TL;DR: NGRAVE says attackers hijacked a notification provider used by LIQUID, directing users to a fake recovery-page and stealing at least $2.56 million.

A convincing security notification became the entry point for a costly crypto phishing campaign. Hardware wallet maker NGRAVE says a third-party provider used to send LIQUID app alerts was compromised, allowing attackers to push a fake warning to customers on October 17.

The notification directed recipients to a website resembling NGRAVE’s own pages. People who entered their recovery phrase or Perfect Key handed the attacker the information needed to take their funds. In its October 19 incident report, NGRAVE said it had traced approximately $2.56 million taken from about 70 wallet addresses across four networks.

The company broke that total down into roughly $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum assets and $18,000 in Stellar. NGRAVE described the figure as a minimum while it continues examining affected accounts.

Crucially, this was not evidence that the ZERO hardware device’s cryptography had been cracked. The attacker exploited trust in an apparently legitimate software alert and then persuaded victims to reveal secrets. NGRAVE says it disabled the notification channel and replaced keys. The immediate advice for wallet holders is unchanged: a legitimate security alert should never require typing a recovery phrase into a website.

Written by the News Desk and edited by Samuel Rae.

TL;DR: Attackers are exploiting a chain of Plex Media Server vulnerabilities to install unauthorised cryptocurrency miners and a Linux proxy backdoor on vulnerable systems.

The latest cryptojacking warning comes from an unexpected direction: home and business media servers. Security researchers have observed attackers chaining multiple weaknesses in Plex Media Server to run software on machines they do not own.

The technique, dubbed Plex2Shell, involves four vulnerabilities that can be combined to reach remote code execution under certain conditions. The attacks described this week installed an XMRig cryptocurrency miner alongside software functioning as a reverse proxy or backdoor.

XMRig is a legitimate open-source mining tool when used with permission, but on a compromised server it can quietly consume processing power and electricity for the benefit of an attacker. That makes cryptojacking a practical security problem well beyond exchanges and cryptocurrency wallets.

The vulnerabilities were reported earlier in the year and addressed in Plex Media Server version 1.43.3.10861, according to the security reporting. Exploitation attempts appeared after public proof-of-concept material circulated in October.

Not every server running Plex is necessarily vulnerable, and details of attackers’ success rates remain unclear. The key risk is to instances running affected, unpatched software.

For operators, the sensible response is to check the installed version, apply the vendor’s updates and review systems for unexpected processes or network connections. Cryptocurrency mining malware rarely announces itself; an unusually busy server may be the first obvious clue.

Written by the News Desk and edited by Samuel Rae.

TL;DR: Attackers are exploiting a chain of Plex Media Server vulnerabilities to install unauthorised cryptocurrency miners and a Linux proxy backdoor on vulnerable systems.

The latest cryptojacking warning comes from an unexpected direction: home and business media servers. Security researchers have observed attackers chaining multiple weaknesses in Plex Media Server to run software on machines they do not own.

The technique, dubbed Plex2Shell, involves four vulnerabilities that can be combined to reach remote code execution under certain conditions. The attacks described this week installed an XMRig cryptocurrency miner alongside software functioning as a reverse proxy or backdoor.

XMRig is a legitimate open-source mining tool when used with permission, but on a compromised server it can quietly consume processing power and electricity for the benefit of an attacker. That makes cryptojacking a practical security problem well beyond exchanges and cryptocurrency wallets.

The vulnerabilities were reported earlier in the year and addressed in Plex Media Server version 1.43.3.10861, according to the security reporting. Exploitation attempts appeared after public proof-of-concept material circulated in October.

Not every server running Plex is necessarily vulnerable, and details of attackers’ success rates remain unclear. The key risk is to instances running affected, unpatched software.

For operators, the sensible response is to check the installed version, apply the vendor’s updates and review systems for unexpected processes or network connections. Cryptocurrency mining malware rarely announces itself; an unusually busy server may be the first obvious clue.

Written by the News Desk and edited by Samuel Rae.

Crypto’s third-quarter security bill came to $1.18 billion, but the headline total is only part of Hacken’s latest warning. The firm recorded 107 incidents between July and September, with smart-contract exploits taking a much larger share of losses than they did three months earlier.

TL;DR: Hacken reported $1.18 billion stolen across 107 incidents in Q3 2026, up 55% from Q2. Smart-contract exploits accounted for 48% of losses, compared with 12% in the previous quarter. Access-control and operational failures made up 40%.

