Bluchip News

☠️ Shadow Economy Part 1 of 3: The middlemen Domain admin access sells for tens of thousands. Medical records: $500 and up. Someone verifies the stolen credentials, packages them, lists them. The buyer takes the building. The seller never touches it. Global damage runs $10.5 trillion a year. The middlemen collect the service fee. The rest is the victim's. One account changes hands. The seller gets paid. The buyer gets the network. The victim gets the bill. ☠️ 地下经济 第一部分：中间商 域管理员权限卖数万到数十万美元。医疗记录：500美元起。有人验证偷来的凭证，打包，上架。买家拿走整栋楼。卖家从不碰它。全球损失每年10.5万亿美元。中间商拿走服务费。剩下的，是受害者的。 一个账号转手。卖家收钱。买家拿到网络。受害者拿到账单。 @bluchipnews

BLUCHIP October 1. For the underground, by the underground. Bluechip OTC opens to the public. Universal KYC verification service. Tailored on and off-ramp solutions. Global coverage. BLUCHIP OTC. The escrow standard. Every deal backed. No exceptions. Nothing changes for those inside. The wait is over for those outside. The name speaks for itself. We tell you half the story. The rest you fill it in, as long as the villain wins. For the underground, by the underground. Death before dishonor. BLUCHIP 十月一日。 来自地下，为了地下。 Bluechip OTC 向公众开放。 通用 KYC 验证服务。 定制化出入金解决方案。 全球覆盖。 BLUCHIP OTC。 托管标准。 每一笔交易都有保障。没有例外。 里面的人，什么都不变。外面的人，不用再等。 名字说明一切。 我们告诉你一半的故事。剩下的你自己填，只要反派赢。 来自地下，为了地下。 宁死不屈。 @bluchipotc @bluchipnews @bluchipchat

☠️ September closes at $2.3B stolen, 11B records gone Year to date through September, crypto theft hit $2.3 billion across 86 major incidents. Bitget's final tally: $387.5 million. Ransomware is projected to burn $74 billion globally, $2,400 per second. Data breaches exposed 11 billion records and 780 million passwords. Telus Digital alone lost up to a petabyte. Berlin refused a ~$2M ransom (30 BTC) and saw 5.79 TB published though the Senate says none of it was national-security classified. Canvas hackers claimed 275 million students, a figure that remains unconfirmed. Two point three billion stolen. Eleven billion records gone. A petabyte from one telecom. All of it needs a clean place to sleep. ☠️ 九月收官：23亿美元被盗，110亿条记录泄露 截至九月底，今年加密领域被盗金额达23亿美元，涉及86起重大事件。Bitget 最终损失修正为3.875亿美元。勒索软件全球损失预计达740亿美元，每秒2,400美元。数据泄露暴露110亿条记录和7.8亿个密码。Telus Digital 一家就丢了高达1PB数据。柏林拒绝约200万美元赎金（30枚比特币），随后5.79TB数据被公开，但参议院称其中不涉及国家安全机密。Canvas 黑客声称影响2.75亿学生，该数字尚未证实。 二十三亿 stolen。一百一十亿条记录 gone。一家电信公司，一个 petabyte。所有这些，都需要一个干净的地方安睡。 @bluchipnews

☠️ FBI to ShinyHunters: we know where you are FBI Cyber Division chief Brett Leatherman posted a video address telling the remaining ShinyHunters members to reach out. His words: “You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.” The FBI says the group breached more than 140 organizations and took at least $70 million in extortion payments since last year. The address followed the Dutch arrest of a 24 year old Amsterdam man on September 15. ShinyHunters says he has no association with the group and called Dutch police unskilled and incompetent. The FBI says arrests change who talks. The group says it is theater. Omertà, but the data keeps talking. ☠️ FBI 对 ShinyHunters 喊话：我们知道你在哪 FBI 网络部门负责人 Brett Leatherman 发布视频，向 ShinyHunters 剩余成员喊话，要求他们主动联系。原话：“你们知道怎么找到我们，我们也知道怎么找到你们。趁选择权还在你们手里，我建议你们先开口。” FBI 称该组织入侵超过 140 家机构，自去年以来收取至少 7000 万美元赎金。此次喊话发生在荷兰 9 月 15 日逮捕一名 24 岁阿姆斯特丹男子之后。ShinyHunters 称此人与该组织无关，并称荷兰警方无能。 FBI 说逮捕会改变谁开口。该组织说这是作秀。缄默法则，但数据一直在说话。 @bluchipnews

