signature

According to Onchain Lens monitoring, less than an hour ago, a certain whale withdrew 28,000 HYPE from HTX, worth approximately 2.57 million dollars, and transferred it to a multi-signature wallet.

Cosmos Labs disclosed that on September 22, Neutron encountered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. The Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out, Hub validators temporarily paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address. When the network was restored, these were transferred to a 4/6 multi-signature address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu through a one-time change. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. The current multi-signature address holds approximately 1.227 million ATOM, which can only be returned after authorization from a Cosmos Hub governance proposal. The related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.

Binance Wallet announced the launch of real-time detection and risk interception features for high-risk signature scenarios to prevent phishing attacks that exploit the authorization mechanisms of DeFi projects.Binance stated that some attacks only require inducing users to complete offline signatures that do not require gas fees, which could lead to asset theft. In the future, it will continue to expand the scope of risk identification scenarios and security protection coverage.

According to on-chain analyst Ai Yi's monitoring, the multi-signature associated address of WLD (Worldcoin) has deposited 42.37 million WLD to Binance in the past 8 hours, worth approximately 19.59 million USD.This is the first time this address has deposited to the exchange in 5 months, and after this deposit, the address has fully liquidated its holdings.

Coinbase Chief Cryptographer Yehuda Lindell stated on the MARA Foundation TV program that the exchange is designing a custody system capable of adapting to any post-quantum signature scheme that Bitcoin may adopt in the future. It is currently unclear which post-quantum signature scheme Bitcoin will use in practical applications. Lindell believes it is unlikely that a single signature scheme will be universally adopted, so preparations must be made for different outcomes across various blockchains.Coinbase is custodian for approximately $250 billion in assets for institutions such as BlackRock. Traditional Multi-Party Computation (MPC) relies on key sharding, but many post-quantum signature schemes may be "not friendly to MPC"; for example, hash-based signatures lack the arithmetic structure required for traditional cryptographic key splitting. Although cryptographers like Dan Boneh are researching relevant solutions, this research is still in a highly experimental phase, and it remains uncertain whether a viable MPC-like solution for hash signatures can be developed.To this end, Coinbase is exploring a backup architecture centered around programmable Hardware Security Modules (HSM), where private keys will be encrypted with post-quantum cryptography and assembled only within physically secure HSMs. Lindell stated that while the completion timeline is uncertain, once finished, "I will be able to say, I can support any scheme," without worrying about a blockchain adopting a signature scheme that it cannot support.

Attackers exploited a signature verification bypass vulnerability in the Kasplex KRC-20 off-chain indexer to transfer 186 million ZEAL and 54.398 billion NACHO without holding the private keys of the bridge custody wallet. They executed five forged transactions to mint the tokens through the Igra Labs EVM layer and Kasplex L2, then sold them to the Zealous Swap liquidity pool. The KAS side of the affected liquidity pool experienced a value loss of 94% to 99.6%.Igra has suspended iKAS withdrawals to Kaspa L1 and Hyperlane transfers, and has warned users to avoid bridging KRC-20 tokens, buying ZEAL or NACHO on the L2 DEX, and adding liquidity to the related pools. The Kaspa L1 consensus and unbridged Igra assets were not affected. Zealous Swap stated that the operators need to fix the indexer and re-index the history, rejecting transactions with empty signatures, abnormal tags, and transactions containing scripts after OP_ENDIF.

According to on-chain analyst Yu Jin's monitoring, a multi-signature wallet of WLFI transferred 88 million WLFI (approximately 5.09 million USD) to Binance half an hour ago.In the past month, this address has gradually transferred 248 million WLFI (approximately 13.55 million USD) to Binance.

According to Blockaid monitoring, an attack was discovered on an unidentified user's Safe multi-signature wallet on Ethereum. The attacker introduced a custom Uni V4 LP Safe module into a liquidity pool they created through a public keeper multicall, and then the hook unpacked aEthrsETH into rsETH, completing the extraction of Yoink MEV within the block. Currently, two transactions have been confirmed to cause approximately 7.73 million dollars in rsETH losses.

Vitalik posted on the X platform, expressing the hope to include the recursive STARK memory pool proposal EIP-8288 in the Ethereum I-star upgrade, stating that it can be seen as the next step after Frames.This proposal allows quantum-safe signature data to be placed off-chain, reducing the cost of signatures; the fuel cost for quantum-safe privacy transactions is also expected to drop from about 10 million to tens of thousands. The proposal relies on frames and recursive STARK aggregated transaction dependencies, with nodes sending a STARK of about 100 to 300KB each time period; the on-chain overhead is one STARK and 96 bytes for each statement to be proven.

The Ethereum Foundation stated on the X platform that the Trezor hardware wallet now supports the "Clear Signing" feature through the ERC-7730 standard, making transactions more readable and understandable on the hardware device.This progress is the result of the Clear Signing working group promoted under the foundation's "Trillion Dollar Security Initiative," aimed at reducing the risk of users suffering asset losses due to "blind signing" of unclear transactions and encouraging more wallets and decentralized applications to participate.

Vitalik recently updated EIP-8141 "Frame Transaction" proposal, with core improvements including atomic batch execution of up to 64 operations, social recovery (similar to Google account recovery, without the need for a mnemonic phrase), P256 quantum-resistant signatures, and the ability for anyone to pay gas fees for users, significantly enhancing the usability of Ethereum wallets.It is reported that the improvement proposal was co-authored by Vitalik, lightclient, and 10 other experts, and is planned to be included in the 2027 Hegotá upgrade, marking a significant native implementation of Ethereum account abstraction.

