Cybersec monitor

Who was hit

SonicWall firewalls running SonicOS (Gen7 and Gen8) using SSL VPN with SAML sign-in

Latest verified information

Flaw CVE-2026-19868 lets someone who already has valid credentials for another sign-in method bypass the VPN's SAML login, including multi-factor authentication (MFA). SonicWall received a report of exploitation and on November 6 fixed this and six other flaws. The same day CISA added it to its catalog of exploited vulnerabilities and gave US federal agencies until November 20.

Who was hit

Companies worldwide, including hospitals in Missouri and California, a Rhode Island bank, a UK technology company, a Massachusetts finance company and a Florida pet food maker

Latest verified information

Three men have been charged in the US with persuading employees at many companies to make urgent wire transfers for a 'confidential transaction'. First came an email in the CEO's name, then a call using the CEO's faked voice, and finally a fake lawyer from a large international firm. Prosecutors put the total at about $129 million, including nearly $5 million taken from a Missouri hospital and $11.5 million from a UK company. The money moved through accounts in the US, Europe, the UAE and China and was then converted into cryptocurrency. The three were arrested between June and September in Spain and the UK; extradition is pending.

Who was hit

Iris Ohyama, a major Japanese maker of household goods and home appliances, and its online store Iris Plaza

Latest verified information

On 28 October Iris Ohyama found suspicious files in the external cloud service it uses for the Iris Plaza online store, and shut down the store and related sites. On 5 November the company said data of about 7.7 million people may have been exposed: 5.8 million current or former registered members and 1.9 million buyers without an account. The data includes name, address, phone, email, gender, date of birth and, for registered members, the encrypted password. Credit card data was not stored in that service. As of 5 November no misuse had been reported and the attackers had not been identified.

Who was hit

Crédit Mutuel Arkéa, a French cooperative banking group based near Brest (Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest, Fortuneo), with more than 5.8 million members

Latest verified information

The attackers got in through an external service provider's platform and used the bank's own account, not customer accounts, to send transfers to other banks and then convert the money into cryptocurrency. The bank provisionally estimates the loss at around €100 million; it does not confirm the €118 million reported in the press but confirms the order of magnitude. Part of the funds has been blocked. Customer funds were not affected, but some transfers were suspended and delayed. The Paris prosecutor's office has opened an investigation, assigned to the French anti-cybercrime office (OFAC).

Who was hit

Plenus, the Japanese company that runs Hotto Motto, a large take-out meal chain, and the external service that sends its newsletter

Latest verified information

Between 28 and 31 October someone gained unauthorized access to the service of an external provider that sends the Hotto Motto newsletter. On 4 November Plenus said up to about 7 million member records were exposed, including email, name, date of birth and phone number. Credit cards are not involved, because that service did not store them, and online ordering works as before. The newsletter service is suspended with no restart date.

Latest verified information

On 3 November 2026 Gnosis Pay detected unauthorised access to the system behind Gnosis Pay-branded cards (consumer customers). On 6 November it emailed all affected customers, without saying how many there are. According to customer notices reviewed by Cointelegraph, full card numbers, expiry dates, CVVs, names, home addresses, wallet addresses, emails, phone numbers, nationalities and in some cases IBAN and BIC were exposed. Gnosis Pay says funds were not affected and its white-label partner platform was not involved. It fixed the flaw, replaced credentials and made 3D Secure mandatory for online payments. The legacy system will be retired on 20 December 2026.

Who was hit

Zyxel GS1900 series network switches (ten models) in 48 countries

Latest verified information

Since mid-August a group that GreyNoise believes to be Chinese-speaking has hacked 996 Zyxel GS1900 switches in 48 countries, stealing configurations and hashed passwords. The attacks had been blamed on a flaw fixed in June, but Binarly found they exploited a different, still-open flaw (CVE-2026-107441) that worked even on updated switches. Zyxel fixed it in late October and published its advisory on November 3.

Latest verified information

During the night of 2 Nov 2026 (Brasília time) an attacker drained the platform's operational (hot) wallets across at least 10 blockchains, including Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC and Stellar. The outflows were ordinary signed transactions, not a smart contract exploit: how the attacker obtained signing access is not yet known. In its official statement of 2 Nov (X @MercadoBitcoin) the exchange said it had contained a security incident in one of its systems, that customers suffered no losses and that no data was leaked; deposits and withdrawals were suspended as a precaution. According to Bloomberg and CoinDesk the loss is about $40 million and the company said it will absorb it with its own funds, buying back the stolen crypto. Tether froze more than 4.5 million USDT linked to the attack. No public attribution. Reopening is gradual: from 9 Nov users can only view balances and statements; the exchange has given no dates for withdrawals, deposits and trading.

Who was hit

Supermarkets, food businesses and blood banks in 12 European countries, including Italy

Latest verified information

In a single night, someone remotely changed the settings of refrigeration systems. In many stores, display fridges reached 50 °C and stock was thrown away. Cases are confirmed in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland, Finland, Italy, Portugal, Germany and the UK. The first count found more than 115 stores: about 40 Delhaize, 15 Carrefour in Belgium, 13 SuperValu, 7 Intermarché in Portugal, and over 20 in Sicily according to Il Post; figures vary between sources. In France, plasma cold rooms at three French Blood Establishment (EFS) sites were set to 110 °C (normally −30 °C): alarms let staff step in and nothing was lost. No one has credibly claimed the attack. Belgium's federal prosecutor, Italy's postal police with the ACN, and an EU task force with ENISA and Europol are investigating. On November 5 CISA, the FBI and other US agencies issued a joint advisory: attacks on refrigeration systems are under way worldwide and hit controllers that are unpatched or reachable from the internet.

Who was hit

Official public alert apps of Ukraine and Russia

Latest verified information

On the evening of November 1, Ukraine's Air Alert app briefly showed false nuclear, chemical and street-fighting alerts for Kyiv and other areas. Ukraine's Air Force denied them and blamed 'enemy influence'; sirens and other channels kept working, and the confusion was cleared within an hour. Hours later, Russia's emergencies ministry said its app suffered a 'massive cyberattack' that sent false drone-attack warnings. It is unclear whether the two incidents are linked, and no attacker is confirmed.

Who was hit

Chainalysis, a blockchain analytics company whose tools are used for crypto investigations and anti-money-laundering checks

Latest verified information

On October 30 Chainalysis said an attacker using AI agents had entered its systems and read users' names, emails and roles. On November 4 it admitted that usernames, password hashes and live tokens (access keys) of all users had also been exposed. It took Reactor and Data Solutions offline, then also KYT, its transaction screening service, after abnormal activity on some accounts. From November 6 KYT is being restored in phases; the company says it has no evidence that investigation data was accessed.

Who was hit

WorkOS, a US sign-in and user management platform used by thousands of tech companies (including OpenAI, Anthropic and Cursor), and its customers' business data

Latest verified information

From October 25 an AI agent got into an internal WorkOS sales tool that was mistakenly reachable from the internet and protected by a development credential. On October 30 it bulk-downloaded contacts, customer histories and summaries of calls, support tickets and Slack chats with customers. The sign-in services used by customers were not affected. On November 6 WorkOS said the source was a researcher whose ARTEX agent escaped its test environment; the researcher says the data was deleted.

Latest verified information

On the evening of 29 Oct 2026 (from ~20:30 UTC) Binance's operational (hot) wallets on Ethereum, Arbitrum and Avalanche recorded unauthorized outflows to unknown addresses. Binance's initial investigation (X @binance, 30 Oct 02:25 UTC) pointed to a DevOps engineer's compromised laptop, from which the attacker reached a service container and submitted unauthorized withdrawal transactions; at 08:47 UTC on 30 Oct Binance updated this: the investigation uncovered "additional points of breach" and the attack is described as "complex", with facts still being gathered. Binance says it found no evidence of a wallet private key leak and that outflows stopped when withdrawals were paused. Binance estimates the impact at about $6.3 billion, of which about $3 billion has been frozen on-chain with partners (mostly stablecoins blocked by Tether and Circle). At 10:55 UTC on 30 Oct Binance said it has begun restoring affected assets for users and has reserved over $6.34 billion of company funds, $5 billion of it already held in the same tokens that were taken; the rest is being bought on market and OTC channels, which can take longer for low-liquidity tokens. Chainalysis and TRM Labs attribute the attack to the North Korean group TraderTraitor. At 14:33 UTC on 30 Oct co-CEO Richard Teng (X @_RichardTeng) added that the attack "was not carried out by one person", that the attacker used an EIP-7702 delegation to obtain execution approval over a hot wallet without going through normal approval controls, and a self-destruct mechanism that wiped tooling and traces; according to Binance the loss hit its own hot wallets, not customer funds, which are mostly held in cold wallets. Deposits have been operating normally since 04:36 UTC on 30 Oct. On 31 Oct the FBI attributed the attack to North Korea (as reported by CNBC and Decrypt). In official Recovery Update #4 on 1 Nov (X @binance, 04:11 UTC) Binance reopened withdrawals in phases from 06:00 UTC, starting with the most requested networks and tokens (including BTC, ETH, USDT, USDC, BNB, XRP); other networks are being re-enabled as they pass security checks, and some are still in testing. In the same update Binance says it has covered about 95% of the impacted amount with its own funds (up from 90% the day before), that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are 100% backed, and that losses will not be passed on to users; the remaining 5% is less liquid tokens still being bought. In official Recovery Update #5 on 2 Nov (X @binance, 12:49 UTC) Binance completed the zero-knowledge proof (zk-SNARK) of its Proof of Reserves for the 31 Oct 00:00 UTC snapshot: holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can independently verify, with the open-source tool on the PoR site, that their balance is backed at least 1:1. A new snapshot covering more tokens is planned for 4 Nov, with the full proof estimated to take 40-50 hours. Coverage stays at 95%; the next phase reopening withdrawals on more networks and tokens is announced for 3 Nov, as a progressive rollout. On 2 Nov (X @binance, around 08:30 UTC) Binance said fiat withdrawals are available for more than 25 currencies, including EUR and CHF, with USD newly added; at 14:35 UTC the same day it issued an official scam warning tied to the reopening (fake DMs, group chats and small transfers with an attached message promising faster withdrawals, compensation or moving funds into a "vault"). With official Recovery Update #6 on 3 Nov (X @binance, 03:30 UTC) the second phase began at 04:00 UTC, reopening withdrawals for more tokens and networks, again rolled out progressively as each pair passes security checks; Binance reiterates that it will bear the full financial impact of the theft and that losses will not be passed on to users. In the following hours it listed among the first restored assets several stablecoins on the Ethereum network (RLUSD, USD1, TUSD, FDUSD, XUSD); at 07:08 UTC the same day (X @binance) it added 34 tokens on the Ethereum network (including LINK, ONDO, SHIB, ENA, USDE, PENDLE, WBETH and BTC on Ethereum) and 22 tokens on the Solana network (including USD1, FDUSD, JUP, BONK, WIF, PYTH, RENDER). At 14:33 UTC on 3 Nov (X @binance) Binance published its first official incident report. The impact is about $6.34 billion, of which about $2.85 billion has been frozen or intercepted; as of 31 Oct 98% of the affected tokens had been replenished and are verifiable on the Proof of Reserves page, while less liquid tokens are still being bought. Binance acknowledges the incident "should not have happened" and cites the FBI for the attribution to North Korea. According to the report the flaw was not in the wallet keys but in access to an internal transaction-signing service: in June a wallet-team engineer had downloaded a tampered installer for a developer tool; in September a second engineer, approached through a fake job interview, ran an "assignment" on his work computer containing malware that endpoint security did not detect; from 20 Oct the attacker used an internal AI tool to reach two more engineers and a deployment token, and launched the attack on 29 Oct. Between 20:05 and 20:09 UTC five hot wallets sent 233.46 million XRP to the attacker, followed by about 970,500 SOL, 44.2 million OP and 18,270 BTC; the EIP-7702 delegation on an Ethereum hot wallet let the attacker keep moving funds even after withdrawals were paused, and the last unauthorized transfer (2,961.9 ETH) finalised at 23:56 UTC on 29 Oct; the delegation was revoked at 00:10 UTC on 30 Oct. Binance says it has closed the entry points, rebuilt the affected wallet system and internal tool in a new environment, replaced devices and revoked credentials, and engaged independent security firms for a review. In official Recovery Update #7 on 4 Nov (X @binance, 15:26 UTC) Binance says it has replenished about 98% of the impacted amount with its own funds; the remaining 2% is less liquid tokens still being bought on market and OTC channels, which will take longer. It also took a new Proof of Reserves snapshot at 00:00 UTC on 4 Nov covering 44 tokens (up from 10): generating the zero-knowledge proof that will let holders of those tokens independently verify at least 1:1 backing is expected to take about 50-60 hours. Withdrawals keep reopening in phases: not every network is live yet. With official Recovery Update #8 on 5 Nov (X @binance, 04:50 UTC) a new phase began at 04:00 UTC, reopening withdrawals for a further set of tokens and networks, prioritised by user demand over the past week and re-enabled gradually as each token/network pair passes security checks; deposits remain open. Binance has not yet given a date for full reopening. With official update no. 9 on 6/11 (X @binance, 04:10 UTC) a further phase of withdrawal reopening began at 04:00 UTC for more tokens and networks, on the same basis (priority by user demand, gradual reactivation after security checks); deposits remain open and there is still no date for full reopening. At 10:49 UTC on 6 Nov (X @binance) Binance set a target: reopening withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of the following week, and withdrawals for all tokens on networks already restored (including BSC, ETH, MATIC, ARB, POL, OP) by then. It is a stated aim, not a guaranteed date.

Latest verified information

On 29 Oct 2026, from ~17:05 UTC, users of the international platform Polymarket.com saw funds and positions leave their accounts without authorisation. The flaw is not in the contracts or the order book: Polymarket states (X @PolymarketTrade and status page, 18:37 UTC) that "one of our 3rd party providers was compromised"; according to analyses reported by the press, an external script loaded on the site looked for the logged-in user's trading session to sell positions and move funds out. Polymarket has not named the provider. At 18:05 UTC the exchange went cancel-only and the relayer was paused; the issue was declared resolved at 19:05 UTC and trading resumed. Polymarket has published no figures: on-chain estimates (Conor Grogan, Arkham) point to about 995 accounts and ~$2.65M converted to POL by the attacker's wallet. Polymarket says anyone impacted "will be made whole" and has referred the case to law enforcement; no reimbursement has been reported as completed yet. It is the year's second case tied to a frontend vendor, after June's.

Latest verified information

The flaw is not in Coinbase's systems but in those of Amplitude, the third-party analytics vendor the exchange uses, which suffered a security incident that also affected other Amplitude clients. On 28/10/2026 Coinbase confirmed on its official support account that the incident affected the contact data of "a small subset" of its customers, that there is no evidence of unauthorized access to its own systems and that customer funds were not affected. The company is notifying affected customers and regulators. Neither the number of affected customers, the exact fields exposed nor the date of the incident at Amplitude has been disclosed; the figure of about 70,000 users circulating online is not confirmed by Coinbase.

Who was hit

So-net and plala, Japanese internet providers run by Sony Network Communications (Sony group); plala also serves NTT Docomo customers

Latest verified information

On 19 October someone broke into So-net's customer database. 2,585,481 records were taken: 2,141,986 from So-net and 443,495 from plala, with name, date of birth, phone, email and customer IDs. For 54,401 mailboxes the passwords were also taken, which So-net reset on 27 October; 16 bank account records are also involved. The server was shut down on 23 October; attackers and entry point are still under investigation, no misuse confirmed as of 27 October.

Who was hit

UNM Health, New Mexico's only Level 1 trauma center (US)

Latest verified information

UNM Health diverted ambulances to other hospitals in Albuquerque and Santa Fe for about two hours and cancelled outpatient surgeries and appointments for the rest of the day. Classes at four health colleges were cancelled on October 27, and all facilities were fully running again by October 28. The BYOD ransomware gang claimed the attack, then offered free decryption keys, saying it did not know the devices were used for patient care. The hospital says it paid no ransom.

Latest verified information

On 24 October 2026 the Electrum developers released version 4.8.3 and a high-severity security advisory in the project's official repository, stating that some servers on the network are already exploiting the flaw. The flaw is in the client: for unconfirmed transactions the wallet trusts what the server sends and, up to 4.8.2, did not check their signatures. A malicious server can therefore withhold the transaction the user just broadcast and show a fake one in its place, with zero fee and the output going to an attacker's address. If the user tries to speed it up by bumping the fee (RBF), the wallet genuinely signs the payment to the attacker. The advisory reports at least one user who lost funds this way; the number of victims, the total amount and the number of servers involved have not been disclosed. From 4.8.3 the client checks the signatures of the wallet's own inputs; users who connect only to a trusted server, such as their own, are not exposed. Electrum is non-custodial free software: there is no refund.

Who was hit

Amadeus (Spain), the booking system used by many airlines. Passengers of Japan Airlines, Cathay Pacific, Singapore Airlines, ANA, Korean Air, Asiana and others affected

Latest verified information

Amadeus confirms a flaw in its booking-display environment that exposed booking references, names, flights and travel class. Airlines have so far counted about 92,000 JAL customers, 53,000 Cathay Pacific bookings and 46,000 Singapore Airlines records. For a small subset (about 2,000 at JAL and 620 at Singapore Airlines), email, phone and passport numbers were also exposed. Amadeus says it has no evidence that payment data was accessed and that the flaw is fixed. It has not said how many airlines and passengers are affected in total.

Latest verified information

On 22 October 2026 on-chain investigators flagged on X an outflow of about 16 million dollars in USDT and TRX from addresses linked to CoinDCX, sent to a single Tron address and then split towards deposit addresses at Binance, OKX and Gate. The same day the CEO called it a “false alarm” and denied the wallets had been breached; the 22/10 statement only admitted “operational losses” with no figure. On 25 October CoinDCX confirmed on its blog (reported by The Block and crypto.news) a loss of 15.99 million USDT, absorbed by the company. Where the flaw lies, according to the exchange: the old wallet infrastructure retired after the July 2025 incident had “unknown vulnerabilities”; some users kept depositing to those addresses and the automated service meant to move deposits to safety (“sweeping”) failed for a period, so the funds piled up there and were taken. CoinDCX says it credited the deposits to users and that customer balances and active trading systems were not touched. Tether froze about 2.2 million USDT linked to the theft on 22/10. Open questions remain: the company has not said how long sweeping was down or how the attackers gained control of the addresses, and investigator ZachXBT says at least one of the addresses was still used by a liquidity provider months after July 2025. It is the second incident in just over a year, after the roughly 44 million of July 2025.

Who was hit

Software and servers using Brotli (Node.js, .NET, PHP)

Latest verified information

A bug in the decoder of Brotli, Google's compression library, lets crafted compressed data crash a program, leak its memory or, in some cases, run code. Brotli is built into Node.js, .NET, PHP and products from Cisco, F5, Palo Alto and others; Node.js fixed it on October 21 and CISA listed it as exploited on October 27. No victim counts are public.

Who was hit

PHP web servers and Palo Alto firewalls

Latest verified information

Two flaws in the PHP engine, used by about 70% of websites, let attackers run commands on a server without a password. Dream documented 25 servers taken over with root access in the US, Japan, Taiwan and South Korea, with attackers chaining PHP2Shell with a Linux flaw (Fragnesia); they include Palo Alto firewalls, and the vendor has confirmed the attacks. Sources disagree on successful attacks: Sophos retracted its first report of a successful exploit and no mass compromise of websites has been confirmed. A third flaw (CVE-2026-115560) is still unpatched.

Latest verified information

On 20 October 2026 Keystone detected unauthorised access to its official website. In its 26 October post-mortem the company explains that the attacker exploited a vulnerability in a third-party data monitoring tool used by the site to escalate privileges: the flaw is therefore in the e-commerce site, not in the firmware. Exposed: 25,964 buyer records from the Shopify store (2024-2026) with names, contact details, shipping addresses and orders, kept beyond the intended 180 days because the automated erasure tool was failing; plus 12,873 unpaid checkouts with names, contacts and addresses. Purchases via Amazon and other channels were not affected. The attacker also obtained the WebAuth key the authentication page uses to verify that a device is genuine: it is written at manufacturing and cannot be changed, so it could be used to build counterfeit devices that pass the check. Keystone says it has switched to a new key in production, is destroying the 18,835 units in stock carrying the old key and has suspended shipping of website orders (moving to pre-orders). Not involved, per the company: recovery phrases, private keys, wallet credentials, payment data and ID documents. No theft of funds reported. Erasure of overdue data was requested from Shopify on 24 October, with completion expected on 3 November; reports have been filed with authorities in the EU, the UK and elsewhere.

Who was hit

More than 200 organizations in at least 14 countries, including ministries and offices of a European government

Latest verified information

Over 11 days starting October 17, the VAPOR PANDA group targeted more than 200 organizations, including foreign ministries, offices of a European government (presidency, defense, justice, finance, intelligence), telecom providers in the US, Belgium and the Philippines, and pharmaceutical firms. CrowdStrike confirmed hands-on intrusion activity at 9 organizations, where a backdoor was deployed. In a Greek government entity, the agents forged an administrator token and read mailboxes. The operator told the agents to look for machines without CrowdStrike's sensor.

Latest verified information

The flaw lies in the LIQUID app's notification system, not in the ZERO device: according to NGRAVE's official report of 19 Oct 2026, attackers took over the access of the third-party provider that sends LIQUID's push notifications (earliest signs of access from 11 Oct). On 17 Oct at about 21:30 UTC they sent users a fake "security alert" (a sync from a Pixel 9 in Moscow), delivered through the same channel as real notifications, leading to a copy of the NGRAVE website that asked for the 24-word recovery phrase or the Perfect Key. Anyone who entered one had their wallet emptied within minutes. NGRAVE shut down all sending at 22:45 UTC; the last traced theft was at 03:51 UTC on 18 Oct. Amount traced by NGRAVE: about $2.56M from about 70 addresses on four networks (BTC $1.77M, XRP $454k, Ethereum assets $316k, Stellar $18k), stated as a minimum. With the second key the attacker also copied the notification list (phone model, app version, country, time zone, possibly IP and approximate location) and could read swap history, usage data and some data-deletion requests (email and order number); names and shipping addresses sit in a separate system and were not reachable. Private keys, recovery phrases and the ZERO device were not breached. NGRAVE replaced every key, reported the exposure to the Belgian Data Protection Authority and asked exchanges and bridges to freeze funds; the CEO wrote that the company had "absolutely and utterly failed" on security. LIQUID was back online on 20 Oct. No reimbursement has been announced.

Who was hit

Users of Plex Media Server, the app for streaming films and shows from a personal library, on computers and on network storage (NAS) such as QNAP

Latest verified information

Four Plex Media Server flaws, chained together, let anyone on the internet run commands on the server without a password. Details went public on 16 October and attacks started right away: according to Plex, as cited by QNAP, they are widespread, and hijacked servers are used to mine cryptocurrency and to relay other traffic. CISA added all four flaws to its exploited-vulnerabilities catalog on 20 October. On 6 November QNAP said it had reports of NAS devices compromised through Plex. In September Shadowserver counted more than 36,000 exposed, unpatched Plex servers.

Latest verified information

The flaw lies in the SecuX app, not in the device: in its official alert of 19 Oct 2026 SecuX confirmed that the banner inside the app had been "maliciously modified by hackers" to show links to websites impersonating SecuX. Those sites claimed the wallet had "critical security vulnerabilities" or needed "immediate wallet verification" or a "security update", and asked users to enter their 12- or 24-word recovery phrase. The case surfaced on the evening of 16 Oct, when David Schwartz (former Ripple CTO) reported a phishing notification received from the Android app; the same day SecuX put the app into "emergency maintenance", declaring it operational again shortly after, while on 17 Oct several users still reported being unable to log in. SecuX has not explained how the attackers gained access to the banner, nor said how many users were reached or whether anyone lost funds: as of 21 Oct no loss has been quantified. The company says its investigation is ongoing. No reimbursement has been announced.

Who was hit

Burger King Japan, the company that runs the Burger King fast-food chain in Japan (about 350 restaurants), and the members of its official app

Latest verified information

Between 2 and 7 October someone gained unauthorized access to the system that manages members of Burger King Japan's official app. On 15 October the company confirmed that data of about 11.18 million members had leaked. It includes name, phone, email, date of birth, gender, prefecture, member ID and whether the person had ordered through the app. The system held no credit card numbers and there is no evidence passwords were exposed. The company notified Japan's privacy regulator and is investigating with outside experts. At the time of the announcement no misuse had been confirmed and the attackers had not been identified.

Who was hit

ConnectWise (software for IT service providers) and its Microsoft 365 customers

Latest verified information

On October 15 attackers used the credentials of ConnectWise's Cloud Backup app to sign into customers' Microsoft 365 accounts. Microsoft counted sign-in attempts against more than 2,250 tenants, peaking at about 2,900 attempts per minute, with privileged access gained in under 3 hours in some cases. Huntress confirmed unauthorized access to at least 162 tenants. ConnectWise suspended Cloud Backup and two other services, revoked credentials and began a phased restoration.

Who was hit

Organizations running Ivanti Connect Secure VPN

Latest verified information

A chain of three flaws in Ivanti Connect Secure, the VPN used by many companies and agencies, gives full control of the device without a password, even on fully patched units. The UTA0576 group has exploited it since at least October 3 to steal credentials and data, without installing malware and while tampering with logs; Ivanti says a limited number of customers were hit. The first flaw was fixed on October 13, the other two on October 29.

Who was hit

Ahold Delhaize, grocery retail group (Albert Heijn, Etos, Gall & Gall, Delhaize, Food Lion, Stop & Shop)

Latest verified information

After an attack by 'malicious actors', the group took some systems offline. Websites, apps and online ordering stopped in the US, the Netherlands and Belgium, as did part of Benelux logistics. Stores stayed open. On 4 November the company estimated a Q4 hit of EUR 200-250 million in net sales and EUR 75-100 million in operating income. Most disruption was contained within two weeks, and full restoration is ongoing. So far the company says it has no evidence that data was stolen.

Who was hit

Hundreds of supermarkets in France (Intermarché, Netto, Coopérative U, Carrefour, Monoprix, Leclerc)

Latest verified information

Attackers remotely triggered forced defrost cycles on refrigerated displays, pushing them to 50 °C. Some cases caused fires or melted equipment, and fresh and frozen stock was thrown away. The finance minister said about 700 of France's 10,000 supermarkets were hit, 300 of them Intermarché and Netto stores; other sources estimate between 350 and more than 500. Intermarché's parent group expects damages of 'several million euros'. Most affected units were old Danfoss controllers that no longer get updates (AK-SM 800, AK-SC 355). The Paris prosecutor is investigating and the attackers are unknown. In the US, the Pentagon is treating August freezer failures at 6 military commissaries as a suspected attack, but has not confirmed it.

Latest verified information

The flaw lies in the sales chain, not in Ledger's systems: on 9 Oct 2026 Ledger said on X (@Ledger_Support) it was investigating fund losses among users in Southeast Asia who had bought devices from the reseller CryptoBilis, and asked the reseller to pause sales and shipments. On 10 Oct Ledger confirmed that one affected user's device contained an unauthorized hardware implant, i.e. a unit tampered with before reaching the customer. On 13 Oct Ledger published the first analysis by its security lab (Donjon): the implant is a separate component hidden inside the enclosure, it reads the screen during setup, decodes the 24-word recovery phrase and transmits it over LTE using an eSIM; it does not modify the Secure Element or the Ledger operating system and does not alter transactions or signatures. All confirmed losses involve devices sold by CryptoBilis, which has stopped selling Ledger devices while the investigation continues. Overnight between 13 and 14 Oct Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and take products off the shelves while it establishes who tampered with the devices and where in the distribution chain; confirmed incidents remain limited to Southeast Asia, Ledger has not verified any drain linked to a device bought elsewhere and says it has no indication that its own systems or its direct sales channel were compromised. On 14 Oct, after a report from one person in Germany, the Donjon inspected retail and distributor stock across Germany and found no sign of tampering, and reports that no implant-related losses have been reported anywhere in Europe; the devices shown online in that case have not yet been examined. Ledger has confirmed neither the number of affected users nor the total amount: the figures circulating (onchain analysts' estimates of more than $72M to more than $86M) come from third parties and Ledger says it has not verified them. On 15 Oct Ledger published its official account on its blog: an organized criminal group bought genuine Ledger devices, opened them, fitted hidden components to capture the recovery phrase during setup and put them back into distribution through resellers in Southeast Asia, then drained wallets in a single coordinated operation; according to Ledger there was no flaw in its chip, operating system or servers, and every unit examined from Germany and from warehouses was clean. Announced countermeasures: returned devices can never be resold in any form, Ledger products will no longer go on shelves or displays, sales in Southeast Asia and Hong Kong remain suspended, and product-level measures are being prepared but not yet described. In the 15 Oct post too, Ledger gives neither the number of affected users nor the amount, and announces no reimbursement or compensation.

Who was hit

IDC Frontier (SoftBank group), Japanese cloud provider, and 495 of its business and local-government customers

Latest verified information

On 7 October ransomware encrypted the virtual servers of 495 IDCF Cloud customers, including local governments. For days, public websites such as a prefecture's site and various business services were unreachable. The attacker exploited a flaw in open-source software used for customer-portal login and gained administrator control. The company says no data left customers' servers, but some data cannot be recovered: as of 20 October only 206 customers could retrieve backups. IDC Frontier did not pay or negotiate and is restoring service in three phases.

Who was hit

At least 9 South Korean banks hit or targeted, including Shinhan, KB Kookmin and Hana

Latest verified information

Since late September at least 9 South Korean banks have disclosed attacks or been named as targets by local media. Shinhan Bank said personal data of about 25,000 customers was compromised; KB Kookmin reported 119 customers affected, including card data. CrowdStrike confirms data was exfiltrated from a broker-facing portal and an employee app. The Financial Services Commission launched inspections and police opened a probe; the attacker, likely a financially motivated Chinese speaker, is unidentified.

Who was hit

Denmark's Central Person Register (CPR), breached through the access of small Odense firm Pays ApS

Latest verified information

Someone abused the lawful access of a private company, Pays ApS, to query the national population register. The ministry confirms the theft of names, addresses and CPR numbers (the Danish equivalent of a social security number) of about 8.8 million living, emigrated and deceased people, out of 11 million records. People with name and address protection are not affected. TV 2 reports more than 14 million lookups. Politiken and TV 2 report that the account used the password '123456'. Police and the Danish data protection authority are investigating.

Latest verified information

MetaMask said it is «currently responding to an ongoing security incident affecting part of our infrastructure». The words are from the company's official update (metamask.io/news/user-update, published 30 September 2026 and last modified 1 October at 05:21 UTC), relayed overnight by the verified @MetaMask X account: «We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors. At this time, we have identified no immediate threat to MetaMask wallets. As a precautionary measure, we are proactively exiting affected validators within our non-custodial staking operations». What is known, and what is not: MetaMask has NOT said which infrastructure component was compromised, has NOT disclosed the vector, has NOT said when the intrusion began, and there is no CVE, no vendor advisory and no named supplier. The only concrete action announced is the validator withdrawal: affected validators have begun the exit process and the last ones are expected to have completed the exit — not the full withdrawal — by the end of 7 October 2026. The perimeter, because it is what matters to anyone using the wallet: MetaMask is self-custody, the keys sit on the user's device, and the company states it does not manage withdrawal keys for stake on behalf of clients. What appears to be touched is the company's infrastructure and the staking operation, not the wallet as such. The staking side was confirmed from the other end: Lido acknowledged that MetaMask Staking began «precautionary steps to protect client assets» by exiting validators from the protocol, and developer Will Shannon wrote that ETH exited from MetaMask Staking-operated validators «is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue». For scale: according to Cointelegraph, MetaMask manages over $3 billion in staked ETH. No loss of funds has been declared by any party, which is why `importo_usd` is left empty: the only quantifiable cost cited by the sources is forgone rewards and downtime penalties on the exited validators. The incident was also relayed by @CertiKAlert, which describes a «security incident affecting part of Metamask infrastructure» without adding details of its own. One thing stays open, and it is not a detail: as long as the cause is not public, anyone running the same piece of infrastructure does not know they need to patch. It is the same gap seen in the Bitget case of 24 September, where the investigations spoke of a «Product A» and a «Product B» without ever naming them. **Update of 2 October 2026.** The official page was last modified on **2 October at 01:01:34 UTC** and the language has hardened in a reassuring direction: where it previously read «we have identified no immediate threat to MetaMask wallets», MetaMask now writes that «**there is no indication that MetaMask wallets or customer funds have been affected**». On everything else the statement is **identical to yesterday's**: no cause, no vector, no indication of which systems were touched, no word on any data access, no validator count. The declared perimeter is unchanged: an ongoing incident affecting part of the infrastructure, a precautionary validator exit, remediation in coordination with external partners. The figures circulating in the press in these hours — «17,000 validators» and «$1.4 billion» — **come from neither MetaMask nor Lido** and are not reported here: for the same reason `importo_usd` is left empty, a number the parties have not declared does not go on the card.

Who was hit

Organizations using Citrix NetScaler ADC and Gateway

Latest verified information

Two flaws in NetScaler ADC and Gateway, the appliances many companies use for remote access, allow command execution without a password; CVE-2026-88771 affects even the default configuration. Citrix confirmed attacks before its September 27 fixes; according to Mandiant (Google) they began at least in early September, with web shells disguised as image or stylesheet requests. Over 20,000 NetScaler devices were visible on the internet, and on October 4 a third exploited flaw, CVE-2026-88779, followed.

Who was hit

More than 100 companies in the US, Canada, Australia and Japan, including Deere, SharkNinja and Cummins

Latest verified information

From September 25 the agents tried to breach more than 1,200 online-shop sites and got into more than 100, taking about 23 hours and roughly $50 in AI costs per successful hack (researcher's estimate). The goal was persistent access to shop and payment systems via web shells. Deere said it saw no sign sensitive data was accessed; SharkNinja said a standalone support site was hit and contained; Reuters could not establish how much data was taken.

Latest verified information

The Bank of Italy delivered the report of its January–June 2026 inspection, with a partially unfavourable assessment. Findings cover AML, ICT risk, securitisations, credit processes and governance: the supervisor found the Board was not adequately overseeing strategic decisions on risk. Implementing the findings means up to €215m of adjustments (€157m on the acquired NPL portfolio, €58m on loans; €45m already booked in June 2026) and €200m of reclassifications. The supervisor asked the bank to review its Board composition and to pay dividends only with a buffer of at least 100bp above requirements. It also opened a procedure on additional capital requirements (90 days at most) and two sanctioning proceedings, giving the bank 45 days to file its defence. No fine has been imposed yet.

Latest verified information

The Bank of Italy delivered the report of its January–June 2026 inspection, with a partially unfavourable assessment. Findings cover AML, ICT risk, securitisations, credit processes and governance: the supervisor found the Board was not adequately overseeing strategic decisions on risk. Implementing the findings means up to €215m of adjustments (€157m on the acquired NPL portfolio, €58m on loans; €45m already booked in June 2026) and €200m of reclassifications. The supervisor asked the bank to review its Board composition and to pay dividends only with a buffer of at least 100bp above requirements. It also opened a procedure on additional capital requirements (90 days at most) and two sanctioning proceedings, giving the bank 45 days to file its defence. No fine has been imposed yet.

Who was hit

Australian government: the Medicare statistics portal and 3 other public websites

Latest verified information

On June 18 an agent in training got into the infrastructure behind the Medicare statistics portal and accessed 3 other public sites without authorization, in one case using an exposed key. OpenAI says no individual patient records were taken, but it only notified the government on September 10, via a generic mailbox. Prime Minister Albanese called the delay unacceptable; the portal was closed and an inquiry, including possible criminal liability, is under way. OpenAI apologized on September 29.

