hackeralert

#Ledger #HackerAlert
🚨 Ledger Attack: $91 Million Stolen from Compromised Devices — Investigation Details

Hardware wallet manufacturer Ledger has released an official update regarding the incident in which crypto users lost approximately $91 million (an estimate by Alex Thorn, Head of Research at Galaxy Research).

🔍 Key Investigation Facts:
Source of the problem: All confirmed breach cases are linked exclusively to devices purchased through an unofficial reseller in Southeast Asia—CryptoBilis.
Direct sales secure: All official Ledger systems and direct sales channels remain unaffected.
Physical tampering: An unauthorized hardware implant was discovered in the wallet of at least one victim. Ledger notes that the number of modified devices is limited, and the investigation is ongoing.
Seller's response: CryptoBilis has completely halted sales of hardware wallets.

🛡 What should owners of devices purchased through CryptoBilis do?
1. If the device is new (unactivated): Do NOT initialize or set it up.
2. If you have already set up the device: Urgently transfer all funds to a new wallet using a seed phrase generated on a secure device purchased directly from the official Ledger website.
3. If you have been affected: Contact official Ledger Support and file a report with law enforcement agencies.

⚠️ An error in the XRP Ledger, present since 2015, could have allowed unbacked XRP to be created through a mathematical overflow. XRPL fixed the flaw without a validator vote and says there is no evidence it was exploited.

🔓 Researchers detected an implant that intercepts data displayed on Ledger hardware wallets during setup. It captures the seed phrase in plain text and sends it over a cellular network. The secure chip remains intact.

#Ledger #HackerAlert #xrp #Ripple #XRPL $XRP $RLUSD

😭 $6M stolen in Base network hack

A hacker drained 1,783 wstETH from a vault on Base - it's not yet known which protocol owned the funds

Another day, another vault that wasn't quite as locked as it looked 🙁
$ETH #ETHUp70%InQ3ButLiquidityFalls
#HackerAlert

🚨 #BITGET HACKER MOVES $83M IN STOLEN XRP

The attacker has moved around $83M worth of stolen XRP -- and Ripple cannot freeze the funds

Two wallets have been almost completely emptied, while a third is still being drained.
Only about $75M remains across the five original holding wallets

The stolen XRP is moving fast

Where will it go next?

#Bitget #HackerAlert

JUST IN: THE CHINESE HACKER WHO STOLE $370M FROM BITGET EXPRESSES THAT HE NEEDS SUPPORT FROM THOR CHAIN TO LAUNDER THE FUNDS

“I’M VERY WORRIED. LOSING MY ASSETS WOULD CAUSE A LOT OF TROUBLE IN MY LIFE”
#Bitget #HackerAlert

@FINANCE-JACK

Binance Case Study: The $230M Malone Lam Crypto Heist

The 20-year-old mastermind Malone Lam, originally from Singapore, orchestrated a massive $230M cryptocurrency theft (approx. 4,100 BTC) targeting a Washington D.C. executive. Using social engineering and SIM swapping, they bypassed 2FA to drain funds in minutes. Lam and accomplice Jeandiel Serrano burned millions on luxury cars, real estate, and high-end goods in Los Angeles. FBI and IRS-CI tracked on-chain activity and spending sprees, leading to their arrest in Miami. Recovered assets are being secured, highlighting extreme vulnerabilities in high-net-worth personal crypto security. Use app-based 2FA and hardware wallets to stay protected.

#Bitcoin❗ #HackerAlert $

$STO
🚨 BREAKING:

💰 Bit get founder Gracy Chen confirmed a Sept. 24 breach this week, affecting ~$351.6M from hot and warm wallet infrastructure.

Cold wallets remain secure. Bit get's $464M+ User Protection Fund covers the full loss.

Crypto suffered its largest hack of the year after Bit get lost $350 million in a single attack.

Nearly $2 billion has already been stolen across 300+ crypto hacks in 2026.

Bit get CEO Gracy Chen says North Korean hackers may be behind the exchange's $352M breach, citing IP addresses linked to VPNs used by a DPRK group.

#HackerAlert #BREAKING #CryptoNews

The price of THORChain rose by 15% following the CEO of the Bitget platform’s request to ban addresses related to a hack. The price of the THORChain coin increased by more than 15% after Bitget’s CEO formally asked the protocol to block services to addresses linked to a hack worth $351.6 million. On-chain data analyses confirm that the stolen funds were routed through THORChain to carry out cross-chain swaps, increasing the clarity of fund flows on the network and sparking debate about the balance between decentralization and controls to combat illicit activity.
#THORChain #Bitget #HackerAlert #Rune
$RUNE

🚨 B1tg3t: from $170M to $387.5M

The B1tg3t case grew in magnitude in just 48 hours.

