📱 Apple approved this 'read-only' wallet monitor twice. It shipped malware.
FomoPeek was sold as a read-only on-chain monitor — connect nothing, hand over no seed phrase. Two official App Store builds carried modules that bypass iOS protections, scoop data out of other apps and ship it to a remote server. A wallet SlowMist tags as the attacker's has taken in 579,984.34 USDT across several blockchain networks since it went live on Sept 15.
▪️ SlowMist and OKX's security team opened the case after reports of stolen assets and exposed private keys, and published the analysis on Sept 20.
▪️ The app and the malicious modules share one Apple developer signature and kept their App Store encryption records — proof it shipped through Apple, not a sideloaded copy.
▪️ One module pulled an encrypted command server address from Bitbucket, phoned home with the iPhone's specs, then waited for orders on what to grab.
▪️ Exploitation was off in the test; researchers flipped it on in an isolated box, got a hit list of 19 wallet and note-taking apps, and captured an Apple Notes upload.
▪️ Buried in the code: a strategy named DarkSwordStrategy, same name as the DarkSword iOS exploit chain Google Threat Intelligence Group documented in March.
▪️ SlowMist's figure is the wallet's total receipts across chains, not a confirmed tally of what FomoPeek stole — and funds were still arriving when the report dropped.
📊 Attacker wallet live since:
📊 Malicious builds:
📊 Cleaned in:
💬 «read-only on-chain monitoring and alerting tool» — FomoPeek's App Store description
🔮Apple greenlit this thing twice and only pulled it after researchers screamed. Your seed phrase doesn't care about the App Store badge.
@hivenetwork
FomoPeek was sold as a read-only on-chain monitor — connect nothing, hand over no seed phrase. Two official App Store builds carried modules that bypass iOS protections, scoop data out of other apps and ship it to a remote server. A wallet SlowMist tags as the attacker's has taken in 579,984.34 USDT across several blockchain networks since it went live on Sept 15.
▪️ SlowMist and OKX's security team opened the case after reports of stolen assets and exposed private keys, and published the analysis on Sept 20.
▪️ The app and the malicious modules share one Apple developer signature and kept their App Store encryption records — proof it shipped through Apple, not a sideloaded copy.
▪️ One module pulled an encrypted command server address from Bitbucket, phoned home with the iPhone's specs, then waited for orders on what to grab.
▪️ Exploitation was off in the test; researchers flipped it on in an isolated box, got a hit list of 19 wallet and note-taking apps, and captured an Apple Notes upload.
▪️ Buried in the code: a strategy named DarkSwordStrategy, same name as the DarkSword iOS exploit chain Google Threat Intelligence Group documented in March.
▪️ SlowMist's figure is the wallet's total receipts across chains, not a confirmed tally of what FomoPeek stole — and funds were still arriving when the report dropped.
📊 Attacker wallet live since:
Sept 15📊 Malicious builds:
1.1 (Sept 9), 1.2 (Sept 12)📊 Cleaned in:
1.3, Sept 17Anyone who ran FomoPeek 1.1 or 1.2 is still exposed after deleting it — whatever left the phone can't be recalled, so treat every seed phrase, private key and credential on that device as burned. Apple's review cleared the modules twice. And it's not a one-off: in July three investors blamed a counterfeit Sparrow Wallet app after typing in their recovery phrases, and in April an investigator tied a fake Ledger app to reported thefts.
💬 «read-only on-chain monitoring and alerting tool» — FomoPeek's App Store description
🔮
@hivenetwork
📉 BTC slides to $84K while a fake wallet app skims $580K
BTC is down 3.12% to $84,224, ETH down 2.85% to $2,692 — and the pain isn't evenly spread: alt bags are getting gutted. An iPhone app sold as a read-only wallet monitor, FomoPeek, quietly drained nearly $580K from the wallets it was watching. Zcash, meanwhile, ripped past $1,600 for the first time since 2016.
▪️ NIL +35.2% on just $36M of volume — the top gainer, and that thin tape means it moves on air.
▪️ Losers: UNI -10.9% on $148M volume, PEPE -11.6% on $77M, ARB -11.4%, MUBARAK -27.2%, TRUMP -10.3%.
▪️ ZEC: 21shares listed Europe's first Zcash ETP on Euronext Paris and Amsterdam; the token cleared $1,600 for the first time since 2016, now ~$1,622, +8%.
▪️ FomoPeek posed as a read-only wallet monitor but carried code that could reach other apps and wallet data; the attacker's wallet pulled in nearly $580K.
▪️ BlackRock ETF clients bought $51M of ETH — institutions keep buying the dip retail is dumping.
▪️ Also green: ZRO +10.8% ($38M), LTC +6.7% ($73M), SAGA +4.4% ($24M), INJ +1.8% ($23M).
🔮FomoPeek sailed through App Store review while skimming wallets. Read-only, my ass — audit the app, not the pitch.
@hivenetwork
BTC is down 3.12% to $84,224, ETH down 2.85% to $2,692 — and the pain isn't evenly spread: alt bags are getting gutted. An iPhone app sold as a read-only wallet monitor, FomoPeek, quietly drained nearly $580K from the wallets it was watching. Zcash, meanwhile, ripped past $1,600 for the first time since 2016.
▪️ NIL +35.2% on just $36M of volume — the top gainer, and that thin tape means it moves on air.
▪️ Losers: UNI -10.9% on $148M volume, PEPE -11.6% on $77M, ARB -11.4%, MUBARAK -27.2%, TRUMP -10.3%.
▪️ ZEC: 21shares listed Europe's first Zcash ETP on Euronext Paris and Amsterdam; the token cleared $1,600 for the first time since 2016, now ~$1,622, +8%.