Yesterday, Ledger disclosed details of the LSB 023 security vulnerability on its official website. Some applications built on the Ledger Secure SDK may still receive new APDU commands during the user screen confirmation, leading to inconsistencies between the parameters displayed on the screen and the final signature parameters.In cases where the attacker controls the APDU communication between the device and the host, after the user confirms the operation shown on the screen, the device may generate a signature with different parameters. Ledger stated that it has fixed the issue through application-level checks and the SDK layer, and released Ledger Secure SDK v26.6.1 on August 21. The relevant applications have been rebuilt and released. Users need to update the applications through Ledger Live; merely updating the device firmware is insufficient to complete the fix. However, Ledger claims there is currently no evidence that the vulnerability has been exploited.

Blockstream has released a Bitcoin Improvement Proposal (BIP) proposing the SHRINCS post-quantum signature scheme. SHRINCS is a hash-based post-quantum signature scheme with a minimum size of 548 bytes, approximately 9 times larger than the existing Schnorr signatures, but much smaller than the NIST-approved ML-DSA and SPHINCS+ schemes. The scheme has completed production environment testing on the Liquid sidechain and includes a copy of the Bitcoin white paper.The scheme also has limitations. The BIP warns that security proofs are still pending, and the scheme is stateful, requiring the storage of used keys for each signature, which increases the signature size by 16 bytes with each use. In the event of device loss, approximately 5777 bytes are needed for a stateless fallback transaction recovery. Blockstream estimates that Bitcoin can maintain a speed of about 3 TPS after adopting SHRINCS, which can be increased to 6.7 TPS when combined with ZK proof aggregation.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

According to Onchain Lens monitoring, a wallet transferred 289,760 LINK (approximately 2.74 million USD) into its Gnosis Safe multi-signature wallet. These tokens were accumulated from Binance over the past month.

According to SlowMist monitoring, the decentralized exchange Atomic protocol was attacked due to a signature replay vulnerability, resulting in a loss of approximately 29,984 USDC.The vulnerability originated from contract 0xa806010f, which lacked binding of position ID, position manager, caller, nonce, deadline, and chain ID in the signature hash, allowing the same manager's signature to be replayed on 21 different position IDs, executing unauthorized full LP destruction under flash loan price manipulation, and without TWAP or slippage checks.

Starknet announced that it has completed the quantum-resistant signature transfer test, where a wallet account using a quantum-resistant signature mechanism completed a real transfer on the Starknet mainnet, with a transaction fee of about 6 cents, and can be queried through the block explorer. This account is currently an experimental, unaudited version, mainly used for research testing. StarkWare stated that this transfer benefits from the design of the Starknet account model.Unlike most blockchains that fix the signature algorithm at the protocol layer, each account on Starknet is a smart contract that can autonomously define the accepted signature schemes, allowing users to upgrade their wallets from traditional elliptic curve signatures to quantum-resistant signatures without hard forks, asset migrations, or changing addresses. StarkWare pointed out that most blockchains face quantum computing risks because wallet signatures and underlying verification systems rely on elliptic curve cryptography. Once large-scale quantum computers appear, running Shor's algorithm could potentially break the related encryption systems. Currently, the Starknet ecosystem supports a quantum-resistant signature scheme based on Falcon-512, which is part of the NIST post-quantum cryptography standardization process, with relevant implementations promoted by ecosystem teams and organizations such as OpenZeppelin.

Bitgo CEO Mike Belshe deposited 100 BTC into a public Bitcoin address, valued at approximately $6.3 million at the time, and invited the Claude model under Anthropic to attempt to transfer the funds from that address. On-chain records show that the wallet received the funds on July 31, and the balance has not been transferred out.Anthropic previously disclosed that during 141,006 cybersecurity assessment runs, 3 incidents were found, with 6 assessment sessions involving 3 models unexpectedly interacting with real organizational systems. The relevant models include Claude Opus 4.7, Claude Mythos 5, and an unpublished internal research model, due to configuration errors by third-party testing partner Irregular that caused the testing environment to connect to the internet.Anthropic stated that Claude Opus 4.7 identified a real website sharing the same name as a simulated company during one assessment, exploited weak passwords and exposed services to recover infrastructure credentials, and accessed a production database containing hundreds of records. The company claimed that the model was attempting to complete assigned tasks and was not actively breaking restrictions or pursuing independent goals. Belshe's challenge involved the Bitgo institutional custody platform, which uses multi-signature or multi-party computation technology to distribute signing authority across multiple independent keys. Anthropic has not publicly responded to this challenge.

According to Onchain Lens monitoring, a certain whale has accumulated 266,400 LINK from Binance over the past month, worth approximately 2.15 million USD, and then transferred the entire balance to a Gnosis Safe multi-signature wallet.

According to Bitcoin News monitoring, approximately 594 BTC were transferred from 500 addresses within 25 minutes on Thursday, valued at around 38 million USD, and the funds were subsequently consolidated into another wallet. The affected holdings all used single-signature addresses, with balances ranging from about 0.15 to 0.26 BTC, and many UTXOs had been dormant for years.Early speculation focused on Coldcard, as at least one victim used the device. Coldcard CEO NVK denied the existence of a device-wide vulnerability, stating that the user may have imported a seed that had previously been leaked or compromised, and pointed out that the transfer involved keys from different wallets. Jameson Lopp noted that another victim only lost part of their UTXOs, not the entire wallet balance, which may indicate exposure of individual private keys rather than a complete seed leak.Currently, the coordinated transfer event is confirmed, but the source remains unknown, and there is no evidence to prove the existence of a Coldcard RNG flaw, supply chain vulnerability, or Bitcoin cryptographic failure.