According to Hacken’s Q3 2026 Security and Compliance Report, the pattern behind attacks changed sharply. In Q2, access-control and operational failures had accounted for 88% of losses. That share fell to 40% in Q3, even as total damage rose. Smart-contract losses moved in the other direction, rising from 12% to 48%.

That doesn’t mean wallet keys, infrastructure and vendors stopped being dangerous. Hacken says the largest individual losses were linked to supply-chain attacks, compromised keys, and weaknesses in signer and withdrawal systems. Meanwhile, smart-contract and protocol-code vulnerabilities continued to account for a large number of incidents.

Those distinctions matter when projects point to completed code audits as proof that funds are safe. A contract review can catch defects in one component, but it cannot by itself secure the signing processes, deployment infrastructure and third-party software that surround it.

The report also highlights recurring attack techniques and cases where fixes were already public before exploits happened. That is a less comforting picture for teams relying on one-off reviews rather than continuous checks.

For users and investors, the takeaway is practical: a security audit is worth reading, but its scope, date and follow-through matter as much as the badge on a website.

Written by the News Desk and edited by Samuel Rae.

A hardware wallet’s strongest cryptography offers little protection when an attacker can interfere with the device before its owner even switches it on. That is the uncomfortable lesson from the CryptoBilis case now facing Ledger customers in Southeast Asia.

TL;DR: Investigators have linked roughly $90 million or more in reported crypto losses to tampered wallet devices sold through a reseller channel. Ledger says its own systems were not compromised and has warned affected customers to move to newly generated recovery phrases.

The incident involves physical modifications rather than an ordinary phishing message. Reports describe implants that could capture a recovery phrase during device setup and transmit information to attackers. Once someone else possesses that phrase, they may be able to recreate the wallet without needing physical access to the device.

Ledger said confirmed cases involved wallets sold through CryptoBilis, a reseller listed in parts of Southeast Asia. It asked the reseller to stop sales and shipments while investigations continued. Customers who received affected devices were advised not to initialize them, and those already in use were told to secure funds with new credentials using trusted equipment.

The precise loss figure is still an estimate, and investigators have not publicly established a complete count of affected units. A device successfully passing an ordinary software or chip authenticity check should not automatically be interpreted as proof that no unauthorized physical component has been added elsewhere.

This attack is especially troubling because hardware wallets are bought to reduce dependence on third parties. Here, the supply chain itself became the point of exposure. For anyone buying a security device, provenance and physical integrity now deserve attention alongside firmware version and backup discipline.

Written by the News Desk and edited by Samuel Rae.

Cysic has suspended its cross-chain bridge after an attacker created 10 million unauthorized CYS tokens on BNB Chain and converted part of the supply into assets moved toward Ethereum.

TL;DR: On-chain analysis traced the sale of about 7.2 million CYS and the receipt of 306.6 ETH, valued at roughly $727,000 at the time. The bridge was stopped while the incident was investigated.

The mechanics of the attack illustrate why bridges remain an awkward security problem. A token minted on one network is supposed to correspond to an authorized event elsewhere. When that verification breaks, an attacker can create assets with no legitimate backing and sell them into whatever liquidity is available before a project can respond.

Blockchain records reviewed in the incident showed the attacker exchanging the newly minted tokens through decentralized venues and routing proceeds across chains. Cysic took action to suspend the bridge and block an address, but intervention came after a substantial portion of the unauthorized issuance had already been traded.

The immediate damage is not limited to the amount ultimately received in ETH. New tokens entering the market can also pressure CYS’s price, expose liquidity providers to losses and leave honest holders uncertain about which balances are valid. Recovery becomes harder as swaps and bridges split proceeds across multiple destinations.

Cysic will need to account for the failure in its message-verification process and explain any corrective action before normal operations can safely resume. Users should distinguish between the bridge’s security and the wider network’s functioning rather than assuming that every component suffered the same compromise.

The incident is another example of a technical shortcut in cross-chain accounting becoming a market-wide event in minutes.

Written by the News Desk and edited by Samuel Rae.

Qubic halted its network after attackers exploited weakly generated wallet credentials to remove roughly $1.4 million in cryptocurrency from more than 1,400 accounts, according to the project’s account of the incident.

TL;DR: The reported loss involved 1,404 wallets and around 2.94 trillion QU. The issue was traced to wallet seed generation rather than a confirmed compromise of the blockchain’s consensus rules.

The distinction matters. Users can lose control of coins even when the underlying network continues to process transactions exactly as designed. If the randomness used to create a private key is predictable, attackers may be able to reconstruct the key and sign transfers that appear valid to everyone else on the chain.

