Unocoin says wallet transfers were signed outside BitGo
Unocoin said on November 13 that BitGo’s freeze on its account appeared to have held. The exchange is investigating transfers out of an Ethereum address while customer accounts remain offline.
Crypto security news
Follow developments in crypto hacks, vulnerabilities and security incidents.
All Security coverage
Keplr pauses Google and Apple sign-ins
Keplr says some users spotted transactions they did not authorize. It has asked anyone who created a wallet with Google or Apple to stop sending funds to that account.
Singapore police identify over 383 victims of crypto scams
Singapore police worked with crypto platforms and overseas investigators to reach scam victims before they sent more money. Cyber Command says its officers and partners helped avert over S$17.4 million in potential losses during the two-month operation.
Initia network restarts with withdrawal restrictions
Initia restarted its L1 and rollups on November 2 after the October 23 exploit. LayerZero WETH and AUSD0 withdrawals face a 24-hour period, while Noble USDC will have an hourly limit.
Binance says it has covered $6 billion of hack losses
Binance says it has replaced $6 billion of stolen assets using its own resources. The team plans to reopen withdrawals on November 1 and publish the full reserve proof on November 3.
Binance reports $6.3 billion hack, halts withdrawals
Binance says it will cover losses with its SAFU fund and company resources after unauthorized withdrawals. Its security team is updating the withdrawal system while investigators work to establish how the attack happened.
zkLink Nova bridge hit: About $786,000 withdrawn
Blockaid says an attacker used a forged transaction summary to withdraw ETH and tokens from contracts on Ethereum. The firm described the attack as ongoing in its first alert early on October 29 UTC.
Bitonic reimburses three customers after bitcoin theft
Bitonic says it reimbursed unauthorized bitcoin withdrawals from three accounts. Services are back, while possible access to personal data remains under investigation.
Bloom hack drains 9,408 SOL; full refunds promised
Bloom says an attacker exploited a third-party software module. The company denies that private keys were compromised and has promised to cover the losses of all nine affected users.
Keystone breach exposes customer shipping addresses
Hardware wallet maker Keystone confirmed that an intruder obtained customer information from its online store. The company says recovery phrases and private keys were not exposed and warns customers about fake refund and device-replacement offers.
Electrum fixes fee-bump flaw used to steal Bitcoin
A malicious server could change the recipient shown in a wallet. Raising the pending transaction’s fee then produced a fresh signature and paid the attacker. Versions before 4.8.3 are affected.
Initia halts its mainnet and rollups after security incident
Initia is investigating with security teams, validators and exchanges. D2 Finance traced about $2.65 million in transfers in its initial analysis; Initia has not confirmed total losses.
San Diego gives first approval to crypto ATM warnings
San Diego plans to require visible fraud warnings on cryptocurrency ATMs or within two feet of them. The proposal passed its first reading unanimously and would also make host businesses responsible for displaying a compliant sign.
Qubic halts network after 1,404 wallets are drained
Qubic says wallet seeds created on certain Apple devices lacked sufficient randomness. The team has fixed the software; the network’s Computor participants will decide how to recover the funds.
Cysic shuts bridge after unauthorized mint of 10 million CYS
Cysic Foundation’s incident report says preliminary findings point to unauthorized database access and a fraudulent mint message. The team has not set a date for reopening the bridge.
NEAR Intents explains the bug behind its $3.8 million exploit
NEAR Intents general manager Alex Shevchenko has published a technical account of the exploit detected on October 1. Deposits were refunded without reversing users’ credited balances, creating $3.8 million in unbacked entries across 23 transactions.
Brooklyn crypto scam takedown targets 241 domains
A three-year investigation led authorities to the servers behind fraudulent investment sites. Prosecutors say the same organization later approached victims again, promising to recover their stolen money.
Ledger asks Asian resellers to halt device sales
The CryptoBilis investigation found a component that reads a device’s screen and sends recovery words over a mobile network. The sales suspension request now covers other resellers in the region.
COLDCARD warns of phishing link posted from its X account
Bitcoin hardware wallet maker COLDCARD has warned users about a malicious link posted from its official X account. The company is investigating how the post appeared.
Veria details patched XRP minting flaw
Veria Labs has described an arithmetic flaw that could break XRP Ledger’s supply rule and says it received a $250,000 bounty. Its report is dated October 10; the fix shipped on September 25.