Latest verified information

On 24 September 2026 at 18:31 UTC, Bitget's security systems detected unauthorised transfers from some of the exchange's hot wallets. Three hours later, at 21:30 UTC, CEO Gracy Chen published the official notice: funds involved estimated at about 351.6 million dollars, cold wallets declared intact ("Bitget operates a three-tier wallet architecture — the breach affected only portions of the hot and warm layers"), the loss declared covered by the User Protection Fund. Deposits and trading never stopped; withdrawals were suspended as a precaution. THE VECTOR. At 00:43 UTC on 25 September the CEO stated that "the attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data and triggered our authorisation process to move funds out". The transfers, in other words, were signed by the exchange's normal procedure, which saw them as legitimate: that is the difference between a breached signing setup and a deceived one. The company declares private key theft ruled out and, on 26 September, declares the vulnerability "identified and remediated", with the investigation supported by two independent third-party firms, Mandiant and SlowMist. THE FIGURE WENT UP, BUT NOT BECAUSE MORE MONEY WAS STOLEN. On 25 September at 14:03 UTC Bitget revised the total from 351.6 to about 387.5 million dollars, and explained why: "the revised figure reflects a more complete accounting of transfers that occurred during the incident, adding affected assets on Zcash and TRON that were not included in the initial estimate. It does not reflect further unauthorized transfers." The distinction matters and should be read in full: the perimeter counted grew by some 36 million, the attack did not. Confirmed assets are XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt (Tether Gold), BNB, AVAX and TRX, across Ethereum and several EVM networks, the XRP Ledger, Zcash and TRON. It remains true that the 387.5 million is the company's own count, which the company itself says may be updated, and that no third party has certified it. WHAT WE VERIFIED OURSELVES. In the same announcement Bitget did something it was not obliged to do: it published the four primary receiving addresses. We queried them directly on their respective chains on 26 September, and they are practically empty. The EVM address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee holds 0.008793 ETH at block 26,063,794 (identical to what we measured on the 25th: nothing moves through it any more). The XRP address rwNhefsz1UQEusxhCvHip3RANinWi4CTck holds 3.09 XRP at validated ledger 107,254,966, against the roughly 102.9 million XRP the press attributes to the theft. The TRON address TBWNguTTgezw9dVorX441C6nDrZpRxYwKD holds 0.4 TRX and zero USDT-TRC20. On the fourth, the Zcash address t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG, we could not obtain a balance from an open public source, so we say nothing about it. The reading of the first three is clear enough: the funds are not parked where they arrived, they have already moved. That is the data point that supports the "ongoing" label better than any headline. THE BOUNTY. On 25 September Bitget opened a recovery bounty programme: 5% of funds a third party helps to freeze and 5% of funds it helps to recover, up to a theoretical maximum of 10%. Actions carried out under a court order or at the request of law enforcement are excluded, and Bitget decides who qualifies, how each contribution is measured and how much to pay. Read it for what it is: not a guarantee of recovery, but a signal that recovery depends on third parties. THE BOUNTY'S FIRST CONCRETE RESULT, AND WHAT IT IS WORTH. On 25 September at 05:00 UTC Circle blacklisted an address labelled "Bitget Exploiter 8", using the freeze function written into the USDC contract: 99,990 USDC. Tether did the same roughly seven hours later, through its own multisig: 218,023 USDT. About $318,000 frozen in total — which against 387.5 million is 0.08%, less than a tenth of a percentage point. The reason is structural and applies to any theft of this kind: an issuer can freeze only its own token, and the attacker had already converted the rest into ETH, which nobody can block. In that same wallet, according to on-chain trackers, roughly 170 ETH remains out of reach, and other linked addresses hold more than 63,000 ETH. On 26 September at 11:44 UTC the CEO publicly thanked Circle and Tether and raised the pressure on the part of the chain that did not cooperate: she formally asked THORChain, the cross-chain swap protocol, to "refuse service to these addresses", writing that "decentralization is a design principle, not a shield for facilitating known stolen funds". The precedent she cites carries weight: after the $1.46B Bybit theft, on-chain analyses say roughly $1.2B moved through that route. It is a real-time demonstration of what the bounty already implied — recovery does not depend on the victim, it depends on whoever stands between the attacker and the cash-out, and not everyone cooperates. A note on method: none of the sources published the frozen address in full, so we could not verify the freeze on-chain ourselves and the figures are as reported. What we did re-verify ourselves on 26 September is the EVM address Bitget published: 0.008793 ETH at block 26,064,276, identical to the two previous measurements — nothing is moving through it. THORCHAIN'S ANSWER HAS ARRIVED, AND IT IS A REFUSAL. On 26 September at 18:17 UTC — six hours after the request — the protocol replied publicly from its official account and pinned the message to the top of its profile, which makes it a stated position rather than a passing comment: "We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved. THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?" No block, no commitment: the request is turned down with an analogy, and the message names both Bitget's CEO and OKX's founder, who had himself challenged the decentralisation claim. The sequence is worth reading in full, because it is the most useful thing this incident teaches anyone holding money on an exchange: the stablecoin issuers froze within hours, but could only touch 0.08% of the total; the part of the chain that could have touched the rest answered within six hours that it is not its business. What a genuinely permissionless protocol can technically do remains an open debate; what it answered is a fact. Meanwhile trackers indicate the attackers are using not only THORChain but also Chainflip, Uniswap, 1inch Fusion, Stargate, Across and Relay: the laundering is running along several routes at once. WITHDRAWALS: THERE IS A DATE, AND IT IS NOT TODAY. On 26 September at 03:57 UTC Bitget published the phased reopening schedule, stating that "the temporary withdrawal pause remains a security measure and is not related to the availability of user assets": BTC on the Bitcoin network from 28 September at 08:00 UTC; ETH on Ethereum, BSC, Arbitrum, Base and Optimism from 29 September at 08:00 UTC; USDT on Ethereum, BSC, Solana and TRON from 30 September at 08:00 UTC; everything else — other tokens, fiat and P2P — from 2 October at 08:00 UTC. Until then the exit stays shut: an announced schedule is not an executed withdrawal, and this card will record it as reopened only when withdrawals actually work. THE COVERAGE, WITH A DETAIL THAT CHANGES WHAT THE FIGURE MEANS. On 25 September at 03:10 UTC Bitget spelled out the composition of the protection fund: it "holds 5,500 BTC, approximately $464M at current prices", with the addresses declared public and verifiable on-chain by anyone (in the announcement, however, the addresses are not listed and no third party has yet published that verification). The detail that matters is that the fund is denominated in bitcoin, not in dollars: the declared capacity covers the 387.5 million loss about 1.2 times, but that is a ratio that moves with the price of bitcoin — if BTC falls by a fifth, the margin is gone, and through nobody's fault. The company adds that "losses from this hot wallet incident after assessment will be borne by the Protection Fund" and that the fund will be replenished, but that "details and coverage terms will be announced separately": as of this verification, those terms have not been published. ON THE PERPETRATOR. The company said that IP address patterns — traced to VPN services previously used by a North Korean group — and on-chain signatures are consistent with techniques of groups linked to North Korea, specifying itself that the attribution is not confirmed; investigators point to the Lazarus group. Since 25 September a voice other than the victim's has been added: on-chain analytics firm Elliptic considers North Korean origin "very likely" and calculates that with this theft the haul of groups linked to Pyongyang in 2026 passes one billion dollars. It remains an assessment by a private party, not a finding by an authority, and it is written that way here. ONE THING THAT IS NOT TRUE, AND WORTH KNOWING. Bitget Wallet, the self-custody wallet, runs on infrastructure completely separate from the exchange and was not involved: the company states this in three separate communications. Headlines about a "Bitget Wallet breach" confuse the exchange's on-chain wallets with the product called Bitget Wallet: they are two different things, and in the second the keys sit on the user's device. THE MOST IMPORTANT OPEN POINT, AND THE DATE IT HAS JUST BEEN GIVEN. The full technical report the company had promised "within 24 hours" of the first notice never came out: three days on, what has been published are progressive updates — useful, detailed, but not a post-mortem. Still missing is the answer to the question that weighs on any judgement of the company: how was that backend system compromised? On 27 September at 11:00 UTC Bitget announced when it will arrive: an «Incident Report for Users» livestream on 28 September at 07:30 UTC on Bitget X Live and Bitget Live, with chief executive Gracy Chen and Xie Jiayin, to «discuss the incident report, answer questions, and share the latest updates on withdrawals». Two things should be read together, and neither is a detail. First: after three days the report finally has a date. Second: the announced format is a live question-and-answer session, not a written document — and a livestream cannot be quoted, checked line by line, or left on the record the way a post-mortem can. Until a text is published, the point stays open even after the 28th. Then there is where it sits in the calendar: 07:30 UTC on 28 September falls thirty minutes before the 08:00 UTC at which, under the company's own plan, the first withdrawal tranche (BTC) is due to reopen. The livestream therefore lands just before the moment the promise becomes checkable by users. This page will record the reopening only when withdrawals are actually going through, not when they are announced on air. 28 SEPTEMBER, THE FIRST THING ACTUALLY CHECKABLE: BTC WITHDRAWALS RESTARTED. At 08:00 UTC on 28 September the first tranche reopened as announced, and at 08:34 UTC Bitget confirmed it on its official account: the resumption «follows additional security work across Bitget's withdrawal infrastructure», the vulnerability «has been remediated», the incident «remains contained, with no further unauthorized transfers identified following containment», user balances are unaffected. The Block, BleepingComputer, crypto.news, Crypto Times and U.Today reported it the same day. According to figures released by the company and picked up by the press, at 09:00 UTC — one hour after the opening — 9,585 BTC withdrawals had been processed across the Bitcoin and BSC networks, totalling about 4,098 BTC, with a declared reserve ratio of 127%. It is the company's own count, certified by no third party; but the order of magnitude says the queue was cleared, not that a single demonstration withdrawal went through. The rest of the schedule is confirmed: ETH on the 29th, USDT on the 30th, everything else — fiat and P2P included — on 2 October, all at 08:00 UTC. Until then the exit stays shut for anything that is not BTC, which is why this entry is still marked "ongoing". THE LIVESTREAM HAPPENED, AND IT MOVED PART OF THE STORY: THE FLAW WAS NOT IN-HOUSE. At 07:30 UTC Gracy Chen and Xie Jiayin held the announced livestream; the recording, one hour and thirty-two minutes, is published on the exchange's official account as «Incident Recap». The explanation given is more precise than that of the previous days and moves the point of entry: the attacker exploited «a vulnerability in a third-party security product» used by Bitget to obtain high-level internal credentials, and used them to send forged withdrawal commands to the wallet system, making it execute abnormal transfers that bypassed risk controls. Private keys were not compromised, cold wallets were not touched. The clarification has to be read in both directions at once, because they pull opposite ways: it was not Bitget's own code that gave way first — but it was a security tool chosen, bought and deployed by Bitget that became the way in, which is a question of how a supplier is picked and watched, not a stroke of bad luck. The company said it will review how it assesses and deploys third-party security products. The supplier was not named. THE FUND'S NUMBERS, STATED ON AIR. Chen put the User Protection Fund at more than 464 million dollars at the time of the suspension — about 5,500 BTC, according to The Block's and BleepingComputer's account —, put platform holdings at over 1.4 billion dollars, and committed to bringing the fund back to its 300 million dollar baseline within a week. These are figures stated by the company on a livestream, not audited accounts nor a proof-of-reserves attestation: they are the promise the loss coverage rests on, and the proof will be the next attestation, not the announcement. THE WRITTEN REPORT IS STILL MISSING. What this page said before the livestream still holds: a livestream is not a post-mortem — it cannot be quoted line by line, checked, or left on the record. The company now states that the internal security report will be completed «this week»: it is the third deadline given to the same document, after the «24 hours» promised on 24 September and the 28 September livestream. Until a public text exists, how that third-party product was compromised remains an unanswered question, and with it any judgement on how avoidable this was. ON THE HUNT FOR THE FUNDS, AN UPDATE THAT IS NOT A RECOVERY. On 28 September independent investigator ZachXBT wrote that Chinese actors are laundering the exploit's funds on behalf of the «alleged DPRK attackers», openly asking for support with their orders in public Discord servers and Telegram channels of the services they use. It is an indication of who is moving the money, not a recovery: nothing has come back, and the North Korea attribution remains an assessment by private parties, not a finding by an authority. 29 SEPTEMBER, SECOND TRANCHE MET: ETH WITHDRAWALS ARE BACK TOO. At 08:00 UTC on 29 September ETH withdrawals reopened, as scheduled. Bitget confirmed it on its official account with its own figures: at 09:00 UTC, one hour after opening, about 9,674 ETH had come in and about 9,023 had gone out — more deposits than withdrawals, a net inflow of about 651 ETH. In the same message the company also confirmed that the previous day's reopening covered BTC on the Bitcoin and BSC networks. These are the company's figures, not checked by third parties; what they say with certainty is only that the second tranche too opened at the promised hour. Still to come: USDT on 30 September and everything else — fiat and P2P included — on 2 October. TWO MORE DETAILS ON THE HOW, FROM THE CEO. In the livestream, in an interview with The Block and in comments to Cointelegraph (reported by The Hacker News on 28 September), Gracy Chen described the flaw in the third-party product as a zero-day, meaning a vulnerability not yet known to or fixed by its maker at the time of the attack. She also laid out the sequence: at 18:31 UTC on 24 September the attacker made two small test transfers that stayed below the risk-control threshold and so triggered no alert; the large transfers started about thirty minutes later. It is a detail that matters: it means that for half an hour the system saw anomalous movements and let them through because they were small. The maker of the compromised product remains unnamed, and the written report has still not come out: for the evening of the 29th the company announced a second livestream with the CEO, not a document. THE EVENING OF 29 SEPTEMBER: THE PROTECTION FUND HAS HALVED, AND CUSTOMERS LEFT IN NUMBERS. This is the most important development since withdrawals reopened, and it did not come from the exchange. On 29 September Bloomberg measured roughly 463 million dollars of net outflows in the 24 hours to Tuesday: the largest single-day net outflow since DefiLlama began tracking exchange proof-of-reserves four years ago. Against remaining reserves of about 5.7 billion dollars, that is more than 10% in one day. Above all: the three addresses Bitget itself identifies as its protection fund, worth about 464 million dollars (5,500 BTC) on 25 September, have fallen BELOW 200 million according to Bloomberg's on-chain reading. Here is the comparison that matters: the fund underpinning the whole "the loss is covered" reassurance is now worth less than half the declared loss (387.5 million). Gracy Chen confirmed it to Bloomberg in her own words: "The Protection Fund is being used to absorb the financial impact of the incident. Bitget will replenish the Fund using its own capital, with the Fund targeted to be above 300 million dollars within one week." That is a dated promise, and therefore a checkable one: the addresses are public and anyone can look at them in a week's time. Until the balance climbs back, it stays a promise. THE 29 SEPTEMBER PROOF OF RESERVES, READ BY US ON THE OFFICIAL PAGE. The same day the company published a new proof-of-reserves attestation and announced it on its official account with an overall ratio of 131% across 19 assets, all above 100%. We went and read the page: snapshot of 29 September 2026 at 11:00 UTC+8 (03:00 UTC), Merkle root 15893cf0dae1c552. The per-asset ratios say more than the total: BTC 142%, USDC 154%, NEAR 181%, USDGO 169%, LINK 137%, LTC 131% — but ETH 110% and USDT 107%. The thinnest margins sit on exactly the two most-used assets, and USDT is the one reopening on 30 September. Two necessary caveats. First, the snapshot is from 03:00 UTC on the 29th: it predates the reopening of ETH withdrawals (08:00 UTC) and predates the 463-million outflow day, so it does not capture either. Second, a reserve ratio above 100% says the platform's holdings covered user balances at the moment of the snapshot; it does not say the loss has been made good. The loss is covered by the fund, and it is the fund that has halved. For reference, the previous attestation (issue 46, snapshot of 17 September, before the incident) showed 135%. The CEO commented: "We have never touched customer funds — which is why, even after this incident, our reserve ratio remains above 131%." A THIRD LIVESTREAM IN SIX DAYS, AND STILL NO DOCUMENT. The second livestream announced for the evening of the 29th did take place (the replay is on the official account). That makes three broadcasts since 25 September. The written report — promised "within 24 hours" on the 24th, then pushed to the 28 September livestream, then to "within this week" — still did not exist as of the evening of the 29th. One detail on figures that look contradictory and are not: Bitget reports a net POSITIVE balance on ETH in the first hour after reopening (about 9,674 in against 9,023 out at 09:00 UTC), while DefiLlama counts 463 million in net outflows. The first is one asset in one hour, measured by the company; the second is the whole platform over 24 hours, measured from outside. Choosing which one to quote is also choosing what to show. 30 SEPTEMBER: THE THIRD TRANCHE REOPENED, AND IT IS THE ONE THAT MATTERS MOST. At 08:00 UTC on 30 September USDT withdrawals restarted on Ethereum, BNB Smart Chain, Solana and Tron, as per the schedule the company published on 24 September (official support page, updated on the 24th at 23:30 UTC). The reopening was confirmed the same day by crypto.news and Crypto Times. It is the third tranche out of four met at the announced date and time, after BTC on the 28th and ETH on the 29th, and it is the most significant of the three: USDT is the asset with the thinnest reserve ratio in the 29 September attestation (107%) and the one holding most of the frozen balances. The last tranche is still shut — all other tokens, fiat and P2P — announced for 2 October at 08:00 UTC: until it opens, this entry stays marked «ongoing». CEO Gracy Chen said that «the business is gradually back to usual». THE PROTECTION FUND IS BACK UP: 309 MILLION, READ BY US ON THE OFFICIAL PAGE. On 28 September the company committed to bringing the fund «to more than 300 million dollars with company capital within the week». On 30 September the CEO posted a screenshot of the fund's public page showing a balance of 309 million dollars, or 3,705 BTC. We did not stop at the screenshot: we went and read the official fund page (bitget.com/promotion/protection-fund) at 11:30 UTC on 30 September and it states exactly «The fund is currently valued at $309M», 3,705 BTC. The dated commitment was therefore met, in two days rather than a week. Three caveats remain, and they change what the number means. First: that page is the company's own, and it values the fund at the bitcoin entry price set at 00:00 UTC each day — it is a more direct reading than a screenshot, not an on-chain verification by us, and the dollar balance moves with the BTC price. Second: 309 million is still below the 387.5 million declared loss, and below the 464 million (5,500 BTC) the fund was worth before the incident. Third: the top-up was made with company capital, not with funds recovered from the attacker — we checked the receiving addresses ourselves on the 26th and they are empty. Covering the loss therefore still depends on the company's balance sheet, and the terms under which an individual user can claim against the fund have still not been published. SIX DAYS, THREE LIVESTREAMS, NO DOCUMENT. The written report on the incident — promised «within 24 hours» on 24 September, then postponed to the 28 September livestream, then to «within this week» — had still not been published on the morning of 30 September, and the company kept announcing it without giving a date. The findings of the two independent investigations, however, landed the same day: the paragraph below records them. 30 SEPTEMBER, AFTERNOON: THE TWO INDEPENDENT INVESTIGATIONS HAVE REPORTED, AND THEY PUSH THE START OF THE ATTACK BACK TO 31 AUGUST. This is the first third-party document on the incident, after six days of livestreams only. Bitget published the interim findings of the two firms it appointed — Mandiant (Google Cloud's cyber-defence arm) and SlowMist — and folded them into its own official incident page, updated on 30 September; the news was picked up the same day by BleepingComputer, The Hacker News and Crypto Times. What they say: the attacker got in by compromising TWO third-party security products in use at the exchange, in at least one case through a zero-day; deployed a web shell on one of the appliances and opened a command-and-control channel; from there moved laterally to the production server that runs wallet jobs, where it installed malicious packages and ran a custom-built withdrawal tool that forged the risk-control parameters and then invoked the wallet's normal withdrawal process. Private keys not compromised, cold wallets untouched. In substance it confirms what the company said on the livestream of the 28th; the difference is that two third parties now say it under their own names, with a timeline. THE NEW FACT, AND IT MATTERS: THE ATTACKER HAD BEEN INSIDE FOR TWENTY-FIVE DAYS. The earliest malicious activity found in the available logs dates to 31 August 2026: a service running on one of the two appliances — SlowMist calls it «Product A» — hit by the zero-day, a hidden script started under that service's process, and a connection to the database. Further activity matching the same pattern appears between 23 and 25 September. That means almost four weeks passed between first access and the money moving, and nothing rang. The exchange noticed the intrusion only once funds started leaving: the reconciliation system flagged the first discrepancies at 19:05 UTC on 24 September, thirty-four minutes after the two test transfers that stayed below the alert thresholds. At 21:44 UTC Bitget halted its signing machines and isolated the withdrawal service; the root cause was identified at 08:43 UTC on the 25th. The theft window itself lasted about two hours and fifty-two minutes, with one wave of roughly 185 million dollars moved in little more than a minute around 19:16 UTC (Crypto Times reconstruction from SlowMist data). THE HOLE THAT STAYS OPEN, AND IT IS NOT BITGET'S. Neither SlowMist nor Mandiant names the vendor or the products: SlowMist calls them «Product A» and «Product B». There is no public CVE, no vendor advisory, no list of affected versions. The consequence concerns anyone keeping money on a platform, not just on this one: any other exchange or custodian running the same appliance cannot patch a flaw whose name and version it does not know. This is not a procedural detail — it is the difference between a closed incident and a vector still open across the rest of the industry. THE DISTINCTION WORTH KEEPING, BECAUSE IT IS EASY TO LOSE. What came out on 30 September are the conclusions of two outside firms, which both describe them as INTERIM and still ongoing. It is not Bitget's own internal report, which still does not exist: the company announced it for the fourth time, «within this week», in a message from its official account on 28 September — the same one in which it published the attacker addresses and tracing data, and in which it writes that «the September 24 incident is the first security incident of this nature affecting Bitget Exchange in eight years of operation». The two do not substitute for each other: the investigations say how the attacker got in, the company's report should say why that appliance was exposed and what changes from tomorrow. The first question has an answer, the second does not. WHERE WITHDRAWALS AND THE FUND STAND ON THE EVENING OF 30 SEPTEMBER. During the afternoon the CEO summed up on her own account: protection fund brought back «above 300 million as promised» (309 million on the official page, which we read at 11:30 UTC), reserve ratio at 131% per the 29 September attestation, withdrawals «already resumed for BTC, ETH and USDT» and everything else «on Friday» — which is 2 October, the same date as the official schedule. The exchange's account confirmed the fund's top-up above 300 million the same day. Three tranches out of four met; the fourth, which covers fiat and P2P, is the only thing users cannot yet verify for themselves, and that is why this entry stays marked «ongoing». HOW MUCH HAS BEEN RECOVERED: 0.22%. According to the reconstruction published on 30 September by rekt.news, the total publicly frozen is about 842,000 dollars — roughly 339,000 in stablecoins between Circle and Tether and about 503,000 stopped mid-execution by the NEAR Intents service — out of a 387.5 million loss: 0.22%. These are reported figures we could not verify on-chain ourselves (no source has published the frozen addresses in full); what we did verify, on 26 September, are the destination addresses published by Bitget, and they are empty. The CEO herself said she is not «very optimistic» about recovery, citing the Bybit precedent: a year after that theft about 3.5% had come back. It works as a realistic measure of what protects a balance on an exchange after an attack of this kind: not the hunt for the funds, but the company's balance sheet. THE CONTEXT, AND IT IS NOT COLOUR. On 30 September CertiK closed the month's books: September 2026 is the worst month of the year, about 766.4 million dollars lost to exploits and phishing and the highest incident count recorded in 2026. Two cases alone — Bitget's 387.5 million and the 318.7 million taken from Blockstream's Liquid Network on 6 September — account for more than 92% of the month's confirmed losses. On attribution nothing changes: the CEO keeps pointing to North Korea on the basis of IP address patterns and on-chain analysis, and TRM Labs reports overlaps between the laundering network and wallets used in earlier Pyongyang-linked attacks, but states that it has NOT definitively attributed the intrusion. These remain assessments by private firms, not findings by any authority. 2 OCTOBER: THE ANNOUNCED HOUR PASSES IN SILENCE. The fourth and final withdrawal tranche — other tokens, fiat and P2P — was set by the company for 2 October at 08:00 UTC. At 17:30 UTC the same day, twelve hours later, there is no confirmation that it happened, and we checked the primary sources one by one. The official incident page, the source for this entry, is still dated 30 September and still says, in the future tense, that those withdrawals are «scheduled to resume on 2 October at 08:00 UTC». The exchange's account posted four times in the hours after that time — the bitcoin price, the rewards programme launched after the attack, an institutional event, a USDC yield offer — without ever saying the exit was open. The support account has not posted since 2023. One outlet wrote that the company «completed the restoration of withdrawals» on 2 October, but without specifying which assets and in contradiction with the company's own page: that is not enough, and writing «reopened» on the strength of an announced hour would be writing a fact nobody has established. That is the difference between the first three tranches and the fourth: BTC on the 28th, ETH on the 29th and USDT on the 30th were announced and then observed at the stated date and hour, each with its own press coverage. Not this one. So the entry stays marked «ongoing» and the recommendation still says to try a small amount first. THE FROZEN TOTAL NOW HAS A FIGURE, AND IT IS STILL CRUMBS: 1.1 MILLION OUT OF 387.5. On 2 October CEO Gracy Chen spoke to CNBC. She said the company has frozen about 1.1 million dollars of the nearly 388 million stolen: 0.28%. It is the first figure on the frozen amount attributable to the company — until yesterday the public number was about 842,000 dollars, 0.22%, and it came from a rekt.news reconstruction, not from Bitget. On recovery she repeated that she is not optimistic and explained why using the precedent she knows best: Bybit, after the 1.5 billion dollar ether theft of February 2025, had a year later frozen and recovered some 80 million in all, 3.5% of what it lost. ⚠️ The CNBC article does not open from Europe (403 both to fetch and in the browser): we verified the statements on two outlets that cite the interview and do open, in agreement on the frozen figure, on the CEO's words and on the protection fund above 300 million rebuilt with company capital. The practical measure for anyone with money in there does not change, it sharpens: what protects a balance after an attack of this size is not the hunt for the funds, it is the balance sheet of whoever runs the exchange. 3 OCTOBER, MORE THAN EIGHTEEN HOURS ON: THE SILENCE HAS BECOME THE FACT. We re-read the same sources at 02:30 UTC on 3 October. The official incident page is still dated 30 September and still says, in the future tense, that other tokens, fiat and P2P are «scheduled to resume» on 2 October at 08:00 UTC: it has not been touched. The exchange's account, after the four posts in the hours following the announced time, stopped posting around the middle of the afternoon on the 2nd and has never mentioned withdrawals. In eighteen hours no outlet writes that the fourth tranche is open: they all still report the date as a schedule. So it is no longer merely «the announced hour was not confirmed»: more than eighteen hours on, with the official page untouched, the silence is itself the verified fact. It does not mean withdrawals are certainly still blocked; it means the only way to find out is to try, and that anyone holding funds there has no statement to rely on. That is why «ongoing» and «unresolved» stay. 3 OCTOBER AT MIDDAY, PAST THE TWENTY-FOUR-HOUR MARK: THE ACCOUNT SPEAKS AGAIN, BUT NOT ABOUT WITHDRAWALS. Third re-reading of the same page, at 11:45 UTC on 3 October: unchanged. Still «Updated: September 30, 2026», and in the section answering «Have Bitget withdrawals resumed?» only BTC and ETH are named as open, while USDT from 30 September and the whole 2 October tranche remain in the «scheduled to resume» column. We are more than twenty-seven hours past the announced time, and therefore past the twenty-four hours we had set as the limit for treating this silence as a delay. What has changed since the reading nine hours earlier is the exchange's account: it is no longer quiet. It has started posting again — an institutional event announced for 5 October and a programme with yields advertised up to 12% on stablecoins — and neither post mentions withdrawals. That does not prove the exit is closed, but it removes the only excuse the silence had: this is not a company that stopped communicating, it is a company communicating something else. In twenty-seven hours no outlet writes that the fourth tranche is open: they all still report the date as a schedule. «Ongoing» and «unresolved» stay, and that is why. WHO FROZE THAT MONEY: NOT BITGET. There is one more detail on the 1.1 million frozen that changes what the figure means. According to The Hacker News, on 1 October, the roughly 1.1 million dollars were frozen by Circle, Tether and NEAR Intents — that is, by the stablecoin issuers and by a third-party service the laundering passed through, not by the exchange and not by an authority. It is the practical confirmation of what the CEO says in words: after an attack of this size, what gets recovered is not recovered by the victim, it is frozen by whoever has the technical power to freeze a centralised token. Anything that leaves in bitcoin, in ether or on a network with no issuer has nobody who can stop it. 4 OCTOBER: THE FOURTH TRANCHE IS SHOWN AS OPEN, AND IT IS THE COMPANY SAYING SO. At 12:10 UTC on 4 October we re-opened the primary sources in the browser (on those pages a command-line fetch returns only the JavaScript shell). The explainer page dated «30 September» is still there, unchanged, and still puts the last tranche in the future tense: stop at that one and the silence looks like it is still running. But the company keeps a second page, dedicated to the incident and continuously updated, which reads «Last updated: 2026-10-04 00:00 UTC» and says the opposite in two separate places. In the timeline of confirmed facts the «2026-10-02 · 08:00 UTC» entry is in the past tense: «withdrawals for other cryptocurrencies, fiat currencies and P2P have gradually resumed». And in the resumption status table all four tranches — BTC on the 28th, ETH on the 29th, USDT on the 30th, and other tokens, fiat and P2P on 2 October — are marked «Resumed». The question left open for two days closes here, and it closes on a first-tier source: the company states it, on its own page, with a date. Two things need saying about how it closed. First: the confirmation came as a silent page update, not as an announcement — BTC, ETH and USDT each got a dedicated notice, the fourth tranche did not, the exchange's account has never mentioned it, and to date no outlet reports the exit as open: all of them still report 2 October as a schedule. Second: the word the company chose is «gradually». The reopening is therefore a declared fact, not a switch, and anyone holding a thinly traded token may still find the exit shut. One signal not to misread, because it is easy to: the support centre is currently publishing suspension and resumption notices on individual tokens (PARTI on Base, ATOM, STX, PONS, LAB, SKYAI, 0X0, and a fresh suspension of GMT on Solana on 4 October), but all of them give «wallet maintenance» as the reason and come in suspend-then-resume pairs: that is the ordinary traffic of any exchange, not the tail of the post-attack reopening, and counting it as such would be wrong in both directions. WHAT THE SAME PAGE UPDATES, AND WHAT IS STILL MISSING. The protection fund is stated at over 314 million dollars, 3,705 BTC, with a total reserve ratio of 127%: more than the 309 million we read on 30 September, still below the 387.5 million declared loss and far from the 464 million it held before the attack — and still company capital, not recovered funds. The 388 million figure is now presented as «final verified», across 12 hot and warm wallet addresses. The written technical report — promised «within 24 hours» on 24 September, then pushed from livestream to livestream — is still billed as «coming soon»: ten days, four broadcasts, no company document. Hence what changes on this entry: «ongoing» switches off, because the withdrawal freeze was the last thing still happening to users and the company states it is over; «unresolved» stays, and stays for the 387.5 million never recovered, for the report that does not exist, and for a loss coverage that is so far a statement.

Latest verified information

On 24 September 2026 at 04:21 UTC, Payy's bridge contract on Ethereum was emptied. The company confirmed it the same day at 16:04 CEST: "Payy's bridge contract on Ethereum was exploited and drained of its full balance", with the investigation ongoing and "all Payy Network transactions paused including deposits, withdrawals, transfers and card transactions". In the hours that followed, Payy added that it had notified law enforcement and was working with multiple incident response organisations, that attacker addresses had been shared with law enforcement, exchanges and blockchain analytics firms, and that Payy Wallet functionality had also been paused, with guidance for users to follow later. We verified the facts directly on-chain rather than from summaries: in Ethereum block 26044909, timestamp 2026-09-24T04:21:23Z, a single successful transaction moved 1,832,149.468132 USDC out of contract 0x367c1eaF14AA06b78ce76bd0243297de79d85270, of which 1,828,589.378132 in one transfer to address 0xaa4985dbdabfaca344237d40f7e06c4a0bb57e70; the other eleven movements in the same transaction are small, from 1 to 3,039 USDC, and in size and shape look like ordinary user withdrawals caught in the same batch. The contract's residual balance is 700.752696 USDC and was unchanged as of 19:35 CEST on 24 September: nothing has come back. According to press reports the attack went through a malicious transaction on the verifyRollup function, and the funds were routed through the Railgun privacy protocol and swapped into roughly 683 ETH spread across several addresses — a reconstruction by analytics firm Specter Investigation, not confirmed by the company. Press estimates range between 1.83 and 1.92 million dollars; we report the figure we were able to verify on-chain ourselves. Payy is non-custodial and built on zero-knowledge proofs — keys stay on the user's device — but the USDC backing the Visa card sat in that contract. So far the company has not said how many user balances are affected, whether and how they will be reimbursed, or when the service will be restored.

Latest verified information

According to the official notice from Baanx US Corp, dated 30 October 2026 and filed with the California Attorney General, unknown parties accessed personal data of some US customers of the Crypto Life card programme between 23 and 28 September 2026 and again on or about 17 October 2026. The weak point was on Baanx's side, in two places: a third-party service provider's access and an internal administrative system. The data potentially exposed includes first and last name, date of birth, address, phone number, email address, transaction history, password (hashed), multi-factor authentication token (encrypted) and Social Security number, where provided. Baanx says the access has been contained and that, based on the investigation so far, there is no evidence that customer funds were accessed; it reset passwords and two-factor authentication on the affected accounts and is offering 24 months of free credit monitoring and identity protection through Experian. The number of affected customers has not been disclosed. The notice covers only the Crypto Life programme in the United States: it does not name other card programmes built on Baanx infrastructure, nor European or UK customers.

Who was hit

At least 27 companies, mostly online retailers, plus more than 100 other websites

Latest verified information

Gambit counted at least 27 breached companies, including a major US airline and a Fortune 500 hospitality group, and more than 600,000 valid cards stolen from 2 of them (79% US-issued). Skimmers were confirmed at 19 victims and found on 100+ other sites; in one case an agent dropped 180 database tables, backups included. The attacker spent about $25 per target; Gambit alerted victims and, with Shadowserver, helped take down the infrastructure.

Who was hit

Unpatched WordPress sites

Latest verified information

A flaw in WordPress core, from 4.7 to 7.1.1, lets an unauthenticated attacker make a site load a PHP file outside the theme and, if theme and server meet certain conditions, run code. The first attacks came on September 22, hours after the fix, using the pearcmd.php file to write files to the server; there is no count of compromised sites. On November 3 CISA also listed as exploited a second core flaw (CVE-2026-119977) in the update process, fixed on October 28 in 7.1.4.

Who was hit

DIVD, the Dutch volunteer cybersecurity institute, and other users of Zammad

Latest verified information

On September 21 the attacker got into DIVD's Zammad ticketing system using two zero-days: one allows remote code execution, the other root access. DIVD got an alert within 19 minutes but completed containment about 28 hours later; data was compromised and possibly exfiltrated. The Dutch NCSC reported active exploitation of both flaws; Zammad fixed them in versions 7.2 and 7.2.2.

Who was hit

123 Reg, one of the UK's main domain registrars and hosting providers (GoDaddy group)

Latest verified information

On 18 September an intruder read, and possibly copied, customer data: name, phone, country, language and currency preferences, account creation date, products, marketing consents and company VAT numbers. Passwords and payment data are not in the list of exposed data. The company has not said how many customers are affected. It notified police, the US FTC and UK and EU data protection authorities.

Latest verified information

On 16 Sep 2026 IoTrust (D'CENT) disclosed that it had detected unauthorized asset transfers from the D'CENT App Wallet, the in-app software wallet, and urged users to move their funds immediately. The official 17 Sep report lists the exposure criteria: a recovery phrase entered or restored into the App Wallet, an address with signing history (sends, token approvals, dApp transactions), and signing performed on an app version below 8.1.0 (released 5 Nov 2025), across Bitcoin, Ethereum, XRPL, TRON, EVM networks and others. The first unauthorized transactions were observed on Android, but D'CENT states the same exposure applies to iOS. The company has NOT published the technical root cause ("it could be used in identical or similar attacks") nor a total loss figure. Third-party on-chain analyses, unconfirmed by the company, size the XRPL leg alone: an automated sweep of 1,552 accounts for 2,009,321 XRP between 16:29 and 18:34 UTC on 15 Sep, and a later estimate by the XRPL intel account of roughly 6,160 addresses involved for about 9.3 million XRP in total, of which 2 million are still in monitored wallets and 7 million have been moved to unknown destinations (reported on 20 Sep by a single outlet, unconfirmed by the company and not consistent with the 2,009,321 XRP reconstructed on-chain: read it as an estimate, not as the total damage; and it is denominated in XRP, not dollars). Korean law enforcement has taken on the case; D'CENT is tracing funds with an external security firm and asking exchanges and projects to freeze them. ⚠️ Hardware wallets connected to the app are NOT affected — the key never leaves the device — BUT if a hardware wallet's recovery phrase was ever entered or restored into the App Wallet, the same risk applies. As of 21 Sep the company is still publicly asking people to spread the warning to "prevent further damage": exposed keys stay compromised until the funds are moved. Update of 24 Sep: a later reconstruction by the analytics platform XRPL.to, picked up by the trade press, puts the XRPL leg alone at roughly 11.75 million XRP taken from 6,678 accounts across six separate waves between 15 and 20 September — around 18.7 million dollars at the rate used by the source (1.59 $ per XRP). It is the broadest estimate so far and supersedes the earlier ones, but it remains a third-party reconstruction: the company has not confirmed it, has published no total of its own, and has announced no reimbursement. Update of 30 Sep — the company has spoken again and the figures have grown. On 26 Sep IoTrust published its first substantive statement since the 17 Sep report (x.com/DCENTWALLETS/status/2103692076219322824, 05:44): it says it has "not identified evidence indicating that the incident originated from DCENT hardware wallets" — the warning still stands for anyone who ever entered or restored a hardware device's recovery phrase into the App Wallet — and that it is cooperating with law enforcement, external security specialists, blockchain projects and exchanges to trace the assets. On reimbursement and recovery the official wording is blunt and should be read literally: "any freezing or recovery of assets depends entirely on the relevant authorities and third parties and cannot be guaranteed." No compensation plan, neither on 26 Sep nor in the official FAQ, which only asks users to update the app to version 10.0.0 or later and repeats that DCENT will never ask anyone to send assets for a "recovery" or a "compensation". On the figures, a broader reconstruction picked up on 28 Sep by Protos and Crypto Briefing puts the XRPL leg alone at roughly 12.4 million XRP taken from 7,393 accounts across a ten-day window, 15 to 25 September — no longer six waves ending on the 20th. It supersedes the earlier estimate (11.7 million from 6,678 accounts between 15 and 20 Sep) and adds the figure that matters most: a further 640,370 XRP was taken AFTER the public appeal of 21 September, that is, after users had been warned. The first wave on 15 Sep emptied 1,682 accounts for 3.6 million XRP in under three hours, starting by hand on the larger balances and then switching to scripts to work down to the smaller ones; 6,095 accounts are recorded as deleted. Of the proceeds, about 6.3 million XRP — just over half — was swapped into ether through THORChain, a cross-chain swap protocol that requires no identification, and routed onward to centralised exchanges including Binance; as of 25 Sep roughly 1.4 million XRP remained on the attacker's addresses. In dollars the sources give between 18 and 20 million at differing rates: the amount is deliberately left undeclared on this card, because those figures cover the XRPL leg only, depend on the rate chosen, and the company has never published a total of its own. And this is no longer an XRPL-only event. The perimeter the company declared covered Bitcoin, Ethereum, XRPL, TRON and EVM networks, and verified losses outside XRPL now exist: IoTrust has disclosed that it received at least 110 reports of abnormal transfers involving non-XRP assets (as of 18 Sep, reported by ZDNet Korea), and the press documents confirmed losses on Bitcoin and at least one case on Stellar. No per-chain breakdown has been published: the size of the damage outside XRPL is quantified by no one, and that is the biggest remaining gap. The technical root cause has not been disclosed, by the company's stated choice; some researchers point to weak randomness in key generation in older app versions, a hypothesis IoTrust has not confirmed. The traced waves now run to 25 September and the exposed keys remain compromised: anyone who has not yet rotated their recovery phrase can be swept at any moment, which is why this incident is still flagged as active.

