CRIME [t3]

⚠️ Researchers warn hackers exploiting Safari zero-day on iPhones to steal crypto private keys, seed phrases and Keychain data; update iOS immediately (source)

⚠️ PolinRider malware infects Laravel Nova package, uses Ethereum transactions to dynamically resolve C2 servers, targets browser and crypto wallet data (source)

⚠️ Fetch.ai loses ~$2M after attacker exploits leaked private key to drain FET bridge via ECDSA signature bypass in TokenConversionManagerV3 contract. (source)

⚠️ Fetch.ai exploited on Ethereum, $1.56M FET drained and $452K NTX minted by same attacker (source)

⚠️ FomoPeek App v1.1–1.2 contained malicious code with iOS kernel exploit framework, leading to private key theft (source)

⚠️ North Korean hackers steal data from 7,000 crypto wallets, infect 30,000 devices, and collect $10.71M in crypto assets via job scam malware campaign across 100+ countries, say Japan NPA and FBI; laptop farm dismantled in Japan. (source)

⚠️ Nimiq loses $50,463 due to missing signature and nonce validation in ERC20PermitHTLCHandler execute function (source)

⚠️ Likwid.fi suffers $74.31M BNB exploit due to unupdated pair reserves in leverage borrow function (source)

⚠️ Nostra finance on Starknet hit by oracle manipulation, $3.5M borrowed; attacker bridges $1.92M to Ethereum (source)

⚠️ Revolut hackers demand $3M in Monero, threaten to sell customer data containing passport details, bank accounts and Bitcoin activity, affecting 680 customers; UK ICO investigating, Revolut confirms breach and notification to affected users. (source)

⚠️ FlamingoFinance old Flamincome contracts exploited via flash loan, $345.9k USDT stolen after attacker inflated VaultYUSDT share price and redeemed aUSDT (source)

⚠️ D'CENT App Wallet reports abnormal asset transfers; users urged to update immediately (source)

⚠️ Core Lightning vulnerability in experimental features may put user funds at risk; patch pending (source)

⚠️ BonfireSwap router exploited for ~$50k due to missing access control in transfer function, allowing unauthorized token drains via pre-approved allowances (source)

⚠️ Hacker minted 46B fake BTC tokens on DeFi bridge using $0.25 input (source)

⚠️ Unknown Gnosis Safe wallet drained of $7.73M via Router contract's insecure multicall allowing delegatecall exploit (source)

⚠️ Revolut exposed 680 customers' data including passports, bank details, and Bitcoin records after fake government requests, now facing extortion and ICO investigation, affected users notified (source)

⚠️ Unidentified user's Safe drained of $7.73M in rsETH via compromised Uni V4 LP module (source)

⚠️ Swiss Bitcoin Pay shuts down servers after customer data breach involving emails, Bitcoin addresses and IBANs leaked (source)

⚠️ Swiss Bitcoin Pay announces customer data breach exposing emails, Bitcoin addresses, IBANs, transaction history and hashed passwords (source)