Hack

The Shiba Inu ecosystem has come under heavy pressure after its Shibarium network fell victim to a flash loan attack on September 13. Hackers exploited its cross-chain bridge, stealing more than $2.4 million in cryptocurrencies.

How the Attack Happened
According to developers, the exploit compromised 10 out of 12 validators, with attackers targeting Ethereum (ETH) and Shiba Inu (SHIB) tokens. The incident shook the entire ecosystem and triggered steep price declines across related tokens.

An Unusual Offer for Recovery
The Shibarium team is attempting to recover the stolen assets. K9 Finance DAO has offered hackers a 5 ETH bounty in exchange for returning the funds. The “peace agreement” is valid for 30 days, with the offer decreasing gradually after seven days.
Shiba Inu developer Kaal Dhairya stated:

“Once secure key transfers are completed and validator controls are verified, the stake manager’s funds will be fully restored. Our top priority is protecting the network and community assets.”
Dhairya also admitted that it remains unclear whether the breach originated from a compromised server or a developer’s device.

Token Prices Plunge
The exploit immediately rippled across the Shiba Inu ecosystem:
SHIB dropped to $0.00001301, down 6.28% in the past 24 hoursBONE plunged from $0.31 to $0.1928, marking a 38% decline since September 14KNINE fell 4.28% to $0.052557
Forensic Investigation and Next Steps
The Shiba Inu team has engaged security firms Hexens, Seal 911, and PeckShield to conduct forensic analysis and check whether additional validator keys were compromised.
Officials said that once secure key transfers are finalized, staking manager funds will be restored. Until then, the network remains in “damage control mode,” with traders awaiting updates before regaining confidence in the ecosystem.

Conclusion: The $2.4 million exploit cast a shadow over Shibarium, raising serious questions about its security. Still, if the funds are recovered and infrastructure reinforced, the ecosystem could gradually bounce back.

#Shibarium , #shibaInu , #SHIB , #Hack , #CryptoSecurity

Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“

Стейблкоїн $YU від протоколу Yala, підтримуваний біткойном і оверколатералізований, зазнав серйозної хакерської атаки, що призвело до різкого падіння його ціни нижче $0,3. 14 вересня 2025 року, близько 5:14 UTC+8, токен втратив прив'язку до долара, обвалившись до мінімуму $0,2046. За даними аналітичної фірми Lookonchain, хакер використав вразливість у протоколі, наклепавши 120 млн YU на мережі Polygon без авторизації. Потім 7,71 млн токенів були переведені на Ethereum і Solana, продані за 7,7 млн USDC, які конвертовано в 1501 ETH і розподілено по гаманцях.
Yala, підтриманий інвестиціями від Polychain, позиціонував YU як стабільний актив, забезпечений біткойном у self-custody або сховищах. Команда негайно відреагувала, відключивши функції Convert і Bridge для запобігання подальшому втратам. Співзасновниця Vicky Fu заявила на X: "Всі кошти в безпеці. Біткойн, депонований у Yala, залишається self-custodial або у сховищах, жоден не втрачено". Розслідування ведеться спільно з фірмами SlowMist і Fuzzland.
Хоча YU частково відновився до $0,917, згодом ціна впала до $0,7869 і не може повернутися до $1. Хакер все ще тримає 22,29 млн YU на ETH/SOL і 90 млн на Polygon, що тисне на ринок. Цей інцидент, що коштував протоколу $7,7 млн, підкреслює ризики кросчейн-експлойтів у зростаючому ринку стейблкоїнів ($300 млрд). Yala запевняє, що інші функції протоколу не порушені, але довіра інвесторів похитнулася. Експерти прогнозують посилений регуляторний нагляд і дискусії про безпеку оверколатералізованих стейблкоїнів. Подія нагадує про вразливості DeFi, де технічні помилки можуть призвести до значних втрат, попри сильне забезпечення.
#Stablecoin #Yala掘金 #YU #Hack #CryptoAttacks #Bitcoin #DeFi
Підписуйтесь на #MiningUpdates , щоб бути в курсі новин про криптовидобуток і блокчейн!

Hackers launched a massive supply-chain attack targeting widely used JavaScript libraries downloaded billions of times worldwide. The incident had the potential to compromise thousands of crypto projects and millions of developer workstations. Yet the attackers walked away with a laughably small amount – less than $50 in crypto.

An Attack That Could Have Shaken the Crypto World
According to findings from Security Alliance, hackers gained access to the account of a developer managing NPM packages and inserted malware into popular libraries aimed at crypto wallets, specifically Ethereum and Solana.
NPM serves developers much like an app store – a central repository for small code utilities used in JavaScript projects. The compromised packages included chalk, strip-ansi, and color-convert, utilities deeply embedded in dependency trees. Even developers who never installed them directly could have been exposed.

The Damage: So Far Under $50
Security researchers identified a single malicious Ethereum wallet address, 0xFc4a48. To date, it has collected only about $50 worth of crypto. Just a few hours earlier, the amount was a mere five cents, hinting that the total losses could rise slightly.
“Imagine this: you compromise an NPM developer account with more than two billion weekly downloads. You could gain unlimited access to millions of developer machines. Endless riches await. And you make less than $50,” Security Alliance wrote on X.
Samczsun, a security researcher at SEAL, compared the attack to finding the keys to Fort Knox and using them as a bookmark: “The malware was widespread, but at this point it is almost completely neutralized.”