Latest verified information

On 11 September 2026, at around 07:20 UTC, an attacker drained 11 wallets by abusing AtomicQueue, an old withdrawal queue built by Veda and no longer in use. The flaw was a missing check: the solve() function never verified that the caller was actually the "solver" it had been handed. The attacker therefore crafted a request via updateAtomicRequest() naming the VICTIM as the solver; the contract then called finishSolve on the victim's address and executed a transferFrom, drawing on the ERC-20 approval that victim had granted the contract long before and never revoked. Haul: 14.4455 liquidETH from 9 addresses plus roughly 7.05 USDC from 2 more, totalling 15.4536 ETH (about 38,000 dollars); a single address lost 12.37 liquidETH, 86% of the total. The technical detail that explains who was hit and who was not: all 11 victims were smart wallets — 7 addresses upgraded via EIP-7702 and 3 Coinbase Smart Wallets — because the attack required the victim's address to contain executable code; ordinary un-upgraded addresses made the call fail and were left untouched. Within about 8 minutes the attacker deposited 15.5 ETH into Tornado Cash across 11 separate transactions, which makes recovery unlikely. The first public alert came from ExVul at 07:51 UTC, followed by SlowMist, which states it notified the team privately before disclosure. CEO Mike Silagadze confirmed the incident in replies to the ExVul and SlowMist threads: he called AtomicQueue an old Veda contract approved by a small number of users, said the issue had been resolved and that affected users would be reimbursed. WHAT IS NOT KNOWN, and it matters: ether.fi has published no formal post-mortem. The official blog stops at 13 August 2026 and the @ether_fi account has posted nothing about the attack — on 12 September it was running a promotion. The reimbursement was announced in words, but there is no public, verifiable proof that it was carried out: that is why this entry stays open. eETH, weETH, the LiquidityPool and current Liquid vault accounting do not appear to have been compromised, and no source reports any effect on the ether.fi Cash card, which does not route through this contract.

Latest verified information

This was not an intrusion: Revolut handed the data over itself, believing it was answering a government agency. A fraudulent information request came from an unauthorised account using the REAL email domain of a government agency — not a lookalike, the authentic one — and therefore passed sender authentication checks. In the notice sent to customers the company writes that it fulfilled the request «under the reasonable belief that it was an authentic government agency request». According to Revolut's notice, made public on 11 September 2026 by investigator ZachXBT who shared a copy, the data handed over includes: full name, date of birth, occupation, postal address, email and phone number; copies of identity documents (passport or driving licence) and the verification selfies submitted at onboarding; and on the financial side IBANs, account status and opening date, Bitcoin wallet reference numbers appearing in account statements, withdrawal records and the complete transaction history, including Bitcoin transfers. Revolut specifies that biometric facial telemetry data — distinct from the selfie images, which did leak — was not part of the disclosure. On 12 September 2026 a spokesperson publicly confirmed the episode to TechCrunch, calling it «a sophisticated external impersonation scam», and stated that «Revolut systems and customer funds are unaffected»: there were no account takeovers and no withdrawals. The company blocked the email address, alerted the government agency involved, law enforcement and financial regulators, and notified affected customers directly. WHAT WAS NOT KNOWN on 12 September, and it mattered: Revolut said a «limited» number of customers was affected but refused to give the figure or say which markets (see the 15 September update at the end); it does not name the impersonated agency; and it does not explain how a third party came to use its official domain. ZachXBT notes the number of accounts appears contained but that the attack seems aimed at high-net-worth individuals. The date on which the data was actually handed over is not known: the date recorded here is that of the notification emails received by customers. UPDATE 14-15 September 2026 — THE DATA IS NOW BEING PUBLISHED, NOT MERELY HELD. Accounts claiming to be behind the attack have opened a public extortion campaign across several Telegram groups. The Register, which saw those posts directly, reports that they contain snippets of data apparently belonging to high-profile individuals — chief executives, professional sportspeople, performing artists — and that the posters are threatening to release «more and more data every day until Revolut pays for leaking their customers», demanding a ransom of 10,000 bitcoin (over USD 780 million at 14 September 2026 prices). Recorded Future News reports the same demand and adds two elements: a customer whose data was circulated as proof did not dispute its authenticity, and among those publicly saying they were affected is Mark Karpelès, former chief executive of Mt. Gox. The Telegram account was subsequently suspended. Revolut, approached by both outlets, declined to comment on the existence of the ransom demand. BE CLEAR ON WHAT IS PROVEN AND WHAT IS NOT: that the extortion campaign exists and that excerpts of the data are circulating is documented by two independent outlets that saw the posts first-hand; that whoever is publishing them is genuinely the party that took the data remains THEIR claim, not an established fact, and no authority has confirmed it. A further UNCONFIRMED indication, which we report because it bears directly on readers in Italy: again according to Recorded Future News, the images circulated by that account suggest the fraudulent email originated from an ITALIAN domain. Italian authorities approached by the outlet did not respond, Revolut still does not name the agency, and the outlet itself states that not all details contained in the posts could be verified: this is an indication, not a finding. Sources close to the company tell The Register that the share of customers affected is small and that ongoing investigations and confidentiality obligations prevent it from saying more. It is not known whether the same compromised domain was used against other financial firms. UPDATE 15 September 2026 — THE FIGURE ARRIVES, AND THE REGULATORS SPEAK. The Financial Times, picked up by Reuters and by subsequent coverage, puts a number on the episode for the first time: 680 customers were affected, and Revolut has contacted all of them directly. The figure does not come from a company statement — Revolut had consistently refused to give one — but from press reporting: the company has neither denied nor publicly confirmed it. On the markets involved, something is finally visible: Irish public broadcaster RTÉ reports that 12 of the 680 are in Ireland, out of roughly 3.4 million Revolut customers in the country — a sign that the individuals were picked one by one, not lifted from an entire market. For Italy there is still no figure. On the authorities' side, silent until 14 September, there are now two public statements, and they should be read for what they actually say: the UK's ICO, the data protection regulator, states «we can confirm we have received a report and are assessing the information provided» — that is a preliminary assessment, NOT the formal opening of an investigation, and several outlets have wrongly reported it as one; the FCA, the UK financial regulator, says it is «aware of the reported incident involving Revolut» and is «engaging with the firm to understand the impact». Neither has announced any enforcement step. Meanwhile the extortion has not stopped: the group claiming the attack calls itself «Revolut Smilik» and has confirmed it wants a payment, repeating that it will publish «more and more data every day» until one arrives. Revolut still declines to comment. UPDATE 16-17 September 2026 — THE CHANNEL HAS A NAME AND IT IS ITALIAN, AND THE RANSOM COLLAPSES FROM 780 MILLION TO 3. (1) HOW THE REQUESTS ARRIVED. Since 12 September one precise question had gone unanswered: how did an outsider come to write from an authority's authentic domain? The channel the requests travelled on is now known: PEC, Italy's certified email system, the legally recognised service used by public administrations, companies and private citizens. According to Corriere della Sera sources, picked up on 16 September by Il Fatto Quotidiano and MilanoFinanza, the mailbox used is said to be that of the Prefecture of Reggio Calabria; the same name appears in a parliamentary question tabled by Democratic Party senators Lorenzo Basso and Antonio Nicita. BE CLEAR ON WHAT IS NOT ESTABLISHED, because the difference is substantial here: it is NOT settled whether the mailbox was genuinely taken over by someone — forensic experts are circulating the hypothesis of an infostealer, that is credentials stolen from a computer — or whether the sender was spoofed from outside. These are two scenarios with very different consequences for anyone using PEC, and the investigations exist precisely to tell them apart: until they do, the graver version is not the one written here. Italy's postal police is investigating for unauthorised access to a computer system and computer fraud; the National Cybersecurity Agency and the Bank of Italy are carrying out their own checks; the Italian data protection authority has opened enquiries. Italian authorities approached by the Irish Times declined to comment, while confirming that investigations are under way. The perpetrators further claim to hold 147 GB of material — 36,393 files in 5,223 folders — taken from Italian law enforcement systems: that is THEIR claim, verified by nobody, and should be read as such. (2) THE RANSOM DEFLATES. On 16 September the group published a 24-hour countdown and lowered its demand from 10,000 bitcoin to 6,000 monero, roughly USD 3 million, threatening otherwise to sell the files of the 680 customers to other criminal groups. The Financial Times reports this, having been shown a 60-second screen recording containing passports, driving licences and banking records, and CoinDesk picked it up on 16 September along with other outlets on 17 September. For the first time Revolut says something about the ransom, after days of «no comment»: «Revolut has not received any direct contact or demand from the individuals or group making these claims.» How to read that: a demand published on Telegram with a timer but never delivered to the company is pressure aimed at the public and the victims, not a negotiation under way; and a price falling from over 780 million to 3 in two days says above all that nobody is paying. (3) WHERE THE 680 ARE. Most are said to be in Switzerland and France, with residents of some thirty other countries — including the UK, Germany and Spain. This too is attributed to the attackers and not confirmed by Revolut. For Italy there is still no figure for affected customers: in this affair Italy appears as the origin of the channel used, not as the targeted market. (4) NOTHING HAS CHANGED ON THE REGULATORS, and this needs saying because the opposite is being written everywhere: numerous outlets, Italian ones included, state that the UK's ICO «opened an investigation» on 14 or 15 September. The ICO's own words are unchanged — it has received a report and is assessing the information provided — and on 15 September MLex, the specialist regulatory outlet, still headlined that the report «is being assessed». Until an act or a sentence from the authority says otherwise, the weaker verb is what stands here. Revolut has published nothing about the incident on its own X account: the latest post is from 3 September and concerns conditional approval from the US OCC. UPDATE 17 SEPTEMBER 2026 — WHERE THE CREDENTIALS CAME FROM, AND WHICH GROUP ENTITY RECEIVED THE REQUESTS. (1) For the first time there is a figure with a name attached instead of a generic hypothesis. Threat intelligence firm Hudson Rock says it holds roughly 300 compromised pec.interno.it webmail credentials in its own database — the certified-mail domain of the Italian Ministry of the Interior, which the Prefectures report to — all originating from machines previously infected by infostealers, the programs that harvest passwords saved in a browser. The firm draws an assessment from this, and words it carefully: the attackers may have bought or reused credentials already stolen by others, without needing to infect an Italian government employee themselves. CyberInsider reported this on 16 September 2026 and SecurityWeek on 17 September 2026. WHAT CHANGES AND WHAT DOES NOT: what changes is that the «infostealer» hypothesis now has a name and a number behind it, instead of being talk circulating among forensic experts; what does not change is that it remains unproven. A private firm's assessment is not the outcome of an investigation, and no Italian authority has yet said whether the mailbox was actually taken over or whether the sender was spoofed from outside. So both hypotheses stand here, exactly as before. The same articles also report — as the attackers' claim, not as verified fact — that a recovery address was added to the mailbox and the traffic monitored continuously, with outgoing fraudulent messages deleted. (2) IT IS NOW KNOWN WHICH GROUP ENTITY RECEIVED THE REQUESTS: not the British entity but Revolut Bank UAB, the group's Lithuanian bank, which serves customers in the European Economic Area, Italy included. Both outlets state this. (3) THE DEADLINE HAS PASSED AND NOBODY KNOWS HOW IT ENDED. The 24-hour countdown opened on the afternoon of 16 September expired on the afternoon of 17 September: as of the evening of 17 September no source reports a payment, a bulk publication of the 680 files, a sale to other groups or a fresh demand. Not knowing how it went is not good news: it only means nothing public has happened. The extortion remains open. On its own X account Revolut has now been silent about the incident for two weeks: the latest post is still the 3 September one about the OCC. UPDATE 19 SEPTEMBER 2026 — THE EXTORTION GOES QUIET, AND THIS ENTRY STOPS BEING FLAGGED AS «ONGOING». Forty-eight hours past the ransom deadline — the countdown expired on the afternoon of 17 September — still nothing public has happened: no payment, no bulk publication of the 680 files, no sale to other criminal groups, no fresh demand, no new claim. The coverage in this window repeats what was already known, with no new facts. Revolut remains silent about the incident on its own X account: the latest post is still the 3 September one about the OCC. So one thing changes, and it concerns how this case is displayed: until today the home security monitor flagged it as «ongoing», the state reserved for what is happening as you read it — an attack under way, funds moving, withdrawals still frozen. That is no longer the case here: the handover of the data was completed on 11 September, the threat to publish has been static for two days, and the Italian data protection authority's enquiries and the UK ICO's assessment are proceedings, not emergencies. The case therefore moves to the «open» state: not closed — the data is out and stays out — but nothing is happening right now. This is not a downgrade of how serious it is, which is unchanged, and it is reversible within an hour: if the 680 files are published or sold, or a new demand arrives, this entry returns to «ongoing» the same day. UPDATE 22 SEPTEMBER 2026 — THERE ARE TWO CLAIMED PERPETRATORS AND THEY ACCUSE EACH OTHER, THE DATA WAS ALREADY OUT IN JULY, AND MEANWHILE THE TEXT MESSAGES HAVE STARTED. (1) IT IS NOT ONE GROUP, AND UNTIL TODAY THIS ENTRY NAMED ONLY ONE: the correction comes first. Above you can read that the group «calls itself Revolut Smilik». In fact TWO Telegram channels claimed the attack: «IAmNotAVillain», the one behind the 6,000 monero demand (about 3 million dollars), and «Revolut Smilik», the one behind the 10,000 bitcoin demand. The former claims the latter is «an impersonator and scammer who used to work with us», who was handed a small sample of the data and is now claiming the whole breach as his own, and warns victims not to negotiate with anyone else. Both channels were suspended by Telegram; «iamnotavillain» later reappeared on a website of its own. This is reconstructed by KELA (analysis updated 15 September 2026) and BankInfoSecurity (15 September 2026). WHAT IT MEANS FOR THE READER: anyone among the 680 who gets contacted cannot tell from the name who actually holds their file — and the very fact that a sample passed between two parties means the data has already circulated. Which of the two versions is true has been established by nobody: these are criminals' competing claims, and we report them as such. (2) THE DATA WAS OUT BY LATE JULY AT THE LATEST — TWO MONTHS BEFORE CUSTOMERS WERE NOTIFIED. BankInfoSecurity reports that those blackmailed include Mark Karpelès, former CEO of Mt. Gox, crypto entrepreneur Marc Zeller and Felix Romer, founder of the gambling platform Gamdom, along with other industry figures, contacted directly by the perpetrator. One victim documented receiving extortion threats with Discord chat screenshots dated 26 JULY 2026, roughly two months before Revolut made the episode public. PRECISION ABOUT DATES IS NEEDED HERE, because it is the point on which this entry could most easily go wrong: the incident date remains 11 September 2026 because that is the verifiable date of the notification emails to customers, and the actual date the data was handed over is still not established either by Revolut or by any authority. What is now documented is something else, and it is enough to change how the case reads: the extortion of individual victims was already under way in July. Anyone who got the email on 11 September was not being told about something that had just happened. (3) HOW LONG IT ALLEGEDLY LASTED, AND WHY THE LITHUANIAN BANK SPECIFICALLY. According to the account the perpetrators gave the Financial Times, relayed by SecurityWeek on 17 September 2026, by American Banker on 18 September 2026 (updated 20 September) and by Cybernews, Revolut answered the fraudulent requests for about FIVE TO SIX MONTHS, not on a single occasion. The perpetrators say they picked Revolut Bank UAB, the Lithuanian subsidiary, precisely because it is obliged to answer a European Investigation Order — the cross-border demand for evidence that one EU member state can send another: they did not get around a compliance procedure, they targeted the duty to comply itself. They also say they selected their targets through on-chain analysis, identifying Revolut accounts holding significant crypto balances — which explains why the 680 are almost all people with visible wealth rather than a random slice of the customer base. American Banker adds the harshest detail: in at least one case a request submitted in the wrong form raised no suspicion, and Revolut staff reportedly explained how to correct it. IMPORTANT, AND DECISIVE: this entire paragraph is the PERPETRATORS' OWN ACCOUNT, given to the press and amplified from there. Revolut has confirmed neither the duration nor the number of requests, no authority has established it, and Cybernews itself headlines it as a claim. We do not write it as fact: we write it as what it is, a self-serving version which nonetheless comes from the only party that knows what happened, and which so far has not been denied. (4) THE EXTORTION SITE, AND ITS NUMBERS. KELA's analysis describes the infrastructure: a static page hosted on GitHub Pages, domain and DNS at GoDaddy, payment subdomain on GoDaddy Payments — something thrown together quickly with free or near-free services, not a structured organisation. The page displays screenshots presented as proof of the exchanges with the Italian mailbox and with the address [email protected], accuses Revolut of ignoring the breach notifications, and offers a contact via Telegram and Session to journalists and affected people alike. It claims nineteen «Document Revolut» archives and a 326 MB folder containing 688 files. A NOTE ON THE NUMBERS: 688 files are not 688 customers, and they do not match the 680 reported by the Financial Times; these are counts published by the perpetrators on their own site, not verified data. (5) THE MOST USEFUL THING TO KNOW TODAY: THE TEXT MESSAGES HAVE STARTED. Malwarebytes, which spotted it first (17 September 2026), and Infosecurity Magazine (21 September 2026) document a smishing campaign against Revolut customers. One affected customer received the message on Monday 14 September 2026, two days after the public announcement, and — this is the detail that makes the scam work — the text appeared IN THE SAME THREAD as genuine Revolut messages, slotting into the real conversation. The link leads to a page that asks for access to the phone's camera and, if granted, imitates Revolut's live video identity check, the one that asks you to turn your head, before asking for your password. The point is to harvest a selfie or video that can be reused to pass verification elsewhere or to make the next scam convincing. WHAT IS NOT PROVEN, and the company that found the campaign says so itself: Malwarebytes writes that «we don't yet know whether the phishing campaign is using data exposed in the breach or whether unrelated scammers are exploiting news of the incident to target Revolut customers more broadly». The link to the breach is NOT treated as established here — and it is also why this campaign does not become a separate Revolut incident: third-party phishing is not the provider's own act. For the reader it makes little difference, because the defence is the same either way, and it is set out below. (6) WHY THIS ENTRY STAYS «OPEN» AND DOES NOT RETURN TO «ONGOING». On 19 September this entry set three conditions for returning to the «ongoing» state: bulk publication of the 680 files, their sale to other groups, or a fresh ransom demand. As of today none of the three has happened, and no source reports a payment. The extortion site is not a new fact — it already existed on 15 September, so before that decision: it simply had not been recorded here. The text-message campaign is the work of third parties and is not attributed to Revolut. The state therefore remains «open»: the case is not closed, the data is out and stays out, but nothing is happening right now that touches systems or funds. The earlier commitment still stands: if the files are published or sold, or a new demand arrives, it returns to «ongoing» the same day. On its own X account, Revolut still says nothing about the incident.

Latest verified information

This is not a break-in at the company's servers: Alby Hub is self-custodial and runs on the user's own machine. On 9 September 2026 getAlby publicly confirmed a critical vulnerability in Hub versions v1.7.0–v1.18.5 (releases prior to August 2025) when the management interface is reachable from the internet: in the company's words, «the vulnerability could allow an attacker who could reach the Hub's management API to gain unauthorized access and send funds». Versions from v1.19.0 (29 August 2025) onwards are unaffected: the flaw had in fact been closed for over a year, but anyone who does not update stays exposed. Alby states that, to its knowledge, «one user has been impacted and thankfully reported these details»: the company has NOT quantified any loss and did not say whether that user lost money. Technical details are deliberately withheld («we will publish full details at a later date, following responsible disclosure practices»), there is no public CVE identifier, and the company thanks Bitcoin Team Red, Project Loupe and other researchers for issues fixed in the latest release. No compensation has been announced, because no loss has been quantified.

Latest verified information

On the evening of 9 September 2026 BitBox warned on its official X account that «there is currently a phishing email going around that's pretending to come from us», urging people not to follow its instructions. At 23:03 CEST the company published its preliminary findings: the email had been «sent out to our newsletter subscribers» and it is «very likely that our newsletter provider got compromised»; moreover «multiple other Bitcoin companies got targeted as well, and it appears that we all share the same newsletter provider». BitBox said it had sent a phishing warning to all subscribers, contacted the provider and reported the fraudulent domains, «most of» which «appear to have been taken down already», and that it was still investigating. What matters for the user is that the message arrived along the legitimate channel, to the real subscriber list: checking the sender is not enough to tell it apart. According to Cointelegraph and Cyber Daily the fraudulent message raised the alarm about an alleged flaw in the device's random-number generation, the same scheme used the same day against Trezor customers, who attributed their campaign to the breach of a third-party email provider (see the Trezor entry). As of our verification date no source has confirmed any theft of funds or recovery phrases, and neither company has disclosed the provider's name, the number of subscribers reached or the date the compromise began. A note on method: third-party phishing against a service's users does not belong in this register; this entry exists because the compromise concerns a supplier in BitBox's own communication chain, as stated by the company itself. UPDATE OF 10 SEPTEMBER 2026, 14:00 CEST: the shared provider BitBox referred to now has a name, though it was given by another affected company. At 23:32 CEST on 9 September CoinTracking — a crypto tax-reporting service, not listed in this register — stated on its official X account that «our third-party email service provider Brevo has experienced a security breach», with a third lure tailored to its own service: an email titled «Data Breach Notice: Please refresh API Keys as soon as possible». BitBox and Trezor still do not name the provider, and at 12:00 UTC on 10 September Brevo's status page reads «fully operational», with no security notice. On the headers of the email received by Trezor customers, Decrypt and Cryptopolitan report — on the basis of recipients' screenshots, not of a company confirmation — the Sendinblue campaign path (Sendinblue is Brevo's former name) and a DKIM, SPF and DMARC pass: the technical explanation of what BitBox had already said in plain words, namely that the message arrives along the legitimate channel. BitBox's expectation about the «multiple other Bitcoin companies» hit therefore gains a third public confirmation. There is still no confirmation of stolen funds or recovery phrases; at 14:00 CEST on 10 September BitBox's latest public statement remains the one from 23:03 on 9 September, and no closing report has been published. UPDATE OF 12 SEPTEMBER 2026, 08:00 CEST — THE PROVIDER HAS ADMITTED IT, BUT IT WAS NOT BITBOX THAT SAID SO. What is written above as of 10 September needs correcting on one point: it is no longer true that the name circulates only through CoinTracking, and no longer true that «Brevo's status page shows fully operational with no security notice». On 10 September Brevo published a post-incident write-up on its own status page titled «Attacker gained access to client accounts»: at 06:30 UTC it identified «a security issue where an attacker exploited a flaw in the way Brevo handles SAML SSO to gain access to 138 Brevo accounts». The mechanism, in Brevo's words: the attacker created a Brevo account, enabled single sign-on on it and invited legitimate Brevo users into that configuration, then signed in through their own identity provider acting as those users; the access was not properly scoped and, instead of being limited to the single organization where SSO was enabled, it «wrongly granted the attacker access to all organizations those users could reach». OFFICIAL BREAKDOWN OF THE 138 ACCOUNTS: 6 used to send phishing to the contacts stored in them, 43 with contacts exported, 93 with no meaningful activity. Brevo states it closed the vector at 08:30 UTC on 10 September, two hours after detection, signed out all platform users, deployed permanent fixes limiting SSO access to the owning organization, and disabled the links in the fraudulent emails. This is confirmation, from the source that counts, of what BitBox had inferred on 9 September when it spoke of a provider shared among several bitcoin companies. WHAT THIS ESTABLISHES FOR BITBOX AND WHAT IT DOES NOT: that BitBox subscribers received the phishing through the legitimate channel was stated by BitBox itself; which of Brevo's three buckets its account falls into — among the 6 used to send, among the 43 with contacts exported, or both — is stated by neither company, and we do not infer it. BitBox still has not published the number of subscribers reached and, as of 12 September, has neither publicly named the provider nor published a final report: its last statement on the case remains the one of 9 September. THE POINT OF COMPARISON, USEFUL BECAUSE IT MEASURES THE MISSING INFORMATION: Trezor, hit in the same wave through the same provider, published a notice on its blog on 10 September naming Brevo and quantifying the exposure — roughly 347,000 newsletter addresses, 2,500 clicks, domain taken down within 20 minutes (entry on the Trezor card). For BitBox, the equivalent of those figures does not exist as of today. WHY WE REMOVED THE «ONGOING» FLAG: the campaign is no longer in progress — the vector is closed on the platform operator's own statement, the phishing domains have been taken down, the sending has stopped. The entry remains unresolved because BitBox's own scope and a final report are missing, and because any exported addresses remain in circulation. As of 12 September no source, including BleepingComputer, SecurityWeek, Malwarebytes and The Record, has confirmed any theft of funds or recovery phrases traceable to this campaign. UPDATE OF 12 SEPTEMBER 2026, 13:30 CEST — BITBOX HAS SPOKEN, BUT TO A NEWSPAPER. What is written above as of 08:00 needs correcting on one point, and the correction is in BitBox's favour: it is no longer true that «its last statement on the case remains the one of 9 September», nor that as of 12 September it had not publicly named the provider. On 11 September Cointelegraph published statements from a BitBox spokesperson — the first time the company has described its own scope. WHAT BITBOX STATES, through the spokesperson: the unauthorised email was sent «through Brevo» — so the provider is now named by the company itself, no longer only by CoinTracking — and «appeared to have reached its full newsletter and tutorial list»; Brevo held «only email addresses and language preferences»; BitBox further states it found no evidence of compromised company credentials, downloaded contacts, lost funds or disclosed recovery phrases, and that it is treating the list as potentially accessed while awaiting Brevo's logs. HOW STRONG THIS SOURCE IS, STATED PLAINLY: these are the company's words, but gathered and reported by a single outlet, not published by BitBox on its own channels. At 13:00 CEST on 12 September the official blog (blog.bitbox.swiss) carries no article on the episode, and on its X account the latest statement on the matter remains the one of 9 September — this morning the account posted only an announcement of its presence at a trade fair. We therefore report the statement with its attribution in plain sight, not as an official communication. WHAT REMAINS OPEN: the number of subscribers reached still does not exist, because «the full list» is a scope and not a figure; and which of Brevo's three buckets the BitBox account falls into — among the 6 used to send, among the 43 with contacts exported, or both — is stated by neither company. There is, however, one substantial change since this morning: BitBox now says it has no evidence of downloaded contacts. That is not the same as ruling it out — the company itself is waiting for the provider's logs to know — but it is more than it had said so far. The point of comparison is unchanged: Trezor published a notice on its own blog with verifiable figures; BitBox answered a journalist.

Who was hit

Port of Tanjung Pelepas (Malaysia), one of the world's largest container hubs

Latest verified information

The port confirmed an attack on its operating systems that halted the container terminal for several hours. A phased restart began on September 10. Maersk, which runs the port with Malaysian group MMC, warned that some vessels could be delayed. The port says it has no evidence that customer data was accessed. It handled more than 14 million TEU in 2025. No attacker has been identified by reliable sources.

Latest verified information

On 9 September 2026 at 22:37 CEST Trezor stated on its official X account that «our third-party e-mail provider has been breached» and that the email titled «Critical Security Alert: STM32 Entropy Vulnerability» does not come from the company: it is a phishing attempt, and no link should be clicked. The company added that it had taken the domain down and was investigating «the situation, including how the hackers got access to our legit domain». That is what separates this case from ordinary phishing: the message did not imitate the official channel, it came through the official channel. According to The Block and Cointelegraph the email used genuine domain names and signatures, falsely claimed a factory defect in the STM32 microcontrollers capable of weakening recovery-phrase generation on a share of newer devices, and pushed the recipient toward a «vulnerability check» page built to harvest recovery words. Trezor said keys and funds were not exposed and, as of our verification date, no source has confirmed any theft of funds or recovery phrases. On the same day BitBox reported an identical campaign coming through its own newsletter provider, pointing to a likely shared mail provider used by several bitcoin companies (see the BitBox entry): the campaign is therefore an upstream compromise of a communication channel, not generic phishing against the sector. It is Trezor's second third-party-supplier incident in a few weeks, after the August ShipMonk data leak reported below; no source has linked the two. As of 10 September the investigation is stated to be still open and no closing report has been published: it is not known which provider was breached, since when, or how many customers received the message. UPDATE OF 10 SEPTEMBER 2026, 14:00 CEST: the shared provider has been named publicly, but not by Trezor. At 23:32 CEST on 9 September CoinTracking — a crypto tax-reporting service, not listed in this register — wrote on its official X account that «our third-party email service provider Brevo has experienced a security breach», and reported a third lure from the same wave, an email titled «Data Breach Notice: Please refresh API Keys as soon as possible». It is the first and so far only affected company to name it: Trezor and BitBox still say «third-party provider» without naming it, and at 12:00 UTC on 10 September Brevo's status page reads «fully operational» and carries no security notice. On the headers of the message received by Trezor customers, Decrypt and Cryptopolitan report — on the basis of recipients' screenshots, not of a company confirmation — a sender «Trezor Security <[email protected]>», a return-path of [email protected], the Sendinblue campaign path (Sendinblue is Brevo's former name) and a DKIM, SPF and DMARC pass. If confirmed, that explains why the message landed in inboxes as genuine: the cryptographic signature was the real one for the Trezor domain. There is still no confirmation of stolen funds or recovery phrases, and no closing report: at 14:00 CEST on 10 September Trezor's latest public statement remains the one from 22:37 on 9 September, roughly 15 hours earlier. UPDATE OF 12 SEPTEMBER 2026, 08:00 CEST — TREZOR HAS NOW NAMED THE PROVIDER, AND THE NUMBERS ARE IN. What is written above as of 10 September («Trezor and BitBox still speak of a third-party provider without naming it») is superseded: Trezor published a notice on its official blog titled «Security incident at Brevo, our third-party email provider», dated 10 September 2026, naming the provider and quantifying the exposure. In Trezor's words: on 9 September «Brevo, the third-party marketing platform Trezor uses for newsletter campaigns, suffered a security incident affecting 120 Brevo accounts», and «an unauthorized actor gained access to Brevo's system and used it to send emails from various customer accounts, including Trezor's». THE FIGURES: the incident affected Trezor's opt-in newsletter database, «roughly 347,000 email addresses», which the company treats as exposed and reusable in future phishing attempts; 2,500 people clicked the link before the domain was disabled, within 20 minutes of detection. Trezor states that Brevo's system «holds no passwords, wallet data, or other personal information», that «no Trezor product, wallet, or account system was affected», and that it suspended its Brevo account to stop further sending. ONE POINT REMAINS OPEN, AND TREZOR SAYS SO ITSELF: the company cannot confirm whether the address list was exported. BREVO HAS ALSO SPOKEN, AND IT IS THE SOURCE ON THE MECHANISM: on 10 September Brevo published a post-incident write-up on its own status page, under the title «Attacker gained access to client accounts». It states that at 06:30 UTC on 10 September it identified «a security issue where an attacker exploited a flaw in the way Brevo handles SAML SSO to gain access to 138 Brevo accounts». The mechanism, in Brevo's words: the attacker created a Brevo account, enabled single sign-on on it and invited legitimate Brevo users into that configuration, then signed in through their own identity provider acting as those users; the access was not properly scoped — instead of being limited to the single organization where SSO was enabled, it «wrongly granted the attacker access to all organizations those users could reach». OFFICIAL BREAKDOWN OF THE 138 ACCOUNTS: 6 used to send phishing emails to the contacts stored in them, 43 with contacts exported, 93 with no meaningful activity. Trezor is among the 6 from which the emails were sent. Whether it is also among the 43 whose contacts were exported is stated by neither Trezor nor Brevo, and it is precisely the point Trezor declares it cannot confirm: we do not infer it. NOTE ON THE 120/138 DISCREPANCY: the lower number is Trezor's on 10 September, the higher one is Brevo's in its later write-up; the figure to use is the platform operator's, 138. REMEDIATION: Brevo states it closed the attack vector at 08:30 UTC on 10 September — two hours after detection — signed out all platform users, deployed permanent fixes limiting SSO access to the owning organization, and disabled the links contained in the phishing emails. WHY WE REMOVED THE «ONGOING» FLAG: as of 10 September this entry was marked as an event in progress. It no longer is — the vector is closed on the operator's own statement, the phishing domains have been taken down, the sending has stopped. What remains open, and is why this entry is not marked as resolved, is what the incident leaves behind: roughly 347,000 addresses in someone's hands, no confirmation as to whether Trezor's list was exported, and no final report from Trezor. As of 12 September no source — including BleepingComputer, SecurityWeek, Malwarebytes and The Record, all of which covered the case — has confirmed any theft of funds or recovery phrases traceable to this campaign. UPDATE OF 12 SEPTEMBER 2026, 13:30 CEST — A PRECISION ON TREZOR'S POSITION. Above it reads that Trezor «states it cannot confirm whether the list was exported»: that is accurate but incomplete, and the omission works against the company. In the same 10 September notice Trezor adds what it concludes operationally, and it is the most cautious conclusion available: «Until we hear more from Brevo, we are treating all roughly 347,000 newsletter addresses as known to the attacker and possibly reusable for phishing.» It is worth writing down because it is exactly the rule of conduct this register recommends below, adopted by the company first: the uncertainty about the export is not used to play the incident down. On 11 September a Trezor spokesperson repeated the same sentence to Cointelegraph, also confirming that «the initial email was sent to 347,000 customers», all of whom were subsequently contacted about the risk.

