# Vulnerability Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Vulnerability", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Cryptocurrency Wallet Manufacturers Warn of Phishing Attacks

Hardware cryptocurrency wallet manufacturers Trezor and Foundation have warned users of a surge in phishing attacks following the disclosure of a vulnerability in Coldcard wallets. Trezor and Foundation both issued alerts via social media, stating they have observed an increase in phishing attempts where attackers impersonate the companies. They emphasized that they will never ask users for their wallet recovery seed or request the download of unknown software. Cybersecurity firm Proofpoint detailed the phishing scheme targeting Coldcard users. Attackers send emails pretending to be from the manufacturer, prompting users to perform a "hardware audit." This leads to a fake website where victims download a file that installs a legitimate remote access tool, potentially giving attackers control. This phishing wave coincides with a critical vulnerability in Coldcard devices, involving a flawed random number generator (RNG) in the firmware. This weakness could allow attackers to brute-force wallet seed phrases. Manufacturer Coinkite has released firmware patches but stressed that users with seed phrases generated on vulnerable versions must create new ones and transfer funds. According to Galaxy Research, confirmed losses from the Coldcard exploit are at least 1,596 BTC (~$100M) from about 7,300 addresses, with potential total losses reaching $130 million. The company warns at least 15 different attackers are actively exploiting the flaw.

cryptonews.ru08/04 14:58

Cryptocurrency Wallet Manufacturers Warn of Phishing Attacks

cryptonews.ru08/04 14:58

At least 15 attackers exploited Coldcard vulnerability: Galaxy

At least 15 attackers have exploited a vulnerability in Coldcard hardware wallets, leading to estimated losses of up to $130 million in Bitcoin across multiple attack waves. According to Galaxy Digital, the exploitation method differed from typical exchange hacks, with one minor theft report uncovering a larger attack. The incident has sparked debate on cold wallet security. Some, like Dragonfly's Haseeb Qureshi, suggest inexpensive AI-based security hardening could have prevented the breach, citing reports that AI models quickly identified the flaw. However, analysts caution these claims lack rigorous testing and note the vulnerability was public before AI assessment. The weakness reportedly involved lower-than-standard private key entropy due to a firmware bug. Experts warn that advancing AI capabilities are reducing the cost and time to find such cryptocurrency vulnerabilities.

cointelegraph08/04 14:46

At least 15 attackers exploited Coldcard vulnerability: Galaxy

cointelegraph08/04 14:46

Bitcoin service Boltz suspends swaps after a series of attacks

Non-custodial Bitcoin swap service Boltz has indefinitely suspended its swap operations due to a rise in automated attacks, likely utilizing AI. The service, which facilitates atomic swaps between Bitcoin's mainnet, Lightning Network, and Liquid Network, stated its small team has faced multiple attacks exploiting vulnerabilities in recent months. While each attack was contained, the attackers began finding new vectors faster than the team could patch them. Boltz emphasized that user funds were never at risk due to its non-custodial model, and its API remains available for processing refunds. However, the team warned that swaps should not be expected to resume soon, citing a "major paradigm shift" for Bitcoin services operating on open-source stacks that requires careful analysis. The announcement follows a report estimating crypto projects lost approximately $1.1 billion to hacks in the first half of 2026.

cryptonews.ru08/04 11:16

Bitcoin service Boltz suspends swaps after a series of attacks

cryptonews.ru08/04 11:16

Alarming Statement from Galaxy Research Regarding Coldcard! Wallet Losses Could Exceed 2000 BTC: Details

Galaxy Research, the research arm of Galaxy Digital, has issued a concerning statement regarding a security vulnerability in Coldcard hardware wallets. The vulnerability, stemming from a flaw in the random number generation mechanism in certain firmware versions of Coldcard Mk3, Mk4, Mk5, and Coldcard Q models, could lead to total losses exceeding 2,000 Bitcoin (over $130 million at current prices). Analysis indicates that three major attacks and 14 smaller security incidents have already resulted in the theft of 1,596 BTC, affecting approximately 7,300 different Bitcoin addresses. There is strong evidence of a fourth, unconfirmed attack using the same method, which could push the total stolen to approximately 2,055 BTC. Manufacturer Coinkite has released an urgent software update and advised users to upgrade their devices immediately. Notably, around 90% of the stolen funds reportedly remain unmoved in the original addresses, suggesting the attackers may not yet have begun laundering or selling the assets. Investigations are ongoing in coordination with US federal agencies and cryptocurrency exchanges to identify the perpetrators and track the stolen assets.

cryptonews.ru08/04 07:01

Alarming Statement from Galaxy Research Regarding Coldcard! Wallet Losses Could Exceed 2000 BTC: Details

cryptonews.ru08/04 07:01

Being at the Front Lines of the Coldcard Theft Case Made Me Realize Why the Impact is Far Greater Than the Numbers Suggest

