Topic: #security
-
Apollo Global Management discloses unauthorized cloud access, data breach
Apollo Global Management confirmed that attackers gained unauthorized access to its cloud platforms between July 6 and July 10, 2026, exposing personal data including names, dates of birth, and Social Security numbers. The breach, disclosed six weeks after discovery, involved phishing and social engineering tactics and targeted multiple other major financial institutions.
-
State Department Offers $10M Reward for Iranian Hacker Tips
The US State Department has posted a $10 million bounty for information on Iranian hackers tied to Handala and Parsian Afzar Rayan Borna, marking an expansion of its Rewards for Justice program into cyber operations.
-
Trezor Data Breach: 13,689 Customers Exposed via ShipMonk
Trezor disclosed a breach at ShipMonk, its shipping provider, exposing names, emails, phone numbers and addresses of 13,689 customers across seven countries. The hardware wallet maker said its own systems were not compromised.
-
USENIX study identifies 65,340 risky crypto addresses with $574.8M in losses
Researchers at USENIX Security '26 identified 65,340 risky addresses across Ethereum and BNB Smart Chain, with $574.8 million in associated losses. Two active attack vectors account for $15.7 million of the total.
-
BTCPay Server patches critical Lightning vulnerability, awards 0.42 BTC
BTCPay Server disclosed a critical vulnerability in its Lightning integration that exposed LND node credentials to remote attackers, patched the flaw in version 2.4.2, and donated 0.42 BTC to security researchers who responsibly disclosed the issue.
-
EU Regulators Warn of Crypto Impersonation Scams Amid MiCA Rollout
European regulators are cautioning cryptocurrency users about a spike in impersonation scams targeting investors displaced by the EU's MiCA framework, which requires all crypto firms to obtain licenses or exit the market by a set deadline.
-
Coldcard Bitcoin Exploit: $130M Stolen via Randomness Flaw
A flaw in Coldcard hardware wallets allowed attackers to brute-force private keys by exploiting weak entropy generation. More than 1,596 BTC have been stolen across confirmed waves, with a suspected fourth bringing the total to roughly 2,055 BTC worth approximately $130 million. Fixed firmware is now available.
-
Hashdex shuts down Bitcoin ETF after failing to gain traction
Hashdex is liquidating its U.S. spot Bitcoin ETF (ticker: DEFI) after the fund accumulated only $14.7 million in assets under management. Trading will end August 17, with cash distributions to shareholders expected by August 28.
-
Coldcard Firmware Flaw Exposes $114M Bitcoin Theft, Accelerates ETF Shift
A firmware vulnerability in Coldcard hardware wallets, active since March 2021, enabled attackers to drain over $114 million from more than 5,200 users by early August 2026. The incident is driving institutional and retail investors toward spot Bitcoin ETFs and regulated custodians as safer alternatives to self-custody.
-
Air-Gapped Bitcoin Wallets: Offline Security Limits After $114M Coldcard Exploit
Air-gapped wallets keep private keys completely offline to reduce hacker exposure, but a $114 million Coldcard exploit demonstrates that offline security still carries risks. Recovery phrase theft and physical attacks remain viable threats.
-
Coldcard firmware exploit drives bitcoin holders back to exchanges
A firmware vulnerability in Coldcard hardware wallets triggered $70–$90 million in losses and prompted retail bitcoin holders to move smaller balances onto centralized exchanges for safety, marking a sharp reversal from the self-custody migration that followed the FTX collapse.
-
Former BNB Chain Employee Deploys ASTEROID Token, Exits With $638K
A former BNB Chain employee deployed the ASTEROID token, acquired 79.67% of the supply for $10,000, and sold 718.8 million tokens for $628,000–$638,000 before the token crashed 50% in 20 minutes. BNB Chain initiated legal action and denied any affiliation.
-
XRP Ledger 3.2.1 fixes manifest flood affecting nodes
XRP Ledger developers released a major software update to address a manifest flood that impacted nodes on Friday, July 31. The upgrade restricts how nodes handle validator manifests to prevent similar incidents.
-
1,082 BTC stolen from Coldcard wallets via weak seed generation
Galaxy Research mapped a 41-minute attack on July 30 that drained 1,082.65 BTC from 1,196 Coldcard wallets by exploiting weak seed generation. The attacker never accessed the devices themselves—instead, they recreated private keys offline by brute-forcing roughly four billion possibilities.
-
Block Discloses Critical Coldcard Vulnerabilities Affecting Bitcoin Hardware Wallets
Block disclosed two critical security flaws in Coldcard hardware wallets (Mk2, Mk3, Mk4, Q, Mk5) that allowed remote theft of Bitcoin. Researchers identified over 1,082 BTC potentially stolen and warned the attack campaign remains active.
-
$972M Crypto Hacks Shift to Keys and Governance Over Code Bugs
Crypto has lost roughly $972 million to hacks in 2026, but most theft now flows through compromised signing keys and governance exploits rather than smart contract vulnerabilities, according to Immunefi's analysis of five years of breach data.
-
Claude AI Discovers Faster Attacks on HAWK and AES Cryptography
Anthropic's Claude AI model identified improved attacks against multiple cryptographic algorithms, including HAWK and AES, in a demonstration of how frontier AI can uncover mathematical weaknesses that escaped human review. The company published findings after following responsible disclosure procedures.
-
Apple kept fake Sparrow Wallet app on App Store after $875K theft report
A federal lawsuit filed in July alleges Apple failed to remove a fraudulent bitcoin wallet app from its App Store despite a customer reporting an $875,000 theft, resulting in a second user losing roughly $840,000.
-
SparkKitty malware infiltrates App Store and Google Play, targets crypto wallets
Security researchers have detailed how SparkKitty malware, first discovered in June 2025, spread through Apple and Google's official app stores by disguising itself as legitimate cryptocurrency and messaging apps, then scanned device photos for wallet recovery phrases.
-
Quantum threat to crypto isn't cryptography—it's governance speed
As quantum computing milestones accelerate, cryptography experts argue Bitcoin and decentralized blockchains face a unique vulnerability: the inability to achieve consensus fast enough to deploy quantum-resistant defenses before a cryptographically relevant quantum computer emerges.
-
AI Chatbots Amplifying Russian Propaganda, NewsGuard Audit Finds
A March 2025 audit by NewsGuard revealed that leading AI chatbots repeated false narratives from the Pravda network about 33% of the time, with seven models directly citing Pravda-affiliated sites. The discovery has prompted European officials to flag risks ahead of upcoming elections.
-
Crypto home invasions surge 20-fold in H1 2026, CertiK reports $124M losses
CertiK's H1 2026 wrench-attack report documents a 20-fold surge in crypto-related home invasions, with 52 verified incidents and $124.1 million in losses and ransom demands. Europe and France account for the majority of recorded cases.
-
North Korea arrests elite hackers for stealing regime funds via crypto
According to Daily NK, North Korean authorities arrested a group of elite state-trained hackers accused of stealing and laundering the regime's own funds through cryptocurrency. The report cites an anonymous source inside Pyongyang and cannot be independently verified.
-
Robinhood CEO's X account hacked to promote fake $VLAD memecoin
Vlad Tenev's X account was compromised Thursday and used to promote Vladhood ($VLAD), a fake memecoin falsely claiming Robinhood app listing. The incident highlighted rising memecoin activity on Robinhood's newly launched blockchain, which has attracted $700 million in assets.