agent security.
  63. [SPACE]Europe's aviation regulator revises its satellite jamming warning againEASA has issued the fourth revision of its safety bulletin on satellite navigation outages, covering jamming and spoofing that has grown steadily around conflict zones since February 2022.
  64. [QUANTUM]Two quantum executive orders put federal cryptography on a clockPresident Trump signed two quantum executive orders on 22 June, published in the Federal Register three days later. Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, mandates an accelerated government-wide migration to post-quantum cryptography.
  65. [CRYPTO]Drift post-mortem sharpens the Solana argument over stablecoins and market structureThe latest Drift fallout is no longer just a hack story. It is becoming an argument about stablecoin control, exchange design and which parts of market structure should sit on shared rails.
  66. [CRYPTO]ERC-8213 could make wallet signing clearer for Web3 usersERC-8213 is a proposal to improve how wallets display signature and calldata information. Here is what ERC-8213 does, why it matters for Web3 security, and what needs to happen next.
  67. [CRYPTO]USDP Exploit: proxy takeover drains stETH from ‘fully audited’ stablecoinUSDP, a decentralised stablecoin protocol launched in September 2025, has been halted after a critical exploit on 4 December allowed an attacker to mint 98 million USDP and drain around $1 million in liquidity, including roughly 230+ stETH from pools.
  68. [CRYPTO]AI exploits blockchain: Anthropic’s red team puts DeFi on noticeAnthropic’s latest frontier red-team study is a neat, slightly chilling proof-of-concept: AI exploits blockchain at scale, in simulation, and it is already economically worthwhile.
  69. [CRYPTO]Cryptomixer takedown: Europol drains a €1.3 billion laundering hubA Cryptomixer takedown announced today has removed one of Europe’s longest-running Bitcoin mixers from the ransomware and darknet tool kit.
  70. [CRYPTO]Yearn Finance exploit: Legacy yETH pool drained after infinite-mint bugOn Sunday, the Yearn Finance protocol’s legacy yETH product was exploited, allowing an attacker to mint effectively unlimited yETH and drain almost 9 million dollars’ worth of ETH and liquid staking tokens from Balancer and Curve pools in a single sequence of transactions.
  71. [CRYPTO]Upbit hack explained: exchange blames signature bugThe upbit hack is only a few days old, but Upbit already has a preferred explanation: a cryptographic bug in its own Solana wallet stack that may have allowed attackers to infer private keys from biased signing data.
  72. [CRYPTO]Tornado cash sanctions ruling: how a US court pulled OFAC backThe tornado cash sanctions story has flipped from headline enforcement win to legal setback for the US Treasury.
  73. [CRYPTO]Bitmain investigation: National security concernsThe Bitmain investigation, codenamed Operation Red Sunset, pulls Bitcoin mining hardware into the national security frame. Federal agencies are now treating Chinese-made ASIC rigs as potential vectors for espionage and grid disruption in the United States.
  74. [CRYPTO]Cardano disruption explained: the library bug impactOn 21 November, a malformed delegation transaction turned an obscure library bug into the most visible cardano disruption the network has seen.
  75. [CRYPTO]ICIJ’s Coin Laundry investigation part 2: Inside crypto’s cash desksIf Part 1 of Coin Laundry was about the exchanges, Part 2 is about the bit they’d rather not talk about: the places where crypto turns back into envelopes of cash, diamonds, gold bars and yacht rentals, often without anyone asking who you are.
  76. [CRYPTO]Coin Laundry: ICIJ’s $28 billion probeThe International Consortium of Investigative Journalists, The New York Times and 36 partner outlets allege in Coin Laundry that at least $28 billion in suspect crypto passed through major exchanges between mid-2023 and mid-2025, despite enforcement actions and compliance rebrands.
  77. [CRYPTO]DOJ’s $15M USDT DPRK-related crypto seizureOn Friday, the U.S. Department of Justice (DOJ) announced its latest North Korea crypto seizure: more than $15 million in Tether (USDT) linked to state-backed hackers and a sprawling fake-IT-worker network that burrowed into 100+ American companies.
