Crypto scammers created a counterfeit version of the Upbit-backed GIWA blockchain and tricked DYORSWAP into integrating it, leading to the theft of approximately 767 ETH (about $2 million) from over 1,300 wallets that bridged funds to the fake Layer 2 network. DYORSWAP has paid over 200 ETH in compensation to affected users.
A Cosmos Hub governance proposal that would have returned 1.2 million ATOM tokens seized after the Neutron attack, plus allocated 500,000 ATOM to supporting voters, is being vetoed by the community. The proposal sought to pay 1.72 million ATOM total from the Hub's community pool.
Crypto casino and sports betting platform Duelbits confirmed a hack that drained approximately $7 million from its hot wallets across multiple blockchain networks including Ethereum, BNB Chain, Tron, and Bitcoin. The platform took its site offline following the suspected private key compromise, though it stated user funds remain safe.
Circle and Tether froze a wallet holding approximately $318,000 in stablecoins following a massive $351.6 million hack of cryptocurrency exchange Bitget on Thursday. The freeze covers only a small fraction of the total stolen funds.
A malicious iOS application called FomoPeek has been connected to the theft of approximately $580,000 in cryptocurrency. Security researchers from SlowMist provided analysis on how the app operated and offered guidance for users who installed affected versions.
Four hooded men broke into a family home in Vendin-le-Vieil, northern France, and restrained a cryptocurrency worker, his wife, and their two children, forcing the father to transfer €40,000 in digital assets before fleeing. The incident is part of a growing trend of violent "crypto-rapts" targeting cryptocurrency holders in France.
Cybercriminals deployed malware called Needle Stealer, disguised as an AI-powered crypto trading agent, to target seven browser-based cryptocurrency wallet extensions including MetaMask and Coinbase Wallet. The malware used signed Microsoft software to steal passwords and replace wallet extensions.
London-based digital asset technology platform Haruko suffered a targeted cyberattack that compromised exchange API details, trading data, and funds belonging to 15 cryptocurrency clients. Attackers obtained an access token that exposed sensitive exchange API information used by hedge funds to trade on crypto exchanges.
Fraudulent YouTube tutorials claiming to teach users how to build crypto arbitrage bots using Anthropic's Claude AI drained more than $517,000 in Ethereum from at least 224 victims, as blockchain intelligence reports a 440% surge in hackers using AI to hide malicious code on blockchains.
A North Korea-backed hacking group infected more than 30,000 computers across over 100 countries using fake job offers, stealing cryptocurrency worth approximately $11 million from more than 7,000 crypto wallets. Japan's National Police Agency and the FBI jointly disclosed the large-scale cyberattack campaign targeting IT engineers globally.
South Korean cybersecurity company DCENT issued a critical security notice on September 16 telling users to transfer assets from its App Wallet immediately after detecting abnormal asset transfers. Initial findings indicate the security issue is limited to the App Wallet product.
Security researchers have uncovered a Brazilian banking malware operation deploying KREMLIN toolkit, which uses Ethereum smart contracts to update its attack infrastructure and hijacks Chrome and Edge browsers to steal credentials and session tokens. More than 1,500 infections have been traced.
The endowment built from unclaimed 2016 DAO funds is launching a second funding round worth $1.8 million to support Ethereum's security initiatives, asking companies that benefit from Ethereum security work to contribute. The move comes as 2026's first half has already set a record for crypto hacks.
Attackers compromised a legitimate Italian state email address to impersonate law enforcement and trick Revolut into releasing personal data of approximately 680-700 customers, primarily cryptocurrency holders. The hackers are now demanding a $3 million ransom in Monero cryptocurrency with a 24-hour deadline to prevent the data's sale.
Decentralized exchange Balancer is proposing to shut down following a $130 million hack, with BAL token holders scheduled to vote September 25-29 on whether to claim proportional shares of over $9 million in remaining treasury assets or forfeit their claims.
CoinEx announced it will cease operations on December 22, 2026, nine years after launching. The closure comes less than three months after a Wall Street Journal investigation highlighted the exchange's role as a hub for illicit Iranian cash transactions, amid broader challenges in the cryptocurrency market.
MetaMask has introduced new security features including warnings for potential scams, lookalike wallet addresses, and first-time recipient transfers. The update includes Added Protection that automatically reverts transactions that differ from their previews.
The European Union's Cyber Resilience Act, effective September 11, 2026, requires cryptocurrency wallet providers to report actively exploited vulnerabilities or severe security flaws within 24 hours of awareness. Non-compliance can result in fines up to 15 million euros.
The EU Cyber Resilience Act's reporting obligations have gone into effect, requiring manufacturers of commercial wallet hardware and software worldwide to report actively exploited vulnerabilities to regulators within 24 hours through ENISA's Single Reporting Platform.