☠️ NightSpire ransomware expands to 50 countries, 243 victims NightSpire, a ransomware crew that emerged in early 2026, has claimed 243 victims across 50 countries. The group targets small and medium businesses, law firms, and manufacturing. It uses a double extortion model, stealing data before encrypting. Average demand is $200,000 to $500,000. The crew operates a leak site and affiliate program. No arrests reported. Two hundred forty three victims. Fifty countries. The crew is still recruiting affiliates. ☠️ NightSpire 勒索软件已扩展至50个国家，243名受害者 NightSpire，一个于2026年初出现的勒索软件团伙，已声称在50个国家拥有243名受害者。该团伙主要针对中小型企业、律师事务所和制造业。它采用双重勒索模式，先窃取数据再加密。平均赎金要求为20万至50万美元。该团伙运营着一个泄密网站和附属项目。目前尚无逮捕报告。 两百四十三名受害者。五十个国家。该团伙仍在招募附属成员。 @bluchipnews

☠️ Pentagon breach exposes 3 million personnel records The Pentagon confirmed a breach at its Defense Manpower Data Center affecting 2.76 million living individuals and 294,000 deceased personnel. Unauthorized users accessed a file-sharing server for roughly nine months, from October 2025 until the vulnerability was patched in July 2026. Exposed files were unencrypted and included Social Security numbers, names, dates of birth, contact details, and military occupational specialties. Nine months in the system. Unencrypted files. The Pentagon found out in July. The records of three million people moved, and the only thing the Pentagon has offered is credit monitoring. ☠️ 五角大楼遭入侵，300 万人员记录泄露 五角大楼证实其国防人力数据中心发生入侵，影响 276 万名在世人员和 294,000 名已故人员。未授权用户在约九个月内访问了一台文件共享服务器，从 2025 年 10 月直至 2026 年 7 月漏洞被修补。泄露的文件未加密，包含社会安全号码、姓名、出生日期、联系方式以及军事职业专长。 在系统里潜伏九个月。未加密的文件。五角大楼 7 月才发现。300 万人的记录被转移，而五角大楼提供的唯一补偿只是信用监控。 @bluchipnews

☠️ Tether froze $550M in Iran linked USDT Tether froze roughly $550 million in USDT during 2026 across wallets linked to Iran's central bank. $344 million in April. $130 million in July across four TRON wallets. A Senate report published the same day found 84 percent of 846 Iran linked wallets moved almost entirely in USDT. It also found $34.6 million kept moving after one blacklisting. Tether processes about $2 billion a day on TRON alone. A year of freezes is a few hours of volume. The network moves faster than the blacklist. The rest is for the reader to weigh. ☠️ Tether 冻结 5.5 亿美元与伊朗相关的 USDT Tether 在 2026 年冻结了约 5.5 亿美元与伊朗央行相关钱包中的 USDT。4 月冻结 3.44 亿美元。7 月冻结 1.3 亿美元，涉及四个 TRON 钱包。同日发布的一份参议院报告发现，846 个与伊朗相关的钱包中，84% 几乎完全以 USDT 流动。报告还发现，在某个地址被列入黑名单后，仍有 3,460 万美元继续转移。仅 TRON 一条链，Tether 每天就处理约 20 亿美元。 一年的冻结量，不过是几小时的交易量。网络跑得比黑名单快。其余的就留给读者自行权衡了。 @bluchipnews

☠️ DDoS attacks sold on Telegram, $30 to $2,000 Kaspersky found 148 active DDoS operators. Brokered attacks run $30 to $2,000, priced by target, duration, and power. Subscriptions to attack tools run higher, up to $30,000 a month. 65 percent of sellers work cybercrime forums. 35 percent work Telegram and Discord. Telegram alone hosts roughly 85 percent of hacker for hire posts. The market is getting crowded. ☠️ Telegram 上出售 DDoS 攻击，30 至 2,000 美元 卡巴斯基发现 148 个活跃的 DDoS 运营者。中介攻击价格在 30 至 2,000 美元之间，按目标、时长和火力定价。攻击工具订阅费用更高，每月最高可达 30,000 美元。65% 的卖家活跃于网络犯罪论坛。35% 活跃于 Telegram 和 Discord。仅 Telegram 就承载了约 85% 的黑客雇佣帖。 市场越来越拥挤了。 @bluchipnews

