Fresh incidents, analyzed daily.
AI-assisted first pass, reviewed by us before it's published here.
CCC token exploit drains $117,000 on Binance Smart Chain
A CCC token exploit on Binance Smart Chain drained an estimated $117,000 from a liquidity pool. Security alerts said the attack abused the token contract’s sell() logic to burn tokens held in the pool, distorting the token’s price. No recovery plan had been announced at the time of the alert.
The Sandbox pledges repayment after bridge exploit
The Sandbox said an Aug. 21 bridge exploit drained about $700,000 from an Ethereum vault tied to bridged SAND. The project said eligible users will be repaid 1:1 from treasury funds, and compromised bridge contracts will be retired. The incident affected bridged SAND on Base and BNB Chain, not Ethereum or Polygon.
Cosmos EVM accounting flaw exploited across six chains
A shared Cosmos EVM accounting bug was exploited across six networks, including MANTRA, TAC, and KiiChain. Public reports put the total theft near $6 million, with MANTRA accounting for the largest disclosed share at about $3.6 million. Cosmos Labs said it warned dozens of networks after the attacks began.
Moonwell loses $8.7M in Base oracle manipulation attack
Moonwell lost about $8.7 million on Aug. 27 after an attacker manipulated the price of the thinly traded MAMO token used as collateral on Base. The inflated price let the attacker borrow real assets including cbBTC, USDC, wstETH, and ETH. The incident left the protocol with bad debt and renewed concern about spot-price oracle risk.
CISA Flags Actively Exploited Metabase SQL Injection: BI Systems Targeted for Production DB Key Theft
CISA added CVE-2026-72898 to its Known Exploited Vulnerabilities catalog. The SQL injection bug in the Metabase BI platform allows attackers to compromise backend databases housing user mapping and API keys.
Microsoft Defender 'ShieldBreak' Zero-Day Patch Bypass Disclosed: Local SYSTEM Access Threatens Endpoint Wallets
A newly released exploit chain named 'ShieldBreak' completely bypasses Microsoft's initial patch for CVE-2026-50656 in Defender's Malware Protection Engine, granting standard users NT AUTHORITY\SYSTEM privileges.
Coinsbuy reportedly hit by $7.9 million theft
Coinsbuy reportedly suffered a $7.9 million crypto theft across Ethereum and Tron wallets. The platform paused deposits and withdrawals, then later said services resumed and customer funds were covered from reserves. The incident underscores exchange-wallet compromise risk.
Unlimited Technology Systems Breach Exposes 3.8M Records: Mass PII Exfiltration Fuels Targeted Crypto SIM-Swaps
A major data breach affecting 3.8 million individuals exposed personal, medical, and identity details. Cybercriminals are using massive PII datasets to coordinate targeted SIM swaps and social engineering against crypto investors.
Metabase CVSS 10.0 Zero-Day Exploited in the Wild: Database Key Theft Threatens Web3 Analytics & Treasury Stores
Attackers actively exploited an unpatched CVSS 10.0 zero-day in Metabase BI software (versions 1.58+), gaining root admin access to extract stored credentials for all connected production databases.
IBM Langflow AI Framework Hit by Remote Code Injection: AI Bots & Trading Pipelines Targeted
A critical code injection vulnerability in IBM Langflow (CVE-2026-9198) was added to CISA's KEV catalog after active exploitation was detected. Exploiting this AI workflow engine grants hackers arbitrary code execution on backend servers hosting trading bots and Web3 analytics tools.
Critical N-able N-central Zero-Day Exploited: MSP Platform Breach Threatens Downstream Web3 Infrastructure
A critical authentication bypass flaw in N-able’s N-central RMM platform is under active exploitation in the wild. Attackers gaining administrative control over MSP management servers can silently deploy keyloggers and drainers across thousands of managed enterprise endpoints.
CaptiveCrunch Campaign Hijacks Hotel Wi-Fi to Push RAT Malware Targeting Remote Web3 Executives
Threat actor Storm-2945 is using compromised hotel Wi-Fi networks to serve fake browser updates that install 'CornFlake' RAT malware, targeting remote crypto teams and conference travelers.
Cisco Secure FMC Zero-Day Exploited in the Wild: Enterprise Firewall Flaw Threatens Node Infrastructure
CISA added an actively exploited Cisco Secure Firewall Management Center flaw (CVE-2026-20316) to its KEV catalog. The bug allows unauthenticated static credential access to core perimeter firewalls.
Adform Supply Chain Attack: Hackers Poison Advertising Script to Swap Crypto Wallet Addresses
Attackers hijacked a core tracking script served by ad-tech giant Adform (reaching 14,000+ businesses), turning a trusted tracking pixel into a browser-based crypto address rewriter.
