DEV Community: Basis Desk

CoinDCX Denies Fresh Hack Following $16M Outflow From Retired Addresses

Basis Desk — Fri, 23 Oct 2026 08:06:57 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

The Indian exchange attributed the movements to addresses compromised in July 2025, absorbing operational losses from sweeping errors.

Key points

CoinDCX denied an active system compromise after analysts flagged approximately $16 million in USDT and TRX outflows.
The exchange attributed the movements to old deposit addresses previously breached during a $44 million hack in July 2025.
Investigator ZachXBT reported at least one flagged address continued funneling deposits to CoinDCX's hot wallet through May 2026.

CoinDCX has dismissed claims of an active security breach after on-chain analysts flagged roughly $16 million in suspicious asset transfers from addresses linked to the Indian digital asset trading platform [1]. The exchange maintained that its current central infrastructure and active user wallets remain unaffected, describing the transactions as activity on deprecated addresses compromised during a previous security incident [1].

Blockchain observers initially highlighted the transfers on Oct. 21, tracing approximately $16 million worth of $USDT and Tron's $TRX routed to a single Tron network address [1]. The destination wallet subsequently disbursed the funds across multiple counterparties, with the single largest transaction totaling 15,819,002 USDT [1]. CoinDCX Chief Executive Officer Sumit Gupta categorized the alerts as a false alarm, asserting that the perpetrators of a July 2025 compromise—which resulted in roughly $44 million in losses—were reusing retired infrastructure [1]. At the time of writing, USDT traded at $0.9986, while broader crypto markets recorded a neutral reading on market sentiment.

Analysts Question Infrastructure Deprecation

Independent on-chain investigator ZachXBT disputed the exchange's explanation, providing data indicating that one flagged deposit address remained operational well after the July 2025 breach [1]. According to ZachXBT, a liquidity provider utilized the address across a 10-month span, forwarding aggregated customer deposits and receiving operational network fees directly linked to CoinDCX's primary hot wallet as recently as April and May 2026 [1]. Analysts had earlier placed CoinDCX under scrutiny over $16M transfers originating from historical addresses.

CoinDCX acknowledged that despite historical notices directing customers to update their accounts, certain users continued transmitting funds to outdated destinations [1]. The firm stated that an internal mechanism intended to sweep assets out of legacy addresses temporarily failed, resulting in operational losses [1]. CoinDCX stated it fully credited all impacted depositors and that standard trading services remain uninterrupted [1].

Sources

CoinDCX denies hack, blames broken clean up job for $16 million outflow — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

PHP Emergency Patches Target Critical Vulnerabilities Threatening Web3 Frontends

Basis Desk — Fri, 23 Oct 2026 03:21:29 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

Vulnerabilities CVE-2026-109618 and CVE-2026-109619 carry a 9.2 CVSS rating, leaving over half of scanned crypto domains exposed to potential off-chain compromises.

Key points

The PHP project pushed emergency fixes for two 9.2-severity RCE vulnerabilities spanning PHP versions 5.4 through 8.5.11.
SlowMist's MistEye system detected PHP fingerprints on 53.3% of 1,488 scanned cryptocurrency industry domains.
Amazon's threat intelligence detected active exploitation attempts in honeypots on Oct. 17, four days prior to public disclosure.

The PHP project issued emergency updates on Oct. 21 to remediate two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both assigned a CVSS v4.0 rating of 9.2 [1]. The flaws enable unauthenticated remote code execution across public-facing PHP installations running versions 5.4 through 8.5.11 [1]. The release was pushed forward from Oct. 22 after technical details leaked prematurely on Oct. 20 [1]. In a related disclosure, Amazon's threat intelligence team reported observing active exploitation attempts against PHP environments as early as Oct. 17 within its MadPot honeypot infrastructure [1].

