The best of crypto, tech and the open web. Curated by humans.
CryptoBilis update We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do: Already using it? Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Not set up yet? Don’t set it up, and never enter your existing wallet backup on it. We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives. On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far. NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it. If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://trezor.io/support#open-chat We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else. For more information, visit our blog: https://trezor.io/blog/news/implant-repo…
It's state-sponsored military cyber warfare against normal engineers working from home. Crypto spent billions building multisigs, KMS enclaves, and MPC clusters, but the adversary isn't trying to crack prime numbers. They find one tired DevOps dev on LinkedIn, send a poisoned PDF, and walk straight through the front door with full sudo rights. You can audit your smart contracts fifty times, but the human endpoint is always running zero-day vulnerabilities. Damn, Lazarus is good at breaking people.
@SG2Trader @SpecterAnalyst Likely Lazarus Group (DPRK)
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: - temporarily suspended deposits and withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. https://www.binance.com/en/support/annou…
BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen: • $1.45 billion $BTC • $875 million $ETH • $234 million $TRX • $50 million $XAUT • $1.57 billion $USDT • $823 million $USDC • $75 million $WBETH • $88.5 million $RLUSD + $447.5 million additional cryptocurrencies This is the largest hack in crypto history.
Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash
Picked by the Kiwi community's upvotes. No spam, unsubscribe anytime. What's in it?
Seeing rumors blaming EIP7702 for the Binance hack. From what I can see EIP7702 was just used to preform the hack efficiently but was NOT the root cause.
🚨995 Polymarket accounts just got drained through Polymarket's own website. Let me explain how, because this one should scare everyone in crypto. No fake link. No shady airdrop. These people were on the real Polymarket dot com on Thursday. Polymarket's site loaded a script from DebugBear, a tool whose only job is measuring how fast the page loads. Somebody poisoned it. Once it was running in your browser, it grabbed your logged-in trading session and started dumping every open position you had, first at 3% under market, then at half price, then at the lowest price possible. Then it swapped the whole balance into POL and shipped it to the attacker. Stablecoins can be frozen. POL can't. It even reported back after every hit. Your wallet, your country, your portfolio size, whether the transfer went through. All of it sent home through DebugBear's own data endpoints. The attacker's wallet went from empty to $2M in about 45 minutes. Conor Grogan's final count was $2.65M. One trader said he lost $800K and watched every position get sold. His friend got hit for $600K. Polymarket flipped the exchange to cancel-only, paused the relayer and says everyone will be made whole. Credit where it's due. But this is the third time this year. About $700K in May. About $3M in June, through a hacked third-party script, same as now. I've been phished. I've been drained. Stay in crypto long enough and it happens to you. But the people on Thursday did nothing wrong. They opened the right website. Not one of these three hacks touched a smart contract. We spent ten years making the blockchain unbreakable and then let a page speed tracker sit right next to people's money.
INTEL: Binance incident escalates from an EIP-7702 delegation exploit to a potential compromise of Binance 16 signing key
Loss might be a bit higher than that, but will cover. 🙏
Binance has 144bn of assets under custody, with USDT and USDC frozen the total loss now is around ~1bn, which is only 0.69% of their total assets under custody They'll cover it from balance sheet easily
🚨 Fallo crítico en el kernel de Linux: se puede atacar por red, sin login y sin necesidad de ninguna acción por parte del usuario. CVE-2026-98432 ➡️ CVSS 9.8 (crítico) ➡️ Afecta a la gestión de conexiones TCP/IPv4, el código que atiende cualquier conexión a tu servidor. ➡️ Ubuntu marca vulnerables desde la 16.04 hasta la 26.10, también los kernels de AWS, Azure, Google Cloud y Oracle. ➡️ La corrección todavía está «en preparación» en casi todas. Si tienes un servidor o un VPS con Linux, sigue los avisos de tu distribución y actualiza el kernel (y reinicia) en cuanto salga el parche. https://ubuntu.com/security/CVE-2026-984…
Smoking gun. Attacker confirmed as North Korea.
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents. The Bitget exploit was attributed to DPRK-linked Traide…
