Menu

blockchain security

NEAR Intents loses $3.8 million to smart contract exploit

NEAR Intents loses $3.8 million to smart contract exploit

, , , , , , ,

NEAR Intents, a cross-chain trading platform linked to the NEAR Protocol blockchain, lost about $3.8 million to a smart contract exploit on Thursday (October 1), forcing it to pause deposits and withdrawals across eleven networks. The breach adds to a string of major 2024 crypto hacks that includes a $350 million exploit at Bitget just last week, according to DefiLlama data.

  • NEAR Intents paused deposits and withdrawals on eleven networks, including BNB Smart Chain, Polygon and Optimism.
  • The platform has processed more than $30 billion in volume across 35 blockchains since launch, per its website.
  • Investigator ZachXBT said the stolen funds moved through KuCoin and were converted into bitcoin.
  • $3.8M Funds lost in the NEAR Intents Omni system exploit
  • $30B Total trading volume NEAR Intents has processed across 35 chains
  • $350M Bitget exploit last week, nearly 100 times the NEAR Intents loss
  • 6% NEAR token’s 24-hour price drop after the exploit was disclosed

NEAR Intents, a cross-chain trading platform associated with the NEAR Protocol blockchain, suffered a security exploit on Thursday (October 1) that resulted in roughly $3.8 million in losses, according to reporting by CoinDesk. The platform paused services and temporarily disabled deposits and withdrawals on several blockchains while it investigated the breach. NEAR Intents said the vulnerability has since been patched and pledged to reimburse affected users in full.

$3.8 million exploit traced to a bug in NEAR Intents’ Omni system

NEAR Intents attributed the exploit to a flaw in how its Omni deposit and withdrawal system interacted with its smart contract. The project said in a post on X that the contract-side vulnerability has been patched and that all affected funds will be reimbursed in full.

NEAR Intents reported the incident to law enforcement. It is also working with security and blockchain analytics firms to trace the stolen funds.

A $350 million Bitget breach last week extends crypto’s rough quarter

The NEAR Intents exploit follows a string of larger incidents this year. Exchange Bitget was hit with an exploit resulting in more than $350 million in stolen assets just last week, while Liquid Network, Drift and Kelp each lost roughly $320 million, $295 million and $293 million respectively, according to DefiLlama tracking.

NEAR Intents itself is designed to simplify cross-chain trading. Rather than choosing a bridge, exchange or route manually, users specify the swap they want, and independent market makers known as solvers compete to complete it. The platform’s website states it has processed more than $30 billion in volume across 35 blockchains since launch, a figure that dwarfs Thursday’s $3.8 million loss.

NEAR token falls 6% as investigators trace funds to KuCoin

NEAR, the native token closely associated with NEAR Intents, fell about 6% over the 24 hours following the disclosure, trading near $4.8451.

The disclosed vulnerability involved NEAR Intents’ cross-chain infrastructure rather than the underlying NEAR Protocol blockchain itself.

Blockchain investigator ZachXBT said the exploit began with irregular withdrawals from a BNB Chain hot wallet linked to NEAR Intents. He said the stolen funds were then sent to crypto exchange KuCoin and bridged into bitcoin, which traded at $84,012.80 at the time of writing.

NEAR Intents’ status page showed deposits and withdrawals still unavailable on BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar, Monad, X Layer, ADI, Scroll and Plasma, even as core services were expected to resume quickly.

The BlockWest read. The real test here is not the $3.8 million loss but whether NEAR Intents’ full-reimbursement pledge holds up once security firms finish tracing funds routed through KuCoin. Solver-based cross-chain routing is pitched to institutions as a way to avoid manual bridge risk, but this incident shows the smart contract layer itself remains a single point of failure. Allocators weighing intents-based infrastructure against traditional bridges should watch whether the reimbursement is completed in full and how fast remaining chains reopen.

NEAR Intents has not published a timeline for restoring deposits and withdrawals on the eleven affected networks, and the security firms tracing the KuCoin-routed funds have not yet disclosed findings beyond ZachXBT’s initial account. Whether the pledged full reimbursement is completed, and whether law enforcement recovers any of the bitcoin-converted funds, remains the open question for the platform’s users.

Cosmos Hub validators lock 1.23 million stolen ATOM pending governance vote

Cosmos Hub validators lock 1.23 million stolen ATOM pending governance vote

, , , , , ,

Cosmos Hub validators moved fast to trap a portion of ATOM stolen in a Sept. 22 governance attack on Neutron, but locking the tokens up did not settle who gets them back. Six named validators now hold the recovered funds in a multisig and say they will not move them until Hub token holders pass a separate governance proposal authorizing a distribution.

  • Hub validators intercepted 1,227,121.37 ATOM of the roughly 1.73 million ATOM the attacker moved from Neutron.
  • Validators representing more than 67% of Hub voting power installed the emergency patch before the Sept. 23 restart.
  • A separate 168,990.9 ATOM slipped through after the restart via a pending THORChain refund and was sold on Osmosis.
  • 1.23M ATOM secured by Hub validators against 1.73M ATOM stolen from Neutron
  • 67% of Hub voting power backed the patch ahead of the Sept. 23 restart
  • 500K ATOM already swapped through THORChain before validators halted the chain
  • 6 named validators hold multisig keys, with four signatures needed to move funds

The attack began on Neutron on Sept. 22, when a governance proposal handed the attacker administrative control over contracts used by Astroport and other protocols, according to a CryptoSlate report. The attacker began swapping and bridging the stolen assets across chains, sending roughly 1.73 million ATOM to the Cosmos Hub. The Hub itself was not exploited; it simply became a chain where part of the stolen balance could still be caught before it moved further.

Validators halted the chain and rewrote one balance to trap the ATOM

As the attacker moved funds, Hub validators halted the network at block height 33,086,740 and agreed to restart on a patched build of the Gaia software, version 28.3.0. At the first block after the halt, the patch executed a one-time state change moving 1,227,121.37 ATOM out of the attacker-linked Hub address and into a recovery multisig, before ordinary transactions resumed.

