Live BTC News

If your Keystone hardware wallet arrived before October 20 and passes the device authentication check, the company says it is safe to keep using. The 18,835 units being destroyed are unsold inventory. Keystone disclosed on October 26 that attackers who breached its website also obtained the device authentication key, the key that proves a Keystone wallet is genuine, according to Bitcoin.com News. That key is set at manufacture and cannot be changed or erased, so anyone holding it could build counterfeit wallets that pass the authenticity check. Every stocked device carrying the key will be destroyed, and new units will ship with a replacement. Devices received after October 20 that use the compromised key need extra verification through customer support, even if they pass the check. Keystone says recovery phrases, private keys, wallet credentials and payment details were not exposed, and it is not telling customers to move funds because of the incident. Buyer data was exposed: of 51,083 Shopify records reviewed, 25,964 still held names, shipping addresses, contact details and purchase history from 2024 to 2026, because an automated deletion system failed to clear them after 180 days. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure," the company said. The breach came through a flaw in a third-party monitoring tool, first spotted on October 20. Shipments of website orders are paused in favor of preorders. Expect fake recall messages asking you to return your device, and ignore them.

X 100 Global runs its treasury, which it calls the Freezer, through a three-seat Senate, and on Saturday, October 24, attackers bought a majority of it with borrowed money, Bitcoin.com News reported. They took a flash loan of about 1.94 million USDT from Aave, used it to buy X tokens and registered helper contracts for two of the three seats. Security firm Exvul said the governance design had no voting snapshots, no minimum holding period and no execution delay, so proposals could pass and execute almost at once. The flaw was in the rules, and no line of code was technically broken. One transaction moved 400,000 X tokens out of the Freezer into a pool the attackers controlled, sending about 36 USDT back to the treasury in return, and the tokens were then sold through a Uniswap V3 pool. Blockaid and other researchers traced about $4.85 million of USDT proceeds and roughly 550,000 X tokens across three transactions. The token fell from the $50 to $60 range to about $1.75, a drop of more than 96%, and decentralized exchange liquidity dried up. About 12.2 million X tokens were still in the Freezer in Blockaid's latest update, and as of 3 p.m. Eastern the project had not acknowledged the breach.

The UAE Ministry of Interior has released results from Operation Confrontation Ghost, a three-month effort run with law enforcement from 30 countries, Interpol and the Global Anti-Scam Alliance, Bitcoin.com News reported on October 24. The operation identified more than $39 billion in fraud-linked digital assets now being seized and recovered, according to the report, which also says tokenized assets were used to secure $12 billion in transactions. Participating countries include the UK, Canada, Japan, France, Italy, the Netherlands, Brazil, China, South Korea, Singapore and Indonesia, alongside 13 private partners such as Crypto.com, Mastercard, Meta, TikTok, Group-IB and Trend Micro. Targets were AI-enabled fraud, financial fraud through digital platforms and online sextortion. The arrest count needs care: the article's body, citing the Emirates News Agency, says more than 960 people were arrested, while its own subheading says nearly 100, and the report does not reconcile the two. Other reported results include 3,500 suspects and 15,000 victims identified, more than 4,000 bank accounts blocked, 570 social media accounts closed and 29 fraud centers raided. UN Office on Drugs and Crime Executive Director Monica Kathina Juma said the "growing use of digital technologies and artificial intelligence in fraud" calls for tighter coordination between countries.

Initia stopped its layer one chain and its rollups at 3:41:30 p.m. UTC on Friday, October 23, after an attacker minted tokens that should not have existed and moved roughly $2.7 million of AUSD, ETH and USDC off the network, according to Bitcoin.com News. Co-founder Ezaan Mangalji said that "to the best of our knowledge so far" the cause was a "Day 0 bug" in Initia's MoveVM running on the Cosmos SDK, which allowed extra tokens to be created on the base chain without touching native INIT. The team says it is working with security firms, validators and exchanges to measure the full damage. Agora, which issues AUSD, said its own contracts were not compromised and it has none on Initia, and that it will freeze AUSD held by attacker addresses on chains where its contracts run. South Korea's Upbit suspended INIT deposits and withdrawals. The token dropped on the news and then recovered to sit 12.5% higher over 24 hours, up 65.8% since September 23. At 7:45 p.m. the chain was still stopped at block height 23,365,925, with no restart date and no confirmed total. Initia is built to help separate networks work together, and in this case a flaw at the base layer reached other networks through the same bridges that design depends on.

