Tag: Security & Hacks

Trezor has disclosed an expanded data breach originating from its shipping provider, ShipMonk, affecting an additional 67,000 customers. This brings the total number of affected individuals to approximately 80,700. The exposed personal information includes names, email addresses, phone numbers, home addresses, and order numbers, raising significant concerns about customer privacy and physical security.

Trezor stated that its own systems were not compromised, and private keys and wallet backups remain secure. The breach at ShipMonk is attributed to a SQL injection flaw in the analytics tool Metabase, which allowed unauthorized access to connected databases. This vulnerability was disclosed on August 6.

The newly disclosed group of affected customers primarily consists of individuals in the U.S. who placed orders between November 2019 and August 2021. The exposure of home addresses is a particular point of concern, as it moves the risk beyond digital privacy to potential physical security threats. Trezor warned that “A letter carrying a name and home address signals ‘we can locate you.’”

This incident significantly expands upon a previous disclosure in August, where Trezor reported a breach affecting 13,689 customers. Trezor had previously cited a 90-day deletion policy negotiated with its fulfillment partners as a reason for the limited scope of the initial breach. However, Trezor repeatedly asked for and received written confirmation that records had been deleted, in line with its contract and data policy, and expressed disappointment to learn they had not been.

Some of the exposed records are nearly seven years old, dating back to November 2019. This longevity of data increases its potential utility for malicious actors, as “stolen data stays useful for years because people rarely move or change their numbers.”

In addition to the Trezor and ShipMonk entities, the same breach wave also affected Framework and Tally. ShipMonk has reportedly received extortion emails attributed to the group ShinyHunters, though this attribution remains unconfirmed.

This expanded breach follows a pattern of threats against hardware wallet owners. In February, owners of both Trezor and rival hardware wallet Ledger reported receiving forged letters demanding fictitious security checks. Trezor warned affected customers about risks to their physical security in light of these incidents and reiterated that wallet backups should never be shared or entered into websites.

Uncertainty remains regarding whether ShipMonk had indeed deleted the records as per its contract and data policy. The attribution of extortion emails to ShinyHunters also remains unconfirmed. Trezor has emphasized that its own systems were not breached and that customer private keys and wallet backups are secure.

Why This Matters

This expanded data breach at Trezor’s shipping provider, ShipMonk, underscores the persistent risks to customer privacy and physical security. The exposure of personal information, including home addresses, for an additional 67,000 customers highlights the potential for long-term exploitation of data and challenges previous assurances about data handling practices. The incident serves as a critical reminder of the vulnerabilities inherent in third-party data management and the tangible threats faced by hardware wallet owners.

Broader Context

Source materials place the factual news in this context: Trezor repeatedly asked for and received written confirmation that those records had been deleted, in line with its contract and data policy, and said it was disappointed to learn they had not been. The intrusion traces to a critical SQL injection flaw in the analytics tool Metabase, disclosed on August 6, which let unauthenticated attackers steal credentials for connected databases. Uncertainty remains regarding whether ShipMonk had actually deleted the records as per contract and data policy, and the attribution of extortion emails to ShinyHunters remains unconfirmed.

Unsolicited Password Reset Emails Plague X Users Amid Security Concerns

X users have been inundated with unsolicited password reset emails over the past several weeks, with a significant surge occurring today. The platform is also experiencing login alerts from unfamiliar locations, and some users report being temporarily locked out of accounts they haven’t accessed in weeks.

These password reset emails are legitimate, originating from X’s own systems, but they are being sent to account owners who did not request them, sparking widespread concern.

Echoes of Past Breaches and Emerging Threats

The situation bears a striking resemblance to a scare faced by Instagram users in January, when unrequested reset emails coincided with the appearance of a dataset containing 17.5 million accounts on a dark-web forum. Meta at the time attributed the issue to a bug that allowed external parties to trigger the emails, while denying any breach of its own systems.

X has not publicly acknowledged a recent breach, but the company is aware of the ongoing problem. In a recent tweet, X engineer Mridul Singhai apologized for the inconvenience, stating that the company is not aware of any new breaches and that hackers appear to be targeting X accounts to gain access to “X money.”

“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts,” Singhai wrote. “We are actively investigating the issue and, so far, have found no evidence of any breaches.”

Datasets and Botnet Activity Fueling Attacks

The current wave of emails may be linked to a years-old vulnerability in Twitter’s API that allowed an attacker to match email addresses and phone numbers to accounts in January 2022. A dataset derived from this exposure, covering over 200 million users, is now cataloged on Have I Been Pwned.