The scope was narrow by design. According to the Hub’s Sept. 24 update, the binary touched only that single source account and left every other user balance and delegation untouched.

Validators controlling more than 67% of Hub voting power had confirmed installation of the patch before the Sept. 23 restart, according to Cosmos Labs. Blocks resumed at 12:00 UTC and the recovery transfer executed roughly six minutes later, at about 12:06 UTC. The underlying code diff was withheld at the time because publishing it would have exposed security fixes in the prior v28.2.0 release still under a coordinated disclosure embargo; Cosmos Labs said it expected to release the diff once that embargo lifted.

Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu hold the keys but not the mandate

The recovery multisig sits with six named signers: Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. Any four of the six can technically authorize a transaction, but the signers have said they will not use that authority until a Hub signaling proposal formally directs where the funds should go. Cosmos Labs said it holds no key to the wallet itself, separating the emergency technical response from the eventual decision over recipients.

A balance check against the recovery address at 15:40 UTC on Sept. 26 showed 1,227,121.374688 ATOM still sitting untouched in the multisig.

Not all of the stolen ATOM was captured. Cosmos Labs said roughly 500,000 ATOM had already been swapped through THORChain before the halt took effect, and other stolen assets reached networks beyond the Hub entirely. A further 168,990.9 ATOM arrived at the attacker’s Hub address just after the restart, through a pending THORChain refund that the one-time patch could not retroactively sweep up; that batch was moved to Osmosis and sold.

Proposal 1056 is in voting but does not authorize this multisig

A check of the Hub’s governance queue at the same Sept. 26 timestamp found no passed mandate covering the recovery multisig among recent entries, according to the on-chain proposal list. The most recent item, Proposal 1057, concerned recovery of a Realio IBC light client and is unrelated. Proposal 1056, titled “ATOM Refund & Justice Bounty,” was still open for voting but sought a different refund and bounty structure and does not authorize the Neutron response team’s planned distribution from this specific wallet.

The governance requirement the six signers have described therefore remains unmet.

Cosmos Labs said Neutron had relaunched with mitigations in place by Friday (September 25), and that contributors along with affected protocols, including Astroport and Drop, were assembling evidence of losses to support a distribution plan. The response team was expected to bring or back a Hub proposal in the following week, according to Cosmos Labs’ Sept. 25 account. Whether Neutron’s own governance also holds a vote is a decision left to that network, the Hub account said.

The BlockWest read. The gap here is not technical but institutional: validators proved they can freeze a stolen balance within hours, yet six private signers are refusing to disburse it without an on-chain mandate, effectively making governance the real custodian of recovered funds. For any protocol treasury or affiliated fund holding ATOM, the practical takeaway is that emergency chain interventions buy time but do not substitute for the slower work of building consensus on who gets paid.

The open question is whether the Neutron response team’s promised proposal, expected sometime in the week following Sept. 25, will name specific claimants and a distribution schedule the six signers accept as their required mandate, or whether Proposal 1056’s separate refund and bounty framework complicates that vote before it reaches the floor.

Evercrest sues LayerZero Labs over $292M rsETH bridge exploit

Evercrest sues LayerZero Labs over $292M rsETH bridge exploit

, , , , , , ,

Update (Sep 26, 9:05pm): New draft specifies the bridge connected KelpDAO with Unichain, and clarifies LayerZero uses a Decentralized Verifier Network (DVN) structure, details not in published version.

A $292 million exploit on KelpDAO’s rsETH bridge in April has turned into a British Columbia lawsuit that asks a court to decide who bears responsibility when cross-chain infrastructure fails. Customers have already answered that question with their assets, moving roughly $14.5 billion away from LayerZero toward a rival network since the attack.

  • Evercrest Technologies sued LayerZero Labs, its Canadian affiliate, and CEO Bryan Pellegrino in British Columbia.
  • The April 18 exploit drained 116,500 rsETH worth $292 million from Kelp’s cross-chain bridge.
  • Projects tied to roughly $14.5 billion in assets had announced moves to Chainlink’s CCIP by Aug. 4.
  • $292M value of rsETH stolen in the April 18 Kelp bridge exploit
  • $14.5B assets moved toward Chainlink’s CCIP by Aug. 4, nearly 50x the exploit
  • $7.4B WBTC’s share of the Aug. 4 migration, the largest single asset
  • $650M Kelp user withdrawals since the attack, according to the lawsuit

Evercrest Technologies, the company behind KelpDAO, has sued LayerZero Labs, its Canadian affiliate, and CEO Bryan Pellegrino in a British Columbia court, according to CryptoSlate. The claim alleges negligent misrepresentation, negligence and defamation over an April 18 exploit that drained 116,500 rsETH worth $292 million from Kelp’s bridge, and it seeks aggravated and punitive damages. Kelp users have withdrawn more than $650 million since the attack, the lawsuit states.

Pellegrino has called the suit meritless.

Evercrest says LayerZero approved Kelp’s single-verifier setup in writing

On April 18, attackers tricked LayerZero’s verifier into approving a forged cross-chain transfer, letting 116,500 rsETH leave Kelp’s bridge. LayerZero’s own incident report traces the breach to a developer who was socially engineered in March into cloning a malicious GitHub repository, giving attackers access to LayerZero’s RPC environment and letting them poison two internal nodes. That intrusion succeeded because Kelp’s bridge required sign-off from a single party, LayerZero’s own signing service, leaving no independent check on the false data it received.

Evercrest alleges LayerZero reviewed and approved that setup in writing, including telling Kelp in February 2024 there was “no problem” with the default arrangement. The suit further alleges LayerZero warned another developer, USDT0, about risks in default configurations while withholding a comparable warning from Kelp. Those allegations have yet to be tested in court.

LayerZero’s own account places the choice on Kelp, saying the application had previously run a two-of-two setup before moving to one-of-one. Its verifier now refuses to sign on any channel where it is the sole required signer, and the company requires multiple independent RPC sources across providers and geographies. By Aug. 4, default pathways on both versions of its endpoint required a minimum of three verifiers, though applications can still build custom configurations at the protocol level.