First, there were more than $170 million in detected on-chain movements. Then came an estimate of $351.6 million and, subsequently, a revised figure of $387.5 million after incorporating affected assets in Zcash and TRON.

But there’s a key detail: the increase in the number does not represent a new wave of transfers, according to B1tg3t.

The company states that the vulnerability was identified and fixed, while Mandiant and SlowMist continue to support the investigation.

📌 #HackerAlert #hackattack #On-chain #ciberseguridad #CircleTetherFreezeBitgetHackerWallet $TRX $ZEC

It looks like the hacker of #Bitget withdrew $1.23M from #Binance 11 hours ago.

Wallet 0x4885 withdrew 257.6 $ETH ($692K) and 545K $USDT from #Binance, then swapped the 545K $USDT for 200.2 $ETH .

Then it transferred everything—457.9 $ETH ($1.23M)—to the hacker’s wallet of #Bitget an hour ago.

So far, we’ve identified the following addresses associated with the @bitget exploiter that still contain funds. We will continue updating this list. @GracyBitget @xiejiayinBitget @Bitget_zh docs.google.com/spreadsheets/d…

#HackerAlert #Hacked

🚨 BREAKING: BITGET HIT BY MASSIVE HACK! 🚨

Bitget has suffered a major security breach, with around $340 MILLION reportedly stolen from its wallets. 💰💀

The attacker moved large amounts of $ETH , USDT, USDC, $AVAX and $BNB , with funds being swapped and moved across chains. 🔥

And here's the part that really matters:

🛡️ Bitget says its User Protection Fund holds more than $450 MILLION.

That means the reported loss could consume a very large portion of that protection fund if the stolen assets have to be fully covered. 😳

Bitget says cold wallets were not affected and that user funds remain protected.

🚫 Withdrawals were suspended while the exchange investigates.

The exact attack vector is still unknown. 🔍

⚠️ The big question now: how much of Bitget's protection fund will ultimately be needed to cover this incident?

#HackerAlert
#BitgetSays$352MAffectedInHack
#BitgetSays

#HackerAlert
🚨 Bitget suffers $351.6 million hack — user funds safe

Crypto exchange Bitget reported a breach of its hot and warm wallets that occurred on September 24 at 18:31 UTC. Attackers infiltrated the wallet infrastructure's backend system, manipulated transaction data, and bypassed the authorization process.

🎯 Key details of the incident:
➡️ Scale of loss: Approximately $351.6 million was stolen. However, cold wallets—where the vast majority of assets are stored—remained completely unaffected.
➡️ Fund security: Exchange CEO Gracy Chen assured that the losses are fully covered by the Bitget User Protection Fund, which currently stands at over $464 million. Client balances will remain intact, although withdrawals have been temporarily suspended.
➡️ Cause: Private keys were not stolen; the issue stemmed from a compromised backend system. The vulnerability has already been contained.
➡️ Perpetrators: On-chain analysts (including Specter and Conor Grogan) point to the involvement of the North Korean Lazarus Group.

⚠️ The exchange promises to publish a detailed report containing a technical analysis and measures to prevent similar attacks within 24 hours.

The ASI Alliance confirms that the FET coin conversion tool was compromised; draining the tool and pausing transfer operations led to a signing key leak that resulted in the withdrawal of nearly $1.56 million worth of FET through a token conversion tool. The ASI Alliance has suspended transfer operations and disabled the affected contracts, in parallel with the investigation into the hacking incident.
#FET #ASI #HackerAlert
$FET

#Polymarket #HackerAlert
🚨 Polymarket hacked for $2.9 million via frontend: users will be refunded

The forecasting platform Polymarket has been hacked. The attackers hacked a third-party vendor and implemented a phishing script into the site's interface. As a result, at least 11 user wallets were affected, from which $2.94 million was withdrawn.
Main:
The threat has been eliminated: The malicious code has already been removed, the platform's smart contracts were not affected.
Compensation: Polymarket officially announced that they will fully refund all victims.

📉 Cryptohacks in June: in brief
This incident added to the statistics of the worst quarter in terms of the number of hacks. In June alone, the crypto market's losses amounted to $74.9 million (29 cases).

Top 3 hacks of the month: Humanity Protocol ($36 million), Secret Network ($4.7 million) and Polymarket ($2.9 million).

Main vulnerability: 43% of all losses for the month occurred due to compromise of private keys. Despite this, Polymarket holds its ground: the platform's TVL now exceeds $450 million, which is 301% more than last year.

What really happened with #coldcard It wasn’t an “AI hack”—it was a 2021 firmware bug. The vulnerability was introduced in Coldcard firmware 4.0.0 in March 2021: devices bypassed their hardware random number generator and fell into key generation via software, predictable, seeded with non-secret chip data.  The specific error is in libngu: the guard uses #ifndef MICROPY_HW_ENABLE_RNG, which only checks whether the macro exists, not whether its value is different from zero.  Result: anyone can reproduce the seed candidates offline and derive addresses to compare them with the blockchain—without touching the device.

The figure keeps growing in waves: from an initial 594 BTC to 1.082 BTC (1,196 addresses) on July 31, then 1.158 BTC, and on August 2 a third wave brought the total to ~1.367 BTC (~$89M) from 4,585 addresses;  today people talk about a fourth wave. Coinkite released an emergency firmware on July 31 for all affected models, but installing it doesn’t fix an already-existing seed.  You must generate a new seed and move the funds. #HackerAlert #bitcoin $BTC

#coldcardexploitattackerscontrol1366btc

​🚨 CRITICAL SECURITY ALERT: EXPANDING EXPLOIT ON COLCARD USERS 🚨

​The bleeding hasn't stopped. What began with an alarming 594 BTC drained in under 30 minutes yesterday has now escalated—exploiters currently hold over 1,366.38 BTC under their control!

​Analysis from Galaxy Research confirms three distinct waves of attacks so far. The burning question every holder is asking: Is the assault over, or are more breaches incoming? Whether this is a solitary hacker deploying upgraded exploit vectors or multiple attackers capitalizing on legacy vulnerabilities dating back to March 2021, the danger is real.

​🛡️ IMMEDIATE ACTION PLAN (PROTECT YOUR ASSETS):

​Patch Right Away: Update your device firmware to the latest official release without delay.

​Generate a New Seed: Transfer your funds to a completely fresh, uncompromised seed phrase.

​Stay Proactive: Cold storage is only as safe as your security hygiene—don't wait until your wallet is drained to take action!

​Stay paranoid, stay secure, and protect your holdings! 🔒⚡

​Disclaimer: Not financial advice. Always Do Your Own Research (DYOR).

​#BTC #Coldcard #HackerAlert

$VELVET
$BEAT
$BTC

#HackerAlert
🚨 Hacker withdraws $1.66 million from Allbridge Core cross-chain bridge through liquidity manipulation

The Allbridge Core cross-chain platform was attacked, resulting in $1.66 million in cryptocurrency being stolen from liquidity pools on the Solana network.

❓ How the scheme worked:
1. Flash loan: The attacker borrowed $1.12 million in USDC stablecoins and exchanged them for USDT.
2. Price manipulation: The hacker executed a series of 5 “same-asset swaps”, exchanging USDT for USDT. Due to an error in logic, the accounting of both sides of the transaction diverged, which significantly distorted the intra-pool price of the asset.
3. Finale of the attack: The distorted price allowed only 4,000 USDT to be exchanged for $2.24 million USDC. The attacker returned the flash loan and took about $1.66 million in profit.

Current status and consequences:
➡️ Security of funds: Private keys, user wallets, and routes without using liquidity pools were not affected.
➡️ Project actions: Allbridge plans to completely abandon pool exchanges.
➡️ Tracking: The team has already tracked transfers for $1.63 million — the funds were transferred from Solana to a consolidation address on the Ethereum network, after which they were distributed in several directions.

#HackerAlert
🚨 Critical bug in Harmony ($ONE ): under attack again, full network rollback considered

The Harmony network was compromised by a mathematical vulnerability at the protocol level, which allowed attackers to hoard billions of native $ONE tokens “out of thin air”.

🔍 What happened?
Mathematical flock: Thanks to two vulnerabilities in cross-shard receipts, attackers were able to pass quorum checks without proper validator signatures, as well as reuse already used receipts.
Emission scale: According to estimates by on-chain researcher Juiceberg, about 4 billion ONEs have been created (~26% of the total supply), of which at least 2.8 billion have already hit the exchanges. Harmony has not yet confirmed the exact numbers.
Emergency update: Harmony released patch v2026.1.1 for validators, which closed the verification holes and stopped further unauthorized minting.

📉 Market reaction and security measures
The bridge ⁠bridge.harmony.one⁠ has been temporarily suspended.
The Harmony team published the addresses of 4 wallets of attackers and called on exchanges to freeze the detected funds.
Price collapse: Against the background of the news, the $ONE token fell by almost 39% in 24 hours, and the total capitalization of the project decreased to $11.27 million.
Rollback possibility: The developers are considering the option of restoring the network state to the time of the attack, but a final decision has not yet been made.

⚠️ Unlike the Horizon bridge hack in 2022 (where multisig private keys were compromised), this time the problem arose directly in the logic of transaction confirmation and protocol quorum.