At least 19 wallets linked to prediction market platform Predict.fun have reportedly been drained of approximately 105 ETH, worth $260,000, with investigators tracing the suspected stolen funds through Ethereum to cryptocurrency mixer Tornado Cash. On-chain investigator Naeven reported the suspected…

Hardware wallet manufacturer Keystone has confirmed that hackers stole a device authentication key and exposed personal information belonging to 25,964 customers, forcing the company to destroy 18,835 devices and suspend shipments. According to the company’s October 26 security announcement, attackers…

---

Bitcoin Magazine

PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic”

Government websites in France and Finland and hospital sites in the Netherlands are offline, Cloudflare is seeing attack traffic, and Britain’s National Cyber Security Centre is telling organizations to pull systems if they can’t patch fast. Bitcoin Magazine technical editor Shinobi joins Grace Remington and Sean Hagan to explain what broke in PHP, why memory management mistakes are the most common security flaw, and why AI finding the exploit in hours changes the pace of hacking but not its nature. He also answers the question every Bitcoiner is asking: is Bitcoin exposed?

Chapters:
0:00 The PHP Exploit Takes Government and Hospital Websites Offline
0:54 AI Found the Flaw in Hours: The “Cyber Pandemic” Warning
1:45 What Actually Broke: Memory Management Mistakes Explained
3:06 Why PHP Was Never Secure and Why This One Is Different in Scale
3:47 Is the AI Hacking Story Sensationalized? AI Does 95% of the Work
5:08 The Rough Adjustment Period and Why Shinobi Is Confident About the Other Side
6:41 No Serious Software Will Ship Without an AI Security Audit
7:23 Is Bitcoin Exposed? libsecp256k1, Bitcoin Core and Why Slow Development Was Right
9:30 Take Your Lightning Node Offline and Keep Your Coins in Cold Storage
12:09 Multisig and Sparrow Setup Checks, and Where to Follow Security Engineers

DISCLAIMER: The views and opinions expressed in this show are those of the participants and do not necessarily reflect the official policy or position of BTC Inc., Bitcoin Magazine, or any affiliated entities. This content is provided for informational and educational purposes only and should not be construed as investment, legal, tax, or accounting advice. Nothing contained in this show constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or financial instruments. Viewers should consult their own advisors before making financial or business decisions.

This post PHP Hack: How Bitcoin Will Respond to the “Cyber Pandemic” first appeared on Bitcoin Magazine and is written by Patrick Green.

Electrum releases version 4.8.3 after malicious servers exploit a Bitcoin wallet flaw to redirect payments through fake fee bumps, causing confirmed losses.

Initia has halted its layer-1 blockchain and rollups after security researcher Spreek reported unauthorized token minting and approximately $2.6 million cashed out by an attacker. Initia confirmed in its Oct. 23 statement that the suspension took effect at 3:41:30 p.m.…

Qubic halted its network after attackers exploited weakly generated wallet credentials to remove roughly $1.4 million in cryptocurrency from more than 1,400 accounts, according to the project’s account of the incident.

TL;DR: The reported loss involved 1,404 wallets and around 2.94 trillion QU. The issue was traced to wallet seed generation rather than a confirmed compromise of the blockchain’s consensus rules.

The distinction matters. Users can lose control of coins even when the underlying network continues to process transactions exactly as designed. If the randomness used to create a private key is predictable, attackers may be able to reconstruct the key and sign transfers that appear valid to everyone else on the chain.

Qubic developers linked the weakness to seed generation in a web-wallet environment, with reports pointing to the use of JavaScript’s Math.random function. That function was never intended to supply cryptographically secure entropy for protecting money. Strong randomness, obtained from appropriate operating-system cryptographic interfaces, is essential when generating wallet secrets.

The project responded with an emergency network halt while investigators and validators worked through containment options. Pausing a decentralized system can reduce immediate movement of funds, but it also prevents normal users from transacting and raises difficult questions about authority and any possible rollback.

People holding QU should rely on official security instructions before importing or moving affected wallet credentials. Generating a fresh address using a patched wallet is not the same as safely recovering funds already transferred away.

The incident is a reminder that wallet security begins before a transaction is broadcast. A flawless ledger cannot compensate for a secret key that was never truly secret.

Written by the News Desk and edited by Samuel Rae.