https://vulnpocalypse.dev/feeds/Exchange, wallet and DeFi incidents: signing-infrastructure compromise, key theft, smart contract bugs and laundering.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/cyber-security-news-reports-fatf-traced-100-million-to-scam-crypto-wallets/https://vulnpocalypse.dev/advisories/cyber-security-news-reports-fatf-traced-100-million-to-scam-crypto-wallets/Thu, 12 Nov 2026 12:00:00 +0000Cyber Security News says a FATF report traced over $100 million to one crypto wallet cluster; no IoCs, so report fast on suspected scams.ecosystemcryptohttps://vulnpocalypse.dev/advisories/bleepingcomputer-reports-ex-fbi-agent-pleaded-guilty-to-25m-crypto-theft/https://vulnpocalypse.dev/advisories/bleepingcomputer-reports-ex-fbi-agent-pleaded-guilty-to-25m-crypto-theft/Thu, 12 Nov 2026 12:00:00 +0000BleepingComputer reports a former FBI agent pleaded guilty to taking about $2.5M in crypto from wallets in FBI cases, no patch or fix is involved.breachcryptohttps://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/https://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/Thu, 12 Nov 2026 12:00:00 +0000An incident at analytics vendor Amplitude exposed contact and some transaction data of Coinbase customers. Coinbase says its systems and funds were not hit.breachcryptoenterprisehttps://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/Wed, 11 Nov 2026 12:00:00 +0000Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.supply-chainnpmnodejsgithub-actionscryptoopen-sourcehttps://vulnpocalypse.dev/advisories/binance-denies-breach-after-actor-using-shinyhunters-handle-claims-data-sale/https://vulnpocalypse.dev/advisories/binance-denies-breach-after-actor-using-shinyhunters-handle-claims-data-sale/Wed, 11 Nov 2026 12:00:00 +0000BleepingComputer reports an actor claims Binance user data is for sale; Binance denies a breach. Never share seed phrases or 2FA codes.breachcryptohttps://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/Wed, 11 Nov 2026 12:00:00 +0000Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.supply-chainopen-sourceendpointcryptohttps://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/Wed, 11 Nov 2026 12:00:00 +0000Seqrite reports Armorsteal, a Python kit that steals data and mines crypto on Windows; check for its scheduled tasks and Defender exclusions.ecosystemendpointcryptohttps://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/Wed, 11 Nov 2026 12:00:00 +0000Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.ecosystemendpointcryptowebhttps://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/Wed, 11 Nov 2026 12:00:00 +0000Chainstack says an attacker accessed part of its production systems and customer data; rotate node credentials, API keys and passwords.breachcryptocloudhttps://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/Wed, 11 Nov 2026 12:00:00 +0000Hackread reports a fake GitHub Solana starter kit tells AI agents to install NetSupport RAT; review commands before agents run them.supply-chainai-toolsopen-sourcecryptoendpointhttps://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/https://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/Wed, 11 Nov 2026 12:00:00 +0000A DebugBear monitoring script on Polymarket.com was swapped for wallet-draining code on October 29, costing traders about 2.7 million dollars.supply-chainwebcryptohttps://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/https://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/Wed, 11 Nov 2026 12:00:00 +0000Chainalysis says an attacker using offensive agentic techniques accessed customer user IDs, names, emails and role labels, but not investigation content orai-toolsai-toolscryptoenterprisehttps://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/Wed, 11 Nov 2026 12:00:00 +0000On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.breachcryptocloudci-cdhttps://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/Wed, 11 Nov 2026 12:00:00 +0000Symantec reports an AI attack agent built to hijack unauthenticated OpenAI-style endpoints, so require authentication on any model endpoint you