North Korean state-sponsored hacking group (APT38) known for cryptocurrency theft, bank heists, and espionage campaigns like Operation Dream Job.
Investigator ZachXBT posed as a paying client of a Chinese laundering network and traced more than $12 million of North Korea's stolen Bybit funds. The trace covers under 1% of the roughly $1.5 billion taken, so the broker proved reachable even as recovery stayed small.
Reality
ZachXBT says he fronted $349.7K in USDC to pose as a client of the Chinese syndicate laundering North Korea's Bybit haul. The only recovery on record, a 442K USDT freeze by Tether, covers at most 3.7% of the $12M+ cluster he says the sting exposed.
Perspective Coverage
8 publishersReality
Dell has fixed CVE-2026-86360, a critical path traversal in Dell System Update that lets an unauthenticated remote attacker run code as root. Any server on a DSU build older than 2.3.0.0 stays exposed until it is updated.
Perspective Coverage
3 publishersReality
Ethereum Foundation says EIP-7906, a check that could have reverted the $1.5 billion Bybit theft, will not ship before 2027. Its own post concedes the check cannot stop the stolen-key and social-engineering attacks behind most of 2026's losses.
Reality
Near Intents halted its cross-chain swap service after a bug in its Omni deposit layer let an attacker take about $3.8 million. Crypto balances carry no deposit insurance, so affected users are relying on the operator's promise to repay them in full.
Perspective Coverage
5 publishersReality
Dell patched six critical flaws in its Kubernetes storage modules, one letting unauthenticated attackers pull admin credentials for every registered array. The Authorization module holds those keys for each array it fronts, so one reachable deployment exposes all the storage registered behind it.
Perspective Coverage
3 publishersReality
Bitget CEO Gracy Chen expects to recover little of the $388 million stolen from the exchange, citing Bybit's 3.5% freeze rate. On that benchmark about $13.6 million is frozen within a year and roughly $374 million stays with whoever carries the loss.
Reality
Kelp DAO has sued LayerZero Labs and co-founder Bryan Pellegrino for negligence and misrepresentation over April's $292 million rsETH bridge exploit. The forged message cleared a bridge that trusted one LayerZero-run verifier, so the case tests who answers for that setup.
Reality
Chainlink's CCIP 2.0 cuts a transfer's default checks from two networks to one and lets institutions add their own verifiers back. Paying for the second check now falls to the bank or issuer, five months after a single-verifier bridge setup cost Kelp DAO $292 million.
Reality
Bitget says suspected North Korean attackers took $351.6 million from its hot and warm wallets by spoofing the transaction data that triggers its signing process. Its $464 million user protection fund, held in bitcoin, covers the loss.
Perspective Coverage
10 publishersReality
Bitget CEO Gracy Chen publicly asked THORChain to refuse service to the wallets that took $387.5 million, after Circle and Tether stopped nearly $318,000. Much of the rest now depends on a no-KYC swap protocol that has declined to block stolen funds in earlier hacks, including its own.
Perspective Coverage
3 publishersReality
Bitget now puts its September breach at $387.5 million, and AMLBot estimates $343 million of it sat untouched in 13 attacker wallets on Sept. 25. The phased withdrawals due from Sept. 28 are the better guide to whether customer money is safe.
Perspective Coverage
15 publishersReality
Bitget CEO Gracy Chen asked Thorchain to refuse service to the hackers behind a theft the exchange now puts at $387.5 million. After the Bybit breach, Thorchain's validators reversed a trading halt within 30 minutes, so recovery plans have little reason to count on the protocol's help.
Reality
Bitget says attackers took over a wallet backend system and fed its authorization process spoofed data, moving out $387.5 million without stolen keys. For teams running payouts, the data an approver trusts now belongs on the same review list as the keys.
Perspective Coverage
3 publishersReality
Check Point says the Operation Dream Job chain now escalates through CVE-2026-68820 to install FudModule v3.1. CISA has told federal agencies to patch by August 25.
Perspective Coverage
4 publishersReality
The layer-1 will rewind both shards to an Aug. 11 checkpoint and ship a client that rejects the exploit's blocks. Finality on Harmony is now whatever the team decides to keep.
Perspective Coverage
3 publishersReality
The rebate ladder that recruits big exchanges also shrinks the burn: 60 cents of every fee dollar at the bottom tier, 26.25 cents at the top.
Reality
A Northern California freelance marketplace's own messaging system carried Excel macro lures to 80,000 of its users across 18 months. Microsoft closed that delivery step in 2022. The same platform lure now shows up in North Korean operations.
Perspective Coverage
6 publishersReality
Rapid7 says the ted backdoor is built into the victim's existing HAProxy 2.8.12 and hooks its filter API, so the load balancer keeps balancing normally while it logs cookies and injects scripts for selected clients.
Perspective Coverage
5 publishersReality
Bitget lost about $351.6 million from its hot and warm wallets after attackers spoofed transaction data in a backend system, the exchange said. Cold storage held and a $464 million fund covers the loss, while about 45% of the haul is native XRP that no one can freeze.
Reality
Security · September 20, 2026 · Confirmed2 publishers
Invest · September 7, 2026 · Confirmed3 publishers
Security · August 15, 2026 · Confirmed2 publishers