Cybersecurity articles tagged #Cryptocurrency on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cronos-blockchain-halted-after-6m-tectonic-defi-exploithttps://runtimerebel.com/blog/cronos-blockchain-halted-after-6m-tectonic-defi-exploitA price manipulation attack on Tectonic’s TONIC token led to a $6M Ethereum theft from the Cronos blockchain, forcing an emergency network restart.Tue, 01 Sep 2026 02:39:19 GMTCryptocurrencyCronosTectonicDeFiBlockchainhttps://runtimerebel.com/blog/safepal-data-breach-exposes-39798-customer-order-detailshttps://runtimerebel.com/blog/safepal-data-breach-exposes-39798-customer-order-detailsSafePal confirms a data breach impacting 39,798 customers, exposing names, emails, and shipping info. Stolen data is for sale, increasing phishing risks.Mon, 17 Aug 2026 00:40:25 GMTSafePalData BreachPhishingCryptocurrencySocial Engineeringhttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptohttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptoClickFix social engineering campaigns target macOS users with Go-based infostealers designed to drain cryptocurrency wallets and credentials.Mon, 10 Aug 2026 00:59:16 GMTmacOSMalwareCryptocurrencyPhishingCredential Thefthttps://runtimerebel.com/blog/banking-malware-crypto-clippers-hijack-h1-2026-paymentshttps://runtimerebel.com/blog/banking-malware-crypto-clippers-hijack-h1-2026-paymentsGen Threat Labs details two H1 2026 campaigns: banking malware abusing compromised mailboxes and a Rust crypto clipper hijacking wallet addresses.Sun, 09 Aug 2026 00:58:21 GMTClipboard HijackerCryptocurrencyFinancial FraudBanking MalwareGepyShttps://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-thefthttps://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-theftThe ClickFix attack leverages a Go-based macOS infostealer to pilfer cryptocurrency, browser data, and Apple Keychain credentials via a Bash script loader.Fri, 07 Aug 2026 02:08:44 GMTClickFixmacOSInfostealerCryptocurrencyGolanghttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackhttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackAdform's JavaScript was poisoned to swap crypto wallet addresses on customer sites.Sat, 01 Aug 2026 10:00:39 GMTAdformJavaScriptCryptocurrencyWallet SwappingSupply Chain AttackClient Side Attackhttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-thefthttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-theftNorth Korean threat actors are using deceptive full-screen macOS update pages to distribute crypto-stealing malware in a new Contagious Interview campaign.Thu, 30 Jul 2026 21:11:51 GMTmacOSLazarus GroupMalvertisingCryptocurrencyDPRKhttps://runtimerebel.com/blog/okobot-framework-injects-phishing-modules-into-ledger-and-trezor-appshttps://runtimerebel.com/blog/okobot-framework-injects-phishing-modules-into-ledger-and-trezor-appsThe OkoBot malware framework targets Windows users to steal hardware wallet seed phrases by injecting malicious pages directly into legitimate desktop apps.Wed, 15 Jul 2026 17:19:11 GMTOkoBotLedgerTrezorPhishingHardware WalletCryptocurrencyhttps://runtimerebel.com/blog/injective-labs-npm-package-compromise-steals-crypto-keyshttps://runtimerebel.com/blog/injective-labs-npm-package-compromise-steals-crypto-keysCritical supply chain attack compromises Injective Labs SDK on GitHub, distributing malicious npm package `@injectivelabs/sdk-ts@1.20.21` to steal crypto wallet keys.Fri, 10 Jul 2026 17:48:42 GMTInjective LabsNPMSupply Chain AttackCryptocurrencyWallet TheftMalicious PackageSDKhttps://runtimerebel.com/blog/injective-sdk-npm-compromise-crypto-wallet-stealer-detectedhttps://runtimerebel.com/blog/injective-sdk-npm-compromise-crypto-wallet-stealer-detectedA