Security firm SlowMist warned that the vulnerabilities pose severe risks to off-chain Web3 infrastructure [1]. An audit by SlowMist's threat intelligence system, MistEye, identified direct PHP fingerprints across 793 of 1,488 scanned crypto-related domains, representing 53.3% of the cohort [1]. While smart contract code remains unaffected on-chain, decentralized finance frontends, crypto payment gateways, and hosted wallet services relying on PHP could be exploited [1]. A compromise at the web layer permits attackers to hijack user signing requests, manipulate approval destinations, or expose hot wallet credentials and administrative interfaces [1]. Similar external attack vectors were highlighted when CertiK warned an eMudhra flaw threatened crypto bots.

Off-Chain Vulnerability and User Exposure

The disclosed vulnerabilities stem from memory management failures [1]. CVE-2026-109618 involves an out-of-memory memory corruption flaw where incomplete data structures are misprocessed during cleanup routines, while CVE-2026-109619 permits attackers to achieve remote code execution in PHP-FPM by exploiting stale global state left between sequential worker requests [1]. Remediation requires upgrading to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, whereas legacy deployments on PHP 8.1 or older have reached end-of-life status and lack standard upstream patches [1].

SlowMist clarified that end-user non-custodial wallets are not inherently cracked by visiting a site, nor is there a mandate for widespread fund withdrawals [1]. However, if administrative servers or off-chain API keys are breached, attackers can deploy deceptive approval transactions on frontend interfaces [1]. The security firm urged operators to separate hot wallets from the web tier and advised users to verify transaction parameters before executing on-chain signatures [1]. As teams inspect their off-chain dependencies, applying strict protocols such as a DeFi risk checklist remains essential to evaluating operational custody and smart contract interactions.

FAQ

Which PHP versions are affected by the vulnerabilities?

PHP versions 5.4 through 8.5.11 are vulnerable. Official security patches were released in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while PHP 8.1 and earlier require manual migration due to reaching end-of-life.

Are private keys directly at risk from these PHP vulnerabilities?

No. The flaws affect web server environments and do not directly compromise private keys in user wallets, though compromised servers could present deceptive transaction prompts or expose backend API credentials.

Sources

PHP Unveils Critical “Internet-Wide” Vulnerabilities: How Can Web3 Patch Its “Off-Chain Weaknesses”? — SlowMist

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Starknet Community Backs Exploration of Independent Post-Quantum Layer 1

Basis Desk — Thu, 22 Oct 2026 09:46:55 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

A governance poll approved research into departing Ethereum with 93.5% support, targeting a quantum-resistant standalone network by 2027.

Key points

Starknet governance closed a non-binding vote with 93.52% voting power approving research into transitioning to an independent layer 1 [1].
A whitepaper detailing the technical architecture is scheduled for public release in November, with STRK remaining the native token [1].
StarkWare is targeting a 2027 post-quantum deployment deadline, arguing Ethereum's planned 2029 timeline carries security risks [1].

The Starknet community voted overwhelmingly to back research into transforming the network from an Ethereum layer 2 into an independent, post-quantum layer-1 blockchain [1]. The non-binding governance poll concluded on Thursday after seven days of voting, drawing approximately 3,200 participants with 93.52% of voting power supporting the initiative [1]. According to StarkWare, the ballot achieved the highest voter turnout in Starknet's governance history, with StarkWare abstaining to allow community members to decide the outcome [1].

Approval of the measure authorizes StarkWare and the Starknet Foundation to form a working group to study the architectural shift and assemble technical proposals [1]. StarkWare CEO Eli Ben-Sasson stated that drafting on a technical whitepaper has begun, with plans to release a public draft in November [1]. Starknet will continue normal operations as an Ethereum layer 2 during this research phase, and any formal decision to sever layer-2 dependencies will require an additional, binding governance vote [1]. The initial proposal confirmed that $STRK will remain the native token without any new asset issuance, and existing bridges to Ethereum will remain operational [1].