Italy's financial police, the Guardia di Finanza, announced on October 21 an operation against a network that allegedly processed more than €110 million, about $128 million, in fake invoices over roughly three years, Bitcoin.com News reported. About €68 million, roughly $79 million, was allegedly sent abroad, some of it by routing money through European banks to crypto exchanges and wallets the network controlled, with part of it moving as the USDT stablecoin. Couriers then returned cash to customers after taking commissions of 2% to 5%. Investigators say they also traced proceeds from drug trafficking and crypto investment scams. More than 350 officers took part, 30 suspects were placed under court-ordered restrictions, 16 in detention and 14 under house arrest, the action reached into Spain and Switzerland, and about €21 million, roughly $24 million, in assets was seized. Prosecutors link the network to the 'Ndrangheta, the Camorra and the Foggia mafia, working with Chinese and Albanian associates, and allege that its headquarters was a car rental business in Pero, near Milan. A financial police inspector also faces corruption allegations over a €3,000 payment. None of the accusations have been tested at trial, and the investigation is ongoing.

A remote code execution flaw in PHP, which Amazon has named PHP2Shell, could let attackers run their own code on a server without logging in, according to CERT-EU advisory 2026-018 as reported by Bitcoin.com News. PHP's maintainers shipped fixes on October 21, but every site has to install them, and the US Cybersecurity and Infrastructure Security Agency issued an alert the same day advising organizations to take PHP-based systems offline until patched. The National Security Agency issued its own warning. Attacks started before the disclosure. Amazon traced an exploitation attempt to October 17, and Cloudflare chief executive Matthew Prince said his network saw thousands of attempts in the 10 hours before the announcement, a number that has since climbed into the millions. Crypto firms moved quickly to report their exposure. Coinbase and BitGo said they were unaffected, Binance said it put safeguards in place before the patch and has finished remediation, and PancakeSwap and Bitget Wallet said they do not run PHP. No crypto firm had reported an exploit or lost user funds at publication. Binance co-founder Changpeng Zhao still urged users to "be extra careful visiting ANY web site in the next few days," warning that compromised sites could become "vectors for credential theft or device exploits."

Transactions were running again on Qubic by the evening of October 19, a day after validators froze the chain at tick 85,371,949 to stop an attacker draining 1,404 wallets of about $1.3 million in QU, according to Bitcoin.com News. On October 20 Qubic said its validators had approved a recovery plan, though it gave no vote count. The roughly 87.1% of stolen tokens that never left the chain have been moved into a protected escrow, and validators have started returning them to verified owners. The other 12.9% sits in an account frozen by MEXC, and getting that back depends on the exchange and any law enforcement action. Victims can file through Qubic's official recovery portal until May 1, 2027, by submitting the affected wallet identity, a newly generated destination wallet, a signed ownership message and supporting evidence, and each approved claim faces a seven-day dispute window before payment. Wallet version 4.26.4, released around October 19, fixes the weak random number generator that made the seeds guessable. Qubic also warned that genuine recovery help never asks for a seed phrase or a fee, a reminder aimed at the scammers who reliably follow a theft like this one.

Between 23:42 UTC Saturday and 01:26 UTC Sunday, an attacker emptied 1,404 Qubic wallets of about 2.94 trillion QU, roughly $1.3 million, according to Bitcoin.com News. The chain itself held up. The weakness sat in how some wallets were created: 55-character seeds generated with insufficient randomness, which let the attacker rebuild a smaller set of likely seeds and check them for balances. Affected seeds came from browsers on iPhones and iPads, Safari on Macs, and older versions of Qubic's iOS app. Developers say version 4.26.4 fixes the flaw, and they moved some exposed funds out of reach before the attacker found them. Qubic's validators, known as Computors, stopped transactions at tick 85,371,949 early Sunday, leaving about 87.1% of the stolen QU stuck on the network. That power cuts both ways, since a quorum able to freeze the chain to protect users can freeze it for any reason. The other 12.9% reached MEXC, which froze the receiving account, and Bitget paused QUBIC deposits and withdrawals for maintenance. QEARN stakes were reportedly untouched, and the token was down more than 10% at 10 a.m. Eastern on Sunday. Qubic, founded by early NXT and IOTA developer Sergey Ivancheglo, drew controversy in 2025 for claiming majority control of Monero's mining hashrate. Whether victims are repaid now depends on a vote of the Computor quorum.