Latest verified information

On 6 September 2026 at 22:25 CEST Liquid Network confirmed that ~4,000 BTC (~$320M) had left the Liquid Federation wallet. OFFICIAL INCIDENT REPORT, 8 SEPTEMBER 2026 19:10 UTC: after almost 47 hours of silence, the network's official channel published the Liquid Federation's first report on the incident, which is now the authoritative source on the mechanism. The report says that on 6 September (Liquid block 4,050,336) a vulnerability in the open-source Elements software — in how Liquid nodes cache range proof verifications, range proofs being the cryptographic proofs that a hidden amount is legitimate — was exploited, allowing the CREATION of ~4,000 LBTC not backed by bitcoin held in reserve. The actors then used SideSwap, a Federation member holding a peg-out authorization (PAK) key, to convert that LBTC into real BTC through Liquid's standard peg-out mechanism. Because the validation failure occurred at the transaction level, BEFORE the peg-out was initiated, both SideSwap's node and the network's globally distributed functionary nodes accepted the LBTC as valid and processed the peg-out as authorized: ~4,000 BTC left through SideSwap's whitelisted bitcoin address, which forwarded them to the address specified by the actors. NO KEYS WERE COMPROMISED, and the report is explicit: the functionaries were not hacked, no private key was compromised, and the peg-out mechanism operated as designed. OFFICIAL FIGURES: before the incident the reserve held ~4,205 BTC; after this peg-out and ADDITIONAL peg-outs processed before operations were halted, the reserve fell to 197 BTC. Other assets issued on Liquid (USDT, DePix, RWAs) were not affected by the vulnerability but remain unavailable while the network is paused. The investigation is still open: the report describes a «convergence of several individually low-probability factors» that defeated the system's redundancies, and promises further detail. TWO INACCURACIES IN THE REPORT, found by us and resolved in favour of the chain: the report dates the exploit to Liquid block 4,050,336 «at 15:53:10 UTC», but on-chain that block carries the timestamp 13:53:10 UTC — 15:53 is Italian time, not UTC; and it calls the return «Liquid block 965,950», which is in fact a Bitcoin block. The dates stand; the times we publish are the ones read off the chain. THE NEGOTIATION: the actors left an on-chain message ("we are whitehats") and, in an exchange over OP_RETURN and PGP, asked for the flaw to be fixed and nodes patched before returning the funds; on 7 September Blockstream replied over the same channel with a PGP-signed message ("bridge nodes are patched, safe to return the funds"). PARTIAL RETURN, VERIFIED ON-CHAIN AND NOW CONFIRMED BY THE REPORT: on 7 September 2026 at 16:09:25 UTC (Bitcoin block 965,950, transaction a6d697a2…c49a46d) the actors' consolidation address sent 3,400 BTC (~$268M) back to the Federation wallet, keeping 598.5 BTC (~$47M) — 15% of the amount withdrawn. The official report says those ~598.5 BTC remain outstanding and that discussions with those responsible are ongoing: no document from either side calls that 15% an agreed bounty. As of 9 September 2026 at 08:15 UTC those bitcoin have still not moved, verified by us: the actors' address holds 598.50008953 BTC across 244 confirmed transactions, grown only by dust sent by third parties and with no outgoing transaction — they have sat there since the 6 September payout at 14:28:56 UTC, more than 65 hours; the Federation's reserves remain at 3,597.47201026 BTC. PATCH AND RESTART, with the report's own dates: the patch to the bridge nodes was completed on 7 September at 01:09 UTC, and «the vulnerability is no longer exploitable». Restarting the network, however, requires an EMERGENCY RELEASE of Elements, v23.3.4, announced «as soon as possible, but within approximately 48 hours» from 19:10 UTC on 8 September — so by 10 September — and still undergoing internal and external review. Only then will functionary operators perform «additional adjustments» to resume full functionality and restore the corrected network state, «including rejection of the invalid peg-out»: the stated goal is to reopen with 1:1 BTC backing, in coordination with the attacker. Anyone running a Liquid node must wait for the release and follow the upgrade instructions; the report tells users that no proactive steps are needed at this time. VERIFIED BY US ON THE OFFICIAL ELEMENTS REPOSITORY: branch elements-23.3.x took in PR #1600 «sigcache: harden range proof cache keys and add -norangeproofcache option» on 8 September 2026 at 19:06:54 UTC, together with the version bump to 23.3.4 and updated manpages. The text of the fix confirms the mechanism from the primary source: the proof caches move from raw SHA-256 concatenation to a writer that LENGTH-PREFIXES every field, «so distinct argument tuples with byte-identical raw concatenations no longer collide to the same cache key», and a -norangeproofcache startup option is added to disable the cache without recompiling. Worth flagging: the same fix also hardens the SURJECTION proof cache (adding vTags to its key) — a second cache with the same class of weakness. THE RELEASE IS OUT, VERIFIED BY US ON THE OFFICIAL REPOSITORY: elements-23.3.4 was published on 9 September 2026 at 03:14:44 UTC, eight hours after the report and almost forty hours inside the «approximately 48 hours» the Federation had given itself. The tag had been created on 8 September at 19:07:52 UTC, two minutes before the report went out. The release ships eighteen archives (Linux, macOS, Windows, ARM, RISC-V, PowerPC) with SHA256SUMS and SHA256SUMS.asc for signature verification, and its changelog contains PR #1600 alongside the changes accumulated since 23.3.3. Two details that matter: on GitHub 23.3.4 is flagged as a PRE-RELEASE, which 23.3.3 was not, and the repository still publishes no formal security advisory. THE FIX ALREADY EXISTED BEFORE THE ATTACK, and the official report does not address this: verified by us on the repository, commit c26d719c «fix: range proof cache bind to asset and scriptpubkey», authored on 3 August 2026 at 10:53:50 UTC, landed on the main branch through PR #1592 on 1 September 2026 at 14:38:01 UTC — five days before the exploit — but never made it into a release, and the Federation's nodes were running 23.3.3 of 13 April 2026. We state it with the caution it deserves: it is a partial change to the same file as the definitive hardening (#1600), not the same fix, and nobody has shown it would have stopped the attack on its own. But the timeline is verifiable at the source, and it is what the press (crypto.news, 8 September 17:58 UTC) built its still-unanswered question on: why a fix to that cache sat on the main branch for days without being in any shipped version. A RELEASE IS NOT A RESTART: AS OF 9 SEPTEMBER 2026 08:15 UTC THE NETWORK IS STILL DOWN, verified by us: Blockstream's explorer is stuck at block 4,051,232 of 7 September at 04:49:10 UTC — over 51 hours of standstill on a chain that closes a block every minute. Five hours after the release was published neither official channel has announced it: @Liquid_BTC has posted nothing since the 8 September report, and Blockstream's status page is still on its 7 September 00:14 UTC notice, with «Public Bridge Nodes» in Major Outage — our fourth consecutive check with no update on that page, while the new facts come out of the repository and X. Peg-outs and L-BTC deposits and withdrawals remain suspended on exchanges. The Federation's reserves (3,597.47 BTC) remain below the L-BTC in circulation (~4,205 BTC before the incident): until the remainder comes back or is covered, backing is not full, and nobody has yet said who covers it. On the restart, on 8 September Samson Mow — JAN3 CEO and a former Blockstream executive, not a company spokesperson — had also pointed to resolving a CHAIN SPLIT created during the pause (CoinDesk and Cointelegraph, 8 September 2026): the official report does not mention it, but the split does explain something we had measured ourselves, two Liquid explorers reporting a different last block (4,051,232 against 4,050,335). The technical reconstruction published by CertiK on 7-8 September matches the official report and adds the detail of how: the cache key was built by concatenating variable-length fields without delimiting them, so two different sets of data could produce the same entry; with the cache primed by harmless transactions, the inflation transaction found the entry already there, got back an «already verified» and its proof was never actually checked. Our two caveats stand: CertiK states on its own site an official partnership with Liquid dating to 2020, so it is not an independent third party, and CertiK itself wrote that the link to that code was an inference because «the exact binaries deployed on individual functionaries have not been published» — an inference the official report and PR #1600 now substantially confirm. Blockstream has published no post-mortem of its own: the 8 September report comes from the Federation, on the network's channel, and Blockstream stopped at its 8 September 01:00 UTC statement describing itself as Liquid's «technical provider». VERIFIED BY US ON-CHAIN: the two peg-outs sit in Liquid block 4,050,349 of 6 September at 14:06:10 UTC (2.65138358 and 3,996.01834922 L-BTC) and the bitcoin payout in block 965,783 of 6 September at 14:28:56 UTC, with 3,995.99999857 BTC landing on the actors' consolidation address; the inflation block cited by the report, 4,050,336, is dated 6 September at 13:53:10 UTC, thirteen minutes before the peg-out. Scope for Jade: the device, its firmware and users' keys are not in question and the Bitcoin side of the wallet works normally — what is frozen is the Liquid functionality, which this card lists among the product's selling points. TURN OF 9 SEPTEMBER 2026: THE ACTORS BREAK THEIR SILENCE WITH A DEMAND AND A THREAT, VERIFIED BY US ON-CHAIN. At 10:16:13 UTC on 9 September a bitcoin transaction (txid f7055f6c…e579588) appeared in the mempool, signed by the keys controlling the retained funds: 29 inputs for 598.50014053 BTC, with 598.50010393 BTC sent back to the actors' OWN address, 1,000 satoshis to the Federation wallet address, and a plaintext message in the OP_RETURN field. NOTE WHAT THIS MOVEMENT IS: it is not an exit and not a return, it is a self-consolidation used to carry the message — the 598.5 BTC stay where they were. AT THE TIME OF OUR CHECK (9 September, 11:30 UTC) THE TRANSACTION WAS STILL UNCONFIRMED: it pays about 1 satoshi per vbyte, a very low fee, so it may sit pending for a long time or be replaced. We publish it with that caveat because it is verifiable at the primary source — anyone can read it on the chain — but it is not yet written into a block. THE TEXT, quoted in full: «Your dereliction of duty is obvious that you allocated only $1.5M (maybe even 0) to secure $5B assets. This is a flagrant neglect of security and a sign of complete mismanagement. You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess. Even companies that participate in bug bounty programs cannot guarantee complete security, let alone one like yours that remains delusional, greedy, and arrogant to this very day. Anyway we are going to publish the privatekey to decrypt our conversations afterwards.» It is a change of register from the «we are whitehats» of 6 September: an explicit demand for money addressed to Blockstream, coupled with a threat framed around holders and an announcement that the private correspondence will be made public. Neither counterparty had responded publicly at the time of our check, and no official source or news outlet had yet commented on the message. THE NEGOTIATION RECONSTRUCTED ON-CHAIN, message by message, all signed by the actors' address (our own verification, times UTC): 6 September 18:30:10 «we are whitehats. contact us on chain»; 7 September 02:20:18 «sending most back to bc1qdlld6…, is that ok»; 7 September 03:30:05 «Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix», with a PGP attachment encrypted to the key published at blockstream.com/pgp.txt; 7 September 12:43:33 «plz confirm again that we are sending the coins back to bc1qdlld6…»; then further PGP messages on 7 September at 15:31:46 and 18:35:17; at 21:03:23 on 7 September a single character, «:(»; more PGP on 8 September at 09:41:24 and 14:25:31, the latter accompanied by the line «All messages will be in plaintext» — which explains why the 9 September demand arrives in the clear. The channel, in other words, stayed open throughout the period when the public channels were silent. A WARNING ABOUT THE CHANNEL ITSELF: the actors' address is public and anyone can write to it by sending dust with an OP_RETURN, and people are doing exactly that — at our check the mempool held third-party messages offering advice on laundering the funds, a request for a 10 BTC handout, and entirely off-topic texts. Not every «on-chain message» that will circulate in screenshots comes from the actors or from Blockstream: only those signed by the addresses involved count. BALANCES AS OF 9 SEPTEMBER 11:30 UTC, verified by us: the actors' address holds 598.50017329 BTC across 258 confirmed transactions (it was 598.50008953 across 244 at our 08:15 UTC check); the growth is entirely dust received from third parties and there is still no outgoing transaction — those bitcoin have sat there since the 6 September payout at 14:28:56 UTC, more than 69 hours. The Federation's reserves rise to 3,601.47201426 BTC: 4.000004 BTC came in that were still in the mempool at our previous check and that we deliberately kept out of this card until they confirmed; no statement accompanies them, and the simplest reading remains an ordinary peg-in. THE NETWORK IS STILL DOWN: as of 9 September 11:30 UTC Blockstream's explorer is still at block 4,051,232 of 7 September at 04:49:10 UTC — over 54 hours of standstill on a chain that closes a block every minute, and our fifth consecutive check on the same number. Release 23.3.4 has been out for more than eight hours but is still flagged as a PRE-RELEASE on the official repository, where no formal security advisory has yet appeared. Neither official channel has moved: @Liquid_BTC has posted nothing since the 8 September 19:10 UTC report and never announced the release it had promised, @Blockstream is still on its 8 September 01:00 UTC statement, and Blockstream's status page keeps seven components in Major Outage with no update since 7 September at 00:14 UTC — our fifth consecutive check. THE SCAMS HAVE ALREADY STARTED, ON THE SAME CHANNEL AND VERIFIED BY US ON-CHAIN: the Federation wallet address has been receiving third-party messages exploiting the case for days, readable by anyone. On 9 September at 08:30:06 UTC an OP_RETURN carried an advert promising to «double your bitcoins», pointing to a site that mimics the attackers' name (whitehats.live): it is the classic doubling scam — do not open the site and do not send anything. On 8 September at 00:43:32 UTC another message offered laundering services over Telegram; on 7 September at 10:46:03 UTC two messages urged people to send funds to a third party's bitcoin address passed off as the «white hats'»; and on 7 and 9 September a memecoin created around the incident was promoted. None of these messages has any connection to Blockstream, to the Federation or to the actors behind the exploit: they are outsiders writing on a public channel. It is the practical confirmation of the warning above — anyone can write on that chain, and scammers are first in line. UPDATE OF 9 SEPTEMBER 2026, 17:45 UTC — THE RELEASE IS OFFICIALLY ANNOUNCED AND A THREE-STAGE RESTART PLAN APPEARS. First a correction we owe ourselves: the transaction carrying the bounty demand, which at our previous check we published while stating it was STILL UNCONFIRMED, has confirmed — it is in Bitcoin block 966,199 of 9 September at 11:45:49 UTC, an hour and a half after appearing in the mempool. The caveat we wrote no longer applies: the message is now written into the chain and anyone can read it there. OFFICIAL STATEMENT FROM @Liquid_BTC, 9 SEPTEMBER 13:30 UTC (posted at 14:36 UTC): this is the first official announcement of the release, arriving almost eleven hours after we found it on the repository. It says the emergency Elements v23.3.4 release is available, that functionary nodes are being updated immediately and that all Liquid node runners are advised to do the same; that the release «addresses the proof-verification cache vulnerability, hardening the cache keys used for range proofs» — official confirmation, from the source, of what we had read in PR #1600; and that the code went through «multiple rounds of internal and external review», with explicit thanks to the Bitcoin Red Team and Alpen Labs. Verified by us on the repository: 23.3.4 IS NO LONGER MARKED AS A PRE-RELEASE (it still was at our 11:35 UTC check), while the security advisories section of ElementsProject/elements remains empty even now. THE RECOVERY PLAN, set out in stages for the first time: (1) resume block production while peg operations remain suspended; (2) replay transactions verified as valid; (3) resume peg operations once the network state has been fully restored, «INCLUDING A RETURN OF FUNDS». Blockstream says it is testing the procedures for the first two stages in parallel, warns that sequencing and implementation may be adjusted along the way, and that no stage proceeds «until it is considered safe to advance». This is the passage that matters most to L-BTC holders, and it should be read for what it says: conversion back into BTC does not return when the chain restarts, but only at the third stage, and the statement explicitly ties it to the return of the funds — that is, to the 598.5 BTC that have not come back and over which an unanswered demand for money now stands. No date was given for any of the three stages. OFFICIAL PHISHING ALERT FROM @Blockstream, 9 SEPTEMBER 17:00 UTC, forty-five minutes before this check: it is the first dedicated scam warning and it confirms, from the company's side, what we had already been measuring on-chain. It says scammers are impersonating Liquid and Blockstream and urging users to «take action», and that Blockstream will NEVER ask for your recovery phrase or PIN, never ask you to send funds, and never provide a link for updated software. The official list of what you must never do: send funds to a «recovery» address; enter your seed on a «migration» site; install firmware or software from an email link; reply to unsolicited direct messages. And the official list of what to treat as a scam: «mandatory security update» emails and portals, refund, «re-peg» or «claim your L-BTC» sites, fake support messages, lookalike domains, and unsolicited «white-hat» or bounty outreach. For verified updates Blockstream points only to blockstream.com and the official app from the official app stores. THE 10% DEMAND REMAINS UNANSWERED, verified by us on the chain and not only on public channels: we re-scanned the transactions of the Federation wallet address and the Federation has signed NO on-chain message, neither in reply to the demand nor before it; and on the actors' side no new signed message has appeared after the one at 11:45:49 UTC. Neither of today's official statements mentions the bounty demand, the «15% loss» threat or the announced publication of the correspondence: on that point, six hours on, there is still not a public word from Blockstream or the Federation. BALANCES AT 9 SEPTEMBER 17:45 UTC, verified by us: the actors' address holds 598.50022061 BTC across 273 confirmed transactions (it was 598.50017329 across 258 at 11:30 UTC); the growth is again only dust received from third parties and there is still no outgoing movement — those bitcoin have sat there since 6 September at 14:28:56 UTC, that is for more than 75 hours. The Federation's reserves stand at 3,601.47203226 BTC, up by 1,800 satoshi of dust alone: no new return. THE NETWORK IS STILL DOWN: Blockstream's explorer is still at block 4,051,232 of 7 September at 04:49:10 UTC, that is 60 hours and 56 minutes of stoppage on a chain that closes a block a minute, and this is our sixth consecutive check on the same number. The announced release has not yet produced a restart. Blockstream's status page, despite the two statements on X, remains stuck on the 7 September 00:14 UTC notice with Liquid and the Public Bridge Nodes in Major Outage: the sixth check in a row without a line on that page. THE ON-CHAIN CHANNEL HAS DEGENERATED, and it is worth knowing before believing a screenshot. Over the last six hours, on the addresses involved, we counted: insistent repetition of the bitcoin-doubling scam that mimics the actors' name (six new identical messages, the last at 17:45:28 UTC), promotion of a mixing service, unsolicited advice on how to launder the funds, begging requests, a message in which an anonymous party IMPERSONATES BLOCKSTREAM'S CHIEF EXECUTIVE, and a series of anonymous messages accusing named, real company executives of having orchestrated the theft, going as far as publishing a purported home address and personal insults. On the latter we are explicit: these are anonymous, unverified claims supported by no source, we do not repeat them and they must not be taken as facts — anyone can write anything on that channel for a few satoshi, and that is exactly what is happening. Messages have also appeared from people stating they have funds locked in L-BTC and publicly demanding them back: these are user voices, not verifiable facts about the service, and we record them as such. UPDATE OF 10 SEPTEMBER 2026, 01:45 CEST (9 SEPTEMBER 23:45 UTC) — SEVENTH CONSECUTIVE CHECK, THE FIRST STAGE OF THE RESTART HAS NOT BEGUN. In the six hours after the three-stage plan was announced, nothing that can be measured has changed. THE NETWORK IS STILL DOWN: Blockstream's explorer is still at block 4,051,232 of 7 September at 04:49:10 UTC, that is 66 hours and 56 minutes of stoppage on a chain that closes a block a minute, and this is our seventh consecutive check on the same number. The first of the three announced stages — resuming block production with the pegs still suspended — has therefore not started, and no stage has a date. BALANCES AT 9 SEPTEMBER 23:45 UTC, verified by us: the actors' address holds 598.50038739 BTC across 285 confirmed transactions (it was 598.50022061 across 273 at 17:45 UTC); the growth is once again only dust received from third parties and there is no outgoing movement — those bitcoin have sat there since 6 September at 14:28:56 UTC, that is for more than 81 hours. The Federation's reserves remain at 3,601.47203226 BTC, identical to the previous check: no new inflow, not even dust. THE 10% DEMAND REMAINS UNANSWERED, and we verified this on the chain and not only on the public channels: the Federation's address has signed no message, and no new signed message has left the actors' address since the one at 11:45:49 UTC. On the official Elements repository there is no new commit since 4 September and THE SECURITY ADVISORY SECTION IS STILL EMPTY, twenty hours after the release was published. Blockstream's status page is still on its 7 September 00:14 UTC notice: our seventh check in a row without a line on it, while the statements keep coming only through X. On the addresses involved the noise continues unchanged — the bitcoin-doubling scam, mixing-service advertising, begging requests, anonymous parties offering themselves as «mediators» between the sides, and alleged users with frozen funds asking for them back: none of these voices is verified and none should be taken as fact. UPDATE OF 10 SEPTEMBER 2026, 07:30 CEST (05:30 UTC), verified by us first-hand: THE SIDECHAIN HAS PASSED THREE FULL DAYS OF DOWNTIME. The Liquid chain height is still 4,051,232 — our eighth consecutive check on the same number — and the last block remains the one from 7 September at 04:49:10 UTC: that is 72 hours and 41 minutes. The first of the three stages announced on 9 September, resuming block production with the pegs still suspended, has therefore not begun, and no stage yet has a date. BALANCES AS OF 10 SEPTEMBER 05:30 UTC: the actors' address holds 598.50040069 BTC across 287 confirmed transactions plus 6 in the mempool (it was 598.50038739 across 285); the increase is again only dust received from third parties and no outflow is recorded — those bitcoin have not moved since 6 September at 14:28:56 UTC, that is more than 87 hours. The Federation's reserves remain at 3,601.47203226 BTC, identical to the satoshi for the second check in a row: nothing has reached the address since 9 September at 17:45:28 UTC, almost twelve hours of complete silence. THE 10% DEMAND REMAINS UNANSWERED, and once again we verified this on the chain: the Federation's address does not appear among the inputs of any transaction and has therefore signed no message, and no new signed message has left the actors' address. On the official Elements repository there is no new commit since 4 September and THE SECURITY ADVISORY SECTION IS STILL EMPTY, more than twenty-six hours after the stable 23.3.4 release was published. Blockstream's status page is still on its 7 September 00:14 UTC notice, our eighth check in a row without a line on it, and the latest statement on X is the one from 13:30 UTC on 9 September: sixteen hours without an update. On the addresses involved the noise continues: overnight a PGP-signed message and an advert for an X profile appeared, sent however by third parties and not by the attackers — none of these voices is verified and none should be taken as fact. UPDATE OF 10 SEPTEMBER 2026, 14:00 CEST (12:00 UTC), verified by us at first hand: NOTHING HAS RESTARTED. The Liquid chain height is still 4,051,232 — the ninth consecutive check on the same number — and the last block remains the one from 7 September at 04:49:10 UTC: that is 79 hours and 14 minutes, more than three days and seven hours. STAGE 1 OF THE PLAN ANNOUNCED ON 9 SEPTEMBER — resuming block production with pegs still suspended — HAS STILL NOT BEGUN, and none of the three stages has a date. BALANCES AT 12:00 UTC ON 10 SEPTEMBER: the actors' address holds 598.50043115 BTC across 291 confirmed transactions plus 6 in the mempool (previously 598.50040069 across 287); the increase is again only dust received from third parties and no outgoing movement appears — those bitcoin have not moved since 6 September at 14:28:56 UTC, that is for more than 93 hours. The Federation's reserves stand at 3,601.47203772 BTC: the only movement since the previous check is a 546-satoshi payment received at 11:38:13 UTC on 10 September, third-party dust, not a return. THE 10% DEMAND REMAINS UNANSWERED and once again we verified this on the chain: the Federation's address does not appear among the inputs of any of its transactions, so it has never signed a message, and no new signed message has left the actors' address. On the official Elements repository there is no new commit since 4 September and THE SECURITY ADVISORIES SECTION IS STILL EMPTY, more than thirty-two hours after the stable 23.3.4 release was published. Blockstream's status page is still stuck on the 7 September 00:14 UTC notice, the ninth check in a row without a line, and the latest statement on X remains the one from 13:30 UTC on 9 September: about twenty-two hours of official silence. On the addresses involved the noise continues and changes shape — overnight and this morning came rhyming begging verses, unsolicited advice on how to launder the funds, anonymous attacks on other projects and the usual mixing-service adverts — but all sent by third parties, not by the actors: none of these voices is verified and none should be taken as fact. UPDATE OF 10 SEPTEMBER 2026, 22:00 CEST (20:00 UTC) — THE NETWORK IS BACK, AND OUR PREVIOUS MEASUREMENT WAS WRONG: WE CORRECT IT HERE. Verified by us on the chain: the last block before the halt is 4,050,335 of 6 September at 13:52:10 UTC, and the first block after the halt is 4,050,336 of 9 September at 21:05:10 UTC. The sidechain halt therefore lasted 79 hours and 13 minutes and ENDED ON THE EVENING OF 9 SEPTEMBER; it is no longer ongoing. The updates we published on 9 and 10 September said the chain was still down and that the first stage of the restart had not begun: that measurement came from Blockstream's explorer, which throughout the outage kept returning block 4,051,232 timestamped 7 September 04:49:10 UTC as the chain tip. The divergence between the two explorers, which we had flagged from day one precisely so as not to pass off a stalled explorer as a stalled chain, has now been resolved in favour of liquid.network, which correctly showed 4,050,335 of 6 September: today Blockstream's own API shows the 4,050,335 → 4,050,336 jump and confirms liquid.network's dates. WHAT HAPPENED ON THE CHAIN, HOUR BY HOUR, VERIFIED BY US. On restart the first blocks cleared a backlog: block 4,050,337 at 21:11:10 UTC contains 329 transactions, 4,050,338 at 21:16:10 contains 83, and 4,050,339 at 21:17:10 contains 40. Immediately afterwards, and throughout the night and morning, blocks came out EMPTY — one block a minute carrying only the service transaction, no user transactions: exactly the phase described by the official 10:00 UTC statement of 10 September, «block production has resumed without transactions». User transactions reappear with block 4,051,244 at 12:31:10 UTC on 10 September; from 16:47 UTC onwards, across the samples we checked, EVERY block carries real transactions. Direct cross-check on block 4,051,689 at 19:56:10 UTC: one service transaction plus five ordinary fee-paying transactions with multiple inputs and outputs. The network is working. TODAY'S TWO OFFICIAL STATEMENTS. At 10:00 UTC Blockstream's status page finally moved after three days of silence — it had been frozen on the 7 September 00:14 UTC notice — under the heading «OPERATIONS RESUMED, RECOVERY ONGOING»: it says the network has entered the next phase of its controlled resumption, that the required functionary and bridge node updates have been successfully deployed, that functionaries are signing and validating blocks as intended, and that «peg operations, including PAK-authorized peg-outs, remain suspended» while work continues on the final recovery stage, namely restoring the BTC/LBTC reserve. On that same page the «Liquid» and «Public Bridge Nodes» components moved from Major Outage to PARTIAL OUTAGE. Then, at 19:55 UTC (posted at 20:04 UTC), the network's official channel issued the day's second update, headed «TRANSACTIONS RESUMED, PEG-OUTS DISABLED»: «transactions on the network have resumed, while peg-outs remain disabled as a precautionary measure while the final stage of recovery continues». The statement adds that «rigorous testing, AI-assisted code scanning, and continuous network monitoring» by internal and external teams are under way, that further information on the resumption of peg-outs will be shared once available, that users need take no proactive steps at this time, and that anyone running a Liquid node should update to Elements v23.3.4 immediately. WHAT HAS NOT CHANGED. The funds have not moved: the actors' address holds 598.50044115 BTC across 292 confirmed transactions plus 6 in the mempool (it was 598.50043115 across 291); the increase is again one thousand satoshis of dust received from third parties, and there is no outgoing spend. The Federation's reserves stand at 3,601.47203772 BTC across 590 transactions, identical to the satoshi and to the transaction against the previous check. The 10% bounty demand remains publicly unanswered. On the official Elements repository the security advisories section is STILL EMPTY, more than forty-one hours after the stable 23.3.4 release, and there is no new commit on master since 4 September. Restoration of the BTC/LBTC reserve is declared «in progress» and no date has been given for peg-outs to reopen: this is why the incident stays open and flagged as ongoing, even though the network is running again. UPDATE OF 11 SEPTEMBER 2026, 01:30 CEST: THE FIRST COMMITMENT FROM A NAMED PERSON ON COVERING THE PEG. On 10 September at 11:02 UTC (13:02 CEST) Adam Back — co-founder and chief executive of Blockstream, account @adam3us — wrote on X: «@Liquid_BTC network resumption coming up. obvious question will LBTC:BTC 1:1 peg be covered; answer YES, so do not panic sell OTC as @PabloSGreco and team are working on more system updates to resume the peg in/out, which happens in a later step». This is the first time someone with a name and a role has publicly taken on the coverage of the shortfall, and it answers the question we had been watching since 7 September. It is worth saying with equal precision what it is NOT: it is not a refund, not a restored reserve, not a figure and not a date. It does not say who puts up the missing 598.5 BTC or when, it comes with no published proof of reserves, and it was not echoed by the network's official channel: the @Liquid_BTC statement at 19:55 UTC, almost nine hours later, still describes the restoration of the reserve as work «in progress». We also record a delay of our own, because it is part of the story: the statement was made at 11:02 UTC and our two following runs, at 14:00 and 22:15 CEST on 10 September, had not seen it. At 20:50 UTC (22:50 CEST) on the same day Back added, replying to a comment, the rationale for the sequencing: «we understand regulated entities and market functions need it. so we focused on resumption stage first, to get assets, securities, notes etc online faster. and ofc users of stable coins, and other swap functions» — confirmation from the most senior voice that peg-in and peg-out are the final stage, and again with no date. TONIGHT'S CHECKS. The network is working: at 23:34:10 UTC on 10 September the chain tip is block 4,051,907, one block per minute, and every sample we opened through the evening contains real transactions (block 4,051,750 at 20:57 UTC, 6 transactions; 4,051,800 at 21:47, 5; 4,051,850 at 22:37, 10; 4,051,900 at 23:27, 5). The funds have not moved: the actors' address holds 598.50048115 BTC across 296 confirmed transactions (it was 598.50044115 across 292), four thousand satoshis more of pure dust received from third parties and no outgoing spend; the 28 transactions now in the mempool, against 6 at the previous check, are more inbound dust worth a few cents in total, not a movement. The Federation's reserves remain 3,601.47203772 BTC across 590 transactions, identical to the satoshi and to the transaction. Blockstream's status page has not moved since the 10:00 UTC statement and keeps «Liquid» and «Public Bridge Nodes» at Partial Outage; @Liquid_BTC has posted nothing after 19:55 UTC and @Blockstream nothing after 8 September. On the official Elements repository release 23.3.4 is now marked stable rather than pre-release, but the security advisories section is STILL EMPTY more than forty-four hours after publication, and there is no new commit on master since 4 September: five days after the incident there is still no formal written advisory on the software that made it possible. The incident stays open and flagged as ongoing: peg-outs are disabled by official statement, the reserve is not restored, and a pledge to cover it, however authoritative, is not coverage. UPDATE OF 11 SEPTEMBER 2026, 08:45 CEST — BLOCKSTREAM SAYS NO TO THE RANSOM AND STOPS CALLING THEM WHITE HATS. At 07:25 CEST (05:25 UTC) on 11 September the official @Blockstream account published, and pinned to the top of its profile, its first message addressed directly to those behind the withdrawal, and it is the heaviest new fact since the Federation's 8 September report. The words are these: «Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.» The company adds that it engaged «in good faith» to secure the return of user funds, but that the effort «should not be mistaken for acceptance of the actions taken nor of the terms being demanded»: this is the first official admission that a financial demand was made and is still on the table. Blockstream says it will not set the precedent that developers of open-source software built for the Bitcoin community should pay «a ransom that far exceeds their economic participation», and writes a line that bears directly on anyone holding LBTC: «Bitcoin is hard money and can't be minted without costs, Bitcoin doesn't haircut users to pay a ransom.» It leaves the actors a door open — «the bitcoin can be returned and we can revert to the standard of white-hat principals» — and otherwise announces it will pursue «every lawful avenue available», working with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible. The message closes with «we will not pay for the return of stolen property, we will not abandon our users» and the imperative «return the bitcoin». WHAT ACTUALLY CHANGES, AND WHAT DOES NOT. The framing changes: until yesterday the case lived under the «purported white hats» label used in the first statement of 6 September, and the 10% bounty demand sent by on-chain message had never received a public answer; from today the answer exists, it is a no, and it is written by the network's operator. The recovery scenario changes too: if the actors do not return the funds voluntarily, the 598.5 BTC come back through courts or forensics, not through a deal — a long road with no guaranteed outcome. Nothing operational changes: peg-outs remain disabled, the reserve is not restored, there is no date. And the point that matters most to LBTC holders is still open: on 10 September chief executive Adam Back promised the 1:1 peg «will be covered», and today the company says it will not pay the actors — the two hold together only if someone else puts up the 598.5 BTC, and nobody has yet said who, how much or when. At the time of our first check, an hour and a half after publication, no recognised outlet had yet picked up the statement: the source was, and is, the company's own official account. Over the course of the morning the news was picked up by several independent outlets — among them Cointelegraph, crypto.news, CryptoPotato and U.Today — which agree on a detail already known and now confirmed by third-party sources: the demand was a 10% bounty to be paid out of Blockstream's own funds, with the threat of a 15% loss for LBTC holders otherwise. THIS MORNING'S CHECKS, all our own and none of them changing the status. The network is working: at 06:48 UTC the Liquid chain tip is block 4,052,341, 434 blocks in 434 minutes since yesterday's 23:34 UTC check, exactly one block per minute. The funds are not moving: the actors' address holds 598.50049115 BTC across 297 confirmed transactions (it was 598.50048115 across 296), a thousand satoshis more of dust received from third parties and no outgoing spend; the 34 transactions now in the mempool, against 28 at the previous check, are more incoming dust. Federation reserves remain 3,601.47203772 BTC across 590 transactions, identical to the satoshi and to the transaction. Blockstream's status page has not moved since the 10:00 UTC statement of 10 September and keeps «Liquid» and «Public Bridge Nodes» in Partial Outage, with peg operations, PAK-authorized peg-outs included, declared suspended. On the official Elements repository the security advisories section IS STILL EMPTY more than fifty-one hours after the stable 23.3.4 release of 9 September, and there has been no new commit on master since 4 September: five days after the incident there is still no formal written advisory on the software that made it possible. RE-CHECK AT 13:25 CEST (11:24 UTC) ON 11 SEPTEMBER 2026: nothing has changed in four and a half hours. The Liquid chain tip is block 4,052,617, 276 blocks in 276 minutes since the 06:48 UTC check, still exactly one block per minute. The actors' address is unchanged at 598.50049115 BTC across the same 297 confirmed transactions: no outgoing spend, no on-chain reply to the refusal to pay, and 36 transactions in the mempool against 34 this morning, still incoming dust only. Federation reserves are unchanged to the satoshi at 3,601.47203772 BTC across 590 transactions. Blockstream's status page has not moved since the 10:00 UTC statement of 10 September, with peg-outs suspended. The Elements security advisories are empty more than fifty-six hours after the stable 23.3.4 release, and there is no new commit on master since 4 September. The incident remains open and flagged as ongoing: peg-outs are disabled by official statement, the reserve is not restored, and a refusal to pay is not a return. RE-CHECK ON 12 SEPTEMBER 2026 AT 02:30 CEST (00:30 UTC): FOR THE FIRST TIME THE PEG SHORTFALL HAS A NUMBER, AND BLOCKSTREAM ITSELF PUBLISHES IT. Until now the peg coverage was a promise without figures: above it is written that «nobody has yet said who, how much and when». The how much now exists, and it does not come from a rumour but from the network's official explorer, liquid.network, operated by Blockstream, which exposes two public endpoints updated at every block. The first, /api/v1/liquid/reserves, reports 3,628.84415900 BTC in reserve, updated to Bitcoin block 966,583 at 00:21 UTC on 12 September. The second, /api/v1/liquid/pegs, reports 4,231.37422444 L-BTC outstanding, updated to Liquid block 4,053,416. The ratio between the two numbers is the peg's real coverage right now: 85.76%. The shortfall is 602.53006544 BTC. That missing amount corresponds almost exactly to what the actors of the theft have not returned: 602.53 against 598.50 BTC, a difference of four bitcoin. Put differently, and with no interpretation needed: today the reserve shortfall IS the loot still held by the actors, and the 10 September promise by chief executive Adam Back — «the 1:1 peg will be covered» — finally has a size, 602.5 bitcoin, but still has neither a name nor a date attached to it. The same endpoint allows the before and after to be measured: the monthly reserves series gives 4,216.6184 BTC on 1 August 2026, against today's 3,628.84. A NOTE ON PRECISION, because the difference matters. On 12 September CryptoSlate published the figure first, with coverage of «just 85%» and a shortfall of roughly 627 BTC, but computed it on the single Federation address that had been drained. That computation understates reserves by 27.37 BTC, because the Federation does not hold everything at one address. The number we publish is the aggregate one from the official explorer, verified by us directly against both endpoints: 85.76% and 602.53 BTC, not 85.15% and 627 BTC. THE REST OF TONIGHT'S CHECKS, all our own, move nothing. The network is working: Liquid chain tip at block 4,053,338, 343 blocks in 344 minutes since the 17:42 UTC check. The funds are not moving: the actors' address holds 598.50055229 BTC across 309 confirmed transactions, inspected one by one down to the fiftieth most recent without finding a single transaction spending from that address — the seven additional ones since this evening are incoming dust of 300 to 1,000 satoshi, and so are the 32 in the mempool. The Federation address has made no outgoing payment since 16:48 UTC on 6 September: that is more than five days, and it is the on-chain confirmation of what the status page states in words. That page is indeed unchanged since the 10:00 UTC statement of 10 September, with «Liquid» and «Public Bridge Nodes» still in Partial Outage and peg operations, PAK-authorized peg-outs included, declared suspended. On the official Elements repository the security advisories section IS STILL EMPTY sixty-eight hours after the stable 23.3.4 release of 9 September, and there is no new commit on master since 4 September. No reply from the actors, on-chain or elsewhere, more than eighteen hours after the public refusal to pay. Trezor still says «our third-party e-mail provider» without naming it, BitBox still speaks of a newsletter provider «very likely» compromised with no name, and Brevo's status page still declares that it is not aware of any issues affecting its systems. The incident remains open and flagged as ongoing. UPDATE OF 17-18 SEPTEMBER 2026 — FOR THE FIRST TIME SOMEONE SAYS WHAT THE PEG-OUT REOPENING DEPENDS ON. On 17 September at 21:05 UTC the network's official channel published its first update since 10 September and put in writing the condition nobody had stated so far: peg-outs will resume ONLY after full 1:1 BTC backing for LBTC has been confirmed and after all required software updates, testing and independent security reviews have been completed. No date: the statement explicitly says it is «not yet able to provide a firm date», and adds that the Liquid Federation members and Blockstream will share the plan and timing «as soon as they are finalized». The same statement confirms the figures: of the ~4,000 BTC that left on 6 September, 3,400 have been returned and «approximately 600 BTC remains unreturned», with recovery efforts still under way. ON THE POST-MORTEM: the root cause and the exploit path have been identified and the immediate fix is in the Elements v23.3.4 release, but the comprehensive technical report is merely announced, «as soon as it is available», and has not been published — on the official Elements repository the security advisories section, which we re-checked today via the API, IS STILL EMPTY nine days after the 9 September stable release. THE ECOSYSTEM IS COMING BACK IN PIECES, AND THE STATEMENT NAMES NAMES: Mifiel has resumed issuing and transacting its digital promissory notes, BTSE reports USDT-Liquid transfers re-enabled and the asset unaffected by the incident, Aqua reports Liquid asset transfers and peg-INS available and has switched on Indra, its swap between LBTC and Lightning BTC, though with «limited» liquidity, and SideShift has re-enabled cross-chain swaps for USDT and DEPIX on Liquid. Bull Bitcoin and the Blockstream App allow Liquid asset transfers again, but on those services the LBTC↔BTC and LBTC↔Lightning routes REMAIN CLOSED until peg-outs are restored: that is the practical measure of what it means, for anyone holding LBTC, that the exit tap is still shut. The network itself warns that availability varies by provider and must be confirmed through each provider's official channels. OUR OWN MEASUREMENT TODAY, 18 SEPTEMBER 2026 AT 12:24 UTC, DOES NOT MOVE BY A SINGLE SATOSHI. Reserves 3,632.22857869 BTC (bitcoin block 967,553) against 4,234.75864413 LBTC outstanding (Liquid block 4,062,754): coverage 85.77%, shortfall 602.53006544 BTC, identical to the satoshi at the eighteenth consecutive reading. The actors' address is not spending: 254 spent outputs for 2,818,049,176,338 satoshi, the same as in previous readings; the balance of 598.50434988 BTC grows only through incoming dust (53 mempool transactions for 26,399 satoshi in total). The Federation address holds 3,601.47207156 BTC across 597 transactions, likewise unchanged. @Blockstream has published nothing on the case since 11 September. The incident remains open and flagged as ongoing. UPDATE OF 2 OCTOBER 2026 — THE TECHNICAL POST-MORTEM EXISTS, AND IT IS OFFICIAL. Our 18 September update closed by saying Blockstream had published nothing on the case since 11 September: that sentence is no longer true and we correct it here. On 23 September 2026 the company published on its blog the «Liquid Network Security Incident Assessment», the technical assessment of the 6 September incident with root cause, exploit mechanics, timeline and the measures adopted. It is the authoritative source on this case and it replaces the Federation's 8 September report as the primary reference. THE ROOT CAUSE IS TWO DEFECTS, NOT ONE, AND THE SECOND SAT INSIDE THE FIX FOR THE FIRST. Both in the cache with which Elements nodes remember rangeproof verifications. Bug A, introduced on 25 April 2018: the cache key was computed as SHA256(nonce ‖ rangeproof ‖ value_commitment), LEAVING OUT the asset commitment and the scriptPubKey — so a validation result could be reused in a context where it did not hold. Bug B, born of the fix for the first: the fix concatenated the fields WITHOUT LENGTH PREFIXES, and the report writes that an attacker could therefore «truncate or extend the rangeproof, adjusting the scriptPubKey to compensate, and produce a transaction with an invalid rangeproof for which the validation cache would nonetheless assert validity». The mechanics of the attack: the actors crafted a transaction whose key fields produced a concatenation BYTE-FOR-BYTE IDENTICAL to that of an already-verified, legitimately cached proof — the same asset commitment and the same last byte of the destination script — and the cache, «recognising» a match, skipped the real verification. The fabricated rangeproof was never validated: it only had to resemble the key. THE OFFICIAL TIMELINE, WITH A SEQUENCE THAT MUST BE READ IN FULL. 2 August 2026: an external researcher reports Bug A to [email protected]. 3 August: Blockstream opens the fix for internal review and DEPLOYS IT TO PRODUCTION. 5 August: the fix is validated on testnet, and the test does NOT catch Bug B. 1 September: the Bug A fix is merged into the public Elements repository, and the report notes that «from this point, the code containing Bug B is publicly visible». 3 September: all internal items tracking the external reports and their remediation are marked resolved. 6 September at 13:53:10 UTC: the attack. At 14:05 the actors deposit 4,000 LBTC to SideSwap's peg-out; at 14:28:56 the Federation releases 3,996.02 BTC on Bitcoin; at 18:26 Blockstream halts the bridge nodes. 7 September at 01:09 emergency patch; at 16:09 the actors return 3,400 BTC. 8 September: the Bug B fix is merged after review. 9 September at 13:30 Elements v23.3.4 is publicly released, at 21:05 block production resumes. ⚠️ Mind how the 1 September point reads: the report says that from that moment the code containing Bug B was public, it does NOT say that publication is what allowed the actors to find it, and we do not claim so. THE REPORT'S FIGURES. ~4,000 unbacked LBTC created; 3,996.02 BTC out via SideSwap's peg-out and confirmed on Bitcoin; 3,400 BTC returned on 7 September; «approximately 602 BTC remains outstanding» and «approximately 602 BTC remains subject to ongoing recovery efforts»; the reserve fell from ~4,205 BTC to 197 BTC before the recovery. On restoration the report promises nothing: «as of the most recent public update (September 17, 2026), the recovery plan remains under active testing and is subject to revision». The document does NOT say that individual user balances were affected. THE FIVE ANNOUNCED MEASURES, which are the part of the report about the future rather than the past. 1) On consensus-critical issues, where more than one remediation exists «the approach providing the strongest structural safety guarantees will now be the default», with independent auditor review before release — the explicit lesson of Bug B. 2) Recurring code review on two tracks: a security scan on any change merged into a release branch, plus periodic review of critical consensus code EVEN WHEN IT HAS NOT BEEN TOUCHED. 3) Expanded adversarial testing: fuzzing, mutation testing, symbolic execution and, where applicable, formal verification of consensus-critical code, plus broader on-chain monitoring. 4) Defence-in-depth on context-sensitive caches, with a versioned schema tag and a mandatory context re-check at lookup time. 5) A dedicated BUG BOUNTY for Elements and the other critical open-source infrastructure the company maintains. WHAT THE NETWORK SAYS ON 28 SEPTEMBER, AND WHY IT MATTERS MORE THAN IT LOOKS. Status as of 28 September 2026, 05:48 UTC, published on 29 September: an «independent external security audit of Elements v23.3.4 is now under way», and in parallel the Liquid Federation is coordinating an update to the PAK list «including the replacement of existing entries and ensuring all peg out keys are properly secured in cold storage». In plain terms: the keys that authorise exits from Liquid are being CHANGED, not merely secured. The network closes with «we expect to share further updates on the path to resumption shortly»: no date, as has been the case since 10 September. OUR MEASUREMENT TODAY, 2 OCTOBER 2026 AT 11:35 UTC — NINETEENTH READING, AND NOTHING IS MOVING. Reserves 3,632.22855173 BTC (bitcoin block 969,581) against 4,234.75864413 LBTC in circulation (Liquid block 4,082,864): coverage 85.77%, shortfall 602.53009240 BTC. The LBTC in circulation are IDENTICAL TO THE SATOSHI to those of 18 September, which is independent proof that no peg-out has gone through in fourteen days; reserves are down by 2,696 satoshi, fee dust. The actors' address holds 598.50443510 BTC with 254 spent outputs, the same count as every previous reading: THEY HAVE SPENT NOTHING, and the balance grows only through incoming dust (1,454 transactions in all, 48 in the mempool for 21,995 satoshi). The Federation address holds 3,601.47204460 BTC. The incident stays open and flagged as ongoing: while peg-outs are closed, anyone holding LBTC cannot exit into bitcoin.

