MetaMask2026-10-01 09:25:02MetaMask validator rewards sent to Tornado-funded address as security probe widensMetaMask’s disclosed security incident has drawn fresh scrutiny after security researcher Kaden said 18 block rewards earned by MetaMask-operated validators were routed to the wrong fee recipient address and ended up at an account previously funded through Tornado Cash. The rewards totaled about 0.36 ETH, or roughly $970 using the ETH price cited in the source report. Kaden said the attacker likely gained access only to fee recipient settings rather than withdrawal credentials, which would mean staked principal could not be withdrawn. MetaMask has not confirmed that assessment or detailed the nature of the incident. The report also described a broader validator exit tied to the incident. Kaden estimated around 17,000 validators and roughly 523,000 ETH were involved in precautionary exits, though MetaMask has not confirmed those figures. Separately, Lido’s public operator key data showed that validators run by Consensys under Lido were no longer operating normally, with 6,914 in exit and 152 already exited as of Oct. 1. Lido said stETH holders do not need to take any action and noted that the protocol has more than 6,750 stETH in temporary reserves to help absorb operational disruption.60
Robinhood Cha2026-09-28 12:58:16Analysts Trace Repeated Token Launch Scheme on Robinhood Chain’s Pons PlatformA ChainCatcher report says a wallet cluster tied to token launches on Robinhood Chain’s Pons platform may have extracted about $18.43 million across 53 launches between July 10 and Sept. 21. The reporting focuses on DEED, a token that opened on Sept. 22 and briefly reached a $4.23 million market cap before collapsing. Onchain Lens flagged a suspected rug pull a day later, saying 110 related wallets at one point controlled about 86% of supply, withdrew roughly $700,000, and the creator also collected 68.5 ETH in creator fees worth about $188,900. According to onchain analyst Wazz, the playbook linked proceeds from one token sale to the next launch. The structure allegedly relied on Pons V2’s anti-sniping tax design, which heavily taxed early buys but allowed launchers to exempt up to 32 wallets. In a series of launches since late August, creators allegedly used 15 to 25 tax-exempt wallets to buy out the bonding curve, then sold into later buyers. Separately, GoPlus disclosed another high-risk meme fraud factory on Robinhood Chain with more than $9 million in turnover over the past 30 days, while saying there is no evidence the two cases involve the same group.250
Bitcoin2026-09-18 08:47:20James Check says Bitcoin may have already found its cycle bottom near $58KBitcoin may have already set its cycle low near $58,000, according to Checkonchain founder and lead analyst James Check, who argues that two separate capitulation phases have already cleared much of the market’s selling pressure. Speaking to Cointelegraph, Check said Bitcoin’s drop toward $60,000 in February marked a "price-pain capitulation," while the stretch around $58,000 in June and July reflected a later "time-pain capitulation" after months of sideways trading wore down holders. His view runs against expectations from some traders who still look to the historical four-year cycle and expect another low around October 2026. Check said that framework has no mechanical basis and can mislead traders if used as a timing tool on its own. Instead, he pointed to cost basis, realized and unrealized losses, holder profitability, and whether seasoned investors are accumulating or distributing. Check said roughly $300 billion in Bitcoin cost basis sat between $58,000 and $70,000, and about 4 million BTC moved from unrealized loss into profit during the rebound. Grayscale research head Zach Pandl offered a similar view, saying he believes the bottom likely came at the end of June near $58,000. Still, onchain signals remain mixed, with HODL Waves and CryptoQuant data pointing to different readings on the strength of the recovery.450
Coldcard2026-09-07 02:38:06Galaxy Research says Coldcard Wave 3 attacker keeps moving funds, with about 45% routed into mixing or cross-chain pathsGalaxy Research said on Sept. 7 that the attacker tied to the Coldcard “Wave 3” incident is still moving stolen funds. In this phase, the attacker created 293 separate 2-of-2 multisig vaults, one for each victim’s assets. The first batch of funds was bridged to Ethereum through THORChain on Sept. 2, while the latest transfers have started entering the CoinJoin mixing process. According to the report, the attacker is handling the largest vaults first and has already moved vaults ranked No. 1 through No. 11 by stolen amount. The next 10 unmoved vaults hold a combined 30.81 BTC, while vaults ranked No. 61 through No. 293 together hold 33.77 BTC. Galaxy Research said about 45% of the assets stolen in this exploit have now been moved, either to Ethereum via THORChain or into CoinJoin transactions. The team also identified a previously unknown vault involving 58 addresses that spent funds in the same 2-of-2 multisig format seen in Wave 3. If that vault also belongs to Coldcard victims, the total number of vaults could rise to 294 and the total stolen amount could increase to about 1,806 BTC.750