Nearly $14.5 billion has left LayerZero for Chainlink’s CCIP since the exploit

By Aug. 4, projects tied to roughly $14.5 billion in assets had announced moves from LayerZero to Chainlink’s CCIP, nearly 50 times the $292 million stolen in April. BitGo accounted for the largest single migration, moving WBTC representing about $7.4 billion of that total and naming CCIP its exclusive cross-chain

EU financial watchdogs warn quantum computers threaten blockchain security

EU financial watchdogs warn quantum computers threaten blockchain security

, , , , ,

European Union financial regulators have warned that advanced quantum computers could eventually crack the cryptography protecting blockchains, with roughly 6.9 million bitcoin worth about $586 billion currently exposed. The warning adds regulatory weight to a debate Bitcoin has long avoided: whether to freeze coins in old, vulnerable wallets before a quantum attack becomes possible.

  • The ESAs’ Joint Committee released its Autumn 2026 Risk and Vulnerabilities report on Wednesday.
  • Roughly 6.9 million bitcoin, worth about $586 billion, sit in wallet types considered vulnerable, according to CryptoQuant data.
  • The European Commission wants member states to begin post-quantum transitions by the end of 2026, with high-risk systems covered by 2030.
  • 6.9M BTC bitcoin holdings regulators flag as quantum-exposed
  • $586B dollar value of that exposed bitcoin supply
  • 4 years IBM’s estimate for commercially viable quantum computing
  • 2030 EU deadline to secure high-risk cryptographic use cases

European financial watchdogs have warned that a sufficiently powerful quantum computer could undermine the cryptography that secures blockchains, and that the danger could arrive before quantum computing has any viable commercial use. The warning comes from the Joint Committee of the European Supervisory Authorities, which groups the European Banking Authority, the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority. It appears in their Autumn 2026 Risk and Vulnerabilities report, released Wednesday, according to reporting by CoinDesk.

“Threats could materialize earlier than any viable commercial application,” the authorities wrote in the report.

6.9 Million Bitcoin Sit Exposed, CryptoQuant Data Shows

According to CryptoQuant figures cited in CoinDesk’s reporting, roughly 6.9 million bitcoin, worth about $586 billion, would be at risk if a quantum computer capable of breaking Bitcoin’s cryptography were built. That figure equals close to a third of Bitcoin’s eventual 21 million coin supply cap, underscoring how much of the network’s value sits in wallet formats regulators consider fragile.

The EU report does not claim such a machine exists today. IBM has previously estimated commercially viable quantum computing could arrive within four years, though the ESAs report itself sets no timeline, saying only that risks could emerge ahead of any practical quantum application.

The gap between those two claims, no working machine yet versus a possible four-year horizon, is the crux of the urgency regulators are trying to convey.

Old Bitcoin Addresses Carry the Real Exposure

Not every dormant bitcoin wallet faces equal risk. Many unspent outputs still hide their public key behind a cryptographic hash, leaving the underlying key concealed unless the coins are spent, which limits exposure for now.

Older pay-to-public-key outputs and reused addresses are different, because their public keys are already visible on the blockchain. A sufficiently powerful quantum computer could use an exposed public key to derive the matching private key and take control of the coins, a risk concentrated in Satoshi-era holdings and addresses that have been reused. The ESAs flagged a related danger they call “harvest now, decrypt later,” in which encrypted data or exposed keys are collected today for decryption once quantum capability catches up.

Brussels Sets a 2026-to-2030 Migration Deadline

The European Commission’s post-quantum cryptography roadmap traces back to an April 2024 Recommendation urging member states to build coordinated national PQC strategies. A NIS Cooperation Group work stream, co-chaired by Germany, France and the Netherlands, translated that into the Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, adopted in June 2025.

That roadmap sets the timeline the ESAs report now echoes for finance specifically: member states should start transitioning to post-quantum cryptography by the end of 2026, with high-risk use cases protected no later than the end of 2030. Between August 11 and September 29, 2025, the NIS Cooperation Group ran a stakeholder survey on the roadmap and has since published an FAQ document covering risk estimation, milestones and hybrid cryptographic schemes, though it leaves unresolved how quickly financial infrastructure specifically, as opposed to general public-sector systems, must comply.

Bitcoin itself has no equivalent deadline. Moving to quantum-resistant signatures would require network-wide consensus among miners and node operators, plus voluntary migration by holders of exposed coins before any attack becomes feasible.

The BlockWest read. The pressure here falls less on Bitcoin’s protocol, which cannot be forced to upgrade on Brussels’ timetable, and more on custodians, exchanges and institutional holders sitting on Satoshi-era or reused-address balances. Expect compliance teams at regulated EU custodians to start auditing address exposure and planning coin migrations well before the 2030 high-risk deadline, regardless of whether Bitcoin’s own governance ever reaches consensus on a network-level fix.

The next concrete marker is the NIS Cooperation Group’s promised second deliverable supplementing the EU’s post-quantum roadmap, which will spell out further detail beyond the 2026 and 2030 milestones already set. Whether Bitcoin’s developer community responds with its own quantum-resistant proposal, or leaves the roughly $586 billion in exposed coins to individual holders to secure, remains an open question the ESAs report does not answer.

S&P Global acquires OpenZeppelin smart contract auditor

S&P Global acquires OpenZeppelin smart contract auditor

, , , , , ,

S&P Global’s acquisition of OpenZeppelin signals a major institutional pivot toward blockchain infrastructure, as the rating agency bets on the security and standardization that underpin trillions in tokenized assets. The deal reflects accelerating adoption of on-chain finance by traditional institutions and regulators moving to enable secondary trading of tokenized securities.

