The address labeled Bofur Capital lost $2M due to an address poisoning attack after withdrawing from Compound. A phisher sent a small USDC transaction to spoof the address, and the victim mistakenly copied the wrong address, leading to the drain. The stolen funds were swapped to 2M DAI.
Cybersecurity firm Rapid7 has identified a phishing campaign targeting 885,000 phone numbers, aiming to steal cryptocurrency by redirecting users to fake wallet websites.
A suspicious outflow of $1.284 million USDC was detected on August 11th from a vultisig-related address. Approximately $1.092 million USDC was swapped for ETH and deposited into Tornado Cash.
BitBox has patched severe wallet flaws recommending users update to firmware version 9.26.5. The company has received no reports of exploitation or fund losses.
Boltz, a Bitcoin swap service, remains offline after its founders exited and an unnamed group agreed to take over. The service is being fixed for vulnerabilities that caused losses to the company.
SafePal reported a breach exposing the personal data of 39,798 buyers, including names, phone numbers, and shipping addresses, due to a flaw in an order-tracking plug-in. The stolen data is being advertised for sale.
Trezor reported that data from 14,000 users, including names, phone numbers, and shipping addresses, was exposed through a shipping provider flaw over 14 months. The company warns of potential phishing risks.
Maya Protocol experienced a withdrawal logic flaw resulting in a loss of approximately $1.7 million. The team has paused global operations to address the issues and is seeking fund recovery.