What Was Stolen?
According to Etherscan, the malicious wallet has received small amounts of:
Ethereum (ETH) – just a few cents initiallyBrett (BRETT)Andy (ANDY)Dork Lord (DORK)Ethervista (VISTA)Gondola (GONDOLA)
Altogether, the value does not exceed $50.

Who Is Safe and Who Isn’t?
The attack deployed a crypto clipper malware designed to silently replace wallet addresses during transactions. This means users had to approve the malicious transaction for the theft to occur.
Fortunately, major crypto wallet providers quickly reassured users:
Ledger and MetaMask confirmed their apps were unaffected, citing multiple security layers.Phantom Wallet said it does not use any vulnerable packages.Uniswap reported no impact on its applications.Other unaffected platforms included Aerodrome, Blast, Blockstream Jade, and Revoke.cash.
According to pseudonymous DefiLlama founder 0xngmi, only projects updated after the malicious package was published could be at risk.

Advice for Users
Experts, including Ledger CTO Charles Guillemet, urged crypto users to be extra cautious when approving on-chain transactions. Some even suggested avoiding crypto websites temporarily until developers fully remove the compromised packages.

Conclusion
The NPM hack highlighted how vulnerable the software supply chain can be – even for projects that never directly used the compromised code. Ironically, it became one of the least profitable hacks in crypto history. While the potential losses could have been astronomical, the attackers only netted a few dozen dollars.

#CyberSecurity , #Hack , #Cryptoscam , #CyberSecurity , #CryptoNews

Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“

Robo vía phishing relacionado con una actualización de Ethereum
En agosto de 2025, las pérdidas por phishing en el mundo cripto aumentaron en un alarmante 72 % intermensual, alcanzando más de USD 12 millones afectados por esta modalidad de estafa. El número de víctimas también creció, sumando 15,230 personas, el máximo registrado en 2025 hasta ahora.
#Hack
¿Cómo operaron los atacantes?
1. Explotaron EIP-7702, una mejora de Ethereum que permite que cuentas externas (EOAs) actúen como wallets inteligentes. Esto permitió que estafadores manipularan firmas para crear transacciones maliciosas a través de plataformas como Uniswap.
2. Bots automatizados — conocidos como "sweeper bots" — vaciaron fondos en al menos tres ataques importantes, drenando unos USD 5.6 millones en tiempo récord.
3. Un caso destacó por su magnitud: un solo usuario perdió USD 3.08 millones en una sola transacción de aEthUSDT. Tres víctimas acumularon el 46 % del total de pérdidas.
4. Las tácticas incluyeron address poisoning y anuncios falsos en buscadores como Google/Bing, que redirigían a usuarios a sitios fraudulentos que imitaban interfaces de DeFi legítimas.
#Hacked
Recomendaciones clave de seguridad
Activa autenticación de dos factores (2FA) siempre que sea posible.
Verifica URLs cuidadosamente antes de realizar cualquier operación—mejor, usa enlaces guardados o marcadores fiables.
Evita hacer clic en enlaces desde búsquedas o mensajes sospechosos.
Aplica herramientas de protección —como filtros DNS o VPNs— y revisa los detalles gramaticales de mensajes inesperados.
#defi
Reflexión general
Este ataque no fue un hack técnico complicado, sino un elaboradísimo phishing que aprovechó una actualización buena en teoría (EIP-7702), combinada con ingeniería social para hacerse pasar por interfaces legítimas. Demuestra que, incluso con nuevas características útiles, el elemento humano sigue siendo la principal vulnerabilidad en cripto.

Gala Games CEO Eric Schiermeyer has confirmed that a "security incident" led to the unauthorized sale of 600 million GALA tokens, worth approximately $23 million. The breach, which Schiermeyer attributed to "messed up" internal controls, has raised significant concerns within the blockchain gaming community.
Incident Overview
On May 20, at 7:32 pm UTC, blockchain observers reported the minting of 5 billion GALA tokens, valued at around $200 million at the time. The compromised wallet was selling the tokens in batches, leading to a sharp drop in GALA's price. The token hit a 24-hour low of $0.038, a 20% decrease from its daily high, before recovering slightly to $0.041, according to CoinGecko.
“We had an incident that resulted in the unauthorized sale of 600 million GALA tokens and the effective burn of 4.4 billion tokens,” Schiermeyer wrote in a May 20 post on X (formerly Twitter). He admitted, “We messed up our internal controls. This shouldn’t have happened, and we are taking steps to ensure it doesn’t happen again.”
Response and Mitigation
Gala Games quickly identified the compromise and revoked unauthorized access to the GALA contract. Schiermeyer assured users that the Ethereum contract was secure and had not been compromised. The company believes it has identified the person responsible and is collaborating with the FBI, the U.S. Justice Department, and international authorities to address the incident.
In a follow-up post on X, Gala Games announced that the security breach had been contained and the affected wallet frozen. However, details about the perpetrator and the method of access to the GALA contract remain undisclosed.
Ongoing Legal Disputes
This security incident occurs amid ongoing legal battles between Schiermeyer and Gala Games co-founder Wright Thurston. Both have filed lawsuits against each other, with Thurston accusing Schiermeyer of squandering millions in company assets, while Schiermeyer alleges that Thurston stole $130 million worth of GALA tokens.
Gala Games did not respond to requests for additional comments.
The incident underscores the critical need for robust internal controls and security measures in the cryptocurrency and blockchain industries, as companies continue to navigate complex technological and legal landscapes.
$GALA #GALA #GalaGames #hack

Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“