Quantum Security and the Independence Thesis

StarkWare initially proposed exploring an independent layer 1 on Oct. 8, pointing to vulnerabilities linked to Ethereum's security architecture and upgrade pace [1]. While Starknet leverages hash-based STARK proofs and programmable accounts that can natively support post-quantum cryptography, its data availability and cross-chain bridge mechanisms remain tethered to Ethereum's consensus rules [1]. In June, StarkWare outlined a three-stage quantum-resistance framework encompassing cryptography upgrades, contract migrations, and independence from Ethereum infrastructure [1]. StarkWare's Quantum Hub has already executed an experimental quantum-resilient transaction on the Starknet mainnet, though the underlying code has not yet completed a security audit [1].

The strategic push stems from diverging cryptographic transition roadmaps [1]. While the Ethereum Foundation targets 2029 for post-quantum deployment, Ben-Sasson argued that timeline is insufficient to protect network value against future quantum capabilities, targeting a full transition for Starknet by 2027 [1]. The development comes as $ETH traded down 2.5% at $2,397 and $BTC fell 2.0% to $81,677 at the time of writing.

FAQ

Is Starknet leaving Ethereum immediately?

No. The completed vote is non-binding and only authorizes technical research. Starknet will continue to operate as an Ethereum layer-2 network, and any actual shift to a layer 1 requires a separate, binding governance vote.

Will there be a new token for the Starknet L1?

No. According to the governance proposal, STRK will remain the network's native token and no new token will be launched.

Sources

Starknet voters back research into life beyond Ethereum — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Project Eleven CEO Claims Quantum Labs Are Withholding Research to Avoid Panic

Basis Desk — Thu, 22 Oct 2026 00:01:17 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

Alex Pruden said labs directly informed the post-quantum security firm they are suppressing sensitive findings, expanding on earlier remarks citing government guidance.

Key points

Project Eleven CEO Alex Pruden claims quantum labs directly told his firm they are withholding certain research to prevent public panic.
Pruden did not identify specific laboratories, disclose the withheld findings, or name the entities requesting suppression.
Google acknowledged in a March 31 post that it withheld circuit details from an elliptic curve study after engaging with the U.S. government.

Quantum computing facilities are intentionally withholding select breakthrough research findings from the public to avoid triggering broad panic, according to Alex Pruden, co-founder and chief executive officer of post-quantum security firm Project Eleven [1]. Speaking in an Unchained livestream recorded on Oct. 19, Pruden described the situation as "a fact" communicated directly to his firm [1].

Pruden stated that labs have chosen not to disclose specific findings either by choice or because outside parties instructed them to remain quiet [1]. "We've been told by quantum labs that they are not publishing certain results because they've been told not to or because they're choosing not to," Pruden said, adding that the objective was to avoid creating panic [1]. Pruden did not identify the specific laboratories, specify the undisclosed research findings, or reveal who instructed the entities to withhold the data [1].

Prior Disclosures and Industry Context

The statements follow earlier comments Pruden delivered on Oct. 8 during a TOKEN2049 side event in Singapore, where he claimed that major quantum enterprises, including Google, engage in self-censorship under government guidance [1]. Public records reflect that Google previously consulted with authorities regarding cryptographic research [1]. In a March 31 blog post assessing the quantum resources required to crack 256-bit elliptic curve cryptography, Google disclosed that it "engaged with the U.S. government" and issued a zero-knowledge proof rather than publishing the underlying circuits, aiming to prevent bad actors from obtaining an actionable roadmap [1].

Pruden's Oct. 19 remarks came amid broader industry deliberations regarding cryptographic vulnerability, following an Oct. 7 proposal by Ethereum Foundation researcher Justin Drake urging the digital asset sector to prepare a "bunker mode" against mathematical breakthroughs [1]. During the same discussion, Project Eleven co-founder Conor Deegan noted that the firm could not confirm whether quantum entities are sitting on active cryptographic breaks [1]. Project Eleven, which introduced its institutional post-quantum custody platform Strongpoint on Oct. 7, plans to take that platform to production in the fourth quarter of 2026 [1].

