Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
James Wynn Returns with 40x Short on 0.4947 $BTC at $40.5K
James Wynn(@JamesWynnReal) is back after 49 days!
He opened a 40x short on 0.4947 $BTC ($40.5K), with a liquidation price of $82,671.48.
11 minutes ago
Kalshi plans to launch futures contracts tracking U.S. CPI and core inflation metrics in December.
According to Bloomberg, Kalshi is venturing into new territory to compete with traditional financial trading platforms, pitching its U.S. inflation-linked futures market to large global banks and hedge funds. People familiar with the matter said the New York-based firm, known for its prediction markets, plans to launch futures contracts tracking the U.S. Consumer Price Index (CPI) and core inflation metrics (excluding food and energy prices) on its trading platform in December. Kalshi has hired Michael Ashton, a former trader at Barclays, to design the contracts and attract large institutional investors. Ashton, who is skilled in inflation trading, is nicknamed "Mr. Inflation".
11 minutes ago
Google has released the Gemini API CLI, enabling Claude Code, Codex to directly call its image generation, video creation, and other capabilities.
Beating AI News Flash: Google AI Studio has launched the open-source Gemini API CLI, a tool that enables AI agents such as Claude Code and Codex to directly call Google’s multimodal models. For example, when using Codex to build a website, users can invoke Gemini to generate images, videos, voiceovers, analyze PDFs, and transcribe audio. The tool also supports Deep Research, allowing users to assign complex research tasks to Google’s research agent and retrieve results after completion. Previously, integrating these features required agents to look up model names and write API call scripts; now, users only need to configure a Gemini API key to operate it via the command line. Additionally, the tool can query available models and parameters, and saves generated files locally, avoiding the need to load large volumes of content into the context window.
11 minutes ago
Pre-Market News Roundup for US Stocks: Tesla and SpaceX merger may face antitrust scrutiny, OpenAI nears completion of new funding round.
Key pre-market news for U.S. stocks on Friday is as follows: 1. SpaceX’s potential merger with Tesla faces antitrust scrutiny; the company is in talks to connect 80,000 cellular sites to build a new network. 2. OpenAI is nearing completion of a new funding round, seeking to raise up to $30 billion at a pre-money valuation of $1.25 trillion. 3. California Public Employees’ Retirement System (CalPERS), the largest U.S. public pension fund, is adjusting its asset allocation: cutting direct holdings in the "Magnificent Seven" tech giants while increasing exposure to private equity. 4. SK Hynix has scrapped the pre-IPO financing and IPO plans of its subsidiary Solidigm. 5. U.S. spot Bitcoin ETFs saw a net outflow of $635 million yesterday, with Ethereum ETFs recording a net outflow of $110 million.
11 minutes ago
Phantom launches Kalshi prediction markets for US users.
Crypto wallet provider Phantom is launching Kalshi’s prediction market for U.S. users, allowing customers to trade event contracts directly within its app. The feature rolled out on Friday, October 23, and will be gradually expanded to more users over the coming weeks. Phantom users must complete Kalshi’s Know Your Customer (KYC) verification to access the function. The launch comes as multiple U.S. states are raising questions about Kalshi. When asked if the related legal disputes are a concern for Phantom, Phantom’s General Counsel Kevin Jacobs said the company is confident in moving forward with the business.
11 minutes ago
CZ: 99% of startup ideas are worth trying, the key lies in whether the team can execute them properly.
Binance founder CZ posted that people often ask him whether his startup ideas are viable, as if his opinion holds much weight. He noted that as long as a team has strong enough execution, 99% of ideas are good, but the key issue is that 98% of teams fail to execute effectively. Therefore, instead of pitching startup ideas, one should directly demonstrate their execution capabilities.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Cysic dangles a 10% bounty, hacker pours loot into Tornado CashThe attacker moved $744,000 in ETH and BNB to Tornado Cash after exploiting Cysic’s bridge to mint 10 million tokens on BNB Smart Chain.
The wallet linked to the Cysic bridge exploit sent about $744,000 in cryptocurrencies to Tornado Cash on Friday after the Cysic Foundation offered the attacker a 10% recovery bounty.
The address transferred 300 Ether (ETH) and 30.4 BNB to the crypto mixer, according to blockchain security company PeckShield.
The hacker exploited a bridge vulnerability to mint 10 million Cysic (CYS) tokens on BNB Smart Chain on Saturday. Cysic suspended the bridge and blacklisted the recipient address, freezing about 2.8 million of the newly minted tokens. The foundation said its mainnet and existing assets in user wallets were unaffected.
The following Thursday, the Cysic Foundation offered the hacker a 10% bounty in exchange for returning 275.872 ETH, worth about $665,000, representing roughly 90% of the identified Ether proceeds.
Tornado Cash pools deposits from multiple addresses, making the funds harder to trace. The attacker’s Ethereum wallet held just $45 in ETH at press time, according to Akham data.
Cointelegraph contacted the Cysic Foundation for comment on fund recovery efforts but did not receive a response by publication.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Cysic dangles a 10% bounty, hacker pours loot into Tornado CashThe attacker moved $744,000 in ETH and BNB to Tornado Cash after exploiting Cysic’s bridge to mint 10 million tokens on BNB Smart Chain.
The wallet linked to the Cysic bridge exploit sent about $744,000 in cryptocurrencies to Tornado Cash on Friday after the Cysic Foundation offered the attacker a 10% recovery bounty.
The address transferred 300 Ether (ETH) and 30.4 BNB to the crypto mixer, according to blockchain security company PeckShield.
The hacker exploited a bridge vulnerability to mint 10 million Cysic (CYS) tokens on BNB Smart Chain on Saturday. Cysic suspended the bridge and blacklisted the recipient address, freezing about 2.8 million of the newly minted tokens. The foundation said its mainnet and existing assets in user wallets were unaffected.
The following Thursday, the Cysic Foundation offered the hacker a 10% bounty in exchange for returning 275.872 ETH, worth about $665,000, representing roughly 90% of the identified Ether proceeds.
Tornado Cash pools deposits from multiple addresses, making the funds harder to trace. The attacker’s Ethereum wallet held just $45 in ETH at press time, according to Akham data.
Cointelegraph contacted the Cysic Foundation for comment on fund recovery efforts but did not receive a response by publication.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
This is the largest suspicious fund movement observed in the past two years. The hacker of Drift Protocol has just made over 520 transfers to the mixer Tornado Cash, injecting more than 122.3 million dollars in Ethereum. While the analytics firm Arkham traces the digital trail of this loot to the letter, the crypto sector’s reaction ranges between shock and resignation.
In brief
Over $122.3 million in ETH was transferred and laundered to Tornado Cash within 48 hours by the hacker of Drift Protocol.
This is the largest deposit made by a hacker on the mixer over the past two years.
The initial attack on Drift Protocol (Solana) involved total damages of $285 million.
Changpeng Zhao (CZ), founder of Binance, responds by reminding of inherent risks in any technology.
$122 Million to Tornado Cash, the Heist of the Century Accelerates
The radars of the on-chain analytics firm Arkham Intelligence turned bright red. The crypto wallet identified as belonging to the hacker of Drift Protocol came out of its inertia to orchestrate a large-scale laundering operation. In just two days (October 20 and 21), the hacker divided his loot into 520 successive transactions to send 122.3 million dollars worth of ethereum to Tornado Cash.
This is simply the biggest deposit made by a cybercriminal on Tornado Cash in two years. By initially converting the stolen tokens from Solana to the Ethereum network, the crypto hacker hopes to definitively obscure the financial trails despite sanctions and international authorities’ surveillance.
Key FigureLaundering Operation IndicatorSource / Status$122.3 millionTotal amount converted into ETH and sent to Tornado CashArkham Intelligence520 transfersNumber of split transactions to mask flowsOn-Chain Data$285 millionTotal estimated damage during the initial Drift Protocol hackDeFi Exploit Registry2 yearsRecord for the largest pirate deposit on Tornado CashArkham HistoryData from Arkham Intelligence.
Arkham’s Hunt Exposes Hackers’ Modus Operandi
Thanks to Arkham’s visual tools, the path of the stolen funds was retraced in real time. Following the exploit on the Drift Protocol smart contracts, the hacker had transferred the majority of his loot to ethereum crypto to store a strategic reserve of over 56,000 ETH. Using Tornado Cash at this scale demonstrates that cybercriminals continue to exploit anonymization tools of decentralized finance (DeFi), despite the strengthening of global surveillance.
This attempt at concealment highlights the ongoing fragility of cross-chain bridges and lending protocols, regularly targeted to siphon off colossal sums within minutes.
Wallet Security: CZ Reminds Technology Limits in Crypto
In light of the scale of this laundering and renewed investor concerns about Web3 protocol vulnerabilities, major figures in the sector have spoken out. Changpeng Zhao (CZ), founder of Binance, reacted pragmatically on X to warn users:
No crypto wallet is 100% safe. No software is bug-free. No technology is 100% secure. There are risks in everything you do, just as there are risks if you do nothing. There will be problems, setbacks, and obstacles to solve. Stay up to date, manage risks, resolve issues.
This reminder makes clear that absolute security remains an illusion in the crypto ecosystem. While the $122 million continue to be shuffled through Tornado Cash’s depths, DeFi developers face increasing pressure to strengthen audits of their infrastructures before the next assault.
The Drift Protocol case and this record laundering of $122 million via Tornado Cash prove that on-chain tracking and hacking engage in a permanent war of attrition in the crypto world. Do you think tracking tools like Arkham will ever succeed in permanently neutralizing laundering?
Maximize your Cointribune experience with our "Read to Earn" program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
Join the program
A
A
Lien copié
Eddy S.
The world is evolving and adaptation is the best weapon to survive in this undulating universe. Originally a crypto community manager, I am interested in anything that is directly or indirectly related to blockchain and its derivatives. To share my experience and promote a field that I am passionate about, nothing is better than writing informative and relaxed articles.
DISCLAIMER
The views, thoughts, and opinions expressed in this article belong solely to the author, and should not be taken as investment advice. Do your own research before taking any investment decisions.
The Drift Protocol exploiter has transferred approximately $109 million in Ethereum to Tornado Cash over the past two days, heightening concerns about the movement of funds stolen in one of the largest decentralized finance attacks this year.
Details of Recent Ethereum TransfersBlockchain analytics platform Onchain Lens reported that addresses controlled by the Drift exploiter sent a total of 44,510 ETH to Tornado Cash between October 20 and 21. The transfers consisted of 25,710 ETH, worth around $63 million, on October 20, followed by 18,800 ETH, valued at roughly $46 million, on the following day.
These movements account for more than one-third of the $295.7 million equivalent stolen in April during the Drift Protocol exploit. Analyst data shows the exploiter’s wallets now hold close to 56,569 ETH, with the balance estimated at about $138 million as of October 21, according to Arkham Intelligence.
