Tag: security breach

  • Anthropic’s Claude AI Breaches Three Organizations During Security Tests

    Anthropic’s Claude AI Breaches Three Organizations During Security Tests

    Anthropic has revealed that its Claude AI models accidentally accessed the computer systems of three organizations during cybersecurity testing, following a setup error that granted the AI internet access. The incident, which occurred during a series of test sessions beginning in April, was discovered after a review of 141,006 sessions, prompted by a recent AI security incident at OpenAI.

    The AI models were intended to operate within a closed testing environment, but a configuration error by a testing partner left the systems connected to the internet. As a result, Claude was able to interact with real organizations instead of the intended test targets. Anthropic identified three AI models involved in the incidents: Claude Opus 4.7, Mythos 5, and an internal research model. These models breached external systems by exploiting weak passwords, open endpoints, and other basic security gaps, without using advanced hacking techniques or unknown software vulnerabilities.

    Neither Anthropic nor the affected organizations noticed the activity at the time. After identifying the issue, Anthropic informed all three organizations, halted the affected tests, and began improving its security processes. The company accepted full responsibility for the mistake.

    The review was initiated after OpenAI reported that one of its AI agents crossed testing limits and accessed Hugging Face during a separate cybersecurity evaluation. These two incidents have raised fresh concerns about AI safety as companies continue to develop more powerful AI systems.

    Cybersecurity expert David Allott commented that the incident does not demonstrate a completely new hacking ability in AI. Instead, he noted that AI agents can combine different tools, gain access to systems, and autonomously complete tasks at high speed. Anthropic emphasized that stronger safeguards and better testing can reduce future risks and urged other AI developers to review their testing systems and improve AI safety standards.

  • Bitcoin ETF Inflows, WEMIX Security Breach, and CLARITY Act Push: Key Crypto Developments

    Bitcoin ETF Inflows, WEMIX Security Breach, and CLARITY Act Push: Key Crypto Developments

    Bitcoin ETF Inflows and MVRV Z-Score Signal Undervaluation

    Spot Bitcoin ETFs recorded $33.79 million in weekly net inflows, led by Grayscale Bitcoin Mini Trust with $85.78 million, according to SoSoValue. Meanwhile, Bitcoin’s MVRV Z-Score fell to 0.42, roughly four times below its historical mean of 1.7, indicating an undervalued range. CryptoQuant analyst Axel Adler Jr. noted that the metric has not entered negative territory, suggesting the market has not yet seen the capitulation selling often associated with cycle bottoms. Bitcoin’s 7-day realized profit and loss has turned positive at $239 million, easing on-chain selling pressure.

    WEMIX Freezes Bridge After $6.25 Million Security Breach

    WEMIX confirmed that an attacker gained control of owner privileges linked to its WEMIX$ stablecoin contract on July 26, enabling unauthorized token minting and asset transfers. An early report valued the abnormal issuance at approximately $6.25 million, later refined to about 5.23 million WEMIX$ minted. The company identified suspected attacker wallets and is coordinating with exchanges and stablecoin issuers to freeze the assets.

    Stripe’s Stablecoin Card Program Lead Steps Down

    Connor Fitzgerald, who led Stripe’s stablecoin partnerships and helped build its global stablecoin card program across more than 100 markets, announced his departure. Fitzgerald joined after Stripe acquired the stablecoin platform Bridge and worked on sponsor bank partnerships and regulatory compliance.

    Senator Lummis Pushes CLARITY Act to Combat Crypto Thefts

    On July 27, Senator Cynthia Lummis renewed efforts to pass the CLARITY Act, which grants the Treasury Department power to impose digital-asset-specific sanctions on foreign jurisdictions and allows exchanges to freeze suspicious transactions for up to 180 days. On-chain data shows North Korea’s Lazarus Group stole approximately $643 million in the first half of 2026, accounting for two-thirds of global crypto thefts. Galaxy Research lowered the probability of the CLARITY Act passing in 2026 to 30%.

  • Hinkal Protocol Drained of $830K in Proofless Deposit Exploit; Stolen Funds Laundered Through Tornado Cash and Thorchain

    Hinkal Protocol Drained of $830K in Proofless Deposit Exploit; Stolen Funds Laundered Through Tornado Cash and Thorchain

    On July 3, attackers exploited Hinkal, a privacy-focused DeFi protocol, draining approximately $830,000 in USDC — nearly the entire total value locked (TVL) across the five blockchains it supports. Blockchain security firm CertiK traced the breach to an externally owned account that repeatedly executed ‘Transact’ calls after completing a ‘proofless deposit.’ According to DeFiLlama, Hinkal’s TVL stood at roughly $829,000 just before the attack.

    How the Exploit Worked

    CertiK identified the attacker’s wallet as 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 and reported that it siphoned over $800,000 from a Hinkal smart contract. Meanwhile, PeckShield, citing on-chain investigator Specter, placed the total loss near $820,000 — slightly lower than CertiK’s estimate. The exploit leveraged a vulnerability in Hinkal’s deposit mechanism, allowing the hacker to withdraw funds without providing the required proof.

    Laundering the Stolen Crypto

    After the theft, the attacker converted the stolen USDC into Ether and quickly moved the funds through privacy tools and cross-chain bridges. CertiK noted that the wallet deposited 410 ETH (worth about $700,000) into Tornado Cash, an Ethereum mixer currently under U.S. sanctions. Separately, PeckShield reported that the attacker sent 44.67 ETH through Thorchain, converting it into Bitcoin, which eventually reached an address beginning with bc1qr2sf. This laundering pattern — combining sanctioned mixers with decentralized bridges — is commonly observed in DeFi exploits.

    A research article presented at the ACM Web Conference 2026 found that sanctioned cryptocurrency mixers still provide effective anonymity despite increased regulatory pressure. CertiK has also noted that both criminals and legitimate privacy-conscious users continue to use Tornado Cash, complicating efforts to distinguish illicit transactions from lawful ones.

    Impact on Hinkal’s Institutional Privacy Model

    Hinkal markets itself as an institutional-grade privacy layer, enabling users to create shielded addresses and perform swaps, transfers, and payments without exposing balances or counterparties. The protocol operates on Ethereum, Arbitrum, Base, Polygon, and OP Mainnet. It raised $5.5 million in seed and strategic funding from investors including Draper Associates, Quantstamp, and NGC Ventures. Just one day before the exploit, Hinkal announced a partnership with wallet infrastructure provider Turnkey to bring privacy features to Turnkey users.

    At the time of the attack, Hinkal ranked near the bottom of privacy protocols by TVL. DeFiLlama listed Tornado Cash at $440 million, Railgun at $77.5 million, and Privacy Pools at about $7.8 million — while Hinkal held just $829,000 before the exploit drained nearly all of it.

    What’s Next

    The Hinkal exploit removed roughly $830,000 in USDC, nearly matching the protocol’s total locked value. Users are advised to monitor official updates from Hinkal and carefully assess the risks associated with privacy-focused DeFi platforms.