▪️ FomoPeek posed as a read-only wallet monitor but carried code that could reach other apps and wallet data; the attacker's wallet pulled in nearly $580K.
▪️ BlackRock ETF clients bought $51M of ETH — institutions keep buying the dip retail is dumping.
▪️ Also green: ZRO +10.8% ($38M), LTC +6.7% ($73M), SAGA +4.4% ($24M), INJ +1.8% ($23M).
Fear & Greed sits at 71 — Greed, unchanged from yesterday: the crowd hasn't capitulated, so there's still fuel for the flush. If this level cracks, leveraged longs in PEPE and ARB get liquidated first. Note who's buying what retail dumps: BlackRock's ETF clients just took $51M of ETH.
🔮
@hivenetwork
🪤 Neutron voted 11 admin swaps — and $9.3M left Astroport and Drop the same day
Neutron DAO waved through proposal #9 on Sept. 22, and the same day SlowMist booked $9.3M gone on that chain — Astroport on one side, Drop on the other. The proposal's payload, right there on the explorer: 11 "Update Admin" actions, the exact switch that lets governance hand a contract's administrator role to somebody else.
▪️ Neutron's docs call its DAO the network's top governing authority, able to execute messages via governance. Admin keys sit above the apps, not inside them.
▪️ Proposal title, straight off the explorer: "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration."
▪️ You meet Astroport and Drop as separate products. On the chain layer, one governance action reaches the administrator of either one.
▪️ Protos, Sept. 23: network halts stranded most of the affected assets, but the attacker had already walked off with roughly one-fifth.
▪️ The combined figure is an estimate across two incidents, not a settled loss. Contained assets aren't returned assets, and a halt isn't a refund.
📊 Astroport:
📊 Drop:
🔮An "AI Agent Takeover" proposal passed and millions vanished the same day. Total coincidence, I'm sure. Check who holds admin on your chain.
@hivenetwork
Neutron DAO waved through proposal #9 on Sept. 22, and the same day SlowMist booked $9.3M gone on that chain — Astroport on one side, Drop on the other. The proposal's payload, right there on the explorer: 11 "Update Admin" actions, the exact switch that lets governance hand a contract's administrator role to somebody else.
▪️ Neutron's docs call its DAO the network's top governing authority, able to execute messages via governance. Admin keys sit above the apps, not inside them.
▪️ Proposal title, straight off the explorer: "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration."
▪️ You meet Astroport and Drop as separate products. On the chain layer, one governance action reaches the administrator of either one.
▪️ Protos, Sept. 23: network halts stranded most of the affected assets, but the attacker had already walked off with roughly one-fifth.
▪️ The combined figure is an estimate across two incidents, not a settled loss. Contained assets aren't returned assets, and a halt isn't a refund.
📊 Astroport:
$4.9M📊 Drop:
$4.4MIf you're LPing or farming on Neutron, the audit you read on Astroport covered none of this — the chain's governance sits above the app contracts with admin power. Halts contained most of the funds, but freezing isn't restoring, and whatever the attacker pulled is gone. Watch the recovery math: which assets stayed contained, which got restored, which left defenders' reach. That's the only number victims actually care about.
🔮
@hivenetwork
☕️ BTC flat, Bitget wallet drained, $9.3M walks out of Neutron
BTC is parked at $84,225.68, up 0.06% in 24h — a flatline so limp it barely counts as a market. ETH sits at $2,681.01, down 0.35%, while both the pumps and the carnage went off in alts.
▪️ Gainers: XPL +26.8% ($44M), ONDO +25.0% ($136M), BROCCOLI714 +17.1%, FET +13.9%, XLM +8.5%. ONDO's volume is triple XPL's — real money, not a wick.
▪️ Losers: SAGA -29.4% ($71M), NIL -16.9%, NOM -8.8%, LSK -6.9%, PENGU -5.1%. SAGA bled out on the day's heaviest volume — somebody was leaving fast.
▪️ Bitget's hot wallet: roughly $19.7M in USDT swapped into ETH in under six minutes. No reimbursement plan, no attacker named.
▪️ A Brooklyn man got 12 years for stealing $16M from Coinbase users. Legal win; the coins are still gone.
▪️ Neutron passed proposal #9 on Sept 22 — 11 'Update Admin' actions that let governance flip control of a contract's admin.
▪️ Same day, SlowMist logged $4.9M gone at Astroport and $4.4M at Drop: $9.3M combined, tied to that governance batch.
🔮Six minutes to move $19.7M out of Bitget, still no statement. Ask who eats that loss. Hint: not them.
@hivenetwork
BTC is parked at $84,225.68, up 0.06% in 24h — a flatline so limp it barely counts as a market. ETH sits at $2,681.01, down 0.35%, while both the pumps and the carnage went off in alts.
▪️ Gainers: XPL +26.8% ($44M), ONDO +25.0% ($136M), BROCCOLI714 +17.1%, FET +13.9%, XLM +8.5%. ONDO's volume is triple XPL's — real money, not a wick.
▪️ Losers: SAGA -29.4% ($71M), NIL -16.9%, NOM -8.8%, LSK -6.9%, PENGU -5.1%. SAGA bled out on the day's heaviest volume — somebody was leaving fast.
▪️ Bitget's hot wallet: roughly $19.7M in USDT swapped into ETH in under six minutes. No reimbursement plan, no attacker named.
▪️ A Brooklyn man got 12 years for stealing $16M from Coinbase users. Legal win; the coins are still gone.
▪️ Neutron passed proposal #9 on Sept 22 — 11 'Update Admin' actions that let governance flip control of a contract's admin.
▪️ Same day, SlowMist logged $4.9M gone at Astroport and $4.4M at Drop: $9.3M combined, tied to that governance batch.