malicious version of the Injective SDK (injective-js) on npm was published via a GitHub compromise, deploying a crypto wallet stealer. Developers are at risk.Fri, 10 Jul 2026 03:32:02 GMTInjective SDKNPMCryptocurrencyWallet StealerSupply Chain AttackMalwareInjective Jshttps://runtimerebel.com/blog/metamask-phishing-campaign-targets-secret-recovery-phraseshttps://runtimerebel.com/blog/metamask-phishing-campaign-targets-secret-recovery-phrasesThreat actors are targeting Metamask users with phishing emails designed to harvest Secret Recovery Phrases, leading to the total loss of cryptocurrency assets.Wed, 01 Jul 2026 09:23:12 GMTMetamaskCryptocurrencyPhishing CampaignSeed Phrase TheftCredential Harvestinghttps://runtimerebel.com/blog/silent-swap-crypto-clipper-fake-google-notes-ext-steals-walletshttps://runtimerebel.com/blog/silent-swap-crypto-clipper-fake-google-notes-ext-steals-walletsAnalysis of Silent Swap crypto clipper campaign using a fake Google Notes extension to surreptitiously replace cryptocurrency wallet addresses during transactions.Tue, 30 Jun 2026 16:48:05 GMTSilent SwapCrypto ClipperCryptocurrencyBrowser ExtensionMalwareFinancial Thefthttps://runtimerebel.com/blog/critical-simplehelp-vulnerability-exploited-for-malware-deliveryhttps://runtimerebel.com/blog/critical-simplehelp-vulnerability-exploited-for-malware-deliveryA critical vulnerability in SimpleHelp is actively exploited to deploy malware, targeting credentials, SSH keys, and crypto wallets. Immediate patching is essential.Tue, 30 Jun 2026 09:19:14 GMTSimpleHelpExploitationMalwareCredentialsSSH KeysCryptocurrencyRemote Supporthttps://runtimerebel.com/blog/zcash-orchard-pool-logic-error-enables-infinite-zec-mintinghttps://runtimerebel.com/blog/zcash-orchard-pool-logic-error-enables-infinite-zec-mintingA critical vulnerability in the Zcash Orchard privacy pool allowed attackers to bypass validation and counterfeit ZEC via zero-knowledge proof flaws.Mon, 08 Jun 2026 17:14:14 GMTZcashOrchard PoolZero Knowledge ProofsCryptocurrencyBlockchain Securityhttps://runtimerebel.com/blog/ofac-sanctions-nobitex-disrupting-ransomware-terror-financehttps://runtimerebel.com/blog/ofac-sanctions-nobitex-disrupting-ransomware-terror-financeThe U.S. Treasury sanctions Nobitex, Iran's largest crypto exchange, for facilitating terrorist financing and ransomware payments.Wed, 03 Jun 2026 21:10:45 GMTNobitexOFACSanctionsCryptocurrencyRansomwareIranTerrorist Financinghttps://runtimerebel.com/blog/jinx-0164-targets-crypto-firms-with-macos-malware-and-fake-lureshttps://runtimerebel.com/blog/jinx-0164-targets-crypto-firms-with-macos-malware-and-fake-luresThe JINX-0164 threat actor targets cryptocurrency firms via recruitment-themed social engineering, macOS-specific malware, and CI/CD infrastructure exploits.Thu, 28 May 2026 09:22:52 GMTJINX 0164macOSCryptocurrencyCI CDSocial Engineeringhttps://runtimerebel.com/blog/fbi-warns-388m-lost-to-crypto-atm-scams-in-2023-defense-guidehttps://runtimerebel.com/blog/fbi-warns-388m-lost-to-crypto-atm-scams-in-2023-defense-guideThe FBI reports Americans lost over $388 million to crypto ATM scams in 2023, driven by social engineering. Learn how to protect against these financial frauds.Tue, 19 May 2026 20:41:06 GMTCrypto ATMScamsSocial EngineeringFBIFinancial FraudCryptocurrencyConsumer Protectionhttps://runtimerebel.com/blog/bluenoroff-exploits-fake-zoom-meetings-to-deploy-macos-malwarehttps://runtimerebel.com/blog/bluenoroff-exploits-fake-zoom-meetings-to-deploy-macos-malwareBlueNoroff leverages AI avatars and stolen video to compromise crypto executives via fake Zoom calls and the Hidden Risk macOS malware