Blockstream has refused to pay a ransom for nearly 600 bitcoin still held by hackers who exploited the Liquid Network on September 6, draining approximately 4,000 BTC (worth $320 million) from federation reserves. The attackers had demanded a 10% bounty payment and used on-chain messages to communicate their demands.
An attacker minted over 40 BTC worth of nBTC out of thin air on Nomic on June 25, but Osmosis took 74 days to discover the exploit, which left allBTC 36% unbacked. The incident contributed to an 8.3% decline in ATOM price amid shaken investor confidence.
Hardware wallet maker Trezor disclosed that attackers compromised its third-party email service provider, enabling them to send phishing emails from Trezor's legitimate domain. The fraudulent emails falsely claimed a security flaw in STM32 hardware had weakened recovery phrases on some devices.
CrowdStrike reports that while an August 31 disruption successfully blocked delivery of new malware payloads, previously installed malware remains active and continues to swap cryptocurrency payment addresses in copy-paste attacks targeting users.
Self-described white-hat hackers returned 3,400 of nearly 4,000 bitcoin stolen from the Liquid Network's federation reserves on September 6, but retained approximately 598.5 BTC worth $47 million. The sidechain remains frozen as Blockstream prepares a restart.
Hardware wallet manufacturers Ledger and Trezor are jointly urging the cryptocurrency industry to adopt more responsible disclosure practices for security vulnerabilities, with concerns mounting about AI-enabled threats. The rare collaboration between competitors aims to improve security standards across the hardware wallet sector.
XRP Healthcare, a blockchain project built on the XRP Ledger, is investigating unauthorized transactions that affected approximately 4,011 XRPH Wallet accounts beginning September 3, with about $452,000 in XRP and related assets removed. The company has traced 267,664 XRP and 23.2 million XRPH tokens on-chain.
XRP Healthcare disclosed that approximately 4,011 XRPH Wallet accounts were affected by unauthorized transactions beginning September 3, 2026, resulting in the theft of around $452,000 in XRP and related assets, including 267,664 XRP and 23.2 million XRPH tokens that have been traced on-chain.
The attacker behind the third wave of Coldcard hardware wallet exploits has moved approximately 97.09 BTC (about $7.7-7.8 million), representing 45% of funds stolen in that wave. The hacker routed the Bitcoin through THORChain and CoinJoin mixing services to obscure the trail, according to Galaxy Research.
Hardware wallet manufacturer Trezor disclosed that an additional 67,000 U.S. customers were affected by a data breach at shipping partner ShipMonk, bringing the total to over 80,000 exposed customer records. The breach involved personal information including names, email addresses, phone numbers, and shipping addresses from orders dating back to 2019, despite Trezor's belief that ShipMonk had deleted the data as certified.
DeFi protocol Notional Finance suffered a $1.7 million exploit on September 4, with an attacker draining approximately $69,000 in DAI and $1.66 million in USDC from a legacy escrow contract through an integer overflow bug. The stolen funds were reportedly moved to Tornado Cash.
U.S. law enforcement and CrowdStrike announced the takedown of Sality, a Russian cybercrime operation active since 2003 that used clipjacking malware to steal cryptocurrency by replacing copied wallet addresses. More than 15,000 infected machines have been isolated in the global operation.
Ukraine's National Police and Security Service announced they dismantled a network of fake investment platforms operating from Kyiv that defrauded at least 62 victims across more than 20 countries, moving up to $1 million per month through crypto draining schemes.
Crypto wallet maker Ledger has been hit with a $500 million class action lawsuit alleging the company failed to prevent multiple data breaches and adequately protect customers. Plaintiff Douglas Kim claims he lost $1.9 million after attackers exploited compromised customer data from a December 2023 breach, with a former employee's lingering access enabling malicious code injection.
The Justice Department and CrowdStrike announced Tuesday they have disrupted the Russia-based Sality botnet, which has been operating since 2003. For the past eight years, the malware used EggJagger to steal Bitcoin and Ethereum by replacing copied cryptocurrency addresses with attackers' addresses, infecting over 15,000 machines.
Blockchain security firm CertiK reported that crypto losses reached approximately $215 million in August 2026, with DeFi exploits accounting for $144.6 million. Major incidents included a $75 million price manipulation attack on Tectonic protocol that halted the Cronos Network and a $9.3 million exploit of More Markets on Flow EVM.
A security vulnerability in an outdated Rain card smart contract led to approximately $1.1 million being drained from Solana-based platforms on August 28, with Avici suffering $500,800 in losses affecting 1,685 users. The exploit caused Avici's token to crash 49%.
Kraken temporarily froze customer accounts after nearly 12,000 unsolicited small cryptocurrency transfers from wallets linked to sanctioned exchange HTX reached the platform between August 17-24. The dust attack triggered Kraken's compliance screening systems, though the exchange has since restored access to affected accounts.
Industry leaders are warning that AI agents could enable crypto hacks far exceeding today's billion-dollar breaches, even as major platforms like Binance begin integrating AI agents for automated trading. Fidelity Digital Assets identified key risks to the sector's AI thesis, including the possibility that AI agents may not converge on public blockchains.
Coinkite released firmware updates 5.6.1 and 1.5.1Q for Coldcard hardware wallets following disclosure of a seed-generation vulnerability that resulted in an $88.6 million Bitcoin theft. Users with affected seed phrases must create new wallets and transfer their Bitcoin.
Cross-chain decentralized exchange Maya Protocol suspended its network after an attacker exploited multiple software vulnerabilities to steal approximately $1.7 million in Bitcoin and other cryptocurrencies. The exploit caused the protocol's native CACAO token to plummet 89%.
Binance-backed cryptocurrency wallet provider SafePal disclosed that a flaw in an order-tracking plugin exposed names, phone numbers, and shipping addresses of 39,798 customers over 14 months. The stolen records are now being advertised on cybercrime forums, raising concerns about phishing and physical security risks for affected users.
A Hyperliquid user lost approximately $550,000 in USDC on August 13 after clicking on a fraudulent Google search advertisement that led to a phishing website. The incident was identified by FlashRescue, with funds transferred to three attacker addresses.
Hardware wallet manufacturer Trezor disclosed that approximately 14,000 customers across seven countries had their names, email addresses, and shipping information exposed after unauthorized access to systems at ShipMonk, its third-party fulfillment partner. The company emphasized that customer wallets and funds remain secure.
Coinbase, Block, BitGo and dozens of other cryptocurrency companies signed a Bitcoin Policy Institute letter calling on AI labs to provide qualified security researchers with access to advanced AI models, arguing that current safety guardrails block legitimate defenders while attackers face no such restrictions.
The Coreum cross-chain bridge connecting to the XRP Ledger was drained of approximately 199,916 XRP on August 9 in under two hours. The attack exploited a flaw in the bridge's relayer logic rather than a vulnerability in the XRP Ledger itself.
A security exploit in Coldcard's offline cryptocurrency storage devices led to approximately $130 million in losses, triggering a sharp increase in new Bitcoin addresses as users rushed to move funds to secure wallets. New Bitcoin addresses jumped from 260,000 to over 330,000 last week, reversing months of declining trends.
An attacker stole $8.07 million from crypto exchange Coinsbuy on August 9, 2026, exploiting vulnerabilities across both the Ethereum and TRON blockchains. Approximately $6.34 million of the stolen funds were reportedly laundered through FixedFloat, according to blockchain security firm BlockWatchdog.
North Korea-linked hacking group Kimsuky has developed three local AI environments and large language model tools to help automate cyberattacks, analyze stolen material, and create more convincing phishing campaigns targeting cryptocurrency and financial companies, according to a South Korean cybersecurity firm.
Crypto payment processor Coinsbuy was hit by a security breach on August 9, 2026, draining over $7.9 million from wallets across Ethereum and TRON networks. The attacker converted stolen assets into Monero, a privacy-focused cryptocurrency that complicates transaction tracing.
Following $3.4 billion in crypto thefts in 2025 and over $1 billion stolen in the first half of 2026, investigators reveal hackers have approximately 45 days to launder stolen assets before trails go cold. The Bybit exchange has recovered $48.4 million after suing North Korea's Lazarus Group, with a US court freezing $30.5 million in related assets.
The XRP Ledger Foundation and RippleX issued urgent security warnings on August 6-7, 2026, alerting users to phishing campaigns promoting fraudulent XRP airdrops and fake "XRP Rewards Scanner" tools designed to steal cryptocurrency from investors.
Prediction market platform Polymarket is replacing single-price snapshots with time-weighted average prices (TWAP) for settling short-duration crypto markets after traders exploited brief price manipulation windows to drain funds. The platform is offering $1M in rewards as part of the upgrade.
A security vulnerability in Coldcard cryptocurrency hardware wallets allowed hackers to steal over $130 million in July, contributing to total monthly crypto losses of $247 million—the second-worst month of 2026. Additional incidents included a $7.9 million theft from Coinsbuy.
BitGo has replaced LayerZero with Chainlink's Cross-Chain Interoperability Protocol (CCIP) as the exclusive cross-chain provider for Wrapped Bitcoin (WBTC), bringing the total value of assets migrating from LayerZero to Chainlink to approximately $14.6-15 billion following recent security concerns.
The cryptocurrency industry has experienced $972 million in security breaches during 2026, with the majority of stolen funds traced to compromised private keys, signature exploits, and governance vulnerabilities rather than smart contract flaws.
The cryptocurrency industry has experienced $972 million in security breaches during 2026, with the majority of stolen funds traced to compromised private keys, signature exploits, and governance vulnerabilities rather than smart contract flaws.
The cryptocurrency industry experienced its most-hacked six-month period ever in the first half of 2026, with over $1 billion stolen across 212 verified exploits, according to security firm Blockaid. The losses highlight ongoing vulnerabilities in crypto security infrastructure.