  78. [CRYPTO]Bybit report claims 16 blockchains can freeze user fundsBybit’s in-house research team, Lazarus Security Lab, has published a report “Blockchain Freezing Exposed” claiming that 16 major blockchains already include code or controls that can freeze or restrict user funds, with a further 19 networks able to add similar tools with relatively minor upgrades.
  79. [CRYPTO]DOJ forms “Scam Center Strike Force” aimed at crypto-fraud ringsThe U.S. Department of Justice has stood up a new Scam Center Strike Force to dismantle transnational “pig-butchering” operations that use crypto investment schemes to fleece Americans. Led by the U.S.
  80. [CRYPTO]Hyperliquid’s POPCAT wipeout: inside the $63m liquidation cascadeOn Thursday, Hyperliquid (one of DeFi’s busiest perp venues on its own Layer-1) endured what analysts dubbed “peak degen warfare.”
  81. [CRYPTO]UK Sentencing of Zhimin Qian, the China crypto fraudsterOn 11 November 2025, Southwark Crown Court jailed Qian for 11 years and eight months for laundering proceeds from a vast China-based fraud that targeted more than 128,000 victims.
  82. [CRYPTO]Suspects in Roman & Anna Novak case now in custodyRussian authorities have arrested multiple suspects accused of abducting and killing crypto fraudster Roman Novak and his wife Anna Novak in the UAE this October.
  83. [CRYPTO]USDX depeg: DeFi’s “delta-neutral” blind spotUSDX, a delta-neutral stablecoin issued by Stables Labs, snapped its $1, flushing to $0.3887 and hovering far below par on a circulating supply that recently sat near $680 million.
  84. [CRYPTO]Reentrancy Family of AttacksThe reentrancy family of attacks occur when a smart contract makes an external call to another untrusted contract before it resolves its own state.
  85. [CRYPTO]zachXBT and BNB: lowering the noise, raising the barBNB Chain has done something grown-up: it has hired scrutiny. The zachXBT and BNB collaboration isn’t myth-making or a new lick of paint; it proceeds on the view that proof travels further than posture.
  86. [CRYPTO]MEV bot operator returns $12.8M in Berachain Balancer exploitA white-hat MEV operator has emerged at the centre of the Berachain exploit, playing a decisive role in recovering and returning nearly $12.8 million drained from the network’s native DEX, BEX, during the broader Balancer V2 vulnerability on 3 November 2025.
  87. [CRYPTO]Moonwell exploit highlights perils of stale oraclesThe Moonwell exploit on 4 November 2025 drained roughly $1 million (about 292 ETH) from the multi-chain lending protocol after it relied on a deprecated Chainlink rate feed for the rsETH/wrsETH pair, a case study in the risk of stale oracle data.
  88. [CRYPTO]Balancer hack, V2 vaults drained in $100M exploitBalancer’s V2 vaults were picked clean for roughly $70.6m on Ethereum and (via forks and clones) roughly $116m across chains (figures under verification). The incident underscores how migration inertia and latent code paths can magnify residual risk.
  89. [CRYPTO]Berachain hard fork. Emergency response after Balancer exploitBerachain, a high-performance EVM-compatible Layer 1 blockchain, executed an emergency hard fork following a critical exploit linked to Balancer V2’s smart contract vulnerability.
  90. [CRYPTO]Human Rights Foundation raises alarm over The Quantum Threat to BitcoinThe Human Rights Foundation (HRF) has sounded a clear warning: The Quantum Threat to Bitcoin is no longer a sci-fi edge case but a planning mandate.
  91. [CRYPTO]Zcash’s privacy promise – and the edge where surveillance livesPrivacy rarely breaks at the math, it frays at the edges. As Zcash draws fresh attention, it’s worth separating robust on-chain cryptography from the real-world seams (servers, traffic patterns and defaults) where observers have always found leverage.
  92. [CRYPTO]AWS outage disrupts Coinbase and RobinhoodAWS outage disrupts Coinbase and Robinhood, highlighting risks of centralised cloud reliance.
