Cryptocurrency Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME | Info | CATEG. | WEB |
|
10.10.26 |
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials | Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces. | Cryptocurrency blog | Socket |
|
10.10.26 |
Inferno Drainer Is Burning Out | Inferno Drainer and its many derivatives constitute arguably the most notorious cryptodrainer-as-a-service ecosystem ever developed. After months spent reverse-engineering its newest payloads and monitoring the ecosystem in real time, one thing seems clear: the operation is in serious decline, and has been for quite some time. | Cryptocurrency blog | Ransom-ISAC |
|
3.10.26 |
PolinRider Switches to Ethereum C2 in 30+ Repositories - Real-time Open Source Software Supply Chain Security | The PolinRider loader family has a new way to find its command and control (C2) servers. It reads Ethereum mainnet and looks for small transactions from an operator wallet. The recipient address of each transaction holds the IP address of a C2 server. SafeDep found two operator wallets that use this method. One wallet has sent a transaction about every 51 minutes since 2026-06-23. | Cryptocurrency blog | NETCRAFT |
|
3.10.26 |
XCTDH Adopts Hash Hiding | A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encoded in Ethereum transaction destination addresses. | Cryptocurrency blog | Ransom-ISAC |
|
30.9.26 |
Beware of Malware infection in Facebook Ads Offering Cryptocurrency Rewards | Just because it’s a familiar tactic doesn’t mean you can let your guard down. A similar attack method using cryptocurrency rewards as bait has recently been identified again. This time, a case was confirmed in which the Node.Js-based malware JSCEAL was distributed through Facebook ads impersonating a cryptocurrency exchange. | Cryptocurrency blog | ASEC |
|
29.9.26 |
Attackers Target Ledger Users Via Google Ads | In August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users. The ads redirected users through Google Cloud Storage and Vercel to a Google Sites page containing a phishing page impersonating Ledger in an iframe. During our analysis, the Vercel redirect appeared to change every 15-20 minutes. | Cryptocurrency blog | ThreatLabz |
|
26.9.26 |
2026 LATAM Crypto Adoption: Latin America Grew 9.8% | Latin America bucked the bear market. The region’s crypto economy saw $593.8 billion in activity, with an overall growth of 9.8%. This growth points to sustained demand for crypto, even in a year when global markets faced headwinds. | Cryptocurrency blog | Chainalysis |
|
26.9.26 |
2026 Global Crypto Adoption Index: Brazil Ranks No. 1 - | Crypto economy overcame worst market since 2022: Even as crypto’s total market cap fell about 50% (a $2.1 trillion contraction), on-chain economic activity slipped just 1.6%, from $9.5 trillion to $9.4 trillion. A growing diversity of use cases, not price speculation, kept the economy steady. | Cryptocurrency blog | Chainalysis |
|
26.9.26 |
Threat Intelligence Gives Security Data Meaning | Security teams have no shortage of threat data. They continuously consume feeds from commercial providers, open-source repositories, information-sharing communities and vendors across the cybersecurity ecosystem. The harder problem is determining which signals matter, what they reveal and what action to take next. | Cryptocurrency blog | R136a1.dev |
|
26.9.26 |
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint | Huntress recently observed a threat actor doing something unique post-compromise: instead of simply dropping a miner, they compiled one directly on the victim endpoint, tailoring the payload while generating unusually conspicuous EDR telemetry. | Cryptocurrency blog | Huntress |
|
26.9.26 |
Been told to pay at a Bitcoin ATM? Read this first | Crypto ATM scams often follow a predictable script – here’s how to recognize it and what to do if you’ve already been caught out | Cryptocurrency blog | Eset |
|
18.9.26 |
EtherHiding Exposed: Inside a Blockchain-powered Malware | We identified a malware campaign, active since at least November 2025, that stores its command-and-control (C2) address inside smart contracts on the Polygon blockchain instead of hardcoding it into the malware itself, a technique known as EtherHiding. | Cryptocurrency blog | GUIDESECURITY |
|
12.9.26 |
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data | Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data. | Cryptocurrency blog | SOCKET.DEV |
|
12.9.26 |
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2 | Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session. | Cryptocurrency blog | CISCO TALOS |
|
9.9.26 |
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files | Note on withheld data: Individual victim IPs are aggregated by network block, not listed. Sensitive data incidentally exposed on unrelated third-party sites has been removed from this report and, where possible, reported to the relevant providers. This report documents attacker infrastructure and tradecraft; it is not a disclosure against any named organization. | Cryptocurrency blog | HUNT.IO |
|
3.9.26 |
Mini Shai-Hulud's Latest Wave: 280 New Places | A new Mini Shai-Hulud wave hit keyv and 800+ npm packages. The malware now scans 469 secret locations, including AI agents, crypto wallets, and CI/CD tools. | Cryptocurrency blog | GITGUARDIAN |
|
2.9.26 |
The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT | Between late July and mid August 2026, multiple Huntress-protected organizations were hit by the same modular RAT, three of which were hit within an 85-minute window. Victims were tricked into downloading a JavaScript file that quietly pulled down an installer for a real, working Exodus crypto wallet, with the RAT hidden inside. | Cryptocurrency blog | Huntress |
|
22.8.26 |
BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer | CloudSEK’s BRIDGEHEAD investigation exposes a 40-package npm typosquatting campaign that abuses WSL to reach Windows hosts and deploy a concealed Rust-based stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and exfiltration, making detection and takedown significantly harder. | Cryptocurrency blog | CloudSEK |
| 27.6.26 | From Langflow to Monero: Inside CVE-2026-33017 Cryptominer | We tracked a cryptocurrency-mining campaign exploiting CVE-2026-33017, which revealed how threat actors are now scanning exposed AI application infrastructure for their next foothold. | Cryptocurrency blog | Trend Micro |
| 21.3.26 | North Korea’s Crypto Theft Operations: The Role of Lazarus Group in State-Sponsored Financial Warfare | Lazarus Group cyberattack on Bitrefill highlights how North Korean hackers exploit crypto platforms via credentials and human error for theft. | Cryptocurrency blog | Cyble |
| 21.2.26 | Technical Deep Dive: The Monero Mining Campaign | In the contemporary threat landscape, while ransomware grabs headlines with high-impact disruptions, cryptojacking operations have quietly evolved into sophisticated, persistent threats. | Cryptocurrency blog | Trelix |