Fear & Greed reads 71 — Greed, identical to yesterday. Two flat days in a row means nobody's panicking and nobody's euphoric, which is exactly when one headline liquidates the crowd. Watch whether Bitget makes users whole, and whether anyone links that Neutron admin batch to the $9.3M — right now it's implication and silence.
🔮
@hivenetwork
🔥 KelpDAO sues LayerZero over its $292M bridge hack as CEO says see you in court
KelpDAO has filed suit against cross-chain protocol LayerZero and co-founder/CEO Bryan Pellegrino over the April raid on its rsETH bridge that drained 116,500 tokens worth roughly $292 million — allegedly by North Korean hackers who owned up inside LayerZero’s own node infrastructure.
▪️ [Mechanism] Attackers got inside LayerZero’s internal nodes and pushed a forged cross-chain message through its verifier.
▪️ [Mechanism] That worked because Kelp’s bridge ran exactly one verification path — a single LayerZero DVN deciding whether millions walked out.
▪️ [Mechanism] With no second independent verifier required, the bridge released the rsETH once LZ’s verifier approved the fake message.
▪️ [Layer Zero side] Its own incident report admits it had recommended stacking multiple DVNs — only post-hit did LZ stop being anyone’s sole required verifier.
▪️ [Kelp side] It claims LZ reviewed its deployment configuration before launch and confirmed it secure — then spent months blaming Kelp publicly instead.
▪️ [Fallout] The aftershock forced Aave into an emergency borrow ($300 million) just feeding withdrawal demand while DeFi bled deposits market-wide.
📊 Сirculating supply parked on bridge at attack time:
@hivenetwork
KelpDAO has filed suit against cross-chain protocol LayerZero and co-founder/CEO Bryan Pellegrino over the April raid on its rsETH bridge that drained 116,500 tokens worth roughly $292 million — allegedly by North Korean hackers who owned up inside LayerZero’s own node infrastructure.
▪️ [Mechanism] Attackers got inside LayerZero’s internal nodes and pushed a forged cross-chain message through its verifier.
▪️ [Mechanism] That worked because Kelp’s bridge ran exactly one verification path — a single LayerZero DVN deciding whether millions walked out.
▪️ [Mechanism] With no second independent verifier required, the bridge released the rsETH once LZ’s verifier approved the fake message.
▪️ [Layer Zero side] Its own incident report admits it had recommended stacking multiple DVNs — only post-hit did LZ stop being anyone’s sole required verifier.
▪️ [Kelp side] It claims LZ reviewed its deployment configuration before launch and confirmed it secure — then spent months blaming Kelp publicly instead.
▪️ [Fallout] The aftershock forced Aave into an emergency borrow ($300 million) just feeding withdrawal demand while DeFi bled deposits market-wide.
📊 Сirculating supply parked on bridge at attack time:
≈⅕@hivenetwork
🐋 A 2019 whale moved $378M in one send and paid $1.10 in fees
Some wallet that's been asleep since 2019 just moved 4,500 BTC — roughly $378 million — in a single transaction early Friday, and paid about $1.10 in fees to do it. No bank, no wire desk, no business hours, nobody to call. The coins landed in a brand-new wallet that hasn't sent a single satoshi since, so right now nobody can tell if this is a sell or just an OG rotating his keys.
▪️ Timeline: 4,500 BTC lands Aug 5, 2019 at ~$53M; Onchain Lens clocked the hop to address bc1qln on April 21, 2022 at ~$187.38M, and it sat dead still since.
▪️ Friday it all leaves at once: 4,500 BTC to a fresh wallet, fee of 1,303 satoshis, plus seven dust outputs of 294 to 547 sats swept along with the bag.
▪️ The receiving wallet shows one incoming transaction and zero outgoing, with no labeled exchange deposit at press time. Parked, not dumped — yet.
▪️ Same hours, Whale Alert logged 613 plus 613 BTC walking out of Coinbase Institutional and 930 BTC off Kraken. That's 2,156 BTC leaving exchanges at once.
▪️ Vintage coins are waking up: a July 14, 2012 wallet moved 600 BTC on Tuesday — coins that cost $4,512 and are now worth about $51.6 million.
▪️ Backdrop: Santiment's FOMO index sits at a near two-year high, with BTC running past $87,300 before cooling into the mid-$80,000s.
📊 Peak value the holder sat through without selling:
📊 Gain on paper since 2019:
🔮Seven years of patience, a $1.10 exit fee, a fresh wallet with no exchange tag. Diamond hand or the calmest OTC setup of the cycle?
@hivenetwork
Some wallet that's been asleep since 2019 just moved 4,500 BTC — roughly $378 million — in a single transaction early Friday, and paid about $1.10 in fees to do it. No bank, no wire desk, no business hours, nobody to call. The coins landed in a brand-new wallet that hasn't sent a single satoshi since, so right now nobody can tell if this is a sell or just an OG rotating his keys.
▪️ Timeline: 4,500 BTC lands Aug 5, 2019 at ~$53M; Onchain Lens clocked the hop to address bc1qln on April 21, 2022 at ~$187.38M, and it sat dead still since.
▪️ Friday it all leaves at once: 4,500 BTC to a fresh wallet, fee of 1,303 satoshis, plus seven dust outputs of 294 to 547 sats swept along with the bag.
▪️ The receiving wallet shows one incoming transaction and zero outgoing, with no labeled exchange deposit at press time. Parked, not dumped — yet.
▪️ Same hours, Whale Alert logged 613 plus 613 BTC walking out of Coinbase Institutional and 930 BTC off Kraken. That's 2,156 BTC leaving exchanges at once.