Records from Tuesday indicate that the exploiter’s monitored balance was near 81,454 ETH, which represented approximately $194 million. This reduction reflects a combination of outgoing transfers and fluctuating Ether prices.
Ongoing Use of Tornado CashThe Drift exploiter has previously used Tornado Cash to obscure transactions. In August, linked wallets sent approximately $44 million in ETH through the mixer. On October 20, Lookonchain identified an influx of about 25,700 ETH sent to the service within just two hours. Additional transfers continued through October 21, tracked across various blockchain monitoring tools.
Recent blockchain activity demonstrates an ongoing effort by the Drift exploiter to move substantial amounts of stolen funds through Tornado Cash, underscoring the complexity of tracing assets once they enter mixing services.
Analysts caution that blockchain analysis alone may not be sufficient to identify the eventual recipients of funds leaving Tornado Cash, creating ongoing challenges for investigators and affected users.
Aftermath of the April ExploitThe Drift Protocol suffered a $295.7 million loss on April 1. Discrepancies in early loss estimates reflected differences in token valuations over time. The attack stands as one of the largest in the decentralized finance ecosystem during 2024.
A June 3 update from Drift highlighted findings provided by Mandiant, which linked the incident to North Korean threat actor UNC6862 through operational evidence and analysis of prior attack patterns. The attackers had reportedly spent months building relationships with platform contributors before launching the exploit, which involved transaction approvals and access compromise rather than vulnerabilities in the smart contract code.
In response to the attack, Drift hired former Helium executive Noah Prince to oversee engineering and brought in staff from Gauntlet to review the protocol’s risk management and liquidation systems. The platform is moving to restart trading operations and intends to dedicate part of its future revenue to compensate victims of the hack. However, any funds moved by the exploiter function independently from these recovery efforts.
User Compensation and Recovery MechanismsDrift’s compensation process began on October 1 with the issuance of DFX tokens on Solana. These tokens allow verified users to redeem one DFX for every USDT lost during the exploit, with a capped supply of about 299.5 million DFX.
At the onset, approximately 3.1 million USDT was available in the recovery pool, setting the initial redemption value at $0.0104 per DFX. This structure means that direct recovery to pre-hack balances will not happen instantly, and the real value received depends on available funds.
Compensation options allow affected users to redeem DFX tokens against pool funds, sell their tokens, or hold them with the prospect of future value. Burned tokens are permanently removed from circulation as they are redeemed.
The recovery system allocates between 60% and 90% of Drift’s daily net revenue to the recovery pool, depending on performance. In addition, any assets recovered through legal measures will be added to compensatory funds. Tether has pledged up to 127.5 million USDT in assistance, with further commitments of up to 20 million USDT from other sources.
Nevertheless, these contributions are not yet available for redemption. Eligible users must claim their DFX tokens before January 1, 2028; any unclaimed tokens will be permanently burned afterward.
As the crypto market shows how quickly funds and meme tokens can gain momentum, timing and investor decisions remain critical. In the meme token sector, viral internet trends have transformed modest investments into substantial profits within days. Data from Fomo App illustrates this with an instance where a $99 investment in “Niu Lai” grew to about $370,000. Tools like Fomo App, which integrate token discovery, investor rankings, and trade notifications, offer traders a way to closely follow investor movements and activity in the fast-paced world of meme tokens.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
TLDR A wallet tied to the April Drift hack sent 25,710 ETH, worth about $63.1 million, into Tornado Cash on Oct. 20. The wallet made 258 deposits over two hours and 13 minutes, leaving about 3.98 ETH behind. Drift estimated about $280 million was taken in the April 1 attack, which Mandiant linked to North Korean group UNC6862. Drift opened DFX token claims on Oct. 1, giving users one DFX for each USDT of verified loss. As of Oct. 4, the redemption quote was about 0.0104 USDT per DFX, close to one cent per USDT lost. A wallet tied to the April hack of crypto trading protocol Drift sent 25,710 ETH into the Tornado Cash mixer on Oct. 20. The transfers were worth about $63.1 million.
The address is labeled “Drift Exploiter 5” on the blockchain explorer Etherscan. The deposits were the wallet’s first outgoing Ethereum transactions, and they left it nearly empty.
How the Transfers Happened The wallet made 258 deposits to the Tornado Cash router. It sent 257 deposits of 100 ETH each, followed by one final deposit of 10 ETH.
The first deposit was confirmed at 07:08:35 UTC in block 26,232,203. The last came at 09:21:35 UTC in block 26,232,865. The full sequence took two hours and 13 minutes.
After the transfers, the address held about 3.98 ETH. The dollar value of the deposits is based on an average Ethereum price of $2,450 on Oct. 20.
On-chain analysis account Lookonchain separately reported that the exploiter wallets it tracks hold a combined 81,864 ETH.
Drift was attacked on April 1, more than six months before these transfers. In an April 2 disclosure, the protocol estimated that about $280 million had been withdrawn.
Drift said the attacker took over the administrative powers of its Security Council. The attacker used durable nonce accounts to pre-sign transactions and delay when they were carried out.
According to Drift, this allowed the attacker to get unauthorized or misrepresented transaction approvals in advance. At the time, the protocol said it had not found a bug in its programs or smart contracts.
In a June 4 update, Drift said the investigation it hired Mandiant to carry out linked the attack to UNC6862. That is a North Korean threat group.
How Drift Plans to Repay Users Drift has set up a Recovery Pool to return funds to affected users. Money recovered through freezes, a bounty, or law enforcement goes into the pool. A share of the platform’s net protocol revenue is also added.
The protocol opened claims and redemptions for its DFX token on Oct. 1. Users receive one DFX for each USDT of verified loss.
Holders can trade their DFX for USDT at the quoted redemption amount. The tokens they submit are burned in the same transaction.
Users who redeem give up their share of future pool deposits for those tokens. Those who redeem only part of their holdings keep that share for the DFX they hold onto.
As of Oct. 4, the quote was about 0.0104 USDT per DFX. That is close to one cent per USDT lost.
In an April 16 update, Drift proposed up to $127.5 million from Tether and $20 million from other partners. The plan included a revenue-linked credit facility, an ecosystem grant, and market-maker loans.
The Oct. 20 deposits show where this wallet’s ETH went. How much of the stolen money will return to the Recovery Pool is still unknown. Ethereum was last trading at $2,462.20, up 3.55% over the past 24 hours.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Wallets linked to the $295 million April hack still held $138 million in Ether after sending another $46 million to the mixer Wednesday.
A Drift exploiter-linked wallet transferred 18,800 Ether, worth about $46 million, to Tornado Cash on Wednesday.
The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million, as blockchain data tracker Onchain Lens said on X.
The transfers to Tornado Cash make the funds harder to trace and represent nearly 37% of the $295 million stolen from decentralized exchange (DEX) Drift in April. The attack ranks as this year’s third-largest crypto hack, according to DefiLlama.
The Drift exploiter-labelled wallets still held 56,569 Ether, worth roughly $138 million after Wednesday’s flurry of transfers, Arkham data shows.
The Solana-based DEX reported about $295 million in losses from the April 1 hack, which its security consultant Mandiant attributed to a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, giving affected users a claim on a pool that launched with about $3.1 million and receives exchange revenue and recovered funds.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Wallets linked to the $295 million April hack still held $138 million in Ether after sending another $46 million to the mixer Wednesday.
A Drift exploiter-linked wallet transferred 18,800 Ether, worth about $46 million, to Tornado Cash on Wednesday.
The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million, as blockchain data tracker Onchain Lens said on X.
The transfers to Tornado Cash make the funds harder to trace and represent nearly 37% of the $295 million stolen from decentralized exchange (DEX) Drift in April. The attack ranks as this year’s third-largest crypto hack, according to DefiLlama.
The Drift exploiter-labelled wallets still held 56,569 Ether, worth roughly $138 million after Wednesday’s flurry of transfers, Arkham data shows.
The Solana-based DEX reported about $295 million in losses from the April 1 hack, which its security consultant Mandiant attributed to a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, giving affected users a claim on a pool that launched with about $3.1 million and receives exchange revenue and recovered funds.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Putin in principle has agreed to resume the trilateral peace talks between Russia, the United States and Ukraine, with Abu Dhabi a possible venue.
According to reports from Reuters and Axios, the Kremlin stated that Russian President Vladimir Putin told U.S. envoy Steve Witkoff on Wednesday he "agrees in principle" to resume trilateral peace talks between Russia, Ukraine and the U.S. around November 10 to end the Russia-Ukraine conflict, with the venue potentially in Abu Dhabi.
Witkoff held a three-hour meeting with Putin in St. Petersburg the same day, presenting the latest plan to end the Russia-Ukraine conflict. Trump envoy Jared Kushner joined the session via video.
Witkoff informed Putin that progress had been made in the Oslo talks, and expressed hope that both sides would consider restarting the Russia-U.S.-Ukraine trilateral negotiations and allow technical experts to participate in discussions on specific issues. He also submitted multiple documents on the peaceful resolution of the Russia-Ukraine conflict to Putin.
Separately, Putin raised with Witkoff the possibility of Russia acting as a mediator between the U.S. and Iran. Putin noted that Russia has decades of special trust relations with Iran and is willing to contribute to resolving the current crisis.
1 minutes ago
The White House: It was made aware of the PHP vulnerability on October 16, and is coordinating to accelerate the release of a fix patch.
The White House stated that the U.S. government was alerted to the PHP security vulnerability on October 16. It is closely monitoring the issue and coordinating with federal agencies and leading systems integration labs to accelerate the rollout of fix patches. The White House noted that federal agencies are evaluating the vulnerability’s potential impact on government systems and critical infrastructure, and are working with network operators to prioritize mitigation measures.
1 minutes ago
LiteLLM hit by second supply chain poisoning attack this year: Steals API keys even without being called
Beating AI Express: Security firm JFrog has discovered that popular open-source AI model gateway LiteLLM has fallen victim to another supply chain attack. Its latest v1.107.0 version was implanted with malware, and official Docker images were also compromised.
LiteLLM enables unified access to models from providers like OpenAI and Anthropic, and centralizes API key management. It was previously targeted by a supply chain poisoning attack back in March this year. This latest attack is far more stealthy: hackers hid three extra files in Python packages. After installation, whenever users launch the associated Python environment—even without invoking LiteLLM—the malicious code runs automatically. It steals browser passwords, SSH private keys, AWS and other cloud platform credentials, plus authentication data for development tools including Claude, Codex, and Cursor. The malware also attempts to exfiltrate model API keys stored in LiteLLM’s database to servers masquerading as official domains. Attackers also embedded a persistent backdoor that checks for remote commands hourly, downloading and executing new code as needed.
Notably, the official source code on GitHub contained no malicious files, but all seven platform-specific packages released to PyPI were infected with trojans. The community traced the issue via Docker build logs: the release system used a source address pointing to a fake repository that differed from the official one by only one hyphen. How the fake repo slipped into the release pipeline remains unconfirmed.