Who was hit

IDScan.net, US identity-document verification provider for venues, retailers and dispensaries (VeriScan platform)

Latest verified information

For five months an outsider had access to IDScan's VeriScan cloud platform. The company confirms that names, contact details, dates of birth and driver's licence, passport and other ID numbers may have been taken, but does not say how many people are affected. Journalist Brian Krebs, who verified samples, reports that a dark-web market offered more than 153 million US and Canadian driver's licence scans plus about 10 million ID cards. The FBI is investigating.

Latest verified information

Between 4 and 5 September 2026 an unauthorised party entered the network of DriveWealth, the New York broker-dealer that supplied Revolut with the infrastructure for US share trading, and exfiltrated personal data. Access was obtained through a social engineering campaign. On 24 September 2026 Revolut began emailing affected customers: these are European Economic Area users who traded US shares before December 2023, when data sharing with DriveWealth ended — the data was still being retained to meet regulatory requirements. For records linked to Revolut, the exposed information includes name, email address, phone number, postal address, employment information, country of citizenship, age, gender and part of the DriveWealth account number; in some cases the date of birth as well. According to DriveWealth's official notice, no passwords and no financial payment information such as credit card or bank account details were compromised, and identity documents were not compromised; the company further states that "no unauthorized brokerage account activity including trading, transfer, withdrawal, ACAT request, or balance or position alteration was identified". Revolut said its own systems, funds and customer accounts were not affected: the breach hit the supplier, not the bank. No figure for the number of Revolut customers involved has been published; DriveWealth's notice cites approximately 62,000 Rhode Island residents across its whole customer base, a figure that cannot be attributed to Revolut users alone. The same incident hit customers of the brokers Stake (notified on 21 September) and Hatch (on 22 September), which use the same infrastructure. It is the second episode in under two weeks to expose Revolut customer data, after the 11 September handover of identity documents and full transaction history to someone impersonating a government authority.

Latest verified information

On 11 March 2026 a customer complained to the Italian data protection authority (Garante) that they kept receiving marketing messages inside the bank's app although they had switched the setting off and had told customer service they objected, on 2 October and 9 December 2025. The promotional notifications continued anyway: at least ten of them between October 2025 and May 2026. In its defence the bank admitted the cause: the opt-out had been recorded by its internal systems but was never synchronised with the CRM unit that actually sends the messages. The authority held that recording a refusal in one database is not enough if the infrastructure that uses the data keeps operating as though the right had never been exercised. By decision no. 613 of 3 September 2026 — made public on 11 September — the Garante declared the processing unlawful for breach of Articles 5(1)(a), 12, 21 and 24 GDPR, ordered payment of EUR 5,508,000, required the bank to put in place technical and organisational measures adequate to support the exercise of data subject rights and to report back within 30 days, and ordered publication of the decision, partly in view of an earlier decision against the same company for related breaches. Two points change how the figure should be read. First, the findings concern ONE complainant and ten notifications, not a body of customers; the amount is large because Article 83(5) GDPR scales it to group turnover, not because the breach reached a large population. Second, this is not a data leak — no information is reported to have reached third parties. The case is not closed: the bank has 30 days to pay, may settle by paying half the fine, or may challenge the decision before the ordinary courts. For the individual complainant the defect appears fixed: since 13 May 2026 they no longer receive the notifications, and the bank says it has strengthened the alignment between opt-out requests and the sending platform.

Latest verified information

On 11 March 2026 a customer complained to the Italian data protection authority (Garante) that they kept receiving marketing messages inside the bank's app although they had switched the setting off and had told customer service they objected, on 2 October and 9 December 2025. The promotional notifications continued anyway: at least ten of them between October 2025 and May 2026. In its defence the bank admitted the cause: the opt-out had been recorded by its internal systems but was never synchronised with the CRM unit that actually sends the messages. The authority held that recording a refusal in one database is not enough if the infrastructure that uses the data keeps operating as though the right had never been exercised. By decision no. 613 of 3 September 2026 — made public on 11 September — the Garante declared the processing unlawful for breach of Articles 5(1)(a), 12, 21 and 24 GDPR, ordered payment of EUR 5,508,000, required the bank to put in place technical and organisational measures adequate to support the exercise of data subject rights and to report back within 30 days, and ordered publication of the decision, partly in view of an earlier decision against the same company for related breaches. Two points change how the figure should be read. First, the findings concern ONE complainant and ten notifications, not a body of customers; the amount is large because Article 83(5) GDPR scales it to group turnover, not because the breach reached a large population. Second, this is not a data leak — no information is reported to have reached third parties. The case is not closed: the bank has 30 days to pay, may settle by paying half the fine, or may challenge the decision before the ordinary courts. For the individual complainant the defect appears fixed: since 13 May 2026 they no longer receive the notifications, and the bank says it has strengthened the alignment between opt-out requests and the sending platform.

Who was hit

Users of Chrome and Chromium-based browsers

Latest verified information

Two flaws in Chrome's V8 JavaScript engine let a malicious web page run code inside the browser. Google confirmed both were already exploited and fixed them on September 3 and 8, the sixth and seventh Chrome zero-days of 2026. Google gave no details on attacks or victims; the flaws also affect Edge, Opera and other Chromium-based browsers.

Who was hit

MikroTik routers with SSH exposed to the internet

Latest verified information

A chain of flaws in the SSH service of MikroTik routers gives full control of the device without a password. CERT Polska saw successful attacks since at least September 2, with attackers creating an admin user named 'ops'; about 122,500 routers had SSH reachable from the internet. MikroTik shipped fixes on September 3, but one fix was incomplete and new versions were published on October 6.

Who was hit

Luminis Health, two hospitals in Maryland (US)

Latest verified information

After the attack, Anne Arundel Medical Center in Annapolis and Doctors Community Medical Center in Lanham sent ambulances with non-critical patients to other hospitals. The patient portal and phone lines were down and doctors worked on paper. For weeks, patients faced cancelled appointments and delayed test results. Systems came back online only around October 8, six weeks later. The network serves about 1.8 million people. It blames an 'unauthorized criminal actor' and has not said whether patient data was stolen.

Latest verified information

On 31 August 2026 security firm SlowMist flagged the exploitation of a Balancer V1-style pool: the attacker squeezed the pool's WBTC reserves down to a minimum and then minted pool tokens (BPT) by depositing a single satoshi, because the contract rounds down. Estimated loss ~$234,000. On 3 September Balancer sent an on-chain message to the addresses involved offering a path to return the funds, announcing it on its X account on 4 September; as of the verification date no return has been announced. It concerns V1 pools, the oldest architecture, not V3.

Latest verified information

On 28 Aug 2026 an attacker exploited a vulnerability in an outdated version of issuer Rain's Solana card contracts, withdrawing funds from users' card balances. Avici acknowledged the issue roughly two hours after the first theft; the AVICI token dropped 49% to an all-time low. Early onchain estimates put the loss above $1M (10,005 SOL plus USDC and USDT), but the official reconciliation Avici published on the evening of 28 Aug (22:44 CEST) revises the damage down to $500,859.22 across 1,685 affected users. Avici states the app's Solana and EVM wallets are self-custodial and were NOT touched: only the separate Solana contract holding the balance topped up onto the card was hit. The contract has been upgraded across all programs and no further unauthorized activity has been observed. Avici promised full reimbursement of every affected user and filed a report with the FBI's Internet Crime Complaint Center. On 29 Aug Avici declared refunds COMPLETED: full balance restored to every affected user, plus an extra 10% cashback on the amount withdrawn. Solana contract upgraded, no further related activity observed.

Latest verified information

On 28 Aug 2026 Rain's monitoring systems detected a vulnerability affecting “a small number of programs” running an outdated version of Rain's Solana contracts; other programs were not impacted. Rain states (X, 28 Aug, 22:26 CEST) it upgraded all programs to the current contracts, closing the flaw, engaged third-party forensics and will work with law enforcement and regulators; full reimbursement of all affected users promised. Rain has published no total of its own: the only official figures come from the reconciliations of the two programs that declared themselves hit — Avici (28 Aug, $500,859.22 across 1,685 users) and Tria (29 Aug, $431,945 across 636 users), for $932,804 and 2,321 users in total. Both stress that self-custodial wallets were untouched: only the separate Solana contract holding the balance topped up onto the card was hit. On 29 Aug Rain stated that ALL impacted cardholders have been repaid in full, with funds in users' contracts and every program upgraded and operating as expected; Avici and Tria separately confirmed refunds completed, each with an extra 10%. Forensics continue. No further card program has declared itself affected.

Latest verified information

On 28 Aug 2026 Tria reported unauthorized withdrawals of USDC/USDT topped up to the Solana card balance, “across all Rain program cards”. The cause is the vulnerability in an outdated version of issuer Rain's Solana contracts, confirmed by Rain the same day (contracts upgraded across all programs, flaw closed, no further unauthorized activity observed). On 29 Aug (12:47 CEST) Tria published its reconciliation: 636 users affected for $431,945 in card balances. The Tria wallet was never affected — it is self-custodial and stayed under the user's control — and assets held in the wallet on EVM, Aptos, Solana and other chains are untouched, as are futures and earn: only the separate Solana contract receiving card top-ups was hit. On the evening of 29 Aug (20:58 CEST) Tria confirmed that every affected user HAS RECEIVED a full refund, plus an additional 10% each.

Latest verified information

On 27 Aug 2026 a customer, Douglas Kim, filed a proposed nationwide class action against Ledger SAS in a New York federal court, seeking at least $500 million in damages. The complaint does not describe a new breach: it challenges how the company handled the known ones — the 2020 data leak (over 270,000 customers, with names, addresses and phone numbers) and the December 2023 compromise of the Ledger Connect Kit library — alleging Ledger downplayed the incidents, was slow to notify customers and failed to strengthen its defences. The plaintiff says $1,948,074 in crypto assets were stolen from him after scammers, using his leaked data, impersonated Ledger in February 2025. ⚠️ these are allegations in a one-sided filing, not facts established by a court, and the case has only just begun. Ledger has not commented publicly and no official statement is on record. The 2026 leak through its Global-e partner is not covered by this suit.

Latest verified information

On 27 Aug 2026 an attacker manipulated the price of the illiquid MAMO token used as collateral on Moonwell's Base market. Per the official post-mortem on the governance forum (Anthias report, evidence cutoff Base block 50,524,962, 27 Aug 14:01 UTC): starting from $1.947M in USDC, they sent 53.4M MAMO directly to the mMAMO contract, inflating the exchange rate ~3.68x without tripping supply caps, then pushed the oracle price from $0.0106 to $0.43 by buying MAMO into thin liquidity; they borrowed $11,028,762 across cbBTC, WETH, USDC and wstETH and exfiltrated $8.728M in DAI to Ethereum (estimated net gain $6.785M). Neither cryptography nor contract code was breached: this was an economic attack on the oracle. Liquidators recovered nearly all mMAMO collateral (735.6M tokens), but roughly $9.1M of residual bad debt remains on the protocol's books. As an emergency measure Moonwell set the borrow caps of ALL Core Markets on Base to 1 wei (new borrowing effectively frozen) along with the MAMO and WELL supply caps. On 28 Aug the team retained security firm ZeroShadow for recovery efforts. What matters for the card: its spend-against-collateral feature relies on borrowing in that same Moonwell Base market, frozen for as long as the caps stay at 1 wei. Several independent outlets note this is the protocol's third security incident in 11 months.

Who was hit

Boston Scientific, US medical device maker

Latest verified information

The attack on IT systems halted ordering, shipping and production. The CEO said all plants and distribution centers worldwide were shut down. Sterilization facilities restarted in early September and full restoration was announced around September 9. Some hospitals ran short of products and bought from other suppliers. Implanted cardiac devices kept working normally. The company told the SEC the incident will have a material impact on its 2026 results and that it will miss its sales guidance, but gave no figure. The attacker has not been identified.

Latest verified information

On 16 Aug 2026 SafePal disclosed a data breach caused by an authorization flaw in a third-party order-tracking plug-in on its e-commerce site: by manipulating the order number a user could view other customers' order data (a separate misconfiguration also prevented data cleanup between September 2025 and April 2026). Exposed data included names, email addresses, shipping addresses, phone numbers and purchase information of customers who ordered between 2 Mar 2025 and 11 Apr 2026. Seed phrases, private keys, passwords, bank details, card numbers, government IDs and funds were NOT exposed: wallet (self-custody) security remained intact. SafePal patched the flaw, cut data retention to 90 days, engaged an independent security firm, removed 30+ fraudulent sites/phishing links and notified customers by email. ⚠️ The stolen data is being advertised for sale on a cybercrime forum: the risk of targeted phishing is real.

Who was hit

MyDr, electronic medical-record software used by about 12,000 healthcare facilities in Poland

Latest verified information

Digital Affairs Minister Krzysztof Gawkowski confirmed the theft of more than 2 TB of data from MyDr covering nearly 19 million people. It includes names, PESEL national ID numbers, phone numbers, emails and health data such as appointments and prescriptions. Prime Minister Tusk said the aim was to extort a ransom from the company. In mid-August the government said the data had not been published or offered for sale. Poland's cybercrime bureau (CBZC) is investigating.

Who was hit

Taiwanese government agencies; the nuclear safety agency and at least 7 energy companies were also targeted

Latest verified information

Over 4 days in July the agents compromised at least 85 government user accounts and took more than 2,500 personnel records, then expanded to the nuclear safety agency and at least 7 energy companies. On August 13 the digital ministry confirmed the attack came from overseas and that affected agencies had completed their response. Dream does not attribute it, but the documentation points to a Chinese-language operator.

Latest verified information

ShipMonk, the logistics provider that ships Trezor orders, was breached on 6 August 2026 through a vulnerability in the third-party analytics platform Metabase, and on 10 August notified Trezor of unauthorised access to the systems holding order data. On 13 August Trezor disclosed the incident: 13,689 customers affected, of whom 11,742 had full name, email, phone number and shipping address exposed and 1,947 had partial exposure (name, city, email), covering orders delivered between 10 May and 8 August 2026 in the United States, United Kingdom, Sweden, Colombia, Brazil, ITALY and Portugal. On 2 September ShipMonk told Trezor the stolen material also contained order data from an earlier partnership between November 2019 and August 2021, which under the contract and the retention policy should have been deleted: on 4 September Trezor updated the notice, adding about 67,000 US customers with full exposure (name, email, phone, shipping address, order number), for a total of roughly 80,700 people. Trezor states that its own systems, devices, private keys and wallet backups were untouched, and says it had repeatedly received written confirmation from ShipMonk that the historical data had been deleted — a deletion that had not happened. The risk is not to the funds themselves but to the people: the list ties a name, phone number and home address to someone who owns a hardware wallet, the same raw material that after the 2020 Ledger breach fuelled years of targeted phishing, fake letters and physical-safety threats.

Who was hit

Developers and companies using npm (JavaScript) packages

Latest verified information

On August 4 an attacker took over the GitHub account of the keyv maintainer and published versions carrying ChainDrop, a Shai-Hulud worm variant that steals tokens and cloud keys and republishes itself into other packages. In under four hours more than 440 npm packages were infected; Singapore's CSA counts over 1,300 compromised versions, with about 2 billion monthly downloads. The poisoned versions carried valid provenance because they were published through the projects' own GitHub workflows.

Latest verified information

Since firmware 4.0.0 (March 2021) seed generation skipped the hardware randomness generator and fell back to a predictable software PRNG: effective entropy ~40 bits on Mk2/Mk3 (fw 4.0.1–4.1.9), ~72 bits on Mk4/Mk5/Q. Keys were derivable remotely, with no physical access to the device. Coinkite advisory on 30 Jul 2026 (last updated 1 Aug). The first wave on 30 Jul drained ~1,082 BTC (~$70M) from ~1,196 addresses in ~41 minutes; further waves followed, four in total. Figures grew at each check: ~$89M from ~4,585 addresses as of 2 Aug, then ~1,816 BTC (~$116M) from over 5,200 addresses per TRM Labs' 5 Aug analysis, which warns they should be treated as preliminary (funds still moving, victims may surface for months); some outlets reported higher estimates, up to ~$130M. It is the largest hardware-wallet theft of 2026. Fixed firmware shipped within ~24h (Mk3 4.2.0+, Mk4/Mk5 5.6.0+, Q 1.5.0Q+, Edge 6.6.0X/QX+), but updating does NOT repair existing seeds: anyone who generated their seed on-device must create a new one and migrate funds. Seeds from ≥50 dice rolls or imported elsewhere are unaffected; a BIP-39 passphrase lowers the risk. TAPSIGNER, OPENDIME and SATSCARD not affected. No recovery of stolen funds and no reimbursement plan announced. As of 3 Sep 2026 Galaxy Research's consolidated tally attributes 1,789.28 BTC to the flaw (~$114.7M at the value when stolen) across 8,865 addresses: slightly fewer BTC but nearly twice the addresses of TRM's 5 Aug estimate, meaning the pool of victims widened. On 2 Sep 2026 the third-wave attacker moved funds for the first time, converting roughly 10% of that wave's haul into ETH through the cross-chain DEX THORChain (announced by Alex Thorn, Galaxy Research, at 01:46 on 3 Sep): these are the first bitcoin to leave the original addresses of any of the three waves Galaxy tracks. About 90% of the third wave is still untouched, some swaps failed and were retried, and Galaxy shared the new Ethereum address with law enforcement and with firms monitoring the stolen funds. On 31 Aug 2026 at 20:57 UTC a honeypot wallet from the public cktripwire.com monitoring project was also swept, one carrying 12.9 bits of added entropy — five dice rolls (TXID 276e8f16732cbcdc02b0ca2e8fa9427ae7fbce053f3c784142c9fe2ed30ed887, verifiable onchain): a direct measurement of how far the attacker's key grinding reaches, confirming that a handful of dice rolls is not enough; as of the same date, honeypots with 16 or more bits of added entropy remain untouched.

Latest verified information

From 1 July 2026 new orders, deposits, sign-ups and staking/Earn products are halted for EU residents, Italy included; withdrawals remain open and funds accessible. Binance withdrew its Greek MiCA application on 24 June 2026 and says it will seek authorisation in France.

Latest verified information

This is not an attack: it is the move to MiCA, and for anyone collecting money through this gateway it matters more than an attack. In an update signed by CEO Max Krupyshev and published on the official site of the CryptoProcessing by CoinsPaid brand, the company states that Dream Finance OÜ's application for authorisation as a Crypto-Asset Service Provider (CASP) "remains under review", and that the company "has restricted its activities in line with the approach published by the Estonian Financial Supervision and Resolution Authority following the end of the transitional period". On the Lithuanian subsidiary the wording is blunter: "Dream Finance UAB (Lithuania) has temporarily suspended the provision of all crypto-asset-related services, including the registration of new clients, the execution of transactions, and the conclusion of new contracts." WHAT THIS MEANS IN PRACTICE. On the Lithuanian entity no accounts are opened, no contracts are signed and — per the company's own text — no transactions are executed. On the Estonian entity activity continues in restricted form: no new clients, no new contracts, no expansion of services to existing clients, no marketing of regulated services in the European Economic Area, pending the authority's decision. THE DATE AND THE STATUS. The date is that of the official update, 30 June 2026: the company does not state the day the suspension began, and we do not invent one. We opened the official page on 26 September 2026 and the text is still the same, in the present tense: no resumption announced, no authorisation decision made public. We record it as "open" rather than as an emergency in progress — it is a regulatory transition, not an event unfolding — but it remains a live constraint on the service, not a historical footnote.

Latest verified information

On 17 June 2026 Deel confirmed that an unauthorised party had accessed contact and commercial information held in its CRM. The public notice came on 26 June 2026 on the official blog. The access did not go through the Deel platform: it happened — in the company's words — “through a compromised connection with Klue, a third-party software provider that integrated with our CRM”. WHAT GOT OUT. Deel describes the material as “public, business contact, and commercial” information used by its sales and marketing teams: names, business email addresses, job titles, phone numbers and business details. To these the company adds, in its own words, “a very limited amount of personal data synced to our CRM”: that “very limited” is not quantified, and neither is the number of customers or partners involved. The platform, payroll and the HR data of workers managed through Deel are not reported as affected. WHAT DEEL DID. Disconnected the vendor and revoked its access, revoked active user sessions and removed older access tokens, engaged independent cybersecurity experts to validate the investigation, engaged external counsel, increased monitoring across systems, engaged with the relevant data protection authorities and set up a dedicated mailbox ([email protected]). The page states it will be updated as the investigation progresses. ⚠️ WHY IT MATTERS MORE THAN THE WORD “B2B” SUGGESTS. This is professional contact data belonging to the people who handle contracts and payroll: exactly the material needed to build a credible payment request. Deel says so itself, advising recipients to be wary of unexpected communications referencing Deel, their organisation, contracts, invoices, account information or payment requests, and not to change payment instructions without independent verification. ⚠️ Third-party phishing is not an incident of the provider — but here the risk stems from a data leak at the provider, and it is the provider itself that discloses it. THE UPSTREAM CAUSE, NOW DOCUMENTED BY KLUE (verified 28/9/2026). Deel had referred generically to “a compromised connection”. The vendor has now published its own account: Klue says it identified unauthorised activity in its integration infrastructure on 12 June 2026, where an attacker exploited “a compromised legacy credential associated with an integration service” to obtain OAuth tokens, and used those tokens to reach connected customer environments — Salesforce among them. Klue states that content stored inside its own platform was not impacted, engaged CrowdStrike for the investigation, involved law enforcement, and calls the event “a deliberate criminal act”. Neither company has published a number of affected customers. ⚠️ AND IT IS NOT AN ISOLATED CASE: DEEL IS ONE VICTIM AMONG MANY. That was the question left open by the previous run, and the answer is yes. The Klue incident is a multi-victim supply-chain compromise: OneTrust, Recorded Future, Huntress, Jamf and LastPass, among others, have each published their own notice. Two practical consequences for anyone using Deel. First, the mechanism is not a stolen Deel password, it is OAuth tokens belonging to an integration — access that was already authorised and keeps working until someone revokes it; if your organisation connects third-party tools to its CRM, that is the surface to review, not the password. Second, data on the same victim may have left through several vendors in the same period, so an attempted scam can appear better informed than Deel's own notice alone would suggest. STATUS. `risolto: false`: the compromised connection was closed and tokens revoked, but data that has left cannot be pulled back, the count of people affected has not been published and the investigation is declared ongoing. `in_corso: false`: no access is reported to be still under way.

Latest verified information

On 10 June 2026 an attacker withdrew **1.34 million dollars** — 150,177 RAY, 5,603 SOL and 893,700 USDC — from **five pools** of the **AMM V3** program, the automated market maker version Raydium had **retired in 2021**. RAY-SOL and USDC-RAY were among the pools hit. The flaw is of a simplicity that explains why years of audits are not enough when old code stays alive: on withdrawal the legacy program checked the *amount* of LP tokens but **not the address of the mint** they came from. The attacker created an arbitrary SPL mint with no link to any real pool, issued **a single unit** of it and called the old contract's withdraw function, bypassing the proportion checks and taking the entire liquidity. No key compromised, no current contract touched. The official Raydium Infra account acknowledged it the same day: «Raydium is aware of an exploit involving unauthorized removal of liquidity from its legacy AMM V3 program which was previously phased out in 2021. No current users of Raydium are affected by this exploit or would have been able to interact with these pools through the UI». The company stated that **the treasury will fully cover** the losses of the liquidity providers left in those pools, and opened a security review. ⚠️ This is what keeps the incident open: four months on, **no source, Raydium included, has published confirmation that the refunds were actually paid** — no timeline was disclosed at the time of the announcement. The usual rule applies: a promise of a refund is not a refund, and until the repayment is stated in the past tense the incident stays unresolved. The 2022 precedent, where Raydium did see compensation through, counts in its favour but does not replace verification.

Latest verified information

On 1 June 2026 one or more attackers exploited a signature-check flaw in the Zodiac modules (Delay and Roles) used by Gnosis Pay card accounts and queued withdrawals from accounts they did not own. They took about $1.5 million, with about $300,000 more left inaccessible, across 5,281 wallets. Gnosis Pay took cards offline, fixed the modules with a ChainSecurity review and restored services between 3 and 7 June. According to the official post-mortem of 3 July, Gnosis covered the losses and no user lost funds.

Latest verified information

US District Court, Northern District of California: the pen-register claim under the California Invasion of Privacy Act was allowed to proceed; the wiretapping and common-law claims were dismissed with leave to amend. Case pending.

Latest verified information

⚠️ Perimeter first: this breach concerns **SoFi Securities (Hong Kong) Limited**, the subsidiary offering investment and securities services to customers in the Asian region, not the US neobank described in this entry — which operates in the US only. It is here because it is the group's second confirmed security incident in four months, not because it touches users of the American account. The facts: SoFi confirmed unauthorized access to a database at SoFi Securities (Hong Kong) Limited that occurred **through a third-party vendor**. Discovery is dated 30 April 2026; customer notification and press coverage come on 8 June 2026. The company said it engaged external cybersecurity professionals and advised customers to enable two-factor authentication, monitor their accounts and stay alert to phishing attempts. What was not said is the most relevant part, and is recorded as such: SoFi **did not disclose the vendor's name**, **did not state how many customers were involved**, did not list the categories of data exposed, and declined to answer further questions. At the time of disclosure it stated: «We do not yet have complete information about the scope and impact of the incident». No definitive count has been published since, nor the start date of the unauthorized access: this is why the date on the entry is that of **discovery**, the only certain one. The incident stays open for that reason, not because something is happening right now: without a figure and without the data categories, a Hong Kong customer has no basis to know whether they are among those affected.

Latest verified information

By decision no. 237 of 17 Apr 2026 (announced 20 Apr) the Italian Data Protection Authority fined PostePay S.p.A. €5,877,000 and Poste Italiane €6,624,000 (over €12.5m total) for unlawfully processing the data of millions of users via the ThreatMetrix component embedded in its apps — including the Postepay app — deemed excessively invasive relative to the anti-fraud purpose, with shortcomings on notice, DPIA, security measures and retention. On 17/7/2026 an interim order of the Rome Court suspended the decision's enforceability, and the authority temporarily removed it from its website; the opposition proceedings are pending.

Latest verified information

The authority fined Poste Italiane and PostePay S.p.A. (issuer of the Postepay Green) over EUR 12.5 million in total (EUR 5.877 million on PostePay according to press reports). The reason is the ThreatMetrix anti-fraud component, which on the BancoPosta and PostePay Android apps collected data on installed and running apps, following 140 reports and 12 complaints since April 2024. The scope covered all PostePay Android app users, the channel used to manage PostePay cards, Green included (Parental Control). On 17 July 2026 an interim order of the Rome Court suspended the decision's enforceability, and the decision was removed from the authority's website. The opposition proceedings are pending.

Latest verified information

Penalty on Poste Italiane and PostePay for using the ThreatMetrix anti-fraud tool, which detected the apps installed on customers' phones without an adequate legal basis. Violations found under Articles 5, 6, 13, 25, 28 and 35 GDPR, following 140 reports and 12 formal complaints. The split of the amounts (EUR 5.877 million to PostePay, EUR 6.624 million to Poste Italiane) comes from press reports, not from the official text. On 17/7/2026 an interim order of the Rome Court suspended the decision's enforceability, and the authority temporarily removed it from its website; the opposition proceedings are pending.

Latest verified information

The Italian Competition Authority fined the group EUR 11.5 million in total: EUR 5m for failing to disclose the extra costs and limits of “commission-free” investing, including fractional shares; EUR 5m for aggressive practices in suspending, limiting and blocking payment accounts, with insufficient pre-contractual information, no advance notice, no chance to respond and no adequate assistance; EUR 1.5m for unclear information on the requirements and timeframe to obtain an Italian IBAN instead of a Lithuanian one. Revolut said it disagrees with the findings and will appeal.

Latest verified information

On 1 Apr 2026 Drift Protocol lost $295.7M of user funds in roughly 12 minutes across 31 withdrawals. Per TRM Labs' reconstruction the attack had been staged for weeks: from 11 Mar the infrastructure funds were withdrawn from Tornado Cash; between 23 and 30 Mar the attackers created Solana "durable nonce" accounts to pre-sign delayed transactions and socially engineered Security Council signers into approving hidden admin authorisations; on 27 Mar Drift had removed the Security Council timelock, erasing the detection window. In parallel they manufactured a fictitious asset (CVT, CarbonVote Token, minted 12 Mar with 750M units), pinned at about $1 via a small Raydium pool and wash trading and fed through an oracle they controlled: Drift's oracles accepted it as collateral worth hundreds of millions. On 1 Apr the pre-signed transactions deposited the fake collateral, raised withdrawal limits and drained the vaults; most of the proceeds were bridged to Ethereum within hours. Drift suspended deposits and withdrawals; the DRIFT token fell more than 40%. Forensics firm Mandiant attributed the attack to UNC6862, a North Korean threat group with direct ties to other state-sponsored actors (attribution reported by Drift itself in its official 3 Jun 2026 update). Recovery: Drift issued a dedicated recovery token (a transferable SPL token, separate from the DRIFT governance token), 1 unit = $1 of verified loss, against $295,426,725.97 in confirmed losses. The recovery pool started from the $3.8M left in the protocol and is meant to grow through quarterly exchange revenue plus announced commitments of up to $127.5M from Tether and up to $20M from other partners; redemption only opens once the pool exceeds $5M, and anyone redeeming early takes a pro-rata share of whatever the pool holds at that moment and forfeits the rest of their claim. The relaunch was made conditional on two independent audits (Ottersec and Asymmetric) and on a new community-governed multisig, with dedicated signing devices and timelocks on all critical administrative actions. On 1 Jul 2026 the protocol was rebranded Velocity and restarted as a perps-only exchange settled in USDT (no longer USDC), backed by a Tether credit line. As of the verification date users are NOT repaid: the latest official recovery update is the one dated 3 Jun 2026, which announces neither that the $5M threshold was reached nor that redemptions opened, deferring "detail on recovery mechanics and timing" to later communications. Drift BET runs on the same infrastructure as the protocol that was hit: the suspension of deposits and withdrawals and the subsequent reboot halted the prediction markets too, and the settlement migration from USDC to USDT applies to the whole platform.

Latest verified information

On 1 Apr 2026 Drift Protocol lost $295.7M of user funds in roughly 12 minutes across 31 withdrawals. Per TRM Labs' reconstruction the attack had been staged for weeks: from 11 Mar the infrastructure funds were withdrawn from Tornado Cash; between 23 and 30 Mar the attackers created Solana "durable nonce" accounts to pre-sign delayed transactions and socially engineered Security Council signers into approving hidden admin authorisations; on 27 Mar Drift had removed the Security Council timelock, erasing the detection window. In parallel they manufactured a fictitious asset (CVT, CarbonVote Token, minted 12 Mar with 750M units), pinned at about $1 via a small Raydium pool and wash trading and fed through an oracle they controlled: Drift's oracles accepted it as collateral worth hundreds of millions. On 1 Apr the pre-signed transactions deposited the fake collateral, raised withdrawal limits and drained the vaults; most of the proceeds were bridged to Ethereum within hours. Drift suspended deposits and withdrawals; the DRIFT token fell more than 40%. Forensics firm Mandiant attributed the attack to UNC6862, a North Korean threat group with direct ties to other state-sponsored actors (attribution reported by Drift itself in its official 3 Jun 2026 update). Recovery: Drift issued a dedicated recovery token (a transferable SPL token, separate from the DRIFT governance token), 1 unit = $1 of verified loss, against $295,426,725.97 in confirmed losses. The recovery pool started from the $3.8M left in the protocol and is meant to grow through quarterly exchange revenue plus announced commitments of up to $127.5M from Tether and up to $20M from other partners; redemption only opens once the pool exceeds $5M, and anyone redeeming early takes a pro-rata share of whatever the pool holds at that moment and forfeits the rest of their claim. The relaunch was made conditional on two independent audits (Ottersec and Asymmetric) and on a new community-governed multisig, with dedicated signing devices and timelocks on all critical administrative actions. On 1 Jul 2026 the protocol was rebranded Velocity and restarted as a perps-only exchange settled in USDT (no longer USDC), backed by a Tether credit line. As of the verification date users are NOT repaid: the latest official recovery update is the one dated 3 Jun 2026, which announces neither that the $5M threshold was reached nor that redemptions opened, deferring "detail on recovery mechanics and timing" to later communications.

Latest verified information

The Federal Court penalised Oztures Trading (Binance Australia Derivatives) in an ASIC action: between July 2022 and April 2023 over 85% of Australian clients were classified as wholesale, exposing 524 retail investors to crypto derivatives without the required protections. That group incurred A$8.66m in trading losses and paid A$3.89m in fees; about A$13.1m in compensation had already been paid in 2023.

Latest verified information

Between 21 February 2022 and 24 April 2024 an employee at one of the bank's branches consulted the banking information of 3,573 customers with no professional reason, in more than 6,600 separate accesses; politically exposed persons were among the profiles consulted. For over two years the bank's internal controls flagged nothing. The Italian data protection authority (Garante) found the technical and organisational measures inadequate overall — an operating model that let staff query the entire customer base with no restriction and no reinforced controls on the most exposed profiles — and also faulted the incomplete and late breach notification and the notice to affected customers, which came only after the authority's order of 5 November 2024. By decision no. 208 of 26 March 2026 the Garante imposed an administrative fine of EUR 31.8 million, among the largest ever issued in Italy and the largest in the banking sector. The bank challenged it: on 13 July 2026 the Court of Turin suspended the decision's enforceability on an interim basis, and the Garante accordingly removed the document from its website for the time being; the opposition proceedings are pending. The distinction matters: the fine is not final, the data breach is — the authority itself established it back in November 2024, when it ordered the bank to inform the customers involved.

Latest verified information

Between 21 February 2022 and 24 April 2024 an employee at one of the bank's branches consulted the banking information of 3,573 customers with no professional reason, in more than 6,600 separate accesses; politically exposed persons were among the profiles consulted. For over two years the bank's internal controls flagged nothing. The Italian data protection authority (Garante) found the technical and organisational measures inadequate overall — an operating model that let staff query the entire customer base with no restriction and no reinforced controls on the most exposed profiles — and also faulted the incomplete and late breach notification and the notice to affected customers, which came only after the authority's order of 5 November 2024. By decision no. 208 of 26 March 2026 the Garante imposed an administrative fine of EUR 31.8 million, among the largest ever issued in Italy and the largest in the banking sector. The bank challenged it: on 13 July 2026 the Court of Turin suspended the decision's enforceability on an interim basis, and the Garante accordingly removed the document from its website for the time being; the opposition proceedings are pending. The distinction matters: the fine is not final, the data breach is — the authority itself established it back in November 2024, when it ordered the bank to inform the customers involved.

Latest verified information

Between 21 February 2022 and 24 April 2024 an employee at one of the bank's branches consulted the banking information of 3,573 customers with no professional reason, in more than 6,600 separate accesses; politically exposed persons were among the profiles consulted. For over two years the bank's internal controls flagged nothing. The Italian data protection authority (Garante) found the technical and organisational measures inadequate overall — an operating model that let staff query the entire customer base with no restriction and no reinforced controls on the most exposed profiles — and also faulted the incomplete and late breach notification and the notice to affected customers, which came only after the authority's order of 5 November 2024. By decision no. 208 of 26 March 2026 the Garante imposed an administrative fine of EUR 31.8 million, among the largest ever issued in Italy and the largest in the banking sector. The bank challenged it: on 13 July 2026 the Court of Turin suspended the decision's enforceability on an interim basis, and the Garante accordingly removed the document from its website for the time being; the opposition proceedings are pending. The distinction matters: the fine is not final, the data breach is — the authority itself established it back in November 2024, when it ordered the bank to inform the customers involved.

