security breach

Gamdom

2026-10-15 01:10:21

Gamdom hit by security breach with losses topping $4.2 million

Gamdom has suffered a security breach that has led to losses across multiple blockchain networks, according to on-chain investigator vxdb. Initial estimates put the total amount stolen at more than $4.2 million. The largest share came from EVM-compatible chains, where the attacker is estimated to have taken about $2.2 million in assets. The affected networks listed in the monitoring update were Ethereum, BNB Smart Chain, Polygon, Arbitrum and Optimism. Losses were also recorded outside the EVM ecosystem. On Solana, the platform lost about $965,000. TRON accounted for roughly $375,000 in losses, while the Bitcoin network saw about $668,000 stolen. The figures cited were described as preliminary. Based on the chain-by-chain breakdown available so far, the combined losses have already exceeded the $4.2 million mark.

10

Blink

2026-10-04 12:26:48

Blink says Sept. 19 attack stole 6.61 BTC from 24 customer accounts

Blink has published a full post-incident review of its Sept. 19 security breach, according to Bitcoin News. The company said the attack led to the theft of 6.61 BTC from 24 customer accounts and traced the underlying vulnerability back to October 2023. Under Blink’s account model, any user with a free Blink account could potentially exploit the flaw to gain customer-support-level privileges, take over customer accounts, and raise withdrawal limits. Blink also said the attacker accessed partial information tied to 3,817 accounts, including some phone numbers and email addresses. It added that names, identification documents, physical addresses, passwords, and seed phrases were not exposed. All 24 compromised accounts had not enabled two-factor authentication. The attacker also tried 18 withdrawals from nine accounts protected by two-factor authentication, but none succeeded. The company said Blink shareholders have fully reimbursed all affected customers. It added that about 5 BTC of the stolen funds was later moved through a cross-chain swap service. Blink is now offering a recovery bounty of up to about 3.3 BTC, with half of any successfully recovered funds to be allocated to people who provide actionable leads and to the circular Bitcoin economy.

370

Blink

2026-10-04 12:25:44

Blink says 24 accounts lost 6.61 BTC in Sept. 19 attack, offers bounty of up to 3.3 BTC

Blink has released a full post-mortem on its Sept. 19 security incident, saying the attack led to the theft of 6.61 BTC from 24 customer accounts. According to the company, the vulnerability had existed since October 2023 and could have allowed any user with a free Blink account to gain support-level privileges, take over customer accounts, and raise withdrawal limits. The attacker also obtained partial information from 3,817 accounts, including some phone numbers and email addresses, while names, identity documents, addresses, passwords, and seed phrases were not exposed. Blink said all 24 compromised accounts did not have two-factor authentication enabled. The attacker also made 18 withdrawal attempts from nine accounts protected by two-factor authentication, but none succeeded. Blink shareholders have fully reimbursed all affected customers. The company added that about 5 BTC of the stolen funds was later moved through a cross-chain swap service. Blink is now offering a recovery bounty of up to about 3.3 BTC, with half of any successfully recovered funds to be allocated to those who provide valid leads and to the Bitcoin circular economy.

360

NEAR Intents

2026-10-03 11:59:10

NEAR Intents recovers full $3.8 million after 48-hour ultimatum to exploiter

NEAR Intents said it has recovered the roughly $3.8 million stolen in a Thursday security breach after identifying the exploiter and giving them 48 hours to return the funds under a "responsible disclosure" process. Later on Friday, general manager Alex Shevchenko said the money had been returned in full and that the investigation would stop. The project had previously paused services after finding what it described as a bug involving the Omni deposit and withdrawal infrastructure’s interaction with the NEAR Intents smart contract. NEAR’s preliminary review said $3.8 million in user funds had been taken and that affected users would be made whole. Blockchain investigator ZachXBT also said the stolen funds were moved to KuCoin and bridged to Bitcoin.

580

Drift Foundat

2026-09-30 14:26:46

Drift Foundation says $9.2 million in stolen funds frozen, 107,165 ETH remains unmoved

Drift Foundation has released an update on recovery efforts tied to its April 1 security incident, saying roughly $295.4 million in user assets was stolen. The foundation said it hired Mandiant, zeroShadow, and SEAL 911 to investigate the attack and trace the funds. Mandiant identified the attacker as North Korean threat group UNC6862. According to the update, the stolen assets were later bridged to Ethereum and split across four wallets holding about 130,259 ETH in total. Three of those wallets, containing a combined 107,165 ETH, have not moved any funds so far. A fourth wallet transferred about 23,094 ETH to Tornado Cash on July 23. The foundation said about $9.2 million in stolen funds has now been frozen. Those funds had previously moved through Tornado Cash in August, though any unfreezing and return process will still require legal coordination. Drift Foundation also said any assets recovered through freezes, bounty efforts, or law enforcement will be sent to the DFX recovery pool. In parallel, it is evaluating the future path of the DRIFT token across the broader ecosystem. The foundation has also launched a public bounty program with Bybit, offering a 10% reward on successfully recovered funds.

460

Drift Foundat

2026-09-30 14:28:02

Drift Foundation says $9.2 million frozen in recovery effort tied to April security breach

The Drift Foundation has released an update on efforts to recover funds stolen in its April 1 security incident, saying about $295.4 million in user assets was taken. The foundation said it hired Mandiant, zeroShadow, and SEAL 911 to investigate the attack and trace the funds. Mandiant identified the attacker as North Korean threat group UNC6862, according to the update. The stolen assets were later bridged to Ethereum and spread across four wallets holding about 130,259 ETH in total. Three of those wallets, which together hold 107,165 ETH, have not moved funds so far. A fourth wallet transferred about 23,094 ETH to Tornado Cash on July 23. Drift said roughly $9.2 million in stolen funds has now been frozen. Those assets had previously moved through Tornado Cash in August, and the foundation said any unfreezing and return of funds will still require legal procedures. The foundation added that any assets recovered through freezes, bounty programs, or law enforcement channels will be sent to the DFX recovery pool. It is also evaluating the future path of the DRIFT token across the broader ecosystem. In addition, Drift said it has worked with Bybit to launch a public bounty program that offers a 10% reward on successfully recovered funds.

420

SlowMist

2026-09-30 04:23:06

SlowMist says Bitget hot wallet theft probe points to third-party security product flaw

SlowMist said on Sept. 30 that Bitget had asked its security team to investigate the hot wallet asset theft that took place on Sept. 25. As of Sept. 29, the firm said its investigation had found that the attack involved a third-party security product, malicious activity on the wallet application host, and a custom withdrawal tool developed by the attacker. According to SlowMist, the attacker used a zero-day vulnerability in a third-party product to carry out malicious actions, then used an internal employee identity on Sept. 25 to gain unauthorized access to the management platform of that third-party product. The attacker also obtained and used a customized tool designed around the wallet’s withdrawal logic. SlowMist said on-chain activity began at 02:31 on Sept. 25 (UTC+8), and assets were moved across multiple blockchains over roughly 2 hours and 52 minutes. It added that the attacker later attempted to tamper with withdrawal records and triggered additional BTC withdrawals. The firm said it is still investigating how the attacker moved laterally between affected systems.

450

Bitget

2026-09-28 07:53:00

Bitget CEO says about $388 million was moved by attackers, protection fund to be restored above $300 million within a week

Bitget CEO Gracy Chen said in a livestream that attackers exploited a vulnerability in a third-party security product to steal internal credential permissions and forge withdrawal instructions to the exchange’s wallet system, bypassing risk-control checks. She said private keys were not compromised and cold wallets were not affected, adding that the vulnerability has been fixed and the incident is now fully contained. Chen said the amount confirmed to have been moved out was about $388 million. She also said Bitget has publicly released the attacker addresses and on-chain tracking data. According to Chen, all losses from the incident will be covered by the user protection fund, and the exchange will replenish that fund to at least $300 million within one week after using it. Bitget has also started an asset recovery plan and will share confirmed vulnerability and attack details with relevant industry parties.

390