UPDATE: All affected card balances will be refunded in full Earlier today, our card-issuing partner, Rain, identified a vulnerability in an version of a Solana card contract used by Avici and a small number of other programs. The contract has now been upgraded across all programs, and no further unauthorised activity has been observed. Avici wallets and card balances are separate. Avici wallets are self-custodial and remain under users’ control. When users top up their cards, funds move into a separate Solana contract that holds their card balance. Only this contract was affected. Note: Funds held in Avici’s Solana and EVM wallets are safe and were not affected. Our current reconciliation shows that 1,685 users were affected, representing $500,859.22 in card balances. Every affected user will have their card balance refunded in full. We remain in close contact with our card-issuing and security partners and are monitoring the remediation closely. Avici has also filed a report with the FBI’s Internet Crime Complaint Center. We are deeply sorry for the concern and inconvenience this has caused.

We are aware of an issue affecting the MAMO Core Market on Base and are actively investigating. As a precaution, borrow caps for all Core Markets on Base have been set to 1 wei, preventing new borrowing and limiting the potential for further impact. The supply caps for MAMO and WELL have also been set to 1 wei. All other supply caps remain unchanged. We will share another update as soon as we have more information.

Last night, the webapp fell victim to an attack. Access to the platform has been halted, and no more funds are moving in or out of user wallets. This report, created by an independent community member, provides a detailed summary of the event: The team is working on a recovery plan and verification of the incident details. Please do not purchase $RIO on Algorand or Stellar; the bridges to these chains will remain closed indefinitely. Freehold and Districts are not impacted by this. Please do not use the webapp anymore; Freehold is the only wallet we are actively maintaining going forward. We have identified deposits by the attacker into both @MEXC and @kucoincom and are in contact with them. The market impact on $RIO was limited, and the attacker was not able to sell much before everything was frozen. We believe CEXs can safely begin enabling deposits/withdrawals on BNB Chain again. We will work with law enforcement to identify the attacker.

The Sandbox team has identified and fully contained a recent vulnerability regarding the SAND cross-chain bridge on Base and BNB Smart Chain (BSC). The impact is minimal, representing less than 0.01% of the total SAND token supply. SAND tokens on Ethereum and Polygon are NOT affected. No user wallets were compromised, and no action is required from holders and liquidity pool (LP) providers on those networks. The SAND locked on Ethereum, which backs all bridged SAND, is fully intact. An attacker was able to mint unbacked SAND on Base and BSC. We have disabled bridging to and from both networks, so SAND on Base and BSC is currently isolated and cannot be moved or redeemed. ⚠️ Do not buy, sell, or trade SAND on Base or BSC. Liquidity on those networks is compromised. We are taking a pre-incident snapshot and preparing a compensation plan for the qualified users of the impacted LPs. Affected users can reach out to official support via contact@sandbox.game. We continue to monitor the situation and are actively investigating its scope, and we will share a full incident report and detailed technical post-mortem soon. We apologize for the inconvenience this has caused and deeply appreciate the continued patience and support of The Sandbox community. ⚠️ Reminder: Our team will NEVER DM you first. Please beware of scam links in the replies.

I have just made the biggest mistake of my life I sent 429710 cate (my life savings) to what i believed was my new wallet address on fomo Being an idiot i typed it out very carefully or so i thought to my new sol address Bzj4TU2MdQ3gkkgm5t93ruzFEzLk7qRsuYJCq4jvMDeF Unfortunately for me i sent it to Bzj4tu2MdQ3gkkgm5t93ruzFEzLK7qRsuYJCq4jvMDeF and not Bzj4TU2MdQ3gkkgm5t93ruzFEzLk7qRsuYJCq4jvMDeF (I capitalized the TU cause im braindead)

Meet Agent OS - a new way to build, deploy and use AI agents on Binance. Bring Binance market intelligence, payment, on-chain, data and trading capabilities directly into your AI workflow. Build. Analyze. Trade. With AI. 🫡 Experience it ↠

Dear community, While your SafePal wallet, seed phrase, and private keys are secure; we identified a flaw in the order-tracking plug-in that led to unauthorized access to information of a subset of customers. The issue has been fixed with additional security measures introduced. The incident impacts approximately 39,798 customers who placed orders between March 2, 2025 and April 11, 2026. Exposed information includes name, email address, shipping address, phone number, and purchase details. All affected customers have been notified individually by email. We have also published this webpage for customers to verify if they are affected using order ID number and shipping country. For a complete disclosure of the incident and the actions we’ve taken, along with FAQs and guidance, please refer to our blog: This incident did not involve your seed phrase, private keys, wallet password, or other wallet credentials, bank account information, payment card numbers, or government-issued identification numbers. Never share your seed phrase, private key, or password with anyone, and stay vigilant against phishing or impersonation attempts. We are extremely sorry to the community and those who are affected. Updates will be posted on our blog as we continue to work through things.