PyPI has since removed the malicious versions, and Docker Hub has taken down affected images. JFrog warns users who installed or ran v1.107.0 to treat all related credentials as potentially compromised, isolate and rebuild their environments, and rotate sensitive data like API keys—rather than simply uninstalling the software. The confirmed safe rollback version is v1.106.2.
1 minutes ago
Tencent Cloud issues a warning on the PHP 'php2shell' remote code execution vulnerability, recommends timely self-inspection and remediation.
Tencent Cloud Security Center has detected a remote code execution vulnerability in PHP, with CVE identifiers CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". The flaw allows unauthenticated remote attackers to send specially crafted multipart POST requests to trigger memory corruption, leading to remote code execution that can result in full server compromise and other harms. Tencent Cloud Security recommends conducting timely security self-inspection; if your system is affected, update and patch immediately to prevent intrusion by external attackers.
1 minutes ago
Bybit plans to seek partnerships with large brokerage firms to challenge Robinhood in the U.S. market.
Bybit CEO Ben Zhou said that Bybit plans to partner with established local firms when entering the U.S. market to compete with platforms like Robinhood. Citing Interactive Brokers as an example, he noted that it is more suitable at this stage to seek partners that already have a U.S. customer base and are looking to expand into crypto business.
Ben Zhou added that applying for money transmission licenses state-by-state could take two to three years, so he prefers to wait for progress on the CLARITY Act and further clarity on the new regulatory framework before entering the U.S. at an opportune time rather than acting hastily. He believes the U.S. market, while large, is highly competitive and already saturated.
Additionally, Bybit is exploring the U.K. market, but Ben Zhou said entry costs there are high, and the location of its London office has not yet been finalized. The company also plans to launch a comprehensive application in Europe as early as the first quarter of 2027, covering derivatives and tokenized stocks.
1 minutes ago
Elon Musk’s net worth returns to $1 trillion, surging by $88 billion in a single day.
According to Forbes, driven by gains in SpaceX and Tesla’s share prices, Elon Musk reclaimed his spot as a trillionaire on October 21. His net worth increased by approximately $88 billion that day, hitting $1.013 trillion. SpaceX’s share price surged over 10% following the release of its better-than-expected third-quarter results, while Tesla’s rose more than 3%; Tesla was set to announce its earnings after U.S. markets closed the same day. Musk confirmed during SpaceX’s Tuesday evening earnings call that the two companies are exploring a merger. Musk became the world’s first trillionaire on June 12 when SpaceX went public, and has since fallen below and reclaimed the threshold multiple times; he most recently lost the status last week amid a decline in SpaceX’s share price.
Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by the attacker.
Summary
Wallets linked to the April Drift exploit reportedly transferred 44,510 ETH, worth $109 million, to Tornado Cash on October 20–21. Wednesday’s activity involved approximately 18,800 ETH worth $46 million, following an estimated $61 million in transfers on Tuesday. Arkham-labeled exploiter wallets reportedly retained 56,569 ETH, valued at $138 million, after the latest deposits. Drift attributed its April attack to a North Korean threat group following an investigation by Mandiant. The exchange opened DFX recovery claims on October 1, initially backed by a pool holding approximately 3.1 million USDT. According to blockchain tracker Onchain Lens, the wallets deposited 44,510 ETH into the mixing service on October 20 and 21, including approximately 18,800 ETH valued at $46 million on Wednesday.
DRIFT EXPLOITER MOVES $109M $ETH TO TORNADO CASH
The Drift Protocol exploiter transferred 44.51K $ETH (~$109.15M) to Tornado Cash over the past two days.
· October 20: 25.71K $ETH (~$63.04M)
· October 21: 18.8K $ETH (~$46.11M)
Addresses:… pic.twitter.com/udDVTmEBje
— Onchain Lens (@OnchainLens) October 21, 2026 The October 21 transfers followed roughly 25,710 ETH sent on Tuesday, when blockchain monitors recorded deposits worth approximately $61 million. Combined, the two batches represent more than one-third of the $295 million lost in Drift’s April 1 exploit, based on their estimated dollar values when transferred.
Attribution of the transactions rests on addresses identified as belonging to the attacker. Tornado Cash accepts cryptocurrency deposits into privacy pools, making it harder to follow funds once they are withdrawn to new addresses. A mixer deposit does not, by itself, establish that the stolen assets have been exchanged for cash or recovered by authorities.
The movement comes after a period of relative inactivity. On October 20, Lookonchain reported approximately 25,700 ETH deposited within two hours, while different monitoring accounts published lower interim totals as the transactions were still taking place.
The latest two-day figure covers the complete period cited by Onchain Lens, not the amount observed by each tracker at the same point in time. The reported 44,510 ETH figure and the quoted $109 million are estimates based on the transfer activity and Ether prices around the deposits.
Exploiter wallets retain $138 million after latest transfers Following Wednesday’s transfers, addresses labeled as the Drift exploiter held approximately 56,569 ETH, valued at $138 million, according to Arkham Intelligence data cited in the October 21 reporting. The figure describes the tracked wallets at that snapshot, not every asset necessarily controlled by the perpetrators.
On Tuesday, the corresponding holdings estimate had been roughly 81,454 ETH, worth $194 million. Those balances changed as funds moved and as Ether’s market price fluctuated.
Past transactions complicate the picture. In August, wallets connected to the same incident had already transferred around $44 million worth of ETH through Tornado Cash, prompting renewed questions about how much could ultimately be frozen or returned to victims.
As crypto.news previously reported, investigators faced difficulties tracking the stolen assets through cryptocurrency mixers.
The April incident was one of the year’s largest decentralized finance thefts. Drift initially faced differing loss estimates because investigators valued affected tokens at different points, while the platform’s later accounting put stolen assets at approximately $295.7 million.
North Korean hackers linked to April Drift exploit Drift said in its June 3 recovery update that cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. Mandiant’s assessment cited operational evidence and similarities with other attacks linked to North Korean operators.
The attackers had spent months developing relationships with Drift contributors before acquiring the approvals needed to move assets, according to accounts published after the exploit. Investigators described a compromise of operational access and transaction authorization, not simply an error in a trading smart contract.
Drift subsequently reorganized its recovery effort around a planned return to trading. In its June update, the platform said it had hired former Helium engineering executive Noah Prince to oversee protocol development and engaged former Gauntlet team members to review risk controls and liquidation infrastructure.
That work formed part of preparations for a relaunched trading platform intended to contribute revenue toward user compensation.
Drift opens DFX recovery claims with initial pool of $3.1 million On October 1, Drift opened claims and redemptions for DFX, a Solana token allocated to affected users according to their verified losses. The recovery framework assigns one DFX for each USDT of recognized loss and fixes total supply at 299,500,810.998 tokens.
At launch, the recovery pool contained around 3.1 million USDT. The stated initial redemption rate was approximately 0.0104 USDT per DFX, equivalent to roughly one cent for each dollar of eligible losses. Claiming a token is separate from receiving its full face amount in cash.
Under Drift’s published recovery rules, a holder can redeem DFX for an available share of the pool, sell the token on a secondary market or retain it as additional funding accumulates. Tokens redeemed against the pool are burned, reducing the outstanding supply.
A portion of the relaunched platform’s net protocol revenue is directed to the pool each day. Drift lists contributions of 60% on the first 30,000 USDT of daily net revenue, 70% on the next band through 100,000 USDT and 90% above that threshold.
Drift says any assets recovered through freezes, law enforcement or other recovery measures will be deposited in the pool. Tether has committed up to 127.5 million USDT in support, while other partners have committed up to 20 million USDT; those commitments should not be confused with money already available for immediate redemption.
Eligible users must submit their DFX claims before 00:00 UTC on January 1, 2028. Under the recovery terms, any tokens still unclaimed at that deadline will be permanently burned.
The wallet cluster linked to the April 1 exploit of Solana-based perpetuals protocol Drift resumed activity on October 20 after roughly two months of silence, depositing 25,700 ETH — about $61.56 million — into the privacy mixer Tornado Cash over a two-hour window, according to on-chain analyst Lookonchain.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity. Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).
— Lookonchain (@lookonchain) October 20, 2026
The deposits are the latest chapter in a recovery that has barely begun. Drift’s own records put the April theft at $295,706,374.93 across 19 assets, while the recovery pool meant to repay victims held about $3.1 million in USDT when claims opened on October 1 — roughly one cent for every dollar lost.
A Two-Hour Burst After Two Months of Silence Lookonchain flagged the movement at about 09:25 UTC on October 20. “The Drift Protocol exploiter, who stole over $270M, is moving ETH to Tornado Cash after 2 months of inactivity,” the account wrote. “Over the past 2 hours, the exploiter has deposited 25,700 ETH ($61.56M) into Tornado Cash and still holds 81,864 ETH ($195M).”
A second tracker, Onchain Lens, published the fuller two-day tally on October 21. “DRIFT EXPLOITER MOVES $109M ETH TO TORNADO CASH,” the account wrote, counting 44,510 ETH — about $109.15 million — moved across October 20 and 21, split into 25,710 ETH on the first day and 18,800 ETH on the second. The post lists two addresses, 0xAa843eD65C1f061F111B5289169731351c5e57C1 and 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7.
The two trackers differ on the dollar figures because each snapshotted ETH at a different price, with ETH trading near $2,481 at the time. The token amounts are the stable unit. What is not in dispute is the pattern: a cluster that had gone quiet since August moved tens of thousands of ETH through the mixer in concentrated bursts, the same method it used in two earlier rounds of Tornado Cash activity over the summer.
The Ledger of the April 1 Theft Drift’s April 16 incident report breaks the loss into 19 assets. Jupiter’s JLP liquidity token was the largest single line at $159,329,898.68, followed by $71,415,648.65 in USDC, $11,321,165.24 in Coinbase-wrapped bitcoin and $10,426,959.98 in SOL. The remaining 15 assets — USDT, USDS, WETH, dSOL, WBTC, Fartcoin, jitoSOL, syrupUSDC, INF, mSOL, bSOL, EURC, zBTC, USDY and JUP — bring the total to $295,706,374.93.
Drift has said its forensic investigation attributed the attack to a North Korea-linked group, and the protocol disclosed in the same report that it is “actively working with law enforcement and blockchain forensics partners to track and recover stolen assets.” Any funds recovered are directed to the recovery pool. Chainalysis separately estimated the loss at about $285 million.
For the relaunch, Drift is moving its settlement layer from USDC to USDT. Tether is proposing up to $127.5 million and other partners up to $20 million to support user recovery, alongside two independent audits from Ottersec and Asymmetric. A new community-governed multisig will manage core protocol assets, with signers on dedicated signing devices and timelocks on critical administrative actions.