Coldcard Mk3 Seed Generation Flaw Exploited: $38M Drained in Automated 25-Minute Bitcoin Sweep
A critical firmware flaw in Coldcard Mk3 hardware wallets bypassed hardware randomness, creating predictable 24-word seed phrases. Attackers brute-forced the weakened entropy space to sweep 594 BTC across 500 wallets in under half an hour.
Origin Energy Breach: 900,000 Records Leaked; Why Reused Passwords Are the #1 Crypto Threat
Origin Energy confirmed a breach affecting 900,000 customers. With PII and account details exposed, the threat of credential stuffing against crypto exchange accounts is at an all-time high.
Seoul Police Bust Fake Flare Network Staking Ring: $8.5M in XRP Stolen via Hired Actors & Spoofed Domains
A sophisticated phishing ring hired actors to promote a fake Flare Network staking portal on YouTube, stealing $8.5M in XRP from 71 investors in just 8 days before police traced $18.8M across linked wallets.
AFX Trade Arbitrum Bridge Drained for $24.15M Following Multi-Sig Validator Key Compromise
Attackers compromised 5 out of 9 validator keys on AFX Trade's third-party Arbitrum bridge, reaching quorum to execute a fraudulent $24.15 million USDC withdrawal into Ethereum.
Undocumented Tenda Router Backdoor Exposed: Hardware Risks to Node Operators and RPC Endpoints
Security researchers uncovered an undocumented administrative backdoor (CVE-2026-11405) across multiple Tenda router models, allowing attackers to hijack network traffic and modify DNS settings.
Phishing signature drains $999,999 in USDT from Ethereum wallet
An Ethereum user reportedly lost $999,999 in USDT after signing a fraudulent approval. Attackers then used Multicall to move and split the funds quickly across a few transactions. The incident is another example of token-approval phishing at high value.
Aurum / NEYRO report alleges custodial drain hidden as “AI trading”
A forensic report alleges that Aurum’s NEYRO product did not perform real trading and instead routed deposits into a pool controlled by the operator. The report says user funds were then swept out and spread across many wallets. The claimed losses are in the tens of millions.
Gravity Bridge reportedly drained in suspected signing-key compromise
Gravity Bridge was reported to have lost about $5.4 million in what investigators suspect was a signing key compromise. Validators reportedly halted the bridge while the incident was investigated. The case highlights the danger of privileged key theft in cross-chain systems.
LayerZero-based cross-chain trick leads to Kelp DAO theft and Aave spillover
A cross-chain attack on Kelp DAO was reported to have released 116,500 rsETH to an attacker after a message was accepted as legitimate. The stolen assets were then used to borrow heavily across DeFi platforms, including Aave, contributing to a broader market panic and large withdrawals.
JFrog Artifactory Zero-Days Uncovered: How Package Registry Flaws Expose Web3 Build Pipelines
Critical privilege escalation zero-days in JFrog Artifactory allow unauthenticated attackers to breach package repositories, posing a severe threat of malicious dependency injection in Web3 CI/CD pipelines.
Garden Finance Exploit: Supply Chain Compromise Drains $450K USDT Across Multiple Chains
An off-chain solver database breach allowed hackers to inject fake transaction records into Garden Finance’s HTLC bridge, mistakenly releasing $450K USDT across Ethereum, Arbitrum, Base, and BNB Chain.
WEMIX Smart Contract Hacked: $6.25M in Stablecoins Illegally Minted After Owner Key Compromise
Attackers compromised the owner/admin credentials for WEMIX$ stablecoin smart contracts, fraudulently minting 5.22M unbacked tokens before swapping and bridging out $6.25 million.
Russian APT Campaign Targeting Zimbra Mail Servers: A Blueprint for Targeted Web3 Phishing
International intelligence confirms an APT campaign targeting Zimbra webmail servers. Compromised internal communications directly enable high-precision social engineering against protocol admins and multisig keyholders.
Critical Check Point Firewall Zero-Day Hit by Active Exploitation: A Direct Threat to Validator Integrity
A CVSS 9.1 authentication bypass in Check Point SmartConsole allows attackers to modify firewall policies, potentially exposing isolated crypto bridge validators to direct intrusion.
Active $9.7M Exploit Hits Crypto Payment Processor Triple-A
Crypto payment processor Triple-A is facing an ongoing hot wallet breach, with over $9.7M routed to a single attacker address—and deposits are still live. Read our breakdown of the attack and crucial security hardening practices every crypto business must implement to prevent key compromises.
Ostium drained of $23.75M in oracle signer key compromise
Ostium confirmed a loss of 23,752,746 USDC from its OLP vault after an attacker obtained an oracle signer private key. The protocol paused trading and later reopened after hardening measures. The funds were converted into ETH and routed through Tornado Cash.