wallet security

Scam Sniffer

2026-10-04 03:02:34

Scam Sniffer says Ethereum user lost about $167,000 in phishing attack

Scam Sniffer reported that a user on Ethereum was hit by a phishing attack and lost about $167,000. The monitoring update said the approval tied to the incident can be traced back to a signature made on Aug. 18, 2025. No other details were provided in the source note. The disclosure was shared through Scam Sniffer’s published monitoring information, with the original source link pointing to its post on X. The case adds to the stream of wallet security incidents tracked through on-chain monitoring, though the source entry here only states the loss amount, the network involved, and the date tied to the approval signature.

20

Revoke.cash

2026-10-03 06:22:49

Revoke.cash urges users to review Auto-Revoking settings after Magic Eden security incident

Revoke.cash has warned users to check the Auto-Revoking section on their account page following last week’s Magic Eden security incident. The service said users should look for yellow warning icons across supported networks. If any appear, the affected address should first be reverted to a regular account in another wallet app, then upgraded to a smart account through MetaMask. Revoke.cash also said users need to make sure all networks they actively use are enabled and that each wallet under a subscription has been granted the required permissions separately. For Ultimate subscribers, the company said Auto-Revoking can protect assets only if two conditions are met: the wallet has been granted Auto-Revoking permission in MetaMask, and the wallet has been upgraded to a MetaMask smart account on the relevant network. It added that the second step usually happens automatically during authorization, but the upgrade may fail if the address had already been turned into a smart account through another wallet application.

20

MetaMask

2026-09-30 23:55:22

MetaMask says infrastructure was affected in security incident, sees no direct threat to wallets

MetaMask said in a security update posted on X on Oct. 1 that part of its infrastructure was affected by a security incident. The company said it has not found any signs of a direct threat to MetaMask wallets at this stage. MetaMask also stressed that the incident involves infrastructure and does not indicate that the wallet itself is currently facing a security risk. As a precaution, the company said it is coordinating with relevant customers, partners, and security advisers to proactively exit affected validators in its non-custodial staking business. MetaMask added that it will share further updates when appropriate. The statement did not disclose additional technical details about the incident.

00

hardware wall

2026-09-30 10:11:12

Crypto hardware wallets compared for 2026: Ledger, Trezor, QR devices and Bitcoin-only models

Cointelegraph has published a broad 2026 comparison of crypto hardware wallets, sorting devices by security model, connectivity, usability and recovery design rather than by branding alone. The guide covers multi-asset wallets, QR-based signers, NFC wallet cards and Bitcoin-only devices, while also explaining what hardware wallets can and cannot protect against. The publication said it hands-on tested Trezor Safe 7, Ledger Stax, Flex, Nano Gen5, Nano X, Nano S Plus and Coinkite’s Opendime across Linux and macOS setups, using both official and third-party software. Other products in the roundup were included based on public information. Among the tested devices, Cointelegraph said Ledger Stax showed noticeable input lag tied to its wraparound screen, making PIN entry slower and less reliable than on cheaper touchscreen models. The article also highlights trade-offs across the market: Bluetooth and USB models for broader compatibility, QR wallets that avoid live data links during signing, NFC cards that sacrifice on-device verification, and Bitcoin-only wallets that narrow functionality in exchange for a smaller attack surface. It also points to a July 2026 Coinkite warning over flawed Coldcard firmware and an Aug. 24 update from Galaxy Research’s Alex Thorn linking about 1,789 BTC in thefts from 8,865 addresses to that issue.

210

SlowMist

2026-09-30 04:58:55

SlowMist says earliest malicious activity in Bitget incident dates back to Aug. 31

SlowMist has released a preliminary investigation into the Bitget incident, saying the earliest malicious activity it has identified can be traced to Aug. 31. According to the report shared by SlowMist founder Cos on social media, the attacker is suspected of compromising two third-party security products and a wallet business host before using a customized withdrawal tool to move assets across multiple blockchains. The report says a node server tied to third-party security product A had a zero-day vulnerability on Aug. 31, when hidden scripts were run under a service process to read database passwords, environment variables, and connect to the database. Similar hidden-script activity was later found on two more nodes on Sept. 23 and Sept. 25. SlowMist also said the attacker likely entered the management platform of security product B in the early hours of Sept. 25 by abusing an internal employee account, then used task parameters and a web execution entry to write malicious files, alter server settings, and assemble malware. Host logs show the malicious program began running at 01:49 on Sept. 25. On-chain records show the first verified outbound transfer took place at 02:31, when the attacker address received 93 TRX and, 11 seconds later, 0.84 ETH. SlowMist said the investigation was still ongoing as of Sept. 29 and has not yet disclosed attribution, the final scale of losses, or the full scope of affected systems.

200

Bitget

2026-09-30 04:09:36

Mandiant says attackers entered Bitget wallet environment through third-party security devices

Bitget said in a post on X that an investigation by Mandiant, the cybersecurity unit under Google Cloud, into its Sept. 24 security incident found that attackers first gained unauthorized access to some third-party security devices. From there, they moved laterally into Bitget’s exchange wallet environment and obtained access to both warm and hot wallets. Bitget added that the findings match the attack path it had disclosed earlier. The update ties the incident to compromised third-party security infrastructure rather than a different entry point and frames Mandiant’s review as consistent with the company’s prior public account of how the breach unfolded.

210

Project Eleve

2026-09-29 15:44:57

Project Eleven Buys Riva Labs to Add Post-Quantum Wallet and Signing Technology

Project Eleven, a startup focused on preparing crypto networks for the arrival of powerful quantum computers, said it has acquired Riva Labs, a cryptography engineering team known for building post-quantum wallets and signing tools. The companies did not disclose the purchase price or any other deal terms. According to a statement shared with Unchained on Tuesday, Riva’s team, technology, and intellectual property will be folded into Project Eleven’s research and product efforts across digital asset custody, blockchain security, and post-quantum cryptography. Riva has centered much of its work on hash-based signatures, a class of signature schemes designed to resist attacks from quantum machines, and has applied that work to software wallets, hardware signers, multi-party computation setups on Ethereum and other public chains, and account abstraction. Project Eleven said the acquisition will help it approach migration as one integrated problem spanning signatures, wallets, key management, and protocol infrastructure. The company also pointed to AI as a force accelerating both cryptographic research and cryptanalysis. Project Eleven raised $20 million in a Series A round in January and has already worked with the Solana Foundation and Ripple on quantum-resistant testing and custody-related prototypes.

120

crypto scams

2026-09-29 04:30:57

2026 crypto scam guide lists 12 common fraud schemes, from fake mainnets to account takeovers

TechFlowPost has published a 2026 crypto scam guide that groups common fraud tactics into five categories and 12 specific schemes, using the recent fake GIWA mainnet incident as a starting point. Written by Changan from the Biteye content team, the piece argues that the most dangerous part of crypto fraud is not only technical trickery, but the constant reshaping of familiar attack surfaces such as X posts, Telegram chats, Google search results, Discord verification flows, wallet history, mobile apps, and exchange recovery processes. The article details several patterns: fake project websites amplified by KOL reposts, fake recruiting and investment outreach that deliver malware through meeting plugins or coding tests, stolen influencer accounts used to launch tokens, Telegram impersonation and code theft, search-engine phishing pages, Discord wallet-drainer verification, fake airdrop emails, address poisoning, fake mainnets and fake bridges, malicious app updates, and exchange account resets backed by forged identity materials. It also cites examples including a fake Hyperliquid site that led to the theft of about 550,000 USDC and the fake GIWA mainnet, where 1,335 addresses sent roughly 767.65 ETH and about 766.25 ETH was drained. Its practical advice is consistent throughout: verify official channels, never share login codes or 2FA credentials, isolate devices from large holdings, review exchange permissions beyond just passwords, and treat every link, signature request, and software download with suspicion.

500