Coldcard2026-09-03 09:31:07Coldcard exploiter moves stolen BTC through THORChain and swaps part into ETHA hacker tied to the third wave of Coldcard wallet thefts has begun moving stolen Bitcoin onchain, swapping part of the haul for Ether through THORChain. Galaxy Research head of research Alex Thorn said the exploiter moved roughly 10% of the stolen funds, while about 90% remains untouched. Thorn described the transfers as the first onchain movement from the original hacker addresses across all three waves of the Coldcard thefts. According to Thorn, the attacker appears to be struggling to swap the full amount through THORChain, with transactions being refunded and retried. Onchain analysts traced the funds to a new Ethereum address, which Thorn said he shared with relevant authorities and crypto companies. He added that it is still unclear whether the attacker will try to further obscure the trail or move the assets through an exchange. Galaxy Research previously linked the Coldcard exploit to the theft of at least 1,789 BTC from 8,865 addresses, worth about $114.7 million at the time of the theft. CertiK said in August that hackers connected to the exploit had also sent 64 BTC and 200 ETH to mixers including Tornado Cash.950
Bitcoin2026-08-31 13:30:00Why a long-dormant Bitcoin OG moved $1 million through a custodian and then burned it remains unexplainedA puzzling Bitcoin transaction trail has left blockchain analysts with a rare case where the onchain record is detailed, yet the motive is still missing. Cointelegraph reported that a wallet dormant for nearly 12 years sent 20.00010537 BTC, worth about $1 million, to a large crypto custodian or centralized platform in March. Roughly three weeks later, 20.00006037 BTC came back to the same address, with only 4,500 satoshis, or about $3, missing. Less than two months later, the coins were deliberately sent to an unspendable address. The transaction is part of a broader 107 BTC burn in May, valued at roughly $8.5 million at the time. Chainalysis said five wallets that eventually destroyed their Bitcoin show strong indicators of common ownership. All five were funded on the same day in April 2014, later sent nearly identical dollar-value amounts of BTC to the same exchange deposit address, and much of the money can be traced back to Mt. Gox. One of the wallets sent 19.6 BTC in 60 transfers between 2022 and 2024, with 58 of those transfers clustered within 10% of about $10,400 despite major changes in Bitcoin’s price. Analysts have floated liquidation, wallet testing, compliance, and privacy as possible explanations, but none accounts for the full sequence.850
Bitcoin2026-08-31 13:36:26Dormant Bitcoin Wallet Moved 20 BTC to Exchange, Took It Back, Then Burned the CoinsA Bitcoin wallet that had been inactive for nearly 12 years moved its entire 20.00010537 BTC balance, worth about $1 million, to a large centralized exchange in March, according to a report cited by Cointelegraph. Roughly three weeks later, almost the exact same amount returned, with only 4,500 satoshis, or about $3, missing. The coins were then permanently burned in May. Blockchain analytics firm Chainalysis said the wallet shows a strong "common ownership" link with four other addresses. All five received their initial funding on the same day in April 2014, and most of the funds can be traced back to the now-defunct Mt. Gox exchange, pointing to an early Bitcoin holder. Bitcoin educator Bennet also found that one of the linked addresses sent 19.6 BTC to the custodian in 60 transactions between 2022 and 2024. In 58 of those transfers, the U.S. dollar value was close to $10,400 even as Bitcoin's price rose more than fourfold over that period. That pattern suggests a fixed-dollar liquidation strategy. Even so, the March transfer and return, followed by the burn, does not fit a standard transaction explanation, and Chainalysis said the motive remains unclear.820
Bitcoin2026-08-13 03:45:35Glassnode: Bitcoin in Late-Bear Compression, But Real Demand Signal Still MissingBitcoin is trading between its median realized price (about $63,000) and the short-term holder cost basis (near $68,700), with spot volume hitting its lowest since 2019. Even as core inflation eased to 2.5% in July and stocks reached fresh records, the largest cryptocurrency barely reacted and even slipped — a clear sign, Glassnode says, that demand is missing. Sell-side pressure is fading. Profitable supply is close to the zones seen at past bear market bottoms, a seller exhaustion gauge has hit cycle lows, and adjusted SOPR has been rejected at breakeven nine times. Buyers, however, remain absent: ETF inflows are tiny and coins are still flowing into exchanges. Derivatives already hold large long positioning, open interest is high relative to volume, and bid depth is thinning. Glassnode is watching $68,700 to the upside and roughly $58,500 below. A sustained break above the former, confirmed by rising volume and ETF inflows, would suggest improvement; losing the latter risks an accelerated drop with thin bids and crowded longs. The firm stays cautious, calling the situation a late-stage bear compression. No real demand signal has emerged.1330