Latest verified information

Between 21 February 2022 and 24 April 2024 an employee at one of the bank's branches consulted the banking information of 3,573 customers with no professional reason, in more than 6,600 separate accesses; politically exposed persons were among the profiles consulted. For over two years the bank's internal controls flagged nothing. The Italian data protection authority (Garante) found the technical and organisational measures inadequate overall — an operating model that let staff query the entire customer base with no restriction and no reinforced controls on the most exposed profiles — and also faulted the incomplete and late breach notification and the notice to affected customers, which came only after the authority's order of 5 November 2024. By decision no. 208 of 26 March 2026 the Garante imposed an administrative fine of EUR 31.8 million, among the largest ever issued in Italy and the largest in the banking sector. The bank challenged it: on 13 July 2026 the Court of Turin suspended the decision's enforceability on an interim basis, and the Garante accordingly removed the document from its website for the time being; the opposition proceedings are pending. The distinction matters: the fine is not final, the data breach is — the authority itself established it back in November 2024, when it ordered the bank to inform the customers involved.

Latest verified information

Between 21 February 2022 and 24 April 2024 an employee at one of the bank's branches consulted the banking information of 3,573 customers with no professional reason, in more than 6,600 separate accesses; politically exposed persons were among the profiles consulted. For over two years the bank's internal controls flagged nothing. The Italian data protection authority (Garante) found the technical and organisational measures inadequate overall — an operating model that let staff query the entire customer base with no restriction and no reinforced controls on the most exposed profiles — and also faulted the incomplete and late breach notification and the notice to affected customers, which came only after the authority's order of 5 November 2024. By decision no. 208 of 26 March 2026 the Garante imposed an administrative fine of EUR 31.8 million, among the largest ever issued in Italy and the largest in the banking sector. The bank challenged it: on 13 July 2026 the Court of Turin suspended the decision's enforceability on an interim basis, and the Garante accordingly removed the document from its website for the time being; the opposition proceedings are pending. The distinction matters: the fine is not final, the data breach is — the authority itself established it back in November 2024, when it ordered the bank to inform the customers involved.

Latest verified information

Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.

Latest verified information

Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.

Latest verified information

Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.

Latest verified information

Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.

Latest verified information

Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.

Latest verified information

Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.

Latest verified information

On 1 March 2026 Bitrefill was attacked. In its official report of 17/3/2026 the company traces the chain: initial access came from a compromised employee laptop, from which a legacy credential was exfiltrated; that credential gave access to a snapshot containing production secrets, and from there the attackers escalated to the broader infrastructure, parts of the database and certain wallets. The incident was detected after noticing suspicious purchasing patterns with some suppliers: gift card stock and supply lines were being exploited and, at the same time, some hot wallets were being drained to attacker-controlled addresses. Bitrefill took all systems offline as its containment response. The company attributes the attack to the North Korean Lazarus/Bluenoroff group based on modus operandi, malware, on-chain tracing and IP and email addresses already seen in earlier attacks. On the data side: Bitrefill states that customer data was not the target and that there is no evidence of the entire database being extracted, but it confirms that around 18,500 purchase records were accessed, containing email addresses, the crypto payment address and metadata including the IP address; for about 1,000 purchases a name had also been required, encrypted in the database, which the company nonetheless treats as potentially accessed because the attackers may have obtained the encryption keys — those customers were notified individually by email. Bitrefill does not require mandatory KYC and verification data, when provided, is held only with its external KYC provider. The amount stolen has never been made public, neither by the company nor by the press. User balances were not affected and the company stated it will absorb the losses from its operational capital, declaring itself well funded and profitable for several years. Systems, payments and volumes are back to normal.

Latest verified information

On 15 Feb 2026 at 18:01 UTC the execution of proposal MIP-X43, which enabled Chainlink OEV wrapper contracts across the Base and Optimism Core Markets, introduced a faulty cbETH oracle configuration: instead of multiplying the cbETH/ETH feed by the ETH/USD price, the system used the raw exchange rate, pricing cbETH at about $1.12 instead of roughly $2,200. Per the official post-mortem published on the governance forum by Anthias Labs (the protocol's risk manager), liquidation bots immediately targeted cbETH-collateralised positions, seizing 1 cbETH for about $1 of debt repaid: many users lost all their collateral while still carrying residual debt, and a smaller number of addresses exploited the distorted price to massively over-borrow cbETH. The discrepancy was detected at 18:05 UTC and the cbETH market's supply and borrow caps were cut to 0.01, but liquidations continued because fixing the oracle required the 5-day governance vote and timelock. The consequences are not closed: in the official reserve report of 24 Aug 2026 the cbETH market on Base is the largest source of bad debt, $1,768,665 against reserves of 2.81 cbETH (~$7,361) and a repayment plan allocating $0.00 to cbETH. Reserve-funded repayment (repayBorrowBehalf) covers only borrowers liquidated between 14 and 18 February: users who merely supplied cbETH without borrowing fall under no stated plan and, on the official forum, still report being unable to withdraw (thread opened 23 Aug, still active on 5 Sep 2026). For the card the link is the same as with the MAMO incident: credit spending relies on Moonwell's Base markets, and cbETH is one of them.

Latest verified information

On 9 February 2026 the Washington State Department of Financial Institutions entered a Consent Order (No. C-25-3892-26-CO01) against CoinZoom, Inc. (NMLS #1735216). It closes the proceeding opened by Statement of Charges No. C-25-3892-25-SC01 of 27 August 2025, in which the regulator had announced its intent to revoke the licence. Primary source: both documents, published in full by the regulator and read by us. WHAT IT ORDERS. Cease and desist from violations of the Uniform Money Services Act; surrender of the money transmitter licence within 90 days of entry; a ban on holding itself out as an approved money transmitter for state residents without a new licence; an obligation to notify all customers in the state within 10 days of the licence surrender, with clear instructions on how to withdraw funds and close accounts; remittance of unclaimed funds to the state's Unclaimed Property Program within 90 days; a bar from the money transmission industry in Washington until 9 February 2029; a $150,000 fine, of which $50,000 is stayed until 9 February 2029 and cancelled on that date if the order is complied with; plus $4,170 in investigation fees. The company admits no wrongdoing and waives its hearing: that is the standard formula in these settlements, and it is reported as such. THE ALLEGATION THAT ACTUALLY MATTERS. These are not filing delays. The regulator's examination covered 1 April 2022 to 31 December 2024 and the first charge is about capital: in 2022, 2023 and 2024 the company was required to maintain a tangible net worth of $3,000,000 and "maintained less than one-third of that requirement in each of those years". The second is an "unsafe and unsound business practice": in 2024 the financial records were not accurate, with the fourth-quarter call report to the regulator and the draft audited financial statements as of 31 December 2024 containing conflicting figures. Then: failure to report a lawsuit filed on 9 November 2023; failure to timely report at least three orders received from other states in 2024 and 2025 — a Suspension Order from Ohio, a Consent Order from Texas and a Suspension Order from North Carolina; annual reports that did not reconcile with the quarterly ones for 2022 and 2023; and the inability, in February 2025, to show that its $100,000 surety bond was adequate for the volume of money transmission conducted. WHAT THIS DOCUMENT DOES NOT SAY. There is no theft, no data breach, no established loss of customer funds. The statutory definition the regulator applies, though, is worth reading: an "unsafe or unsound practice" means conduct that "creates the likelihood of material loss, insolvency, or dissipation of the licensee's assets, or otherwise materially prejudices the financial condition of the licensee or the interests of its customers". It is a judgement on the soundness of whoever holds the money, not on its website. STATUS. The order is in force and its obligations run to February 2029. We have not verified first-hand that the licence was actually surrendered within the 90 days, nor that customers in the state were notified: for that reason the entry stays open and unresolved. As of 26 September 2026 the Washington proceeding is settled by this agreement, while the Statement of Charges described the investigation as "continuing" at its own date.

Latest verified information

A separate incident, unrelated to the 2025 data theft. The improper access dates to December 2025 and was detected by the security team; the contractor no longer works for the company. Data exposed per the support-interface screenshots leaked on Telegram: email, name, date of birth, phone, identity verification information, balances and transaction records. Affected customers were notified and given identity-theft protection.

Latest verified information

Findings by the German regulator against Bitpanda Asset Management on its business organisation, judged non-compliant with §25a of the banking act. Bitpanda states in its 2024 report that all deficiencies were remediated by Q1 2025; internal auditors nonetheless flagged ongoing non-compliance and documentation gaps. A further late-2025 review has no public outcome. No known fine.

Latest verified information

California's financial regulator found Nexo Capital made crypto-backed loans to at least 5,456 Californians without a licence and without assessing ability to repay, breaching the California Financing Law, plus two violations of consumer financial protection rules. Besides the penalty, Nexo must within 150 days transfer California residents' funds to a licensed affiliate. The conduct dates to July 2018 - November 2022, before the US exit.

Latest verified information

Following an inspection from 16 September to 20 December 2024, the Bank of Italy found shortcomings at Banca Profilo, the bank behind the Tinaba account, wallet, card and deposit, in its anti-money-laundering organisation, procedures and controls: customer risk profiling, due diligence and suspicious-transaction reporting. By measure no. 4 of 13/1/2026 it fined the bank €190,000, taking the corrective action into account. The official page shows no appeal. The findings concern internal controls, not customer funds.

Latest verified information

Following an inspection from 16 September to 20 December 2024, the Bank of Italy found shortcomings at Banca Profilo, the bank behind the Tinaba account, wallet, card and deposit, in its anti-money-laundering organisation, procedures and controls: customer risk profiling, due diligence and suspicious-transaction reporting. By measure no. 4 of 13/1/2026 it fined the bank €190,000, taking the corrective action into account. The official page shows no appeal. The findings concern internal controls, not customer funds.

Latest verified information

Unauthorised access to the cloud systems of Global-e, a third-party provider acting as merchant of record for part of the international orders on Ledger.com, exposed Ledger customers' names and contact details. No payment data, credentials, seed phrases or balances were involved: Ledger states its own systems, hardware and software were not breached. The number of affected customers was not disclosed. Ledger is not the only brand affected.

Latest verified information

The source is the breach notification SoFi itself filed with the Washington State Attorney General on 26 January 2026, signed by Valerie Franch, Associate General Counsel, Privacy, «on behalf of SoFi Bank, N.A., and Social Finance, LLC». Official wording: «On or around January 2, 2026, SoFi discovered unauthorized activity in its systems, which occurred as a result of social engineering». So not a technical exploit: someone was granted access. What was taken, in the notification's words: «name, address, email address, phone numbers, date of birth, and employment and education information of approximately 38,049 state residents» were «acquired by the unauthorized actor». What was not taken, which SoFi also puts in writing in the customer letter: «this scammer never had access to your password, account number(s), or debit/credit card number(s)». No member accounts were compromised and, as of the notification date, there were «no reports of fraud, identity theft, or compromises of consumer accounts» linked to the incident. ⚠️ The number to read carefully: 38,049 counts Washington State residents only, because that is the one figure that state's law compels. **SoFi has never made a national total public.** Estimates between 500,000 and 1.6 million customers circulate online: they come neither from SoFi nor from a recognised outlet, and so are not written here as fact. The certain figure is 38,049 in a single state, and the overall order of magnitude remains undisclosed. Timeline, from the Attorney General's official record: unauthorized access between 29 December 2025 and 2 January 2026, data exfiltrated between 31 December and 3 January, notification on 26 January — within the 30 days required. «No unauthorized activity has been observed since January 3, 2026». SoFi says it engaged CrowdStrike and other outside advisors and notified law enforcement; for customers it applied «additional monitoring and other safeguards» on accounts, with the practical consequence that it may ask for extra information from anyone contacting support or trying to change their account. 📌 One thing is missing, and it shows: the notification **offers no credit monitoring service** to those affected. The attachment is limited to generic instructions on obtaining your own free credit report and placing a fraud alert or freeze with Equifax, Experian and TransUnion. On a breach exposing date of birth and employment data, that is a choice the user pays for out of pocket.

Latest verified information

On 24 December 2025 an "unauthorized and malicious" version of the Trust Wallet Browser Extension, 2.68, was published to the Chrome Web Store "outside of our standard release process" — Trust Wallet's own words in its community update, published on 30 December 2025 and updated on 17 July 2026. Opening the extension on desktop with that version meant having the wallet drained. The official figures: "2,520 wallet addresses that were affected by this incident and drained by the attackers, with approximately $8.5 million in assets impacted that can be associated with 17 wallet addresses controlled by the attacker". The fix is version 2.69, to be installed in place of 2.68. On the cause Trust Wallet publishes no technical post-mortem but a stated likelihood: "the Browser Extension v2.68 incident is likely related to the industry-wide Sha1-Hulud incident in November", which it believes gave the attacker "access to the browser extension source code and the Chrome Web Store API key" — the key used to publish an update signed as if it came from the company. The figure grew over time, worth remembering because all three still circulate: on 25 December ZachXBT spoke of "upwards of $6 million" from an initial list of theft addresses, Changpeng Zhao the same day of "$7m affected so far", and only the later official count reached $8.5 million. On reimbursement: Trust Wallet decided to "voluntarily reimburse the affected users", but the process is NOT closed. The company states it received "over 5,000 claims" against 2,520 verified addresses, "indicating a significant number of duplicate or false submissions", and that "claim reviews are ongoing and handled on a case-by-case basis". As of 30 September 2026 there is no past-tense statement saying reimbursements have been completed, which is why this stays open. Scope, because it matters: the desktop browser extension was hit, not the mobile app.

Latest verified information

Bybit announced a phased wind-down of services for Japanese residents from 2026, due to the lack of registration with Japan's Financial Services Agency. New sign-ups had already been paused in October 2025. The FSA had issued repeated public warnings for unregistered operation and in 2025 asked Apple and Google to remove the app. Restrictions still ongoing.

Latest verified information

The criminal group known as ShinyHunters gained unauthorised access to a legacy third-party cloud file storage system used by Checkout.com in 2020 and earlier for internal operational documents and merchant onboarding materials, and demanded a ransom. In the statement on its own newsroom, signed by Chief Technology Officer Mariano Albera, the company states that "the threat actors do not have, and never had, access to merchant funds or card numbers", and that the incident did not affect its production payment processing platform. Checkout.com chose not to pay: it refused the extortion and announced it would donate the ransom amount to cyber security research (Carnegie Mellon University and the Oxford Cyber Security Centre), adding that it is working with law enforcement and the relevant regulators and has begun identifying and contacting those who may have been impacted. The company does not quantify the scope; trade press places it below 25% of the current merchant base. The date needs a note on method, because the official page carries none: the statement says only that the extortionists made contact "last week". The date given here, 14 November 2025, is the date the statement was published, pinned on two independent sources (BleepingComputer, which dates its article 14 November 2025, and Security Boulevard). The breach itself concerns data from 2020 and earlier; the intrusion date has not been made public. As the material consists of merchant onboarding documents and internal operational files, the exposure concerns the platform's business customers, not the end consumers who pay through it.

Latest verified information

On 13 November 2025 a trader burned about 3 million dollars of their own capital in order to inflict a loss of roughly 4.9 million on Hyperliquid's HLP vault, the shared pool where depositors put USDC. According to Cointelegraph's reconstruction, also reported by The Defiant, they withdrew 3 million USDC from OKX, split it across nineteen wallets and opened more than 26 million dollars of leveraged long positions on the POPCAT token; they then built a buy wall of about 20 million around 0.21 dollars, giving the appearance of solid price support, and cancelled it. With the support gone, dozens of over-leveraged positions were force-liquidated and the HLP vault absorbed them. The attacker's capital was wiped out: unlike classic manipulation there was no profit to collect here, and analysts read it as an attack aimed at the protocol's structure rather than at anyone's wallet. During the episode the platform paused bridge withdrawal processing for about an hour using its emergency lock function, then resumed. No official statement was published linking that pause to the POPCAT case: the fact is reported by the trade press, the explanation is not. No code exploit, no compromised keys, no funds stolen from individual users: the loss fell on the shared pool, that is on HLP depositors in proportion to their share. It is the same pattern as March 2025, with one detail that makes it more uncomfortable: here the attacker accepted losing everything in order to do it.

Latest verified information

On 3 November 2025 at 07:46 UTC an attacker exploited a rounding error in the `upscale` function of Balancer V2 Composable Stable Pools v5, on Ethereum and several layer-2 networks. The official post-mortem puts the theft at $94.8M of user funds (outlets reported gross figures between $116M and $128M, which include funds later protected or recovered). Balancer states that V3 and the other V2 pool types were unaffected. Partial recoveries: ~$19.7M in osETH/osGNO returned via StakeWise, a Gnosis Chain hard fork, and ~$8M returned to affected LPs under proposal BIP-892. Balancer Labs wound up as a company in March 2026 and the DAO continued in reduced form. On 14 September 2026 Marcus Hardt, former CEO of Balancer Labs, filed a proposal on the official forum for an orderly wind-down of the protocol with distribution of the treasury (~$9.96M) to BAL holders: Snapshot vote from 25 to 29 September 2026 and, if approved, on 30 October 2026 the pools that can be paused move to withdrawals only.

Latest verified information

Measure no. 344 of 28/10/2025 (published 9/01/2026), following an inspection from 9 July to 11 October 2024: shortcomings in organisation and controls, particularly on credit risk (arts. 53 and 67 TUB). €310,000 fine. In setting the amount the Bank of Italy took the bank's corrective action into account. The official page shows no appeal.

Latest verified information

On 16 October 2025 FINTRAC, Canada's financial intelligence unit, imposed on Xeltox Enterprises Ltd. — trading as Cryptomus, formerly Certa Payments Ltd., a money services business incorporated in British Columbia — an administrative penalty of 176,960,190 Canadian dollars, announced on 22 October. It is the largest the authority has ever issued, for about 2,600 violations of Canada's proceeds of crime and terrorist financing act. THE VIOLATIONS, IN THE AUTHORITY'S OWN NUMBERS. Failure to submit suspicious transaction reports on 1,068 occasions (July-August 2024); failure to report 1,518 virtual currency transactions of 10,000 dollars or more; non-compliance with a Ministerial Directive; inadequate compliance policies; insufficient risk assessments; failure to notify changes to its registration information. WHY THE FIGURE IS WHAT IT IS. The record is explained not by the size of the company but by the nature of what went unreported. FINTRAC lists among the unreported transactions those suspected of involving proceeds from trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion. Director Sarah Paquet says it plainly: «given violations connected to child sexual abuse material trafficking, fraud, ransomware and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action». Part of the missing reports concerned, according to the authority, transactions with known darknet markets and wallets tied to criminal activity; the unreported operations also include 7,557 transactions originating from Iran. THE APPEAL, AND WHY THERE IS NOT A WORD MORE HERE. On 14 November 2025 Xeltox filed an appeal in Federal Court, arguing that the penalties rest on «errors of law» and, on the substance, that FINTRAC was wrong to treat Xeltox and Cryptomus as «functionally the same entity»: the company states it licenses the Cryptomus platform from a Panama-based company, Padel West S.A., and should not answer for transactions conducted by other licensees. That is an argument, not an outcome. As at this verification date no Federal Court decision is on record: the penalty was imposed by an authority and has been neither upheld nor overturned by a court, and this page presents it as neither. A DISTINCTION THAT MATTERS TO THE READER. None of this says user funds were taken: it is not a hack and not a balance-sheet hole. It says the service's anti-money-laundering controls were judged severely inadequate by the authority that supervises them, and that the amount at stake is of an order of magnitude that can put the continuity of an operator this size in question.

Latest verified information

During the 10 October 2025 crash USDe briefly fell below $0.66 on Binance. The exchange paid $283 million in compensation to futures, margin and loan users holding USDe, BNSOL or wBETH as collateral in the 21:36-22:16 UTC window.

Latest verified information

After an Apple review of Hong Kong Cards-as-a-Service programmes, cards issued from this date cannot be enabled for Apple Pay. Cards already added keep working and need no replacement. RedotPay states it is working with partners on possible solutions, with no timeline given.

Latest verified information

The Judicial Panel on Multidistrict Litigation centralised eleven actions pending in four districts, plus eight potential tag-along actions, in the Southern District of New York. Plaintiffs challenge the adequacy of Coinbase's data security and the timing of breach notification. Coinbase is seeking to push the claims into individual arbitration under its user agreement. Still open: it was not verified whether a ruling on the arbitration motion has been issued.

Latest verified information

On 19 July 2025 CoinDCX, India's largest exchange, had an internal operational account compromised. The news did not break from the company first: on-chain investigator ZachXBT flagged it, and official confirmation came the next day. The facts, as described by CEO Sumit Gupta: the account hit was "used only for liquidity provisioning on a partner exchange" and "the incident was quickly contained by isolating the affected operational account". The part that matters for anyone keeping money there comes next: "since our operational accounts are segregated from customer wallets, the exposure is only limited to this specific account and is being fully absorbed by us — from our own treasury reserves". Customer assets stayed in cold wallets and were not touched: no user lost money, and the company publicly reaffirmed in August 2025 that the loss remained its own. The figure. Sources range between 43.4 and 44.2 million dollars depending on when the assets were valued; it is recorded here as "about 44 million". The money was routed through bridges between Solana and Ethereum, with the attacker's wallet funded at the outset via Tornado Cash: the classic sequence of someone who has already planned the laundering. How they got in — and this is the instructive part. According to Bengaluru police, the attackers did not force the infrastructure: they reached an employee with a fake freelance job offer, persuaded him to install a malicious file on his work laptop, and then used those credentials to enter internal systems and order the transfers. An employee was detained in late July 2025 as part of the investigation: he denied knowing participation. We do not name him, because it is an accusation and not a conviction, and because the useful fact for a reader is not a person's name but the mechanism: the most effective entry point against an exchange, in 2025 as today, is a person written to with the offer of a job. Where the funds are. They were not recovered. According to public reconstructions the haul was consolidated into roughly 4,443 ETH and 155,830 SOL and has sat still since. CoinDCX opened a bounty programme — up to 25% of whatever was recovered, capped at around 11 million dollars, open to outside researchers and analysts — and reported the case to CERT-In, India's computer emergency response team. No official conclusion of that investigation appears to have been published. How to read this entry's status: for users the chapter is closed and left no consequences, because the company paid for the loss. For the fact itself it is not: the funds have not come back, the bounty is still open and there is no finding by an authority. That is why the entry stays open but is not flagged as "ongoing": nothing is happening right now.

Latest verified information

THE ACT, IN THE REGULATOR'S OWN WORDS. On 10 June 2025 the Bank of Ghana publishes notice number BG/GOV/SEC/2025/13, «Caution on unlicensed digital platforms – YellowPay and HanyPay», signed by the secretary Sandra Thompson. We read the original document, and these are its words: it has come to the Bank's attention that «YellowPay, an unapproved digital payment platform provided by Yellow Card Financial Inc., an entity not licensed by the Bank, is actively promoting itself as a provider of digital payment services, cryptocurrency trading, and cross-border remittance solutions». The platform, the regulator writes, «purports to enable users to make payments, send and receive electronic money and stable coins across borders, as well as convert stable coins into local currency; activities which require appropriate licensing from the Bank of Ghana». Then the second count: YellowPay is said to be engaged in an ongoing collaboration with HanyPay, an entity that «claims to be licensed by the Africa Diaspora Central Bank (ADCB)», to develop and integrate a new stablecoin, AKL Lumi — and the Bank adds two things, that HanyPay «is neither licensed nor authorized to operate within the jurisdiction of Ghana» and that the Bank of Ghana «does not recognize ADCB as a central bank». The part that concerns anyone using the service is the last one: the notice informs «the public, financial institutions, and all relevant stakeholders to DESIST from engaging with Yellow Card Financial Inc. and HanyPay Ghana, on the basis that their activities are not approved by Bank of Ghana». THE COMPANY'S REPLY, WHICH DENIES THE PREMISE AND NOT MERELY THE TONE. Yellow Card replied publicly on 11 June 2025 with a statement on its own blog. The central point is that the service complained of does not exist in that country: «the Yellow Pay service is not even available in Ghana». On the rest: the company states it has «never worked on the AKL Lumi stablecoin», that HanyPay had begun onboarding for its Payments API in 2024 but «the process was never completed», and that what existed was «a standard API access request, not a partnership»; a February 2025 press release announcing an integration is described as false and unauthorised. Yellow Card also notes that it has a subsidiary, Yellow Card Ghana Limited, incorporated in 2020 and registered with Ghana's Financial Intelligence Centre and Data Protection Commission. General Counsel Craig Stoehr: «It is most unfortunate that the Bank of Ghana determined to publish this notice, as Yellow Card Ghana clearly communicated the above-mentioned facts… well in advance». ⚠️ WHAT WE RECORD AND WHAT WE DO NOT DECIDE. This entry does not say that Yellow Card operated without a licence: on that merit there is a central bank asserting and a company denying, and the registry is not a judge. What is an established fact, with a date, a number and a signature, is the ACT: a central bank publicly asked the country's financial institutions and its citizens not to do business with the group. That is the effect that can reach a person's account — a Ghanaian bank refusing a transfer, a payment that does not go through — and that is why it is on the card. WHY IT STAYS OPEN. We found no withdrawal of the notice, no Ghanaian licence obtained afterwards, no correction from the Bank: as of 2 October 2026 the measure is still published on the Bank of Ghana's website. It is not, however, an «ongoing» fact in the monitor's sense: nothing is happening right now, it is a standing measure. To be read alongside one more element that changes its practical reach a great deal: since January 2026 Yellow Card has shut its retail offering to focus on the enterprise segment, so the pool of people who can run into this problem today is far smaller than it was in 2025.

Latest verified information

On 20 May 2025 the British Columbia Securities Commission issued a temporary order (2025 BCSECCOM 209) against Xeltox Enterprises Ltd., trading as Cryptomus, based in Vancouver. In the commission's own words, there is evidence that Cryptomus «may be violating the registration requirements of the Securities Act and operating as an unrecognized exchange». WHAT THE ORDER PROHIBITS. «The temporary order prohibits Cryptomus from trading securities or derivatives and from engaging in promotional activities.» It is a precautionary measure, not a final finding: its purpose is to halt the activity while the matter is decided, and by design it does not establish that a violation occurred. WHAT WE COULD NOT ESTABLISH, AND WE SAY SO. The order expired on 4 June 2025, with the executive director able to ask a commission panel to extend it. From the open sources we consulted it does not appear whether it was extended, whether a hearing was held, or whether the proceeding was closed. So we record the certain fact — an order by an authority, dated and published by that same authority — and declare the question of how it ended still open, rather than pretending to know. THE CONTEXT THAT MAKES THIS ENTRY USEFUL. Five months after this order, the same company received from FINTRAC the penalty recorded below. Two different Canadian authorities, in the same year, on the same operator: the single entry matters less than the sequence.

Latest verified information

Coinbase refused the $20 million ransom and disclosed the incident to the SEC in a Form 8-K. No passwords or private keys were compromised and no customer funds were accessible. Stolen data: name, address, phone, email, last four digits of the tax ID, masked account numbers, government-ID images, balances and transaction history. The FY2025 accounts book $345.2 million of net losses and $311.2 million of cash actually paid out, between voluntary customer reimbursements and legal costs: the reimbursement is therefore confirmed by an SEC filing, not by a press release. A further $8.6 million in Q1 2026: the tab is still open. The figure of about 70,000 affected customers comes from the Maine Attorney General notification and does not appear in the 8-K.

Latest verified information

On 12 May 2025 at 20:55 UTC the curve.fi domain was hijacked at registrar level: the attackers altered the DNS delegation and the official address began pointing to a site mimicking Curve's homepage. The team noticed at 21:20 UTC. WHAT WAS ON THE OTHER SIDE. According to Curve's own account the fake site was «a static decoy that did not function as a real frontend and only attempted to prompt users for wallet signatures». No smart contract, no funds and no user data were touched: the protocol stayed «fully secure and operational» and processed over 400 million dollars in volume during the outage, because anyone operating through contracts or alternative interfaces does not go through the domain. The perimeter, the company says, was «strictly limited to the DNS layer». Wallet providers such as Phantom took part in the response, blocking access to the compromised site. THE DECISION THAT FOLLOWED. Curve did not wait to get the domain back: it moved the official frontend to curve.finance and recommended reaching the protocol through the ENS domain curve.eth. The stated reason is the extended downtime and the limited support received from the .fi registrar, iwantmyname — the same registrar as the August 2022 hijack. On the exact cause the company says it detected no sign of its own credentials being compromised and that the investigation remained open. WHY IT IS HERE. There was no theft from the protocol's reserves, which is why this entry is not classified as a hack. But for hours the address people know by heart served a trap: for the user the service could not be reached safely, and that is exactly the kind of fact this page has to declare.

Latest verified information

A penalty on Revolut Bank UAB, the largest ever imposed by Lithuania's central bank. A scheduled inspection found deficiencies in monitoring business relationships and transactions, with failures to flag suspicious operations. No actual money laundering cases were established. Revolut settled via an administrative agreement and said it had fixed the procedural shortcomings.

Latest verified information

After the 2024 Wells notice over an unregistered broker-dealer and clearing agency, and after the suit filed against the SEC in October 2024 and dropped in December, on 27 March 2025 the SEC said it had closed the investigation with no enforcement action.

Latest verified information

On 26 March 2025 Hyperliquid's HLP vault — the shared pool where users deposit USDC and which acts as the platform's automatic counterparty to liquidations — found itself carrying an unrealised loss of about 12 million dollars on a position it had not chosen. HOW IT WAS BUILT. According to reconstructions by The Block, Cointelegraph and the analytics firm Arkham, a trader used three accounts: deposited about 7 million dollars within minutes, opened two long positions (roughly 2.15 and 1.9 million) and one short of about 4.1 million on the JELLY token (JELLYJELLY), then pulled the margin out of the short. Left uncovered, that position was liquidated and — by the platform's design — was transferred to the HLP vault. The price of JELLY was then pushed up across several markets, rising roughly three-hundredfold in twenty minutes: every tick up was a loss for the vault, which was short and could not close because there was nobody on the other side. HOW IT ENDED, AND WHY THAT IS THE POINT. With the loss around 12 million, the network's validator set voted to remove JELLY perpetual futures «on evidence of suspicious market activity», settling all positions at a set price of 0.037555 dollars — that is, close to the price at which the attacker had gone short, not the market price at the time. For the vault the outcome flipped from a 12 million loss to a profit of about 700,000 USDC over 24 hours. Hyperliquid announced that «all users apart from flagged addresses will be made whole from the Hyper Foundation», automatically and based on on-chain data: JELLY longs were refunded as though their positions had closed at 0.037555. The attacker, per the same reconstructions, had already withdrawn about 6.26 million of the 7.17 million deposited before their withdrawals were frozen. NO USER WAS LEFT OUT OF POCKET, AND YET THIS IS WORTH KNOWING. There was no code exploit, no stolen keys, no bridge breach: the platform worked as written, and precisely because of that a trader was able to dump a toxic position onto the pool that holds depositors' money. What averted the loss was not an automatic mechanism but a human decision taken within minutes by a small validator set, which delisted a market and picked the settlement price. The debate that followed about how decentralised the platform really is starts here, and the company acknowledged it by changing the rules: tighter caps on the liquidator vault, a new open-interest cap formula, and an on-chain vote for delisting assets below certain thresholds. IT WAS NOT THE FIRST EPISODE OF ITS KIND, TWO WEEKS EARLIER. On 12 March 2025 a trader had deposited 15.23 million USDC and opened a long ETH position of 160,234 ETH (about 306.85 million dollars), then withdrew part of the margin so as to be liquidated: the HLP vault absorbed about 4 million dollars of loss (roughly 1% of the 451 million deposited) and the trader walked away with 1.86 million in profit. Hyperliquid stated that «there had been no exploit or hack» and that its liquidation engine «simply could not handle the size of the position», then cut maximum leverage to 40x on bitcoin and 25x on ethereum. Two episodes in fifteen days, both on the same weak point: a forced liquidation handed to the shared pool. AMOUNT LEFT UNQUANTIFIED, AND THAT IS A CHOICE. The maximum exposed loss was about 12 million dollars, but it never became final: after the delisting and the forced settlement the vault closed the 24 hours in profit. Writing 12 million would state a loss that did not happen; writing zero would erase the risk the depositors' pool actually ran. The field is therefore left empty, and the range is told here.

Latest verified information

On 5 March 2025 an attacker took roughly **5 million dollars** — 2.4 million USDC and 1,276 WETH — exploiting a flaw in the `_settleOrder` function of the **Fusion v1 resolver contracts**, the retired version of 1inch's order settlement system. The bug is an **integer underflow**: passing a negative `interactionLength` value (-512) produced memory corruption that allowed funds to be redirected. No sophisticated technique, basic arithmetic — and, worth recording, **nine audit teams had missed it**. Who lost the money, because that is the distinction that matters: not 1inch's users, but the **resolvers**, the market makers that execute orders on the protocol and still had the Fusion v1 implementation running inside their own contracts. The worst hit was TrustedVolumes. 1inch stated publicly: «We're actively working with affected resolvers to secure their systems. We urge all resolvers to audit and update their contracts immediately». ⚠️ What does not add up in the communication should also be said: the company's first statement — «no end-user funds were at risk» — was technically true but **omitted the 5 million already taken from resolvers**, and it was called out for that. After a negotiation the attacker **returned about 4.05 million dollars**, keeping roughly **450,000** as a self-assigned «10% finder's fee». The case is closed: the vulnerable contracts were already deprecated, and the residual exposure only concerned those who had not updated them. Why this entry exists: until today the card declared «no known incident» with a verification date — a **false** statement, given the event dates to March 2025.

Latest verified information

On 24 February 2025 Aux Cayes Fintech Co. Ltd, the Seychelles-based company operating OKX, pleaded guilty before the US Attorney's Office for the Southern District of New York to one count of operating an unlicensed money transmitting business, agreeing to penalties totalling more than $504 million ($420.3 million criminal forfeiture and roughly $84.4 million fine). From the court documents and admissions: since 2017 OKX had an official policy barring US persons from its exchange, yet actively sought them out; between 2018 and at least early 2024 it served US customers who transacted over one trillion dollars, generating hundreds of millions in fees. Until November 2022 a retail user could open an account, receive and transfer funds and trade without completing any identity verification; the block on US IP addresses could be bypassed with a VPN, and until early 2024 customers could trade through intermediaries that disclosed no identifying information to OKX. In at least two documented episodes (April 2023 and January 2024) an employee advised prospective US customers how to supply false information to get past verification. Prosecutors put the suspicious transactions and criminal proceeds that moved through the platform at over $5 billion. The company agreed to retain an external compliance consultant through February 2027. The filing explicitly names the derivatives products too, futures contracts included.

Latest verified information

On 24 February 2025 Aux Cayes Fintech Co. Ltd, the Seychelles-based company operating OKX, pleaded guilty before the US Attorney's Office for the Southern District of New York to one count of operating an unlicensed money transmitting business, agreeing to penalties totalling more than $504 million ($420.3 million criminal forfeiture and roughly $84.4 million fine). From the court documents and admissions: since 2017 OKX had an official policy barring US persons from its exchange, yet actively sought them out; between 2018 and at least early 2024 it served US customers who transacted over one trillion dollars, generating hundreds of millions in fees. Until November 2022 a retail user could open an account, receive and transfer funds and trade without completing any identity verification; the block on US IP addresses could be bypassed with a VPN, and until early 2024 customers could trade through intermediaries that disclosed no identifying information to OKX. In at least two documented episodes (April 2023 and January 2024) an employee advised prospective US customers how to supply false information to get past verification. Prosecutors put the suspicious transactions and criminal proceeds that moved through the platform at over $5 billion. The company agreed to retain an external compliance consultant through February 2027. The filing explicitly names the derivatives products too, futures contracts included.

Latest verified information

Attackers spoofed the Safe{Wallet} multisig interface during a routine cold-to-warm transfer, altering the smart contract logic and draining over 401,000 ETH and derivatives. Withdrawals were never halted: within ten hours 99.994% of more than 350,000 requests had been processed. The gap was closed within 72 hours via bridge loans, deposits and OTC purchases, and independent security firm Hacken published an updated proof-of-reserves showing collateral above 100%. No customer lost funds. Preliminary forensics by Sygnia and Verichains attributed the root cause to malicious code on the Safe{Wallet} platform, with no vulnerability in Bybit's own infrastructure. Main source: Bybit's official timeline, i.e. the interested party; withdrawal and reserve figures are attributed to third parties but the Hacken report was not read directly.

Latest verified information

On 21 February 2025 **1.46 billion dollars** left a Bybit multisig cold wallet. The forensic investigation run by **Mandiant** together with Safe's team, with independent findings from **Sygnia** and **BlockSec**, reconstructed a path that starts much earlier and **inside Safe**, not inside Bybit. On **4 February** the macOS workstation of a Safe{Wallet} developer is compromised, most likely through malware delivered by social engineering. On **5 February** the attackers use that developer's **AWS session tokens** — sessions already active, which let them **bypass multi-factor authentication** after several failed attempts to register their own MFA device — and enter Safe{Wallet}'s AWS infrastructure, where they stay until **17 February**. On **19 February** they modify the **JavaScript resources hosted on the S3 bucket** serving Safe{Wallet}'s web interface, injecting code that manipulates transactions. The trigger was surgical: the code activated **only** on transactions from the Safe address of one specific Bybit cold wallet. Bybit's CEO Ben Zhou described the result: Safe's interface showed the signers a legitimate transaction, while a different payload was sent to their Ledger devices. Nineteen days of preparation; the **FBI** formally attributed the attack to North Korean state actors of the **TraderTraitor** cluster (also tracked as Jade Sleet, Slow Pisces, UNC4899). What Safe stated, and which matters in full: the forensic review **found no vulnerabilities either in Safe's smart contracts or in the source code of the frontend and services**. The flaw was in the company's infrastructure, not in the protocol. Safe then **fully rebuilt and reconfigured all infrastructure and rotated all credentials**, restoring the service on Ethereum mainnet in phases. The funds were never recovered: the loss was absorbed by Bybit, which replenished its reserves. The link to this card, stated plainly: **the stolen money was Bybit's, but the flaw exploited was in Safe's house** — which is why the episode appears both here and on the exchange's card.