Even 5 years after a vulnerability was discovered, no one expected it to fuel the largest Bitcoin theft of the year. On July 30, anomalies were detected: hundreds of Bitcoin were aggregated from numerous addresses in a short timeframe, followed by a rapid expansion of the attack. The perpetrator scanned thousands of addresses, stealing nearly 2,000 BTC worth over $100 million. The cause was quickly identified: a bug in the mnemonic generation process of the Coldcard hardware wallet, specifically a weak random number issue that made the entropy predictable. While initially less noticed in China due to Coldcard's smaller user base, the incident caused an uproar overseas, where Coldcard is highly respected among Bitcoin OGs and maximalists. Panic peaked by July 31, with small transactions (under 1 BTC) reaching a daily volume of 39,600 BTC, the highest since FTX's collapse in 2022. The attack is believed to have been discovered and executed by an AI model, similar to a prior incident that halved Zcash's value, but with potentially more severe psychological impact. The breach shook the core belief system of Bitcoin's most dedicated community. According to Yu Xian, founder of SlowMist, who is assisting some victims, the profound impact lies in undermining trust in a historically reputable, open-source, "perfect" hardware wallet. This erodes confidence in self-custody solutions, leading some users to reconsider the perceived safety of centralized exchanges with robust security measures. For ordinary users, Yu Xian recommends: always use a passphrase with your mnemonic seed; maintain a small amount in a non-passphrase wallet as a canary; and for non-technical users, relying on reputable centralized services might be a simpler option. General advice includes auditing your asset storage methods, staying calm to avoid phishing, and isolating questionable assets. The incident underscores a critical security asymmetry: attackers, unrestricted and highly motivated, can leverage AI far more aggressively than defenders, who face various constraints. This dynamic could lead to even larger-scale breaches in the future, potentially involving core protocols like Bitcoin itself. The industry's challenge is to continuously evolve and strengthen its defenses in this ongoing arms race.

marsbit08/04 06:56

Being at the Front Lines of the Coldcard Theft Case Made Me Realize Why the Impact is Far Greater Than the Numbers Suggest

marsbit08/04 06:56

July Security Report: Total Losses Approximately $97 Million, Cross-Chain Bridge Attacks Concentrated with Over $35 Million

In July 2026, the cryptocurrency sector suffered total losses of approximately $97 million, with hacker attacks and contract vulnerabilities accounting for about $94 million. A significant trend was the shift in attack vectors from smart contract code to off-chain infrastructure, signature key leaks, and governance manipulation. Major incidents included: * **Ostium ($23.75M loss):** An attacker gained access to its off-chain price oracle signing system, manipulated BTC prices, and drained funds. * **AFX Trade Bridge ($24.15M loss):** The private validator key for its cross-chain bridge was compromised, allowing unauthorized withdrawals. * **BonkDAO ($20M loss):** An attacker acquired enough tokens to pass a malicious governance proposal and drain the treasury, exploiting low voting thresholds. * **Bonzo Lend ($9.05M loss):** A third-party oracle provider's signature verification was exploited to inject manipulated token prices. * **Verus Bridge ($7.55M loss):** A repeat attack exploiting the same unpatched bridge vulnerability. * **B2 Network ($3.86M loss):** An attacker seized the upgrade authority for a staking contract. Cross-chain bridges remained a prime target, with concentrated attacks causing over $35 million in losses. Phishing scams resulted in roughly $3 million in losses, employing sophisticated methods like fake mobile apps and physical counterfeit letters targeting Ledger users. Key takeaways are the acceleration of attacks on off-chain infrastructure, the persistent vulnerability of cross-chain bridges, and the rising prominence of governance-layer exploits. Recommendations include enhancing off-chain key management with multi-sig security, implementing stricter governance controls, and increasing user vigilance against phishing.

marsbit08/04 02:21

July Security Report: Total Losses Approximately $97 Million, Cross-Chain Bridge Attacks Concentrated with Over $35 Million