Sources

Project Eleven CEO Calls it ‘a Fact’ that Quantum Labs Are Withholding Results — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Drift Protocol Attributes Exploit to North Korea, Taps Helium and Gauntlet Veterans for Relaunch

Basis Desk — Wed, 21 Oct 2026 10:21:25 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

A forensic review by Mandiant tied the breach to threat group UNC6862 as the decentralized exchange prepares a rebooted USDT perpetual platform on Solana.

Key points

Mandiant's forensic analysis attributed the Drift exploit to UNC6862, a North Korean state-sponsored threat group.
Drift hired former Helium executive Noah Prince as Head of Protocol and engaged former Gauntlet members for risk modeling.
The rebooted perpetual exchange will focus on USDT pairs to generate revenue for a dedicated user loss recovery pool.

Drift Protocol announced that cybersecurity firm Mandiant conclusively attributed its recent security breach to UNC6862, a North Korean state-sponsored threat group [1]. According to an official update published on June 4, 2026, the attacker's operational telemetry, tactics, and techniques matched historical operations run by state-backed actors linked to similar decentralized finance intrusions [1].

To prepare for its upcoming platform relaunch on Solana, the team hired former Helium Head of Protocol Engineering Noah Prince to serve as its Head of Protocol [1]. Prince, who previously managed Helium's network migration to Solana, will lead efforts to restructure the codebase and reinforce platform defenses [1]. Additionally, Drift engaged former members of the Gauntlet team to overhaul risk management and vault mechanics, covering liquidator optimization, liquidation engines, funding rates, and post-launch risk monitoring [1].

Relaunch Strategy and User Recovery

The protocol stated that its primary goal is deploying a secure, revenue-generating platform to fund a dedicated user recovery pool designed to repay outstanding customer losses [1]. Drift plans to position itself as the primary perpetual exchange denominated in $USDT on Solana, backed by a strategic support package from Tether and additional partners [1].

The initiative follows previously outlined remediation steps, including token claims and asset redemption efforts and earlier frameworks for a $147.5M recovery plan after the protocol was compromised [1]. Drift said it will disclose further specifics regarding the relaunch schedule and recovery mechanics in subsequent updates [1].

Sources

Drift Recovery Update – June 3, 2026 | Drift Updates — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Solana Activates Alpenglow Consensus Upgrade on Mainnet

Basis Desk — Wed, 21 Oct 2026 04:41:46 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

The protocol-level overhaul targets sub-second finality of 150 milliseconds, moving validator voting off-chain and replacing variable fees with a flat epoch admission cost.

Key points

Alpenglow activates at Solana epoch 1064 on Oct. 21, targeting transaction finality of roughly 150 milliseconds.
Votes move off-chain using aggregated BLS certificates, retiring Proof of History and clearing block space.
A flat 0.8 SOL per-epoch Validator Admission Ticket under SIMD-0357 replaces variable per-vote transaction fees.

Solana's core network is scheduled to activate the Alpenglow consensus upgrade on Wednesday, Oct. 21, at the start of epoch 1064 [1]. Designed by core development team Anza, the architecture replaces the longstanding TowerBFT consensus engine in what represents the largest protocol-level modification since Solana's inception [1]. At the time of writing, $SOL was trading at $105.69.

Under TowerBFT, validator votes functioned as on-chain transactions, consuming approximately three-quarters of block space and resulting in finality times of roughly 6 seconds at current 200-millisecond slot times [1]. Alpenglow shifts voting off-chain, using BLS signature aggregation to produce compact certificates confirming validator participation [1]. The design is engineered to lower transaction finality to roughly 150 milliseconds while freeing up block space for user transactions [1]. Once the transition finishes, Solana will also retire Proof of History, as single network hops eliminate the need for the shared cryptographic clock [1].