A Recovery Pool Still a Fraction of the Loss The recovery mechanism Drift opened on October 1 is a fixed-supply token called DFX. One DFX was issued for every USDT of verified loss, capping the supply at 299,500,810.998 tokens, and the token redeems against a pool that held about $3.1 million when claims opened. Drift’s own documentation puts an early redemption at “about 0.0104 USDT per DFX.”
The arithmetic is blunt. A pool of $3.1 million against a loss of $295.7 million is a recovery of about 1.05 percent. Viewed from the other side it is harsher: the $109.15 million the exploiter moved through Tornado Cash in two days is roughly 35 times the entire recovery pool. On October 20 alone, the $61.56 million deposited equaled about 21 percent of the full haul.
Drift’s earlier DFX launch coverage walks through the claim mechanics, and the April theft itself was documented as one of the month’s largest DeFi exploits. The pool is funded once a day at 00:00 UTC from a share of Velocity’s net protocol revenue — 60 percent of the first $30,000, 70 percent of the next $70,000 and 90 percent above $100,000 — until verified losses are repaid. Claims close at 00:00 UTC on January 1, 2028, after which unclaimed DFX is burned.
The mechanics leave victims with a three-way choice that Drift’s documentation states plainly: redeem DFX for USDT at the current redemption amount, sell it on a secondary market such as Raydium, or hold it and let the pool grow as deposits arrive and supply shrinks. Because a redemption burns DFX and removes USDT in the same proportion, the redemption amount itself does not fall when holders exit — each future deposit is simply shared among fewer remaining tokens. The trade-off is time against certainty, and Drift has not tied pool growth to a fixed repayment schedule.
What the Deposits Do Not Prove A Tornado Cash deposit does not establish what happened to the funds next. The mixer pools deposits so they can be withdrawn from fresh addresses, and moving ETH into it is not proof that the tokens were sold, converted to cash or moved to an exchange. Lookonchain’s framing — “moving ETH to Tornado Cash” — stops at the observable transfer, and the trackers themselves disagree on the remaining balance, with Lookonchain citing 81,864 ETH after the October 20 deposits and Arkham’s entity page later showing about 56,569 ETH.
Freezing or recovering any of the stash would require an exchange or custodian willing to act on the labels, since Ethereum addresses cannot be blocked at the protocol level. That is why Drift’s recovery path runs through a bounty program and law enforcement rather than through the mixer itself.
What is not yet known is whether any of the laundered funds can be clawed back, or whether law enforcement will tie the movement to the actors Drift has named. Until a court or a recovery action produces a result, the North Korea attribution remains an allegation and the $109.15 million figure remains an on-chain estimate rather than a completed liquidation.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
According to security firm Salus' monitoring, on October 21, the attacker behind Drift Protocol began transferring funds from another long-dormant wallet, depositing 4,600 ETH into Tornado Cash, valued at around $11.23 million. The two linked wallets tracked by Salus have now deposited a total of 30,310 ETH into Tornado Cash. The address starting with 0xaa8 had previously sent 19,600 ETH to Tornado Cash, then added another 6,110 ETH, bringing its total deposits to 25,710 ETH. The other address starting with 0xd3f, after lying dormant for about 202 days, made its first outbound transfer, sending 4,600 ETH to Tornado Cash in 46 separate transactions over roughly 19 minutes. This address had earlier received a total of around 24,882 ETH across 11 wallets, with funds primarily sourced from USDC bridged from Solana to Ethereum via CCTP and converted into ETH. As of the monitoring time, the address still holds approximately 20,286 ETH.
On-chain detective ZachXBT reported that two addresses belonging to an institution had a combined 973,000 MORPHO tokens stolen hours ago, valued at approximately $2.3 million. The stolen funds have been deposited into Tornado Cash. Both thefts involved EIP-7702 account delegation transactions. Per ZachXBT’s tracking, the entity linked to one of the hacked addresses was also targeted in a $3.5 million hack on October 9. That earlier batch of assets came from claims on an old cross-chain bridge, then was cross-bridged from Ethereum to Zcash via NEAR Intents before entering the Ironwood privacy pool. ZachXBT further noted that the hacked address has an on-chain association with an address suspected to belong to Nima Capital.
Malaysia's central bank launches SSDS+ platform to support the issuance of tokenized bonds and Islamic bonds.
Bank Negara Malaysia, Malaysia’s central bank, has announced the launch of SSDS+, a next-generation paperless securities depository system based on distributed ledger technology. The platform supports the issuance, depository, and custody of tokenized debt securities, including sukuk (Islamic bonds). It can track the ownership and transfer of tokenized securities, and connects to the real-time electronic funds and securities transfer system RENTAS+ to settle bond payments using central bank currency. Bank Negara Malaysia stated that SSDS+ is primarily designed for wholesale issuance, but it also already has the capability to support tokenized government bonds and corporate retail bonds.
2 minutes ago
South Korean stocks closed up more than 3%, with SK Hynix rising 5.8%.
According to Bitget market data, South Korea’s KOSPI index closed 182.93 points higher on Wednesday, October 21, marking a 3.29% gain to end at 5,735.67 points. Samsung Electronics rose 5.67%, and SK Hynix gained 5.8%.
2 minutes ago
Arthur Hayes: Flop Labs' testnet and airdrop are expected to launch in the coming weeks.
BitMEX founder Arthur Hayes announced in a post that Flop Labs' testnet and airdrop are set to launch in the coming weeks. He specifically warned that no FLOP token currently exists, and anyone claiming the token is already available is a scammer.
2 minutes ago
Former Alibaba P10 Algorithm Director Prepares to Launch RSI Startup, First-Round Valuation Approximately $80 Million
Beating AI Express News: Zhu Xiaoyong, former Algorithm Director of Alibaba's ATH team, is preparing to launch a startup named RSI, with an initial round valuation reportedly around $80 million. Previously, he served as Chief Applied Scientist at Microsoft, and at Alibaba was responsible for model research and development and self-evolution-related work. RSI stands for Recursive Self-Improvement, whose goal is to enable AI to participate in improving its own training and operation methods. Zhu’s team plans to start with open-source tools, data, and model training services, helping enterprises in sectors including healthcare, robotics, and semiconductors to continuously optimize their proprietary models using their own data.
2 minutes ago
MEXC halts services for Russian users, triggering a 15% slump in its platform token MX.
According to HTX market data, MEXC's platform token MX has plunged 15% to $1.695, likely impacted by MEXC's official announcement that it will cease services for users in Russia and Belarus. Earlier, crypto exchange MEXC released an official notice stating the move is a measure to strengthen its global compliance operations.
2 minutes ago
NASDAQ-listed company BNB Standard will begin trading on October 26.
Nasdaq-listed company BNB Standard (stock code: BNC) announced it will ring the Nasdaq opening bell on October 26 to celebrate its corporate rebranding and the appointment of a new management team. The company’s chief executive officer will attend the bell-ringing ceremony alongside board members, its management team, investors, and ecosystem partners.
Drift exploiter sends $61M ETH to Tornado Cash, holds $194M The April 1 hack caused about $295 million in losses and was later attributed to a North Korean threat group in a Mandiant investigation.
A wallet linked to the Drift Protocol hack sent about $61 million in Ether (ETH) to Tornado Cash, a service that obscures transaction trails.
The wallet deposited 25,700 ETH to the cryptocurrency mixer over two hours on Tuesday after two months of inactivity, blockchain analytics platform Lookonchain said in an X post.
The exploiter’s addresses held about 81,454 Ether, worth roughly $194 million, according to Arkham. Crypto mixers pool funds from multiple addresses and obscure fund trails, making tracing harder.
Drift, a Solana-based decentralized exchange, reported about $295 million in losses from the April 1 hack. Drift said in June that a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The tokens give affected users a claim on a recovery pool, which held about $3.1 million at launch and receives exchange revenue and any recovered funds.
Drift exploit ranks as the third-largest crypto hack of 2026, according to DefiLlama. Other notable exploits include the $387 million Bitget hack and the $320 million Liquid Network exploit.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Drift exploiter sends $61M ETH to Tornado Cash, holds $194M The April 1 hack caused about $295 million in losses and was later attributed to a North Korean threat group in a Mandiant investigation.
A wallet linked to the Drift Protocol hack sent about $61 million in Ether (ETH) to Tornado Cash, a service that obscures transaction trails.
The wallet deposited 25,700 ETH to the cryptocurrency mixer over two hours on Tuesday after two months of inactivity, blockchain analytics platform Lookonchain said in an X post.
The exploiter’s addresses held about 81,454 Ether, worth roughly $194 million, according to Arkham. Crypto mixers pool funds from multiple addresses and obscure fund trails, making tracing harder.
Drift, a Solana-based decentralized exchange, reported about $295 million in losses from the April 1 hack. Drift said in June that a forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1. The tokens give affected users a claim on a recovery pool, which held about $3.1 million at launch and receives exchange revenue and any recovered funds.
Drift exploit ranks as the third-largest crypto hack of 2026, according to DefiLlama. Other notable exploits include the $387 million Bitget hack and the $320 million Liquid Network exploit.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
In brief Wallets tied to the April 1 Drift exploit deposited 25,700 Ethereum, worth about $61.56 million, into Tornado Cash over two hours on Tuesday. Arkham data shows the exploiter's 71 tracked addresses still hold 81,454 ETH, worth roughly $198 million, after a first 23,095 ETH round in July. Drift's DFX recovery pool held about 3.1 million USDT when claims opened Oct. 1, paying early redeemers roughly a penny per dollar lost. Wallets tied to April's $295 million Drift Protocol exploit pushed 25,700 Ethereum, worth about $61.56 million, into the crypto mixer Tornado Cash over roughly two hours on Tuesday. The addresses had been quiet for about two months before the burst.
Transfer data from Arkham Intelligence shows the deposits landing in batches of 100 ETH, about $237,800 each, plus smaller 10 ETH chunks. Those sizes match the mixer's fixed deposit pools, which let users pull funds out later from fresh addresses and break the public link between sender and receiver.
Myriad: Where does Ethereum go next? Click to make your prediction.Arkham's entity page, which tracks 71 addresses linked to the attacker, still shows 81,454 ETH sitting in those wallets after Tuesday's deposits, worth roughly $198.58 million at current prices. Besides that ETH stash, the wallet holds around $561.6K in other coins like USDT, USDC, Solana, and USDY.
Tuesday's deposits follow a first round on July 23 and 24, when an address labeled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, into the same mixer.
Drift exploiter wallet movements. Image: ArkhamThe April 1 exploit hit Drift's vaults on Solana after the attacker gained admin powers, introduced a fake token and used it to borrow out real liquidity. Drift's own asset breakdown puts the haul at $295.7 million, led by $159.3 million in JLP—the Jupiter Liquidity Provider token—and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum.
