BlockThreat - Week 37, 2026
$11.6M stolen across 23 incidents. Mass phishing campaign targeting Trezor, BitBox, CoinTracking, and other projects.
Multiple data leaks this week. Customers of Trezor, BitBox, CoinTracking and other crypto projects were hit with phishing emails inviting them to download a fix for a "Critical Security Alert: STM32 Entropy Vulnerability". The common thread was Brevo, the email marketing platform, which had 138 of its accounts breached. Things are even wilder with Revolut, which simply handed over full customer details to a malicious actor posing as law enforcement. Embarrassing!
A reminder to consider all 3rd party dependencies including marketing platforms in your threat models and may be stop using platforms with multiple breaches.
In other news, Osmosis recently discovered that it was hacked again for more than two months ago for $3M. Oh and be sure to read the excellent article by Kudelski Group on various DPRK threat actors and their tactics.
Let’s dive into the news!
News
- Osmosis took 74 days to discover 40-BTC Nomic exploit.
- Revolut gave away customers' data.
- Crypto customers targeted by scammers after email marketing provider breach. Brevo compromise resulted in phishing emails sent to Trezor, CoinTracking, BitBox, and other customers.
- Audited DeFi protocols lost $885M to attacks that occurred completely outside their audit scopes.
- The current uncomfortable state of Bitcoin Security by KVAZAR.
- Coinmint CEO accused of misappropriating 448 BTC in lawsuit.
News - Web2
- AI Burnout Hits the People Charged With Defending Hospitals and Banks From Hackers. Crypto industry is not the only one suffering.
- We found another cyberattack by internal OpenAI agents, this time targetting @rubygems by Thomas Larsen.
- We're publishing our most detailed threat intelligence report to date by Anthropic.
Crime - DPRK
- Beyond Lazarus: Organization of DPRK Cyber Capabilities by Kudelski. Thread version by tanuki42.
- Contagious Interview steps outside the developer workflow by Jamf.
Crime - Arrests and Seizures
- Organized Crime Network Investigation: Public Groups Offering Mixing, Cross-Chain Transfers and Transaction-Link Severance by Bitrace.
- U.S. OFAC and DOJ Join Forces to Crack Down on Xinbi Guarantee, Restricting More Than $52 Million in Crypto Assets by SlowMist.
- Adam Iza sentenced to 15 years in kidnapping plot tied to Bitcoin theft.
- Malone Lam Faces Plea Hearing Over $245M Bitcoin Theft.
- Mexican authorities raid hidden crypto mine, suspecting power theft and money laundering.
Scams
- $LAPTOP crashed 99% after launch by GoPlus Security.
Media
Vulnerabilities
- Wallet Ranking Update: Address Poisoning and AI-Assisted Reviews by Coinspect.
- The Wasabi team failed to acknowledge the vulnerability in the release notes and did not publish an advisory by floppy.md.
- Signature overflow attacks on Ledger by Bitfinding.
- Important: Update your Alby Hub. Another critical vulnerability in Bitcoin ecosystem.
Research - Bug Hunting
- Sectioned AI-assisted audit workflow centered on value flow and invariants by Arsen.
- Smart Contract Fuzzing Case Study: Balancer Precision Rounding Vulnerability by ACai.
Research - EVM
- How a $7,000 Wrong-Chain Transfer Became an Official Safe Factory by Officer's Notes.
Research - Bitcoin
- How to hack a Bitcoin light client? by Arsen. Three merkle proofs verify the structure. The fourth check is a substring search on a field the miner fills in by hand.
Research - AI
- The Year Finding and Exploiting Bugs Became Cheap, and What to Do About It by Stefanos Chaliasos (ZK Security).
- 26 LLM routers are secretly injecting malicious tool calls and stealing creds by Chaofan Shou.
- Hot Takes on Smart Contract Security & AI. by BengalCatBalu.
- Jenny was a Friend of Mine - MCPs and Friends by Andy Gill (Zsec).
- Harnessing Harnesses - Climbing the LLM Hills by Andy Gill (Zsec).
Whitepapers
- On Identifying Sound Conditions for Frontrunning Resistance.
- Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!.
- Meme Coin Factories: Uncovering Large-Scale Manipulations on pump.fun.
- DAO to (Anonymous) DAO Transactions.
Tools
- ultrafuzz by Monad. End-to-end agentic smart contract fuzzing and threat hunting. Today we are open sourcing Ultrafuzz, an agentic smart-contract fuzzing and threat-hunting orchestrator by Antonio Viggiano.
- Learn Rust Attack Vectors by Ivan Fitro. A hands-on catalog of Rust web3 vulnerability patterns, built for a Solidity auditor learning the Rust attack surface.
- web3-vulnerability-database just got better! by Antonio Viggiano.