Validator Economics and Phased Rollout

The upgrade alters validator operating costs and fault tolerance structures. Per-vote transaction fees, which reached about 2 $SOL daily following earlier slot-time reductions, are replaced by a flat Validator Admission Ticket set by SIMD-0357 at 0.8 SOL per roughly 24-hour epoch [1]. Operators must fund vote accounts directly to cover the ticket or face exclusion from consensus for that epoch [1]. However, block leaders will no longer collect revenue from included vote transactions [1]. Meanwhile, the network's fault model shifts to tolerate up to 20% Byzantine stake alongside an additional 20% offline stake, raising the aggregate tolerance to 40% [1].

Validators were directed to operate Agave-based clients throughout the migration, with Firedancer's 26.10 release offering post-migration compatibility while Frankendancer support is retired [1]. Galaxy reported testing the upgrade on a volunteer test cluster since June 2026 across six re-geneses and a network rollback [1]. As previously scheduled, this mainnet activation represents Phase 1, dubbed Votor [1]. Subsequent phases will introduce optimistic leader handovers and the Rotor block-propagation mechanism, while dual-voting slashing mechanisms remain disabled for this initial release [1].

Sources

Alpenglow: What We Learned Running Solana's Biggest Consensus Change — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Optimum Launches RLNC-Powered Propagation Protocol for Ethereum Validators

Basis Desk — Tue, 20 Oct 2026 15:36:47 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

The mump2p network deploys Random Linear Network Coding across global Flexnodes, claiming two to four times faster block delivery than Gossipsub.

Key points

Optimum launched mump2p on its Flexnode mesh to accelerate Ethereum data using Random Linear Network Coding (RLNC).
The team claims 2x to 4x faster block delivery over Gossipsub and first-seen advantages exceeding 90%.
The validator integration operates as a drop-in transport layer with no modifications required for consensus rules.

Optimum has deployed the Optimum Network alongside its initial protocol, mump2p, aimed at accelerating transaction, block, and blob propagation across Ethereum [1]. The system uses Random Linear Network Coding (RLNC), an erasure-coding method co-invented at MIT by Optimum co-founder Prof Muriel Médard, to improve fault tolerance and lower latency without altering underlying consensus rules [1].

At the time of writing, $ETH traded at $2,428, up 1.0% over 24 hours. Optimum's deployment targets execution and consensus layer transport through a distributed mesh of "Flexnodes" [1]. The company claims that the network delivers blocks two to four times faster than Ethereum's standard Gossipsub peer-to-peer layer, with data appearing first on the Optimum mesh in more than 90% of instances compared to Gossipsub [1]. According to the project, the increased speed decreases missed and wrong-head attestations, while allowing block proposers to extend MEV sidecar bid-collection windows without missing proposal deadlines [1].

Expansion to Trading Infrastructure

The protocol is live for node operators as a drop-in integration through the Optimum console [1]. Because mump2p functions purely as a data-layer transport overlay, node runners do not need to adjust Ethereum consensus parameters or modify existing validator infrastructure [1]. The release arrives as node operators examine low-latency networks in parallel with broader layer-1 developments, such as when Ethereum activates network upgrades to refine consensus scaling.

Following the validator rollout, Optimum stated it plans to introduce an offering designated as "Optimum for Traders" [1]. That planned network aims to provide earlier transaction signaling to trading strategies and accelerate execution onchain, though the team did not publish a specific launch date [1].

Sources

Product — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

SlowMist Finds Qubic Wallet Seeds Leaked Through Network Headers

Basis Desk — Tue, 20 Oct 2026 07:56:33 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

Researchers demonstrated that intercepting six network header values let attackers reconstruct private keys following the theft of 2.94 trillion QU.

Key points

SlowMist identified that Qubic Wallet generated 55-character private key seeds using the non-cryptographic Math.random() function.
The same random sequence populated dejaVu network headers transmitted over plaintext TCP between bridges and peers.
Capturing six consecutive header values allowed researchers to reconstruct the PRNG state in 15 milliseconds and derive private keys.