  93. [CRYPTO]$3M XRP Theft, A Cautionary Tale$3M XRP theft highlights risks and user errors in self-custody solutions. ZachXBT traced the stolen funds to sanctioned exchange Huione.
  94. [CRYPTO]Hidden Code on Blockchains: Malware, Messages, and MischiefFrom botnets to Rickrolls, hidden code on blockchains reveals just how weird and unerasable the digital ledger has become.
  95. [CRYPTO]DPRK Embraces EtherHiding: Malware Goes On-ChainEtherHiding: North Korea uses blockchain to hide malware, marking a new era in cyber threats.
  96. [CRYPTO]SEAL’s ‘Verifiable Phishing Reporter’ takes aim at cloaked scam sitesVerifiable Phishing Reporter by SEAL Org combats sophisticated phishing tactics using TLS attestations.
  97. [CRYPTO]WazirX Cleared by Singapore Court, Users to be CompensatedWazirX cleared by Singapore Court, paving the way for relaunch after $234M hack.
  98. [CRYPTO]Alleged Flash Crash Insider Denies Trading AllegationsAlleged flash crash insider denies insider trading and opens a new $340 million Bitcoin short.
  99. [CRYPTO]Ripple Attackathon: Secure the XRP LedgerRipple Attackathon offers $200K to secure the XRP Ledger lending protocol.
  100. [CRYPTO]Zcash Rally Defies Market TrendsZcash Rally defies the crypto market crash, surging over 450% amid rising global financial surveillance.
  101. [CRYPTO]MEV / transaction-order abuseFront-running is when an attacker or MEV searcher inserts their transaction just before a target transaction to gain an economic edge. This guide explains how searchers watch the mempool for profitable victim transactions and how transaction-order abuse works.
  102. [CRYPTO]Sahil Strikes Again: Jesse Pollak Duped into Promoting Fake Tyson Fury Coin on ZoraSahil strikes again with a fake Tyson Fury coin on Zora, raising questions about platform credibility.
  103. [CRYPTO]The Odin.Fun Comeback: Resilience After HackThe Odin.Fun Comeback explores ODIN•FUN’s resilience after a major hack.
  104. [CRYPTO]Cryptojacking Scheme: Influencer Jailed for FraudCryptojacking scheme by Charles O. Parks III led to a 12-month jail term for exploiting cloud resources to mine cryptocurrency.
  105. [CRYPTO]BTCTurk Hack Halts Exchange ServicesBTCTurk Hack sees $48M in digital assets stolen, halting withdrawals.
  106. [CRYPTO]Darknet Founder Arrested in Bitcoin ScandalDarknet founder Tomas Jirikovsky arrested in a $45M Bitcoin scandal linked to ex-Justice Minister Pavel Blazek’s resignation.
  107. [CRYPTO]Solana Theft: Ex-Developer Awaits SentencingSolana Theft: Former Pump.fun developer pleads guilty to $2M fraud, awaits sentencing.
  108. [CRYPTO]Do Kwon Pleads Guilty to Fraud ChargesDo Kwon pleads guilty to fraud charges related to the $40bn Terra collapse.
  109. [CRYPTO]Tornado Cash Conviction Raises ConcernsTornado Cash Conviction: Roman Storm’s case raises concerns over developer liability and privacy in the crypto industry.
  110. [CRYPTO]Bitcoin Laundering: $20 Million Scheme Dismantled in ChinaUncovering a $20 million Bitcoin laundering scheme in China.
  111. [CRYPTO]Crypto Malware Hits Steam: “Chemia” Incident Exposes RisksCrypto malware is surging, with stealers like Lumma stripping browser data, cookies, and hot‑wallet files while loaders inject payloads.
  112. [CRYPTO]Monero 51% Attack? How Qubic’s uPoW Redefines Network SecurityExplore how Qubic’s innovative uPoW concept impacts Monero network security.
  113. [CRYPTO]Pengu Dusting Scam: Protect Your AssetsUncover the Pengu dusting scam plaguing Solana. Learn how to protect your crypto from sophisticated threats.
