{"title":"Crypto and Web3 advisories","description":"Exchange, wallet and DeFi incidents: signing-infrastructure compromise, key theft, smart contract bugs and laundering.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/cyber-security-news-reports-fatf-traced-100-million-to-scam-crypto-wallets/","title":"Cyber Security News reports FATF traced $100 million to scam crypto wallets","url":"https://vulnpocalypse.dev/advisories/cyber-security-news-reports-fatf-traced-100-million-to-scam-crypto-wallets/","date":"2026-11-12","summary":"Cyber Security News says a FATF report traced over $100 million to one crypto wallet cluster; no IoCs, so report fast on suspected scams.","tags":["ecosystem","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/bleepingcomputer-reports-ex-fbi-agent-pleaded-guilty-to-25m-crypto-theft/","title":"BleepingComputer reports ex-FBI agent pleaded guilty to $2.5M crypto theft","url":"https://vulnpocalypse.dev/advisories/bleepingcomputer-reports-ex-fbi-agent-pleaded-guilty-to-25m-crypto-theft/","date":"2026-11-12","summary":"BleepingComputer reports a former FBI agent pleaded guilty to taking about $2.5M in crypto from wallets in FBI cases, no patch or fix is involved.","tags":["breach","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/","title":"Coinbase customer contact and transaction data exposed in an incident at analytics vendor Amplitude","url":"https://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/","date":"2026-11-12","summary":"An incident at analytics vendor Amplitude exposed contact and some transaction data of Coinbase customers. Coinbase says its systems and funds were not hit.","tags":["breach","crypto","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","title":"Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 compromised","url":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","date":"2026-11-11","summary":"Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.","tags":["supply-chain","npm","nodejs","github-actions","crypto","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/binance-denies-breach-after-actor-using-shinyhunters-handle-claims-data-sale/","title":"Binance denies breach after actor using ShinyHunters handle claims data sale","url":"https://vulnpocalypse.dev/advisories/binance-denies-breach-after-actor-using-shinyhunters-handle-claims-data-sale/","date":"2026-11-11","summary":"BleepingComputer reports an actor claims Binance user data is for sale; Binance denies a breach. Never share seed phrases or 2FA codes.","tags":["breach","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","title":"Fake GitHub security tool repos spread AsyncRAT, Doctor Web reports","url":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","date":"2026-11-11","summary":"Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.","tags":["supply-chain","open-source","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/","title":"Armorsteal Python malware kit steals data and mines crypto, Seqrite reports","url":"https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/","date":"2026-11-11","summary":"Seqrite reports Armorsteal, a Python kit that steals data and mines crypto on Windows; check for its scheduled tasks and Defender exclusions.","tags":["ecosystem","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/","title":"Fake GTA VI download sites push malware and crypto scams ahead of the November 19 launch","url":"https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/","date":"2026-11-11","summary":"Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.","tags":["ecosystem","endpoint","crypto","web"]},{"id":"https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/","title":"Chainstack discloses breach of production systems exposing customer data","url":"https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/","date":"2026-11-11","summary":"Chainstack says an attacker accessed part of its production systems and customer data; rotate node credentials, API keys and passwords.","tags":["breach","crypto","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/","title":"SolanaCry: fake Solana GitHub repo lures AI coding agents, Hackread reports","url":"https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/","date":"2026-11-11","summary":"Hackread reports a fake GitHub Solana starter kit tells AI agents to install NetSupport RAT; review commands before agents run