# Chain Incident > Security incidents, wallets and network risks. Canonical: https://chainincident.com/ ## Latest news - [Initia halts layer-1 network and rollups after security incident](https://chainincident.com/news/6aad7ccf-c166-4e8e-9a53-13bdfb3c5c9f) — 2026-10-23T18:41:45.632Z Initia confirmed an October 23 halt across its L1 and rollups while teams investigate the scope of the incident. [Read as Markdown](https://chainincident.com/news/6aad7ccf-c166-4e8e-9a53-13bdfb3c5c9f/index.md) - [Bitcoin Core revises disclosure for easily discoverable flaws](https://chainincident.com/news/00cd3bcc-5c16-47be-bf3f-f6ddce2aaa6c) — 2026-10-23T10:17:57.199Z October 22 update creates an embargo exception. [Read as Markdown](https://chainincident.com/news/00cd3bcc-5c16-47be-bf3f-f6ddce2aaa6c/index.md) - [Cysic keeps bridge closed after reporting unauthorized 10 million CYS mint](https://chainincident.com/news/ec27e5dd-d922-4588-acad-a706911c71b8) — 2026-10-18T16:03:06.297Z Cysic Foundation disclosed an October 17 unauthorized mint on BNB Smart Chain and says its cross-chain bridge remains unavailable while the cause and token movements are investigated. [Read as Markdown](https://chainincident.com/news/ec27e5dd-d922-4588-acad-a706911c71b8/index.md) - [Guide: Preserve CVE identity and timestamps in an incident note with AirnodeHub](https://chainincident.com/news/a38b516c-197c-4e31-bbb7-9132dcafd2fc) — 2026-10-17T00:36:26.507Z Use the documented NVD interface to preserve CVE identifiers, record timestamps and original advisory references, while keeping relay attestation separate from incident evidence. [Read as Markdown](https://chainincident.com/news/a38b516c-197c-4e31-bbb7-9132dcafd2fc/index.md) - [Ledger asks resellers in six Southeast Asian countries and Hong Kong to pause sales](https://chainincident.com/news/bb315b07-38fc-4cd4-872d-126bdcfc2b5d) — 2026-10-14T00:38:00.272Z Ledger’s October 13 update asks regional resellers and distributors to suspend device sales and remove shelf stock while its investigation continues. [Read as Markdown](https://chainincident.com/news/bb315b07-38fc-4cd4-872d-126bdcfc2b5d/index.md) - [Firelight launches DeFi cover phase with staker capital exposed to claims](https://chainincident.com/news/d3ce9179-9310-452b-984a-c3355f087b08) — 2026-10-06T18:36:02.513Z The October 6 launch announcement names initial Sentora integrations and makes slashing exposure part of the staking position. [Read as Markdown](https://chainincident.com/news/d3ce9179-9310-452b-984a-c3355f087b08/index.md) - [Drift opens DFX recovery claims with launch redemptions near 1% of losses](https://chainincident.com/news/144e0bde-0146-47cc-b44c-6dd831a33e30) — 2026-10-04T18:32:53.063Z One DFX per USDT lost measures the claim allocation, while available payouts depend on the recovery pool and redemption burns future participation for those tokens. [Read as Markdown](https://chainincident.com/news/144e0bde-0146-47cc-b44c-6dd831a33e30/index.md) - [NEAR Intents manager says $3.8 million exploit funds were returned in full](https://chainincident.com/news/7adf5fff-8d8f-4360-ab5d-cab623c6bc0d) — 2026-10-03T11:37:55.181Z The October 2 statement announces recovery, while a complete public reconciliation and technical postmortem remain separate questions. [Read as Markdown](https://chainincident.com/news/7adf5fff-8d8f-4360-ab5d-cab623c6bc0d/index.md) - [SlowMist reports 114 ETH loss through a third-party Safe loop module](https://chainincident.com/news/84cfc377-e1d8-4eaa-af4a-63d0b47c0b05) — 2026-10-03T00:49:01.504Z The reported authorization flaw affects an adapter enabled by two Safe wallets, rather than Aave’s core lending pools. [Read as Markdown](https://chainincident.com/news/84cfc377-e1d8-4eaa-af4a-63d0b47c0b05/index.md) - [Blast announces shutdown and October 26 withdrawal interface cutoff](https://chainincident.com/news/9ec4fbcf-2193-4411-8d4e-a51bbfed8468) — 2026-10-02T18:37:04.102Z The Ethereum layer-2 will wind down, with withdrawals moving to direct bridge-contract access after the normal interface closes. [Read as Markdown](https://chainincident.com/news/9ec4fbcf-2193-4411-8d4e-a51bbfed8468/index.md) - [Fundsz promoters face $31.48 million restitution and penalty order](https://chainincident.com/news/b99a7347-0eb1-4de8-bb80-4372ac76835b) — 2026-10-01T18:33:52.400Z A Florida default judgment closes remaining CFTC claims in the older fraud case, without establishing that investors have been repaid. [Read as Markdown](https://chainincident.com/news/b99a7347-0eb1-4de8-bb80-4372ac76835b/index.md) - [SEC sues over alleged $15 million WhatsApp crypto investment scams](https://chainincident.com/news/39be3c2b-a4b7-49cc-93ee-54d69abec877) — 2026-09-30T06:36:21.195Z Two civil complaints allege fake trading platforms, withdrawal fees and false claims of SEC oversight. [Read as Markdown](https://chainincident.com/news/39be3c2b-a4b7-49cc-93ee-54d69abec877/index.md) - [Bitget attacker moves $83 million in XRP as recovery limits come into focus](https://chainincident.com/news/c5fc05a5-254b-45ee-8fad-d581971b5baf) — 2026-09-28T01:59:33.229Z About 54 million XRP left the original attacker wallets after Bitget's September 