family.Wed, 29 Apr 2026 08:53:57 GMTBlueNoroffLazarus GroupHidden RiskmacOS MalwareCryptocurrencyhttps://runtimerebel.com/blog/26-fakewallet-apps-infiltrate-apple-app-store-research-analysishttps://runtimerebel.com/blog/26-fakewallet-apps-infiltrate-apple-app-store-research-analysisResearchers discover 26 malicious apps on the Apple App Store impersonating crypto wallets to steal seed phrases via trojanized software and browser redirects.Fri, 24 Apr 2026 12:32:02 GMTApple App StoreFakeWalletCryptocurrencyPhishingiOS SecuritySeed Phrase Thefthttps://runtimerebel.com/blog/malicious-crypto-apps-on-apple-app-store-target-private-keyshttps://runtimerebel.com/blog/malicious-crypto-apps-on-apple-app-store-target-private-keysDozens of fake cryptocurrency wallet applications have been found in the Apple App Store, designed to phish users' recovery phrases and private keys, leading to…Tue, 21 Apr 2026 20:25:52 GMTCryptocurrencyMalwarePhishingApple App StoreMobile SecurityPrivate KeysRecovery Phraseshttps://runtimerebel.com/blog/malicious-crypto-wallets-infiltrate-china-s-apple-app-storehttps://runtimerebel.com/blog/malicious-crypto-wallets-infiltrate-china-s-apple-app-store26 fake cryptocurrency wallet apps infiltrated China's Apple App Store, impersonating popular brands to steal seed phrases and drain user funds.Tue, 21 Apr 2026 00:45:03 GMTCryptocurrencyMalwareiOSApple App StoreWalletSeed Phrase TheftChinaSupply Chain Attackhttps://runtimerebel.com/blog/grinex-exchange-shuts-down-after-13-74m-state-sponsored-hackhttps://runtimerebel.com/blog/grinex-exchange-shuts-down-after-13-74m-state-sponsored-hackSanctioned exchange Grinex halts operations following a $13.74M hack attributed to Western intelligence agencies. Analysis of TTPs and geopolitical impact.Sat, 18 Apr 2026 12:18:02 GMTGrinexCryptocurrencyState SponsoredSanctionsFinancial Cybercrimehttps://runtimerebel.com/blog/grinex-crypto-exchange-suffers-13-7m-hack-blames-intelligencehttps://runtimerebel.com/blog/grinex-crypto-exchange-suffers-13-7m-hack-blames-intelligenceKyrgyzstan's Grinex crypto exchange suspended operations after a $13.7M hack. The exchange attributes the breach to Western intelligence agencies, highlighting sector…Sat, 18 Apr 2026 00:40:22 GMTGrinexCryptocurrencyCyberattackFinancial SectorIntelligence ClaimsBreachhttps://runtimerebel.com/blog/ref6598-exploits-obsidian-plugins-to-deploy-phantompulse-rathttps://runtimerebel.com/blog/ref6598-exploits-obsidian-plugins-to-deploy-phantompulse-ratAttackers are targeting finance and crypto sectors by abusing Obsidian plugins to deliver the PHANTOMPULSE RAT via sophisticated social engineering.Thu, 16 Apr 2026 12:31:23 GMTREF6598PHANTOMPULSEObsidianFinanceCryptocurrencyhttps://runtimerebel.com/blog/cve-2024-21390-engagelab-sdk-vulnerability-risks-android-crypto-walletshttps://runtimerebel.com/blog/cve-2024-21390-engagelab-sdk-vulnerability-risks-android-crypto-walletsMicrosoft reveals a vulnerability in the EngageLab SDK affecting millions of Android crypto wallet users, potentially allowing for private key theft.Fri, 10 Apr 2026 08:39:29 GMTCVE-2024-21390AndroidEngageLabCryptocurrencySDK Vulnerabilityhttps://runtimerebel.com/blog/bitcoin-depot-breach-3-6m-exfiltrated-from-crypto-wallet-systemshttps://runtimerebel.com/blog/bitcoin-depot-breach-3-6m-exfiltrated-from-crypto-wallet-systemsBitcoin Depot reports a $3.6 million theft following a breach of internal systems. Analyze the impact and learn how to mitigate cryptocurrency ATM breaches.Thu, 09 Apr 2026 08:38:23 GMTBitcoin DepotCryptocurrencyWallet SecurityFinancial TheftSec