Loading story…
World Liberty Financial (WLF) has initiated emergency measures to secure user funds after discovering that several wallets were compromised through phishing attacks and exposed seed phrases. The company responded by freezing affected wallets, verifying user identities with enhanced know-your-customer (KYC) checks, and developing new smart contract logic to migrate assets into more secure replacement wallets. WLF attributed the incident to third-party security lapses rather than vulnerabilities in its own platform or smart contracts. The situation has drawn political scrutiny, with U.S. senators urging federal agencies to investigate allegations that WLF tokens were sold to sanctioned entities, following a watchdog report from September.
The incident highlights ongoing security challenges in the cryptocurrency sector, where phishing and poor key management continue to expose users to significant risks. WLF's response underscores the importance of rapid incident containment, user verification, and technical remediation in the wake of digital asset compromises. The company’s actions are being closely watched by regulators and the broader crypto community, especially given its political connections and the potential for regulatory consequences if allegations of token sales to sanctioned entities are substantiated.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The U.K. Serious Fraud Office arrested two men in connection with the suspected $28 million Basis Markets rug pull. The agency described the case as its first major cryptocurrency fraud investigation.
World Liberty Financial scrambled to protect user funds after some wallets were compromised through phishing attacks or exposed seed phrases. The incident prompted the firm to take steps to secure affected accounts.
Firas Isa, founder and CEO of Crypto Dispensers, faced U.S. federal charges for allegedly laundering $10 million through the company's crypto ATM network. The case emerged as the company was reportedly considering a $100 million sale.
The Gana Payment project suffered a hack resulting in losses of about $3.1 million. According to ZachXBT, the stolen assets were laundered across BNB Smart Chain and Ethereum through Tornado Cash.
Basis Markets was suspected of orchestrating a $28 million rug pull, forming the basis of a later U.K. Serious Fraud Office investigation. The references do not provide a specific date for when the alleged fraud occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wallet-drain campaign dubbed **Ill Bloom** exploited weak entropy in `CryptoJS.lib.WordArray.random()` to steal at least **$5.69 million** from cryptocurrency users, according to Coinspect. The flaw affected wallet applications that used vulnerable versions of CryptoJS to generate recovery phrases, allowing attackers to guess seed phrases, derive wallet addresses, and drain funds. Coinspect linked two theft waves between May 27 and July 13 to the issue and identified five affected apps: **RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo**. The underlying problem traces to a long-standing weakness in CryptoJS random-number generation, broadly covered by advisory `GHSA-rg76-677x-56q9` for versions earlier than `4.0.0`, though exploitation depended on whether developers used the function for security-sensitive seed generation. Coinspect warned that simply updating an affected wallet does not secure wallets already created with weak recovery phrases; users must generate a new secure seed phrase and move funds, and additional vulnerable wallet apps may still exist beyond the five publicly named.
Aug 6, 2026
Researchers identified a **FakeWallet** campaign that placed at least **26 malicious iOS apps** in Apple’s App Store, where they impersonated well-known cryptocurrency wallets including **MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie**. The apps primarily targeted users in **China**, taking advantage of the fact that many legitimate crypto wallet apps were unavailable in the local App Store, and used typosquatting, fake branding, and phishing flows to redirect victims to browser-based credential theft pages or trojanized wallet installers. Investigators said the operation had likely been active since at least late 2025, and Apple was notified and removed several of the identified apps. The malware used multiple techniques to steal wallet secrets from both hot-wallet and cold-wallet companion apps, including **malicious `dylib` injection**, executable hooking, provisioning profiles, and **React Native code tampering**. For hot wallets, the implants scraped mnemonic seed phrases and private keys directly from wallet interfaces; for Ledger-themed variants, the apps displayed convincing in-app prompts and fake verification pages to trick users into entering recovery phrases. Stolen data was **RSA PKCS #1-encrypted**, Base64-encoded, and sent to attacker-controlled servers, and researchers assessed the activity may be linked to the **SparkKitty** threat based on shared modules, Chinese-language artifacts, similar fake App Store-style distribution, and overlapping cryptocurrency theft objectives.
Jun 29, 2026
A critical zero-day in Litecoin’s **MimbleWimble Extension Block (MWEB)** transaction handling was actively exploited to launch a denial-of-service attack that disrupted major mining pools, caused some unpatched nodes to accept malformed or invalid transactions, and temporarily affected transaction finality and mining operations. Reports said the flaw stemmed from an input-validation failure in MWEB processing, allowing attackers to inject invalid data and, in some cases, enable unauthorized peg-out activity tied to third-party decentralized exchanges. Litecoin developers publicly confirmed the incident, issued a patch within hours, and coordinated a **13-block chain reorganization** to remove illegitimate transactions and restore chain integrity. The team said legitimate transactions remained valid overall, some transactions in reorganized blocks were reversed, and users and exchanges were not expected to lose funds. The incident highlighted the operational risk of delayed patch adoption across proof-of-work infrastructure, particularly around newer privacy-related features such as `MWEB`.
Jun 29, 2026