24 breach, while the exchange revised its loss estimate and continued recovery work. [Read as Markdown](https://chainincident.com/news/c5fc05a5-254b-45ee-8fad-d581971b5baf/index.md) - [Bitget pauses withdrawals after reporting $351.6 million wallet breach](https://chainincident.com/news/b0943d8c-f8e7-4ad5-8496-3332207b8fa2) — 2026-09-25T14:51:27.748Z The exchange says unauthorized transfers affected part of its hot and warm wallet infrastructure. Withdrawals are paused while deposits and trading remain available. [Read as Markdown](https://chainincident.com/news/b0943d8c-f8e7-4ad5-8496-3332207b8fa2/index.md) - [Cosmos Hub restarts after 25-hour halt and moves ATOM linked to Neutron attack](https://chainincident.com/news/5657959f-b54d-4ef8-98a5-f463e858f1ab) — 2026-09-24T15:53:54.690Z Block production resumed and 1,227,121 ATOM moved from the reported attacker wallet. Public statements had not identified who controlled the receiving address. [Read as Markdown](https://chainincident.com/news/5657959f-b54d-4ef8-98a5-f463e858f1ab/index.md) - [SingularityNET bridge incident expands to unauthorized AGIX and WMTx minting](https://chainincident.com/news/e684e606-531a-4926-8b5b-dade24c5403d) — 2026-09-21T02:48:29.176Z Reports link a single attack cluster to unauthorized AGIX and WMTx minting, while the incident response and supply reconciliation remain in progress. [Read as Markdown](https://chainincident.com/news/e684e606-531a-4926-8b5b-dade24c5403d/index.md) - [A failed callback should not give an onchain game a second roll](https://chainincident.com/news/9619d817-757e-4fd5-9d86-91eda2f631ff) — 2026-09-20T19:00:04.283Z A randomness service can accept a valid proof even when the game's receiving function fails. Treating that failure as permission to request a different result can introduce a new problem: an application may end up selecting among outcomes instead of honoring the original draw. [Read as Markdown](https://chainincident.com/news/9619d817-757e-4fd5-9d86-91eda2f631ff/index.md) - [HP warns fake AI trading tools are replacing browser wallets with malicious copies](https://chainincident.com/news/26e8e324-abd8-495a-959c-bc00814b6e3f) — 2026-09-17T16:32:20.997Z The September report describes credential theft through lookalike Coinbase and MetaMask extensions. [Read as Markdown](https://chainincident.com/news/26e8e324-abd8-495a-959c-bc00814b6e3f/index.md) - [Revolut says it received no direct ransom demand after customer data disclosure](https://chainincident.com/news/6f9f47e1-1e73-4840-9381-9a80a6e847df) — 2026-09-17T12:25:53.789Z Reuters reports a public extortion threat, while the company describes fraudulent requests from a government email domain. [Read as Markdown](https://chainincident.com/news/6f9f47e1-1e73-4840-9381-9a80a6e847df/index.md) - [0x reports malicious Uniswap v4 hooks that change swap outcomes after quoting](https://chainincident.com/news/b96d4a0c-4edf-4010-a92b-5de024675e6b) — 2026-09-17T02:38:11.702Z The routing provider describes pools where execution delivers less than the quoted amount and explains its screening response. [Read as Markdown](https://chainincident.com/news/b96d4a0c-4edf-4010-a92b-5de024675e6b/index.md) - [Swiss Bitcoin Pay announced server shutdown after suspected unauthorized access](https://chainincident.com/news/070f5699-1043-4c1a-bc8c-e69749ac3643) — 2026-09-14T21:09:09.373Z The company said it was investigating possible access to internal systems and customer email addresses. [Read as Markdown](https://chainincident.com/news/070f5699-1043-4c1a-bc8c-e69749ac3643/index.md) - [How to verify API3 oracle sources before a DeFi integration](https://chainincident.com/news/c8deb210-63fa-43a8-afa7-9d318343d9f2) — 2026-09-11T02:22:03.972Z API3 documents a practical route from checking a provider’s signed-data endpoint to confirming the contract and update settings a DeFi app will use. [Read as Markdown](https://chainincident.com/news/c8deb210-63fa-43a8-afa7-9d318343d9f2/index.md) - [AUSTRAC Removes 45 Crypto and Remittance Registrations Following Increased Scrutiny](https://chainincident.com/news/b1a49dc9-07ba-499b-b106-fcd1673c7fcc) — 2026-09-08T14:15:19.352Z Australia’s financial intelligence regulator AUSTRAC has removed 45 crypto and remittance service providers from its registers over the past year through cancellations, suspensions, and refused renewals, targeting entities deemed high risk or non-compliant with anti-money laundering standards. [Read as Markdown](https://chainincident.com/news/b1a49dc9-07ba-499b-b106-fcd1673c7fcc/index.md) - [Liquid recovery transfer returns 3,400 BTC as restart preparations continue](https://chainincident.com/news/89f405ee-3125-4f46-9352-49d8f6ca8c8a) — 2026-09-08T05:34:09.778Z A confirmed Bitcoin transaction returned 3,400 BTC to the reported Liquid Federation address. Blockstream says updated software is deployed as members prepare a restart. [Read as Markdown](https://chainincident.com/news/89f405ee-3125-4f46-9352-49d8f6ca8c8a/index.md) ## Follow and explore - [Topic archives](https://chainincident.com/topics) - [RSS feed](https://chainincident.com/rss.xml) - [Reading guide](https://chainincident.com/llms.txt)