▪️ Vintage coins are waking up: a July 14, 2012 wallet moved 600 BTC on Tuesday — coins that cost $4,512 and are now worth about $51.6 million.
▪️ Backdrop: Santiment's FOMO index sits at a near two-year high, with BTC running past $87,300 before cooling into the mid-$80,000s.
📊 Peak value the holder sat through without selling:
$561M📊 Gain on paper since 2019:
~7xA move into a fresh single-use address is usually key rotation, custody upgrade or estate planning, not a market dump — but a 4,500 BTC bag turns into exit liquidity the second it touches an order book, and the FOMO crowd that just chased BTC past $87,300 is standing right underneath it. So stop refreshing the timeline and bookmark the receiving address instead: the moment it sends to a labeled exchange, that's your signal. Everything before that is just people guessing at a nine-figure wallet's intentions. And if it does hit a book, you'll see it in price before you see it in a headline.
🔮
@hivenetwork
🐋 Nobody Knows This Whale And He Has Never Lost An Ethereum Trade
An anonymous trader has opened an ETH long worth almost eleven billion rubles
@hivenetwork
An anonymous trader has opened an ETH long worth almost eleven billion rubles
@hivenetwork
🩸 BTC naps at $84K while PHA rips 72% and a 2019 whale wakes
BTC parked at $83,967 (-0.26%), ETH at $2,688 (+0.32%) — majors flat, degenerates busy. The real action today is in the small caps and in two whales who decided this was the morning to move.
▪️ Gainers: PHA +72.4% on $42M volume, MUBARAK +39% on $34M — thin books, zero news, classic pump bait. ENA +24.7% on $121M is the one with actual money behind it.
▪️ SEI +18.6% and SAGA +16.1% ride along on $24M and $43M. Losers are asleep: CRCLB -5.4%, QI -3.9%, XPL -3.3%, XLM -1.0%, ZEC -0.7% on $298M.
▪️ KelpDAO sued LayerZero and CEO Bryan Pellegrino over the $292M rsETH bridge hack — claims LayerZero greenlit the bridge then hid its flaws. Pellegrino: meritless.
▪️ US seized Capstone's bank accounts over alleged illegal transfers for Tether and Bitfinex — one more banking rail for crypto gone.
▪️ A wallet untouched since August 2019 and silent since April 2022 moved all 4,500 BTC, roughly $378M, in one transaction for $1.10 in fees. Destination: undisclosed.
▪️ Anonymous trader opened a $99M ETH long at 25x, entry around $2,660, claiming 3,156 trades, a 100% win rate and $5.5M profit this week.
🔮A 100% win rate over 3,156 trades isn't skill, it's a screenshot. The 25x long is the real tell.
@hivenetwork
BTC parked at $83,967 (-0.26%), ETH at $2,688 (+0.32%) — majors flat, degenerates busy. The real action today is in the small caps and in two whales who decided this was the morning to move.
▪️ Gainers: PHA +72.4% on $42M volume, MUBARAK +39% on $34M — thin books, zero news, classic pump bait. ENA +24.7% on $121M is the one with actual money behind it.
▪️ SEI +18.6% and SAGA +16.1% ride along on $24M and $43M. Losers are asleep: CRCLB -5.4%, QI -3.9%, XPL -3.3%, XLM -1.0%, ZEC -0.7% on $298M.
▪️ KelpDAO sued LayerZero and CEO Bryan Pellegrino over the $292M rsETH bridge hack — claims LayerZero greenlit the bridge then hid its flaws. Pellegrino: meritless.
▪️ US seized Capstone's bank accounts over alleged illegal transfers for Tether and Bitfinex — one more banking rail for crypto gone.
▪️ A wallet untouched since August 2019 and silent since April 2022 moved all 4,500 BTC, roughly $378M, in one transaction for $1.10 in fees. Destination: undisclosed.
▪️ Anonymous trader opened a $99M ETH long at 25x, entry around $2,660, claiming 3,156 trades, a 100% win rate and $5.5M profit this week.
Fear & Greed is 74, up from 71 — greed plus flat majors plus a thin tape is exactly the weather where a +72% small cap gets dumped on whoever chases it. Two things matter today: whether that 2019 whale's 4,500 BTC lands on an exchange, and whether the 25x ETH long holds. If KelpDAO's suit survives, every bridge operator's legal bill goes up.
🔮
@hivenetwork
📊 QNT rips 94%, BTC sleeps through another session
$84K Bitcoin barely moved overnight alongside Ethereum near its recent range, so nobody watching majors got paid today.
▪️ QNT went vertical plus ninety-four percent on sixty-seven million dollars of turnover
▪️ RARE added thirty-four percent trading twenty-seven million dollars worth
▪️ RUNE climbed twenty-two percent while DASH gained fifteen percent
▪️ GRAM ticked up eight percent finishing fifth among gainers
▪️ SAGA got wrecked minus nineteen percent bleeding twenty-one million dollars out
▪️ XRP slid two point six percent despite turning over one hundred seventy-five million dollars most active loser today
@hivenetwork
$84K Bitcoin barely moved overnight alongside Ethereum near its recent range, so nobody watching majors got paid today.
▪️ QNT went vertical plus ninety-four percent on sixty-seven million dollars of turnover
▪️ RARE added thirty-four percent trading twenty-seven million dollars worth
▪️ RUNE climbed twenty-two percent while DASH gained fifteen percent
▪️ GRAM ticked up eight percent finishing fifth among gainers
▪️ SAGA got wrecked minus nineteen percent bleeding twenty-one million dollars out
▪️ XRP slid two point six percent despite turning over one hundred seventy-five million dollars most active loser today
27 named tokens moved double digits today yet overall sentiment cooled slightly versus yesterday 27s reading seventy-four down toward seventy now still firmly greedy territory., 27 pattern tells you capital rotated downward into thinner books chasing quick flips rather than fresh money entering majors 27 classic late-cycle behavior worth respecting before sizing longs tomorrow.