  • OpenZeppelin’s open-source library has facilitated more than $37 trillion in cumulative transferred value across DeFy and traditional finance applications.
  • The firm has completed over 900 security engagements, including a 2021 audit that prevented $15 billion in Convex Finance losses.
  • OpenZeppelin will operate as a standalone unit within S&P Global under CEO Demian Brener, with financial terms undisclosed.
  • $37T Cumulative value transferred via OpenZeppelin Contracts since the library’s creation
  • 900+ Security audits and assessments completed by OpenZeppelin to date
  • $15B Convex Finance deposits protected by OpenZeppelin’s late-2021 vulnerability discovery
  • 2015 Year OpenZeppelin was founded as a blockchain security specialist

According to a press release from S&P Global, the rating and data agency has agreed to purchase OpenZeppelin, the smart contract auditor whose free code library underpins the infrastructure for major stablecoins, tokenized funds, and decentralized finance platforms. CryptoPotato reported the deal, which positions the traditionally finance-focused conglomerate deeper into on-chain asset management as institutional capital accelerates its migration to blockchain networks.

OpenZeppelin’s Library Powers Trillions in On-Chain Value

Founded in 2015, OpenZeppelin has become the de facto standard for secure smart contract development across both decentralized and institutional finance. The firm’s open-source Contracts library, which provides audited token and contract templates, sits beneath the vast majority of the world’s largest stablecoins and tokenized investment funds. Over its operational history, the library has facilitated more than $37 trillion in cumulative value transferred through contracts built on its codebase.

The firm’s security practice extends beyond its freely available library to paid advisory engagements with protocols and institutions seeking custom risk assessments. In a 2021 audit of Convex Finance, an OpenZeppelin team uncovered a critical vulnerability that would have exposed $15 billion in user deposits to loss. That engagement exemplifies the firm’s role as a trusted gatekeeper in an ecosystem where code flaws can result in catastrophic financial damage.

S&P Global Integrates Blockchain Expertise Into its Risk Assessment Division

OpenZeppelin will continue operating under its own name as a standalone unit within S&P Global, with existing CEO Demian Brener maintaining leadership and reporting to Yann Le Pallec, President of S&P Global Ratings. S&P Global disclosed no financial terms and stated the acquisition would not materially impact its financial results, suggesting a relatively modest valuation by conglomerate standards.

The move extends S&P Global’s existing cryptocurrency capabilities, which include a suite of digital asset benchmarks launched in 2021 through S&P Dow Jones Indices. That arm publishes indexes tracking more than 240 cryptocurrencies alongside dedicated Bitcoin and Ethereum gauges, with pricing data supplied by Lukka.

Our digital assets strategy centers on bringing trusted data, benchmarks and transparent risk assessment to markets as they move onchain.

Yann Le Pallec, President of S&P Global Ratings

Le Pallec added that OpenZeppelin will strengthen the company’s capacity to assess smart contract and on-chain technology risks for both traditional institutions and DeFi-native firms entering the tokenized asset space.

Tokenization Regulatory Momentum Accelerates on Acquisition Day

The timing of the deal underscores broader institutional momentum toward on-chain finance. On the same day S&P Global announced the acquisition, the U.S. Securities and Exchange Commission opened the door to secondary trading of tokenized U.S. stocks through a temporary innovation exemption. The SEC’s framework requires that smart contracts involved in such trading be publicly auditable and deployed on public, permissionless blockchains, standards that align directly with OpenZeppelin’s existing work.

The regulatory alignment suggests S&P Global is positioning itself ahead of an anticipated wave of institutional tokenization activity.

The BlockWest read. We see this as a validation of OpenZeppelin’s market position rather than a watershed moment for crypto adoption. The deal allows S&P Global to wrap institutional credibility around a firm already powering critical infrastructure, but the undisclosed valuation and non-material financial impact suggest S&P views this as a strategic option on tokenization upside rather than a transformative acquisition. The real question is whether the Ratings division’s involvement accelerates OpenZeppelin’s institutional penetration or waters down its independence.

Watch for OpenZeppelin’s next client wins among traditional financial institutions now backed by S&P Global’s distribution and credibility, particularly as the SEC’s tokenization exemption moves from temporary status toward permanent rules. Demian Brener’s commitment to maintain OpenZeppelin’s independent brand and standards will be tested when S&P Global’s institutional clients demand faster, less conservative audit timelines in pursuit of competitive advantage in tokenized markets.

XRP project closes following security breach that compromised 4,000 accounts and resulted in $450,000 in losses

XRP project closes following security breach that compromised 4,000 accounts and resulted in $450,000 in losses

, , , , ,

A healthcare platform built on XRP Ledger is shutting down after a critical wallet vulnerability drained approximately $450,000 from thousands of user accounts. The incident underscores persistent security risks in decentralized applications and highlights challenges facing blockchain startups even as recovery and investigation efforts continue.

  • XRPH Wallet flaw exposed 4,010 user accounts and resulted in roughly $450,000 in stolen assets between September 3 and 4.
  • The vulnerability reduced the cryptographic keyspace from the intended 2^128 to approximately 2^46, enabling attackers to derive private keys from public information.
  • XRP Healthcare will delist tokens and cease operations while pursuing recovery efforts and coordinating with exchanges, platforms, and authorities.
  • $450,000 Value of stolen assets moved to collector account during the breach
  • 4,010 User wallets classified as victims after the mass sweep attack
  • 2^46 Effective cryptographic keyspace after bug versus intended 2^128
  • Sept. 3 Date the XRPH Wallet incident occurred and funds were drained

XRP Healthcare announced its operational shutdown on September 10, citing the wallet vulnerability alongside existing pressures including prolonged market downturn, elevated development costs, and a failed public-listing attempt. The platform disclosed that a flaw in how its XRPH Wallet application generated user credentials had enabled attackers to systematically drain accounts over a 48-hour window. Analytics service XRPL.to traced 10,281 payments across this period, originating from what the company determined to be 4,010 compromised wallets sending funds to a single collector address.

The incident represents one of the most significant security failures within the XRP Ledger ecosystem and demonstrates how implementation errors in cryptocurrency wallet design can rapidly compromise user funds at scale. Even as blockchain technology matures, wallet security remains a critical vulnerability, particularly for platforms that manage both crypto assets and sensitive personal health information.

How The Wallet Flaw Collapsed Cryptographic Security

XRP Healthcare’s investigation identified the root cause: the application passed a 55-character string into xrpl.Wallet.fromEntropy(), a function designed to accept raw bytes as input. Only the first 16 characters were retained by the system, leaving 39 characters unused and drastically reducing the effective entropy to approximately 72.9 trillion possible combinations, or roughly 2^46, versus the intended 2^128 security level.

The developers also discovered that the wallet generation process relied on Math.random(), a function known to have limited cryptographic strength compared to secure random number generators, potentially reducing the practical search space further. Using only public information and a partial scan of the reduced keyspace, the team successfully reproduced private keys for nine live wallets, including four that had already been drained. This reproduction required no access to user devices or the underlying XRP Ledger protocol itself.

The flaw meant that users could not protect exposed wallets simply by importing the same seed phrase into different software applications.

The vulnerability illustrates a common pitfall in blockchain development: cryptographic security requires precision at every step of key generation and storage. Small oversights in how entropy is passed between functions or how random number generators are selected can cascade into catastrophic failures affecting thousands of users. Security audits and code reviews by external specialists are increasingly viewed as essential for platforms handling user assets.

Stolen Assets Traced To Ethereum Address

The attack resulted in the movement of approximately 267,664 XRP, 23.2 million XRPH tokens, and 2.43 million XRPHAI tokens to the identified collector wallet. XRP Healthcare traced the stolen assets end-to-end to an Ethereum address holding roughly 445,198 DAI, providing a clear on-chain record of the funds’ destination.

The cross-chain movement of funds reflects how attackers often bridge stolen assets across multiple blockchains to obscure the trail and access liquidity on different platforms. Despite the transparency of blockchain ledgers, tracing and recovering funds remains challenging without cooperation from centralized exchange operators and law enforcement agencies equipped to handle cryptocurrency theft investigations.

The company has advised all affected users to abandon any credentials generated through XRPH Wallet and transfer remaining assets using newly created keys generated through secure methods. XRP Healthcare requested that affected users submit detailed factual reports on Etherscan, including transaction records documenting their drained wallets, to support ongoing recovery and investigation efforts.

Platform Delisting And Continued Coordination

XRP Healthcare announced plans to delist its native tokens, XRPH and XRPHAI, from exchanges, with individual platforms expected to establish their own withdrawal deadlines. The XRPH Wallet applications will remain offline, though the company stated it is retaining its intellectual property and global trademark portfolio.

The decision to retain intellectual property suggests the possibility that XRP Healthcare’s technology, once remediated, could be acquired or rebuilt under new ownership. However, the reputational damage from a major security breach typically makes it difficult for platforms to rebuild user trust, even with improved security measures.

Despite ceasing normal operations, the company said recovery efforts will continue in parallel with its wind-down. XRP Healthcare committed to ongoing coordination with exchanges, platforms, law enforcement authorities, and other parties while preserving all technical records and transaction documentation related to the incident.

The company has preserved technical and transaction records connected to the incident and will continue working with law enforcement and platform operators; affected users should monitor their email and official XRP Healthcare channels for exchange-specific withdrawal deadlines and recovery procedures.

Ethereum Foundation Targets December 2029 as Final Date to Address Quantum Computing Threat

Ethereum Foundation Targets December 2029 as Final Date to Address Quantum Computing Threat

, , , , ,

The Ethereum Foundation has set a hard December 2029 deadline for quantum-resistant upgrades across the network’s base layer, treating the target as non-negotiable through at least January 2027. This aggressive timeline matches migration schedules announced independently by Google, Cloudflare, and Microsoft, positioning Ethereum to address cryptographic vulnerabilities before quantum computers pose an existential threat to blockchain security.

  • Ethereum Foundation commits to quantum resistance by December 2029, treating date as fixed deadline rather than research aspiration.
  • Roughly 65% of ETH currently sits in quantum-vulnerable addresses, according to Project Eleven data.
  • Hegotá hard fork will serve as first test of whether the 2029 timeline can be met across execution, consensus, and data layers.
  • Dec 2029 Ethereum Foundation’s non-negotiable deadline for full quantum resistance deployment.
  • 65% Portion of ETH supply currently held in quantum-vulnerable address formats.
  • 7.2 mo Average timeline per hard fork needed to hit December 2029 quantum deadline.

The Ethereum Foundation’s Protocol cluster published its quantum resistance commitment alongside a comprehensive evaluation of 62 proposals for Hegotá, the hard fork scheduled to follow Glamsterdam. The Foundation aims to harden Ethereum’s base layer across execution, consensus, and data layers before quantum computers become capable of breaking the cryptographic schemes that currently secure the network.

The December 2029 target reflects an assessment that Q-day, the point at which quantum computers pose a practical threat to current encryption, could arrive as early as 2030. This timeline is particularly significant because the overwhelming majority of Ethereum’s economic value currently rests in cryptographic protections that quantum computers could potentially compromise, leaving holders of quantum-vulnerable addresses at risk of losing access to their funds.

Planning for Quantum Threats Earlier Than Most Industry Forecasts

The Foundation acknowledged that its 2030 Q-day assumption is deliberately aggressive, front-running most credible expert predictions about quantum computing timelines. Established research institutions and quantum computing firms typically estimate that cryptographically relevant quantum computers remain at least a decade away, making Ethereum’s 2029 target significantly more conservative than industry consensus.

The commitment aligns with parallel migration schedules independently announced by Google, Cloudflare, and Microsoft, each setting similar timelines to transition critical infrastructure away from quantum-vulnerable cryptography. The Protocol cluster will treat the December 2029 deadline as fixed and non-negotiable at minimum through January 2027, when outside quantum computing experts will conduct a formal reassessment of the field’s progress. This staged commitment structure acknowledges uncertainty while maintaining decisive action.

“Planning for Q-day in 2030 is a deliberately aggressive assumption,” the Foundation’s priorities blog states.

Hegotá Becomes The Critical First Step in The 2029 Timeline

The Ethereum Foundation framed the Hegotá hard fork as the deciding factor for whether the full sequence of post-quantum upgrades can ship on schedule. Complete quantum resistance is positioned five hard forks away, meaning the network must average 7.2 months per fork to meet the December 2029 target, a pace the cluster describes as aggressive. Hegotá’s success in shipping key quantum-readiness components will determine feasibility for subsequent upgrades.