Jameson Lopp's archive of physical attacks on crypto holders, covering home invasions, kidnappings, violent robberies and extortion back to 2014, now lists about 702 incidents, roughly double its earlier size. Most of the new entries came from outside work. A researcher known as Pizza Bitcoiner built a separate database of 670 verified incidents across 72 countries from January 2020 to mid-October 2026 using AI-assisted searches of local-language news, court records and police reports, found 375 cases missing from Lopp's collection, and about 351 of those have been added. Lopp credited the work on X on October 16: "Kudos to Pizza Bitcoiner for finding hundreds of new attack reports via agentic searches." The researcher's own figures are stark: 413 incidents involved victims held against their will, 300 resulted in injuries and 31 in deaths, with reported losses of about $394 million across the 447 cases where a figure was available. Annual counts rose from 37 in 2020 to 165 in 2025, with 134 more through mid-October this year, and France stands out as a hotspot alongside the United States. Bitcoin.com News flags a caveat: better searching and wider language coverage explain part of that rise, so the trend line likely overstates how fast the crime itself is growing. Even on a conservative reading, holding your own keys protects against remote theft and leaves physical security as a separate problem to plan for.

Quantus, American Fortress, Intmax, Keystone, Midnight Foundation, Postquant Labs, Abelian, The Vault and Hacken launched the Quantum Alliance in Lisbon on October 15, built around an estimate that roughly 6.04 to 6.4 million BTC, close to a third of supply, sit at addresses whose public keys are already visible on chain. About 1.1 million BTC associated with Satoshi Nakamoto falls inside that figure. The exposure is a consequence of how spending works: some transactions reveal a public key, and it stays on the ledger permanently. No existing computer can derive the private key from it, and no quantum computer capable of running Shor's algorithm at the required scale exists either, so nothing here is spendable by an attacker today. The disagreement is entirely about when. The Quantum Doom Clock, built by Postquant Labs co-founders, points to March 2028 as an early possible window on a model assuming about 856,000 physical qubits are needed; other researchers put the real risk in the 2030s. Google Quantum AI's reported Willow result, cutting errors by a factor of 40 and reaching 99.99% accuracy on specialized quantum states, is the kind of datapoint that moves those estimates. The Alliance is not building a chain. It intends to publish standards and migration guidelines across four areas, moving existing funds to safer cryptography, evaluating privacy technology, protecting wallets and making security tools work across chains, modeled on the Internet Engineering Task Force. Quantus chief executive Christopher Smith expects "post-quantum cryptography" to eventually just be called cryptography.

Chainalysis posted findings this week on an operator who ran a task scam, the kind that pays victims small amounts to post fake reviews or inflate online sales, then tells them their account carries a negative balance that has to be topped up with their own money before any earnings can be withdrawn. He moved the proceeds into three Ledger wallet addresses. The devices came from CryptoBilis, the Southeast Asian reseller at the center of the implant case, and attackers emptied all three, taking 60 BTC, more than $4.9 million at the quoted level. The irony is the headline, but the useful detail is the confirmation of reach. Investigators found unauthorized hardware implants in those devices capable of transmitting recovery information over a mobile network, which is the same mechanism Ledger described on October 13, and this case shows it worked on wallets that were funded and actively used rather than only on test units. It also means the loss estimates circulating for this incident include money that was itself stolen, which is worth keeping in mind when reading the aggregate figures. Ledger's answer, announced October 15, is Atom, an Android-based device with a protective enclosure and tamper sensors, which does not ship until mid-2027.