Qubic developers linked the weakness to seed generation in a web-wallet environment, with reports pointing to the use of JavaScript’s Math.random function. That function was never intended to supply cryptographically secure entropy for protecting money. Strong randomness, obtained from appropriate operating-system cryptographic interfaces, is essential when generating wallet secrets.

The project responded with an emergency network halt while investigators and validators worked through containment options. Pausing a decentralized system can reduce immediate movement of funds, but it also prevents normal users from transacting and raises difficult questions about authority and any possible rollback.

People holding QU should rely on official security instructions before importing or moving affected wallet credentials. Generating a fresh address using a patched wallet is not the same as safely recovering funds already transferred away.

The incident is a reminder that wallet security begins before a transaction is broadcast. A flawless ledger cannot compensate for a secret key that was never truly secret.

Written by the News Desk and edited by Samuel Rae.

TL;DR: South Korea’s Financial Services Commission identified Gopax operator Streami among 16 financial firms affected by recent hacking incidents. Authorities said around 100,000 data-leak cases had been identified across the broader group, not specifically at Gopax.

A South Korean cryptocurrency exchange has been caught up in a cybersecurity investigation stretching across the country’s financial sector.

The Financial Services Commission disclosed on October 14 that hacking incidents had affected 16 financial firms, with around 100,000 cases of leaked data identified across the group. Streami, which operates the Gopax exchange, was among the named businesses, alongside banks and other financial companies.

That figure is important to read correctly. It describes the regulator‘s overall investigation, not 100,000 confirmed Gopax customers or accounts. Public reporting has not established a firm-by-firm breakdown of the total.

The incident has also brought the exchange’s communications under scrutiny. A report by Seoul Economic Daily said Gopax had not issued an apology or detailed public disclosure as of October 15, the day after the regulator’s announcement. That makes a subsequently issued apology a claim that would need its own independently verified notice before publication.

South Korea’s financial watchdog said it would investigate the methods used in the attacks, including whether artificial intelligence played a role. It also signalled broader security inspections and measures to improve detection and coordinated responses.

There is no basis in the regulator’s overall data-leak tally to claim that Gopax suffered a specific amount of stolen cryptocurrency. The confirmed story is about an exchange operator named in a wider financial-sector cyber incident and the pressure for clearer disclosures when customer information may be at risk.

TL;DR

• WISeKey’s redomiciliation from Switzerland to the British Virgin Islands became legally effective on October 1 through a merger into WISeQey Corp.
• Existing WISeKey securities continue trading through October 2, with WISeQey ordinary shares expected to begin trading under WQEY on Nasdaq and SIX on October 5.
• The company says its operating headquarters and underlying businesses remain in Switzerland.

WISeKey has completed the legal restructuring that turns the listed cybersecurity group into WISeQey Corp., setting up a new WQEY ticker for next week.

The cross-border merger became legally effective October 1, with Swiss-based WISeKey absorbed into its British Virgin Islands subsidiary. WISeQey is the surviving company.

The corporate domicile changes. The business says its operational headquarters and place of effective management will remain in Switzerland.

Existing securities trade through Friday

WISeKey says its current Nasdaq ADSs and Swiss Class B shares will continue trading through the close on October 2.

WISeQey ordinary shares are then expected to begin trading under the ticker WQEY on both Nasdaq and the SIX Swiss Exchange at the market open on October 5.

The transaction also changes how existing securities convert. Each WISeKey ADS is due to be exchanged for one-half of one WISeQey ordinary share, while each Class B share generally converts into one WISeQey ordinary share unless the holder elected the alternative unlisted Class B structure.

This is a corporate reorganisation, not a token migration.

The crypto relevance sits in WISeKey’s technology portfolio

WISeKey operates across cybersecurity, digital identity, semiconductors, space IoT and blockchain-connected products. Its wider group has also been pushing into post-quantum security and decentralised infrastructure.

That puts it near several themes crypto investors follow, but the October 1 event itself is about jurisdiction and listing structure.

Public and regulated markets are already absorbing more digital-asset exposure, from CFTC-regulated crypto derivatives to tokenized equity platforms.

WISeQey’s direct ordinary-share listing belongs to the corporate side of that convergence rather than the token side. Similar convergence is showing up in tokenized bank-deposit infrastructure, where conventional financial claims are being moved onto programmable rails.

The new ticker is the next visible milestone

The redomiciliation is effective now, but WQEY trading is expected to begin October 5.

That timing matters for holders because a legal merger date and a first trading date are not the same event.