A critical architectural vulnerability in Qubic Wallet allowed attackers to extract user private keys from network traffic using as few as six packet header observations, according to an analysis published by security firm SlowMist on Oct. 20 [1]. The findings follow Qubic's Oct. 18 disclosure that bad actors drained roughly 2.94 trillion $QU across 1,404 wallets by exploiting weak randomness in key generation [1].

SlowMist reported that the root cause stemmed from two separate code paths sharing the same non-cryptographically secure pseudorandom number generator (PRNG) [1]. When generating account seeds, the wallet relied on JavaScript's standard Math.random() to assemble a 55-character string [1]. In V8 engines, this function uses the xorshift128+ algorithm, which provides at most 64 bits of seed entropy rather than the nominal 258.5 bits expected from the character set [1]. Because the derivation directly converted these letters into a private key without mixing passwords or hardware entropy, breaking the PRNG completely exposed the key [1].

Plaintext Headers Exposed PRNG State

The vulnerability became remotely exploitable because the same random number stream was tapped to generate network packet headers [1]. The wallet populated a request header field named dejaVu by drawing truncated values from Math.random() [1]. These values were sent inside balance and tick requests transmitted over plaintext TCP to network peers after TLS termination at the default web bridge [1].

By capturing six consecutive dejaVu header values, researchers fed interval constraints into the Z3 solver and reconstructed the full 128-bit internal state of the PRNG in about 15 milliseconds [1]. Because balance queries simultaneously exposed the account's public key, observers on the unencrypted link could calculate candidate seeds backwards or forwards, verify them offline, and forge signatures to drain funds [1]. The incident follows an earlier network pause by Qubic after the unauthorized transfers were first detected [1].

Sources

Recovering Private Keys in Just 6 Connections: Qubic Wallet May Have Leaked Most of Its Private… — SlowMist

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Zakura Develops One-Time Viewing Key Fix for Quantum Zcash Swap Risks

Basis Desk — Mon, 19 Oct 2026 05:32:07 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

The proposed protocol modification isolates swap addresses using private information retrieval to prevent future quantum computers from de-anonymizing historical wallet payments.

Key points

Zakura introduced a one-time incoming viewing key (ivk) architecture to shield Zcash swap users from future quantum decryption attacks.
Cross-chain swaps via NEAR Intents previously exposed user addresses on public ledgers, creating vulnerabilities to Shor's algorithm.
The solution integrates private information retrieval (PIR) to maintain fast wallet seed recovery without splitting hardware wallet balances.

Zakura published an engineering proposal on Oct. 19, 2026, detailing a defense against future quantum decryption attacks targeting $ZEC cross-chain swaps [1]. The vulnerability affects users who publish shielded addresses to public ledgers during automated swap processes, particularly through protocols like NEAR Intents [1].

Under Zcash's current cryptographic design, shielded transactions hide recipient and public-key data from classical and quantum observers on the native ledger [1]. However, when an address is permanently published to an external public blockchain—such as a refund destination recorded on NEAR's public network—an adversary with a sufficiently advanced quantum computer running Shor's algorithm could derive the user's incoming viewing key ($ivk$) [1]. Because standard Zcash accounts rely on a single $ivk$ across all diversified addresses, compromising that key would expose the value, memo, and linkability of every transaction the account has ever received [1].

Isolating Addresses Without Account Fragmentation

To eliminate the risk of chain-wide de-anonymization prior to the launch of Zcash's Tachyon upgrade, Zakura designed a "one-time $ivk$" architecture that wallets can adopt directly [1]. Standard naive workarounds involve generating a new account for each swap, but hardware wallet limitations make that approach unwieldy [1]. For instance, Keystone hardware signers only access account index 0, while Ledger devices require separate transactional approvals for every account index [1].