Three days after confirming an unauthorized implant in devices sold through Malaysian distributor CryptoBilis, Ledger has announced Atom, a smartphone-shaped wallet running Android, due mid-2027 and built at its own facility in Vietnam. CoinDesk's piece does not state a price; Bloomberg's headline on the same announcement puts it at $899. Users switch between ordinary phone use, apps like WhatsApp and TikTok included, and a protected mode for keys, with integration to the AI assistant OpenClaw. The security additions speak directly to how the attack worked: an enclosure around the sensitive components, sensors that detect removal of the screen or back cover, and tamper detection with its own battery that works while the device is off. A Ledger spokesperson told CoinDesk the enclosure "will explicitly block the screen reader implants from this weekend's incident." The compromised units reportedly carried hidden chips that read screen signals to capture 24-word recovery phrases, with onchain researchers estimating up to $93.2 million lost across more than 300 wallets, mostly in Southeast Asia, and Tether freezing $10 million of USDT tied to it. Note what is not being offered: Ledger will not do trade-ins for affected customers, and the device that fixes the problem arrives in roughly eighteen months. Selling only through its own site is the more immediate answer, since the distributor was the attack surface.

The reseller-linked losses first reported over the weekend now have a mechanism attached. Attackers allegedly implanted hardware into devices sold through distributor CryptoBilis, with reported losses still above $86 million. Ledger says its own systems and its direct sales were not affected. A physical implant is a different category of problem from a phishing campaign or a leaked seed phrase, because it means the device was compromised before the owner ever touched it, and no amount of careful behavior by the buyer would have prevented it. The practical read for anyone holding a device: where you bought it is now a relevant question, and the answer matters more than how carefully you have handled it since. The loss figure remains unconfirmed and the allegation of implanted hardware has not been independently verified.

Reported losses exceeding $86 million, with some estimates running as high as $92.9 million, have been traced across roughly 311 wallets spanning Bitcoin, Ethereum, TRON, BNB Chain and Polygon. The thread leads to CryptoBilis, a third-party Ledger reseller, and Ledger has asked the reseller to pause sales and shipments while it investigates. Two things worth stating plainly. The figures are unconfirmed and the range between $86 million and $92.9 million is wide enough to show nobody has a firm count yet. And there is no indication Ledger's own infrastructure was compromised, which makes this a supply chain problem rather than a product one. The distinction matters for anyone deciding what to do about a device they already own.

The Zcash development team is planning quantum-resistant signature opcodes built on hash-based signature verification, with integration targeted for January 2027 and no activation date set. Zakura engineer Roman Akhtariev describes the mechanism as preventing an attacker from "deriving private keys from public keys and forging transaction authorizations." The number that explains why this matters: roughly 11.96 million ZEC sit in transparent address pools out of 16.98 million in circulation, about 70% of supply, and transparent addresses are the ones whose public keys are exposed. Shielded balances are a different problem with a different exposure. Worth keeping the urgency honest, though, since no practical quantum attack on mainstream wallet keys has been demonstrated. This is work done ahead of a threat rather than in response to one, which is the only sensible time to do it.

THORChain drew criticism for refusing to block funds linked to the Bitget attacker, while cross-chain protocol NEAR Intents said it identified more than $50 million in suspicious transfer attempts but has frozen only $503,000 so far. How much is ultimately recoverable remains unclear. The split response is the story: protocols built to be uncensorable are being asked to censor, and they are answering differently.

Bitget resumed Bitcoin withdrawals at 08:00 UTC Monday, the first stage of a phased restoration that runs through October 2 for ETH, USDT and other services. The exchange says attackers exploited a third-party security product to obtain credentials and forge withdrawal commands. Circle and Tether had frozen roughly 99,990 USDC and 218,023 USDT linked to the attack by September 26. Separately, ZachXBT reported that launderers moving the stolen funds are taking orders in public Discord channels.

Bitget increased its estimate from $351.6 million to about $387.5 million after tracing stolen assets on Zcash and TRON that the first review missed, across seven networks. The exchange attributes the breach to suspected North Korean actors. Elliptic says the theft pushes North Korea's 2026 crypto haul past $1 billion, with laundering already running through Tornado Cash. CEO Gracy Chen has been consistent that no private key was compromised: attackers broke into a backend wallet system, fed it forged transfer data, and let Bitget's own authorization process approve the payouts. Cold wallets were untouched.