Compounding the issue, a hacker known as ThinkingOne posted a 34-gigabyte file in April 2025 containing 201 million X user records—including screen names, email addresses, account creation dates, and follower counts—on the BreachForums platform. Researchers have confirmed that the emails in this dataset match active X accounts.

Neither of these datasets requires a fresh hack to remain a threat. The circulating email addresses are being utilized in two ongoing operations. Researchers at Breakglass Intelligence discovered an unsecured command-and-control panel in April 2026 that was actively testing stolen credentials against X accounts, confirming 18 new compromises within a 12-minute window. Over its operational lifetime, the botnet had tested more than 4.8 million X accounts, with two-factor authentication blocking 85.6% of these attempts.

Phishing Campaigns and Proton Mail Disruptions

Separately, a phishing campaign unrelated to any data breach has been targeting X users since July. Scammers are sending emails that closely mimic X’s legitimate “new device login” alerts, complete with the correct logo and grammar. These emails prompt recipients to click a link to secure their account, leading to fake pages designed to steal passwords or authorize malicious applications.

Some X users have also reported experiencing unsolicited reset activity on Proton email services around the same time. Proton has acknowledged the disruption and is investigating the issue.

While neither Proton nor security researchers have confirmed a direct link, users who employ Proton Mail for their X accounts should be aware of the potential implications.

X’s Security Measures and User Recommendations

X’s help documentation confirms that the platform proactively resets passwords for accounts flagged as compromised or targeted by phishing, sending an email to the registered address with instructions. If such an email arrives without your request, it suggests that your credentials may have already been targeted or that you have been subjected to a phishing attempt.

X advises users to verify sender addresses, as the company only emails from @X.com or @e.X.com and never requests passwords via email. Users are also encouraged to enable two-factor authentication using an authenticator app, employ a unique password for X, and regularly review their account’s active sessions and connected applications for any unfamiliar activity.

A crucial security step recommended by X is to enable the “password reset protect” option within the “security and account access” settings. This adds an extra layer of verification, requiring confirmation of the associated email address before a password reset request can be processed.

Users are also cautioned against contacting individuals offering unsolicited help, as these are often scams that prey on users mentioning specific keywords or seeking assistance with security topics.

Proton Mail Service Disruption

Proton’s status page reported a service disruption on September 1, attributing it to residual hardware failures from an overheating incident the previous week and reduced capacity during infrastructure upgrades. While this disruption is not connected to the X activity, it could potentially delay the delivery of any necessary reset emails to Proton Mail users.

By the time researchers took down the April botnet’s control panel, it had confirmed 138 account compromises out of 4.8 million attempts. While this represents a small fraction, it is significant when multiplied across the billions of credential-stuffing attempts estimated to target login pages globally each month.

Cronos Network Paused After Lending Protocol Exploit, $75 Million in Assets Affected

The Cronos blockchain was halted on Sunday following an exploit that targeted Tectonic, its largest lending protocol. The incident is estimated to have affected approximately $75 million in assets.

No timeline has been provided for when the network will resume operations, and the blockchain has not yet detailed the fate of assets linked to the attacker once the chain is restarted.

Kris Marszalek, CEO of Crypto.com, confirmed the security breach and stated that the Cronos team is investigating the incident. He asserted that the Cronos app and exchange were unaffected and continued to operate normally, with all user funds remaining secure.

On-chain tracking platform LookonChain reported that the attacker managed to bridge only $6.29 million to the Ethereum network. These funds were subsequently swapped for 2,592 ETH after the network was halted. The remaining $68.7 million is currently stranded on the Cronos Network.

Researcher Weilin Li suggested the attack was connected to Tectonic’s TONIC governance token, which reportedly has a 20% collateral factor despite very low liquidity. Li explained that the attacker executed a price manipulation strategy, similar to the Mango Markets incident, causing TONIC’s price to surge by 100-fold within 20 minutes.

This type of price manipulation attack has recently impacted other decentralized finance (DeFi) platforms. Last week, Moonwell, a lending protocol on the Base network, lost over $8 million after an attacker manipulated the collateral price of MAMO, a low-liquidity, small-cap token. In response, Moonwell significantly reduced borrow caps for all Core Markets on Base to 1 wei, effectively halting new borrowing. Supply caps for MAMO and WELL were also reduced to 1 wei, while others remained unchanged.

