Blockstream has refused to pay a ransom for roughly 598.5 BTC that remains under the control of the actors behind the Liquid Network exploit after 3,400 BTC was returned earlier this week. Blockstream said in an X post on Sept.β¦
Cronos has confirmed that $9.19 million remains unrecovered after an attacker borrowed $120.4 million from Tectonic, while a validator-backed rollback reversed roughly $111.2 million in affected value. According to a post-mortem published by Cronos on Monday, the attacker manipulated theβ¦
Liquid Network has recovered 3,400 BTC worth about $269.2 million from the self-described white-hat hackers behind a 4,000 BTC withdrawal, although nearly $47 million remains outstanding. Liquid Network has recovered 85% of the withdrawn Bitcoin On-chain data shows that theβ¦
Rocket has suspended deposits, withdrawals and trading after an attacker manipulated a dormant perpetual market and withdrew approximately $287,000 in positive PnL from the platformβs Bridge. Rocket said in a Sept. 7 update on X that the security incident occurredβ¦
TAC, a Cosmos-based EVM sidechain connected to the TON ecosystem, has halted block production after a supply-related exploit.
The incident occurred on August 22, according to public incident materials. TAC connects Ethereum-based applications with the TON network, but the exploit affected the TAC sidechain and its token supply, not the main TON blockchain.
That distinction is critical.
The TON mainnet should not be described as halted or compromised based on this incident. The affected network is TAC, an EVM sidechain connected to TON.
TL;DR
TAC halted block production after a supply exploit.
The incident affected the TAC sidechain and its token supply.
TON mainnet was not the halted network.
Exploit Details
TAC halted block production after identifying a security exploit tied to token supply.
A halt is a serious operational step. It means the network stopped producing blocks while the team investigated or contained the issue. For users, that can affect transfers, applications, liquidity, and confidence until operations resume.
The key point is scope.
This was not a halt of TON mainnet. It was a halt of the TAC sidechain, which is designed to connect EVM applications with TON-related infrastructure.
Scope matters because crypto incidents are often misreported when networks are interconnected.
Why EVM Sidechains Carry Different Risks
Sidechains can expand an ecosystemβs functionality.
They may bring Ethereum-compatible applications, tooling, wallets, and smart contract patterns to networks that do not natively operate like Ethereum. That can be useful for developer adoption.
But sidechains also create additional risk surfaces.
They have their own validators, contracts, bridges, token mechanics, and governance. A problem on a sidechain may not compromise the base network, but it can still affect users who rely on that sidechain.
TACβs halt shows why those distinctions matter.
Supply Exploits Are Serious
A supply exploit can be especially dangerous because it affects trust in the tokenβs accounting.
If an attacker can mint, inflate, duplicate, or manipulate supply, the economic integrity of the network is at risk. Teams may halt block production to prevent further damage while investigating.
That can be the responsible move, but it is disruptive.
Users need clear communication about what assets are affected, whether balances are safe, whether transactions will be rolled back, and how the network plans to restart.
TON Connection Needs Careful Framing
The TON connection is part of the story, but it should not be exaggerated.
TACβs purpose is to connect EVM applications with TON. That makes the incident relevant to the broader TON ecosystem. But relevance is not the same as direct impact on TONβs base chain.
The clean framing is: TAC is connected to TON, but TAC is the network that halted.
That protects readers from assuming TON itself stopped.
What Comes Next
The next questions are operational.
When will TAC resume block production? What caused the supply exploit? Will balances be adjusted? Will contracts be patched? Will bridges or related applications need action from users?
Until those questions are answered, caution is warranted.
For the wider ecosystem, the incident is another reminder that sidechain infrastructure can introduce risk even when the base network remains unaffected.
TACβs halt is serious. It just needs to be understood at the correct layer.
SecondFi has renewed its bounty offer to the attacker behind a $16.1 million Cardano exploit, as the team continues trying to recover 16.1 million ADA stolen in a June incident.
