Crypto hacks drained $766.49 million in September, a 2026 monthly record, and $387.5 million came from one breach of Bitget's hot wallets. After the money returned from the Liquid Network exploit, that one exchange accounts for about 80% of what stayed stolen.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
Alloc Init's Shielded Bitcoin paper claims Zcash-style private transfers on Bitcoin with no soft fork or consensus change. Moving coins into and out of the pool still depends on witness encryption the authors have not finished.
Reality
- Evidence35
- Adoption0
- Hype gap+45
- Incentives50
- Confidence40
Dutch officials report root access and Monero miners on Macs with port 5900 open to the internet. Sonoma, Sequoia and Tahoe all need the update Apple shipped as an important security fix.
Perspective Coverage
5 publishers
- Builder
- Builder 22%
- Operator
- Operator 70%
- Investor
- Investor 8%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence68
The Dutch NCSC says CVE-2026-65400 was abused within two weeks of Apple's fix, with root access and Monero miners in every reported case. Patching closes the door; it does not evict anyone.
Perspective Coverage
6 publishers
- Builder
- Builder 22%
- Operator
- Operator 72%
- Investor
- Investor 6%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+20
- Incentives40
- Confidence62
The group calling itself iamnotavillain wants 6,000 Monero within 24 hours and Revolut says no demand has reached it. The data went out through a government email account the bank was obliged to answer.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 51%
- Investor
- Investor 27%
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives60
- Confidence55
Revolut answered fraudulent information requests sent from a real government email account for months. A group calling itself iamnotavillain now wants about $3 million in Monero for the roughly 680 customer files.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+8
- Incentives55
- Confidence60
Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.
Reality
- Evidence66
- Adoption28
- Hype gap+10
- Incentives62
- Confidence58
Signal is testing a numberless signup in its Android 8.28 beta that costs a one-time $2.99 and issues an Account ID plus a recovery key. The purchase clears through Google Play, so degoogled users cannot buy it.
Reality
- Evidence62
- Adoption18
- Hype gap+12
- Incentives55
- Confidence58
Unit 42 committed a fresh, overly permissive AWS key to a random GitHub repository with the usual quarantine policy switched off, then timed how long a cryptojacking crew took to find it and start mining.
Reality
- Evidence52
- Adoption45
- Hype gap+30
- Incentives78
- Confidence60
Version 3.20 lets Monero and Zcash trade against bitcoin, ether and stablecoins inside THORChain's own pools, which makes pool depth rather than the 8.9% price pop the figure that decides how much of this route is usable.
Reality
- Evidence26
- Adoption28
- Hype gap+34
- Incentives61
- Confidence31
An authentication state flaw lets anyone who reaches TCP/5900 skip credentials entirely. Multiple cases reported to NCSC-NL ended in root and a Monero miner.
Reality
- Evidence34
- Adoption31
- Hype gap+18
- Incentives24
- Confidence41