# Cryptocurrency Cryptocurrency is decentralized digital currency secured by cryptography and operating through distributed consensus and blockchain infrastructure. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## HBO Max's verified Reddit account hijacked to spread malware DevFeed: [HBO Max's verified Reddit account hijacked to spread malware]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-15T11:51:03Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Malware](), [ClickFix](), [Reddit](), [Social engineering](), [passwords](), [Cryptocurrency](), [macOS](), [Windows]() Tags: [clickfix](), [cryptocurrency](), [hbo-max](), [macos](), [malware](), [news](), [passwords](), [pasteswitch](), [powershell](), [reddit](), [security](), [social-engineering](), [terminal](), [windows]() ### AI overview Cybercriminals hijacked HBO Max's verified Reddit account and used it to run 108 malicious ads over about 48 hours. The ads promoted fake software and used ClickFix-style instructions to distribute infostealers and cryptocurrency clipboard hijackers to macOS and Windows users. ### Source excerpt Cybercriminals used HBO Max's verified Reddit account to run 108 malicious ads that tricked people into installing information stealers. ## Search results are sending people to fake Bitrefill checkouts DevFeed: [Search results are sending people to fake Bitrefill checkouts]() Original publisher: [Read original article]() Author: Stefan Dasic Published: 2026-09-15T08:40:22Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Cryptocurrency](), [Bitcoin](), [Website]() Tags: [bitcoin](), [cryptocurrency](), [fraud](), [payments](), [phishing](), [qr-code](), [scam](), [scams](), [search](), [threat-intel]() ### AI overview Fake Bitrefill checkout pages are appearing in search results and copying the company's branding and payment flow. They persuade victims to send cryptocurrency to scammer-controlled addresses, with no goods delivered and little chance of recovering the payment. ### Source excerpt Fake Bitrefill checkout pages are appearing in search results and tricking people into sending cryptocurrency directly to scammers. ## Gitea RCE Flaw Now Under Active Exploitation, CISA Confirms DevFeed: [Gitea RCE Flaw Now Under Active Exploitation, CISA Confirms]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-08-29T06:33:49Z Content type: news Language: en Sources: [Self Host Lab]() Topics: [Gitea](), [Vulnerabilities](), [Security](), [incident](), [Cryptocurrency](), [Docker Container]() Tags: [cryptocurrency](), [docker-container](), [gitea-rce](), [hosting](), [incident](), [network-security](), [network-security-news](), [news](), [security](), [self-hosted](), [vulnerabilities]() ### AI overview CISA confirmed that the critical Gitea vulnerability CVE-2026-60004 is being actively exploited and added it to the Known Exploited Vulnerabilities catalog. The article explains the exploit through Gitea's diffpatch API, which can enable arbitrary code execution, and describes a documented compromise of an outdated self-hosted instance that led to cryptocurrency mining inside a Docker container. ### Source excerpt CISA has added CVE-2026-60004, the critical Gitea RCE flaw patched in version 1.27.1, to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Help Net Security documented a real compromise: an outdated instance with open registration hit by an automated scanner, ending in a cryptocurrency-mining payload. Here is what changed and how to patch. ## Raspberry Pi Projects That Sound Great But Are Usually a Bad Idea DevFeed: [Raspberry Pi Projects That Sound Great But Are Usually a Bad Idea]() Original publisher: [Read original article]() Author: Patrick Fromaget Published: 2026-07-18T05:00:00Z Content type: opinion Language: en Sources: [RaspberryTips]() Topics: [Hardware](), [Cryptocurrency](), [hosting](), [Linux](), [Security](), [servers](), [1Password in the browser]() Tags: [crypto](), [experiment](), [hardware](), [hosting](), [inspiration](), [linux](), [projects](), [raspberry-pi](), [security](), [self-hosting]() ### AI overview The article argues that although Raspberry Pi computers can run many projects, some are poor choices for long-term reliance because they require more reliability and maintenance than a Pi setup can provide. It presents cryptocurrency mining and self-hosting an email server as examples: both can be useful learning exercises, but Raspberry Pi hardware is generally unsuitable