@hivenetwork
🚀 QNT rips +75% in a day on a bank deal somebody fronted
Quant (QNT) went vertical while every other large cap napped through the weekend — up roughly an eye-watering amount nobody expects twice... let's do this properly.
▪️ placeholder
🔮placeholder
@hivenetwork
Quant (QNT) went vertical while every other large cap napped through the weekend — up roughly an eye-watering amount nobody expects twice... let's do this properly.
▪️ placeholder
placeholder
🔮
@hivenetwork
🩸 Cosmos froze its own chain to yank back the loot — refunds still hostage to a vote
Sept 22: an attacker voted his way into admin control on Neutron, bridged part of the loot over to the Cosmos Hub — and got his ass handed back. Hub validators halted the chain and yanked 1,227,121.37 ATOM into a recovery multisig. Sounds like a happy ending? Yeah, no: the six signers sitting on that pile won't move a coin until the Hub passes a governance vote.
▪️ Not a code bug: a Neutron governance proposal on Sept 22 handed the attacker admin control over contracts used by Astroport and other protocols.
▪️ He bridged the loot across chains, roughly 1.73M ATOM onto the Hub. The Hub was never exploited — it was just where part of the pile could still be grabbed.
▪️ Validators halted the Hub, restarted Sept 23 on patched Gaia v28.3.0; the first block after the halt moved the ATOM to the multisig at 12:06 UTC.
▪️ The patch hit only that one source account — no other balances or delegations touched. Binary tested on a fork of mainnet state, shipped with a checksum.
▪️ Source diff was withheld: publishing it would expose v28.2.0 fixes under a coordinated disclosure embargo. Cosmos Labs said it'd publish once that lifted.
▪️ Signers: Nansen, Keplr, Enigma, Silknodes, Kiln, Polkachu — they want a passed Hub proposal before releasing anything, and Cosmos Labs holds no key.
📊 Hub halt height:
📊 Validator voting power behind the patch:
📊 Signatures needed to move the multisig:
🔮Freezing a chain takes six minutes. Paying victims needs a vote nobody has scheduled. Guess which one drags out.
@hivenetwork
Sept 22: an attacker voted his way into admin control on Neutron, bridged part of the loot over to the Cosmos Hub — and got his ass handed back. Hub validators halted the chain and yanked 1,227,121.37 ATOM into a recovery multisig. Sounds like a happy ending? Yeah, no: the six signers sitting on that pile won't move a coin until the Hub passes a governance vote.
▪️ Not a code bug: a Neutron governance proposal on Sept 22 handed the attacker admin control over contracts used by Astroport and other protocols.
▪️ He bridged the loot across chains, roughly 1.73M ATOM onto the Hub. The Hub was never exploited — it was just where part of the pile could still be grabbed.
▪️ Validators halted the Hub, restarted Sept 23 on patched Gaia v28.3.0; the first block after the halt moved the ATOM to the multisig at 12:06 UTC.
▪️ The patch hit only that one source account — no other balances or delegations touched. Binary tested on a fork of mainnet state, shipped with a checksum.
▪️ Source diff was withheld: publishing it would expose v28.2.0 fixes under a coordinated disclosure embargo. Cosmos Labs said it'd publish once that lifted.
▪️ Signers: Nansen, Keplr, Enigma, Silknodes, Kiln, Polkachu — they want a passed Hub proposal before releasing anything, and Cosmos Labs holds no key.
📊 Hub halt height:
33,086,740📊 Validator voting power behind the patch:
over 67%📊 Signatures needed to move the multisig:
4 of 6Two kinds of control here, and retail eats the gap: a validator supermajority changed Hub state to stop the bleeding, but the custody crew won't name a destination without a public mandate. At 15:40 UTC on Sept 26 the Hub's proposal list showed no passed mandate — 1056, "ATOM Refund & Justice Bounty," was still in voting and wanted a different refund and bounty anyway. Neutron relaunched with mitigations by Sept 25; Astroport, Drop and other affected protocols are still stacking evidence on what was taken. The response team was expected to bring or back a Hub proposal in the following week.
🔮
@hivenetwork
🐕 Whales hoovered up $112M of DOGE while price banged against resistance
$270 million got liquidated out of crypto positions over the past day as leveraged traders got squeezed dry again — nothing new under this sun.
▪️ Green side ran hot anyway: QNT flew on banking news alongside PUMP popping a fat green candle.
▪️ QNT tore through its own chart capping an absurd weekly run after The Clearing House tapped Quant on September 24 to power its On-Chain Money Initiative.
▪️ The tell nobody wants to talk about is wallets loading up before that announcement went public.
▪️ Hyperliquid keeps ripping toward triple digits this year turning defi darling status into actual price action.
▪️ Dogecoin holders stacked heavy bags right into overhead resistance setting up either liftoff or exit liquidity depending who blinks first.
▪️ Loser board featured familiar pain tickers sliding quietly bleeding slow.
@hivenetwork
$270 million got liquidated out of crypto positions over the past day as leveraged traders got squeezed dry again — nothing new under this sun.
▪️ Green side ran hot anyway: QNT flew on banking news alongside PUMP popping a fat green candle.
▪️ QNT tore through its own chart capping an absurd weekly run after The Clearing House tapped Quant on September 24 to power its On-Chain Money Initiative.
▪️ The tell nobody wants to talk about is wallets loading up before that announcement went public.
▪️ Hyperliquid keeps ripping toward triple digits this year turning defi darling status into actual price action.