Arkham's portfolio view still lists exactly one Fartcoin in the exploiter's holdings, worth about 15 cents, a long way from the $4.1 million in Fartcoin that Drift says was taken in April.
Drift said in April that the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person and deposited $1 million of its own money to build trust. In June, Drift said forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
Drift, whose relaunched exchange now runs as Velocity, opened claims for its DFX recovery token on Oct. 1, issuing one token for every USDT of verified loss, about 299.5 million in total. The recovery pool held about 3.1 million USDT at launch, so early redemptions paid roughly 0.0104 USDT per token, or about a penny on the dollar.
The pool gets a daily cut of between 60% and 90% of Velocity's net protocol revenue, scaling up as daily revenue grows, and Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, the bounty, or law enforcement also go into the pool.
Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers
Create an account to save your articles.
Add on Google
Add Decrypt as your preferred source to see more of our stories on Google.
In brief
Wallets tied to the April 1 Drift exploit deposited 25,700 Ethereum, worth about $61.56 million, into Tornado Cash over two hours on Tuesday.
Arkham data shows the exploiter's 71 tracked addresses still hold 81,454 ETH, worth roughly $198 million, after a first 23,095 ETH round in July.
Drift's DFX recovery pool held about 3.1 million USDT when claims opened Oct. 1, paying early redeemers roughly a penny per dollar lost.
Wallets tied to April's $295 million Drift Protocol exploit pushed 25,700 Ethereum, worth about $61.56 million, into the crypto mixer Tornado Cash over roughly two hours on Tuesday. The addresses had been quiet for about two months before the burst.
Transfer data from Arkham Intelligence shows the deposits landing in batches of 100 ETH, about $237,800 each, plus smaller 10 ETH chunks. Those sizes match the mixer's fixed deposit pools, which let users pull funds out later from fresh addresses and break the public link between sender and receiver.
Myriad: Where does Ethereum go next? Click to make your prediction.Arkham's entity page, which tracks 71 addresses linked to the attacker, still shows 81,454 ETH sitting in those wallets after Tuesday's deposits, worth roughly $198.58 million at current prices. Besides that ETH stash, the wallet holds around $561.6K in other coins like USDT, USDC, Solana, and USDY.
Tuesday's deposits follow a first round on July 23 and 24, when an address labeled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, into the same mixer.
Drift exploiter wallet movements. Image: ArkhamThe April 1 exploit hit Drift's vaults on Solana after the attacker gained admin powers, introduced a fake token and used it to borrow out real liquidity. Drift's own asset breakdown puts the haul at $295.7 million, led by $159.3 million in JLP—the Jupiter Liquidity Provider token—and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum.
Arkham's portfolio view still lists exactly one Fartcoin in the exploiter's holdings, worth about 15 cents, a long way from the $4.1 million in Fartcoin that Drift says was taken in April.
Drift said in April that the attack was a six-month operation in which the group posed as a quantitative trading firm, met contributors in person and deposited $1 million of its own money to build trust. In June, Drift said forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
Drift, whose relaunched exchange now runs as Velocity, opened claims for its DFX recovery token on Oct. 1, issuing one token for every USDT of verified loss, about 299.5 million in total. The recovery pool held about 3.1 million USDT at launch, so early redemptions paid roughly 0.0104 USDT per token, or about a penny on the dollar.
The pool gets a daily cut of between 60% and 90% of Velocity's net protocol revenue, scaling up as daily revenue grows, and Tether has committed up to 127.5 million USDT toward the relaunch and recovery. Any stolen funds recovered through freezes, the bounty, or law enforcement also go into the pool.
Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers
Create an account to save your articles.
Add on Google
Add Decrypt as your preferred source to see more of our stories on Google.
Dormant wallets tied to one of 2026’s largest crypto hacks have once again become active. Blockchain analytics firms Onchain Lens and Lookonchain have detected large-scale Ethereum withdrawals originating from wallets associated with the Drift Protocol exploit, according to data from Arkham Intelligence.
Renewed laundering activity through Tornado CashAfter a two-month pause, attackers resumed operations, transferring substantial volumes of stolen ETH to Tornado Cash, a privacy-focused mixing service. Blockchain data shows the movement of funds in deliberate tranches, a strategy aimed at minimizing price disruptions and obscuring final destinations.
An address flagged by analysts as “Drift Exploiter 5” sent 13,400 ETH—valued at around $32 million—to Tornado Cash within a single day. Independent analytics providers, including MistTrack, estimate that the sum of ETH moved across all connected wallets during the same period reached as high as 25,700 ETH, or about $61.5 million.
The attackers are known to divide funds into batches of 100 ETH before processing them through Tornado Cash. This method severs transaction trails and complicates efforts by investigators to track the stolen assets on public ledgers.
This is the group’s second large-scale laundering effort. In July, they moved approximately $44 million via Tornado Cash using a similar approach. Despite these transactions, the majority of the stolen funds remain untouched. According to current blockchain analyses, between 82,000 and 94,000 ETH—worth up to $224 million—are still held in addresses linked to the exploiters.
Mini dictionary: Tornado Cash, a decentralized cryptocurrency mixer, is designed to improve transaction privacy on Ethereum by pooling user deposits and allowing withdrawals from a different address, breaking the on-chain link between sender and recipient. It has been widely used for both legitimate privacy purposes and for laundering stolen crypto assets.
PeriodETH LaunderedUSD EquivalentJuly 2026~22,000 ETH$44 millionOctober 2026Up to 25,700 ETH$61.5 millionRemaining82,000 – 94,000 ETHUp to $224 millionDrift Protocol hack: A landmark DeFi breachThe Ethereum being laundered today stems from the April 1, 2026 attack on Drift Protocol, a decentralized derivatives platform built on Solana. In just 12 minutes, the protocol suffered losses of $285 million, setting a new precedent in DeFi security incidents.
According to post-mortem analyses, the hackers exploited hidden vulnerabilities in popular software tools, Cursor and VSCode, to infiltrate devices belonging to members of Drift’s Security Council. By acquiring privileged admin keys, the attackers gained control over core platform functions. The breach culminated in the deployment of a counterfeit CarbonVote token, which served as fake collateral, enabling the extraction of real liquidity from the protocol.
Drift Protocol’s security review highlights that the exploit showcased a “rare level of planning and technical sophistication,” combining multiple attack vectors and several layers of deception.
For Drift’s investors, seeing the stolen Ethereum reappear in mixers effectively signals the loss of any realistic chance of recovery. In August, authorities managed to freeze only $9.2 million, with the majority of assets now circulating in the open market under different identities.
Recovery efforts and investor compensationDrift Protocol has initiated a compensation plan for affected users, funded through its native DFX tokens. Tether provided initial support for the buyback fund, but current coverage stands at only about 1 percent of total user losses.
The development team has pledged to channel future platform revenues into replenishing the compensation fund, aiming to gradually close the recovery gap as stolen funds seep back into market circulation.
Platform representatives emphasize their ongoing commitment: “We are working to rebuild user trust and restore losses, but the scale of the attack presents complex challenges.”
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Micron plans to invest up to $3 billion in the U.S. semiconductor supply chain to fund critical mineral processing projects.
Micron Technology announced it will fund Indium Corporation’s expansion project in Rome, New York, to restore the critical mineral processing capacity required for U.S. semiconductor manufacturing. The two sides will sign a long-term supply agreement to ensure stable supply of high-purity mineral raw materials and reduce reliance on globally concentrated mineral refining capacity. This collaboration is part of Micron’s U.S. semiconductor supply chain investment plan unveiled in July this year, which is set to invest up to $3 billion. Micron also plans to inject over $250 billion into U.S.-based wafer manufacturing and related technologies by 2035, with the latest project providing supply chain support for its domestic manufacturing layout.
7 minutes ago
OKX to list AXIS perpetual contracts
OKX will officially launch AXISUSDT perpetual contracts on its web platform, mobile app and API at 22:00 (UTC+8) on October 21, 2026. The detailed rules are as follows: 1. Opening time: The AXIS USDT contract will open for trading at 22:00 (UTC+8) on October 21, 2026 2. Contract overview: Axis Robotics builds a self-evolving data engine for embodied intelligence.
7 minutes ago
Anthropic is reportedly preparing a Claude model that better understands user intent, and it may be Fable 5.5.
Dongcha Beating AI Flash News: Anthropic is preparing to launch a new model better at understanding users' real intentions. The Information cited a pre-tester as saying the new model outperforms the currently available Claude in reasoning and meeting user needs. For example, when a user only asks to fix a single bug, it may further identify common issues causing such bugs and ask if they want to fix them together. The new model is also said to be better at proposing unconventional solutions: if a user consults about stock investment, it may design its own prediction algorithm instead of just repeating common analysis methods like price-earnings ratios. However, these evaluations only come from one tester so far, with no public test data available. The community speculates the new model may be Claude Fable 5.5. On October 13, LiteLLM synced `claude-fable-5-5` from the Azure model directory, but deleted the entry the next day after audit. Meanwhile, Google is internally testing Gemini 4 Carbon. Business Insider previously reported that some employees believe its programming ability is close to Claude Opus 5.5. OpenAI is also preparing a new version of Terra, with reports suggesting it may launch in the coming weeks, with further improved capabilities and an expected price lower than GPT-6.1 Sol.
7 minutes ago
Cantor Fitzgerald Reiterates Overweight Rating on Tesla, Sets Target Price at $485
Leading financial services firm Cantor Fitzgerald has reaffirmed its "Overweight" rating on Tesla, maintaining its target price at $485. Analysts at the firm expect Tesla's Roadster sports car demonstration to be impressive, but its actual contribution to the company's short-term profits remains limited. They noted that the Roadster's subsequent commercialization still faces uncertainties including road legality and mass production progress, so even with an impressive demonstration, it may not quickly translate into substantial financial gains.
7 minutes ago
A trader with a 0% win rate liquidated all his meme coin holdings, incurring total losses of over $1 million.
According to Lookonchain's monitoring, trader Jelitics traded 12 meme coins on the Solana blockchain, all of which ended in losses, resulting in a 0% win rate and total losses exceeding $1 million. He has now sold all his meme coin holdings.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Per Lookonchain monitoring, Drift Protocol has resumed activity after two months of inactivity, transferring ETH to Tornado Cash. Over the past two hours, the attacker has deposited 25,700 ETH (worth roughly $61.56 million) into Tornado Cash, and currently holds 81,864 ETH (valued at approximately $195 million).
A wallet group linked to the $285 million Drift Protocol exploit has resumed moving stolen cryptocurrency, with blockchain analysts reporting that approximately $61.56 million in Ethereum was deposited into Tornado Cash on October 20.
