Crypto & Financial Crime
Cybersecurity news in this category
Lazarus Group Behind Record $6.3 Billion Binance Hot Wallet Theft: Anatomy and Cassandra Index Impact
Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
EIP-7702 Explained: How Ethereum's New Signature Standard Enables Persistent Wallet Delegation Attacks
Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack
On October 29, attackers drained between $2.5 and $3.5 billion in ETH and tokens from Binance hot wallets on Ethereum within 40 minutes, with the total including Bitcoin and Tron reaching at least $5.57 billion according to Decrypt. The attacker did not steal private keys directly but instead used EIP-7702 to delegate execution code from a malicious contract to Binance 14, allowing a single sweep call to transfer all assets. Tether and Circle froze roughly $2.5 billion in USDT and USDC within the first hours, while Binance stated user funds remain secure and investigations continue. Blockchain analysis reveals 18 hours of preparation including three test runs on external wallets funded via Tornado Cash, followed by the main delegation and sweep in just over three minutes. The attack shares strong operational similarities with previous incidents attributed to TraderTraitor, a Lazarus subgroup, including gas funding patterns, test sweeps, and the use of a sweep function. ETH was moved first to an address that has not yet dispersed funds, while stablecoins were fragmented across new wallets before partial freezes took effect.
Bitget Loses $351 Million in Record 2026 Crypto Theft After Attackers Forge Internal Transfers
Bitget's hot and warm wallets were drained of approximately $351 million on September 24, marking the largest known single crypto theft of 2026. Attackers did not steal private keys but instead forged internal transfer requests that bypassed approval workflows. The stolen assets spanned at least five blockchains, with the largest portion being roughly 103 million XRP worth about $157 million. Bitget's CEO Gracy Chen attributed the incident to North Korean hackers based on IP patterns, behavioral signatures, and on-chain evidence matching prior operations. The exchange maintains a $464 million user protection fund sufficient to cover all losses, while deposits and trading remain unaffected and only withdrawals are temporarily frozen. The case highlights how process-level compromises can bypass even robust key-management controls in cryptocurrency exchanges.
Address Substitution Attacks Exploit Partial Address Checks in Crypto Wallets
Address poisoning, clipboard hijackers, and supply-chain malware all rely on users verifying only the first and last few characters of long blockchain addresses. Researchers detail real incidents including a May 2024 theft of 1,155 WBTC worth roughly 68 million dollars where an attacker poisoned transaction history after a test transfer. Studies from Carnegie Mellon University show that even security-conscious users miss mismatches in truncated addresses 21 to 38 percent of the time. Existing identicons such as Jazzicon and Blockies can be matched by attackers because they depend on only the first eight hex characters. The team released the open-source Humanized Hash library that renders any address or hash as a 4x4 grid of colored shapes using PBKDF2 stretching, making forgery computationally expensive. Calculations indicate that matching both the visual pattern and edge characters requires tens to millions of GPU-years on current hardware. The library supports multiple languages with identical output and carries an MIT license with a fixed algorithm.
Monero Web Wallet Built on Official monero-wallet-rpc Adds Digest Authentication, Two-Phase Transfers and BigInt Precision
A developer created a non-custodial Monero web wallet that runs entirely on the user's machine and communicates only with a personal monero-wallet-rpc instance. The project retained all key-handling logic inside the official RPC daemon while adding a custom backend, frontend and supporting infrastructure. Eight practical challenges were documented, including HTTP Digest authentication that is tightly coupled to TCP connections and the silent loss of monetary precision caused by JSON.stringify on large numbers. The solution introduced two-phase transaction submission to reduce the risk of broadcast errors and replaced floating-point arithmetic with BigInt to guarantee exact handling of Monero amounts. The resulting implementation demonstrates how to expose a convenient web interface without introducing custodial risk or weakening the security model of the Monero wallet RPC.
Liquid Network Federation Wallet Drained of 4000 BTC in Alleged White-Hat Exploit Exposing L-BTC Minting Flaw
On September 7, the Liquid Network sidechain suffered a major incident where its Federation wallet lost approximately 4000 Bitcoin, worth around $320 million or 2.1 billion RMB, leaving only 200 BTC behind. The funds were moved through the authorized SideSwap settlement platform using PAK keys without any reported key compromise. Liquid officials described the actor as a claimed white-hat hacker intending to return assets for a fee, but security experts point to a critical vulnerability allowing unauthorized L-BTC minting that could bypass the 1:1 Bitcoin backing mechanism. The network has halted all new transactions while federation members work on remediation, affecting major platforms including BTSE, Bitfinex, and BitMEX. This event aligns with a broader 2026 trend where attackers target protocol-level asset issuance rather than individual keys, as seen in recent Coldcard RNG flaws and other incidents totaling $972 million in crypto thefts. The case underscores weaknesses in multi-signature federation validation and cross-chain anchoring that go beyond traditional smart contract bugs.
1755 Bitcoin Worth $110 Million Stolen from 5000 Hardware Cold Wallets Due to Flawed Random Number Generator
A mainstream hardware cold wallet suffered a systemic defect in its random number generation algorithm, allowing attackers to compromise approximately 5000 wallets and steal 1755 BTC valued at around $110 million. The incident, confirmed on August 4, marks the largest hardware wallet security breach in crypto history because the flaw existed at the foundational level of private key generation rather than in network defenses. Victims had relied on the common assumption that offline cold storage provides ultimate protection, yet the non-random RNG reduced the effective keyspace dramatically, enabling feasible brute-force attacks. Historical precedents show similar RNG weaknesses have repeatedly undermined wallet security across platforms including Android implementations and various hardware chips. The event underscores that cold storage security depends entirely on correct implementation of cryptographic primitives at every layer, from hardware entropy sources to firmware. Experts recommend avoiding blind trust in any single device, verifying third-party audits, and diversifying storage across multiple solutions including open-source options.
COLDCARD Wallets Suffer Mass Crypto Theft After RNG Flaw Allows Seed Reconstruction
A critical implementation error in COLDCARD hardware wallets enabled attackers to reconstruct wallet seeds and steal cryptocurrency from thousands of users. The flaw stemmed from an incorrect switch to the libsecp256k1 library, which inadvertently used the rng_get() function from libNgU for seed generation instead of proper hardware entropy. Depending on the model, seeds for Mk2 and Mk3 devices could be derived solely from UID, timer state, and generator history, while Mk4, Mk5, and Q models added limited extra entropy. On July 30, the attacker drained over 1,367 BTC worth approximately $88 million from 4,585 addresses in just 41 minutes. Coinkite released updated firmware, but affected users must also regenerate new seeds and consider additional protections such as passphrases. Other Coinkite products including TAPSIGNER, OPENDIME, and SATSCARD remain unaffected. The incident highlights how even well-tested cryptographic libraries can fail when integrated incorrectly.
Coldcard Firmware Flaw Linked to Theft of 1,082 Bitcoin in 41 Minutes
A critical defect in COLDCARD firmware degraded entropy during BIP39 seed generation, enabling offline enumeration of weak seeds and resulting in the theft of 1,082.65 BTC from 1,196 addresses in just 41 minutes on July 30, 2026. The root cause traces to a March 2021 integration error that replaced the STM32 hardware RNG with a deterministic software PRNG initialized only by chip ID and timing registers, yielding roughly 40 bits of effective entropy on Mk3 devices and 72 bits on Mk4, Mk5, and Q models. Coinkite issued emergency firmware updates, yet any seed created on vulnerable versions remains exposed regardless of later updates. Additional sweeps matching the same pattern have raised total observed losses to 1,367.05 BTC across 4,585 addresses. Users must generate fresh seeds on patched firmware and migrate funds immediately; dice-based entropy addition or BIP39 passphrases provide only partial mitigation.