them.","tags":["supply-chain","ai-tools","open-source","crypto","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/","title":"Polymarket traders drained via hijacked DebugBear monitoring script, DNS compromise cited","url":"https://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/","date":"2026-11-11","summary":"A DebugBear monitoring script on Polymarket.com was swapped for wallet-draining code on October 29, costing traders about 2.7 million dollars.","tags":["supply-chain","web","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/","title":"Chainalysis breach by offensive agentic techniques exposes customer names and emails","url":"https://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/","date":"2026-11-11","summary":"Chainalysis says an attacker using offensive agentic techniques accessed customer user IDs, names, emails and role labels, but not investigation content or","tags":["ai-tools","ai-tools","crypto","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","title":"Binance hack: $6.3B drained after attackers got its own systems to sign","url":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","date":"2026-11-11","summary":"On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.","tags":["breach","crypto","cloud","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/","title":"Symantec reports AI attack agent built to hijack exposed model endpoints","url":"https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/","date":"2026-11-11","summary":"Symantec reports an AI attack agent built to hijack unauthenticated OpenAI-style endpoints, so require authentication on any model endpoint you expose.","tags":["ai-tools","ai-tools","web","nextjs","cloud","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/","title":"CRAFTY FALCON: CERT-In warns AI-driven attacks are draining Indian BFSI through their own payment APIs","url":"https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/","date":"2026-11-11","summary":"CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.","tags":["ai-tools","ai-tools","enterprise","cloud","web","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/binance-says-ios-flaw-worse-query-could-expose-crypto-wallet-secrets/","title":"Binance says iOS flaw worse_query could expose crypto wallet secrets","url":"https://vulnpocalypse.dev/advisories/binance-says-ios-flaw-worse-query-could-expose-crypto-wallet-secrets/","date":"2026-11-10","summary":"Binance says iOS flaw worse_query may let malicious apps read other apps' files, including seed phrases; update iOS and remove untrusted apps.","tags":["exploited","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/ukraine-cyber-police-says-it-dismantled-crypto-scam-call-centers/","title":"Ukraine Cyber Police says it dismantled crypto scam call centers","url":"https://vulnpocalypse.dev/advisories/ukraine-cyber-police-says-it-dismantled-crypto-scam-call-centers/","date":"2026-11-09","summary":"Ukraine's Cyber Police says it detained four suspects in a crypto investment scam network; be wary of unsolicited investment offers.","tags":["breach","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/keplr-and-web3auth-say-web3auth-flaw-hit-google-and-apple-login-wallets/","title":"Keplr and Web3Auth say Web3Auth flaw hit Google and Apple login wallets","url":"https://vulnpocalypse.dev/advisories/keplr-and-web3auth-say-web3auth-flaw-hit-google-and-apple-login-wallets/","date":"2026-11-09","summary":"Keplr and Web3Auth say a Web3Auth flaw hit Google and Apple login wallets; users should stop sending funds and move unstaked funds.","tags":["exploited","crypto","web"]},{"id":"https://vulnpocalypse.dev/advisories/nikke-pc-launcher-supply-chain-attack-pushed-a-remote-access-backdoor-and-wallet/","title":"NIKKE PC launcher supply-chain attack pushed a remote-access backdoor and wallet stealer via CDN scripts","url":"https://vulnpocalypse.dev/advisories/nikke-pc-launcher-supply-chain-attack-pushed-a-remote-access-backdoor-and-wallet/","date":"2026-11-09","summary":"Tampered NIKKE PC launcher scripts on the official CDN delivered a remote-access backdoor; Windows players should check their PCs and rotate credentials.","tags":["supply-chain","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/","title":"GitBook breach: SSO flaw led to infrastructure access, API tokens revoked","url":"https://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/","date":"2026-11-09","summary":"GitBook