Bitget detected unauthorized transfers at 18:31 UTC on September 24 and suspended withdrawals. Bitquery traced 21 transfers out of the exchange, beginning with a 93 TRX test on Tron, then 19.67 million USDT0 on Arbitrum moving to the same address. The attacker sold stablecoins for ETH within minutes, consolidated from other chains onto Ethereum, and began converting stolen BNB into Bitcoin. Deposits and trading continued throughout. Bitget's User Protection Fund held more than $464 million when withdrawals were halted, and the exchange says it will absorb the loss.

Hackers published Revolut customer data and demanded 10,000 BTC, roughly $770 million at current prices, a figure large enough that it reads more as leverage or provocation than a realistic payment expectation. Publishing the data before the demand inverts the usual sequence, which removes whatever incentive the company had to pay. It lands in a stretch that already included the Liquid Network withdrawal, the Coldcard exploit and the Zilliqa emergency fork.

Alby confirmed a critical vulnerability in older Alby Hub versions that could let attackers gain unauthorized access and send funds, with at least one user known to be affected. Separately, BitBox warned that a phishing email impersonating the company, claiming a faulty random number generator, is circulating and telling users not to click links or enter seed phrases. The second one is worth noting precisely because it borrows the shape of a real incident, the Coldcard RNG failure from July, to make the lie plausible.

Roughly 4,000 BTC was withdrawn from the Liquid Network, the Bitcoin sidechain, by parties describing themselves as white-hat hackers, who have since said they intend to return most of it once the underlying bug is fixed. Recovery framed as voluntary is not recovery until the coins actually move, and holders are relying on the word of whoever holds the keys. It lands in a stretch that has already included the Coldcard exploit, the BTCPay Server disclosure and the Zilliqa emergency fork.

The network executed an emergency hard fork following private key leaks that cost 683.1 million ZIL, one of several smart contract failures reported across the day. Emergency forks are a blunt instrument, effectively rewriting network state to undo the damage, and they tend to reopen the argument about what immutability is worth when the alternative is absorbing a nine-figure token loss. It adds to a rough stretch that already included the Coldcard exploit and the BTCPay Server disclosure.

An SQL injection exploit against a Metabase instance at third-party logistics provider ShipMonk exposed names, emails, phone numbers, and physical delivery addresses for 13,689 Trezor customers. For hardware wallet buyers, a leaked home address tied to confirmed crypto ownership is arguably worse than a leaked email, since it creates a targeting list for physical attacks. It lands the same week BTCPay Server patched a flaw that let attackers exfiltrate Lightning credential files and sweep merchant funds.

The self-hosted payment processor disclosed an actively exploited vulnerability with user funds at risk, telling operators to move to version 2.4.2 immediately or take their servers fully offline until they can patch. The warning landed the same week the Coldcard exploit crossed nine figures, making it a rough stretch for two very different corners of the self-custody stack.

Blockchain monitoring firms now put losses from the Coldcard hardware wallet exploit above $130 million, with Galaxy Research suggesting at least a dozen separate actors are working the same flaw rather than one coordinated group. The root cause traces to a March 2021 firmware build that routed seed generation through a software pseudorandom generator instead of the device's hardware RNG, letting attackers reconstruct keys offline without ever touching the wallet. Coinkite shipped emergency firmware on July 31, but patching does not repair a seed that was already generated weakly.

Galaxy Research put confirmed Coldcard exploit losses above $100 million across three verified waves plus fourteen smaller incidents, with a suspected fourth wave that could push the total near $130 million. The firm drew a careful line between what it has verified on-chain and what it merely suspects, and cautioned that the attack is still active. Roughly 90% of the stolen coins have not moved and remain traceable, which leaves a real, if narrow, path to recovery.

On-chain analysis showed attackers had moved roughly 1,816 BTC, near $116 million, out of wallets their owners believed were safely offline, spread across four distinct waves since the flaw surfaced. The breach dominated crypto social feeds precisely because it struck cold storage, the setup long treated as the safest way to hold Bitcoin. Prices barely reacted, with Bitcoin and Ethereum each down under 1% since the news broke.

A cluster of exploits hit a decentralized perpetual exchange and an Ethereum bridge within days of each other, with the larger breach alone accounting for over $24 million in stolen stablecoins. The bridge was hit for a second time in two months using a variation of a flaw first exploited in May, a reminder of how often teams patch a bug without closing the door it came through.