BTCPAY SERVER EXPLOIT — OVER $1.6M IN CRYPTO REPORTEDLY STOLEN

Publication Date: 3 November 2026
Incident Period: 30 October – 2 November 2026
Platform: BTCPay Server
Reported Losses: Approximately $1.63 million
Category: Cryptocurrency Security / Wallet Exploit

BTCPay Server, an open-source Bitcoin payment platform, has warned operators after attackers gained unauthorized access to certain self-hosted instances and drained connected hot wallets.

On-chain analysis published by Bitquery traced approximately 18.38 BTC and 3,405 LTC, valued at around $1.63 million at the time of analysis, to addresses associated with the incident. The exact number of affected servers and victims has not been confirmed.

KEY DEVELOPMENTS

• Attackers reportedly gained administrator-level access to affected BTCPay Server instances.
• The incident targeted older software versions, specifically version 2.4.1 and earlier, according to the project’s investigation.
• BTCPay initially urged operators to shut down their instances using "./btcpay-down.sh" while the investigation was underway.
• The project reported no credible hot-wallet drain reports involving users running version 2.4.7 at the time of its update. This should not be interpreted as a guarantee of safety.

AFFECTED VERSIONS

The investigation identified an attack vector targeting BTCPay Server versions 2.4.1 and older. The precise method used to gain administrator access had not been fully explained in the reports reviewed.

SECURITY RECOMMENDATIONS

• If you operate a BTCPay Server instance, check the project's latest official security guidance before bringing it online.
• Update to the latest verified release and investigate any suspicious administrator accounts or transactions.
• If a hot wallet may be compromised, treat its seed and credentials as exposed; use a secure device to move remaining funds to a newly generated wallet.
• Report suspected losses and preserve relevant server logs and transaction records.

STATUS: Investigation ongoing in the latest reports reviewed. On-chain researchers traced approximately $1.63 million in Bitcoin and Litecoin transfers associated with the incident.

SOURCE: BTCPay Server / CoinDesk / Decrypt / Bitquery Research

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat

KRAKEN USER REPORTEDLY LOSES $106 MILLION+ IN SOCIAL ENGINEERING SCAM

Publication Date: 2 November 2026
Incident Reported: 2 November 2026
Category: Cryptocurrency / Cybersecurity

A Kraken user has reportedly lost more than $106 million in cryptocurrency after being targeted by scammers impersonating Kraken support over the phone.

According to blockchain investigator ZachXBT, the victim was targeted through a social engineering attack in which fraudsters allegedly posed as legitimate Kraken support representatives to gain access to the victim's funds.

Latest Developments:

- ZachXBT reported that the victim lost more than $106 million in cryptocurrency.
- The attackers allegedly impersonated Kraken support representatives during phone calls.
- The incident reportedly involved the loss of the victim's entire balance held on Kraken.
- The exact method used to gain access to the funds and the status of any recovery efforts remain unclear.

Potential Impact: The incident highlights the growing threat of social engineering attacks targeting cryptocurrency users, particularly through support impersonation and fraudulent phone calls.

Security Reminder:

«- Never share passwords, 2FA codes or recovery phrases with anyone claiming to be support.
- Verify support calls through the platform's official application.
- Avoid transferring funds based on unsolicited calls or urgent security warnings.
- Remember that cryptocurrency transactions are generally irreversible once confirmed.

Status: The incident has been reported by ZachXBT. Independent confirmation of the full loss amount and recovery status remains pending guidance.

Sources: ZachXBT | Kraken Official Security

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat

BTCPAY SERVER WARNS OF ACTIVE HOT WALLET DRAINS, URGES ALL OPERATORS TO SHUT DOWN

Publication Date: 3 November 2026
Platform: BTCPay Server
Incident Type: Cryptocurrency Security / Hot Wallet Compromise
Status: Investigation Ongoing

BTCPay Server has issued an urgent security warning after reports emerged of unauthorized attackers draining hot wallets across multiple self-hosted instances.

The project has urged all operators to immediately shut down their BTCPay Server instances while investigations into the incident continue.

