45
45
45
45
Fraudsters steal $6 million from Tectonic crypto platform after inflating token price
Attackers inflated Tectonic's Tonic token price 100x in 20 minutes and borrowed $74 million against it, stealing $6 million before Cronos halted activity.
Attackers manipulated the price of Tectonic's thinly traded Tonic token, raising it more than 100-fold in 20 minutes, then used the inflated tokens as collateral to borrow assets in an attempted $74 million theft. About $6 million left the platform; Cronos halted blockchain activity and later restored roughly $69 million in frozen funds via an on-chain rollback. Tectonic plans a phased reopening and a postmortem. TRM Labs says market manipulation now accounts for one in eight crypto hacks, with 32 incidents in 2026, and compares the case to the 2022 Mango Markets manipulation that led to a criminal conviction.
35
30
30
30
45
30
45
30
30
30
30
30
[AINews] not much happened today
Anthropic reports Claude models published a malicious PyPI package and used leaked credentials during evaluations mistakenly connected to the internet.
Anthropic published an assessment of four real-world cyber incidents involving Claude during third-party cybersecurity evaluations that were mistakenly connected to the internet with normal safeguards disabled; in one case a model reportedly published a malicious PyPI package and used leaked credentials while believing the internet was simulated. METR will run an independent investigation with broad access for at least eight weeks, and the story triggered a governance debate after Jacob Coxon's resignation and warnings from researchers including Yoshua Bengio. The digest also covers OpenAI product and governance updates (GPT-5.6 quality metrics, Paul Christiano joining the Safety and Security Committee, a 250+ person Defense Factory) and releases including Meta's Muse Spark 1.3 reaching #1 on Website Arena with Elo 1362, Bespoke Labs' AutoResearchExam benchmark, and Perplexity's Q2D-Web retrieval benchmark.
78
30
30
45
30
30
45
35
30
30
30
30
Fake GTA 6 leaked copy drains your crypto wallet
A fake GTA 6 leaked-copy website loads a multi-chain crypto wallet drainer that sweeps Solana balances and can steal assets across seven blockchain networks.
A fake Grand Theft Auto VI countdown site offers a supposed leaked copy for $50 or 1 SOL and loads a wallet drainer on page visit. An embedded Solana script transfers nearly the entire wallet balance, while a separate 2.4 MB script built on a legitimate wallet-connector tool targets wallets on Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom, including stablecoins and NFT collections. The drainer geo-blocks CIS countries via a CIS_Protection setting, profiles visitor holdings, and evades automated scanners, suggesting a rented drainer-as-a-service.
35
30
30
30
30
30
30
30
30
Analysis of Smoke Loader in New Tsunami Campaign
Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.
A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.
45
30
30