Coordinating multiple hard forks at this velocity represents an unprecedented operational challenge for Ethereum’s distributed governance structure. The Foundation’s multi-layer approach distributes quantum-resistance work across execution, consensus, and data layers, but sequencing dependencies between these layers could create bottlenecks that delay subsequent forks.

The Foundation assigned Frame Transactions the highest execution-layer priority, grading it A-tier as the must-ship item that will allow Ethereum to adopt new signature schemes without requiring a hard fork for each transition. A complementary A-tier package comprising EIP-8298 and EIP-8151 will enable accounts to abandon secp256k1 as their master key, moving away from the vulnerable cryptography standard.

EIP-8365, also prioritized, begins the process of retiring validator withdrawal credentials still locked to vulnerable cryptographic schemes. These execution-layer changes represent the technical foundation upon which subsequent consensus and data layer upgrades will depend.

The consensus layer faces different constraints because its cryptography cannot be swapped without a fork, requiring components to await complete design finalization.

Hash-Chain RANDAO for the consensus layer received a B-tier rating, reflecting that while the direction is sound, sequencing places it later in the upgrade roadmap. The Foundation took a cautious approach to execution-layer cryptographic verification, dropping ML-DSA verification precompiles to C tier rather than enshrining a single scheme before a dedicated cryptographic review is completed.

This conservative stance reflects awareness that locking in specific post-quantum algorithms prematurely could create technical debt if the field’s understanding of quantum-resistant cryptography shifts. The cryptographic community continues to evolve its assessment of which algorithms offer the strongest security properties against future quantum attacks, making premature standardization strategically risky.

The January 2027 reassessment point marks the next critical moment for the quantum resistance timeline. At that review, the Foundation and outside experts will evaluate whether quantum computing progress warrants adjusting the December 2029 deadline or whether Hegotá’s outcomes justify confidence in the five-fork acceleration schedule required to meet it.

Aave’s cryptocurrency lending proposal grants emergency powers to halt markets while blocking reversal of those halts

Aave’s cryptocurrency lending proposal grants emergency powers to halt markets while blocking reversal of those halts

, , , ,

Aave’s proposed Risk Steward framework would grant specialized teams emergency powers to freeze markets while blocking their own ability to unfreeze them, introducing a split governance model that trades operational speed for accountability constraints. The vote opens a window into how decentralized lending protocols balance rapid crisis response against the risks of concentrated emergency authority.

  • Risk Stewards would receive no-delay access to four roles controlling protocol parameters on Ethereum and Avalanche immediately upon execution.
  • Emergency powers are one-way only: stewards can freeze or halt assets but cannot unfreeze, unpause, or reactivate them without separate governance approval.
  • Emergency permissions would remain inactive until a future software release, pre-positioning authority to reduce response lag during actual security crises.
  • Sept 3-6 Snapshot vote window for Risk Steward governance proposal on Aave DAO
  • 36-72 hrs Minimum cooldown periods for routine parameter updates by type

Aave DAO is holding a governance vote on a proposal that would restructure how the protocol manages risk and emergency response across Ethereum and Avalanche. The Snapshot vote opened September 3 at 3:46 p.m. UTC and closes September 6 at the same time. If approved, execution would require action from the V4 Security Council before the new roles take effect.

The proposal addresses a persistent challenge in decentralized finance: the tension between governance speed and security. Large lending protocols like Aave face potential threats ranging from smart contract exploits to oracle manipulation, yet traditional governance processes can require days or weeks for approval. Risk Stewards would represent a middle ground, capable of responding within hours while remaining constrained by mechanisms preventing unilateral market reopening.

Risk Stewards Receive Four Compartmentalized Control Roles

The proposal grants Risk Stewards four distinct roles: Hub and Spoke risk-management roles plus Hub and Spoke emergency roles, all operating without execution delays once activated. Rather than concentrating governance power, the redesign splits each V4 instance’s configurator controls into five granular categories: two flag-control roles, a listing role, an emergency role and a risk-management role. Existing domain admins would inherit these new roles to preserve their current operational scope.

This compartmentalization reflects an industry-wide shift toward distributing governance responsibilities across specialized teams. By separating control over different protocol functions, Aave aims to reduce the attack surface and limit damage from any single compromised account. The philosophy mirrors lessons learned from earlier DeFi incidents where centralized authority or unitary admin keys created catastrophic failure modes.

Routine parameter updates governing interest-rate settings, collateral factors, liquidation settings and oracle caps would be subject to minimum cooldowns of 36, 48 or 72 hours depending on the parameter type, with these bounds applying to both chains. These cooldown periods allow time for community monitoring and intervention while still enabling faster adjustments than standard governance cycles.

The tiered cooldown structure balances protocol responsiveness against governance safety, allowing faster parameters to adjust frequently while slower parameters affecting fundamental economics receive more deliberation time.

One-Way Emergency Powers Prevent Unilateral Market Restoration

The emergency category is restricted strictly to one-way safety actions. Hub calls can deactivate or halt assets and Spokes, while Spoke calls can pause or freeze individual reserves or entire markets. Critically, these functions cannot reactivate, unhalt, unpause or unfreeze affected markets, preventing Risk Stewards from unilaterally restoring market access without additional governance approval.

The separate flag-control roles, which operate bidirectionally and can change states in both directions, would not be granted to Risk Stewards. This design intentionally decouples emergency shutdown authority from recovery authority, combining faster bounded maintenance with immediate emergency power while requiring broader consensus for market reopening. The constraint mirrors common practices across decentralized finance, where shutting down markets quickly is valued for security but restarting them is reserved for consensus-driven processes to prevent abuse.

This asymmetry creates what governance theorists would recognize as a ratchet mechanism: easy to restrict but difficult to restore. Such designs are common in safety-critical systems, from industrial controls to blockchain protocols, where recovery decisions warrant higher scrutiny than protective actions taken under duress.

Emergency Permissions Remain Inactive Until Future Software Release

The emergency permissions would remain inert until a future software release adds support for them. By pre-positioning these roles now, Aave seeks to address a known vulnerability in decentralized governance: the lag between detecting a critical threat and receiving authorization to respond. Establishing permissions in advance would allow a later version to respond without waiting through another governance cycle.

Aave Labs confirmed that Risk Steward contracts are undergoing a Certora audit nearing finalization, though the code is not being presented as fully audited. Certora specializes in formal verification that mathematically proves certain properties about code behavior, signaling that Aave is prioritizing rigorous security validation for a system granting elevated protocol access. Formal verification has become increasingly important in DeFi as protocols manage billions in user assets.

If the Snapshot passes and the Security Council executes, the immediate change would be no-delay access to bounded parameter controls, with one-way emergency powers pre-positioned but not yet usable. This staged activation allows community members to monitor steward behavior under normal conditions before emergency authorities become available.

Forum participants have requested public rationales, post-action reports, periodic reviews and reporting on the frequency and size of steward actions, none of which is required in the current proposal.

This accountability gap highlights broader challenges in decentralized governance, where delegating authority to specialized teams improves operational efficiency but requires robust mechanisms to prevent abuse. Community members have suggested that implementing reporting requirements and periodic governance reviews could address these concerns without compromising emergency response capabilities, setting the terms for debate as the September 6 vote approaches.

Disclosed regulatory documents expose identities of 291 cryptocurrency users through direct connections between personal information and transaction records

Disclosed regulatory documents expose identities of 291 cryptocurrency users through direct connections between personal information and transaction records

, , , , ,

A data breach at Swiss Bitcoin service Pocket Bitcoin has directly linked real-world identities to public wallet addresses for 291 customers, creating phishing and fraud risks despite leaving funds secure. The incident highlights how combining public blockchain data with personal information exposes customers to impersonation attacks and physical security threats.

  • 291 Pocket Bitcoin customers had names matched to Bitcoin addresses in breached support records from partner banks.
  • Exposed data included names, postal addresses, Bitcoin addresses, identity documents, and source-of-funds records in varying combinations.
  • Private keys were never compromised, leaving customer funds secure but creating phishing and impersonation risks.
  • 291 Customers affected by data linkage of identity to wallet activity
  • Aug. 21 Date of Pocket Bitcoin’s initial disclosure of the breach
  • Aug. 31 Date of company’s expanded disclosure clarifying scope of exposed data
  • $100M Loss from recent hardware wallet attacks escalating beyond data leaks alone

Breach Disclosure and Initial Confusion

Pocket Bitcoin, a non-custodial Swiss Bitcoin service, disclosed on August 21 that a data breach had exposed customer information. The company initially stated that Bitcoin addresses, its customer database and transaction history were not affected. In an August 31 update, however, Pocket Bitcoin clarified that while its core databases remained secure, related information had been included in some correspondence stored in the compromised support system maintained with partner banks.

The delayed clarification underscores challenges that cryptocurrency companies face in communicating breach scope to customers and regulators. Non-custodial Bitcoin services like Pocket Bitcoin typically do not hold customer funds directly, which simplifies certain security responsibilities but creates complex data management scenarios when operational records are compromised. The staggered disclosure timeline likely reflected the company’s need to coordinate with its banking partners to determine exactly what information had been exposed across multiple systems.

Names and Addresses Linked to Public Wallet Activity

The breach exposed correspondence containing varying combinations of customer names, postal addresses, Bitcoin addresses used for transactions, identity-document copies and source-of-funds records. Most affected customers had only some of those fields exposed rather than the complete set, according to Pocket Bitcoin. The connection between a customer’s real-world identity and postal address to a public Bitcoin address removes anonymity that would otherwise separate a person’s offline identity from their on-chain activity.

Bitcoin addresses themselves are publicly visible on the blockchain, allowing anyone to inspect balances and transaction histories.

The exposure creates a privacy vulnerability and heightens phishing risks. Switzerland’s National Cyber Security Centre has documented scams that use a recipient’s real home address to increase pressure on targets, illustrating how location data combined with identity information can be weaponized. Pocket Bitcoin warned that details from exposed correspondence could make deceptive emails, calls or messages about the incident appear more credible to recipients.

This type of identity-to-address linkage represents a broader privacy concern in the cryptocurrency ecosystem. Users often assume that Bitcoin addresses provide pseudonymity, but exchanges, payment processors and service providers routinely collect identity information for regulatory compliance. When those records are compromised, the pseudonymity evaporates, leaving users exposed to targeting based on their cryptocurrency holdings and transaction patterns.

Customer Funds Protected Despite Identity Exposure

The breached information cannot move Bitcoin because spending requires a valid cryptographic signature made with the corresponding private key.

Pocket Bitcoin emphasized that it operates as a non-custodial service and never held customers’ private keys. The company determined there was no risk to customer funds and stated it had no indication that the exposed information had been misused. The distinction matters: while the breach does not give an attacker control over anyone’s wallet, it does create fraud and impersonation risks.

The non-custodial model provides a meaningful security advantage in breach scenarios. Services that custody customer assets on behalf of users face substantially higher stakes when data is compromised. By contrast, Pocket Bitcoin’s architecture means the primary risk from the breach stems from secondary attacks leveraging the exposed identity and contact information rather than direct theft of funds.

Investigation Complete and Authorities Notified

Pocket Bitcoin said its forensic investigation and review of relevant partner-bank correspondence were complete, and the vulnerability had been closed. Each of the 291 affected customers received an individual notice listing the specific data exposed in their case. The company reported the incident to the Swiss Federal Data Protection and Information Commissioner and filed a police report.

The investigation findings and regulatory notification represent standard protocol for data breaches under Switzerland’s data protection framework. However, Pocket Bitcoin acknowledged that its current visibility into the incident does not guarantee that copied information has not been misused, leaving the question of whether affected customers will face follow-on fraud attempts unanswered. Customers should monitor for impersonation attempts and unsolicited contact referencing the breach details, particularly communications claiming to address the incident.

The incident serves as a reminder that securing customer funds is necessary but insufficient for protecting users in the cryptocurrency space. As the industry matures and regulatory requirements drive more identity collection, the intersection of personal data and blockchain activity creates new attack surfaces that require careful protection and transparent disclosure practices.

Grayscale: Zcash Could Become More Important as AI Poses Risks to Financial Privacy

Grayscale: Zcash Could Become More Important as AI Poses Risks to Financial Privacy

, , , , , , ,

Grayscale’s research suggests artificial intelligence will amplify demand for blockchain privacy solutions, positioning Zcash as a potential beneficiary as AI tools make de-anonymization of public blockchains easier. The investment firm converted its Zcash Trust into a spot ETF this month, betting the token’s current valuation leaves room for significant gains.

  • Grayscale Head of Research Zach Pandl expects AI to create new privacy threats and drive demand for privacy solutions like Zcash.
  • Zcash uses zero-knowledge cryptography in shielded transactions to conceal both transaction addresses and amounts, unlike Bitcoin’s fully transparent ledger.
  • ZEC gained nearly 80 percent over the past month and is currently trading around 850 dollars per token.
  • 80% ZEC price gain over the past month compared to longer-term performance
  • $850 Current ZEC trading price versus analyst target of $1,800
  • Aug 25 Launch date of Grayscale’s new spot ZEC ETF on NYSE Arca
  • 20x ZEC surge over the past year versus sub-1% Bitcoin market cap share

Grayscale released a research report identifying artificial intelligence as a catalyst for a new wave of financial privacy concerns, with implications for both traditional finance and blockchain networks. The firm’s analysis identifies AI as likely to accelerate de-anonymization risks on public blockchains by making address labeling more effective and widely available. This development could drive institutional and retail users toward privacy-preserving alternatives, with Zcash positioned as a primary candidate to capture that demand.

AI Threatens De-anonymization On Transparent Blockchains

Grayscale Head of Research Zach Pandl framed AI as the third major wave of financial privacy concern, following earlier waves triggered by computerization in the 1970s and internet expansion in the 1990s. Public blockchains like Bitcoin face particular vulnerability because all transactions are recorded on an immutable, transparent ledger accessible to anyone with internet connectivity. The pseudonymous nature of blockchain addresses creates an illusion of privacy while leaving a permanent digital footprint that persists indefinitely.

When blockchain activity is linked with off-chain information such as exchange deposits, user identities, or transaction patterns, individual addresses can potentially be de-anonymized, a risk that was outlined in Bitcoin’s original white paper. Sophisticated chain analysis firms have already developed tools to track and classify addresses based on behavioral patterns and known transaction histories. Regulatory pressure has further incentivized development of more advanced address labeling systems, enabling law enforcement and financial institutions to monitor blockchain activity with increasing precision.

While the de-anonymization risk predates AI, advances in machine learning and data analysis could make blockchain address labeling significantly more effective and accessible, according to Grayscale’s assessment. Machine learning algorithms can identify patterns in transaction behavior, timing, and network clustering that human analysts would struggle to detect manually. As these tools become more sophisticated and commoditized, they may eventually become accessible to a broader range of actors beyond specialized forensics firms, democratizing de-anonymization capabilities.

This development raises the stakes for users who conduct financial transactions on public blockchains without privacy protections, creating an incentive to migrate toward solutions that offer stronger confidentiality guarantees. Individuals concerned about financial surveillance, asset seizure, or competitive intelligence gathering may increasingly view privacy-focused blockchains as essential infrastructure rather than optional tools.

Zcash’s Shielded Transactions Address AI-Era Privacy Gaps

Unlike Bitcoin, Zcash incorporates zero-knowledge cryptography through shielded transactions that conceal both the addresses involved and the transaction amount. This cryptographic approach allows network participants to verify transactions without revealing sensitive information, providing mathematical certainty about transaction validity without exposing metadata. Grayscale characterized this privacy feature as potentially becoming a “must-have” for users prioritizing financial confidentiality in an environment where AI tools threaten de-anonymization of transparent blockchain activity.

The firm noted that Zcash’s market valuation may not fully reflect its privacy advantages relative to other assets. Grayscale pointed out that while ZEC surged approximately 20 times over the past year, it still represents less than 1 percent of Bitcoin’s total market capitalization, suggesting the current price may underestimate Zcash’s long-term value proposition for privacy-conscious users. This valuation gap could narrow if institutional adoption of privacy-focused cryptocurrencies accelerates in response to regulatory scrutiny and AI-driven surveillance capabilities.

Grayscale’s Spot ZEC ETF Launches Amid Strong Token Performance

Grayscale converted its Zcash Trust, originally launched in 2017, into a spot ZEC exchange-traded fund that began trading on NYSE Arca on August 25. The conversion represents another step toward mainstream acceptance of privacy-focused cryptocurrencies, following similar ETF launches for other digital assets.

The timing of the ETF launch coincides with significant momentum in ZEC price action. Over the preceding month, Zcash gained nearly 80 percent, climbing to approximately 850 dollars per token at the time of reporting. The institutional-grade product provides a regulated vehicle for investors seeking exposure to Zcash without directly managing private keys or custody arrangements, potentially attracting capital from institutional portfolios that require traditional market infrastructure.

Crypto analyst Ali Martinez has identified 1,800 dollars as a “first stop” price target for ZEC, suggesting potential for further upside gains from current levels. The question now centers on whether Grayscale’s ETF launch will accelerate institutional adoption of Zcash as a privacy-focused holding, or whether regulatory and competitive pressures will constrain momentum beyond near-term technical targets. Regulatory scrutiny of privacy-focused cryptocurrencies remains a significant wild card that could impact both adoption rates and government policy toward privacy technologies in financial markets.

Load More

Back To Top
© BlockWest 2026
BlockWest Media LLC

Equities, AI, and blue-chip crypto, covered as one connected market.

Sections

Company

Legal

Follow

𝕏 ▶ in

© 2026 BlockWest. All rights reserved.