Zakura's method instead modifies key derivation by producing a unique randomized secret ($rivk$) per swap index via keyed hashing, while leaving spending keys ($ask$) and nullifier derivation keys ($nk$) untouched [1]. This ensures that all incoming funds remain spendable from a single unified balance without manual multi-account approvals [1]. If a quantum computer subsequently cracks an exposed swap address, the attacker recovers only the isolated viewing key for that specific transaction [1].

To resolve wallet-recovery scanning overhead created by multiple viewing keys, Zakura implemented private information retrieval (PIR), adapting lookup mechanisms previously deployed for Zcash coinholder voting [1]. The update arrives as infrastructure operators expand zero-knowledge integrations, following steps such as when Gemini migrated Zcash infrastructure to Zakura node capabilities [1]. Zakura indicated that client software can integrate the derivation pattern immediately ahead of long-term post-quantum upgrades [1].

Sources

Quantum Unlinkability for Zcash Swaps — Zakura — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Qubic Pauses Network After Weak Wallet Seeds Lead to $1.4M Exploit

Basis Desk — Mon, 19 Oct 2026 01:22:13 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

The layer-1 chain halted operations at tick 85,371,949 after an attacker drained 2.94 trillion QUBIC tokens across 1,400 compromised wallets.

Key points

Qubic halted block production at tick 85,371,949 after 1,400 wallets lost 2.94 trillion QU, valued at $1.4 million.
The vulnerability stemmed from weak Math.random() seed generation on Apple devices and Safari browsers through Oct. 18, 2026.
Network validators will vote on remediation for the 87.1% of stolen assets currently frozen on-chain, while MEXC froze the rest.

Layer-1 blockchain network Qubic halted operations following an exploit that drained roughly $1.4 million across more than 1,400 accounts, according to project statements [1]. The network suspended processing at tick 85,371,949 and remains paused [1]. The incident resulted in the theft of 2.94 trillion $QU, the network's native asset, stemming from weakly generated wallet seeds across specific Apple operating systems and legacy application versions [1].

According to Qubic, the vulnerability impacted wallet seeds produced using any browser on an iPhone or iPad, Safari on macOS through Oct. 18, 2026, or the official Qubic iOS application prior to July 2025 [1]. Project representatives stated that 87.1% of the stolen capital never exited the Qubic blockchain and remains frozen on-chain, while the remaining 12.9% transferred to the centralized exchange MEXC [1]. The exchange froze the attacker's receiving account within approximately one hour of the transfer [1]. Weak key generation has presented ongoing systemic threats across the digital asset ecosystem, echoing self-custody incidents such as the Coldcard firmware vulnerability that weakened seed creation mechanisms [1].

Remediation and Recovery Roadmap

Qubic resolved the flaw in web wallet version 4.26.4, with a GitHub repository commit confirming the replacement of JavaScript's pseudo-random Math.random() function with the cryptographically secure crypto.getRandomValues() function [1]. Core developers are auditing affected accounts and drafting recovery proposals [1]. Network validators, known as Computors, will vote on governance measures to determine the disposition of the frozen assets [1].

The protocol operates an AI-oriented Useful Proof of Work consensus system, supporting fee-free smart contract execution [1]. Core contributors said a comprehensive technical post-mortem will be published after a restitution path is confirmed, though developers have not announced a formal timeline for network resumption [1].

FAQ

Which Qubic wallets were susceptible to the seed generation bug?

The flaw affected seeds generated via any browser on iOS or iPadOS, Safari on macOS up to Oct. 18, 2026, and the official Qubic iOS application before July 2025.

Are the drained Qubic funds permanently lost?

According to Qubic, 87.1% of the stolen assets remain frozen on-chain awaiting a validator vote, while the remaining 12.9% was frozen by exchange MEXC.

