Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 50 results
highbug_reportVulnerabilityLedger halts Asia sales after hardware implants steal crypto seed phrases
Ledger hardware wallets purchased from third-party resellers in Southeast Asia (Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia), Hong Kong, and potentially Europe (MediaMarkt).
highpublicGeopoliticalUK Sanctions Cryptomus Platform Over Russia Sanctions Evasion
The UK's October 2024 sanctions against Cryptomus represent a strategic escalation in Western efforts to disrupt financial infrastructure enabling Russia's circumvention of economic restrictions imposed following its invasion of Ukraine.
criticalbug_reportVulnerabilityLedger hardware wallets sold via CryptoBilis contain spy chip implants
Ledger Nano X hardware wallets distributed through Southeast Asian reseller CryptoBilis (Malaysia-based, operating across Southeast Asia). Compromised devices also sold via Amazon Japan and Yahoo! Auctions Japan by China-based sellers shipping from M…
highbug_reportVulnerabilityLedger wallets sold via CryptoBilis contain hardware implants, $86M stolen
Ledger hardware cryptocurrency wallets purchased through reseller CryptoBilis in Southeast Asia within the last 90 days. Confirmed cases involve unauthorized hardware implants in devices sold exclusively through this reseller.
highpublicGeopoliticalMaryland Man Convicted for $53M Uranium Finance Cryptocurrency Heist
This case represents a significant milestone in U.S. law enforcement's evolving approach to decentralized finance (DeFi) crime. The conviction of Jonathan Spalletta for exploiting smart contract vulnerabilities in Uranium Finance underscores the Just…
highbug_reportVulnerability16 malicious Firefox extensions steal crypto wallet keys and recovery phrases
Mozilla Firefox users who installed any of 16 malicious extensions impersonating Rabby Wallet (4 extensions) and OKX Wallet (12 extensions). Extensions masqueraded as wallet portals, desktop utilities, and browser tools.
highperson_alertThreat ActorCanto Incognito Targets AI/LLM Infrastructure for Crypto Mining Botnet
Canto Incognito is a financially motivated threat actor attributed with moderate confidence to an Italian-speaking operator based on Italian-language artifacts and netflow indicators.
criticalbug_reportVulnerabilityBitget confirms zero-day in third-party security product led to $387M theft
Bitget cryptocurrency exchange; third-party security products (Product A and Product B, vendors unnamed); 11 blockchains including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia.
criticalbug_reportVulnerabilityBitget crypto exchange breached via zero-day in security appliances
Bitget cryptocurrency exchange. Two unnamed third-party security appliances (referred to as "Product A" and "security appliance B") compromised via zero-day vulnerabilities.
criticalbug_reportVulnerabilityBitget exchange loses $388M via zero-day in unnamed third-party product
Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws under active global exploitation
Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution) and CVE-2026-88772 (remote code execution or denial-of-service).
criticalperson_alertThreat ActorNorth Korean Hackers Steal $387.5M from Bitget Crypto Exchange
North Korean state-sponsored threat actors are attributed to this breach based on on-chain analysis and IP behavior patterns. These groups are financially motivated, conducting large-scale cryptocurrency theft operations to generate revenue for the N…
criticalperson_alertThreat ActorLazarus Group Steals $351.6M from Bitget via Backend Compromise
Lazarus Group (G0032), also tracked as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, and ZINC, is a North Korean state-sponsored APT group. The actor is financially motivated, conducting large-scale cryptocurrency heists to generate revenue f…
highperson_alertThreat ActorNorth Korea's Contagious Interview Campaign Steals $10.71M in Crypto
North Korean state-sponsored threat actors operating under the 313 General Bureau of the Munitions Industry Department. The activity is tracked under multiple names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang…
highperson_alertThreat ActorU.S. Disrupts Chinese Organized Crime Scam Marketplace, Freezes $52.8M
Chinese organized crime syndicates operating the Xinbi Guarantee illicit marketplace, a Telegram-based platform facilitating pig butchering romance scams, wire fraud, and money laundering.
criticalbug_reportVulnerabilityAlby Hub critical flaw enables wallet takeover on internet-exposed instances
Alby Hub versions v1.7.0 through v1.18.5 (all releases before August 2025). Only instances exposed to the internet are vulnerable. Versions v1.19.0 and later are patched. Current version is v1.24.0.
