News Center
Global Payments Weekly | 2026 W45
USDCHong Kong tokenized depositsCircleNigeria regulation
Apple's iOS 27.2.1 Update Leaves Crypto Wallet Security Flaw Unpatched
Apple's iOS 27.2.1 security update patched nine vulnerabilities, but researcher forcequitOS points out that the worse_query flaw remains unfixed. The bug allows malicious apps to bypass iOS sandbox restrictions and access private keys and seed phrases stored by crypto wallets. Binance has warned users to remove untrusted apps, update their devices, and move funds to a new wallet if they suspect credentials have been compromised. Apple's official security notes make no mention of the flaw, and the first beta of iOS 27.3 does not fix it either.
2026-11-11
After Bithumb, Hackers Target South Korea's Financial Security Agency
South Korea's Financial Security Institute (FSI) has been hit by a cyberattack that exposed around 300 personal records, mostly belonging to employees of financial institutions, along with documents from over 40 financial firms. The attackers impersonated Financial Supervisory Service (FSS) officials, exploited a temporary access page meant for when SMS authentication was unavailable to bypass verification, and used more than 100 IP addresses to evade detection. The FSI detected the intrusion on November 9 and shut down the affected systems, and regulators and police have launched an investigation. The incident follows a separate breach reported by crypto exchange Bithumb in October, and in November GOPAX also suspended trading and withdrawals over hacker threats.
2026-11-11
Crypto Debit Cards Expose Risks of Shared Payment Providers
This article examines the risks crypto debit cards face from relying on shared payment infrastructure. A Rain contract exploit stole about $1.1 million in stablecoin collateral used for card spending, though users' personal wallets and private keys were unaffected. MNEE App CEO Ron Tarter notes that brands depending on banking-as-a-service platforms have limited control over upstream parties like sponsor banks and processors, and sponsor banks can terminate programs at any time. The article also cites Kulipa's insolvency affecting roughly twenty wallet and fintech companies, and a $1.5 million loss from an attack on Gnosis Card's security system. It recommends that companies establish direct banking relationships and ensure customer records remain independently accessible.
SOLshared payment infrastructurestablecoin collateralbanking-as-a-service2026-11-10
Ledger CTO Warns Against Storing Crypto on iPhone
Ledger CTO Charles Guillemet is warning crypto holders not to store recovery phrases or other critical wallet data on iPhones. The warning follows a Binance security alert about an iOS vulnerability called worse_query affecting iOS 26.7.1, 27.0.1, and 27.2, which could let malicious apps access other apps' files and expose wallet recovery phrases, private keys, and login credentials. Binance advises removing untrusted apps, updating the system, and moving funds to a new wallet on a clean device. The article also mentions a Ledger hardware wallet tampering incident reported a month earlier.
2026-11-10
NEAR AI Patches SGLang Security Flaw, Restores Cloud Service
NEAR AI suffered a security incident on November 8 after attackers exploited a remote code execution vulnerability in the open-source SGLang inference engine on its servers to breach internal systems. The incident exposed account information—including emails, names, subscription plans, and balances—for roughly 100 users, while chat histories, settings, and logs from 18 legacy AI agents were accessed. Cloud API keys for two customers were also exposed through logs, and the company has since revoked the affected credentials. NEAR AI has patched the flaw, rotated compromised credentials, and completed a forensic review, with Cloud service now restored. The company stressed that the NEAR blockchain protocol and other services were unaffected and that the incident is unrelated to the Binance hack.
NEARremote code executionSGLang vulnerabilityAPI key exposure2026-11-10
Sahil Leaks Celebrity Memecoin Chats and $10,000 Claims
On November 7, Sahil Arora released private chat logs allegedly tied to celebrity memecoin promotions, accusing several influencers of taking paid endorsements. Screenshots show talks with Bark about promoting the JENNER token, arranging X Spaces, and courting celebrity account engagement; he also claims Mario Nawfal charged $10,000 for a single tweet, and another group chat involves a roughly $10,000 shoot meeting with Caitlyn Jenner's team. The disclosures have reignited scrutiny of promotional practices during 2024's celebrity memecoin boom.
2026-11-07
Gnosis Pay Discloses Data Breach Ahead of December Shutdown
Gnosis Pay disclosed a customer data breach on November 6 affecting legacy systems behind its branded payment cards. The company said it detected unauthorized access on November 3, contained it within two hours, and that funds were not affected. Affected customers were notified by email, and the corporate platform was unaffected. Before the consumer business closes on December 20, 3D Secure verification will be mandatory for all online card payments, with enhanced monitoring of card activity and wallets. Some users have questioned the company's response and worry about phishing risks following the exposure of personal information.
2026-11-06
How Polygon Plans to Return 70 Million Stolen POL to Recovery Wallets
Polygon has proposed an improvement proposal to transfer approximately 70.49 million POL from five blocked addresses to designated recovery wallets via a coordinated hard fork at a specific block, with 46.63 million tied to the Binance incident and 23.86 million to the Polymarket incident. Block producers had already restricted outbound transfers from these addresses, though balances remained intact. Tether separately froze USDT that was moved alongside the stolen POL from Binance. The article notes that getting tokens into recovery wallets is only the first step—whether customers receive compensation depends on each platform's claims process and how prior payouts are handled.
POLstolen fundsPolymarkethard fork2026-11-06
Chainalysis confirms user credentials exposed in cyberattack, takes services offline
Blockchain analytics firm Chainalysis has confirmed a cyberattack in which all users' names, usernames, password hashes, and active tokens were exposed to malicious actors. The company has taken investigation and transaction monitoring services including KYT, Reactor, and Data Solutions offline, and found that some customer accounts may have been accessed without authorization. The attack involved an "on-path attack" intercepting customer passwords; the company says the attack method has been contained and remediated, and will require customers to reset passwords and rotate API keys. Chainalysis says there is no evidence so far that investigation data was accessed or blockchain attribution data was manipulated.
2026-11-06
OpenAI Found 948 Linux Security Flaws—And Figured Out How to Exploit Them
OpenAI announced that its autonomous security agent uncovered 948 distinct local privilege escalation vulnerabilities in the Linux kernel, developed working exploits, and generated candidate patches. The research scanned roughly 2.8 million lines of kernel code at a cost of about $1.21 million in API credits—around $1,279 per vulnerability. The new model found more than five times as many flaws as earlier versions and used at least 10 exploitation techniques unfamiliar to researchers. The article discusses the growing capabilities and potential risks of AI in cybersecurity research.
2026-11-05