disclosed a November 2026 breach that exposed API tokens and integration secrets; create new GitBook API tokens and rotate connected secrets.","tags":["ai-tools","web","cloud","ai-tools","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/mercado-bitcoin-cyberattack/","title":"Mercado Bitcoin, Brazil's largest crypto exchange, confirms cyberattack as tens of millions drain from the platform","url":"https://vulnpocalypse.dev/advisories/mercado-bitcoin-cyberattack/","date":"2026-11-09","summary":"Brazil's Mercado Bitcoin confirmed a cyberattack; blockchain firms traced $40M\u2013$48.6M drained from customer deposit addresses. Partners froze over $15M.","tags":["breach","crypto","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/cr\u00e9dit-mutuel-ark\u00e9a-confirms-cyberattack-and-fraudulent-transfers-via-a-supplier/","title":"Cr\u00e9dit Mutuel Ark\u00e9a confirms cyberattack and fraudulent transfers via a supplier, with a reported $133M loss","url":"https://vulnpocalypse.dev/advisories/cr\u00e9dit-mutuel-ark\u00e9a-confirms-cyberattack-and-fraudulent-transfers-via-a-supplier/","date":"2026-11-09","summary":"Cr\u00e9dit Mutuel Ark\u00e9a confirmed a sophisticated attack through a service provider that enabled fraudulent transfers, while the reported $133 million loss is","tags":["breach","enterprise","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/","title":"BTCPay Server hot wallets drained on outdated self-hosted instances","url":"https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/","date":"2026-11-09","summary":"Attackers drained hot wallets on internet-exposed BTCPay Server instances running 2.4.1 or older; update to 2.4.7 and move funds to a new wallet.","tags":["exploited","crypto","network-edge","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/","title":"Aoki and Aokigahara infostealers target AI coding assistant credentials","url":"https://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/","date":"2026-11-09","summary":"Infostealers dubbed Aoki and Aokigahara steal AI coding assistant tokens and cloud keys, so rotate them if a developer machine may be infected.","tags":["ai-tools","ai-tools","endpoint","cloud","ci-cd","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/mirax-android-rat-spread-through-streaming-app-ads-hijacks-phones-to-drain-bank/","title":"Mirax Android RAT spread through streaming-app ads hijacks phones to drain bank accounts","url":"https://vulnpocalypse.dev/advisories/mirax-android-rat-spread-through-streaming-app-ads-hijacks-phones-to-drain-bank/","date":"2026-11-06","summary":"Mirax Android banking trojan spreads via streaming-app ads, so refuse Accessibility requests from entertainment apps and skip advertised APKs.","tags":["ecosystem","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/trezor-safe-5-suspected-crypto-theft-implant-found-in-device-sold-by-reseller/","title":"Trezor Safe 5 suspected crypto-theft implant found in device sold by reseller CryptoBilis","url":"https://vulnpocalypse.dev/advisories/trezor-safe-5-suspected-crypto-theft-implant-found-in-device-sold-by-reseller/","date":"2026-11-06","summary":"Trezor reports a suspected implant in a Safe 5 sold by reseller CryptoBilis; buyers since March 2026 should move funds to a new wallet and seed.","tags":["supply-chain","crypto","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/phexia-macos-stealer-spread-via-clickfix-terminal-commands-report-says/","title":"Phexia macOS stealer spread via ClickFix Terminal commands, report says","url":"https://vulnpocalypse.dev/advisories/phexia-macos-stealer-spread-via-clickfix-terminal-commands-report-says/","date":"2026-11-05","summary":"Cyber Security News reports WithSecure findings that Phexia malware tricks Mac users into Terminal commands, so never paste site commands into Terminal.","tags":["ecosystem","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/marsalek-infostealer-hides-in-fake-roblox-fortnite-and-minecraft-game-cheats/","title":"Marsalek infostealer hides in fake Roblox, Fortnite and Minecraft game cheats","url":"https://vulnpocalypse.dev/advisories/marsalek-infostealer-hides-in-fake-roblox-fortnite-and-minecraft-game-cheats/","date":"2026-11-05","summary":"Marsalek infostealer hid in fake Roblox, Fortnite and Minecraft cheats; if you ran one, rotate passwords and sessions from a clean