KEY DEVELOPMENTS

• Hot wallets across multiple BTCPay Server instances have reportedly been targeted by unauthorized attackers.

• The project has advised all operators to take their instances offline immediately.

• Operators have been instructed to use the shutdown command "./btcpay-down.sh".

• The investigation is ongoing, and the full extent of the incident has not yet been established.

IMMEDIATE SECURITY RECOMMENDATIONS

• If you operate a BTCPay Server instance, take it offline immediately as instructed by the project.

• Avoid bringing your instance back online until official security guidance is available.

• Review your hot wallet activity for any suspicious transactions.

• If your wallet may be compromised, treat its credentials and seed as exposed.

• Securely move any remaining funds to a newly generated wallet using a trusted device.

STATUS: BTCPay Server has urged operators to shut down their instances while the investigation remains ongoing. Further security guidance is expected from the project.

SOURCE: BTCPay Server Official Security Advisory

Upcoming #1 channel for news: @CorridorIntel
Sponsored by @Literatechat

WESTERN EUROPEAN FINANCIAL BANK REPORTEDLY SUFFERS AN ADDITIONAL $27M LOSS, BRINGING TOTAL LOSSES TO OVER $133M

Publication Date: 3 November 2026
Platform: Kraken
Incident Type: Cryptocurrency Theft / Unauthorized Withdrawals
Status: Reported by ZachXBT

A large financial bank in Western Europe has reportedly suffered an additional $27 million loss, bringing its total cryptocurrency losses to over $133 million.

According to blockchain investigator ZachXBT, the victim is a major financial institution that does not wish to publicly disclose the theft.

The bank reportedly had over $130 million stolen from its Kraken account within the last 24 hours.

KEY DEVELOPMENTS

• The same victim has reportedly lost an additional $27 million.

• Total reported losses have now exceeded $133 million.

• ZachXBT identified the victim as a large financial bank based in Western Europe.

• Over $130 million was reportedly stolen from the bank's Kraken account within the last 24 hours.

• The financial institution reportedly does not want to publicly disclose the theft.

STATUS: The reported losses have exceeded $133 million following an additional $27 million loss. The identity of the financial institution remains undisclosed.

SOURCE: ZachXBT

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat

TRUST WALLET EXPLOIT — $1.1M REPORTEDLY STOLEN THROUGH SEED PHRASE THEFT

Publication Date: 5 November 2026
Incident Period: Not confirmed
Platform: Trust Wallet / Apple iOS
Reported Losses: Approximately $1.1 million
Category: Cryptocurrency Security / Wallet Exploit

Trust Wallet users are reportedly being targeted in a security incident involving devices running Apple's iOS 18.5. According to circulating reports, an unknown attacker is exploiting a vulnerability that allegedly allows seed phrases to be extracted directly from affected devices.

The stolen seed phrases could provide attackers with unauthorized access to victims' cryptocurrency wallets, potentially allowing them to transfer and drain available funds. Reported losses have reached approximately $1.1 million, although the exact number of affected users and the full scope of the incident remain unclear.

KEY DEVELOPMENTS

• The alleged attack involves the extraction of wallet recovery phrases without users knowingly sharing them.
• The precise vulnerability and method used to obtain access have not been publicly established.
• The reported incident has raised concerns about the security of cryptocurrency wallet credentials stored on mobile devices.

AFFECTED VERSIONS

The circulating warning specifically identifies devices running iOS 18.5. However, it remains unclear whether the issue is limited to this version or affects additional iOS releases and device models.

SECURITY RECOMMENDATIONS

• Update your iPhone to the latest available iOS version.
• Install Trust Wallet updates only through official application stores.
• Never share your seed phrase with anyone, including individuals claiming to represent Trust Wallet support.
• If you suspect your seed phrase has been compromised, create a new wallet on a trusted device and transfer your remaining assets.
• Monitor wallet activity for unauthorized transactions.

STATUS: The reported losses stand at approximately $1.1 million. The alleged iOS vulnerability, attack method and full extent of the incident remain unverified.