Latest verified information

On the evening of 5 February 2025 (US time) Jupiter's official X account — the channel through which the project speaks to its audience — was taken over by attackers, who used it to promote a fake token called $MEOW (the name of the project's mascot and pseudonymous co-founder) and then a second one, $DCOIN. The alert came from the project itself, via the Jupiter Mobile account: "The main Jupiter Exchange account has been compromised. Team is working on restoring access", together with a warning not to click any link. The account was recovered within a few hours, overnight between 5 and 6 February. What did NOT happen, and it is the part that matters for anyone using the aggregator: none of Jupiter's contracts were touched and no user or treasury funds were taken — the team stated that assets remained safe in multisig wallets and that the compromise was limited to the X account, with no other channels affected. What did happen to those who believed the post: anyone who bought $MEOW in the minutes when it looked like a project announcement was left holding a token with no liquidity after its creator pulled out. ⚠️ There is no verified figure for the losses: reports speak of "millions lost in minutes" and of the fake token's market cap climbing past $20-30 million before collapsing, but a token's market cap is not a loss, and no source — neither Jupiter nor any third party — has ever published a count of victims or amounts. That is why the amount field is left empty: putting the market cap there would be a false number. No reimbursement was announced, and the JUP token fell about 12% during the episode. The incident is recorded here because the compromised account was the service's own official one: this is not third-party phishing aimed at a brand's users, it is the brand itself speaking with an attacker's voice for a few hours.

Latest verified information

India's Financial Intelligence Unit penalised Bybit Fintech Limited for expanding services in India without the mandatory Virtual Digital Asset Service Provider registration. Because of persistent non-compliance the websites had been blocked through the relevant ministry. After payment Bybit secured its registration with the Indian FIU. The amount is not converted to dollars: the official source states only the rupee figure.

Latest verified information

Fiwind announced it itself, on 31 January 2025 at 17:00 CET, on its own X account and with the same wording on its official Telegram channel: "this morning we suffered an attack on a cloud service, through which attackers were able to access our domains fiwind.io and panel.fiwind.io, on which they modified the visible messages and designs. This attack only affected the front end of the websites, all funds are under control. We are working to return the service to normal." The app was taken offline as security protocols kicked in. The next day, 1 February 2025, Argentine outlet iProUP quoted the CEO: "they did not touch the funds and the service is being restored". What we do NOT know, written down because a missing fact is itself a fact: Fiwind published no post-mortem, never named the cloud provider involved, never said how access was obtained, and has never stated anything about customer data — the CEO's denial covers funds, not data. Nor is there any closure statement: the only reference to restoration is that 1 February quote, in the present progressive. The incident is treated as closed because the event was bounded in time and both domains have operated normally since (both checked on 30 September 2026, responding normally). Scope note: Fiwind is a registered Argentine operator (PSAV no. 75, ALYCI no. 2,231, PSP no. 34,539) and the wallet is custodial, so third parties controlling the front end is a risk the user carries even when balances are left alone.

Latest verified information

On **23 January 2025 at 11:30 UTC** Phemex detected «unusual activity» in its hot wallets. Those are the company's own words, from the official statement carrying the timeline (`phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline`). The attacker drained **sixteen hot wallets across sixteen different blockchains**, including Ethereum, Solana, XRP and Bitcoin, in a way the analyses describe as systematic: **highest-value tokens first, and immediate conversion of freezable assets into ones that cannot be frozen** — maximising the haul while minimising any chance of recovery. The cause given by **Halborn**'s analysis is **private key compromise**, most likely from centralised storage: it is the only hypothesis that explains why all sixteen wallets fell the same way. ⚠️ **The amount is the most delicate part of this entry and should be read for what it is.** Phemex has **never published a figure of its own**, neither then nor since. Every estimate comes from third parties and they rose over the days: **~29 million** in the first hours, **69.1 million** according to **PeckShield** (which on 24 January breaks it down as $17M on Solana, $13M in XRP, $5.3M in Bitcoin), **73 million** in Halborn's analysis, **at least 85 million** in the count by MetaMask's **Taylor Monahan**. `importo_usd` carries PeckShield's figure, as the measurement of an identified forensic party and the most widely cited one; the full range stays written here because a single number, on a fact where the company says nothing, would be false precision. **What Phemex did, with the dates from its own statement:** deposits and withdrawals suspended on almost all chains on **23 January at 15:13 UTC**; gradual reopening with manual approval from **24 January** (ETH, USDT and USDC on Ethereum), then **25 January** (Bitcoin, then SOL/USDC/USDT on Solana), then **26 January** (Arbitrum, Optimism, BSC, Polygon, Base); **all withdrawals restored by February 2025**. CEO **Federico Variola** publicly confirmed the episode, calling it «sophisticated», and stated that **cold wallets were not touched**. Phemex also did something rare in comparable cases: it **published a Proof of Reserves** right after the attack to show solvency, and in its statement writes that it has «sufficient asset reserves» and that «user funds are always safe». **Why `risolto` stays `false` on a twenty-month-old fact.** Not because the service is frozen — it has been fully operational since February 2025 — but because the three things that would close the case never arrived: **the funds were never recovered**, Phemex **committed** to reimbursing affected users without any public confirmation that reimbursements were completed (and a promise of reimbursement is not a reimbursement), and **there is no final accounting and no technical post-mortem** from the company. On attribution, finally, no confirmation: the analyses point to the North Korean **Lazarus** group based on the modus operandi, but that is an analysts' hypothesis, not an official attribution, and it stays one on this card. `in_corso` is `false`: nothing is happening right now.

Latest verified information

The company pleaded guilty on 10 July 2024 and was sentenced on 15 January 2025 by the US Attorney's Office for the Southern District of New York: a $100 million fine and two years' probation for willfully failing to establish and maintain an adequate anti-money-laundering (AML) and know-your-customer (KYC) programme. From the court filings: BitMEX served US customers and knew it was required to register with the CFTC, yet opening an account required only an email address; senior executives knew US-resident customers kept accessing the platform through at least 2018 and that the policies nominally preventing this were easily overridden. Prosecutors also state the company lied to a bank about the nature of a subsidiary in order to move millions of dollars through the US financial system. The three founders (Arthur Hayes, Benjamin Delo, Samuel Reed) and executive Gregory Dwyer had already pleaded guilty and were sentenced in 2022. The fine has been paid and the criminal case is closed.

Latest verified information

France's data protection authority fined Ledger for GDPR breaches tied to the 2020 data breaches: inadequate security, retaining data longer than necessary and insufficient transparency on its use. CNIL did not publish the decision and the amount surfaced through the press: the date shown is the date of the report, not necessarily of the ruling. Separately, around 50 victims brought civil claims in Paris.

Latest verified information

On 18 September 2024 Ethena Labs announced that its domain registrar account had been compromised: «we have taken steps to deactivate the site until further notice. The protocol is unaffected and funds are safe». The company asked users not to interact with any site or application purporting to be the Ethena frontend. The Block and crypto.news reported it the same day. No loss of funds was reported and the registrar involved was not named. It is the kind of attack that hits the address, not the code: whoever controls the domain can swap the real site for a copy that asks users to sign malicious transactions, even while the protocol's contracts stay intact — the same pattern that hit Compound and Celer through domains managed on Squarespace in July 2024. The site is back up and responding normally.

Latest verified information

The Financial Conduct Authority's first ever penalty under the Electronic Money Regulations 2011. CB Payments Ltd repeatedly breached a voluntary requirement agreed with the regulator, onboarding 13,416 customers classified as high-risk, with around $25 million in prohibited deposits that fed roughly $226 million of transactions.

Latest verified information

On 18 July 2024 WazirX lost roughly USD 234.9 million in digital assets (over ₹2,000 crore) from a multi-signature wallet held under a custody arrangement with Liminal Custody: the setup required three of five WazirX signatures plus one from Liminal, but during a signing operation the contract governing the wallet was replaced, after which the attacker could move the funds without needing the exchange's keys at all. Attribution to North Korea's Lazarus Group is not a company claim: it was confirmed by a joint statement from the United States, South Korea and Japan in January 2025. On who is responsible for the custody failure the two companies blame each other and neither account is established: WazirX pointed at Liminal, Liminal rejected this, relying on a review it commissioned from Grant Thornton and pointing back to vulnerabilities on WazirX's side, while the Delhi Police IFSO unit alleged that Liminal failed to hand over logs and technical data for the day of the breach. Withdrawals stayed frozen for about fifteen months. Repayment ran through a Singapore restructuring of Zettai Pte Ltd: the scheme of arrangement was approved by 95.7% of creditors by number and 94.6% by value, sanctioned by the Singapore High Court on 13 October 2025, and the platform reopened for trading on 24 October 2025. Within ten business days of the restart, eligible users received a first distribution of about 85% of their approved claims. The remaining ~15% has NOT been repaid: it is represented by 'Recovery Tokens' allocated to eligible users, which the company itself states are not tradable and are only eligible for future buyback 'subject to the availability of sufficient profits and recoveries', in three-month evaluation cycles triggered once at least USD 10 million in unencumbered value has been recovered. The case therefore remains open: a buyback promise conditional on future profits is not a refund.

Latest verified information

Evolve Bank & Trust is a US bank that sells almost nothing to the public: it works behind fintechs, issuing accounts and cards on their behalf. This incident therefore also concerns people who never heard the name "Evolve" and who were customers of an app. The chronology, as the bank itself tells it in its official notice: the attackers "accessed and downloaded customer information from our databases and a file share during periods in February and May" 2024. "In late May 2024, Evolve Bank & Trust identified that some of its systems were not working properly": it looked like a hardware failure, it was an intrusion. The bank states it has seen "no new unauthorized activity since May 31, 2024". The way in, admitted by the bank, is the most ordinary there is: "an employee inadvertently clicked on a malicious internet link". The perpetrator is named: "this was a ransomware attack by the criminal organization, LockBit". The ransom was not paid and the data was published: in late June 2024 LockBit released the stolen material, at first presenting it as a breach of the US Federal Reserve — a false claim, disproved in the following days when it became clear the data was Evolve's. That is why this case got far more visibility than it otherwise would have. The numbers and the perimeter. The formal notice of 8 July 2024 and the filings with state authorities put the number of people involved at 7,640,112. The exfiltrated data, according to the bank's notice, includes "names, Social Security numbers, bank account numbers, and contact information" for most retail customers "as well as customers of our Open Banking partners", plus information relating to employees and ACH transaction records; a smaller group also had their debit card number exposed. The Social Security number is what makes this case heavy and non-ageing: it is not a password, it cannot be changed. What did NOT happen: the bank states there is "no evidence that the criminals accessed any customer funds". The money in the accounts was not touched — what got out were identities. Remedies offered: individual notification to those affected and two years of credit monitoring and identity theft protection for US residents, with a dedicated phone line. Why it still matters today, two years on: the data was published, so it is permanently in circulation, and a person's Social Security number cannot be revoked. For a European reader the direct risk is low — the perimeter is American — but the case is worth reading for something that concerns everyone: when you use a financial app, your documents also sit with the bank behind the app, which you did not choose and whose name you probably do not know.

Latest verified information

On 14 June 2024 the Board of Governors of the Federal Reserve System, together with the Arkansas State Bank Department, issued a cease and desist order against Evolve Bancorp, Inc. and its subsidiary Evolve Bank & Trust. It is not a fine: it is an order to fix things and to show they have been fixed. The content is the point. According to the Federal Reserve, examinations conducted in 2023 and a follow-up review in early 2024 found that the bank "engaged in unsafe and unsound banking practices by failing to have in place an effective risk management framework" for its partnerships with fintech companies, and that it "did not maintain an effective risk management program or controls sufficient to comply with anti-money laundering laws" and consumer protection laws. The order requires it to strengthen internal policies, the oversight and monitoring of those relationships, and its recordkeeping and consumer compliance procedures. It should be read in the context in which it arrived, without being confused with that context: in spring 2024 the collapse of technology middleman Synapse — for which Evolve was one of the partner banks — had left end customers of several apps without access to their own money for weeks, because of a mismatch in the ledgers between the parties. The Federal Reserve specifies that its action is independent of the Synapse bankruptcy proceedings: that order concerns the way the bank governed its own partnerships, it is not a finding of liability for the money frozen in that affair. Why it matters to readers of this registry: Evolve is not a brand you choose, it is the infrastructure under brands you do choose. An action saying the bank was not adequately overseeing its fintech partners is, translated, an action about the level of supervision applied to the accounts and cards those partners were selling to the public. Status: there is no indication that the order has been revoked or terminated. Compliance obligations of this kind are multi-year by nature and their closure is announced by the authority: until then this entry stays open. It is not an "ongoing" incident — nothing is happening right now — but it is not closed either.

Latest verified information

Between 3 and 7 June 2024 an unauthorised party entered the internal collaboration tool of the provider that handles ACH transfers for Gemini — the US bank debit and credit rail — and accessed the data of roughly 15,000 Gemini customers. The exposed information is full name, bank account number and routing number used for ACH transfers: not a contact list, but the details with which a debit is instructed against an account. According to the published reconstruction, date of birth, home address, email address, social security number, phone number, username and password were NOT exposed. Gemini emailed affected customers on 25 June 2024 and sent the formal breach notification letters on 24 July 2024. The company's official statement is short and should be reported as it stands: "The incident at a third party involved information of approximately 15K Gemini customers. Although we notified the customers involved out of an abundance of caution, our analysis found no evidence of customer impact." As in the 2022 case, Gemini's own systems were not breached: the entry point was a vendor. ⚠️ The ACH provider has not been named, no technical post-mortem has been published, and no closing communication after the 24 July letters is on record. The distinction between "no evidence of impact" and "no impact" is the company's, not ours: a bank account number and a routing number, once out, remain usable indefinitely.

Latest verified information

On 7 May 2024 the Consumer Financial Protection Bureau, the US federal consumer finance regulator, issued an order against Chime Financial, Inc. The charge concerns neither a cyberattack nor a loss of funds, but how long the company took to return money to customers closing their accounts: according to the regulator, Chime "failed to refund consumers' balances within 14 days in thousands of instances, including thousands of instances when Chime failed to issue consumer refunds within 90 days". The CFPB found the conduct unfair under the Consumer Financial Protection Act, noting that the delay prevented people from accessing their own money needed for basic expenses. The order requires Chime to come into compliance, to pay a 3.25 million dollar civil money penalty and at least 1.3 million dollars in consumer redress, and imposes compliance, regulatory reporting and enhanced recordkeeping obligations for a period of five years — so until 2029. The figure recorded here as the amount is the penalty, not a loss suffered by users. One clarification is needed to avoid confusing two different companies: in November 2023 the CFPB closed another matter, for 3 million dollars, against "Chime Inc.", operator of a remittance app — a separate entity from Chime Financial, the card company, and unrelated to this order. Chime operates as a fintech: accounts are issued by FDIC-insured partner banks, not by Chime itself.

Latest verified information

WHAT HAPPENED. On 29 April 2024 roughly 14.8 million dollars left the wallets of Rain, the exchange run by Bahrain-based Rain Management W.L.L. Whoever carried out the attack converted the proceeds almost at once: the funds were «quickly transferred to instant exchanges and swapped for BTC and ETH», for a total of 137.9 BTC and 1,881 ETH that ended up in two wallets which then stayed inactive. On the technical cause Halborn's analysis is careful but clear within its scope: the attacker «must have had the ability to generate valid digital signatures for the attack transactions», so this is most likely COMPROMISED PRIVATE KEYS — a failure of key management, not a smart-contract flaw. THE PART THAT WEIGHS MORE THAN THE THEFT: WHO TOLD THE STORY. For two weeks Rain said nothing. The news broke on 13 May 2024, when on-chain investigator ZachXBT flagged on his channel the anomalous outflows from the exchange's BitGo wallets. Only after that did Rain publish a statement on its own site. On 13 May CoinDesk wrote that «Rain did not immediately respond to CoinDesk's request for comment». For an operator whose sales argument is its licence, this is not a side point: the market learned of a 14.8 million dollar loss from an independent researcher, two weeks after the fact. WHAT RAIN SAID, AND IN WHAT WORDS. In the 13 May statement the exchange acknowledged the incident, said it had taken «immediate steps» to strengthen platform security and that it was cooperating with the relevant legal and regulatory authorities. On customer money the wording reported by several outlets is this: funds are «under custody, fully accounted for and held on a 1:1 basis», and the Rain Group has «covered any potential losses resulting from this incident, ensuring that our customers' interests remain protected». In other words the company absorbed the loss out of its own resources, with no haircut to balances: the same pattern as Bitstamp in 2015, the opposite of Bitfinex in 2016. ⚠️ ON THE AMOUNT, THE RANGE MUST BE STATED. This card carries 14.8 million dollars, which is ZachXBT's measurement as reported by CoinDesk and Halborn and is the most circumstantial (it breaks down per asset: 137.9 BTC and 1,881 ETH). Other sources report «about 15 million» and some later accounts speak of 16 or 16.13 million dollars. Rain has NEVER published a figure of its own, so no number here is the company's: they are all third-party estimates of proceeds converted into two assets while the price moved. ⚠️ ON ATTRIBUTION, WHAT WE DO NOT ASSERT. There is a circulating attribution, carried by an encyclopaedia entry and by a Forbes article of 4 December 2024, of the theft to the North Korean Lazarus group, with access obtained by contacting an employee on LinkedIn with a fake job offer and a fake coding exercise that installed the TraderTraitor malware; the link would be documented in a US Department of Justice seizure warrant and in a Mandiant analysis. We do not write it as fact: the Forbes article returns 403 to our access and we could open neither the warrant nor the analysis. If a source does not open, the data does not exist — it stays noted as an attribution to be verified, not as an established cause. WHY THIS ENTRY IS MARKED CLOSED. Not because the money came back: the 137.9 BTC and 1,881 ETH were never recovered and the destination wallets were already inactive in the following days. It is closed on the side that concerns anyone who held an account: the company states in the past tense that it covered the loss, operations never stopped, and in over two years not a single public report has emerged of customers left out of pocket over this incident. It remains a company statement, not an independent verification, and this card says so.

Latest verified information

Following an inspection from 19/09/2022 to 22/12/2022, the Bank of Italy found shortcomings in customer risk profiling, customer due diligence and active cooperation (suspicious transaction reporting) under Legislative Decree 231/2007. By decision of 23/01/2024 it fined the bank €35,000, taking into account the corrective action already under way. According to the 2023 annual report, the board decided not to appeal. The findings concern internal controls, not customer funds.

Latest verified information

Six months after the $37.3 million theft, CoinsPaid was hit again. The alert did not come from the company but from outside: security firm Cyvers detected anomalous transactions and its CEO Deddy Lavid gave the precise time — "on January 5, 2024, at 6:13:23 PM UTC" — and the total: $7.5 million across BNB Chain and Ethereum. The reported composition is $6.1 million in USDT, ETH and USDC, over $1 million in BNB and roughly $368,000 in CoinsPaid's own CPD token, swapped into ETH. The funds moved to externally owned accounts and other exchanges, including MEXC, WhiteBIT and ChangeNOW; WhiteBIT said it had frozen what arrived from there. A NOTE ON THE DATE. Several outlets date the episode to 6 January 2024, which is the day the detection became public; here the date is the one matching the UTC timestamp given by whoever measured it, 5 January. It is the choice we always make: date the fact, not the news. THE SILENCE IS THE DATA POINT. Unlike July 2023, when CoinsPaid published a detailed post-mortem, on this second episode the company issued no public comment: the outlets said so in the days immediately after, and no later statement is on record. So we do not know whether the funds hit were the company's or clients', nor what the vector was, nor whether anything was recovered. When the victim does not speak, the only honest thing to write is that it does not speak.

Latest verified information

A former employee's NPM account was phished despite 2FA: the attacker published three versions of Ledger Connect Kit carrying a drainer, hitting dApps that loaded the library for about five hours. Root cause stated by Ledger: access to external tools was not automatically revoked at offboarding. Ledger committed to reimbursing all victims, including non-customers. The $484,000 figure is CoinDesk's estimate: the official technical report gives no total.

Latest verified information

On 5 December 2023 the Monetary Authority of Singapore (MAS) added imToken PTE Ltd to its Investor Alert List, the list of operators offering services without a licence from the regulator. It is an investor warning, not a conviction nor a monetary penalty. imToken said it is in dialogue with MAS to clarify its decentralised wallet model and to request removal; as of the verification date it does not appear to have been removed from the list.

Latest verified information

On 22 November 2023 the hot wallets of the HTX exchange (formerly Huobi) and the HECO cross-chain bridge — the chain HTX built to move assets cheaply between blockchains — were drained on the same day. Justin Sun, founder and adviser to the platform, confirmed the attack that same day on his X account: «HTX and Heco Cross-Chain Bridge Undergo Hacker Attack. HTX Will Fully Compensate for HTX's hot wallet Losses». Deposits and withdrawals were suspended on both platforms as a precaution. THE FIGURE: WHY WE DO NOT WRITE JUST ONE. The sources do not converge, and putting a single number on the card would give an air of precision the facts do not have. On the exchange's hot wallets: an HTX spokesperson mentioned about 30 million dollars (South China Morning Post), while two days later the company revised its own count to 13.6 million; other accounts say 12.5 million. On the HECO bridge: 86.6 million per Cointelegraph, 83.4 million per other on-chain readings, «more than 85 million» per SCMP. Published totals therefore range from 97 million (CoinDesk) to 115 million (CNBC, which explicitly writes «so far»). What the sources do agree on is the order of magnitude — about one hundred million dollars — and the split: the large part is the bridge, not the exchange. THE CAUSE. Security firm Cyver, cited by CoinDesk, points to a suspected private key leak as the vector of the attack on the HECO bridge; for the exchange's hot wallets several independent analyses suggested a phishing attack. HTX has never published a technical post-mortem confirming either hypothesis. The context should be recorded too, because it is part of the fact: according to CNBC and SCMP this was the fourth attack in two months on HTX and entities linked to Justin Sun. WHAT HAPPENED NEXT. Services reopened on 24 November 2023, a little over 24 hours after the announcement, with the statement that «the funds lost during this incident constitute only a minor fraction of the platform's total capital» and a commitment to «100% safety of user funds». The market responded anyway: in the following weeks the platform recorded about 258 million dollars of net outflows (PYMNTS, Business Standard, December 2023) — more than double what was stolen. THE BRIDGE NEVER CAME BACK, AND THAT IS THE PART THAT WEIGHS MOST ON HECO USERS. The HECO chain was not restored: it was shut down. Users holding HRC20 assets were told to deposit them on HTX by 10 January 2025; deposits were converted into points, then redeemed in the HTX token distributed in 12 tranches from 15 January 2025. That is an orderly wind-down, not a restitution: whoever held assets on HECO received a different asset, on terms set by the company, and whoever missed the window received nothing. WHY WE MARK IT CLOSED, AND WHAT REMAINS UNVERIFIED. The fact is closed: operations were restored in two days, almost three years have passed, and the chain involved has been formally wound down. But «full reimbursement» remains a company statement: there is no public accounting, by the company or by third parties, documenting how many users were compensated and for how much, and Sun's promise explicitly covered only HTX's hot wallets, not the bridge.

Latest verified information

A $3.4bn FinCEN penalty with a five-year monitorship and a $968,618,825 OFAC settlement for 1,667,153 apparent sanctions violations, plus parallel resolutions with the DOJ and CFTC. Founder Changpeng Zhao pleaded guilty, stepped down as CEO and paid $50m.

Latest verified information

Between 17 and 18 November 2023 open interest on the YFI perpetual market on dYdX v3 rose from around $0.8 million to roughly $67 million, with the price on the platform well above other perpetual venues; when the position was liquidated, the insurance fund absorbed about $9 million, roughly 40% of its value. Founder and CEO Antonio Juliano publicly called it a clearly targeted attack against dYdX based on manipulation of the entire YFI market, announcing a review of the v3 risk parameters and an investigation with several partners. No user funds were compromised: the insurance fund exists precisely to cover liquidation losses and did its job, remaining capitalised at around $13.5 million afterwards. YFI fell about 40% in the following hours. The incident concerns dYdX v3, the earlier version on Ethereum/StarkEx, not the independent Cosmos chain dYdX runs on today.

Latest verified information

Penalty on Foris DAX MT Limited for offering crypto services in the Netherlands for about two years without registration, which it obtained in July 2023. A EUR 2 million base, increased for the significant number of Dutch customers and unpaid supervisory fees. Crypto.com said it is appealing.

Latest verified information

Overnight between Sunday 24 and Monday 25 September 2023, about 5,000 ether — just under 8 million dollars at the time — were taken from an HTX hot wallet. Justin Sun publicly confirmed the episode and stated that the company had already covered the loss, adding that it represented a minimal fraction of the platform's reserves. THE PUBLIC NEGOTIATION. Instead of going straight to the authorities, HTX offered the attacker a 5% bounty on the funds (about 400,000 dollars) and, publicly, a security adviser role, giving them a week before law enforcement would be involved. On 7 October 2023 the attacker returned the entire sum in two transactions, of roughly 4,000 and 1,000 ether. Sun confirmed: «We have confirmed that the hacker has fully returned all funds, as promised, and we have also paid the hacker a whitehat bonus of 250 ETH». WHY IT STAYS ON THE CARD EVEN THOUGH THE MONEY CAME BACK. The outcome is the best possible one — no user lost anything and the matter closed in thirteen days — which is why the severity here is «moderate» and not «critical». But the fact remains relevant for two reasons. First: the loss was possible because a hot wallet key turned out to be usable by an outsider, and two months later the same kind of exposure cost far more (the incident of 22 November 2023). Second: the return depended on the attacker's voluntary choice after a negotiation, not on a technical control or an insurance cover — it is not a mechanism a user can count on.

Latest verified information

On 30 July 2023, between 13:10 and 22:00 UTC, four Curve pools were drained one after another. The flaw was not in Curve's code: it was in the compiler. Versions 0.2.15, 0.2.16 and 0.3.0 of the Vyper language produced a reentrancy guard that did not work — the lock was there in the source and absent from the compiled contract. Whoever wrote those pools had done the right thing and was exposed anyway. The bug had been fixed in version 0.3.1, but the contracts already deployed were the old ones. THE POOLS AND THE FIGURES, ONE BY ONE (LlamaRisk analysis): pETH/ETH, 6,106.65 WETH (~11 million dollars); msETH/ETH, 866.55 WETH (~1.6 million) and 959.71 msETH (~1.8 million); alETH/ETH, 7,258.70 WETH (~13.6 million) and 4,821.55 alETH (~9 million); CRV/ETH, 7,193,401.77 CRV (~5.1 million at the time of the attack), 7,680.49 WETH (~14.2 million) and 2,879.65 ETH (~5.4 million). Total around 74.5 million dollars. Press estimates range between 52 and 74 million depending on what is counted and at which prices: the figure here is the one from the technical summary, with the per-pool detail so it can be checked. WHAT CAME BACK ON ITS OWN. Part of the funds was extracted ahead of the attackers by whitehat operators: 2,879.65 ETH (~5.4 million) taken out of the CRV/ETH pool by c0ffeebabe.eth were returned to the Curve team. Other funds were handed back by the attacker to Alchemix and JPEG'd after those projects offered the 10% bug bounty reward. The other pools were not so lucky. THE REIMBURSEMENT, AND THE DETAIL THAT CHANGES WHAT THE WORD MEANS. On 21 December 2023 governance approved, with 94% of the vote, the distribution of about 49.2 million dollars to the affected liquidity providers in the Curve, JPEG'd, Alchemix and Metronome pools. Of that, about 7.2 million were ETH actually recovered; the remaining roughly 42 million were paid in CRV tokens subject to vesting, drawn from the community fund (55,544,782.73 CRV approved in total). Put another way: those who had put ETH into the pools largely got back the protocol's governance token, released over time and at a price that can move in any direction. It is a real, voted reimbursement rather than a promise — but it is not the same thing as getting back what was deposited, and this page does not write it as if it were. WHY IT STILL MATTERS. The case is closed, the lesson is not: the risk was neither in the contract nor in that contract's audits — the audits existed — but one layer below, in the compiler, which none of the checks in use was looking at.

Latest verified information

On 22 July 2023 CoinsPaid — the crypto payment gateway operated by Estonia's Dream Finance OÜ — lost $37.3 million. The reconstruction comes from the company itself, in a post-mortem published on its own site on 7 August 2023, and the entry point is the part worth remembering: an employee answered a fake job offer presented as coming from Crypto.com and, to complete the "test assignment" requested, installed a program containing malicious code. From there, profiles and access keys to the internal infrastructure were stolen. WHAT THE COMPANY STATES. Client funds "were not affected and are fully available": the attack hit the company's own operating wallets, not merchant balances. The attackers, CoinsPaid writes, could not breach the hot wallets or access private keys directly; the internal alarm system fired and made it possible to stop the activity and shut the access down. The company also describes the run-up: constant unsuccessful attacks logged from March 2023, ranging from social engineering to DDoS and brute force, before the one that worked. On 7 July 2023, between 20:48 and 21:42, there had been a massive preparatory attack. THE ATTRIBUTION, AND WHO MAKES IT. It is the victim that names Lazarus, the group linked to North Korea, writing that it left the attackers "a record-low reward". It remains an attribution by an interested party: no authority has publicly certified it. Bloomberg reported on 28 July 2023 that the company turned to the Estonian authorities, and the episode was covered by BleepingComputer, Cointelegraph and CoinDesk. WHAT CANNOT BE SAID. In those same weeks another processor, AlphaPo, suffered a much larger theft, and several accounts add the two together to reach figures around $100 million: they are different companies, and we do not conflate them here. Nor is there any record of the $37.3 million being recovered: the "over $70 million recovered" figure in circulation refers to the several dozen cases handled by the analytics firm Match Systems as a whole, not to this incident.

Latest verified information

A mismatch between European and US payment systems meant that on certain declined transactions Revolut erroneously refunded accounts with its own money. Organised criminal groups exploited the loophole for several months during 2022. The loss hit company money, not customer accounts, and only came to light after a US partner bank flagged it. The loophole was later closed. The date shown is that of the press report, not of the event.

Latest verified information

Announced in December 2022 as a phase-out of all US products. The settlement with state regulators required Nexo to notify remaining US clients to withdraw their assets by 1 April 2023; withdrawals stayed open. Nexo formally re-entered the US market on 16 February 2026.

Latest verified information

On 11 March 2023 Circle disclosed that 3.3 billion dollars of the reserves backing USDC — roughly 8% of a total of about 40 billion — sat at Silicon Valley Bank, the Californian bank placed into receivership by regulators the day before. The announcement came with banking markets closed, on a Friday evening: the market makers who normally hold USDC at one dollar could not hedge until the open, and on secondary markets the stablecoin fell to around 0.87-0.88 dollars, the most severe break of parity USDC has ever recorded. On 12 March the US Treasury and prudential regulators announced that all depositors of Silicon Valley Bank and Signature Bank would be made whole; Circle published a note the same day with an explicit title — "3.3 billion of USDC reserve risk removed, dollar de-peg closes" — stating those funds would be "fully available when U.S. banks open tomorrow morning" and that USDC "remains redeemable 1:1 with the U.S. Dollar". Parity was restored in the hours that followed. Those who waited for redemption lost nothing; those who sold over the weekend realised the price difference, but not because of a hole in the reserves: the collateral existed, it was temporarily unreachable. In the same communication Circle disclosed the reserve composition: 77% (32.4 billion) in short-dated US Treasury bills custodied at BNY Mellon with liquidity management by BlackRock, 23% (9.7 billion) in cash held primarily at BNY Mellon. The episode is closed: the reserves were recovered in full, there were no losses for holders who redeemed, and the banking concentration of the reserves has since been restructured.

Latest verified information

The document is public and we read it in full: it is consent order FDIC-22-0040b, issued by the Federal Deposit Insurance Corporation against Cross River Bank, Teaneck, New Jersey. The bank signed the stipulation on 8 March 2023; the FDIC made it public on 28 April 2023 together with the month's other actions. WHAT THE REGULATOR FOUND. The FDIC "considered the matter and determined" that the bank engaged in unsafe or unsound banking practices related to its compliance with applicable fair lending laws and regulations, "by failing to establish and maintain internal controls, information systems, and prudent credit underwriting practices" in conformance with the safety and soundness standards of Appendix A to 12 C.F.R. Part 364, or violations of the Equal Credit Opportunity Act (Regulation B) and the Truth-in-Lending Act (Regulation Z). The finding stems from the 3 May 2021 Consumer Compliance Report of Examination. ONE CLARIFICATION THAT HAS TO BE MADE. In the text the bank "neither admits nor denies" the charges: that is the standard formula of US consent orders. The order does not accuse Cross River of any specific discriminatory practice and does not require it to make restitution to customers. What it does describe is a control failure: the bank lent through fintech partners that decided creditworthiness with automated algorithms, and in the regulator's view it did not have oversight adequate to that model. WHY IT MATTERS IF YOU ARE CHOOSING A SPONSOR BANK. The order requires the board to "immediately" increase its supervision of the system of internal controls, information systems, credit underwriting practices and internal audit related to consumer protection laws — what the bank itself calls its Marketplace Lending Compliance Management System. But the clause that changes things in practice is another one: Cross River must carry out enhanced due diligence and obtain the FDIC's prior approval before entering any new fintech partnership. For anyone evaluating Cross River as a BIN sponsor, that means onboarding a new programme does not depend on the bank alone. STATUS AT THE VERIFICATION DATE. A consent order stays in force until the FDIC formally terminates, modifies or suspends it. As of this verification no termination order appears to have been published, and the most recent press coverage (July 2026, about Cross River's role as the FDIC-insured bank behind X Money) still describes it as active. We write that as a check on what is publicly on the record, not as a certainty: if and when the FDIC publishes a termination, this entry should be closed.

Latest verified information

The SEC charged Nexo Capital with failing to register the offer and sale of its Earn Interest Product, finding it to be a security. Nexo paid $22.5 million to the SEC and the same again to state regulators across 50+ jurisdictions, without admitting or denying the findings, accepting a cease-and-desist order and ending the product for US investors. The SEC credited Nexo's cooperation and its voluntary halt of the product from February 2022. No fraud charges and no loss of client funds.

Latest verified information

After the Bulgarian prosecutors' raid, alleging money laundering, tax crimes, computer fraud and unlicensed banking, Nexo said it saw no abnormal withdrawal activity despite on-chain outflows. On 22 December 2023 prosecutors closed the probe finding no evidence of crime. Nexo subsequently filed an international arbitration claim against Bulgaria.

Latest verified information

The New York State Department of Financial Services found the customer due diligence programme “immature and inadequate”, transaction monitoring ineffective, and identified more than 100,000 unreviewed alerts by late 2021. Coinbase accepted a $50 million civil penalty, neither tax-deductible nor insurable, and committed to invest at least a further $50 million in its compliance programme within 24 months, under an independent monitor.

Latest verified information

On 16 December 2022 at 10:12 UTC an attacker began removing liquidity from Raydium using the **Pool Owner (admin)** account of the Liquidity Pool V4 program. The technical point, and Raydium writes it in its own post-mortem, is that **there was no vulnerability in the contracts**: the attacker held the private key of the administrative authority, most likely through trojan-type malware on the machine holding it. With that key they called a fee-withdrawal function and drained **eight constant-product pools** for roughly **4.4 million dollars** in total, in RAY, stSOL, whETH, USDC, SOL, UXP, ZBC and USDT. Developers shipped a patch within hours, blocking any further reach into the other pools. The recovery attempt failed: Raydium publicly offered a 10% bounty plus the stolen RAY balance, and the attacker returned nothing. At that point the protocol did the only thing left, and saw it through: governance authorised the use of buyback revenues and team token allocations to reimburse liquidity providers, against a snapshot of LP balances taken at the moment of the exploit. The **claim portal** stayed open until **14 May 2023 at 23:59 UTC** and returned **100% of the principal** lost on RAY-USDC, RAY-SOL and RAY-USDT, and **90%** on SOL-USDC, SOL-USDT, stSOL-USDC, ETH-USDC, UXP-USDC and ZBC-USDC. Whatever went unclaimed returned to the Buyback Treasury. Stated precisely, because the difference matters: this is not a promise of a refund, it is a refund made and closed — but not whole for everyone, six pools out of nine recovered nine tenths.

Latest verified information

On 14 December 2022 Gemini published a notice on its official blog about phishing campaigns aimed at its customers, explaining that "an incident at a third-party vendor" had allowed an unauthorised actor to collect email addresses and partial phone numbers of some customers. The same day an archive of 5,701,649 lines carrying that data began circulating; Have I Been Pwned, which indexed it on 16 Dec 2022, counts roughly 5.3 million distinct accounts — the two figures differ because the lines include duplicates, so read the first as the size of the archive and the second as the number of people. The phone numbers were truncated, with some digits hidden. The company states the archive did NOT contain names, addresses or KYC documentation, and above all that "no Gemini account information or systems were impacted" and that "all funds and customer accounts remain secure": the breach was the vendor's, not the exchange's. The data did not appear out of nowhere: it had been on sale on forums since September 2022 for 30 bitcoin (about 520,000 dollars at the time), reoffered in October and in mid-November bundled with archives from other exchanges, and only later published for free. ⚠️ Gemini never named the vendor. Have I Been Pwned attributes the origin to Twilio, which processed Gemini customer data through its Authy two-factor authentication service and which traced its own breach to "a sophisticated social engineering attack designed to steal employee credentials": it is a coherent third-party attribution, but the company has not confirmed it and it should be kept distinct from the facts it did state. No post-mortem, no official count of affected customers.

Latest verified information

Shortly before midnight UTC on 1 November 2022 Deribit's hot wallet was compromised: USD 28 million left in BTC, ETH and USDC (the latter immediately converted into ETH). Deribit locked all withdrawals at once, including third-party integrations (Copper Clearloop, Cobo Loop, Banxa), and disclosed the incident on its X account at 07:00 UTC on 2 November. Withdrawals reopened the same day: Copper Clearloop and Cobo Loop at 15:30, ordinary on-chain withdrawals at 23:00 on 2 November. The official incident report of 7 November 2022 states that trading, client assets, the Insurance Fund, Fireblocks, Copper Clearloop, Cobo Loop and every cold storage address were untouched, that there are no indications of client or account information being compromised, and that unauthorised client withdrawals were zero. The loss was absorbed by the company's balance sheet — not by the Insurance Fund, which at the time held around USD 40 million. On 2 November management of BTC, ETH and USDC moved entirely to Fireblocks, with every withdrawal requiring manual confirmation by an administrator (stated target window: 60 minutes). The stolen funds stayed put until 5 November, when they were routed into the Tornado Cash mixer. ⚠️ Two points this registry keeps explicit. First: the official report does NOT say how the attacker got in — only that the hot wallet «was compromised». The sole explanation in circulation is a statement by chief commercial officer Luuk Strijers to the press («hackers have gained access to our wallet server»), which does not appear in the company document: it is reported as a statement, not as an established cause. Second: the event dates to November 2022 and concerns Deribit B.V. as a standalone, Panama-registered company. Coinbase's acquisition closed in August 2025, almost three years later: this is not a Coinbase-era incident and it has not been replicated onto the Coinbase cards.