highperson_alertThreat ActorSlim Spider Targets Brazilian Financial Institutions for Crypto Theft
Slim Spider is a previously undocumented, financially motivated threat actor attributed by CrowdStrike to Brazil-based operations targeting Brazilian financial institutions since at least March 2026.
highperson_alertThreat ActorLiquid Hackers Exploit Elements Bug, Return 85% of Stolen Bitcoin
Liquid Hackers is a group that exploited a vulnerability in the Elements software underlying the Liquid Network Bitcoin sidechain on September 6, 2026. The actors self-identify as "white hats" and communicated via on-chain messages, claiming their in…
highbug_reportVulnerabilityTrezor shipping partner breach exposes 81,000 customer records via Metabase
Trezor cryptocurrency hardware wallet customers who placed orders through ShipMonk logistics provider between November 2019 and August 2026. Total of 81,000 customers affected (67,000 U.S.
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.
highbug_reportVulnerability13 malicious Packagist packages target iOS devices to steal crypto wallets
Packagist/Composer ecosystem: 13 malicious theme packages across 5 vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms). Targets Vietnamese streaming sites using OphimCMS/KKPhim.
criticalbug_reportVulnerabilityCosmos EVM balance flaw exploited on six chains after delayed patch
Cosmos EVM module versions < 0.6.2 and >= 0.7.0 < 0.7.2. All blockchains running Cosmos EVM with permissionless vesting account creation are vulnerable. Six chains were exploited August 20–25, 2026. Fixed in v0.6.2 and v0.7.2 (released August 19).
highbug_reportVulnerability19 malicious Chrome/Edge extensions drain crypto wallets via auto-updates
19 browser extensions (18 Chrome, 1 Edge) published since February 2024, with "Enable Right Click & Copy — Smart Unlock + OCR" having 80,000 installs. Extensions either created by threat actor or purchased from legitimate owners.
highperson_alertThreat ActorNorth Korea IT Worker Infiltration Targets Crypto and Tech Firms
North Korean IT worker operations, attributed by researchers to Famous Chollima (a CrowdStrike designation under the Lazarus umbrella), involve operatives seeking employment at Western technology and cryptocurrency companies under fraudulent identiti…
highbug_reportVulnerabilityMalicious VS Code extensions steal crypto wallets and credentials from devs
Microsoft Visual Studio Code users who installed "Solidity Pro" extensions (helper-beeps.solidity-pro or web3devtoolsx.solidity-pro) from Open VSX marketplace. Extensions targeted Ethereum/Web3 developers.
highbug_reportVulnerabilityClickFix attacks deliver macOS stealer targeting crypto wallets and Keychain
macOS systems (all CPU architectures). Users tricked into pasting malicious commands into Terminal. Targets cryptocurrency wallets (Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, XRP), browser passwords, Apple iCloud Keychain, and cached credentials.
highbug_reportVulnerabilityTwo H1 2026 campaigns use compromised email and clipboard hijacking
Campaign 1: Users in Czechia, Slovakia, Poland, and Lithuania targeted by GepyS banking malware via compromised corporate email accounts. Campaign 2: Cryptocurrency users globally affected by Rust-based clipboard hijacker monitoring 21 blockchain typ…
highbug_reportVulnerabilityClickFix campaign delivers Go-based macOS stealer targeting crypto wallets
macOS users across all versions; targets cryptocurrency wallets (Bitcoin, Ethereum, Litecoin, Dogecoin, Monero, XRP), browser password databases, Apple Keychain, and cached browser credentials.
criticalbug_reportVulnerabilityCryptoJS weak RNG drained $5.7M from five crypto wallets over 12 years
CryptoJS versions below 4.0.0 (except 3.2.0 and 3.2.1). Five confirmed affected wallet apps: RRWallet (discontinued), Bexo Wallet (fixed in 20.1.0, builds pending), NanChat (fixed in 1.3.0), Bitcoin Libre (fixed in v4, July 2024), and Milo (discontin…
highbug_reportVulnerabilityPhishing campaign exploits COLDCARD wallet fears to deploy ScreenConnect RAT
COLDCARD hardware wallet users targeted via phishing emails. Attack delivers ConnectWise ScreenConnect remote access tool via malicious batch file (Coldcard_Diagnostic_Tool.bat) hosted on GitHub.