Stories tagged “Exploit.”
30 stories
An exploit on a third-party adapter built on Aave V3 led to the draining of approximately $305,000 from two Safe multisig wallets, though Aave founder Stani Kulechov confirmed the core Aave V3 protocol remained unaffected.
White hat hackers successfully rescued 52.37 Bitcoin from wallets exposed by a Coldcard vulnerability, transferring the funds to a Wyoming-based Crypto Recovery Trust for victims.
CISA has added a maximum-severity pre-authentication remote code execution (RCE) flaw in N-able N-central (CVE-2026-86218) to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it by September 11, 2026, due to active exploitation.
A critical vulnerability (CVE-2026-32475) in the Elementor Pro WordPress plugin is being actively exploited to upload webshells and execute arbitrary commands, affecting over 6 million installations. The flaw, patched on August 19, allows attackers to bypass file validati…
The Cronos blockchain, backed by Crypto.com, was entirely halted following an exploit on its largest lending protocol, Tectonic, resulting in an estimated $75 million loss. This drastic measure froze all network positions to contain the attack, though Crypto.com's main ap…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004, a case of remote code execution that allows an …
Coldcard, a Bitcoin hardware wallet maker, released new firmware (5.6.1 or 1.5.1Q) for its Mk4, Mk5, and Q models to address a seed-generation flaw that led to over $100 million in Bitcoin thefts. The update introduces new randomness requirements for seed generation and f…
Microsoft has patched a maximum-severity vulnerability in the Entra ID identity and access management (IAM) platform that has been exploited in attacks. The flaw, tracked as CVE-2026-69836, allowed threat actors with no privileges to gain code execution in low-complexity …
Coinkite has released firmware updates for Coldcard hardware wallets, requiring user-supplied entropy to strengthen seed phrase generation after an exploit led to $112 million in Bitcoin losses. Users must generate new seed phrases to secure their funds.
Harmony plans to roll back its blockchain to Aug. 11 following an exploit that created forged ONE tokens, discarding more than 109,000 transactions confirmed after its chosen checkpoint.
Bitcoin thefts from Coldcard hardware wallets are slowing but total losses continue to rise, with Galaxy Research confirming over 1,778 BTC ($112 million) stolen and suspecting a higher total of 2,417 BTC.
Security researchers have disclosed new 'Plug and Pwn' attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges.
A $100 million Coldcard hardware wallet exploit, caused by a five-year-old firmware flaw, has prompted Bitcoin holders to re-evaluate and strengthen their self-custody security, moving towards collaborative multisig solutions.
Air-gapped wallets protect private keys from online attacks, but the Coldcard exploit shows they're not immune to threats. Over $114 million in user losses highlights the importance of offline security.
A solo miner scored a major win even as the broader market frets over a multimillion-dollar Coldcard hardware wallet exploit. The miner successfully packaged block 960,804 early Monday, earning a block reward of 3.157 BTC valued at approximately $199,300.
A fourth wave of attacks targeting Bitcoin held in Coldcard-generated addresses is ongoing, with an estimated 1,816 BTC (around $114 million) moved from over 5,200 addresses since July 30. Unlike previous waves, these transactions use replace-by-fee, offering victims a ch…
The Coldcard exploit is ongoing, with Galaxy Research now tracking about $88.6 million stolen across 4,585 addresses in three waves. The breach has spurred an unusual reversal of the 'not your keys, not your coins' ethos as users move Bitcoin back to exchanges.
Binance founder Changpeng 'CZ' Zhao is warning crypto owners not to place blind faith in hardware wallets, following an exploit that drained tens of millions of dollars in Bitcoin from users. The exploit, which occurred due to a firmware build error in a March 2021 Coldca…
vBulletin has fixed a critical pre-auth RCE flaw in its forum software, tracked as CVE-2026-61511, which affects versions 5.x and 6.x up to 5.7.5 and 6.2.1. The flaw allows unauthenticated attackers to execute arbitrary PHP code through template rendering.
A critical command injection vulnerability (CVE-2026-16812) in on-premises Arista VeloCloud Orchestrator (VCO) is under active exploitation, allowing remote code execution and potential system compromise. Arista has released patches and provided indicators of compromise.
A proof-of-concept exploit for the Certighost vulnerability in Windows Active Directory Certificate Services has been released, allowing attackers to potentially compromise a Windows domain. The vulnerability was fixed by Microsoft as part of the July 2026 Patch Tuesday s…
Garden Finance temporarily took its app offline after blockchain security firm Blockaid reported an exploit targeting the protocol's hash time-locked contracts (HTLC) across four blockchain networks.
A security researcher has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. The exploit is build-specific to GitLab 18.11.3 on x86-64 and affects broader releases.
Magnet Forensics is suing Paradigm Shift Technology over its publication of usbliter8, an unpatchable Apple chip exploit. The company claims the exploit was developed using stolen trade secrets from a former engineer.
Balance Coin, an algorithmic stablecoin, has fallen more than 99% following a reported exploit. The stablecoin is currently trading at $0.001358, down from $0.9954.
Hackers are exploiting the wp2shell critical vulnerability suite affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.
Allbridge Core, a cross-chain stablecoin bridge, has paused its protocol after a security incident that resulted in a $1.65 million exploit. The attacker allegedly used a flash loan and rapid swaps to manipulate the bridge's stablecoin exchange rate.
WordPress Core has been hit with critical 'wp2shell' remote code execution vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137. Public exploits have been released, making it essential for administrators to patch their sites immediately.
A security researcher has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date Windows systems. The exploit abuses a security vulnerability in the Windows User Profile Service, which has yet to receive a CVE ID f…
A hacker exploited Ostium's price-feed automation system, submitting oracle reports with manipulated future timestamps to make losing trades appear profitable, triggering an $18 million USDC payout from the protocol's vault.