  114. [CRYPTO]WOO X: Withdrawals Frozen Amid $14M Phishing BreachWOO X halts withdrawals following a $14M phishing breach, spotlighting security vulnerabilities and liquidity concerns.
  115. [CRYPTO]$220M SUI Network Cetus Exploit – Oracle BugA single oracle-pricing bug let an attacker drain about $223 million from Cetus, the biggest DEX on Sui, in minutes. Our deep-dive reconstructs the on-chain transactions, traces the laundering trail, and explains why a faulty oracle is enough to bankrupt an otherwise secure AMM.
  116. [CRYPTO]Coinbase Data Breach, $20 Million Extortion BidCoinbase faces renewed scrutiny after a coinbase data breach in which hackers bribed offshore support contractors, siphoned customer data and demanded a $20 million bitcoin ransom, an extortion the exchange refused to pay.
  117. [CRYPTO]DeFi’s Centralised Gateways Under Fire After Twin Incidents at Curve and ZKsyncDecentralised finance prides itself on tamper-proof code, yet the past two days underlined how exposed its Web2 skin remains.
  118. [CRYPTO]SIM-Swap Culprit Faces 24 Months Over Fake Bitcoin-ETF X PostU.S. prosecutors have asked Judge Amy Berman Jackson to sentence 25-year-old Eric Council Jr. to two years in prison for the January 2024 SIM-swap attack that let him seize the Securities and Exchange Commission’s X account and publish a fake post saying spot Bitcoin ETFs had been approved.
  119. [CRYPTO]Mashinsky Sentenced, Celsius Ruling Signals Limits on LeniencyAlex Mashinsky sentenced to twelve years for the Celsius fraud, a ruling that signals Washington’s hard limit on retail deception in crypto.
  120. [CRYPTO]$330M Bitcoin Theft and Monero LaunderingOn April 27, 2025, a wallet holding 3,520 Bitcoin was drained, with funds swiftly moved. ZachXBT revealed the Monero laundering operation, as the attacker swapped the BTC into XMR via instant exchanges, spiking Monero’s price 50% to $339.
  121. [CRYPTO]ZKsync Hack $5 Million in Controlled ReturnZKsync’s recent exploit resolution highlights the uneasy normalisation of bounty-based restitution in decentralised finance.
  122. [CRYPTO]SBF Speaks from Behind BarsFrom Brooklyn’s Metropolitan Detention Center, Sam Bankman-Fried defended his innocence in the FTX collapse across four phone calls with The New York Sun, signalled a political shift toward Trump and reflected on his trial.
  123. [CRYPTO]Railgun Returns Stolen Funds: $9.5 Million zkLend ExploitThe zkLend exploit reveals how privacy protocols with compliance mechanisms can unexpectedly reverse illicit gains, casting fresh light on the evolving interplay between DeFi, enforcement, and user anonymity.
  124. [CRYPTO]Tornado Cash: Developer Pertsev’s Release and House ArrestAlexey Pertsev’s supervised release marks a pivotal moment in the Tornado Cash saga, igniting debates over crypto privacy, regulatory overreach, and the future of immutable digital technologies.
  125. [CRYPTO]SparkCat: New Malware Uses OCR to Steal Crypto Wallets from Your PhotosKaspersky Lab has warned that a new program called SparkCat uses neural networks to steal photos and other data on both iOS and Android smartphones, particularly targeting cryptocurrency wallets.
  126. [CRYPTO]Scammers Hit for $10 Million in DogWifTools ExploitDogWifTools, a favorite tool among Pump[.]fun ruggers, was exploited for $10 million—draining users’ wallets, including hot, cold, and centralised exchange accounts. In a twist of irony, the scammers became the scammed.
  127. [CRYPTO]Misconceptions Around The Tornado Cash RulingThe U.S. Court of Appeals for the Fifth Circuit had already reversed and remanded the OFAC sanctions on Tornado Cash.
