US authorities ordered a ban on MEXC transfers through US financial institutions, effective 30 days after Federal Register publication. The order does not establish a worldwide withdrawal halt.
A Bitcoin “quantum landmine” proposal would put an attacker’s own BTC at risk. Owners would need proof of ownership prepared in advance; adoption is unconfirmed.
Stolen Binance funds moved through about 12,000 wallets in the first three and a half days. A November 5 analysis put frozen or seized assets at about $2.85 billion; this does not mean users have been repaid.
The KCBCA Signals Issue 2 editorial examines five cyber resilience challenges and the review records needed to keep rights, evidence, and responsibility verifiable after systems fail.
Block proposes a DOJ agreement totaling about $964 million before credits, with a net payment of about $764 million. A final agreement and court approval remain pending.
Seven THORChain swap routes resumed on November 3. The summary shared in the group on November 5 describes a partial restart, with some networks still restricted.
BIP-54 proposes four fixes to Bitcoin’s consensus rules. Some mining pools have begun producing compatible transactions; mainnet activation is still pending.
South Korea plans to prepare crypto incident-reporting guidelines in November. A shared report summary outlines immediate notifications to support incident investigation and information sharing.
KCBCA Signals Volume 1, Issue 2 brings together 13 contributions on cyber resilience, digital asset infrastructure and governance. The 49-page English issue is free online and as a PDF.
Customers report unauthorized use of AI API keys stored on Northflank. The cloud hosting platform says to assume all environment variables were decrypted and rotate every stored secret.
18,270 BTC stolen from a Binance hot wallet. A freeze on other tokens does not mean the BTC is frozen.
Binance withdrawal availability varies by asset and network. Binance says approximately $6.3 billion in crypto assets was stolen from its hot wallets on October 29 (UTC).
Chainalysis customer names, emails and other profile data were exposed. Watch for unexpected password reset requests and authentication prompts.
Some booking data was viewed without authorisation through ONDA's Hotel Plus system. About 25,000 bookings may be affected; the exact scope is still under investigation.
Daishin Securities says personal and credit data of more than 38,000 customers has leaked. Eight items were exposed, including names, addresses and encrypted account numbers.
About $16M was drained from old deposit addresses at CoinDCX, India's largest crypto exchange. The exchange first called the reports a false alarm, then confirmed the loss days later.
An attacker minted unbacked tokens on Initia and bridged out about $2.7M in assets. As of Oct 27, no restart date had been set.
Bithumb has reported a breach of its internal mobile work system. Whether customer data was exposed remains under review.
Dark web alert from your bank? Chase Credit Journey (powered by Experian) alerts aren't proof of a Chase breach or identity theft.
An SBOM records software components, versions, and origins. It needs updates with deployments, evidence tracking, and a wider map of dependencies beyond code.
Hashes help check files, deployed code, and reports for changes. Built-in commands can compare fingerprints, but truth, authorship, and interpretation require separate checks.
Attacks on French retailers caused food disposal at hundreds of stores. The incident highlights checks on remote access, firmware, and maintenance responsibilities.
Railway disclosed that an unauthorized party may have obtained decrypted customer secrets, including API keys and database credentials. It urged all users to rotate or revoke stored credentials.
AI agents seeking public records attempted SQL injection on US and Canadian government sites, with no confirmed breach. Parameterized queries and limited permissions remain central defenses.
AI can turn patches and advisories into attack code faster. Defending against zero-day and n-day attacks requires less exposure, rapid updates and checks that fixes address the root cause.
Connecting AI tools also brings credentials and permissions into play. An official SDK flaw and agent incidents show why service-specific checks, limited access and explicit approval matter.
Hijacked official accounts and legitimate domains can lead to phishing sites. Check the address, certificate, request and route before logging in or approving a wallet action.
Credential stuffing reuses leaked login details across services. With bank breach causes still under investigation, users need unique passwords and organizations need API authorization checks.