Summary
Lookonchain reported that the Drift exploiter deposited 25,700 ETH, worth approximately $61.56 million, into Tornado Cash on October 20. Earlier monitoring by Onchain Lens identified at least 13,400 ETH, worth around $32 million, moving to the mixer. The transfers follow an April 1 attack that Chainalysis estimated caused $285 million in losses. Drift said a subsequent forensic investigation attributed the attack to a North Korea-linked group. The protocol opened DFX recovery-token claims and redemptions for affected users on October 1. According to blockchain monitoring account Lookonchain, the suspected exploiter transferred 25,700 ETH into the privacy-focused mixing service over a two-hour period, ending roughly two months of reported inactivity. The tracker estimated that the wallets still controlled 81,864 ETH worth approximately $195 million.
An earlier Onchain Lens update identified at least 13,400 ETH, valued at roughly $32 million, flowing into Tornado Cash. Its accompanying wallet snapshot showed approximately $224.59 million in remaining assets.
Meanwhile, the two trackers reported different amounts as the transfers unfolded. The latest wallet balances have yet to be independently verified through Arkham.
Drift exploiter resumes Tornado Cash transfers The reported activity represents another stage in the movement of assets taken from Drift, a Solana-based decentralized derivatives platform.
Tornado Cash pools cryptocurrency deposits and allows funds to be withdrawn through separate addresses, making direct transaction tracing more difficult. Sending ETH to the service does not establish whether the funds were converted into cash, sold on an exchange or recovered by another party.
A separate monitoring account reported that one wallet deposited 19,600 ETH, worth approximately $46.81 million, through 196 transactions on October 20. That figure falls between the two social-media observations but has not been reconciled against a complete transaction-level record.
The Drift Protocol exploiter deposited 19,600 ETH (~$46.81M) into Tornado Cash in 196 transactions on October 20, 2026, moving funds held for roughly 202 days, according to the our Tornado monitoring system.
On April 1, the Solana perpetuals platform suffered an estimated $285M… https://t.co/OEjYr8uRzQ pic.twitter.com/sXaSkLDsRe
— Salus (@salus_sec) October 20, 2026 The same account identified a wallet ending in 57c1 that had reportedly held stolen assets since April. It estimated the address retained 6,114.15 ETH, valued near $14.6 million, after its first outgoing transactions.
These wallet-specific figures cannot establish the exploiter’s total remaining assets because investigators track several addresses and the balances change as transfers occur.
April Drift exploit followed months of social engineering The original attack took place on April 1, when attackers obtained administrative control of Drift through transaction approvals from members of its Security Council.
In an April 9 investigation, Chainalysis estimated losses at $285 million, representing more than half the protocol’s total value locked.
The attackers reportedly spent months posing as representatives of a trading firm and building relationships with Drift contributors. They exploited Solana’s durable nonce feature, which permits pre-signed transactions to remain valid until execution.
After obtaining sufficient multisignature approvals, the attackers took control of administrative permissions and approved a fake token called CarbonVote Token, or CVT, as collateral.
According to Chainalysis, the attackers manufactured trading activity around CVT to create an artificial price history. They then used the token as collateral to withdraw genuine assets, including stablecoins and cryptocurrencies.
Subsequently, Drift published a more detailed asset breakdown totaling approximately $295.7 million in stolen tokens. The figure differs from the initial forensic estimate because the reports use different valuations and accounting scopes.
Investigators traced portions of the proceeds moving between Solana and Ethereum, where the attacker accumulated ETH before the latest reported mixing activity.
Investigators linked the attack to North Korean operators Security researchers have connected the Drift theft to a suspected North Korean hacking operation.
In an April 7 assessment, blockchain analytics company Elliptic identified transaction patterns and laundering techniques consistent with earlier North Korea-linked attacks.
Drift later reported that an investigation by cybersecurity firm Mandiant had attributed the incident to UNC6862, a North Korean threat group.
The platform had previously linked the attack to the operators behind Radiant Capital’s October 2024 exploit. Radiant suffered losses estimated at approximately $50 million in that incident.
The case was part of a series of major DeFi thefts in April. As crypto.news previously reported, April exploit losses exceeded $600 million during the month’s first 18 days, including separate attacks on Drift and KelpDAO.
Drift recovery claims opened in October While investigators continued tracing the stolen cryptocurrency, Drift established a program to compensate affected users.
On October 1, the project opened claims and redemptions for DFX recovery tokens. Its announcement stated that each verified USDT of loss entitled an affected user to one DFX token.
The protocol fixed the total token supply at approximately 299.5 million and said its recovery pool contained around 3.1 million USDT at launch.
Users can redeem DFX against available pool funds, trade the tokens or retain them while additional funds accumulate. The redemption amount depends on the pool balance and outstanding token supply, so holding a DFX token does not guarantee immediate repayment at face value.
The project said proceeds from its relaunched trading platform, Velocity, would contribute to the recovery pool. Tether has separately committed up to $127.5 million in support, while other partners have committed up to $20 million.
Drift’s October announcement states that funds recovered through enforcement action, freezing or other recovery efforts will be added to the pool. DFX claims remain open until January 1, 2028.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
According to on-chain analyst Ai Yi (@ai_9684xtpa), a whale that accumulated 5,147 ETH at an average price of $1,886.7 between August 12 and 13 transferred 5,170 ETH (valued at $12.82 million) to Tornado Cash five hours ago. The batch of tokens has an unrealized profit of $3.056 million, and the purpose of the transfer remains unknown.
Relevant content
Apple's stock price hits an all-time high, currently trading at $346.1.
According to BIT (bit.com) market data, Apple (AAPL.O) stock has hit a new all-time high, currently trading at $346.1, up 1.5%.
10 minutes ago
Goldman Sachs CEO denies resignation rumors, saying there are currently no leadership succession plans or timelines.
Goldman Sachs CEO David Solomon has downplayed recent rumors of a possible leadership transition at the firm, describing them as just "noise". Goldman's Chief Operating Officer John Waldron has long been viewed as a potential successor to Solomon. Recent reports suggested Solomon could step down as early as next year, bringing the timing of Goldman's leadership handover back into the market's spotlight. Solomon stated Tuesday during an earnings call with analysts: "I want to be clear: there are no ongoing succession transition arrangements at Goldman Sachs, nor any related timeline. The board and I are fully focused on the company's growth strategy and continue to deliver outstanding services to our clients." He added that he is satisfied with the company's development progress, which in turn makes him enjoy his current role more.
10 minutes ago
U.S. corporate earnings growth expectations continue to cool, with analysts warning that high-valued U.S. stocks have limited room for error.
Data compiled by Bank of America shows that while S&P 500 third-quarter earnings expectations remain strong, profit growth is projected to slow quarter-over-quarter for 10 of its 11 sectors. Data from industry research aggregators indicates analysts expect S&P 500 constituents’ profit growth to decelerate from 25% in Q3 2026 and 28% in Q4 2026 to 18% in the first half of 2027, signaling a slight softening in the overall earnings outlook ahead. A slowdown in profit growth expectations alone is not enough to end the stock market rally. However, with U.S. stocks near record highs and growing market concerns that inflation pressures will prove more persistent than anticipated, U.S. companies must deliver sufficiently strong results to push equities to new peaks. Luca Paolini, chief strategist at Pictet Asset Management, noted: “We are seeing early signs that profit growth momentum may be peaking. With the bar for earnings expectations set so high, even a slight miss on results could trigger sharp market reactions.”
10 minutes ago
US stock market's storage and optical communication sectors saw broad declines, with CRDO falling more than 6%.
According to market data from BIT (bit.com), the U.S. stock market’s storage and optical communication sectors saw broad declines. Among them, storage concept stocks: Micron Technology (MU) fell 4.31%, Western Digital (WDC) dropped 3.55%, SanDisk (SNDK) declined 2.48%, and Seagate Technology (STX) fell 3.29%. Optical communication concept stocks: Applied Optoelectronics (AAOI) fell 3.15%, Coherent (COHR) dropped 2.58%, Credo (CRDO) declined 6.27%, Lumentum (LITE) fell 2%, Nokia (NOK) dropped 1.36%, and Astera Labs (ALAB) fell 3%.
10 minutes ago
High interest rates have not dampened lending demand, with the Big Three US banks posting another all-time high in net interest income.
Despite rising interest rates, U.S. consumers and businesses have kept borrowing, pushing loan revenue at America’s three largest banks to another record high in the third quarter. Earnings reports released Tuesday by JPMorgan Chase, Citigroup, and Wells Fargo show the three firms’ combined net interest income reached $56.5 billion in the third quarter, marking the fifth consecutive quarter of hitting an all-time high. JPMorgan forecasts net interest income will rise further in 2027. This outlook stands in sharp contrast to expectations earlier this year, when banks widely projected interest rates would fall. Back then, record trading revenue had captured most investors’ focus, leaving traditional interest income from loans and other interest-earning assets relatively overlooked. Banks also noted that U.S. consumers and businesses still have the ability to repay loans on time. All three banks reported a decline in non-accrual loans—loans for which banks cease recognizing interest income. Bank of America is scheduled to release its third-quarter results on Wednesday. However, amid a host of geopolitical uncertainties including the wars in Ukraine and the Middle East, persistent stubborn inflation, and elevated oil prices, banks remain cautious.
10 minutes ago
A trader engaged in $2.84 billion worth of wash trading on Papertrade, suffering a net loss of $637,000.
According to Lookonchain's monitoring, a trader has accumulated a $637,000 loss on Papertrade, with a cumulative notional trading volume of $2.84 billion. The trader incurred a $1.71 million trading loss and received 136 million PAPER tokens. Additionally, the trader earned $1.07 million in USDC rewards via staking, of which $943,000 has been claimed while $130,000 remains unclaimed. Overall, the trader’s net loss stands at $637,000.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Iran's top security official: The U.S. response to Iran's latest proposal is 'insufficient'
According to Iran's Fars News Agency, the Secretary of Iran's Supreme National Security Council stated that the United States' response to Iran's latest proposal is "insufficient". The U.S. needs to clarify issues that remain unclear to the Iranian side. The U.S. has accepted some of our conditions, while other issues remain unclear.
1 hours ago
Papertrade responds to allegations of price manipulation and protocol vulnerabilities: The issue arises from loose position limits during its initial launch phase, and parameters have already begun to be tightened.
Papertrade’s official response to allegations of price manipulation exploits and critical protocol vulnerabilities states that it has never been feasible to grant equal priority to small and large orders. Doing so would lead to front-end congestion from spam transactions—a far worse outcome than the current queuing mechanism. Against these constraints, the team has designed the fair launch to be as inclusive as possible. Last night’s manipulation attempt targeting the BTC/ETH pair on Hyperliquid’s Best Bid Offer (BBO) was not a flaw in the six-month-developed mechanism. Such scenarios were already accounted for; the incident only occurred because position limits were set very loosely during the early launch phase to mitigate congestion. Had position limits been imposed during peak queuing demand, it would have only exacerbated slow user experiences. The queuing mechanism itself, due to uncertainty in entry/exit confirmation times, actually provides natural protection against manipulation. As congestion eases, the team has begun tightening position limits at both on-chain and relay levels. In such a system, manipulation attacks are always possible—the key is whether such attempts are economically viable. The official goal is to set parameters such that manipulation is almost never profitable. Even if successful, tail risks are extremely high, and the expected value is negative.
1 hours ago
Analysis: 53% of Bitcoin's holdings are concentrated above $83,000, with the $84,000 to $85,000 range serving as a key breakout level.
Crypto analyst Darkfost notes that approximately 53% of total invested capital is concentrated above Bitcoin’s current price level of around $83,000, meaning buying Bitcoin at this level would put your holding cost lower than more than half of existing investors. The $84,000–$85,000 range is the largest cluster of trading positions; many investors react at this key level, making it Bitcoin’s core resistance that it must break through. Moving lower, the $79,000–$77,000 range may act as a support level. If the price fails to effectively break through the $84,000–$85,000 range, the market may first retest this support zone. Once the price breaks above this dense position cluster with significant trading volume and holds steady there, it will mean the cost pressure for most existing holders has been absorbed, and subsequent upward resistance will ease noticeably.
1 hours ago
Strive’s CEO followed Michael Saylor’s lead in releasing Bitcoin Tracker information, hinting at an upcoming announcement of additional Bitcoin purchases.
Bitcoin treasury firm Strive CEO Matt Cole, following in Michael Saylor’s footsteps, has released details related to a Bitcoin tracker. He stated “Think ?igger,” hinting that he will announce another Bitcoin purchase next week. Earlier on October 5, Matt Cole disclosed that Strive bought 2,000 BTC at an average price of $84,422 per coin, totaling approximately $169 million, bringing the company’s total Bitcoin holdings to 29,462 coins.
Onchain derivatives protocol Variational, built on Arbitrum, has announced a campaign to distribute over $1 million and 150,000 platform points to the chain’s top 10,000 most active perpetual contract traders (excluding market makers) to attract their onboarding. Eligible traders can receive up to 3,000 Variational points, while referrers are entitled to up to $15,000 in rewards. More than 750 new users have already registered via the initiative. On September 24, Variational unveiled its VAR tokenomics: 32% of total tokens will be allocated to a genesis airdrop (distributed proportionally to users’ points, fully unlocked at TGE), 18% to ecosystem reserves (managed by the foundation), and 50% to the team and investors (locked for 12 months post-TGE, then linearly unlocked over a minimum of 3 years). The team plans to hold its token generation event (TGE) in Q4, and will continue distributing 150,000 points weekly until then. Additional airdrop terms include: a minimum of 1 point is required to claim; unclaimed airdrop allocations will be burned; and 100% of protocol revenue will be used for VAR buybacks and burns.
1 hours ago
Specter: Arkham Incorrectly Tags Addresses Linked to CryptoBillis Ledger Theft
On-chain analyst Specter has pointed out that Arkham incorrectly tagged a THORChain wallet address as linked to the CryptoBillis Ledger hack, which caused crypto security firm PeckShield to mistakenly assert that the CryptoBillis Ledger attacker had deposited approximately $3.89 million in crypto assets to Binance over the past two days. PeckShieldAlert has responded that it will correct the related labels.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
According to Salus monitoring, the attacker behind the Triple-A breach has transferred 4,970 ETH to Tornado Cash, worth around $12.4 million. The attacker routed two separate fund streams through a single wallet, depositing the funds into Tornado Cash via 49 transactions of 100 ETH each and 7 transactions of 10 ETH each. One of the streams includes funds that were previously withdrawn from a mixer. On July 27, stablecoin payment infrastructure Triple-A was hacked, with total losses totaling approximately $11.8 million.
Relevant content
Two whale addresses have collectively withdrawn 5,965 ETH over the past 20 minutes, and may continue buying.
According to on-chain analyst Ai Yi (@ai_9684xtpa), two addresses belonging to the same whale have built positions worth $14.89 million in ETH. Over the past 20 minutes, the two addresses have withdrawn a total of 5,965 ETH from Binance at an average price of $2,496.95 per ETH. Notably, the address that sourced the funds also transferred similar amounts of USDC to several other new addresses, suggesting it may continue to buy ETH in batches.
13 minutes ago
Relay to Decommission Relay Vaults, Withdrawal Page to Close on December 31
Cross-chain protocol Relay announced via Twitter that it will shut down Relay Vaults. Users holding funds in the vaults must withdraw via the official portal, which will close on December 31, 2026. After that date, users can still withdraw funds directly from the smart contracts. The project stated that Vaults are an optional product for users to provide liquidity, and the shutdown is to make way for an upcoming improved version, with relevant details to be announced later. Swaps, payment services, and all other integrations remain unaffected and will operate as normal.
13 minutes ago
NEAR treasury firm SVRN acquires NEAR infrastructure platform FastNEAR
According to official announcements, NEAR treasury firm SVRN has acquired NEAR infrastructure platform FastNEAR. FastNEAR will join SVRN as a wholly owned subsidiary, with its co-founders Evgeny (Eugene) Kuzyakov and Mike Purvis also joining the SVRN team. The announcement notes that FastNEAR is a high-performance RPC infrastructure provider powering NEAR applications, and it also supports most of NEAR’s data layer, including server clusters handling network read and write operations, archival infrastructure storing full transaction histories, and NEARDATA – a data source for developers to process these historical records.
13 minutes ago
Entropy paid 569.98 HYPE to acquire Xiaomi’s code, and may soon launch a perpetual contract for it.
HIP-3 market deployer Entropy won the auction for the code "xiaomi" with 569.98 HYPE, and is expected to launch its perpetual contracts soon.
13 minutes ago
CZ: Does not oppose hardware wallets, noting that different wallet products are suitable for different scenarios.
CZ posted on X that users should prioritize asset security (SAFU), adding that he does not oppose hardware wallets or self-custody. He pointed out that different wallets and products suit different use cases, with distinct security implications and best practices. YZi Labs has invested in hardware wallet projects including OneKey and SafePal, as well as mobile wallet products such as Trust Wallet.
13 minutes ago
Trump: I have made enormous contributions to world peace, and it is unbelievable that I was not selected for the Nobel Peace Prize.
Trump posted on Truth Social, stating: "I ended 8 wars, and 2 more are set to end or be resolved. I freed all Israeli hostages, including the last 28 survivors and victims. I released hundreds of hostages from around the world and sent them back home. I won the Venezuela conflict, captured the dictator who tyrannically ruled the country, and prevented Iran—the world’s leading state sponsor of terrorism—from acquiring nuclear weapons—wait a minute! Yet despite all I and the U.S. have accomplished, I did not receive the Nobel Peace Prize. It’s truly unbelievable!"
The attacker behind Triple-A’s July treasury breach has transferred 4,970 ETH worth approximately $12.4 million into Tornado Cash, according to blockchain security firm Salus.
Summary
4,970 ETH entered Tornado Cash on Oct. 9 through 56 deposits, according to Salus. The attacker combined funds from two intermediary addresses through a single wallet before depositing them. Triple-A said the July breach affected company treasury assets, while customer funds remained untouched. The company attributed the attack to social engineering and engaged specialists to trace the stolen assets. Salus said its Tornado monitoring system tracked 49 deposits of 100 ETH and seven deposits of 10 ETH linked to the Triple-A attacker on Oct. 9.
In its account of the transactions, the security firm described two streams of funds that passed through separate intermediary addresses before reaching one wallet. Salus said the attacker used that wallet to make the Tornado Cash deposits, with one stream containing funds from earlier withdrawals from the mixer.
The firm valued the combined deposits at approximately $12.4 million. Its tracing account placed the transfers after the attacker had moved assets across blockchains to Ethereum, exchanged the tokens, and divided the funds between two addresses on Sep. 6.
Triple-A attacker combined two fund streams before depositing ETH According to Salus, the Sep. 6 transfers separated the funds into two intermediary wallets after the cross-chain movements and asset swaps. The attacker later routed both streams through a single address before depositing the Ether into Tornado Cash.
In the post, Salus stated:
“One stream included funds from earlier withdrawals.”
The firm’s transaction breakdown puts 4,900 ETH in the 49 larger deposits and another 70 ETH in the seven smaller deposits. Its account links the activity to the attacker responsible for stealing Triple-A’s own treasury assets in July, when public estimates placed the loss at approximately $11.8 million.
Earlier tracing had already identified Ethereum as a destination for assets removed from wallets associated with the payments company. On July 25, crypto.news reported the wallet drain, citing researchers who put the receiving address’s balance at approximately 5,226.66 ETH, worth about $9.7 million at the time.
In that initial reporting, blockchain investigator Specter estimated that more than $9.3 million had been removed, exchanged, and bridged to Ethereum. PeckShield subsequently drew attention to the transactions, while later estimates put the suspected loss above $9.7 million.
Triple-A said the July breach affected its treasury assets By July 27, Triple-A had confirmed unauthorized wallet access and said the financial impact would be absorbed through its treasury reserves. The report attributed the approximately $11.8 million loss estimate to Specter.
In its official statement, the company said it detected unauthorized access on July 25 and temporarily placed certain services into maintenance mode for approximately three hours while securing the affected infrastructure.
Triple-A said the compromised wallets belonged to Triple A Technologies Pte. Ltd., its Singapore entity. According to the statement, no other company entities or operations were affected, and transactions and settlements resumed normally across all markets after security checks.
Addressing its financial position, Triple-A stated:
“Triple-A remains well capitalised, is able to meet all its liabilities.”
The company also said customer funds were held separately in trust accounts maintained with safeguarding institutions. According to Triple-A, those accounts were not exposed because it did not provide digital asset custody on behalf of its clients.
In the same statement, the payments provider identified internal and external cybersecurity experts, blockchain forensic specialists, and Singapore police as participants in its investigation and asset-recovery efforts.
Social engineering gave the attacker access to operational systems In an Aug. 21 post-mortem, Triple-A said the attack began with social engineering against an engineering employee. According to the company, the approach involved impersonation, communications across different channels, and a live call.
After compromising credentials, the attacker obtained elevated system permissions, deployed malware, accessed production databases, and abused API credentials to execute cryptocurrency withdrawals, the report said.
The company identified affected operational wallets on TRON, Ethereum, Polygon, and Arbitrum. Its post-mortem said customer money remained in separate trust accounts with institutions including DBS and Standard Chartered.
For the investigation, Triple-A engaged Sygnia to conduct forensic work and strengthen security controls, while zeroShadow handled asset tracing and supported recovery efforts. The company said it notified the Monetary Authority of Singapore and Singapore police immediately after detecting the incident.
According to the report, remediation included tighter access and approval requirements, credential restrictions, separation of operational environments, expanded monitoring, and reviews of wallet exposure limits. Triple-A said active attacker access had been removed and identified persistence mechanisms eliminated, while tracing and potential freezing actions remained in progress.
