Security

The attacker behind the Cysic bridge exploit transferred $744,000 in cryptocurrency to Tornado Cash after the foundation offered a 10% recovery bounty.

Indian cryptocurrency exchange CoinDCX faces scrutiny over suspicious transfers of approximately $16 million in USDT and TRX from addresses previously linked to the platform, with co-founder Sumit Gupta denying the excha...

Chinese prosecutors have applied to confiscate over 61,000 Bitcoin and related assets held by UK authorities, stemming from a massive international Ponzi scheme that defrauded more than 102,000 victims.

PHP has issued fixes for two critical vulnerabilities that can allow unauthenticated remote code execution, prompting immediate-update guidance for affected web-facing installations.

India's largest crypto exchange CoinDCX rejected claims of a fresh hack after blockchain analysts detected $16 million in suspicious outflows, attributing the activity to compromised addresses from a July 2025 incident.

Two companies allege First Horizon Bank permitted millions in unauthorized wire transfers after scammers impersonated a business owner in phone calls to the lender.

Binance founder Changpeng Zhao argues AI is unlikely to break crypto's encryption, but warns that phishing and social engineering remain serious risks.

PHP has released patches for the PHP2Shell vulnerabilities, but millions of exploit attempts and hundreds of thousands of unpatched servers mean the internet isn't fully safe yet.

Railway warns that an attacker may have decrypted customer environment variables, prompting a platform-wide credential reset as an on-chain investigator separately alleges $371,000 in crypto theft.

Financial sector data indicates that Norwegians are losing gold after fraudsters persuade them to purchase the precious metal and leave it in public spaces.

Italian financial police dismantled an alleged mafia-run underground bank near Milan that processed over €110 million in fake invoices and moved €68 million abroad using banks and cryptocurrency.

North Korean government and state media websites have been offline for 24 hours following the disclosure of a major PHP vulnerability that left 70% of the world's websites open to hackers.

Rabby Wallet's new mobile feature lets users remove or hide scam tokens with a long press, extending a control previously available on desktop.

Qubic's recovery design freezes listed vulnerable addresses and requires evidence beyond a valid signature before funds are released, even when no attacker has moved the coins.

A logic flaw in the NEM token contract allowed an attacker to repeatedly manipulate PancakeSwap pool reserves, resulting in an estimated $820,000 loss.

Qubic restarted its blockchain on Oct. 19 after a thief drained 1,404 wallets of nearly $1.3 million in QU tokens. The attacker exploited weak wallet recovery seeds, not the blockchain itself.

Cloudflare CEO Matthew Prince says exploit attempts against a critical PHP vulnerability have reached millions, after thousands were seen even before public disclosure.

Two critical PHP vulnerabilities with a CVSS score of 9.2 enable unauthenticated remote code execution. BNB Chain, Trust Wallet, and Changpeng Zhao have responded as patches arrive.

Changpeng Zhao urges caution when visiting websites after two PHP vulnerabilities were patched early, with BNB Chain and PancakeSwap confirming they do not use PHP.

Attackers used compromised third-party notification access to send fake security alerts through NGRAVE's LIQUID app, draining $2.56 million from 70 wallet addresses across four networks.