Another recent incident involved a low-liquidity Pendle market, where price manipulation led to approximately $36 million in liquidations of leveraged PT-reUSD positions on Morpho.

Following the exploit, Tectonic’s total value locked (TVL) has plummeted. According to DefiLlama, the lending protocol held around $121 million in assets on August 29. Two days later, this figure had dropped to approximately $3 million.

Crypto Platforms Suffer Over $3.6 Billion in Security Breaches Since Early 2025

Cryptocurrency platforms have been hit by security incidents resulting in losses exceeding $3.63 billion between January 2025 and July 2026, according to a report by CoinGecko. The analysis documented a total of 245 attacks during this 19-month period.

Major Breaches Drive Significant Losses

The vast majority of these losses, over 72.5%, were concentrated in the 10 largest incidents, highlighting how a small number of major breaches have disproportionately impacted the total amount stolen. Vulnerabilities in infrastructure and supply chains proved to be the most damaging, affecting both centralized and decentralized exchanges and accounting for combined losses of more than $1.8 billion.

Notable security failures were observed at platforms including Bybit and KelpDAO. CoinGecko’s findings also indicate that the primary weaknesses vary depending on the platform’s architecture.

For centralized exchanges, compromised private keys were the most frequent cause of failure. Decentralized applications, on the other hand, lost $546 million due to sophisticated smart contract exploits. However, both types of platforms remain susceptible to oracle manipulation and market volatility, with internal mechanism errors leading to substantial losses for entities such as Bitget, Binance, and Hyperliquid.

Audits Fail to Prevent Majority of Exploits

The report also scrutinized the effectiveness of security checks, revealing that independent audits did not prevent a significant number of these incidents. Of the 245 attacks recorded since early 2025, 147 involved protocols that had undergone audits prior to being compromised. Alarmingly, these audited platforms were responsible for over 88% of the total capital drained during the period.

Conventional audits often overlook the specific areas exploited in major attacks. Many incidents stemmed from external infrastructure issues, unexamined code modifications, or systemic features manipulated through governance attacks. Only approximately 11% of incidents involving audited platforms were linked to smart contract vulnerabilities that were within the scope of the audit, though these flaws still resulted in $396 million in losses.

Centralized exchanges (CEXs) typically do not employ the same audit models as decentralized protocols. Instead, they rely on compliance measures and financial attestations like Proof-of-Reserve. CoinGecko noted, however, that these safeguards offer limited protection against social engineering tactics and severe private-key security failures.

Crypto Insurance Coverage Declines Amid Rising Risks

Despite the increase in exploits, active coverage across leading crypto insurance protocols has seen a decline of 20.2%, dropping from $163.2 million to $130.2 million. Cumulative payouts have remained relatively stable at $33 million. The report suggests that the high-risk environment in the sector may be deterring capital providers and discouraging users from purchasing coverage at elevated premium prices.

Furthermore, crypto insurance policies often have a limited scope, with claims frequently restricted to verified smart contract exploits or infrastructure failures. Losses attributed to human error, compromised private keys, or market volatility may not be eligible for coverage.

As of August 2026, five out of nine on-chain insurance protocols had ceased operations or shifted to different market segments.

MANTRA Halts Blockchain Operations Following Cosmos EVM Module Incident, Token Tumbles to Record Low

MANTRA has suspended its blockchain network after an incident impacted its Cosmos EVM module, a development that sent its native token to an all-time low on August 21. The project’s team stated that two wallet addresses were affected, but no user funds were compromised. A patched release is currently undergoing testing, with a potential network restart anticipated later today.

Network Freeze and Investigation

Initially, MANTRA announced the chain halt as a precautionary measure while investigating the incident. All network endpoints and transactions were frozen, and deposits and withdrawals to and from the MANTRA Chain were temporarily disrupted. A subsequent status update confirmed the network remained halted as developers worked on and tested a remediation solution. Transactions, transfers, and staking operations were unavailable, though MANTRA reiterated that user funds were unaffected by the halt itself.

Root Cause Identified and Remediation Underway

The team has since pinpointed the root cause, confirming the incident was isolated to the Cosmos EVM module and affected two wallet addresses before the threat was contained. “No user funds were exploited,” the team emphasized. They also confirmed that a full network snapshot was taken prior to initiating the restart process. The patched v8.4.0 release addresses the underlying vulnerability and is being tested on the DuKong testnet. The project aims for a coordinated mainnet upgrade and restart later today, contingent on successful testing. Validators have been instructed to keep their mainnet nodes offline until the restart is officially announced.