SOURCE: Circulating Security Reports / Trust Wallet Support (official attribution unconfirmed)

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat

AI-POWERED FRAUD SCHEME — OVER $129M STOLEN THROUGH DEEPFAKE CEO IMPERSONATION

Publication Date: 8 November 2026
Incident Period: July 2024 – February 2026
Platform: Corporate Financial Institutions / International Businesses
Incident Type: Cybercrime / AI-Powered Impersonation / Financial Fraud
Status: Criminal Charges Filed / Extradition Pending

Three men have been charged in the United States for allegedly orchestrating an international fraud scheme using artificial intelligence to impersonate corporate executives and attorneys, resulting in more than $129 million in reported losses.

According to an indictment unsealed by the U.S. Department of Justice, the suspects allegedly used AI-generated or manipulated voices and images to impersonate company CEOs during phone and video calls. They also impersonated lawyers from major international law firms to convince employees that confidential financial transactions were legitimate.

Victims were instructed to transfer large sums of money into bank accounts controlled by the alleged criminal network. The funds were subsequently converted into cryptocurrency in an attempt to conceal their origin and ownership.

KEY DEVELOPMENTS

- More than $129 million was allegedly stolen from companies across the United States and other countries.
- Three suspects identified as Jacob Soall, Sharon Hazan and Guy Sheetrit were charged in connection with the scheme.
- AI technology was allegedly used to replicate the voices and images of corporate executives and attorneys.
- Employees were targeted through fraudulent emails, phone calls and video meetings involving fabricated financial transactions.
- Victims included hospitals, financial institutions, a UK-based fintech company and other businesses.
- Stolen funds were transferred through international bank accounts before being converted into cryptocurrency.
- The three suspects were arrested in Spain and the United Kingdom, with extradition requests pending.

IMMEDIATE SECURITY RECOMMENDATIONS

- Independently verify unusual financial transfer requests with the relevant executives.
- Establish secondary identity verification procedures for high-value transactions.
- Never rely solely on voice or video calls to authenticate someone's identity.
- Require multiple levels of authorization for significant financial transfers.
- Train employees to recognize AI-generated impersonation and social engineering attempts.

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat

KEPLR WALLET SECURITY BREACH — OVER $6M IN CRYPTO REPORTEDLY STOLEN

Publication Date: 8 November 2026
Platform: Keplr Wallet / Web3Auth
Incident Type: Cryptocurrency Security / Private Key Compromise
Status: Investigation Ongoing

Keplr Wallet has suffered a major security incident involving certain wallets created through Google and Apple login. The incident has been linked to a vulnerability in Web3Auth's authentication infrastructure, which exposed private keys associated with affected accounts.

According to blockchain analytics firm Bitquery, approximately $6.01 million in cryptocurrency was traced to attacker-associated addresses, with more than 44,000 wallets reportedly affected across multiple Cosmos-based networks.

Following the incident, Keplr temporarily suspended Google and Apple login functionality while coordinating with Web3Auth to investigate the breach and secure remaining assets.

KEY DEVELOPMENTS

- Over $6 million in cryptocurrency was reportedly stolen from affected wallets.
- More than 44,000 wallets were reportedly impacted across multiple Cosmos-based networks.
- The incident primarily involved wallets created through Google and Apple login.
- Keplr temporarily suspended Google and Apple login functionality.
- Web3Auth and Keplr initiated investigation and asset recovery operations.
- Wallets created using recovery phrases or hardware wallets were reported unaffected in Keplr's initial assessment.

IMMEDIATE SECURITY RECOMMENDATIONS

- Avoid depositing additional funds into potentially affected social-login wallets.
- Follow official Keplr instructions regarding account security and asset recovery.
- Never share recovery phrases or private keys.
- Avoid unofficial recovery services and suspicious links.
- Monitor official Keplr and Web3Auth announcements for further updates.

Sources: Bitquery Investigation — Gaurav Agarwal; Crypto.news reporting.

