Hacks

Founder Aaluxx said he would ‘work to fix and recover in full,’ while routing service LeoDex reported that Maya had activated a global halt.

Harmony asked exchanges to block four wallets and paused its bridge, while an analyst’s estimate of four billion unauthorized ONE remains unconfirmed.

Hardware wallet maker Foundation and the Bitcoin zine Citadel21 both said their nodes were swept, in some cases hours before the project's public alert. BTCPay says the flaw under attack is not the one disclosed in its changelog.

Bitcoiners who followed self-custody best practices — air-gapped devices, steel seed plates, safety deposit boxes — describe watching years of savings disappear in minutes as attackers exploiting the Coldcard flaw drained more than $114 million.

North Korea-linked actors drove the largest losses, with the $292M KelpDAO and $285M Drift exploits both tied to DPRK groups.

The exploit targeted a bridge operated by derivatives exchange AFX and emptied nearly all of the USDC locked in the contract, according to security firm Blockaid. Arbitrum co-founder Steven Goldfeder said the network's native bridge was not affected.

The attacker used a $1.12 million Kamino flash loan to skew Allbridge's Solana stablecoin pools, then bridged the proceeds to Ethereum, security firms said.

Blockchain security firm PeckShield now puts the drain on Arbitrum perpetuals protocol Ostium at roughly $24M, above the up-to-$18M first estimated.

Blockaid says an attacker used a registered price-feed forwarder and future-dated oracle reports to book fake trading profits, in the latest exploit to target the automated infrastructure DeFi protocols lean on for pricing.

A pseudonymous team is redeploying the Uniswap v4 token that pays fees to everyone who holds it, after a bad actor created 2,500 'phantom' fee positions. The original token has crashed more than 90% in a day.