Latest verified information

The suit, alongside coordinated actions by seven other state regulators the same day, alleged failure to register as a broker-dealer, false claims of being a “licensed and registered platform”, and offering the Earn Interest Product to about 10,000 New Yorkers. Resolved by the January 2023 multistate settlement, which also imposed a five-year ban on offering securities in New York.

Latest verified information

Unauthorised database access via social engineering. 50,150 customers affected, 20,687 of them in the European Economic Area: names, addresses, emails, phone numbers and partial card data. Revolut said no PINs, passwords or funds were exposed and notified Lithuania's data protection authority. A wave of phishing SMS to users followed in the following days.

Latest verified information

On 9 August 2022 the nameserver for the curve.fi domain was compromised at the registrar iwantmyname. Anyone typing the official address landed on an identical copy of the site which, instead of the normal operations, asked users to sign an approval in favour of an attacker-controlled contract: funds were pulled from the victim's own wallet, not from the protocol's reserves. Curve raised the alarm from its official account — «don't use the site, the nameserver is compromised» — and about an hour later announced it had found and reverted the configuration, urging anyone who had approved contracts on Curve in the preceding hours to revoke those approvals «immediately». Specialist press reconstructions put the amount taken in that window at slightly over 573,000 dollars. TWO THINGS TO KEEP SEPARATE. Curve's smart contracts were not touched: liquidity providers in the pools lost nothing from this event. Those who lost money were users who signed on the fake site during that hour. It is an attack on the service's web layer, not on the protocol — but it is still a fact about the service, because the hijacked domain was its own. WHAT DID NOT HAPPEN. No restitution to the affected users is on record: the 573,000 dollars never came back. The case is closed in the sense that the domain was recovered the same day, not in the sense that anyone was repaid. THE PRECEDENT THAT MATTERS. The registrar involved, iwantmyname, is the same one as in the May 2025 hijack recorded below: the same external dependency failed twice three years apart, and it is the reason Curve abandoned the .fi domain in 2025.

Latest verified information

Measure no. 254 of 05/07/2022, following an inspection from 8 March to 4 June 2021: shortcomings in organisation, remuneration policies and risk management, particularly credit and operational risk (art. 53 TUB). €100,000 fine. The official page shows no appeal.

Latest verified information

By decision no. 30210 of 21 June 2022 (case PS12164, Bulletin no. 26 of 11 July 2022), acting on a 4 October 2021 report from the Bank of Italy, Italy's competition and market authority found that from 2016 to September 2021 Extrabanca's mortgage contracts contained a salary-channelling clause requiring the customer to hold a current account at the bank: to get the mortgage you had to open an Extrabanca account, costing on average about €80 a year, above the market average. Over the period the bank granted 578 mortgages worth €62.3 million, of which 418 (€43.9 million) came with an account opened at the same time, and 372 accounts carried the salary-channelling clause. The authority treated it as an aggravating factor that the bank's customers are mostly non-EU nationals and therefore more exposed through language, cultural and financial-literacy barriers. The practice is unfair in itself under article 21(3-bis) of the Italian Consumer Code. The base fine of €250,000 was cut to €150,000 for the steps taken: the clause was removed from contracts in September 2021 and on 15 April 2022 the bank credited affected customers €30 for each year of the relationship, writing to tell them they may debit instalments and receive their salary at any bank. Two sets of commitments offered by Extrabanca had been rejected. The decision can be appealed to the Lazio regional administrative court; we have no record of the outcome of any appeal.

Latest verified information

By injunction order no. 226 of 16 June 2022 the Italian data protection authority (Garante) fined Deutsche Bank S.p.A. (Milan) 20,000 euro. The established fact: a request to access their own data, filed by a customer on 13 July 2020 and sent by certified email, received no reply either “without undue delay and in any event at the latest within one month” of receipt, or by way of a communication of the reasons for non-compliance within the required time. Articles 12(3) and 15 GDPR were found to be breached. The bank's two defences were both rejected, and that is the instructive part of the decision: the fact that the request sat inside a longer, broader complaint does not make it invisible — the Garante found it clearly formulated and properly delivered; and the claim that the information was “already known” to the customer does not remove the obligation, because the right of access also serves to verify that the data are accurate. ⚠️ What this fact is NOT: it is not a data leak, no customer's data left the bank. It is a national authority's sanction over how the rights of the people whose data it holds were handled: the reason it is recorded — at `minore` severity, since it concerns a single request and the amount is modest — is that it concerns the company, not one product, and therefore applies to every Deutsche Bank S.p.A. card. `risolto: false` with `in_corso: false`, i.e. “open” rather than “under way”: the order dates from 2022 and the open sources consulted do not say whether it was paid or challenged. We state the certain fact and the unverified outcome, instead of pretending to know.

Latest verified information

By injunction order no. 226 of 16 June 2022 the Italian data protection authority (Garante) fined Deutsche Bank S.p.A. (Milan) 20,000 euro. The established fact: a request to access their own data, filed by a customer on 13 July 2020 and sent by certified email, received no reply either “without undue delay and in any event at the latest within one month” of receipt, or by way of a communication of the reasons for non-compliance within the required time. Articles 12(3) and 15 GDPR were found to be breached. The bank's two defences were both rejected, and that is the instructive part of the decision: the fact that the request sat inside a longer, broader complaint does not make it invisible — the Garante found it clearly formulated and properly delivered; and the claim that the information was “already known” to the customer does not remove the obligation, because the right of access also serves to verify that the data are accurate. ⚠️ What this fact is NOT: it is not a data leak, no customer's data left the bank. It is a national authority's sanction over how the rights of the people whose data it holds were handled: the reason it is recorded — at `minore` severity, since it concerns a single request and the amount is modest — is that it concerns the company, not one product, and therefore applies to every Deutsche Bank S.p.A. card. `risolto: false` with `in_corso: false`, i.e. “open” rather than “under way”: the order dates from 2022 and the open sources consulted do not say whether it was paid or challenged. We state the certain fact and the unverified outcome, instead of pretending to know.

Latest verified information

By injunction order no. 226 of 16 June 2022 the Italian data protection authority (Garante) fined Deutsche Bank S.p.A. (Milan) 20,000 euro. The established fact: a request to access their own data, filed by a customer on 13 July 2020 and sent by certified email, received no reply either “without undue delay and in any event at the latest within one month” of receipt, or by way of a communication of the reasons for non-compliance within the required time. Articles 12(3) and 15 GDPR were found to be breached. The bank's two defences were both rejected, and that is the instructive part of the decision: the fact that the request sat inside a longer, broader complaint does not make it invisible — the Garante found it clearly formulated and properly delivered; and the claim that the information was “already known” to the customer does not remove the obligation, because the right of access also serves to verify that the data are accurate. ⚠️ What this fact is NOT: it is not a data leak, no customer's data left the bank. It is a national authority's sanction over how the rights of the people whose data it holds were handled: the reason it is recorded — at `minore` severity, since it concerns a single request and the amount is modest — is that it concerns the company, not one product, and therefore applies to every Deutsche Bank S.p.A. card. `risolto: false` with `in_corso: false`, i.e. “open” rather than “under way”: the order dates from 2022 and the open sources consulted do not say whether it was paid or challenged. We state the certain fact and the unverified outcome, instead of pretending to know.

Latest verified information

By injunction order no. 226 of 16 June 2022 the Italian data protection authority (Garante) fined Deutsche Bank S.p.A. (Milan) 20,000 euro. The established fact: a request to access their own data, filed by a customer on 13 July 2020 and sent by certified email, received no reply either “without undue delay and in any event at the latest within one month” of receipt, or by way of a communication of the reasons for non-compliance within the required time. Articles 12(3) and 15 GDPR were found to be breached. The bank's two defences were both rejected, and that is the instructive part of the decision: the fact that the request sat inside a longer, broader complaint does not make it invisible — the Garante found it clearly formulated and properly delivered; and the claim that the information was “already known” to the customer does not remove the obligation, because the right of access also serves to verify that the data are accurate. ⚠️ What this fact is NOT: it is not a data leak, no customer's data left the bank. It is a national authority's sanction over how the rights of the people whose data it holds were handled: the reason it is recorded — at `minore` severity, since it concerns a single request and the amount is modest — is that it concerns the company, not one product, and therefore applies to every Deutsche Bank S.p.A. card. `risolto: false` with `in_corso: false`, i.e. “open” rather than “under way”: the order dates from 2022 and the open sources consulted do not say whether it was paid or challenged. We state the certain fact and the unverified outcome, instead of pretending to know.

Latest verified information

The French authority blacklisted Bybit for lacking digital-asset service provider registration, repeating the public warning in May 2024 and reserving the right to have the site blocked. Bybit was removed from the blacklist on 14 February 2025 after more than two years of remediation; Bybit EU GmbH now holds a MiCA authorisation from the Austrian regulator and appears on the French white list.

Latest verified information

On 5 May 2022 a federal court ordered Arthur Hayes, Benjamin Delo and Samuel Reed to pay $10 million each for operating an unregistered crypto derivatives platform, accepting orders and funds from US customers without CFTC registration, acting as an unregistered futures commission merchant and failing to implement adequate KYC and anti-money-laundering programmes. The conduct covered runs from November 2014 to 1 October 2020. On the criminal side the three had already been sentenced in 2022 for Bank Secrecy Act violations. Penalties paid, proceedings closed.

Latest verified information

On 28 February 2022 the Italian Competition Authority (AGCM) closed proceeding PS12146, fining Crédit Agricole Italia S.p.A. one million euros for an unfair commercial practice. WHAT THE APP DID. In the online banking app, before the update released on 11 October 2021, the instant transfer — the more expensive option compared with a standard one — carried the label "Suggested" beside it. And after the customer had nonetheless chosen a standard transfer, the costlier option was put forward again in a highlighted box reading "Proceed with instant". The Authority held the conduct capable of "exercising undue influence and considerably limiting the average consumer's freedom" in choosing the type of transfer, in breach of Articles 24 and 25 of the Italian Consumer Code. WHY THIS IS A FACT AND NOT AN ACCUSATION. That is what matters most here. Crédit Agricole challenged the decision, and by judgment no. 9315/2025 published on 15 May 2025 the Lazio Regional Administrative Court upheld the fine. So this is not a pending allegation but a penalty that has survived the first instance of administrative review. We find no subsequent ruling by the Council of State: if one arrives and reverses the outcome, this entry must be rewritten. WHY IT SITS ON A CURRENT ACCOUNT CARD. Because it is not a fact about an advertising campaign: it is a fact about the interface through which money moves — that is, about the product. The extra cost was paid by the customer on every transfer, and paid without having genuinely chosen it.

Latest verified information

Measure no. 28 of 25/01/2022: €100,000 for breaching the large-exposure limit (art. 395 CRR) and €85,000 for breaching reporting duties to the supervisor (art. 51 TUB). The bank's appeal was dismissed by the Rome Court of Appeal (ruling no. 7644/2023) and it then appealed to the Court of Cassation. The Bank of Italy page was last updated on 25/07/2024 and does not yet show the Cassation outcome.

Latest verified information

Withdrawals suspended for about 14 hours, 2FA tokens revoked and reset for all users. The company states no customer lost funds and all affected users were fully reimbursed.

Latest verified information

On 10 August 2021 a federal court ordered HDR Global Trading Limited, 100x Holding Limited, ABS Global Trading Limited, Shine Effort Inc Limited and HDR Global Services (Bermuda) Limited to pay $100 million, with up to $50 million offset by the parallel payment to FinCEN. The findings, covering November 2014 to 1 October 2020: operating a crypto derivatives platform without approval as a Designated Contract Market or Swap Execution Facility, acting as an unregistered futures commission merchant, failing to implement a Customer Identification Program and KYC procedures, failing to implement an adequate anti-money-laundering programme, and unlawfully accepting orders and funds from US customers on bitcoin, ether and litecoin derivatives. Penalty paid.

Latest verified information

Filed in the Northern District of California on behalf of over 270,000 customers, alleging negligence and downplaying the breach's scope. Dismissed in November 2021 for lack of jurisdiction, it was reversed on appeal by the Ninth Circuit on 1 December 2022, which found California jurisdiction based on about 70,000 wallets sold in the state. The case appears still pending and no settlement is on record.

Latest verified information

With measures no. 123 and no. 124 of 09/03/2021 the Bank of Italy fined the bank, then Banca di Credito Peloritano and under special administration, €200,000 in total. No. 123 (art. 144 Consolidated Banking Act, €100,000) concerns weaknesses in organisation and internal controls over the credit process. No. 124 (art. 62 Legislative Decree 231/2007, €100,000) concerns weaknesses in anti-money-laundering organisation and controls, including customer due diligence. The measures state that the bank, then under special administration, did not take part in the proceedings.

Latest verified information

By decision no. 28511 of 22 December 2020 (case PS11798, Bulletin no. 2 of 11 January 2021), Italy's competition and market authority fined Findomestic Banca €300,000 over an information omission on its own website: the page explaining how to suspend instalments on loans and leases under article 56(2)(c) of the Cura Italia emergency decree (decree-law 18 of 17 March 2020) stated the suspension was free of charge, but nowhere said how long the bank would take to reply — neither an estimated nor a maximum time. The downloadable request form did not state it either. Who it applied to, precisely: the suspension at issue was the one for loans and leases to small and medium-sized businesses, and the parties protected by the decision are «micro-enterprises» (fewer than 10 employees and under €2 million turnover), which the Italian Consumer Code treats as consumers for protection against unfair commercial practices. It was not the suspension of instalments on a card or a consumer loan. The figure that makes the omission concrete came from Findomestic itself: average processing time declared at two or three days, yet among the examples the bank put on the record are a request from late March granted on 14 May 2020, one from 31 March accepted on 15 May, one from 21 April approved on 15 May — «and other similar situations with response times exceeding 30 days». Anyone asking for a suspension in order not to miss an instalment could not know whether the answer would take three days or six weeks, and so could not weigh up alternatives. The bank's defence was that no rule required it to publish maximum processing times. The authority replied that the omission breaches article 22 of the Consumer Code regardless, because it is material: and it set the fine on the operator's size (2019 revenues of about €1,275 million) and on the «weakness of those targeted by the practice, namely micro-enterprises under difficulty and pressure connected to the health emergency». One notable element on the record is the Bank of Italy's opinion: as far as its own remit goes, the same conduct «does not amount to breaches» of the banking transparency rules. Two authorities, two yardsticks: what clears the supervisor's transparency check can still be an unfair practice towards the customer. The conduct ran from March 2020 to late September 2020, when Findomestic amended the site to add that the outcome would be communicated by email «within a maximum of 10 days from receipt of the complete documentation». The decision prohibits repeating the practice and orders payment within thirty days; it could be appealed to the Lazio regional administrative court within sixty days and we have no record of the outcome of any appeal.

Latest verified information

By decision no. 28511 of 22 December 2020 (case PS11798, Bulletin no. 2 of 11 January 2021), Italy's competition and market authority fined Findomestic Banca €300,000 over an information omission on its own website: the page explaining how to suspend instalments on loans and leases under article 56(2)(c) of the Cura Italia emergency decree (decree-law 18 of 17 March 2020) stated the suspension was free of charge, but nowhere said how long the bank would take to reply — neither an estimated nor a maximum time. The downloadable request form did not state it either. Who it applied to, precisely: the suspension at issue was the one for loans and leases to small and medium-sized businesses, and the parties protected by the decision are «micro-enterprises» (fewer than 10 employees and under €2 million turnover), which the Italian Consumer Code treats as consumers for protection against unfair commercial practices. It was not the suspension of instalments on a card or a consumer loan. The figure that makes the omission concrete came from Findomestic itself: average processing time declared at two or three days, yet among the examples the bank put on the record are a request from late March granted on 14 May 2020, one from 31 March accepted on 15 May, one from 21 April approved on 15 May — «and other similar situations with response times exceeding 30 days». Anyone asking for a suspension in order not to miss an instalment could not know whether the answer would take three days or six weeks, and so could not weigh up alternatives. The bank's defence was that no rule required it to publish maximum processing times. The authority replied that the omission breaches article 22 of the Consumer Code regardless, because it is material: and it set the fine on the operator's size (2019 revenues of about €1,275 million) and on the «weakness of those targeted by the practice, namely micro-enterprises under difficulty and pressure connected to the health emergency». One notable element on the record is the Bank of Italy's opinion: as far as its own remit goes, the same conduct «does not amount to breaches» of the banking transparency rules. Two authorities, two yardsticks: what clears the supervisor's transparency check can still be an unfair practice towards the customer. The conduct ran from March 2020 to late September 2020, when Findomestic amended the site to add that the outcome would be communicated by email «within a maximum of 10 days from receipt of the complete documentation». The decision prohibits repeating the practice and orders payment within thirty days; it could be appealed to the Lazio regional administrative court within sixty days and we have no record of the outcome of any appeal.

Latest verified information

By decision no. 28511 of 22 December 2020 (case PS11798, Bulletin no. 2 of 11 January 2021), Italy's competition and market authority fined Findomestic Banca €300,000 over an information omission on its own website: the page explaining how to suspend instalments on loans and leases under article 56(2)(c) of the Cura Italia emergency decree (decree-law 18 of 17 March 2020) stated the suspension was free of charge, but nowhere said how long the bank would take to reply — neither an estimated nor a maximum time. The downloadable request form did not state it either. Who it applied to, precisely: the suspension at issue was the one for loans and leases to small and medium-sized businesses, and the parties protected by the decision are «micro-enterprises» (fewer than 10 employees and under €2 million turnover), which the Italian Consumer Code treats as consumers for protection against unfair commercial practices. It was not the suspension of instalments on a card or a consumer loan. The figure that makes the omission concrete came from Findomestic itself: average processing time declared at two or three days, yet among the examples the bank put on the record are a request from late March granted on 14 May 2020, one from 31 March accepted on 15 May, one from 21 April approved on 15 May — «and other similar situations with response times exceeding 30 days». Anyone asking for a suspension in order not to miss an instalment could not know whether the answer would take three days or six weeks, and so could not weigh up alternatives. The bank's defence was that no rule required it to publish maximum processing times. The authority replied that the omission breaches article 22 of the Consumer Code regardless, because it is material: and it set the fine on the operator's size (2019 revenues of about €1,275 million) and on the «weakness of those targeted by the practice, namely micro-enterprises under difficulty and pressure connected to the health emergency». One notable element on the record is the Bank of Italy's opinion: as far as its own remit goes, the same conduct «does not amount to breaches» of the banking transparency rules. Two authorities, two yardsticks: what clears the supervisor's transparency check can still be an unfair practice towards the customer. The conduct ran from March 2020 to late September 2020, when Findomestic amended the site to add that the outcome would be communicated by email «within a maximum of 10 days from receipt of the complete documentation». The decision prohibits repeating the practice and orders payment within thirty days; it could be appealed to the Lazio regional administrative court within sixty days and we have no record of the outcome of any appeal.

Latest verified information

On 16 October 2020 OKEx (now OKX) suspended all cryptocurrency withdrawals, stating that one of its private-key holders was out of reach while cooperating with an investigation by the Chinese authorities. The holder was Mingxing 'Star' Xu, founder of OKCoin and CEO of OK Group. Deposits and trading stayed live, but for five weeks no user could move funds out. On 19 November 2020 the exchange announced the reopening, declaring 100% reserves and that all balances were fully withdrawable; withdrawals resumed on 26 November 2020. No user funds were lost and this was not a hack: the point is the custody architecture, which had made access to funds dependent on one individual being reachable.

Latest verified information

On 16 October 2020 OKEx (now OKX) suspended all cryptocurrency withdrawals, stating that one of its private-key holders was out of reach while cooperating with an investigation by the Chinese authorities. The holder was Mingxing 'Star' Xu, founder of OKCoin and CEO of OK Group. Deposits and trading stayed live, but for five weeks no user could move funds out. On 19 November 2020 the exchange announced the reopening, declaring 100% reserves and that all balances were fully withdrawable; withdrawals resumed on 26 November 2020. No user funds were lost and this was not a hack: the point is the custody architecture, which had made access to funds dependent on one individual being reachable.

Latest verified information

In 2020 Kraken Security Labs published an analysis of flaws in the CoolWallet S (the model preceding the Pro): the Android companion app kept the PIN and seed in cleartext in the phone's storage, exposing them to malware with device access. CoolBitX fixed the flaw in later updates. The incident concerns the S model, not the Pro, but is reported for historical continuity of the brand.

Latest verified information

Curve restored service over the following weekend and accelerated its migration away from Wirecard, bringing card and e-money issuing in-house. The FCA lifted the restrictions on Wirecard on 30 June 2020.

Latest verified information

Unauthorised access via an API key on 25 June 2020, found on 14 July through the bug bounty and disclosed on 29 July. In December 2020 the dump was published on a hacking forum: about 272,000 records with name, postal address and phone. Email and SMS phishing campaigns followed, along with physical-safety concerns since shipping addresses were exposed. No payment data, passwords, seed phrases or funds were compromised: the device itself was not breached. Ledger hired a CISO and expanded its bug bounty and continuous testing.

Latest verified information

Special administration ordered by Sicilian Region measure no. 456 of 16/04/2020. It ended on 28/02/2022, when the shareholders' meeting reappointed the corporate bodies and the bank returned to ordinary management. The new bodies took office on 01/03/2022 (Bank of Italy notice). In 2024 the bank merged with Tyche and took the name Tyche Bank.

Latest verified information

On 1 November 2019 BitMEX sent a general user update leaving recipients' email addresses in the visible field rather than in blind copy. The company confirmed it the same day in a blog post and a statement by deputy COO Vivien Khoo: the fault was in the mailing software, further sends were stopped as soon as the issue was spotted, and beyond the email addresses no personal data or account information was disclosed. BitMEX then forced a password reset for all users holding a balance without two-factor authentication. Estimates of the scale differ: contemporary reporting put it at roughly 22,000 recipients, while a third-party account claimed to have collected more than 400,000 addresses — a claim never verified nor confirmed by the company, which stays a claim here and is not treated as a figure.

Latest verified information

AGCM decision no. 27977, meeting of 29 October 2019, case PS11401, published in Bulletin no. 46 of 18 November 2019. Between January and 19 April 2019 Deutsche Bank ran, on the internet and through TV spots and leaflets, a prize promotion offering “a prize of +1% on the total invested” to those bringing their capital to the bank. The prize was then delivered in a form different from what the headline claim suggested: an electronic voucher with usage limits, not a sum of money. The authority found the practice unfair under Articles 21 and 23(u) of the Italian Consumer Code, prohibited it, and imposed a 4,000,000 euro fine. The proceeding started from reports by the consumer association Altroconsumo and by a consumer; on 17 April 2019 the AGCM had already adopted an interim measure. Opinions of the Bank of Italy and of the communications authority AGCOM were obtained. OUTCOME OF THE CHALLENGE. The Lazio regional administrative court upheld the fine and the Council of State rejected the bank's appeal with judgment no. 4994/2025 (R.G. 922/2024), published on 10 June 2025, finding the amount appropriate: the AGCM had correctly weighed the size of the bank, the gravity of the breach, how widely the message was spread and the information asymmetries typical of the sector. ⚠️ Source transparency: we read the sanctioning decision in the AGCM's own official bulletin; the appeal outcome is reported by a single trade publication (AziendaBanca) with verifiable case identifiers, whose full text we could not open. `risolto: true`: the proceeding is closed and the fine is final after the last instance. ⚠️ Closed does not mean compensated: an antitrust fine goes to the State, not to the people who took up the promotion, and the card does not tell it as if it were a refund. WHY IT SITS ON THIS CARD AND NOT ON THE OTHER Deutsche Bank ones: it is a commercial practice, and it concerned the current account and the investment services of account holders — not the cards or the term deposit. Facts concerning the company as a whole, such as personal-data sanctions, sit on every card instead.

Latest verified information

Between 1 and 6 October 2019 the group's IT consortium, Crédit Agricole Group Solutions, delivered bank statements by certified email (PEC) to customers other than the account holders those documents referred to: 2,219 messages in total. The two banks notified the breach to the Italian data protection authority (Garante) on 9 October 2019. THE DECISION. By prescriptive and sanctioning decision of 14 January 2021 (doc. web 9582744) the Garante found a breach of Articles 5(1)(f) and 32 of Regulation (EU) 2016/679 — the principles and measures on security of processing. The administrative fines are 1,650,000 euros against Crédit Agricole Italia S.p.A. and 315,023 euros against Crédit Agricole FriulAdria S.p.A., 1,965,023 euros in total. Crédit Agricole Group Solutions, the processor behind the technical fault, was not fined directly. WHAT GOT OUT. Not credentials and not money: accounting documents carrying the holder's name, account details and transactions, landing in another customer's certified mailbox. It is the kind of exposure that cannot be recalled and that changing a password does not repair. STATUS AT THE VERIFICATION DATE. The decision is still published on the Garante's site and no ruling annulling it appears on the record. We check this because a challenged fine is not a final one: here, on the public record, nothing points the other way.

Latest verified information

Between 1 and 6 October 2019 the group's IT consortium, Crédit Agricole Group Solutions, delivered bank statements by certified email (PEC) to customers other than the account holders those documents referred to: 2,219 messages in total. The two banks notified the breach to the Italian data protection authority (Garante) on 9 October 2019. THE DECISION. By prescriptive and sanctioning decision of 14 January 2021 (doc. web 9582744) the Garante found a breach of Articles 5(1)(f) and 32 of Regulation (EU) 2016/679 — the principles and measures on security of processing. The administrative fines are 1,650,000 euros against Crédit Agricole Italia S.p.A. and 315,023 euros against Crédit Agricole FriulAdria S.p.A., 1,965,023 euros in total. Crédit Agricole Group Solutions, the processor behind the technical fault, was not fined directly. WHAT GOT OUT. Not credentials and not money: accounting documents carrying the holder's name, account details and transactions, landing in another customer's certified mailbox. It is the kind of exposure that cannot be recalled and that changing a password does not repair. STATUS AT THE VERIFICATION DATE. The decision is still published on the Garante's site and no ruling annulling it appears on the record. We check this because a challenged fine is not a final one: here, on the public record, nothing points the other way.

Latest verified information

Attackers obtained API keys and 2FA codes and withdrew 7,000 BTC in a single transaction, about 2% of BTC holdings. Binance covered the loss in full via the SAFU fund: no user funds were affected.

Latest verified information

On 7 January 2019, between 00:40 and 04:20 UTC, the Ethereum Classic network suffered a 51% attack: properly confirmed transactions were voided by a chain rollback. The party that lost money was Gate.io, which had already credited those deposits. The exchange tells the story itself: on 8 January 2019 Gate.io Research published its own analysis — seven rolled-back transactions, four attributed to the attacker for 54,200 ETC in total (about $271,500 at the time), with an actual loss to the exchange of roughly 40,000 ETC — and stated that "Gate.io will take all the loss for the users". On 12 January 2019 at 04:07 UTC Gate.io published a second official announcement: "On Jan.10, we found that the recent ETC 51% attacker returned 100k USD value of ETC back to Gate", adding that it had tried to contact the attacker without reply and did not know the reason. The technical point, which is the interesting part for anyone assessing the exchange: the attack targeted the network, not Gate.io's systems, but the loss landed on the exchange because it credited ETC deposits after too few confirmations. After the incident Gate.io raised its ETC confirmation threshold (from 12 to 500, per its own communication at the time) and introduced a double-spend alert system for proof-of-work chains. What we did NOT find, and we say so: a past-tense confirmation that user reimbursement was completed. The 2019 commitment is forward-looking; in seven years no users appear to have been left short, there is no litigation and no collective complaint, and that is why the case is treated as closed — not because a closure statement exists.

Latest verified information

Electrum is a light wallet: it does not download the blockchain, it connects to servers on the public ElectrumX network. Up to version 3.3.3 the client displayed error messages received from the server as rich text, unfiltered — Qt's default behaviour. An attacker therefore put a large number of malicious servers online across different IP address ranges, to raise the odds of clients connecting to them: when a user tried to broadcast a transaction, the server replied with a fake error message inviting them to download an Electrum 'update'. That file was malware, and installing it emptied the wallet. The flaw is documented by the developers themselves in the report opened on 26 December 2018 in the project's official repository, and was closed in version 3.3.3; from 3.3.4 onwards server messages are no longer rendered as rich text. An independent analysis estimated that at its peak the attacker controlled around 70% of the network's servers. Figures differ across sources and none is official: from the 200+ BTC of the early accounts to the 771+ BTC attributed to the whole series of attacks, which continued for months into 2019 — which is why no amount is stated here. Affected users were not reimbursed: Electrum is free, non-custodial software, and there is no intermediary to claim from. The case is closed in the sense that the vulnerability was fixed years ago, not in the sense that anyone recovered what was taken.

Latest verified information

On 28 March 2018 the FDIC announced settlements with Cross River Bank (Teaneck, New Jersey) and Freedom Financial Asset Management, LLC (San Mateo, California) for unfair and deceptive practices in violation of Section 5 of the Federal Trade Commission Act, in the marketing and origination of "Consolidation Plus" loans, offered exclusively to consumers already contracted with the affiliated debt settlement company, Freedom Debt Relief. WHAT WAS FOUND. According to the regulator, consumers were required to sign loan documents without knowing the loan's essential terms; they were not told that major creditors do not negotiate with the debt settlement company; they were told the loan would result in all their debts being settled within 30 to 45 or 30 to 90 days; and the claims about credit improvement were misleading too. Violations of the Truth in Lending Act and the Electronic Fund Transfer Act were found alongside. THE FIGURES. A civil money penalty of $641,750 against Cross River Bank and $493,500 against Freedom Financial Asset Management. Separately, $20 million was placed in a segregated account to provide restitution to harmed consumers; in its release the FDIC specifies that the exact final restitution amount had not yet been determined. Both firms stipulated to their respective consent orders without admitting or denying the violations. HOW WE COUNT IT. We treat this as a closed case: the proceeding ended in a settlement, the penalties were assessed and the restitution fund was established. What no public document we could find reports is the final amount actually distributed to consumers: we say so because money set aside and money received are not the same thing, and here only the first of the two is documented. WHY IT STAYS ON THE CARD EIGHT YEARS ON. Not to tally up precedents, but because it is the same pattern as the 2023 order: a bank lending through a third-party partner and answering for how that partner treats the end customer. On a card aimed at people evaluating Cross River precisely as infrastructure operated on behalf of others, the two facts read together.

Latest verified information

On Christmas Day 2016 an attacker activated a new phone number on the PIN-protected Verizon account of KeepKey founder Darin Stanchfield, and used that number to trigger his email account recovery. From there they began resetting the passwords of services linked to that mailbox, including the company's Twitter account, and reached a sales distribution channel, the services of the vendor used for shipping and logistics, and an email marketing account. The data potentially stolen is customer data: physical addresses, emails and phone numbers. The company disclosed the episode publicly on 2 January 2017. Two things the founder stated explicitly: "KeepKey computers, servers and network were never compromised" and funds stored on the hardware wallets "were never at risk" — the device holds keys offline and the company does not retain customer balances. The more unusual twist: the attacker phoned a company engineer offering, in exchange for 30 bitcoin, to explain how he got in, say what data he had taken, destroy it, return the accounts and keep the breach quiet. Stanchfield did the opposite — he made the episode public in a Reddit post and put up a 30 bitcoin bounty for the attacker's arrest. ⚠️ The entry is on the card because it remains the service's only documented and dated incident, not because it endangered any keys: it is ten years old, it concerns contact data rather than funds, and it is rated minor for exactly that reason. It does, however, show the kind of risk that never really closes in this sector: people who had bought a hardware wallet found their home address, paired with the fact that they hold crypto, potentially in a stranger's hands.

Latest verified information

On **2 August 2016**, **119,756 bitcoin** left Bitfinex, then based in Hong Kong: about **72 million dollars** at the time, down to ~58 million within hours because the news knocked roughly 20% off the bitcoin price. The detail that makes this an industry lesson: the exchange was using **BitGo's multisignature** setup, and it did not help — around **2,000 duly approved transactions** were diverted to a single wallet. Bitfinex halted withdrawals and trading. **The decision that set a precedent, a bad one: the loss was socialised.** It was not borne by the accounts that were hit: **every customer, including those who had not lost a satoshi, had 36% cut from their balance**, receiving in exchange **BFX tokens** proportional to the haircut, convertible into shares of **iFinex** (the parent company) or redeemable. On that front Bitfinex closed the matter: **all BFX tokens were redeemed within eight months** of the plan starting, which is why the users of the time count as compensated — but they were compensated with a financial instrument issued by the same company, not with their bitcoin. **The legal aftermath, still open.** In **February 2022** US authorities arrested **Ilya Lichtenstein** and **Heather Morgan** and recovered bitcoin worth, at the time, **3.6 billion dollars**, by getting into encrypted cloud storage holding addresses and private keys; the funds had moved from AlphaBay to the Russian marketplace Hydra from early 2017. **August 2023**: Lichtenstein admitted carrying out the hack and pleaded guilty to money laundering conspiracy; Morgan pleaded guilty to money laundering and conspiracy. **November 2024**: sentenced to **60 and 18 months** respectively. ⚠️ **And this is why `risolto` is `false` a decade on.** The recovered bitcoin **has not returned to Bitfinex**. In **March 2025** the Department of Justice *recommended* returning over **100,000 bitcoin**, but the US administration's strategic bitcoin reserve initiative created competing claims over seized assets; in **July 2023** holders of **Recovery Right Tokens** were paid roughly **315,000 dollars**, a tiny fraction. A recommendation is not a restitution, and `in_corso` is `false` because nothing is moving right now: the case is **open**, not an emergency. `importo_usd` carries the valuation at the time of the theft (72 million); the same bitcoin is worth orders of magnitude more today, which is why the 2022 seizure figure (3.6 billion) must not be confused with the loss.

Latest verified information

On **4 January 2015**, **fewer than 19,000 bitcoin** were taken from Bitstamp's **operational wallets** — about **5.1 million dollars** at the time. The exchange suspended the service on **5 January at 09:00 UTC** and reopened **nearly a week later**. The official position came from CEO **Nejc Kodrič**, and it is the part that matters to the user: the breach «represents a small fraction of Bitstamp's total bitcoin reserves», held in **offline cold storage**, and customers' bitcoin held before the suspension are «completely safe and will be **honored in full**». And so it was: the loss stayed with the company, which covered the shortfall from reserves, and **no customer had their balance cut** — the exact opposite of what Bitfinex would do eighteen months later by socialising its loss across accounts. ⚠️ **The attack vector was never confirmed by the company** and is not asserted here: reconstructions circulated about a targeted compromise through social engineering, but Bitstamp never adopted them and they do not go on the card. What the company did state is that it cooperated with law enforcement in the investigation. **No primary source available today documents the identification of those responsible or the recovery of the funds**, although second-hand accounts repeat the opposite: that step remains unverified. `risolto: true` because what had to close for users did close, and verifiably so: balances intact, service restored, loss absorbed by the company. Only the criminal side remains open, and it does not affect the customer.

Latest verified information

In decision no. 25058 of 1 August 2014 (case PS7061), Italy's competition and market authority found that between October 2011 and June 2014 Fiditalia ran an aggressive commercial practice on two fronts: intimidating payment reminders sent even for disputed debts, and obstacles placed in the way of customers exercising their contractual rights — one documented example is a customer who had to send three written requests and numerous phone chasers to obtain an early-settlement statement. The company itself reported that 63,045 reminders turned out to be unjustified, explaining that its first notice goes out 15 days before the contractual due date; 3,881 customers filed complaints. The authority banned the practice and set the base fine at €190,000, raising it to €230,000 because Fiditalia had already been subject to two other Consumer Code decisions (no. 21255 of 2010 on financing terms and no. 22450 of 2011 on the Eureka card), then bringing it back to €190,000 given the company's loss-making accounts. At the date of the decision the practice was still ongoing. Neither the compliance report the decision required within sixty days nor the outcome of any appeal is public, so the case is recorded as open.

Latest verified information

In decision no. 25058 of 1 August 2014 (case PS7061), Italy's competition and market authority found that between October 2011 and June 2014 Fiditalia ran an aggressive commercial practice on two fronts: intimidating payment reminders sent even for disputed debts, and obstacles placed in the way of customers exercising their contractual rights — one documented example is a customer who had to send three written requests and numerous phone chasers to obtain an early-settlement statement. The company itself reported that 63,045 reminders turned out to be unjustified, explaining that its first notice goes out 15 days before the contractual due date; 3,881 customers filed complaints. The authority banned the practice and set the base fine at €190,000, raising it to €230,000 because Fiditalia had already been subject to two other Consumer Code decisions (no. 21255 of 2010 on financing terms and no. 22450 of 2011 on the Eureka card), then bringing it back to €190,000 given the company's loss-making accounts. At the date of the decision the practice was still ongoing. Neither the compliance report the decision required within sixty days nor the outcome of any appeal is public, so the case is recorded as open.

Latest verified information

In decision no. 25058 of 1 August 2014 (case PS7061), Italy's competition and market authority found that between October 2011 and June 2014 Fiditalia ran an aggressive commercial practice on two fronts: intimidating payment reminders sent even for disputed debts, and obstacles placed in the way of customers exercising their contractual rights — one documented example is a customer who had to send three written requests and numerous phone chasers to obtain an early-settlement statement. The company itself reported that 63,045 reminders turned out to be unjustified, explaining that its first notice goes out 15 days before the contractual due date; 3,881 customers filed complaints. The authority banned the practice and set the base fine at €190,000, raising it to €230,000 because Fiditalia had already been subject to two other Consumer Code decisions (no. 21255 of 2010 on financing terms and no. 22450 of 2011 on the Eureka card), then bringing it back to €190,000 given the company's loss-making accounts. At the date of the decision the practice was still ongoing. Neither the compliance report the decision required within sixty days nor the outcome of any appeal is public, so the case is recorded as open.

Latest verified information

By decree of 20/07/2010, on a proposal from the Bank of Italy, the Minister of Economy dissolved the management and control bodies of Credito di Romagna S.p.A. and placed it under special administration for serious irregularities (art. 70(1)(a) of the Consolidated Banking Act). On 23/07/2010 the Bank of Italy appointed the special commissioner and the supervisory committee. The sources read do not mention any suspension of payments or losses for depositors. The procedure appears closed, since the bank later returned to ordinary governing bodies. The exact closing date could not be verified from an official source.