expose.ai-toolsai-toolswebnextjscloudcryptohttps://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/Wed, 11 Nov 2026 12:00:00 +0000CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.ai-toolsai-toolsenterprisecloudwebcryptohttps://vulnpocalypse.dev/advisories/binance-says-ios-flaw-worse-query-could-expose-crypto-wallet-secrets/https://vulnpocalypse.dev/advisories/binance-says-ios-flaw-worse-query-could-expose-crypto-wallet-secrets/Tue, 10 Nov 2026 12:00:00 +0000Binance says iOS flaw worse_query may let malicious apps read other apps' files, including seed phrases; update iOS and remove untrusted apps.exploitedendpointcryptohttps://vulnpocalypse.dev/advisories/ukraine-cyber-police-says-it-dismantled-crypto-scam-call-centers/https://vulnpocalypse.dev/advisories/ukraine-cyber-police-says-it-dismantled-crypto-scam-call-centers/Mon, 09 Nov 2026 12:00:00 +0000Ukraine's Cyber Police says it detained four suspects in a crypto investment scam network; be wary of unsolicited investment offers.breachcryptohttps://vulnpocalypse.dev/advisories/keplr-and-web3auth-say-web3auth-flaw-hit-google-and-apple-login-wallets/https://vulnpocalypse.dev/advisories/keplr-and-web3auth-say-web3auth-flaw-hit-google-and-apple-login-wallets/Mon, 09 Nov 2026 12:00:00 +0000Keplr and Web3Auth say a Web3Auth flaw hit Google and Apple login wallets; users should stop sending funds and move unstaked funds.exploitedcryptowebhttps://vulnpocalypse.dev/advisories/nikke-pc-launcher-supply-chain-attack-pushed-a-remote-access-backdoor-and-wallet/https://vulnpocalypse.dev/advisories/nikke-pc-launcher-supply-chain-attack-pushed-a-remote-access-backdoor-and-wallet/Mon, 09 Nov 2026 12:00:00 +0000Tampered NIKKE PC launcher scripts on the official CDN delivered a remote-access backdoor; Windows players should check their PCs and rotate credentials.supply-chainendpointcryptohttps://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/https://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/Mon, 09 Nov 2026 12:00:00 +0000GitBook disclosed a November 2026 breach that exposed API tokens and integration secrets; create new GitBook API tokens and rotate connected secrets.ai-toolswebcloudai-toolscryptohttps://vulnpocalypse.dev/advisories/mercado-bitcoin-cyberattack/https://vulnpocalypse.dev/advisories/mercado-bitcoin-cyberattack/Mon, 09 Nov 2026 12:00:00 +0000Brazil's Mercado Bitcoin confirmed a cyberattack; blockchain firms traced $40M–$48.6M drained from customer deposit addresses. Partners froze over $15M.breachcryptoenterprisehttps://vulnpocalypse.dev/advisories/crédit-mutuel-arkéa-confirms-cyberattack-and-fraudulent-transfers-via-a-supplier/https://vulnpocalypse.dev/advisories/crédit-mutuel-arkéa-confirms-cyberattack-and-fraudulent-transfers-via-a-supplier/Mon, 09 Nov 2026 12:00:00 +0000Crédit Mutuel Arkéa confirmed a sophisticated attack through a service provider that enabled fraudulent transfers, while the reported $133 million loss isbreachenterprisecryptohttps://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/Mon, 09 Nov 2026 12:00:00 +0000Attackers drained hot wallets on internet-exposed BTCPay Server instances running 2.4.1 or older; update to 2.4.7 and move funds to a new wallet.exploitedcryptonetwork-edgeopen-sourcehttps://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/https://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/Mon, 09 Nov 2026 12:00:00 +0000Infostealers dubbed Aoki and Aokigahara steal AI coding assistant tokens and cloud keys, so rotate them if a developer machine may be infected.ai-toolsai-toolsendpointcloudci-cdcryptohttps://vulnpocalypse.dev/advisories/mirax-android-rat-spread-through-streaming-app-ads-hijacks-phones-to-drain-bank/https://vulnpocalypse.dev/advisories/mirax-android-rat-spread-through-streaming-app-ads-hijacks-phones-to-drain-bank/Fri, 06 Nov 2026 12:00:00 +0000Mirax Android banking trojan spreads via streaming-app ads, so refuse Accessibility requests from entertainment apps and skip advertised APKs.ecosystemendpointcryptohttps://vulnpocalypse.dev/advisories/trezor-safe-5-suspected-crypto-theft-implant-found-in-device-sold-by-reseller/https://vulnpocalypse.dev/advisories/trezor-safe-5-suspected-crypto-theft-implant-found-in-device-sold-by-reseller/Fri, 