The validated notes show the exploit affected 374 wallets and stemmed from a key-generation vulnerability. SecondFi says it secured 129 million ADA during containment, but the stolen funds remain the focus of the recovery effort.
Security researchers at Groom Lake reportedly observed behavior resembling techniques previously linked to North Koreaβs Lazarus Group, but that attribution has not been officially confirmed. That caveat is important. Similar behavior is not proof of identity.
SecondFi has also confirmed it will not resume normal operations.
That makes this less of a comeback story and more of a recovery-and-containment story.
For more details, visit the official Support platform.
TL;DR
SecondFi renewed its bounty offer after 16.1 million ADA was stolen.
The exploit affected 374 wallets and involved a key-generation vulnerability.
Lazarus-like behavior has been noted, but attribution is not confirmed.
The Key-Generation Detail Is The Core Problem
A key-generation vulnerability is one of the worst kinds of wallet or protocol failures.
If a private key, seed, or signing path is generated in a weak or predictable way, users can lose funds even if they never knowingly gave anything away. That makes the failure feel especially unfair because normal user caution may not be enough.
SecondFiβs case appears to fall into that broader category.
The exploit did not just involve a user clicking a phishing link or approving a bad transaction. It involved the foundations of how wallet security was established.
That is why the recovery effort matters, but also why trust is so hard to rebuild afterward.
Once users believe key generation was flawed, the platform has a much deeper credibility problem than a normal smart contract bug.
The 129M ADA Containment Figure Matters
SecondFiβs claim that it secured 129 million ADA during containment is an important part of the story.
In any exploit, the headline number usually focuses on what was lost. But what was protected also matters. If containment prevented a much larger loss, that should be recognized.
Still, users who lost funds will naturally focus on recovery.
A bounty offer is one way to create an incentive for the attacker to return assets. It does not guarantee success. Some attackers negotiate. Some ignore offers. Some launder funds. Some return partial amounts.
The outcome often depends on how traceable the funds are, whether exchanges and bridges can block movement, whether law enforcement is involved, and whether the attacker believes keeping the funds is riskier than taking a bounty.
Attribution Should Stay Careful
The Lazarus-like behavior note is sensitive.
Crypto has seen multiple high-profile hacks attributed to North Korean-linked groups, and Lazarus has become a familiar name in security reporting. But attribution is difficult, especially when based on behavioral patterns rather than official findings.
Techniques can be copied. Infrastructure can be reused. Analysts can identify similarities without being able to prove who is behind an attack.
That is why this story should not say Lazarus did it unless an official or directly supported source confirms it.
The responsible framing is that researchers observed behavior resembling known techniques, while attribution remains unconfirmed.
SecondFi Not Resuming Normal Operations Changes The Tone
SecondFi confirming that it will not resume normal operations is a major detail.
Some exploited protocols return after a fix, audit, migration, or recapitalization. Others wind down because the technical, legal, and reputational damage is too great.
SecondFi appears to be in the second category.
That gives users clarity, even if it is not the outcome they wanted. The focus becomes recovery, claims, communications, and ensuring any remaining protected funds stay safe.
For the Cardano ecosystem, the incident is a reminder that DeFi security is not only about chain-level reliability. Application-layer key management, wallet generation, custody assumptions, and operational controls all matter.
A secure base chain cannot save a flawed application design.
Recovery Is Now The Main Story
The renewed bounty offer keeps the door open for returned funds, but users should treat the situation cautiously.
Until funds are returned or a formal recovery plan is completed, the story remains unresolved. The best outcome would be a negotiated return. The more difficult outcome is a long tracing and enforcement process.
For Cardano DeFi, the lesson is clear.
As more applications handle larger sums of ADA, security expectations need to rise. Audits, key-generation reviews, independent testing, incident response plans, and transparent communications are not optional. They are what separate experimental apps from infrastructure users can trust.
SecondFiβs exploit shows how quickly that trust can break.
This article is based on SecondFi incident and recovery materials, including the renewed bounty update.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by Support. at Support
A hacker tied to the Trusted Volumes exploit has returned 1,122 ETH to the protocol, closing part of a security incident that began with a multi-million-dollar exploit earlier this year.