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat

US TREASURY SANCTIONS 8 CANADIAN MONEY SERVICES BUSINESSES OVER IRAN-RELATED CRYPTO TRANSACTIONS

Publication Date: 8 November 2026
Incident Date: 6 November 2026
Platform: U.S. Department of the Treasury / OFAC
Incident Type: Cryptocurrency / Financial Sanctions / Sanctions Evasion
Status: Sanctions Imposed

The U.S. Department of the Treasury has sanctioned eight Canadian money services businesses accused of facilitating financial transactions involving sanctioned Iranian entities and organizations linked to the Islamic Revolutionary Guard Corps (IRGC).

Announced under Operation Economic Outcast, the action targets businesses allegedly involved in converting Iranian rials and other currencies into digital assets to facilitate international transactions and sanctions evasion.

Among the designated businesses are NIA Nations Currency Ltd and Diverse Trade Inc, operating as Million Exchange. Blockchain investigator ZachXBT had previously raised concerns about suspicious OTC activity involving these businesses.

KEY DEVELOPMENTS

- Eight Canadian money services businesses were designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC).
- The designated businesses include Million Exchange, Amin Exchange, NIA Nations, Farah Exchange, CCC Inc, B Galaxy Inc and Darvish Exchange, alongside another affiliated business.
- Treasury alleged that several businesses facilitated transactions with sanctioned Iranian cryptocurrency exchanges.
- Wallet addresses associated with NIA Nations reportedly transacted with Nobitex, Wallex, Ramzinex and Bitpin.
- Million Exchange was accused of facilitating transactions involving digital assets linked to the IRGC and other terrorism-related addresses.
- Several designated businesses were also accused of facilitating financial flows connected to international drug trafficking.
- The sanctions block designated entities' property under U.S. jurisdiction and generally prohibit transactions involving them by U.S. persons.

IMMEDIATE SECURITY RECOMMENDATIONS

- Conduct due diligence before engaging with cryptocurrency OTC service providers.
- Screen business counterparties against official sanctions lists.
- Monitor exposure to wallets associated with sanctioned entities.
- Maintain transaction records and conduct regular compliance reviews.
- Avoid transactions involving designated entities or their controlled intermediaries.

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat

LEDGER ATOM INTRODUCES HARDWARE-ENCRYPTED MESSAGING TO PROTECT PRIVATE COMMUNICATIONS

Publication Date: 10 November 2026
Announcement Date: 15 October 2026
Platform: Ledger / Ledger Atom
Incident Type: Hardware Security / Encrypted Communications / Anti-Phishing Protection
Status: Product Announced

Ledger has introduced Ledger Atom, a new security and privacy-focused device designed to protect users' financial activities and sensitive communications.

The device supports GPG/OpenPGP encryption, allowing users to encrypt messages before sending them through third-party messaging applications. The messaging application never receives the unencrypted message, which can only be accessed through another Ledger Atom device operating in Secure Mode.

The feature is designed to strengthen privacy around financial conversations and reduce exposure to social engineering attacks, phishing attempts and communication-based scams.

KEY DEVELOPMENTS

- Ledger Atom introduces hardware-backed encryption for private communications.
- Users can encrypt messages before sending them through their preferred third-party messaging applications.
- Messaging applications cannot access the original unencrypted message.
- Messages can be decrypted on another Ledger Atom device through Secure Mode.
- The device features a dual-operating-system architecture combining Android Open Source Project with Ledger OS.
- A physical privacy switch cuts power to the camera and microphone at the hardware level.
- Ledger describes Atom as its most advanced security device to date, incorporating additional anti-tampering protections.

SECURITY IMPLICATIONS

- Hardware-backed encryption can help protect sensitive financial conversations.
- Users gain additional protection against messaging-platform exposure.
- Secure communication reduces certain risks associated with intercepted or compromised messages.
- Hardware-level privacy controls provide additional safeguards beyond conventional software settings.

SOURCES & CREDITS

1. Ledger Official Announcement — Introducing Ledger Atom, 15 October 2026.
2. Business Wire — Ledger Atom product launch and technical specifications.
3. The Block — Ledger Atom security architecture and product coverage.

Upcoming #1 channel for news @CorridorIntel
Sponsored by @Literatechat