A very close friend of mine, coldcard MK4 User, after 6 years of suggesting Bitcoin to him, finally allocated and went pretty hard in 2025. 3/4 of a million dollars Moved ALL to a very well known and solid Australian exchange Less then 12 hours later, it was withdrawn ALL gone

We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days prior to August 8th, 2026. The data exposed: - Full names - Shipping addresses - Phone numbers - Email addresses The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email). The breach is limited due to Trezor’s strict 90-day data storage policy (we were also able to negotiate the same terms with fulfillment partners, who follow the same policy). All affected customers have been contacted separately by email. Our systems and devices remain secure, but affected customers could experience an increase in phishing attempts. NEVER enter your wallet backup on a website or share it with anyone, and only check for updates on official Trezor channels. We are deeply sorry to the community and those affected. We are investigating this situation and will post updates on our blog:

Every builder should have a clear path to strong security. AvengerDAO now brings 11 security firms, an official BNB Chain standard, and bug bounty support for builders, from development through launch and beyond. The goal is to raise the baseline for every project launching on BNB Chain 🧵👇

We are asking all exchanges to block and freeze funds that traces back to these 4 wallet addresses: one1uap8dx2z0qsjxqthm5flgcxkeepsz3gsrghnfn 0xe7427699427821230177dd13f460d6ce43014510 one17u300a40ll5wphd8kj5hktryhdjq3ml9f4phy4 0xf722f7f6afffe8e0dda7b4a97b2c64bb6408efe5 one1a5hur07z5vtvzhr35zkw8tfqedemkz8t88xgd7 0xed2fc1bfc2a316c15c71a0ace3ad20cb73bb08eb one1h56hkxmua0uzfv07fu04cudvtrl35u96pq47vy 0xbd357b1b7cebf824b1fe4f1f5c71ac58ff1a70ba

Microsoft Threat Intelligence has identified a cluster of compromised websites displaying ClickFix lures and using EtherHiding, a technique associated with the ClearFake campaign. An injected Base64-encoded JavaScript contacts a BNB Smart Chain RPC gateway to query a smart contract previously reported in connection with ClearFake to fetch next-stage instructions. Content stored in a smart contract is resistant to conventional takedown or sinkholing because only the owner of the cryptocurrency wallet that deployed it can make changes. Users are presented with a fake CAPTCHA that instructs them to open the Windows Run dialog, paste clipboard content, and press Enter to execute an attacker-supplied command under the guise of verification. We’re seeing multiple forms of command obfuscation and living-off-the-land abuse, including conhost, cmd, PowerShell, pcalua, mshta, rundll32, msiexec, curl, WMI, WebDAV, and scheduled tasks. Carets split keywords, environment variables hide interpreters, and Windows run headlessly or minimized. TerminalFix lures apply the same technique but direct users to Windows Terminal or PowerShell instead of the Run dialog. This campaign demonstrates that ClickFix and TerminalFix are a high-volume initial access technique. Microsoft reports campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains can funnel visitors to scam pages. Numerous actors use the technique to deliver Lumma Stealer and other infostealers, RATs such as Xworm and AsyncRAT, loaders including MintsLoader, and remote management tools. A single successful execution can expose credentials, establish persistence, enable lateral movement, and create a path to human-operated ransomware and potential domain compromise. Microsoft recommends that organizations enable Microsoft Defender network, web, and cloud-delivered protection; restrict Run and command-line tools where not required; enable PowerShell script-block logging; and implement application control. Users should never paste commands from CAPTCHAs, browser errors, emails, ads, or unsolicited support pages into Run, Terminal, PowerShell, or Command prompt. Microsoft Defender XDR provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Suspicious command in RunMRU registry”, “Possible ClickFix activity”, “Possible initial access from an emerging threat”. Microsoft Defender Antivirus blocks malicious command execution using detections such as Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.*. Treat these alerts as evidence of a potential initial access incident: isolate affected devices, investigate credential exposure and persistence, and hunt for related activity.

🧵1/2 🚨GoPlus Security Alert: #BONK# Suffers Governance Attack, Resulting in a $20M Loss Bonk (@bonk_inu) was hit by a malicious governance proposal attack. A total of 4.426T $BONK held in the BonkDAO wallet was transferred to a malicious address (9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ). The malicious proposal remained live for 6 full days without any effective intervention, ultimately resulting in a total loss of approximately $20 million. Attack proposal details: