$70M Bitcoin Gone in 41 Minutes — And Your TV Might Be Spying Too
Sunday, August 2, 2026 · 5-minute read
Microsoft researchers uncovered a campaign — dubbed CaptiveCrunch — where Russian intelligence-linked hackers compromised hotel Wi-Fi networks to push fake browser update alerts to guests' laptops. Victims who clicked installed CornFlake, a piece of malware that records webcam footage, microphone audio, and keystrokes. The operation is tied to APT29 / Cozy Bear, the same group behind major breaches at the US government and SolarWinds.
↗ The Hacker NewsA suspected Chinese-speaking hacking group has been quietly breaking into government offices, health agencies, and law enforcement bodies across Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria since January 2025. The attackers use two newly discovered backdoors called OctLurk and SilkLurk, which can download extra tools and run commands on infected systems. Researchers at Kaspersky say the group doesn't match any known actor they track.
↗ The Hacker NewsThe US government's cybersecurity agency CISA is warning that hackers are increasingly going after the computers that control water and wastewater facilities. The targets are internet-exposed programmable logic controllers (PLCs) — the devices that physically operate pumps, valves, and treatment systems. A successful attack on these systems could disrupt the water supply for entire communities.
↗ CISAAdvertising technology company Adform had a malicious script quietly inserted into its code on July 27. That script ran inside the browsers of anyone visiting a site that used Adform's ad platform — and it watched for cryptocurrency wallet addresses. The moment you copied a Bitcoin, Ethereum, or Tron address — or even typed one into a form — the script replaced it with an address controlled by the attacker. You'd send money thinking it went to the right place, but it didn't. Adform removed the bad code the same day and notified affected clients, but warns the script may still be sitting in browser caches.
Amazon has linked a set of supply-chain attacks on the npm software registry ��� specifically packages named "Debug" and "Chalk" — to North Korean government hackers. Developers who installed these packages unknowingly ran malicious code on their systems. npm is one of the most widely used code repositories in the world, making it a high-value target for groups that want to compromise many software projects at once.
This is as bad as it gets — a perfect 10.0 score. A flaw in Adobe's enterprise email marketing platform Adobe Campaign Classic lets an attacker run any code they want on an affected server without needing a password, a login, or any help from a user. It's caused by an authorization check that simply doesn't work correctly. A second flaw (CVE-2026-48448, score 8.6) in the same software allows an attacker to read files off the server using SQL injection.
Status: Patch available — Adobe Campaign Classic v7 build 9398 fixes both. Adobe says neither flaw is being actively exploited yet, but that could change fast.
Broadcom patched three critical flaws in VMware's suite of virtualization products. The worst let attackers bypass authentication entirely — no password required — or "escape" from a virtual machine to take control of the underlying physical host. These are especially dangerous in corporate data centers where dozens of virtual machines share a single server.
Status: Patches released by Broadcom. If your organization runs VMware infrastructure, this is an urgent update.
JetBrains warned of a critical authentication bypass in TeamCity, the software many development teams use to automatically build and test code. An attacker who finds an exposed TeamCity server could log in without credentials and potentially run code on it — a serious risk since these servers often have broad access to a company's software development pipeline.
Status: Patch available. JetBrains urges all on-premises users to update immediately and avoid exposing TeamCity to the public internet.
Google revealed that AI tools helped its engineers find and fix more than 1,072 security vulnerabilities in the Chrome browser. Rather than replacing human researchers, the AI acts like a tireless assistant — scanning enormous amounts of code for patterns that look like bugs, flagging them for human review. This is notable because finding security flaws in complex software like a web browser is extremely time-consuming work, and AI is beginning to do it at a scale that wasn't possible before. It's an early sign that AI-assisted vulnerability research could meaningfully raise the baseline security of widely used software.
↗ BleepingComputerLG Electronics announced it will suspend any smart TV apps that include residential proxy SDKs — code that quietly turns your television into a relay point for other people's internet traffic. Research by security firm Spur found over 42% of LG's webOS app store contained such code. LG's move comes after public pressure and gives app developers a deadline to remove the offending code or face removal from the platform. If you own an LG smart TV, this is a good reminder to periodically review what apps you have installed.
↗ Krebs on SecurityOn July 30, someone drained 1,082 Bitcoin — worth about $70.2 million — from 1,196 different wallet addresses in just 41 minutes. It wasn't a heist with guns or a phishing email. The attacker simply did the math.
The root cause goes back to a firmware update in March 2021 for the Coldcard hardware wallet, a popular device made by Canadian company Coinkite that stores Bitcoin offline. When you set up a hardware wallet, it needs to generate a random seed phrase. That randomness is everything: if anyone can guess your seed, they own your Bitcoin. Coldcard is supposed to generate this seed using a dedicated hardware random number generator (RNG) built into its chip. But the 2021 firmware accidentally routed that process to a software-based pseudorandom number generator (PRNG) instead. A software PRNG is predictable if you know its starting conditions.
Here's the problem: the starting conditions for Coldcard's PRNG weren't secret. Researchers at Galaxy Research found that an attacker who could figure out a device's unique ID, the state of its internal timer, and a few other data points could reconstruct candidate seed phrases offline — without ever touching the device. They could then check those candidate seeds against the public Bitcoin blockchain to see which ones held real funds. No hacking required. Just computing power and publicly available data.
Coinkite shipped emergency firmware on July 31 — the day after the theft — for all affected models. But here's the critical point: updating the firmware does not fix wallets that already exist. If your Coldcard was set up between March 2021 and whenever the fix was applied, your current seed may be compromised. Coinkite is telling affected owners to generate a brand-new seed on a patched device and move their funds to a fresh wallet immediately. If you or anyone you know uses a Coldcard hardware wallet, this is the most important thing to act on this weekend.