- I’m excited to officially release Forge Proposal Simulator v1.0.0! by Ξlliot. FPS is a Foundry framework for building, simulating, validating, and reviewing governance proposals before they go onchain.
Hacks
Detailed indicators of compromise including exploit transactions, attacker addresses, exploit PoCs are available upon request.
MiniRouter2 Compromise
Date: September 7, 2026
Attack Vector: Arbitrary External Calls
Impact: $30,000
Chain: Robinhood
https://x.com/DefimonAlerts/status/2097823842269897018
Unkn_a331fd Compromise
Date: September 7, 2026
Attack Vector: Insufficient Function Access Control
Impact: $46,070
Chain: BSC
https://x.com/exvulsec/status/2097004102240842230
ICON Compromise
Date: September 8, 2026
Attack Vector: Transaction Replay
Impact: $408,000
Chain: ICON, Sonic
https://www.icon.foundation/blog/2026/icon-network-replay-exploit-post-mortem
Amnext Compromise
Date: September 8, 2026
Attack Vector: Reward Manipulation
Impact: $116,100
Chain: BSC
https://x.com/TenArmorAlert/status/2097506987554808212
Enso Compromise
Date: September 8, 2026
Attack Vector: Incorrect Price Oracle
Chain: Ethereum
https://x.com/SlowMist_Team/status/2097602957311455640
Unkn_fcf3d9 Compromise
Date: September 8, 2026
Attack Vector: Insufficient Function Access Control
Chain: Ethereum
https://x.com/SlowMist_Team/status/2097511755220242515
Zentra Finance Compromise
Date: September 9, 2026
Attack Vector: Reward Manipulation
Impact: $143,000
Chain: Citrea
https://x.com/ZentraFinance/status/2098415552293195831
Dominion Compromise
Date: September 10, 2026
Attack Vector: Multisig Hijacking
Impact: $200,000
Chain: Solana
https://x.com/sunrise/status/2098262276201648592
OMNI404 Compromise
Date: September 10, 2026
Attack Vector: Incorrect Reward Calculation
Impact: $5,923
Chain: Ethereum
https://x.com/SlowMist_Team/status/2098300936720695573
Unifi Compromise
Date: September 10, 2026
Attack Vector: Function Parameter Validation
Impact: $4,100
Chain: BSC
https://x.com/exvulsec/status/2097995560154509770
Brevo Compromise
Date: September 10, 2026
Attack Vector: Unknown
Chain: Ethereum
https://x.com/brevo_official/status/2098013044227915777
Symbiosis Compromise
Date: September 11, 2026
Attack Vector: Signature Verification
Impact: $336,000
Chain: Ethereum, BSC, Bitcoin
https://x.com/blockaid_/status/2098275381417513149
T0 Trade Compromise
Date: September 11, 2026
Attack Vector: Incorrect Price Oracle
Chain: Base
https://x.com/DefimonAlerts/status/2098792733011816766
Edgeless Network Compromise
Date: September 11, 2026
Attack Vector: Governance
Chain: Arbitrum
https://x.com/DefimonAlerts/status/2098643882267304049
GDC Compromise
Date: September 11, 2026
Attack Vector: Reward Manipulation
Chain: Ethereum
https://x.com/exvulsec/status/2098391015954809048
BeatSwap Compromise
Date: September 11, 2026
Attack Vector: Price Oracle Manipulation
Impact: $77,512
Chain: BSC
https://x.com/SlowMist_Team/status/2098314846765015062
ORB Compromise
Date: September 11, 2026
Attack Vector: Reentrancy
Impact: $32,611
Chain: Ethereum
https://x.com/SlowMist_Team/status/2098662550019694645
EtherFi Compromise 2
Date: September 11, 2026
Attack Vector: Insufficient Function Access Control
Impact: $38,000
Chain: Ethereum
https://x.com/SlowMist_Team/status/2098344499923784048
Proton Swaps Compromise
Date: September 12, 2026
Attack Vector: Function Parameter Validation
Impact: $9,000,000
Chain: XPR Network
https://x.com/madblocksbp/status/2098865517696078182
Arcane Privacy Compromise
Date: September 12, 2026
Attack Vector: Malicious Insider
Impact: $500,000
Chain: Solana
https://x.com/ArcanePrivacy/status/2098404749712171387
Ampleforth Compromise
Date: September 12, 2026
Attack Vector: Governance
Chain: Ethereum
https://x.com/DefimonAlerts/status/2098990897924821329
Revolut Compromise
Date: September 12, 2026
Attack Vector: Social Engineering
Chain: Ethereum
https://www.internationalcyberdigest.com/revolut-gave-away-customers-data/
Chainflip Compromise
Date: September 13, 2026
Attack Vector: Logic Error
Impact: $736,442
Chain: Tron