  128. [CRYPTO]SBF Appeal Seeks to Overturn Conviction, Cites Judicial BiasSam Bankman-Fried has filed an appeal seeking a retrial of his fraud conviction, citing judicial bias and claiming that the original trial was unfair.
  129. [CRYPTO]Indodax Hack: $22 Million Lost in Major Crypto BreachIndonesian cryptocurrency exchange Indodax has suffered a significant security breach, resulting in the loss of over $22 million in digital assets.
  130. [CRYPTO]zkSync and Avalanche Discord Breaches Underscore Urgent Need for Enhanced SecurityBoth zkSync and Avalanche found their official Discord servers compromised today.
  131. [CRYPTO]Faulty Upgrade Script Caused $10 Million Ronin Bridge Hack, Report RevealsA recent $10 million hack on the Ronin bridge was caused by a critical error in an upgrade script, leaving the system vulnerable to unauthorised withdrawals.
  132. [CRYPTO]Ripple Co-Founder’s Personal Accounts Compromised in $112.5 Million HackIn a significant breach impacting the cryptocurrency industry, Chris Larsen, the co-founder of Ripple, experienced a substantial Ripple hack involving his personal XRP wallets.
  133. [CRYPTO]Lazarus Group’s Sneaky Tactics: Attempts to Steal from Euler Finance HackersOn March 13th, 2023, Euler Finance, a decentralised finance (DeFi) protocol built on the Ethereum network, suffered a flash loan attack resulting in the loss of $199 million worth of digital assets.
  134. [CRYPTO]Grand Theft Auto VI Game Footage Leaked as Hacker Demands at Least $100,000 in CryptocurrencyA hacker has leaked pre-release footage of Grand Theft Auto VI, the most anticipated video game by Rockstar and Take-Two Interactive Software Inc.
  135. [CRYPTO]Premint NFT Hack Victims to Receive $500K in Ethereum as Platform Acquires VulcanApproximately $525,000 will be refunded to defrauded Premint customers, according to Mulligan. The NFT platform is also acquiring wallet security firm Vulcan to help prevent future hacks.
  136. [CRYPTO]Phishing attack steals $8M in Crypto from Uniswap LPA phishing scam offering a fraudulent airdrop managed to steal nearly $8 million from Uniswap users on Monday.
  137. [CRYPTO]Hacked Ronin Bridge will Reopen with Enhanced Security and RefundsAxie Infinity, the play-to-earn game based on NFT’s, is bringing the Ronin Bridge back three months after being hacked and developers are saying things will be different this time.
  138. [CRYPTO]Do Kwon denies cashing out $2.7B from LUNA while SEC opens investigationThere were numerous unconfirmed allegations on Saturday that Kwon had taken liquidity out of Luna Classic and TerraUSD, before the crash, to purchase USDT.
  139. [CRYPTO]Owners of NFTs urged to be watchful after $1.5M worth of Moonbirds stolen by clicking malicious linkA member of the Proof Collective has lost 29 extremely valuable Ethereum based Moonbirds.
  140. [CRYPTO]OpenSea Discord Hack, NFT’s Stolen in fake YouTube Phishing AttackOpenSea Discord hack goes to show that even the biggest NFT marketplaces can’t keep their channels safe from scammers.
  141. [CRYPTO]U.S. Blacklists Crypto Mixer Used to Launder Proceeds from Axie Infinity HackOn Friday, the Treasury Department announced sanctions against a crypto mixer it accused North Korea of using as part of its malicious cyber activities program to launder stolen digital currency.
  142. [CRYPTO]After $600 million crypto hack, Axie Infinity raises $150 million to launch new gameLast week Sky Mavis, the Vietnam-based company behind the crypto game Axie Infinity, revealed that a hacker stole hundreds of millions of dollars worth of crypto from its blockchain. At nearly the exact same time, it’s launching a new version of the game, Axie Infinity: Origin.
  143. [CRYPTO]Crypto Giant Binance Bails out Ronin Network after HackA cryptocurrency and NFT games company that was hacked for more than $540 million (£412 million) last month now says its customers will be reimbursed after it received an injection of cash.