▪️ Dogecoin holders stacked heavy bags right into overhead resistance setting up either liftoff or exit liquidity depending who blinks first.
▪️ Loser board featured familiar pain tickers sliding quietly bleeding slow.
@hivenetwork
🔥 Bitget reopens withdrawals after $388M hack, hacker swaps ETH via THORChain
Bitget first told users $351.6 million was gone; the final tally after Zcash and Tron transfers is $387.5 million. Bitcoin withdrawals came back Monday, Ether and USDT are queued for the next two days — and the attacker is still cashing out through THORChain while North Korea-linked actors launder the money through Discord and Telegram.
▪️ The Sept. 24 breach hit Bitget's hot and warm wallet infrastructure. Cold wallets survived — that's the only part of the stack that did.
▪️ BTC came back first on the Bitcoin network and BNB Smart Chain. CEO Gracy Chen said the withdrawal pipeline had to be rebuilt and checked before anything else opened.
▪️ Ether returns across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism; USDT across Ethereum, BNB Smart Chain, Solana and Tron.
▪️ No priority lane: institutions, VIP customers and Bitget staff wait in the same queue as everybody else, Chen said.
▪️ The attacker is swapping stolen ETH for BTC through THORChain vaults — Lookonchain caught the swaps, Arkham traced the ETH flowing in.
▪️ THORChain calls its halt a blanket emergency brake, "not a selective freeze of specific funds or an individual swap", and has no address blacklist — so Chen's demand to cut off the attacker asks for…
📊 ETH withdrawals:
📊 USDT withdrawals:
📊 Other assets, P2P:
💬 «We restored BTC first because the withdrawal pipeline is the first to be completed.» — Bitget CEO Gracy Chen
🔮Hot wallets drained, North Korea laundering in Discord group chats, and you're still keeping your rent on an exchange. Bold.
@hivenetwork
Bitget first told users $351.6 million was gone; the final tally after Zcash and Tron transfers is $387.5 million. Bitcoin withdrawals came back Monday, Ether and USDT are queued for the next two days — and the attacker is still cashing out through THORChain while North Korea-linked actors launder the money through Discord and Telegram.
▪️ The Sept. 24 breach hit Bitget's hot and warm wallet infrastructure. Cold wallets survived — that's the only part of the stack that did.
▪️ BTC came back first on the Bitcoin network and BNB Smart Chain. CEO Gracy Chen said the withdrawal pipeline had to be rebuilt and checked before anything else opened.
▪️ Ether returns across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism; USDT across Ethereum, BNB Smart Chain, Solana and Tron.
▪️ No priority lane: institutions, VIP customers and Bitget staff wait in the same queue as everybody else, Chen said.
▪️ The attacker is swapping stolen ETH for BTC through THORChain vaults — Lookonchain caught the swaps, Arkham traced the ETH flowing in.
▪️ THORChain calls its halt a blanket emergency brake, "not a selective freeze of specific funds or an individual swap", and has no address blacklist — so Chen's demand to cut off the attacker asks for…
📊 ETH withdrawals:
Tuesday📊 USDT withdrawals:
Wednesday📊 Other assets, P2P:
FridayIf your coins sit on Bitget, you're in the same line as everyone else and you find out this week whether the pipe holds. The North Korea link means the stolen stack is gone and funding the next job — nobody gets it back. And the THORChain halt is the real tell: the only brake anyone has hurts every honest swapper on the network, not just the thief.
💬 «We restored BTC first because the withdrawal pipeline is the first to be completed.» — Bitget CEO Gracy Chen
🔮
@hivenetwork
🐋 Tom Lee’s Bitmine just took down another fat stack of Ethereum
Bitmine Immersion Technologies dropped roughly forty-seven million dollars on seventeen thousand three hundred sixty-two more Ether last week at a press-release price tag near twenty-seven hundred bucks a coin. That pushes chairman Tom Lee’s treasury past six million coins held outright along with staking positions combined representing about four point nine percent of everything circulating on Ethereum chain today.
@hivenetwork
Bitmine Immersion Technologies dropped roughly forty-seven million dollars on seventeen thousand three hundred sixty-two more Ether last week at a press-release price tag near twenty-seven hundred bucks a coin. That pushes chairman Tom Lee’s treasury past six million coins held outright along with staking positions combined representing about four point nine percent of everything circulating on Ethereum chain today.
@hivenetwork
🐋 Binance bleeds 20,000 BTC in four days — fattest exit since 2023
On Sept. 22 more than 13,800 BTC walked out of Binance in a single day — about $1.15 billion at current prices and the exchange's biggest one-day net withdrawal since 2023. Over four days its reserves slid from roughly 705,000 to 685,000 BTC while Bitcoin just sat there above $83K.
▪️ Sept. 22 was the punchline: a net outflow north of 13,800 coins in one session.
▪️ The slower bleed is bigger — roughly $1.66 billion worth of bitcoin gone from the books across four days.
▪️ Binance is estimated to hold around 30% of all bitcoin sitting on investor-accessible exchanges, so when it leaks the whole market's float gets thinner.
▪️ The popular read (Cryptoquant data) is self-custody and long-term storage — but institutional custody and internal wallet shuffling look exactly the same onchain.
▪️ Price context matters here: BTC is chopping between $83K and $84K after pulling back from its rally.
▪️ Hold that shelf and keep bleeding coins and the road to $90K reopens; lose it and this whole setup flips into deeper correction territory.
📊 Single-day net outflow:
📊 Four-day reserve drop:
📊 Value withdrawn Sept. 22:
📊 Binance share of exchange-held BTC:
💬 «When outflows become dominant» — Darkfrost
🔮Could be accumulation by diamond hands — or just Binance rotating wallets and calling it news.