The on-chain recovery is unusual because the attacker did not return everything. Instead, the wallet linked to the exploit sent back roughly $2 million worth of ETH while retaining another large amount as what now looks like a de facto bounty. That kind of outcome is familiar in DeFi, where projects sometimes negotiate with attackers after an exploit rather than risk losing the full amount forever.
The returned funds matter because they reduce the damage for the protocol and its users. But the structure of the settlement also shows how messy DeFi security remains. When smart contracts fail, the market often ends up relying on public pressure, wallet tracking, and informal negotiation rather than a clean legal process.
The Trusted Volumes attacker returned 1,122 ETH to the protocol inventory.
The exploit originally drained about $5.9 million through a smart contract vulnerability.
The attacker appears to have retained roughly $2 million as a bounty-style settlement.
What Happened With Trusted Volumes?
The exploit traces back to a vulnerability in Trusted Volumesβ RFQ swap proxy. According to the on-chain evidence, the May 7 attack drained approximately $5.9 million in assets through a signature-check bypass.
That is the kind of vulnerability that can be especially damaging in DeFi because it sits close to the execution layer of a protocol. If a swap proxy accepts an invalid or improperly checked instruction, an attacker may be able to move funds in a way the system was never meant to allow.
The important update now is the return of 1,122 ETH from the attacker wallet to protocol inventory. The primary source for the story is the wallet and transaction evidence on Etherscan, which shows the recovery leg of the movement.
This does not necessarily mean the protocol has been made whole. It means a meaningful part of the exploited funds has come back.
That distinction matters. A partial recovery can be better than nothing, but it still leaves users and the wider market asking why the vulnerability existed, how quickly it was detected, and whether the protocol has made changes to prevent a repeat.
Why DeFi Exploit Settlements Keep Happening
Crypto has developed a strange pattern around major exploits.
In traditional finance, a theft usually leads to police reports, frozen accounts, and court processes. In DeFi, the first response is often public wallet tracking. The attackerβs address gets labelled. On-chain analysts follow the movement of funds. Protocol teams may publish messages offering a bounty if the money is returned.
Sometimes attackers accept. Sometimes they disappear into mixers, bridges, or exchange routes. Sometimes they return a portion and keep the rest.
That appears to be the shape of this case.
The reason this happens is simple: blockchains make funds visible, but not always recoverable. If an attacker controls the private keys, the protocol cannot simply reverse the transaction. The best practical outcome may be to offer a settlement before the funds are moved further away.
That is uncomfortable, but it is also realistic.
For users, the lesson is that code risk is not abstract. Even protocols with real activity can suffer from a small implementation flaw that becomes a major loss. For developers, the lesson is even sharper: signature validation, access controls, proxy logic, and upgrade paths need aggressive review because attackers only need one weak point.
The Recovery Helps, But It Does Not Erase The Exploit
The return of 1,122 ETH is clearly positive for Trusted Volumes, but it should not be treated as a full reset.
An exploit still happened. Funds were still removed. The attacker still appears to have kept a significant sum. The protocol still needs to show that the underlying issue has been addressed and that users can trust the system going forward.
That matters because DeFi confidence is fragile after security incidents. Users may forgive a protocol that responds quickly, communicates clearly, and recovers funds. They are less forgiving when teams stay vague, downplay the incident, or fail to explain what changed.
The strongest next step for Trusted Volumes would be a clear post-mortem: what failed, how the attacker used it, how the contract logic has been fixed, and whether any user balances remain affected.
Until then, the market can recognise the recovery without pretending the episode is over.
This is also a useful reminder for the wider sector. DeFi security is not only about preventing hacks. It is about incident response, transparency, on-chain monitoring, and whether projects can recover enough trust after something goes wrong.
Trusted Volumes got some funds back. The harder job is proving the system is safer than it was before the exploit.
This article is based on Etherscan wallet and transaction data.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by Etherscan. at Etherscan
Login