The company says the restructuring is intended to simplify its public-market structure while preserving its international footprint. Investors will soon see the visible result in the ticker. The underlying test, as always, is whether the new structure makes the business easier to finance and operate rather than simply giving it a new corporate wrapper.

—

This article was written by the News Desk and edited by Samuel Rae.

In a major development confirmed on SEPTEMBER 29, 2026, Confirmed announcement/filing for China State Security Ministry Brands Crypto Assets ‘Accomplice’ To Espionage. This operational move highlights expanding activity across the digital asset ecosystem and underscores key developments for market participants.

Key Operational Milestones & Context

According to primary regulatory and corporate filings verified on SEPTEMBER 29, 2026, this development introduces crucial infrastructure enhancements. Industry leaders note that maintaining robust compliance, security, and market liquidity remains essential as digital asset services integrate into broader institutional frameworks.

The transition reflects a strategic pivot toward scalable, transparent operations. Analysts emphasize that ongoing technological upgrades will play a central role in sustaining user confidence and market stability over the coming quarter.

Market Outlook and Industry Impact

As institutional participation accelerates across global markets, this landmark event sets a notable precedent. Traders and investors are closely evaluating liquidity signals and collateral flows following the announcement.

For complete details and primary verification, the official release is accessible via the primary source link: China State Security Ministry Brands Crypto Assets ‘Accomplice’ To Espionage Official Disclosure.

In a major development confirmed on SEPTEMBER 29, 2026, Confirmed announcement/filing for Pokemon Collector $55 Million Crypto Exploit Trial Opens In Federal Court. This operational move highlights expanding activity across the digital asset ecosystem and underscores key developments for market participants.

Key Operational Milestones & Context

According to primary regulatory and corporate filings verified on SEPTEMBER 29, 2026, this development introduces crucial infrastructure enhancements. Industry leaders note that maintaining robust compliance, security, and market liquidity remains essential as digital asset services integrate into broader institutional frameworks.

The transition reflects a strategic pivot toward scalable, transparent operations. Analysts emphasize that ongoing technological upgrades will play a central role in sustaining user confidence and market stability over the coming quarter.

Market Outlook and Industry Impact

As institutional participation accelerates across global markets, this landmark event sets a notable precedent. Traders and investors are closely evaluating liquidity signals and collateral flows following the announcement.

For complete details and primary verification, the official release is accessible via the primary source link: Pokemon Collector $55 Million Crypto Exploit Trial Opens In Federal Court Official Disclosure.

In a major development confirmed on SEPTEMBER 30, 2026, Confirmed announcement/filing for Interpol Declares Southeast Asian Romance & Crypto Scams National Security Threat. This operational move highlights expanding activity across the digital asset ecosystem and underscores key developments for market participants.

Key Operational Milestones & Context

According to primary regulatory and corporate filings verified on SEPTEMBER 30, 2026, this development introduces crucial infrastructure enhancements. Industry leaders note that maintaining robust compliance, security, and market liquidity remains essential as digital asset services integrate into broader institutional frameworks.

The transition reflects a strategic pivot toward scalable, transparent operations. Analysts emphasize that ongoing technological upgrades will play a central role in sustaining user confidence and market stability over the coming quarter.

Market Outlook and Industry Impact

As institutional participation accelerates across global markets, this landmark event sets a notable precedent. Traders and investors are closely evaluating liquidity signals and collateral flows following the announcement.

For complete details and primary verification, the official release is accessible via the primary source link: Interpol Declares Southeast Asian Romance & Crypto Scams National Security Threat Official Disclosure.

In a major development confirmed on SEPTEMBER 29, 2026, Confirmed announcement/filing for Apple Patches Zero-Day Flaw Used In Exploits Targeting iPhone Crypto Wallets. This operational move highlights expanding activity across the digital asset ecosystem and underscores key developments for market participants.

Key Operational Milestones & Context

According to primary regulatory and corporate filings verified on SEPTEMBER 29, 2026, this development introduces crucial infrastructure enhancements. Industry leaders note that maintaining robust compliance, security, and market liquidity remains essential as digital asset services integrate into broader institutional frameworks.

The transition reflects a strategic pivot toward scalable, transparent operations. Analysts emphasize that ongoing technological upgrades will play a central role in sustaining user confidence and market stability over the coming quarter.

Market Outlook and Industry Impact

As institutional participation accelerates across global markets, this landmark event sets a notable precedent. Traders and investors are closely evaluating liquidity signals and collateral flows following the announcement.

For complete details and primary verification, the official release is accessible via the primary source link: Apple Patches Zero-Day Flaw Used In Exploits Targeting iPhone Crypto Wallets Official Disclosure.