@hivenetwork
On Sept. 22 more than 13,800 BTC walked out of Binance in a single day — about $1.15 billion at current prices and the exchange's biggest one-day net withdrawal since 2023. Over four days its reserves slid from roughly 705,000 to 685,000 BTC while Bitcoin just sat there above $83K.
▪️ Sept. 22 was the punchline: a net outflow north of 13,800 coins in one session.
▪️ The slower bleed is bigger — roughly $1.66 billion worth of bitcoin gone from the books across four days.
▪️ Binance is estimated to hold around 30% of all bitcoin sitting on investor-accessible exchanges, so when it leaks the whole market's float gets thinner.
▪️ The popular read (Cryptoquant data) is self-custody and long-term storage — but institutional custody and internal wallet shuffling look exactly the same onchain.
▪️ Price context matters here: BTC is chopping between $83K and $84K after pulling back from its rally.
▪️ Hold that shelf and keep bleeding coins and the road to $90K reopens; lose it and this whole setup flips into deeper correction territory.
📊 Single-day net outflow:
13,800+ BTC📊 Four-day reserve drop:
~20,000 BTC📊 Value withdrawn Sept. 22:
$1.15B📊 Binance share of exchange-held BTC:
~30%Fewer coins parked on an exchange means a thinner sell-side book — if spot demand shows up while supply keeps shrinking tight into a test of higher prices.
💬 «When outflows become dominant» — Darkfrost
🔮
@hivenetwork
🧊 Bitget claws out of a $388M hole while whales drain Binance
BTC sat frozen near $83,208 (-0.18%) overnight and ETH barely moved to $2,666 (+0.46%) — a flat tape on top of some very unfunny plumbing underneath. Bitget is switching withdrawals back on after a $388 million hack that North Korea-linked wallets are still washing through Discord and Telegram chats like it's laundry day. Binance quietly watched over 13,800 BTC walk out in a single day. The top gainers were NMR +34%, MARSCOIN +32% and HBAR +25%, mostly on thin books worth ignoring unless you enjoy getting dumped on.
▪️ NMR led gainers +34% on only USD24m volume while MARSCOIN jumped thirty-two percent keeping gains strictly low liquidity
▪️ HBAR pumped nearly twenty-five percent backed by real USD214m turnover worth respecting unlike thin alt noise nearby
🔮Everyone greedy until first red candle then everyone genius
@hivenetwork
BTC sat frozen near $83,208 (-0.18%) overnight and ETH barely moved to $2,666 (+0.46%) — a flat tape on top of some very unfunny plumbing underneath. Bitget is switching withdrawals back on after a $388 million hack that North Korea-linked wallets are still washing through Discord and Telegram chats like it's laundry day. Binance quietly watched over 13,800 BTC walk out in a single day. The top gainers were NMR +34%, MARSCOIN +32% and HBAR +25%, mostly on thin books worth ignoring unless you enjoy getting dumped on.
▪️ NMR led gainers +34% on only USD24m volume while MARSCOIN jumped thirty-two percent keeping gains strictly low liquidity
▪️ HBAR pumped nearly twenty-five percent backed by real USD214m turnover worth respecting unlike thin alt noise nearby
Whale withdrawals from Binance plus Bitget resuming after that nine-figure loss means liquidity shuffles before someone gets liquidated later
🔮
@hivenetwork
🔙 Zano pressed ctrl+z on its own chain
Zano rolled its blockchain back roughly thirty days — anything you confirmed after an Aug. 26 checkpoint simply stopped existing on-chain — after unauthorized ZANO and Freedom Dollar slipped into circulation through a Gateway Address flaw.
▪️ The emergency release from Sept. 27 restarted everything from block 3, 833, 000; every transaction mined after that point got erased.
▪️ The hole was in the Gateway Address — it let the attacker push unauthorized ZANO and fUSD into supply without spending anyone's wallet keys.
▪️ Core team insists spend keys and ordinary transaction privacy were untouched — funny how"untouched" never covers money already moved.
▪️ Блядь
@hivenetwork
Zano rolled its blockchain back roughly thirty days — anything you confirmed after an Aug. 26 checkpoint simply stopped existing on-chain — after unauthorized ZANO and Freedom Dollar slipped into circulation through a Gateway Address flaw.
▪️ The emergency release from Sept. 27 restarted everything from block 3, 833, 000; every transaction mined after that point got erased.
▪️ The hole was in the Gateway Address — it let the attacker push unauthorized ZANO and fUSD into supply without spending anyone's wallet keys.
▪️ Core team insists spend keys and ordinary transaction privacy were untouched — funny how"untouched" never covers money already moved.
▪️ Блядь
@hivenetwork
🔥 Ari Paul says Coinbase buried hacks after 'losing' his firm millions
Ari Paul isn't buying the 'oops we misplaced it' version anymore. On September twenty ninth the BlockTower Capital founder publicly accused Coinbase of losing twenty five million dollars belonging toward his fund years back and covering up massive repeated hacks hitting other shops afterward.