for profitable mining or dependable email hosting. ### Source excerpt After years of testing and writing tutorials on RaspberryTips, I can tell you one thing: you can make your Raspberry Pi do almost anything. However, just because it works doesn't mean it's a good idea. Let's talk about it. A Raspberry Pi can run many home projects, but some are poor choices for long-term use.... ## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026) DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)]() Original publisher: [Read original article]() Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub Actions](), [npm packages](), [AsyncAPI Specification](), [Malware](), [GitHub](), [Remote Access Trojan](), [passwords](), [ssh](), [Cloud](), [Cryptocurrency]() Tags: [asyncapi-supply-chain-attack](), [chainguard-asyncapi](), [chainguard-libraries](), [ci](), [cloud](), [cryptocurrency](), [github](), [github-actions](), [github-actions-pwn-request](), [malicious-packages](), [malware](), [miasma](), [npm](), [npm-packages](), [passwords](), [personal-access-token](), [provenance](), [pull-requests](), [remote-access-trojan](), [ssh](), [supply-chain](), [tokens]() ### AI overview The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials. ### Source excerpt A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design. ## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account]() Original publisher: [Read original article]() Published: 2026-06-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [Remote Access Trojan](), [Cryptocurrency](), [C2]() Tags: [c2](), [chainguard-libraries](), [chainguard-packages](), [command-and-control](), [crypto](), [malware](), [mastra](), [npm](), [npm-takeover](), [packages](), [provenance](), [remote-access](), [remote-access-trojan](), [secure-packages](), [software-packages](), [supply-chain](), [tls]() ### AI overview The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts. ### Source excerpt A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries. ## This month in security with Tony Anscombe - May 2026 edition DevFeed: [This month in security with Tony Anscombe - May 2026 edition]() Original publisher: [Read original article]() Author: Editor Published: 2026-05-29T07:30:00Z Content type: news Language: en Sources: [WeLiveSecurity]() Topics: [Cybersecurity](), [Artificial Intelligence](), [Threat Research](), [Cryptocurrency](), [Google](), [systems](), [passwords]() Tags: [ai](), [crypto](), [cryptocurrency](), [cybersecurity](), [google](), [news](), [passwords](), [security](), [systems](), [video]() ### AI overview A monthly cybersecurity roundup covering cyber-intrusions against Polish water treatment facilities, an AI-directed attack in Mexico that failed to move from IT to OT systems, an AI-developed zero-day exploit identified by Google, and cryptocurrency kiosk scams. ### Source excerpt In this roundup, Tony looks at attacks against Polish water treatment facilities, how AI-directed attacks failed in Mexico, and what Google believes is the first AI-generated zero-day exploit ## Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly DevFeed: [Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly]() Original publisher: [Read original article]() Published: 2026-03-31T02:03:00Z Content type: article Language: en Sources: [The latest research from Google]() Topics: [Cryptocurrency](), [Vulnerabilities](), [Post-quantum cryptography](), [Quantum Computing](), [Cryptography](), [Zero-knowledge proof](), [Google]() Tags: [algorithms-theory](), [awareness](), [coinbase](), [cryptocurrency](), [cryptography](), [ethereum](), [google](), [government](), [migration](), [post-quantum](), [quantum](), [quantum-computing](), [research](), [security-privacy-and-abuse-prevention](), [vulnerabilities](), [zero-knowledge]() ### AI overview Google Research describes how future quantum computers could break the elliptic-curve cryptography protecting cryptocurrency with fewer resources than previously estimated. The article recommends transitioning blockchains to post-quantum cryptography and presents zero-knowledge proofs as a way to disclose vulnerabilities responsibly. ### Source excerpt Algorithms & Theory ## SourceHut author describes the operational cost of aggressive LLM crawlers DevFeed: [SourceHut author describes the operational cost of aggressive LLM crawlers]() Original publisher: [Read original article]() Author: March Published: 2025-03-17T00:00:00Z