Filinghttps://runtimerebel.com/blog/drift-protocol-hacked-for-285m-via-durable-nonce-attackhttps://runtimerebel.com/blog/drift-protocol-hacked-for-285m-via-durable-nonce-attackSolana-based DEX Drift Protocol lost $285 million due to a social engineering and durable nonce attack, leading to Security Council takeover.Fri, 03 Apr 2026 12:21:37 GMTDrift ProtocolSolanaDurable NonceSocial EngineeringDPRKCryptocurrencyDeFihttps://runtimerebel.com/blog/drift-protocol-compromise-admin-control-seized-280m-losthttps://runtimerebel.com/blog/drift-protocol-compromise-admin-control-seized-280m-lostAnalysis of the Drift Protocol incident where a threat actor seized Security Council powers, leading to a $280 million loss. Learn about the attack vector and mitigation.Thu, 02 Apr 2026 20:15:38 GMTDrift ProtocolCryptocurrencyDeFiAdministrative ControlSecurity CouncilFinancial LossAccess Controlhttps://runtimerebel.com/blog/torg-grabber-infostealer-threat-to-728-crypto-walletshttps://runtimerebel.com/blog/torg-grabber-infostealer-threat-to-728-crypto-walletsAnalysis of Torg Grabber infostealer, detailing its methods for exfiltrating sensitive data from 728 cryptocurrency wallets and 850 browser extensions.Wed, 25 Mar 2026 20:17:25 GMTTorg GrabberInfostealerCryptocurrencyWalletsBrowser ExtensionsData Exfiltrationhttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-grouphttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-groupBitrefill identifies North Korean Lazarus Group as the perpetrator of a recent cyberattack, underscoring the persistent threat to crypto-focused businesses.Thu, 19 Mar 2026 20:16:23 GMTLazarus GroupBlueNoroffBitrefillCryptocurrencyAPTNorth Koreahttps://runtimerebel.com/blog/unc4899-exploits-airdrop-for-crypto-firm-breach-analysishttps://runtimerebel.com/blog/unc4899-exploits-airdrop-for-crypto-firm-breach-analysisUNC4899 breached a crypto firm using AirDrop to bypass network security. This analysis explores the TTPs of North Korean threat actors in 2025.Mon, 09 Mar 2026 16:30:09 GMTUNC4899Jade SleetmacOS SecurityAirDropNorth KoreaCryptocurrencyhttps://runtimerebel.com/blog/fbi-arrests-suspect-in-46m-us-marshals-crypto-thefthttps://runtimerebel.com/blog/fbi-arrests-suspect-in-46m-us-marshals-crypto-theftA suspect linked to the theft of $46 million in cryptocurrency from the U.S. Marshals Service has been arrested.Thu, 05 Mar 2026 20:16:44 GMTCryptocurrencyTheftUS Marshals ServiceGovernmentCybercrimeFBIhttps://runtimerebel.com/blog/quicklens-chrome-extension-hijacked-to-deploy-clickfix-malwarehttps://runtimerebel.com/blog/quicklens-chrome-extension-hijacked-to-deploy-clickfix-malwareMalicious QuickLens Chrome extension removed from Web Store after stealing cryptocurrency and deploying ClickFix malware to 30,000 users.Sat, 28 Feb 2026 20:09:10 GMTQuickLensClickFixChrome ExtensionCredential TheftCryptocurrencyhttps://runtimerebel.com/blog/korean-tax-agency-leak-leads-to-4-8m-cryptocurrency-thefthttps://runtimerebel.com/blog/korean-tax-agency-leak-leads-to-4-8m-cryptocurrency-theftSouth Korea's National Tax Service accidentally leaked a wallet's mnemonic seed phrase in a press release, allowing hackers to drain $4.8 million.Sat, 28 Feb 2026 16:08:53 GMTSouth KoreaNational Tax ServiceCryptocurrencyMnemonic PhraseOperational SecurityOPSEChttps://runtimerebel.com/blog/fake-recruiters-deploy-malware-via-malicious-coding-challengeshttps://runtimerebel.com/blog/fake-recruiters-deploy-malware-via-malicious-coding-challengesNorth Korean threat actors are targeting software developers with fake job offers and malicious coding tests to deploy malware on developer workstations.Fri, 27 Feb 2026 12:18:39 GMTLazarus GroupNorth KoreaSocial EngineeringMalicious Coding ChallengesCryptocurrencyTrojanized Software