Crypto Tech News

GitHub is investigating unauthorized access to its internal repositories. The company stated there is currently no evidence indicating that customer data or external repositories were compromised by the breach.

Minnesota is the first state to officially ban prediction markets, passing a law that makes it a felony for platforms like Kalshi and Polymarket to operate within its borders. Although dozens of states have previously taken legal action against the controversial industry, this marks the first comprehensive legislative ban on event contracts in the United States.

A compromised npm maintainer account recently published over 600 malicious versions across more than 300 popular packages in an attack dubbed Mini Shai-Hulud. This widespread supply chain incident impacts over 15 million monthly downloads by injecting malicious code into widely used libraries like size-sensor and timeago.js. Developers are advised to immediately audit their dependencies and ensure they are running secure versions.

Iran has launched an insurance service backed by Bitcoin for shipping companies seeking to transit the Strait of Hormuz. The semi-official Fars news agency reported the initiative, citing documents from the country's Ministry of Economy and Financial Affairs.

A graduate student has developed a powerful new cryptographic tool by harnessing the complexity of mathematical proofs. This approach utilizes highly advanced and unknowable math to create a robust new method for securely hiding digital secrets. The innovation represents a significant advancement in modern data encryption technologies.

This guide details practical SQL query patterns used to detect transaction fraud, sharing exact queries to identify red flags like rapid transaction velocity and impossible geographical distances. It also highlights the use of advanced window functions to analyze merchant clusters and track unusual off-hours buying behavior.

Readers reminisce about bypassing early shareware DRM and payment enforcement in classic games like Scorched Earth and Escape Velocity by editing game files or altering system clocks. The discussion highlights the forgiving attitudes of early software creators toward piracy and local cheating. Additionally, the thread mourns the passing of Escape Velocity co-creator Peter Cartwright, noting that his Kickstarter to remaster the game was successfully funded after his death.

Education technology company Instructure paid a ransom to hackers after its Canvas learning management system was breached twice. In exchange, the cybercriminals returned the compromised personal data of 275 million users across more than 8,800 institutions. Instructure assured its users that no customers will face further extortion from this incident.

A sophisticated supply-chain attack compromised 42 TanStack packages on the npm registry after an attacker exploited GitHub Actions vulnerabilities to publish 84 malicious versions. The breach chained a pull request exploit with cache poisoning and OIDC token extraction, prompting developers to review the official postmortem and audit their dependencies.

Google's threat intelligence group reported that criminal hackers likely used an AI model to discover and weaponize a major software vulnerability, citing the exploit script's textbook formatting and hallucinated details as evidence. However, readers note that while these markers strongly indicate the code was generated by an AI, they do not definitively prove the model was used to find the underlying bug.

A sophisticated cyber campaign is exploiting a malicious Obsidian note-taking app plugin to deploy a new remote access trojan named PHANTOMPULSE. The malware is specifically targeting victims operating within the finance and cryptocurrency sectors.

Following a massive ransomware attack that compromised 44,000 web hosting servers through an authentication bypass, cPanel has issued critical emergency security updates. The latest patch addresses the initial exploit alongside three additional newly discovered vulnerabilities in the platform. Administrators are urged to apply these updates immediately to secure their cPanel and WHM environments.

Brazil's central bank-backed instant payment platform, Pix, is rapidly capturing market share and disrupting the traditional financial landscape. This massive consumer shift is placing significant competitive pressure on global credit card giants Visa and Mastercard. As a result, these legacy networks must adapt their strategies and innovate to defend their dominance in the Brazilian market.

A recent report highlights how insider traders are continuously exploiting the oil futures market to generate massive profits at the direct expense of everyday consumers. These ongoing manipulative practices undermine market integrity and inflict severe financial harm, prompting urgent calls for stricter regulatory oversight to protect retail investors.

Coinbase is reducing its workforce by approximately 14% to streamline operations and better position the business for the future. The decision was communicated to employees via an internal email that outlines the reasons for the cuts and the support available for affected staff.

Unlike Bitcoin's fixed hash model, Monero utilizes a unique proof of work algorithm called RandomX that requires executing random, CPU-friendly programs over a large memory dataset. This distinct approach allows the network's mining process to behave fundamentally differently from ASIC-first systems.

The anti-tamper DRM software Denuvo has now been successfully cracked across all single-player games it previously secured. This milestone represents a major, albeit temporary, victory for the cracking community and has sparked widespread celebration among piracy enthusiasts. Game developers may now need to explore alternative digital rights management strategies to protect future releases.

A fraudulent scheme targeting Chinese nationals has led to the closure of numerous care homes and hotels across Japan after scammers sold Japanese Business Manager visas disguised as real estate investments. Fraudsters purchased cheap, abandoned rural properties at rock-bottom prices and resold them at massive markups, but the collapse of the operation has left foreign investors with worthless buildings and no visas.

Researchers have developed a more efficient implementation of Shor's algorithm, significantly reducing the quantum resources needed for integer factorization. This optimization marks a major milestone in quantum computing by making the process faster and less resource-intensive. Ultimately, this advancement brings the threat to current cryptographic systems one step closer to practical reality.

Three men in Toronto are facing charges for using a Stingray-like cell tower simulator to send spam and phishing text messages. Although authorities claim the criminal device is unprecedented in Canada, critics point out that law enforcement regularly uses similar surveillance technology. The suspects reportedly allowed emergency calls to bypass their fake network to avoid immediate detection by government scanners.

GnuPG version 2.5.19 introduces the Kyber post-quantum encryption algorithm and SHA256 key fingerprints to secure communications against future quantum computing threats. The transition to quantum-safe encryption is being compared to Y2K, with the underlying migration requiring significant effort despite remaining largely seamless for average users. This update is considered critical to mitigate the risk of previously intercepted encrypted data being compromised once quantum decryption becomes viable.

Security experts confirm that quantum computers do not pose a threat to current 128-bit symmetric encryption keys. This consensus is based on the specific scaling details of Grover's algorithm. Consequently, organizations do not need to increase their symmetric key sizes during the transition to post-quantum cryptography.

Spotify and several major record labels have secured a $322 million default judgment against the piracy site Anna's Archive. The case concluded without a fight because the operators of the shadow library remain unknown and did not respond to the lawsuit.

A malicious actor recently purchased 30 WordPress plugins and embedded backdoors into all of them, escalating a growing trend of supply chain attacks. This follows a similar incident involving the Widget Logic plugin, where a new owner compromised a trusted name to distribute malicious code. The coordinated compromise highlights the ongoing security risks associated with third-party plugin acquisitions in the WordPress ecosystem.

A new Polymarket bot named Nothing Ever Happens automatically purchases No shares on all non-sports prediction markets. Created by developer Sterling Crispin, the automated tool is designed purely for entertainment and functions primarily as a meme.

A newly compiled archive details a staggering timeline of major cybersecurity breaches that have largely flown under the radar this year. By documenting these underreported hacks, the collection sheds light on the escalating and often overlooked digital threats facing modern organizations.