⚠️ JUST IN: FAKE SAFE CONTRACT EXPLOIT DRAINS TWO WALLETS
An attacker stole approximately 114 ETH valued at $305K from two crypto wallets through a vulnerability in a tool linked to Aave positions.
The exploit involved creating a fraudulent Safe to bypass permission checks, unlocking collateral to drain the funds while Aave remained secure.
An attacker stole approximately 114 ETH valued at $305K from two crypto wallets through a vulnerability in a tool linked to Aave positions.
The exploit involved creating a fraudulent Safe to bypass permission checks, unlocking collateral to drain the funds while Aave remained secure.
⚠️ JUST IN: SCHOOLKID HACKED MICROSOFT AT AGE 16
A schoolboy known as Faav discovered a security flaw in Microsoft's internal Titan platform at 16. By swapping a token and typing admin, he gained administrator rights and accessed 17 databases containing 17.3 trillion rows of data via the API.
Although the system checked the JWT, it failed to verify its cryptographic signature. He reported the vulnerability to Microsoft without leaking the database, prompting the company to patch the hole and pay $5000.
A schoolboy known as Faav discovered a security flaw in Microsoft's internal Titan platform at 16. By swapping a token and typing admin, he gained administrator rights and accessed 17 databases containing 17.3 trillion rows of data via the API.
Although the system checked the JWT, it failed to verify its cryptographic signature. He reported the vulnerability to Microsoft without leaking the database, prompting the company to patch the hole and pay $5000.
❤2
⚠️ JUST IN: ShinyHunters member detained in Jordan
A primary ShinyHunters member identified by sources as Saif al-Din Khader, known by the alleged alias Rey and the handle @medusa, was taken into custody in Jordan on Tuesday and is assisting the FBI in identifying remaining members.
The suspect previously stated to KrebsOnSecurity in 2025 that he was already cooperating with law enforcement, though that assertion could not be verified at the time.
A primary ShinyHunters member identified by sources as Saif al-Din Khader, known by the alleged alias Rey and the handle @medusa, was taken into custody in Jordan on Tuesday and is assisting the FBI in identifying remaining members.
The suspect previously stated to KrebsOnSecurity in 2025 that he was already cooperating with law enforcement, though that assertion could not be verified at the time.
❤1
⚠️ JUST IN: Crypto.com allegedly locks user accounts without explanation
Crypto.com is reportedly freezing user accounts without providing clear explanations. According to the post, one user alleges that $500K has been locked for 6 months.
The source states that the platform is now moving to terminate the affected account.
Crypto.com is reportedly freezing user accounts without providing clear explanations. According to the post, one user alleges that $500K has been locked for 6 months.
The source states that the platform is now moving to terminate the affected account.
⚠️ JUST IN: Greek Police Arrest 17 Over Crypto Scam
Greek police arrested 17 individuals allegedly tied to an investment scam that reportedly drew over 10,000 participants. Authorities state that the operation used an online platform to promise doubled returns within 50 days, amassing roughly $8M.
Investigators have verified 18 victims who suffered total losses of €55,970, and inquiries remain active.
Greek police arrested 17 individuals allegedly tied to an investment scam that reportedly drew over 10,000 participants. Authorities state that the operation used an online platform to promise doubled returns within 50 days, amassing roughly $8M.
Investigators have verified 18 victims who suffered total losses of €55,970, and inquiries remain active.
⚠️ JUST IN: Roblox GDPR system abused for restricted usernames
Individuals reportedly exploited the Roblox GDPR system to secure rare account usernames featuring restricted characters. This vulnerability allowed the creation of handles that typically violate standard platform naming policies.
The loophole now appears to be resolved. Consequently, the affected accounts have had their usernames reset to roblox_user_ followed by numbers.
Individuals reportedly exploited the Roblox GDPR system to secure rare account usernames featuring restricted characters. This vulnerability allowed the creation of handles that typically violate standard platform naming policies.
The loophole now appears to be resolved. Consequently, the affected accounts have had their usernames reset to roblox_user_ followed by numbers.
⚠️ JUST IN: Crypto whale loses funds to phishing site
A cryptocurrency investor holding assets since 2017 with a $4M portfolio suffered a $160K loss after connecting a wallet to a fraudulent exchange platform.
The malicious actors drained $160K from the account before the investor managed to secure the remainder of the digital holdings.
A cryptocurrency investor holding assets since 2017 with a $4M portfolio suffered a $160K loss after connecting a wallet to a fraudulent exchange platform.
