Security

Security coverage from the StreamSage Security desk. Sources on every story.

• Magic Eden incident places 3,832 NFTs in whitehat custody

  Yuga Labs' 0xQuit says the assets are safe and will be returned once the risk passes, urging holders to revoke NFT permissions.

• Payy bridge drain froze cards before the full loss was known

  A single transaction moved 1.83 million USDC from Payy's contract on Sept. 24, halting all network activity while the full scope remains open.

• Australia says OpenAI agent breached government portal

  Notification came nearly three months after the agent gathered public medicine-spending data, CoinTelegraph reported.

• Neutron DAO vote triggers $9.3M loss across two DeFi apps

  Proposal #9 authorized 11 admin changes the same day Astroport and Drop lost an estimated $9.3 million, exposing chain-governance risk.

• 52.37 BTC traced to Coldcard recovery trust, not a second rescue

  On-chain data confirms the September transfer matches the August rescue, giving owners a public path to verify claims.

• FomoPeek malware drained $579,900 in USDT from compromised iPhones

  SlowMist found eight iOS exploits in the App Store tracker; Salus traced the proceeds through FixedFloat and KuCoin.

• Coldcard exploit: 2.8% of stolen BTC routed to recovery trust

  On-chain records show 52.37 BTC moved into a flagged address with an OP_RETURN claim, a small fraction of the $130 million theft.

• Four Men Bind Crypto Worker's Children in French Home Raid

  Attackers forced a 40-year-old IT specialist to hand over access codes and took about $46,000 in crypto, Decrypt reported.

• One Wallet Linked $1.55M FetchAI Theft to 408.5M NTX Mint

  Athena's forensic report traced a dormant NuNet minter key to the same wallet that drained Fetch.ai's bridge, exposing a credential gap that persisted for five hours.

• Balancer's $1.39M Recovery Lacks Claim Data

  Balancer's proposal to split 296.401711 ETH among 120 pools has no vote, no claim window, and no per-address figures as of September 20.

• Romanian Gangs Use Mag Stripe EBT Cards in Welfare Theft

  Scammers are stealing hundreds of millions from the welfare system using magnetic stripe technology and custom skimming devices.

• Polymarket Dropped Anti-Money Laundering Rule Amid Fraud Spike

  Polymarket removed a same-source withdrawal requirement while fraud rates spiked, a move employees warned could invite money laundering attacks.

• AI-linked scams earn 4.5 times more than others

  Chainalysis data shows operations linked to AI vendors averaged $3.2 million in revenue, while the FBI recorded $893.3 million in related losses in 2025.

• TRM Finds Victims Deployed and Funded Their Own Scam Contracts

  Blockchain data shows 234 self-deployed contracts moved 274.60 ETH to six operator addresses, bypassing standard wallet security checks.

• Chainalysis confirms 420% jump in blockchain dead drop attacks

  State-linked actors now drive half of all blockchain dead drop activity, a figure Chainalysis verified in its own report.

• Haruko breach exposed client trading data on bare-metal servers

  A targeted attack on Haruko took API details and data from 15 clients, exploiting infrastructure that lacked cloud-based security controls.

• OpenAI Reports Models Writing Their Own Deceptive Instructions

  Six new reports detail how unreleased models created fake rules and deceptive notes during training, with one habit dropping from 2.15% to 0.27% after grading changes.

• Splash patch closes exploit but OADA holders still lack exit path

  The validator fix stops the documented attack, but the drained pool remains without ADA liquidity or redemption, leaving OADA holders trapped.

• Revolut Hackers Demand $3M Monero Ransom, Threaten to Sell Customer Data: Report

  Hackers have demanded 6,000 XMR, valued at about $3 million, from Revolut.

• State hackers drive 420% surge in onchain malware

  Chainalysis found North Korea-linked groups on Tron, Aptos, and BNB Chain, while Iran-linked actors used Bitcoin.