CRIME [t3]

⚠️ Coldcard hacker moves $7.7M in stolen Bitcoin in third attack wave (source)

⚠️ Cozy Finance exploited for ~$160k via UMA Optimistic Oracle manipulation, enabling unauthorized CPT redemption after false price proposals triggered compensation mechanism. (source)

⚠️ Notional Finance exploited for $1.73M via fCash minting vulnerability allowing free-collateral bypass with large position rounding (source)

⚠️ Bitcoin sidechain Liquid Network hacked for nearly 4,000 BTC (~$320M), attacker claims funds will be returned after fix (source)

⚠️ Cozy Finance exploited on Optimism, $170K drained (source)

⚠️ Two attackers replicate Notional Finance exploit on BSC, malicious fCash positions set to mature (source)

⚠️ Blockstream’s Liquid Network reportedly exploited for ~4,000 BTC ($319M) by group claiming to be whitehats, onchain message left for contact (source)

Community Alert: Multiple verified WooX users have reported withdrawals stuck in pending or processing over the past three days. WooX was incubated by Kronos Research, and in Q4 2025 it was acquired by FusionX Digital, a firm which allegedly has ties to BitMart founder Sheldon Xia. On July 26, 2026, BitMart announced it would cease operations and restructure. Its users have been left without access to millions in stuck funds, with complaints increasing on X. Sheldon Xia has published only vague statements claiming user assets are safe, and those claims still have not been independently verified. As of this post, WooX has not yet issued a statement.

⚠️ Reddio exploited for ~9.25 ETH due to cross-vault asset double-counting flaw allowing stETH to back both rsvETH and rsvstETH shares simultaneously, enabling flash loan manipulation and redemption abuse despite 2% withdrawal cap. (source)

⚠️ Dream Health Chain exploited for $71.8k due to award state machine logic flaw allowing repeated claims (source)

⚠️ Trezor says data breach affects another 67K US customers (source)

⚠️ Trezor says data breach affects another 67,000 US customers (source)

⚠️ SlowMist identifies iOS Safari DarkSword wallet theft campaign using six-CVE chain to steal crypto assets (source)

⚠️ Trezor says shipping provider breach affected additional 67,000 US customers, exposing names, emails, phone numbers, shipping addresses and order details (source)

⚠️ Notional Finance escrow contract exploited, $1.7M in DAI and USDC stolen, swapped for 689.2 ETH and sent to Tornado Cash (source)

⚠️ Pocket Bitcoin discloses August data breach affecting 5,411 customers, exposing names, addresses, bank data, and in some cases identity documents and Bitcoin addresses; no funds or keys compromised. (source)

⚠️ Coldcard hacker swaps stolen Bitcoin for ETH via THORChain (source)

⚠️ Avici, Tria and other crypto neobanks drained of $1.1M via outdated Rain contract exploit (source)

⚠️ GebProxyActions exploited for ~5.94 ETH due to missing caller access control in quitSystem function, allowing attacker to bypass SAFE checks and steal collateral. (source)

⚠️ Injective exploited for $4.9M as block halt triggers emergency patch; Ontology pauses amid suspected attack (source)