06 Nov 2026 12:00:00 +0000Trezor reports a suspected implant in a Safe 5 sold by reseller CryptoBilis; buyers since March 2026 should move funds to a new wallet and seed.supply-chaincryptoendpointhttps://vulnpocalypse.dev/advisories/phexia-macos-stealer-spread-via-clickfix-terminal-commands-report-says/https://vulnpocalypse.dev/advisories/phexia-macos-stealer-spread-via-clickfix-terminal-commands-report-says/Thu, 05 Nov 2026 12:00:00 +0000Cyber Security News reports WithSecure findings that Phexia malware tricks Mac users into Terminal commands, so never paste site commands into Terminal.ecosystemendpointcryptohttps://vulnpocalypse.dev/advisories/marsalek-infostealer-hides-in-fake-roblox-fortnite-and-minecraft-game-cheats/https://vulnpocalypse.dev/advisories/marsalek-infostealer-hides-in-fake-roblox-fortnite-and-minecraft-game-cheats/Thu, 05 Nov 2026 12:00:00 +0000Marsalek infostealer hid in fake Roblox, Fortnite and Minecraft cheats; if you ran one, rotate passwords and sessions from a clean device.ecosystemendpointcryptohttps://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/Thu, 05 Nov 2026 12:00:00 +0000A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.supply-chainai-toolsopen-sourcecloudcryptophpnodejsci-cdhttps://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/https://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/Wed, 04 Nov 2026 12:00:00 +0000CVE-2026-81648, a CVSS 10.0 missing authorization flaw in the CryptoPayment Gateway WordPress plugin, is being exploited and has no fix.exploitedphpwebcryptohttps://vulnpocalypse.dev/advisories/older-iphones-bootrom-flaws-risk-crypto-seed-phrases-gbhackers-reports/https://vulnpocalypse.dev/advisories/older-iphones-bootrom-flaws-risk-crypto-seed-phrases-gbhackers-reports/Mon, 02 Nov 2026 12:00:00 +0000GBHackers reports unpatchable BootROM flaws in older iPhones could expose stored crypto seeds; move funds to a new seed made on trusted hardware.exploitedcryptoendpointhttps://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/Mon, 02 Nov 2026 12:00:00 +0000October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.ai-toolsphpnodejspypinpmgithub-actionsai-toolscryptocloudhttps://vulnpocalypse.dev/advisories/tensorlake-npm-compromise/https://vulnpocalypse.dev/advisories/tensorlake-npm-compromise/Mon, 02 Nov 2026 12:00:00 +0000tensorlake 0.5.144 on npm ran a Shai-Hulud variant at install that steals secrets and wallets and can wipe the host. Isolate before revoking tokens.supply-chainnpmcryptoai-toolshttps://vulnpocalypse.dev/advisories/trapdoor-npm-pypi-crates-stealer/https://vulnpocalypse.dev/advisories/trapdoor-npm-pypi-crates-stealer/Mon, 02 Nov 2026 12:00:00 +000034 lure packages on npm, PyPI and crates.io stole keys, wallets and cloud credentials and planted AI-agent rule files. Check for the names and rotate secrets.supply-chainnpmpypiopen-sourceai-toolscryptohttps://vulnpocalypse.dev/advisories/microsoft-reports-north-korean-threat-actors-expanding-ai-use-in-tradecraft/https://vulnpocalypse.dev/advisories/microsoft-reports-north-korean-threat-actors-expanding-ai-use-in-tradecraft/Thu, 29 Oct 2026 12:00:00 +0000Microsoft reports North Korean actors use AI to scale job-themed lures and fake personas, so developers should verify unsolicited recruiter contacts.ai-toolsai-toolscryptoenterpriseopen-sourcehttps://vulnpocalypse.dev/advisories/amatera-infostealer-spreads-via-clickfix-and-fake-ai-tool-ads-eset-reports/https://vulnpocalypse.dev/advisories/amatera-infostealer-spreads-via-clickfix-and-fake-ai-tool-ads-eset-reports/Thu, 29 Oct 2026 12:00:00 +0000ESET reports the Amatera infostealer spreads via ClickFix and fake AI tool ads; never paste web page commands into Run, PowerShell or Terminal.ai-toolsendpointai-toolscryptowebcloudhttps://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/https://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/Wed, 28 Oct 2026 12:00:00 +0000Bithumb, Daishin Securities and Mirae Asset reported hacking incidents on Oct 28, 2026, with Daishin confirming exposed customer contact data; root cause isbreachcryptoenterprisewebphp