marsbit08/04 02:21

AI Bulk Bombards Apple Bug Bounty Program, Review Team Has Gone Offline

Apple has temporarily suspended and limited submissions to its Bug Bounty Program due to a flood of AI-generated vulnerability reports. The program, launched in 2016 and offering rewards up to $5 million, has been overwhelmed by reports from amateur researchers using tools like ChatGPT, many containing false positives or "AI hallucinations." This AI-driven surge in bug reports is straining Apple's security review team, leading the company to impose a 30-day "cooling-off" period and submission caps. The trend highlights a broader industry challenge, with other major firms like Google and GitHub also adjusting their vulnerability disclosure programs. Paradoxically, while AI is creating a reporting bottleneck, it's also accelerating defense. Apple's recent macOS Tahoe 26.6 security update, which patched 194 vulnerabilities, included its first-ever acknowledgments to AI tools (Claude, Codex Security, etc.) for helping discover flaws. This forces Apple into faster, more frequent security updates, a departure from its traditionally controlled release cadence. A key example involves Apple's advanced "Memory Integrity Enforcement" (MIE) security feature, touted as a major breakthrough. However, researchers using an AI model bypassed its protections in just five days, demonstrating both the power and disruptive pace of AI in cybersecurity. The incident underscores a critical shift: as AI compresses the vulnerability discovery cycle to days, traditional monthly security update cycles may become dangerously long exposure windows.

marsbit08/04 01:46

AI Bulk Bombards Apple Bug Bounty Program, Review Team Has Gone Offline

marsbit08/04 01:46

2013 Bitcoin Whale Awakens, Moves 500 BTC Amid Escalating Coldcard Concerns

A "Bitcoin whale" wallet dormant since 2013 has awakened, moving 500 BTC (worth ~$31.32 million). This transaction, first reported by btcparser.com and Whale Alert, originates from an address created on December 6, 2013, when Bitcoin first surpassed $1,000. The original 500 BTC were valued at approximately $521,000 at that time. This movement is seen as part of a wider trend prompted by growing security concerns surrounding a vulnerability in the Coldcard hardware wallet's firmware and random number generator. Reports indicate roughly 1,431.97 BTC have already been stolen via this exploit. Since July 30th, hundreds of BTC have been proactively transferred from other long-dormant wallets, likely due to these fears. Blockchain data shows the 500 BTC were sent to a Pay-to-Witness-Public-Key-Hash (P2WPKH) address not linked to any known exchange, custodian, or entity. For early adopters who embraced self-custody, the Coldcard flaw directly challenges their core philosophy of exclusive private key control. Analysts suggest this transfer represents a security precaution—an effort to protect capital by moving funds from a potentially vulnerable, outdated wallet—rather than a market-timing decision. The action underscores a shift in priority for some long-term holders from speculation to capital preservation amid heightened security risks.

cryptonews.ru08/03 20:36

2013 Bitcoin Whale Awakens, Moves 500 BTC Amid Escalating Coldcard Concerns

cryptonews.ru08/03 20:36

ZachXBT Refuses to Track $88M Coldcard Hack

Well-known blockchain investigator ZachXBT stated on X that he currently has no plans to track or investigate the Coldcard hack, which has resulted in losses of approximately $88.6 million. He cited a focus on ecosystems that value his work and noted a lack of support from Bitcoin maximalists for his investigations. The attack exploited a firmware flaw in Coinkite's Coldcard Mk3 hardware wallets (versions 4.0.1 to 4.1.9), causing some devices to generate guessable seed phrases. The hacker, potentially using automated tools or AI, drained funds from thousands of inactive addresses in multiple waves starting July 30th. Coinkite's incident response sparked separate controversy when the company emailed customers using addresses stored indefinitely, contradicting prior claims about data deletion policies. This has damaged trust in self-custody solutions. With ZachXBT stepping back, tracking the stolen 1,367 BTC falls largely to firms like Galaxy Research. The vulnerability may affect seeds generated over the past four years, requiring users to upgrade firmware and generate new seeds for safety.

cryptonews.ru08/03 12:05

ZachXBT Refuses to Track $88M Coldcard Hack

cryptonews.ru08/03 12:05

XRPL Node Operators Urged to Update to Version 3.2.1 Immediately

Ripple's Director of Development, Vijay Khanna, has notified XRP Ledger node operators of the release of XRPL version 3.2.1, which contains a critical fix for the network. This update addresses a "manifest flood" attack that was observed in the network on July 31st. Previously, nodes would accept, store, and relay an unlimited number of manifests from unknown validator keys. Version 3.2.1 implements four key restrictions to prevent such flooding: - A manifest size limit, rejecting any manifest larger than expected. - An inbound limit, where incoming packets exceeding a threshold are dropped instead of disconnecting the peer. - An outbound limit, capping the manifest packet size in welcome messages to new peers. - A caching limit, rejecting new unknown keys after 100 are stored. Additionally, manifests from unknown keys are no longer saved to disk, preventing the flood from persisting after a node restart. Node operators are strongly urged to update to XRPL 3.2.1, wait briefly to ensure the process is running, and then restart the xrpld service. This release enhances validator manifest security by rejecting oversized objects early, limiting processing and storage of untrusted data, and preventing untrusted information from entering permanent storage.

cryptonews.ru08/03 09:40

XRPL Node Operators Urged to Update to Version 3.2.1 Immediately