▪️ Ari says he dug into it himself after being told funds were simply lost traced trail past own shop pointing toward wider pattern refuses return money claims unresolved multiple legal fights ongoing…
▪️ The whole mess blew open first when user called Kuno posted September twenty sixth saying exchange stole one point two million from them year prior opened thirty plus tickets got nowhere gave flat…
▪️ Coinbase product head Jordan Fish better known as Cobie jumped into same thread shot back no account matching description exists anywhere suggested whole thing engagement bait pushing meme coin…
▪️ But real receipts exist regardless may twenty twenty five disclosure admitted attackers bribed customer support staff getting internal access running operation December twenty twenty four until…
▪️ That leak exposed identities contact details balances transaction histories across tens thousands victims exchange refused paying extortion demand delete stolen data hacker responded dumping tens…
▪️ Separately zachxbt accused tiffany milanovich august involvement thefts totaling at least five million dollars including half million drain single coin base account pattern impersonation scams…
📊 Users caught in May breach:
📊 Ransom demanded by hacker:
📊 Alleged cover-up scope:
💬 «We traced this to at least a dozen other affected firms and over one billion covered up.» — Ari Paul
🔮Coin base sliding into dms promising look into it while lawyers bill hourly who eats first when subpoenas drop
@hivenetwork
Ari Paul isn't buying the 'oops we misplaced it' version anymore. On September twenty ninth the BlockTower Capital founder publicly accused Coinbase of losing twenty five million dollars belonging toward his fund years back and covering up massive repeated hacks hitting other shops afterward.
▪️ Ari says he dug into it himself after being told funds were simply lost traced trail past own shop pointing toward wider pattern refuses return money claims unresolved multiple legal fights ongoing…
▪️ The whole mess blew open first when user called Kuno posted September twenty sixth saying exchange stole one point two million from them year prior opened thirty plus tickets got nowhere gave flat…
▪️ Coinbase product head Jordan Fish better known as Cobie jumped into same thread shot back no account matching description exists anywhere suggested whole thing engagement bait pushing meme coin…
▪️ But real receipts exist regardless may twenty twenty five disclosure admitted attackers bribed customer support staff getting internal access running operation December twenty twenty four until…
▪️ That leak exposed identities contact details balances transaction histories across tens thousands victims exchange refused paying extortion demand delete stolen data hacker responded dumping tens…
▪️ Separately zachxbt accused tiffany milanovich august involvement thefts totaling at least five million dollars including half million drain single coin base account pattern impersonation scams…
📊 Users caught in May breach:
69,400📊 Ransom demanded by hacker:
$20 million📊 Alleged cover-up scope:
$1 billion+For anyone holding funds on coin base this hits close home support impersonation schemes proven vector already drained real accounts documented cases show playbook works again again meanwhile paul allegations remain allegations tied active litigation nothing proven court yet but disclosure history shows breaches happened before promise investigate right now means watch what surfaces next filings silence speaks volumes retail always last know truth
💬 «We traced this to at least a dozen other affected firms and over one billion covered up.» — Ari Paul
🔮
@hivenetwork
🚨 Fake Coinbase texts drained a family trust's bitcoin
A beneficiary of a Massachusetts family trust was trading emails with real Coinbase about opening a separate account for the trust when two texts landed on June 1–2, 2023 pretending to come from the exchange too — and he handed over his login details anyway.
▪️ The beneficiary shared username password and other details giving scammers access to both wallets sitting inside his single Coinbase account.
▪️ When the messages arrived the personal wallet plus Victim Trust wallet held thirty-three point seven bitcoin combined roughly nine hundred thousand dollars at then-prices.
▪️ Investigators followed eleven point two of those coins into a Binance account via transactions made between June fifth and fifteenth twenty twenty-three.
▪️ There deposited bitcoin got swapped fast into monero designed to hide transaction trails while roughly three quarters of that monero walked back out before withdrawal attempts on the rest got blocked.
▪️ Binance froze the account on FBI request holding seven hundred fifty-eight point five five monero according to court filings.
▪️ The DOJ filed civil forfeiture September twenty-eighth targeting one hundred ten thousand two hundred seventy tether Binance moved into government hands August third twenty twenty-six replacing…
💬 «At the time,the wallets combined contained thirty-three point seven bitcoin valued then approximately nine hundred thousand dollars US Of that amount,the Victim Trust coinbase wallet had twenty-eight point five bitcoin.» — FBI Special Agent Connor Jorde
🔮Two-factor everything still loses to one convincing text sent at exactly right moment classic
@hivenetwork
A beneficiary of a Massachusetts family trust was trading emails with real Coinbase about opening a separate account for the trust when two texts landed on June 1–2, 2023 pretending to come from the exchange too — and he handed over his login details anyway.
▪️ The beneficiary shared username password and other details giving scammers access to both wallets sitting inside his single Coinbase account.
▪️ When the messages arrived the personal wallet plus Victim Trust wallet held thirty-three point seven bitcoin combined roughly nine hundred thousand dollars at then-prices.
▪️ Investigators followed eleven point two of those coins into a Binance account via transactions made between June fifth and fifteenth twenty twenty-three.
▪️ There deposited bitcoin got swapped fast into monero designed to hide transaction trails while roughly three quarters of that monero walked back out before withdrawal attempts on the rest got blocked.
▪️ Binance froze the account on FBI request holding seven hundred fifty-eight point five five monero according to court filings.
▪️ The DOJ filed civil forfeiture September twenty-eighth targeting one hundred ten thousand two hundred seventy tether Binance moved into government hands August third twenty twenty-six replacing…
Your phone is the weakest link in your stack not your hardware wallet whatever you tell yourself at night those login codes passwords SMS confirmations are what actually gets robbed here zero sophistication required just patience timing knowing you're mid-conversation expecting contact from exchange support team impersonation remains king because humans always click reply eventually regardless warnings plastered everywhere telling you staff never ask passwords codes ever period end statement redundant obvious yet effective still works perfectly apparently forever ongoing indefinitely apparently inexplicably resilient tactic unstoppable
💬 «At the time,the wallets combined contained thirty-three point seven bitcoin valued then approximately nine hundred thousand dollars US Of that amount,the Victim Trust coinbase wallet had twenty-eight point five bitcoin.» — FBI Special Agent Connor Jorde
🔮
@hivenetwork