device.","tags":["ecosystem","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","title":"ARTEX Docker image backdoored, researcher says; CERT-In flags Crafty Falcon","url":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","date":"2026-11-05","summary":"A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.","tags":["supply-chain","ai-tools","open-source","cloud","crypto","php","nodejs","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/","title":"Unpatched CryptoPayment Gateway WordPress plugin exploited: unauthenticated attackers can read wallet credentials in cleartext","url":"https://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/","date":"2026-11-04","summary":"CVE-2026-81648, a CVSS 10.0 missing authorization flaw in the CryptoPayment Gateway WordPress plugin, is being exploited and has no fix.","tags":["exploited","php","web","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/older-iphones-bootrom-flaws-risk-crypto-seed-phrases-gbhackers-reports/","title":"Older iPhones BootROM flaws risk crypto seed phrases, GBHackers reports","url":"https://vulnpocalypse.dev/advisories/older-iphones-bootrom-flaws-risk-crypto-seed-phrases-gbhackers-reports/","date":"2026-11-02","summary":"GBHackers reports unpatchable BootROM flaws in older iPhones could expose stored crypto seeds; move funds to a new seed made on trusted hardware.","tags":["exploited","crypto","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/","title":"Hacktober 2026: PHP2Shell, Node.js and LiteLLM fixes, Binance probe","url":"https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/","date":"2026-11-02","summary":"October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.","tags":["ai-tools","php","nodejs","pypi","npm","github-actions","ai-tools","crypto","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/tensorlake-npm-compromise/","title":"tensorlake 0.5.144 on npm carried a Shai-Hulud variant with a wiper, a browser wallet stealer and an Ethereum dead drop","url":"https://vulnpocalypse.dev/advisories/tensorlake-npm-compromise/","date":"2026-11-02","summary":"tensorlake 0.5.144 on npm ran a Shai-Hulud variant at install that steals secrets and wallets and can wipe the host. Isolate before revoking tokens.","tags":["supply-chain","npm","crypto","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/trapdoor-npm-pypi-crates-stealer/","title":"TrapDoor: 34 fake crypto, AI and dev-tool packages on npm, PyPI and crates.io stole wallets and secrets and planted CLAUDE.md and .cursorrules","url":"https://vulnpocalypse.dev/advisories/trapdoor-npm-pypi-crates-stealer/","date":"2026-11-02","summary":"34 lure packages on npm, PyPI and crates.io stole keys, wallets and cloud credentials and planted AI-agent rule files. Check for the names and rotate secrets.","tags":["supply-chain","npm","pypi","open-source","ai-tools","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-reports-north-korean-threat-actors-expanding-ai-use-in-tradecraft/","title":"Microsoft reports North Korean threat actors expanding AI use in tradecraft","url":"https://vulnpocalypse.dev/advisories/microsoft-reports-north-korean-threat-actors-expanding-ai-use-in-tradecraft/","date":"2026-10-29","summary":"Microsoft reports North Korean actors use AI to scale job-themed lures and fake personas, so developers should verify unsolicited recruiter contacts.","tags":["ai-tools","ai-tools","crypto","enterprise","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/amatera-infostealer-spreads-via-clickfix-and-fake-ai-tool-ads-eset-reports/","title":"Amatera infostealer spreads via ClickFix and fake AI tool ads, ESET reports","url":"https://vulnpocalypse.dev/advisories/amatera-infostealer-spreads-via-clickfix-and-fake-ai-tool-ads-eset-reports/","date":"2026-10-29","summary":"ESET reports the Amatera infostealer spreads via ClickFix and fake AI tool ads; never paste web page commands into Run, PowerShell or Terminal.","tags":["ai-tools","endpoint","ai-tools","crypto","web","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/","title":"Bithumb, Daishin Securities and Mirae Asset report hacks in new South Korean financial breach wave","url":"https://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/","date":"2026-10-28","summary":"Bithumb, Daishin Securities and Mirae Asset reported hacking incidents on Oct 28, 2026, with Daishin confirming exposed customer contact data; root cause is","tags":["breach","crypto","enterprise","web","php"]}]}