Sources

Qubic freezes chain after attacker drains 1.4K wallets with weak seeds — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Thai Police Arrest Chinese National Over Alleged $75M Crypto Laundering Ring

Basis Desk — Sun, 18 Oct 2026 23:26:30 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

Authorities in Bangkok took a 37-year-old suspect into custody after investigators linked him to foreign currency and digital asset laundering across 133 accounts.

Key points

Thai police arrested a 37-year-old Chinese citizen connected to an alleged 500 million yuan ($75 million) laundering ring [1].
Investigators allege the suspect managed cryptocurrency and foreign-currency transfers across more than 133 accounts [1].
The suspect faces domestic charges in Thailand for an expired visa before potential extradition to China [1].

Thai law enforcement has arrested a 37-year-old Chinese national wanted by authorities in China for his alleged role in an international money-laundering syndicate, investigators reported via Thai media Khaosod English [1]. The illicit network is accused of facilitating more than 500 million yuan ($75 million) in transactions through cryptocurrency and foreign-currency channels [1].

According to police findings, the suspect allegedly operated digital asset and foreign-exchange transactions on behalf of criminal enterprises using more than 133 distinct accounts [1]. Investigators further alleged that the individual facilitated visa arrangements for operatives linked to broader cross-border money-laundering networks [1].

Evading Detection in Bangkok

The suspect allegedly attempted to avoid capture by presenting falsified residential paperwork and swapping registration plates across vehicles before law enforcement located him at a luxury property in Bangkok [1]. Investigators noted that his Thai visa lapsed more than three years prior to his detention [1]. The suspect faces local legal proceedings for the residency violations prior to Thai authorities coordinating his extradition to China to address the pending arrest warrant [1].

The apprehension reflects continuing enforcement crackdowns across Southeast Asia on cybercrime and illicit crypto flows [1]. Earlier initiatives in the region, such as operations by the US Department of Justice Scam Center Strike Force and the Royal Thai Police Anti-Cyber Scam Center, have similarly targeted hosting infrastructure and seized millions in digital assets connected to fraudulent syndicates [1].

Sources

Chinese suspect in $75M international crime network arrested in Bangkok — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.

Hacken Reports $1.18 Billion Lost to Crypto Exploits in Q3 2026

Basis Desk — Sun, 18 Oct 2026 23:26:06 +0000

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

Total losses climbed 55% from the prior quarter across 107 security incidents, driven by a surge in smart contract attacks.

Key points

Crypto exploits resulted in $1.18B stolen across 107 incidents in Q3 2026, a 55% increase over Q2.
Smart contract exploits drove 48% of all losses, up from 12% in Q2, while access control failures accounted for 40%.
Regulators issued $450,000 in fines to CASPs worldwide and increasingly targeted senior executives with personal liability.

Digital asset breaches cost protocols and users $1.18 billion between July and September 2026, marking a 55% surge compared to the second quarter, according to a security and compliance report published by Hacken on Oct. 15 [1]. The cybersecurity firm cataloged 107 distinct security incidents during the three-month period [1].

Smart contract flaws accounted for 48% of total value stolen, up sharply from 12% in the previous quarter [1]. Meanwhile, operational breakdowns and access control compromises dropped to 40% of quarterly losses, down from 88% in the second quarter [1]. Despite the percentage shift, Hacken noted that the largest individual losses stemmed from private key compromises, infrastructure failures in withdrawal and signer systems, and software supply chain attacks [1].

Supervisory Pressures Mount

The report highlighted recurring vulnerability patterns reappearing across separate codebases and languages, while several high-profile exploits materialized shortly after public security patches were released [1]. Hacken also observed shifts in regulatory enforcement, noting that global regulators have begun scrutinizing operational resilience on an ongoing basis rather than relying on point-in-time security audits [1]. Global supervisors levied $450,000 in penalties against crypto-asset service providers during the quarter, with authorities increasingly directing personal liability toward founders and executive management following security failures [1].

Sources

Hacken Q3 2026 Security and Compliance Report — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.