Tornado Cash sanctions were removed while U.S. proceedings continued In March 2025, the U.S. Treasury removed Tornado Cash sanctions, reversing the designation imposed in August 2022.
Treasury’s delisting announcement said the decision followed its review of legal and policy questions concerning financial sanctions and evolving technology. The department nevertheless said it would continue monitoring transactions that could benefit malicious cyber actors or North Korea.
Separately, an Aug. 26 report detailed how a U.S. judge had postponed Roman Storm’s retrial until April 26, 2027. According to the Aug. 25 court order, Judge Katherine Polk Failla granted the Tornado Cash co-founder’s request after his defense cited scheduling conflicts and a pending acquittal motion.
The report said Storm’s first jury convicted him in August 2025 of conspiracy to operate an unlicensed money transmitting business but deadlocked on money laundering and sanctions conspiracy charges. Under the revised calendar, the final pretrial conference was scheduled for April 20, 2027, six days before the retrial.
Ethereum rose 71% in Q3, with its profit supply ratio still not entering the warning zone.
Coinbase Institutional issued a report noting that ETH rallied 71% in the third quarter, yet on-chain metrics show no clear signs of overheating in its price action. Data indicates the share of ETH supply in profit has exited the accumulation range, but remains well below the warning threshold, signaling the current market has not reached the overextended levels flagged by historical metrics.
2 hours ago
Former Mt.Gox CEO claims to have discovered Ledger hardware wallets implanted with spy modules, which can send mnemonic phrase information via LTE.
Former Mt. Gox CEO Mark Karpelès revealed in a post that a Ledger hardware wallet he received is suspected to have an implanted spy module. The device originated from Malaysia; its outer packaging’s heat-shrink film was intact, and anomalies were not immediately noticeable upon opening. The implant was hidden in the position of the screen’s original buffer pad. Karpelès further detailed that the module contains LTE communication components, an antenna, eSIM, and a microcontroller connected to Ledger’s SPI bus. It can analyze characters displayed on the device to users and exfiltrate relevant data after the mnemonic phrase is configured. Attackers may subsequently monitor the victim’s wallet address and transfer assets at an opportune moment. He urged users to inspect their devices in accordance with Ledger’s official guidance.
2 hours ago
MAGIC rose over 60% in 24 hours, pushing its market capitalization to $33 million.
According to HTX market data, MAGIC has surged over 60% in the past 24 hours, currently trading at $0.0992, with its market cap rising to $33 million.
2 hours ago
某用户6月抄底80枚BTC浮盈138万美元，一周前存入Ledger现已全部被盗
According to Lookonchain’s monitoring, a user purchased 80 BTC for approximately $65,000 around four months ago, with a total investment of about $5.2 million. The user once recorded an unrealized profit of roughly $1.38 million. However, the user bought a Ledger hardware wallet from third-party dealer CryptoBillis a week ago and transferred all 80 BTC into it, only to have the entire funds stolen now. This incident is linked to recent fund thefts involving multiple CryptoBillis clients, though whether the devices were tampered with, the specific attack method, and the attacker’s identity remain unconfirmed.
2 hours ago
Investor Loses 80 $BTC ($5.2M) After Buying Compromised Ledger From Reseller
Poor guy! 4 months ago, he bought 80 $BTC ($5.2M) at a low price of ~$65,000 and was sitting on a $1.38M profit. But a week ago, he bought a Ledger device from reseller CryptoBillis and deposited all 80 $BTC into it. Now he's lost everything.
2 hours ago
A Ledger user who purchased the device only three weeks ago had 7 million USDT stolen, likely the largest single loss in this incident.
Multiple users who purchased Ledger hardware wallets from dealer CryptoBillis have suffered fund theft, with total losses approaching $90 million. According to monitoring by on-chain analytics firm Lookonchain, a user with address TY24Ya bought a Ledger device from CryptoBillis three weeks ago, deposited 7 million USDT into it, and roughly 10 hours ago, the entire sum was stolen—marking one of the largest individual losses in this incident. To date, whether the devices were tampered with, the specific technical root cause of the theft, and the attacker’s identity remain unconfirmed. The public is advised to exercise vigilance and approach hardware wallets from unvetted sources and third-party distribution channels with caution.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
HyperLabs has transferred 1.875 million HYPE tokens to the wallets of five OTC buyers.
Per monitoring by Onchain Lens, HyperLabs—the development team behind Hyperliquid—has completed the 7-day unbonding process for 3.75 million HYPE tokens. The tokens are now reflected in its spot balance, valued at approximately $330 million. Notably, these tokens will not be sold on the public market; instead, they are earmarked for an over-the-counter (OTC) transaction the team struck with an undisclosed entity. To date, 1.875 million HYPE has been allocated to five OTC buyer wallets, with each receiving 375,000 tokens—accounting for 50% of the total 3.75 million HYPE allocated in this OTC deal.
5 hours ago
Eric Trump: AI will become the fastest driver of growth for the crypto industry, and capital will continue to rotate between the two sectors.
According to Bloomberg, Eric Trump, the second son of U.S. President Donald Trump, told attendees at Singapore’s Token2049 conference that large-scale investments in AI will ultimately become the fastest driver of growth for digital assets. Citing an example of AI agents booking vacations, he said such agents would use crypto wallets instead of fiat currencies for transactions, adding that the faster AI integrates into daily life, the faster the crypto industry will expand. Eric noted that Bitcoin has recently rebounded above $80,000, a sign that capital is flowing back to the crypto market from AI investments, and he believes funds will continue to rotate between AI and crypto assets. Additionally, he said the growth of dollar-backed stablecoins could boost demand for U.S. Treasuries. He also emphasized the "public welfare" value of asset tokenization, arguing that tokenizing high-end real estate, artworks, and music royalties would allow a broader public to invest in assets that were previously mainly accessible to wealthy investors. When discussing banks, he said financial institutions had previously tried to hinder the development of digital assets, but now they are racing to adopt crypto technologies.
5 hours ago
Chair of the U.S. House Financial Services Committee: SEC and CFTC’s crypto regulatory actions remain insufficient, and he hopes the CLARITY Act will be passed after the midterm elections.
U.S. House Financial Services Committee Chairman French Hill stated that while the SEC and CFTC have taken steps to advance crypto regulation, these actions still fall short of the long-term stability congressional legislation can deliver. After the Senate failed to pass the Digital Asset Market Clarity (CLARITY) Act last month, the two regulators unveiled related rulemaking plans, but Hill argues permanent legislative changes are still needed to ensure the U.S. retains its leadership in digital assets and blockchain technology. In an interview with Fox Business, Hill said he remains hopeful Congress will pass the CLARITY Act during the post-midterm election lame-duck session. Between the November election and the swearing-in of the new 2027 Congress, the Senate will only have 22 legislative days. Election results could sway lawmakers’ voting stances on the bill. The two regulators currently have a combined seven vacant commissioner seats: after Hester Peirce announced her resignation last week, the SEC is left with only Chairman Paul Atkins and Commissioner Mark Uyeda, while CFTC Chairman Michael Selig is the agency’s sole serving commissioner.
5 hours ago
HyperLabs has completed the unstaking redemption of 3.75 million HYPE, equivalent to approximately $332 million.
According to on-chain analyst Yu Jin’s monitoring, the 3.75 million HYPE tokens (valued at $332 million) that HyperLabs, the development team behind Hyperliquid, applied to unstake seven days ago have been successfully redeemed just two minutes ago.
5 hours ago
Escalating tensions in the Middle East boost safe-haven demand, with the US Dollar Index approaching its year-to-date high.
Against the backdrop of rising oil prices and further escalating tensions in the Middle East, investors flocked to safe-haven assets, leading to a notable strengthening of the U.S. dollar on Wednesday. Following an increase in Iranian attacks targeting vessels in the Strait of Hormuz, the U.S. Dollar Index (DXY) rose as much as 0.5%, moving in lockstep with oil prices and now approaching its year-to-date high. Among G10 currencies, nearly all have fallen against the U.S. dollar, with the euro posting the weakest performance, underperforming other major currencies. Catherine Brooks, head of research at XTB, said in a report: "The U.S. dollar is acting as a counter-cyclical asset, attracting safe-haven inflows as other asset classes are sold off." (Jinshi)
5 hours ago
Coinbase will list PONS for spot trading.
Coinbase will launch spot trading for Pons (PONS) on October 7. Should liquidity conditions be met and trading be supported in relevant regions, the PONS-USD trading pair will open today.
Federal prosecutors cited a recent appeals court ruling involving cryptocurrency mixer Bitcoin Fog as supplemental authority for their opposition to Tornado Cash developer Roman Storm’s acquittal.
In a Monday filing, prosecutors cited a Sept. 25 appeals court ruling that affirmed the convictions and sentence of Bitcoin Fog operator Roman Sterlingov.
The D.C. Circuit held that venue in Washington, D.C., was proper for all four counts. For the money-laundering counts, it relied on evidence that an undercover agent conducted Bitcoin Fog transactions from his D.C. office. For the unlicensed money-transmission counts, it found sufficient evidence that Bitcoin Fog had served customers in the district.
Prosecutors said the Bitcoin Fog ruling “directly supports” their position in Storm’s case, arguing that Tornado Cash activity in Manhattan was sufficient to establish venue in the Southern District of New York for Storm’s money-laundering and unlicensed money-transmission conspiracy charges. They pointed to testimony from Shakeeb Ahmed, who said he used Tornado Cash from his Manhattan apartment.
Judge Katherine Polk Failla heard arguments on Storm’s acquittal motion in April 2026 and has not yet ruled. A retrial on the money-laundering and sanctions conspiracy counts on which the jury deadlocked is scheduled for April 26, 2027, if those charges remain pending.
A jury convicted Storm in August 2025 of conspiring to operate an unlicensed money-transmitting business but deadlocked on the money-laundering and sanctions-conspiracy charges. Storm filed his post-trial motion for acquittal in September 2025, arguing that prosecutors failed to prove he intended to help criminals misuse Tornado Cash.
DOJ leans on Bitcoin Fog ruling in New York argumentIn his 2025 acquittal motion, Storm argued that Ahmed’s use of Tornado Cash from his Manhattan apartment was not enough to establish venue in New York because the transactions did not further the alleged conspiracy.
Prosecutors argued that even short-lived deposits can help a mixer by increasing the pool of transactions used to obscure the movement of funds. They said that reasoning applies to Ahmed’s Tornado Cash activity and supports their argument that his use of the service furthered the alleged conspiracy.
Storm criticized the filing in an X on Monday, saying, “The DOJ is still coming after me with everything it has.”
He also cited the Treasury Department’s Monday announcement that it would withdraw its proposed crypto-mixer rule, arguing that the government is taking conflicting approaches to crypto privacy tools.
Magazine: US crypto rules need to survive the next election
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