Content type: opinion Language: en Sources: [Drew DeVault]() Topics: [Large Language Model](), [Crawler](), [Git](), [Go Language](), [ci](), [Cryptocurrency](), [HTTP]() Tags: [agents](), [ci](), [cryptocurrency](), [git](), [go](), [http](), [llms](), [robots]() ### AI overview A personal opinion post describes SourceHut's experience mitigating aggressive LLM crawlers that ignore robots.txt, crawl expensive Git endpoints, distribute requests across many IP addresses, and contribute to recurring outages. It also compares this burden with earlier CI cryptocurrency-mining abuse and Go module mirror traffic. ### Source excerpt This blog post is expressing personal experiences and opinions and doesn't reflect any official policies of SourceHut. Over the past few months, instead of working on our priorities at SourceHut, I have spent anywhere from 20-100% of my time in any given week mitigating hyper-aggressive LLM crawlers at scale. This isn't the first time SourceHut has been at the wrong end of some malicious bullshit or paid someone else's externalized costs - every couple of years someone invents a new way of ruining my day. Four years ago, we decided to require payment to use our CI services because it was being abused to mine cryptocurrency. We alternated between periods of designing and deploying tools to curb this abuse and periods of near-complete outage when they adapted to our mitigations and saturated all of our compute with miners seeking a profit. It was bad enough having to beg my friends and family to avoid "investing" in the scam without having the scam break into my business and trash the place every day. Two years ago, we threatened to blacklist the Go module mirror because for some reason the Go team thinks that running terabytes of git clones all day, every day for every Go project on git.sr.ht is cheaper than maintaining any state or using webhooks or coordinating the work between instances or even just designing a module system that doesn't require Google to DoS git forges whose entire annual budgets are considerably smaller than a single Google engineer's salary. Now it's LLMs. If you think these crawlers respect robots.txt then you are several assumptions of good faith removed from reality. These bots crawl everything they can find, robots.txt be damned, including expensive endpoints like git blame, every page of every git log, and every commit in every repo, and they do so using random User-Agents that overlap with end-users and come from tens of thousands of IP addresses - mostly residential, in unrelated subnets, each one making no more than one HTTP request ove ## Ultralytics AI Pwn Request Supply Chain Attack DevFeed: [Ultralytics AI Pwn Request Supply Chain Attack]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2024-12-11T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Malware](), [GitHub Actions](), [Vulnerabilities](), [Cryptocurrency](), [GitHub](), [Google](), [comfyui]() Tags: [ai](), [application-security](), [awareness](), [blog](), [code-security](), [comfyui](), [cryptocurrency](), [developer](), [devrel](), [devsecops](), [github](), [github-actions](), [google](), [malware](), [open-source-security](), [pypi](), [security](), [snyk-container](), [supply-chain](), [supply-chain-security](), [ultralytics](), [vulnerabilities]() ### AI overview The article analyzes the two-phase Ultralytics supply chain attack in December 2024. Attackers published malicious PyPI versions containing cryptocurrency-mining malware, first through compromised GitHub Actions workflows and later by publishing directly to PyPI. The article presents the release timeline, detection signals such as unusual CPU usage and repository discrepancies, and guidance for detecting exposure and securing projects. ### Source excerpt Discover the details of the Ultralytics AI supply chain attack, a sophisticated two-phase breach targeting PyPI releases and GitHub Actions with cryptocurrency mining malware. Learn how to detect exposure, secure your projects, and protect against future vulnerabilities using tools like Snyk. ## Lottie Player npm package compromised for crypto wallet theft DevFeed: [Lottie Player npm package compromised for crypto wallet theft]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-10-31T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [Vulnerabilities](), [Cryptocurrency](), [snyk](), [Security](), [supply-chain-security](), [Command-line interface]() Tags: [awareness](), [blog](), [cli](), [code-security](), [crypto](), [dependency](), [developer](), [devrel](), [incident](), [npm](), [package-compromise](), [security](), [snyk](), [snyk-code](), [supply-chain](), [vulnerabilities]() ### AI overview The @lottiefiles/lottie-player npm package was compromised after an npm registry publishing token was exposed. Malicious code in versions 2.0.5, 2.0.6, and 2.0.7 attempted to prompt users to connect cryptocurrency wallets. Those versions were removed, and version 2.0.8 restored the safe project code. The article explains how to use Snyk Dependency Reports and the Snyk CLI to identify affected projects and vulnerable dependencies. ### Source excerpt On October 31st, 2024, another package compromise and cryptocurrency hijack story unfolded for a popular npm package. Scan open source dependencies and container images in the CLI or your SCM with Snyk to determine if you're using one of the vulnerable versions of lottie-player, and potentially uncover any other security vulnerabilities you may have in your projects. ## Quick update: What's going on? DevFeed: [Quick update: What's going on?]() Original publisher: [Read original article]() Published: 2023-08-12T00:00:00Z Content type: news Language: en Sources: [Community blog on PINE64]() Topics: [Cryptocurrency](), [coinbase](), [FOSDEM](), [Linux]() Tags: [announcements](), [coinbase](), [community](), [community-update](), [cryptocurrency](), [fosdem](), [linux](), [payments](), [update]() ### AI overview PINE64 explains the pause in its community updates, announces that the Pine Store now accepts USD Coin payments through Coinbase, and invites the community to a meetup in Warsaw. ### Source excerpt Welcome to our long-awaited community post, where we aim to address the most commonly asked question while also unveiling some more news. Let's get started! Why hasn't there been a community update for the past few months? Is PINE64 dead? As you may have noticed, there haven't been any community updates as of late, and we are sorry for the prolonged silence. This isn't because the community hasn't been busy, quite the opposite is true. Instead, the problem is that the usual community update authors are too busy with their daily jobs and other tasks around the community. Although thanks to some community members who have shown interest to participate, we are working on a new community update and we hope we will publish it soon! Pine Store now accepts payments in cryptocurrency. The community has consistently expressed interest in paying on the Pine Store with cryptocurrency, and despite several previous attempts to find a suitable crypto payment service, the process has proven challenging, leading to eventual failure. However, we are happy to announce that Pine Store now facilitates payments using USD Coin cryptocurrency via Coinbase! Talk to us at our upcoming community meetup in Warsaw! We always attempt to meet in person at least twice a year. For reasons that ought to be obvious to everyone, this wasn't possible these past few years, but now that travel is once again viable we're returning to a bi-annual meetup schedule. We always meet at FOSDEM in February followed by a meeting halfway through the calendar year. While FOSDEM primarily serves the function of interacting with the broader Linux community and members of other projects as well as product announcements, the second yearly meetup aims at evaluating the project's progress, identifying issues, and creating a roadmap for the coming months. This year we're holding the second meetup in Warsaw. TL, Ayufan, Lukasz, and I will be having lunch in Hala Gwardii on Sunday, August 20th at noon. The place offers a wi ## Update on beta testing payments in Signal DevFeed: [Update on beta testing payments in Signal]() Original publisher: [Read original article]() Published: 2021-04-13T00:00:00Z Content type: opinion Language: en Sources: [Signal Blog]() Topics: [Cryptocurrency](), [Finance](), [User Experience](), [data]() Tags: [cryptocurrency](), [integrations](), [payments](), [privacy](), [signal](), [user-experience]() ### AI overview Signal discusses its beta-testing payments direction and the privacy problems of existing payment networks. Rather than building a cryptocurrency protocol itself, Signal proposes linked support for separately maintained non-custodial cryptocurrency wallets so users can access payments networks while keeping their data private. ### Source excerpt As the world stands today, the future of transaction privacy does not look great. The existing landscape is dominated by traditional credit companies, who over the past decade have been steadily pushing their networks for increased access to user data. They (and their data customers) are on a track to getting SKU level data of every purchase everyone makes everywhere. There are other contenders, such as regional online payments networks (like Venmo in the US), but the data story there is similar. This is not a future we are particularly excited about. At Signal, we want to help build a different kind of tech - where software is built for you rather than for your data - so these are trends that we watch warily. Read more... ## Announcing World Trade Francs: The Official Ethereum Stablecoin DevFeed: [Announcing World Trade Francs: The Official Ethereum Stablecoin]() Original publisher: [Read original article]() Author: Vitalik Buterin Published: 2018-04-01T15:35:26Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Cryptocurrency](), [Blockchain](), [Protocol (disambiguation)]() Tags: [blockchain](), [blockchain-technology](), [cryptocurrency](), [ethereum](), [governance](), [network](), [protocol](), [research-development](), [token](), [tokens]() ### AI overview The article announces World Trade Francs, described as a decentralized stablecoin built on Ethereum and next-generation blockchain technology. It also introduces WTF as a stable token and FTW as a corresponding volatile token within the proposed system. ### Source excerpt We have long recognized that in order for cryptocurrency to reach mass adoption, a form of cryptocurrency that has higher price stability than existing cryptocurrencies like BTC and ETH would be needed so that people can use the currency to store funds and engage in commerce without worrying about their... ## On Inflation, Transaction Fees and Cryptocurrency Monetary Policy DevFeed: [On Inflation, Transaction Fees and Cryptocurrency Monetary Policy]() Original publisher: [Read original article]() Author: Vitalik Buterin Published: 2016-07-27T17:00:00Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [Blockchain](), [Cryptocurrency](), [Security](), [Protocol (disambiguation)](), [Bitcoin](), [Ethereum]() Tags: [bitcoin](), [blockchain](), [cryptocurrency](), [ethereum](), [protocol](), [research-development](), [security]() ### AI overview The article examines how blockchains fund security through inflation or transaction fees. Using Bitcoin and Ethereum as examples, it discusses transaction-fee revenue, declining mining rewards, and the estimated cost of acquiring enough mining power to overwhelm the network. ### Source excerpt The primary expense that must be paid by a blockchain is that of security. The blockchain must pay miners or validators to economically participate in its consensus protocol, whether proof of work or proof of stake, and this inevitably incurs some cost. There are two ways to pay for this... ## Ethereum Partners with R3CEV on Lizardcoin, Bringing Together the Best of Centralized Finance and Blockchain Technology DevFeed: [Ethereum Partners with R3CEV on Lizardcoin, Bringing Together the Best of Centralized Finance and Blockchain Technology]() Original publisher: [Read original article]() Author: Vitalik Buterin Published: 2016-04-01T08:43:10Z Content type: opinion Language: en Sources: [Ethereum Foundation Blog]() Topics: [blockchain technology](), [Ethereum](), [Cryptocurrency](), [Bitcoin](), [Finance]() Tags: [banking](), [bitcoin](), [blockchain-technology](), [cryptocurrency](), [ethereum](), [finance](), [ibm](), [research-development](), [technology]() ### AI overview The article describes an announced collaboration between the Ethereum Foundation and banking consortium R3CEV to create Lizardcoin, a blockchain-based cryptocurrency intended to combine centralized financial controls with blockchain technology. It outlines a capped and reducing supply, account holding fees, and multi-bank KYC requirements, while comparing the project with Bitcoin. ### Source excerpt The Ethereum Foundation has announced that it will be working with the New York-based banking consortium R3CEV on creating a new blockchain-based cryptocurrency, Lizardcoin, which aims to showcase the benefits of blockchain technology as well as the consortium's ability to bring the technology to institutional clients and the regulation-loving masses...