Token Performance and Historical Context

The native token, formerly known as OM, now trades under the MANTRA ticker. This change followed a 1:4 non-dilutive redenomination and ticker swap in March of this year, where holders received four MANTRA tokens for each former OM token without altering their overall value at the time of conversion. Following the chain halt, the token experienced a significant drop of over 18%, falling from approximately $0.0050 to $0.0041, marking a new all-time low. At the time of reporting, the token had recovered some of its value, trading near $0.0046, but remained approximately 82% below its March 4 all-time high of $0.02627.

This incident echoes a previous significant downturn for the token. In April 2025, OM plummeted from above $6 to below $1 in under an hour, erasing roughly 90% of its market value and triggering liquidations exceeding $70 million. At that time, CEO John Patrick Mullin attributed the collapse to “reckless forced closures” by centralized exchanges. The repercussions continued into January 2026, when MANTRA announced staff reductions across multiple teams, citing rapid expansion in 2024 and early 2025 that had led to an unsustainable cost base following a challenging market period and the token’s prior collapse. Mullin had also pledged to burn 300 million OM tokens after the April 2025 crash, a burn that was completed later that month.

MANTRA has stated that a comprehensive post-mortem analysis will be released subsequently. For the time being, the chain remains paused as the patched software undergoes testing, leaving users with limited information beyond the team’s updates.

Nearly 2,000 Hacked WordPress Sites Used in Sophisticated Malware Operation

Cybersecurity firm Check Point Research has uncovered a widespread operation utilizing nearly 2,000 compromised WordPress websites to distribute malware, steal sensitive data, monitor victims, and deploy ransomware. The campaign, which began in mid-May, has been linked to the StopAndProtect ransomware family and involves a comprehensive suite of malicious tools working in concert.

A Multifaceted Criminal Toolkit

The compromised websites served as a central hub for the operation, hosting various malware components, issuing commands to infected computers, and storing stolen information such as documents, screenshots, and activity logs. “The operation doesn’t rely on a single piece of malware, but on a whole toolkit of criminal software working together,” explained Check Point researcher Jaromír Horejsi. He elaborated that some components are designed to encrypt files, while others silently exfiltrate documents or lock screens, and a distinct tool facilitates live communication between attackers and their targets.

Deceptive CAPTCHA Leads to Infection

The malware primarily targets Windows users, initiating its attack through a deceptive CAPTCHA prompt on a compromised website. This “ClickFix” prompt then directs victims to execute a PowerShell command. Upon execution, this command installs malware capable of stealing credentials, cryptocurrency wallet seed phrases, spreading across networks and USB drives, locking screens, and ultimately deploying ransomware. The report did not specify whether macOS or Linux users are affected.

Operational Security Lapses Expose the Operation

Despite the sophistication of the attack, errors made by the perpetrators inadvertently provided Check Point researchers with a detailed look into the operation. “Operational security (OPSEC) failures by the developer exposed lots of files, including detailed infection logs from victims’ machines, screenshots from infected computers, and source code of tools the criminals use to mass-manage compromised websites,” Horejsi noted.

By July 24, the campaign had affected over 6,000 unique IP addresses globally, with significant concentrations in the United States (1,852), Russia (630), and India (630). The exposed directories yielded over 31,000 screenshots collected between mid-May and the end of July, alongside more than 700 archives containing stolen data, including documents, passwords, and cryptocurrency wallet files.

Accidental Self-Infection and Broader Campaign Links

Check Point also believes the threat actor may have accidentally infected themselves. “We collected a few hundred files exfiltrated from victims’ machines, and we believe that in one instance the threat actor infected themselves, as one archive contained several unusual files with suspicious content,” Horejsi stated. This accidental exposure, he added, aids in understanding the actor’s methods and the scale of their compromised domain control.

The ClickFix mechanism has appeared in several other malware campaigns this year. In May, an apparel website associated with FBI Director Kash Patel was taken offline after macOS users were reportedly targeted with ClickFix malware, which prompted them to run a command in Terminal to install an infostealer. In July, Jamf Threat Labs identified ClickFix-style malware distributed via a sponsored ad on X, leading users to a site that instructed them to execute a command installing a variant of the Atomic infostealer. Earlier in August, Microsoft researchers had warned of hackers using compromised websites and BNB Chain smart contracts to distribute malware through fake CAPTCHAs.