☠️ Bitget launderer also worked the Kelp exploit, no arrest ZachXBT traced the Bitget laundering trail to a Chinese operator using the aliases "lolo" and "Marin." The same person allegedly handled funds from the $292 million Kelp DAO exploit in April. The launderer is seeking transaction support in public Discord and Telegram channels. Five aliases published with transaction hashes. NEAR Intents blocked over $50 million in attempted flows, letting only $166,000 through. THORChain refused Bitget's demand to block the addresses, calling itself permissionless. The same launderer, two of the year's biggest hacks, and he's asking for help in public Discord. The trail is getting sloppy. ☠️ Bitget 洗钱者也曾操盘 Kelp 漏洞利用，无人被捕 ZachXBT 将 Bitget 洗钱链条追踪到一名中国操作者，其使用化名“lolo”和“Marin”。据称，同一人还处理了 4 月 Kelp DAO 2.92 亿美元漏洞利用的资金。该洗钱者正在公开的 Discord 和 Telegram 频道寻求交易支持。五个化名连同交易哈希被公布。NEAR Intents 拦截了超过 5,000 万美元的尝试性资金流动，仅放行 166,000 美元。THORChain 拒绝了 Bitget 封堵这些地址的要求，自称无需许可。 同一个洗钱者，今年两起最大的黑客攻击，而他还在公开的 Discord 里求助。痕迹越来越粗糙了。 @bluchipnews

☠️ Tether accounts seized as bitcoin touched 60 week average Right as bitcoin kissed its 60 week average, the US moved on these Tether accounts. Make of the timing what you like. There is a study, a prominent one, that says Tether pumped BTC with USDT it never backed. Want to end your bitcoin experiment? Wait for stablecoins. Then take Tether. ☠️ 比特币触及 60 周均线之际，Tether 账户被查封 就在比特币触及 60 周均线的当口，美国对这些 Tether 账户采取了行动。时机如何解读，随你。 有一项知名研究指出，Tether 用其从未真正背书的 USDT 拉抬了 BTC。 想终结你的比特币实验？等稳定币。然后拿下 Tether。 @bluchipnews

☠️ Lunex MaaS platform expands to 28 panels, blinds EDR with AMD driver Ontinue reverse engineered Lunex, a malware as a service platform tied to the Psychedelic Stealer. The attack chain starts with a fake Cloudflare CAPTCHA on compromised Ukrainian websites. A loader bypasses UAC, then abuses an AMD Radeon driver vulnerable to CVE-2023-20598 to zero out kernel callbacks. Security tools stay running but go blind. The stealer then pulls credentials from seven Chromium browsers, nine crypto wallets, and installs a Chrome native messaging host that survives reboots and binary deletion. Panels grew from 6 in June to 28 across 13 countries. No arrests. The driver is signed. The signature is valid. Windows loads it. The security tools report healthy while the credentials walk out the door. ☠️ Lunex MaaS 平台扩展至 28 个面板，用 AMD 驱动致盲 EDR Ontinue 逆向工程了 Lunex，一个与 Psychedelic Stealer 关联的恶意软件即服务平台。攻击链始于被入侵的乌克兰网站上的假 Cloudflare CAPTCHA。一个加载器绕过 UAC，随后滥用存在 CVE-2023-20598 漏洞的 AMD Radeon 驱动，将内核回调清零。安全工具仍在运行，但已经失明。窃取程序随后从七款 Chromium 浏览器、九个加密钱包中提取凭据，并安装一个 Chrome 原生消息宿主，该宿主可在重启和二进制文件删除后存活。面板从 6 月的 6 个增至横跨 13 个国家的 28 个。无人被捕。 驱动是签名的。签名是有效的。Windows 会加载它。安全工具报告一切正常，而凭据正走出大门。 @bluchipnews

☠️ Barracuda claims US chemical maker, 90GB of formulas for sale Barracuda ransomware listed International Chemical Company, a Philadelphia manufacturer of specialty metalworking fluids and industrial cleaners, on its leak site. The actor claims roughly 90GB from a main file server. Sales records, formulas, patents, manufacturing instructions, contracts, partner material. The listing is marked selling, price $50,000. The company has not confirmed the intrusion. The formulas are the product. A competitor does not need to hack the plant. They just need to buy the listing. ☠️ Barracuda 声称攻陷美国化工制造商，90GB 配方待售 Barracuda 勒索软件将 International Chemical Company 挂上其泄露网站。该公司是费城一家特种金属加工液和工业清洁剂制造商。攻击者声称从一台主文件服务器获取了约 90GB 数据，包括销售记录、配方、专利、制造说明、合同和合作伙伴资料。该条目标记为出售中，标价 50,000 美元。该公司尚未确认此次入侵。 配方就是产品。竞争对手不需要黑进工厂。他们只需买下这个条目。 @bluchipnews

☠️ DYORSWAP fake chain drains 766 ETH from 1,335 wallets A fraudulent network impersonating GIWA Chain deployed on September 27 and harvested 767.65 ETH from 1,335 addresses. The fake chain ran a working bridge and batcher, mimicking OP Stack infrastructure. Deposits flowed in, then 766.25 ETH moved out through the spoofed bridge. DYORSWAP confirmed the losses were not from its contracts but from the impersonated network. The deployer address was funded 8.5 hours before launch. The attacker built a fake chain, ran it for hours, and walked with 766 ETH. DYORSWAP paid 200 ETH back from its own pocket. That is not a recovery. That is a receipt. ☠️ DYORSWAP 假链从 1,335 个钱包盗走 766 枚 ETH 一个冒充 GIWA Chain 的欺诈网络于 9 月 27 日部署，从 1,335 个地址中收割了 767.65 枚 ETH。这条假链运行着可用的跨链桥和批处理器，模仿 OP Stack 基础设施。存款不断流入，随后 766.25 枚 ETH 通过伪造的跨链桥转出。DYORSWAP 证实损失并非来自其合约，而是来自被冒充的网络。部署者地址在启动前 8.5 小时获得资金。 攻击者搭建了一条假链，运行了数小时，然后带着 766 枚 ETH 离场。DYORSWAP 自掏腰包退还了 200 枚 ETH。那不是追回。那是一张收据。 @bluchipnews

☠️ Duelbits casino drained of $7M, site offline Crypto casino Duelbits shut down after attackers took roughly $7 million from hot wallets across four blockchains. Scam Sniffer flagged unusual transfers on BNB Chain, Ethereum, and Tron, then spotted 8.1 BTC gone from the Bitcoin wallet . The attacker holds 836 ETH, 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB . Co-founder Joe confirmed the hack and said the site stays offline . Most of the stolen assets were swapped into ETH and consolidated into one address holding about 2,234 ETH. The funds have not moved. No arrest. No recovery. The casino folded before the attacker did. ☠️ Duelbits 赌场被盗 700 万美元，网站下线 加密货币赌场 Duelbits 在攻击者从四条区块链上的热钱包中盗走约 700 万美元后关停。Scam Sniffer 标记了 BNB Chain、以太坊和 Tron 上的异常转账，随后发现比特币钱包中 8.1 枚 BTC 不翼而飞。攻击者持有 836 枚 ETH、593,000 枚 USDT、97,000 枚 USDC、31,500 枚 DAI 和 124 亿枚 SHIB。联合创始人 Joe 证实了此次黑客攻击，并表示网站将继续保持离线。 被盗资产大部分被兑换成 ETH，并归集到一个持有约 2,234 枚 ETH 的地址。资金尚未转移。无人被捕。资金无法追回。赌场比攻击者先倒下了。 @bluchipnews

☠️ ShinyHunters bypasses WAF, resumes mass PeopleSoft exploitation ShinyHunters resumed mass exploitation of Oracle PeopleSoft using CVE-2026-35273, a critical remote code execution flaw. The gang bypassed WAF rules by encoding a single character in the request path, swapping /PSEMHUB/ for /%50SEMHUB/. Google's Mandiant confirmed dozens of systems hit across education, tech, healthcare, agriculture, transportation, and government. Web shells including x.jsp, u.jsp and a trojanized Ple64.exe backdoor were deployed. Oracle shipped the patch in June. Many organizations only adjusted firewall rules instead. The gang found a way around the shield. They did not find a way around the vulnerability. The servers that stayed unpatched are the ones that got hit. ☠️ ShinyHunters 绕过 WAF，恢复对 PeopleSoft 的大规模利用 ShinyHunters 利用 CVE-2026-35273——一个严重的远程代码执行漏洞——恢复了对 Oracle PeopleSoft 的大规模利用。该团伙通过在请求路径中编码单个字符绕过了 WAF 规则，将 /PSEMHUB/ 替换为 /%50SEMHUB/。Google 的 Mandiant 证实，教育、科技、医疗、农业、交通和政府部门有数十个系统遭到攻击。攻击者部署了包括 x.jsp、u.jsp 在内的 Web Shell，以及一个被植入木马的 Ple64.exe 后门。Oracle 已于 6 月发布补丁。许多组织却只是调整了防火墙规则。 该团伙找到了绕过盾牌的方法。他们没有找到绕过漏洞的方法。那些未打补丁的服务器，才是被攻陷的服务器。 @bluchipnews

☠️ Hypervault Finance drained of $3.6M, funds already through Tornado Cash PeckShield detected an abnormal withdrawal from Hypervault Finance worth about $3.6 million. Funds were bridged from Hyperliquid to Ethereum, swapped into ETH, then 752 ETH was deposited into Tornado Cash. No arrest. No recovery. The money did not sit. Straight out, bridged, swapped, mixed. By the time the alert posted, it was already gone. ☠️ Hypervault Finance 被盗 360 万美元，资金已通过 Tornado Cash PeckShield 检测到 Hypervault Finance 一笔价值约 360 万美元的异常提现。资金从 Hyperliquid 跨链至以太坊，兑换成 ETH，随后 752 枚 ETH 被存入 Tornado Cash。无人被捕。资金无法追回。 钱没有停留。直接转出、跨链、兑换、混币。等到警报发布时，资金早已消失。 @bluchipnews

☠️ Italian bank loses $108M to AI voice cloning Scammers cloned a senior lawyer's voice and called Fideuram's chairman. They posed as Intesa's CEO on WhatsApp, then a fake lawyer confirmed a critical foreign transaction. He authorized 95 million euros. About 53 million was recovered from China, Portugal, and Italy. The rest went to crypto and is gone. No hack. No malware. A cloned voice and a familiar name. ☠️ 意大利银行因 AI 语音克隆损失 1.08 亿美元 诈骗者克隆了一名资深律师的声音，致电 Fideuram 董事长。他们在 WhatsApp 上冒充 Intesa 的 CEO，随后一名假律师确认了一笔关键的外国交易。他授权了 9,500 万欧元。约 5,300 万欧元已从中国、葡萄牙和意大利追回。其余资金流入加密货币，已无法追回。 没有黑客攻击。没有恶意软件。只是一个克隆的声音和一个熟悉的名字。 @bluchipnews

☠️ D'CENT App Wallet drain hits 7,393 wallets, 12.4M XRP stolen Attackers drained 12.4 million XRP from 7,393 D'CENT App Wallet users over ten days. The first wave hit on September 15, taking 3.6 million XRP from 1,682 wallets in under three hours. The vulnerability affected app versions older than 8.1.0. Hardware wallets were unaffected unless users imported their recovery phrases into the app. Roughly half the stolen XRP was laundered through THORChain and Binance. D'CENT is working with law enforcement. ☠️ D'CENT App 钱包被盗波及 7,393 个钱包，1,240 万 XRP 被窃 攻击者在十天内从 7,393 个 D'CENT App 钱包用户处盗走 1,240 万 XRP。第一波攻击发生于 9 月 15 日，不到三小时内从 1,682 个钱包中窃取 360 万 XRP。该漏洞影响 8.1.0 之前的 App 版本。硬件钱包未受影响，除非用户将助记词导入到 App 中。 被盗 XRP 中约有一半通过 THORChain 和 Binance 进行洗钱。D'CENT 正在与执法部门合作。 @bluchipnews

☠️ Bitget breach now $387.5M, withdrawals paused Bitget revised its loss estimate to $387.5 million, adding Zcash and TRON transfers missed in the first count. The attack hit hot and warm wallets across multiple chains. Cold wallets held. Withdrawals remain paused. CEO Gracy Chen said the exchange would publish an incident report within 24 hours. The attacker moved fast, most of it into ETH. Preliminary on chain links point to Lazarus. The $464M fund covers the loss. Chen blamed a nation state. Convenient, that. ☠️ Bitget 被盗金额现达 3.875 亿美元，提现暂停 Bitget 将其损失估计修正为 3.875 亿美元，补充了首次统计中遗漏的 Zcash 和 TRON 转账。此次攻击波及多条链上的热钱包和温钱包。冷钱包未受影响。提现仍处于暂停状态。CEO Gracy Chen 表示，交易所将在 24 小时内发布事件报告。 攻击者行动迅速，大部分资金被转入 ETH。初步链上线索指向 Lazarus。4.64 亿美元的资金可覆盖此次损失。Chen 将矛头指向某个国家行为体。真方便，呵。 @bluchipnews