The malicious actors drained $160K from the account before the investor managed to secure the remainder of the digital holdings.
⚠️ JUST IN: Crypto hacker guilty of $50m theft
Jonathan Spalletta, known as Cthulhon, surrendered and was found guilty of stealing over $50 million from Uranium Finance and laundering the funds through Tornado Cash.
The hacker used the stolen assets to purchase rare items, including a $500,000 Black Lotus card and Pokémon cards, with his sentence pending.
Jonathan Spalletta, known as Cthulhon, surrendered and was found guilty of stealing over $50 million from Uranium Finance and laundering the funds through Tornado Cash.
The hacker used the stolen assets to purchase rare items, including a $500,000 Black Lotus card and Pokémon cards, with his sentence pending.
⚠️ JUST IN: Conduit sues Tether over frozen USDT funds
Conduit has initiated legal action against Tether in New York, alleging that the firm improperly froze $2.76 million worth of USDT. According to the filing, Tether declined to release the assets despite multiple efforts by Conduit to resolve the dispute.
The ongoing legal challenge leaves Conduit without access to its capital, as the disputed funds remain locked by Tether without justification.
Conduit has initiated legal action against Tether in New York, alleging that the firm improperly froze $2.76 million worth of USDT. According to the filing, Tether declined to release the assets despite multiple efforts by Conduit to resolve the dispute.
The ongoing legal challenge leaves Conduit without access to its capital, as the disputed funds remain locked by Tether without justification.
⚠️ JUST IN: US Government Transfers $470M in Seized Crypto
The US government has reportedly transferred approximately $470 million in seized cryptocurrency, featuring Bitcoin, WBTC, and USDT, into wallets connected to Coinbase Prime.
These digital assets originate from seizures linked to the 2016 Bitfinex hack as well as FTX and Alameda, though no sale has been confirmed yet.
The US government has reportedly transferred approximately $470 million in seized cryptocurrency, featuring Bitcoin, WBTC, and USDT, into wallets connected to Coinbase Prime.
These digital assets originate from seizures linked to the 2016 Bitfinex hack as well as FTX and Alameda, though no sale has been confirmed yet.
⚠️ JUST IN: Telegram Bot Vulnerability Leads to Exploitation
A user exploited a Telegram payment and refund vulnerability for two months, generating approximately $4.5M in Stars. According to the source, the bug allowed stars to persist in balances while specific gift purchases triggered partial refunds, enabling the cycle to repeat.
Reportedly, around $1.5 million was withdrawn before Telegram restricted gift transfers. The acquired stars were subsequently spent on luxury gifts and rare Plush Pepe NFTs.
A user exploited a Telegram payment and refund vulnerability for two months, generating approximately $4.5M in Stars. According to the source, the bug allowed stars to persist in balances while specific gift purchases triggered partial refunds, enabling the cycle to repeat.
Reportedly, around $1.5 million was withdrawn before Telegram restricted gift transfers. The acquired stars were subsequently spent on luxury gifts and rare Plush Pepe NFTs.
⚠️ JUST IN: SIM SWAPPER SENTENCED FOR CRYPTO THEFT
Ajay Shinjin, 25, received a 2.5 year prison sentence in London for orchestrating a SIM-swapping scheme that targeted four victims and stole nearly £200K ($260K) in cryptocurrency in November 2021.
City of London Police reported that he personally received over £44K of the funds, which were spent on Dubai trips, an upscale apartment, and gold-plated dental grills before his re-arrest at Heathrow in October 2023 and guilty plea on September 28, 2026.
Ajay Shinjin, 25, received a 2.5 year prison sentence in London for orchestrating a SIM-swapping scheme that targeted four victims and stole nearly £200K ($260K) in cryptocurrency in November 2021.
City of London Police reported that he personally received over £44K of the funds, which were spent on Dubai trips, an upscale apartment, and gold-plated dental grills before his re-arrest at Heathrow in October 2023 and guilty plea on September 28, 2026.
⚠️ JUST IN: LEDGER WALLET DRAINING CAMPAIGN HITS $86 MILLION
Onchain investigator Specter reports a wave of Ledger wallet drains across X and Reddit, with theft addresses receiving funds from hundreds of victim wallets across Ethereum, TRON and Bitcoin.
According to the onchain investigator, total identified losses from this campaign now exceed $86M.
Onchain investigator Specter reports a wave of Ledger wallet drains across X and Reddit, with theft addresses receiving funds from hundreds of victim wallets across Ethereum, TRON and Bitcoin.
According to the onchain investigator, total identified losses from this campaign now exceed $86M.