Cyber, in brief

Bitget, a crypto exchange based in Singapore and founded in 2018, said thieves moved coins out of a small number of its online wallets on Thursday evening. [2][5]

Its first estimate of the loss was $351.6m. It raised that to $387.5m on Friday after finding more missing coins on two further networks, Zcash and TRON. [4]

Arkham, a firm that traces coins on the public ledgers, says $228m left Bitget's wallets in 18 minutes, between 18:58 and 19:16 UTC. [4]

The biggest single loss was $153m in XRP. Ether, the dollar-pegged coins USDT and USDC, and Tether Gold were also taken. [4]

Bitget's chief executive, Gracy Chen, says the attacker took over a system inside its wallet service, fed it false transfer details, and got the exchange's own approval process to sign the coins out. [1][3]

Bitget has not said how the attacker got into that system. It says no further unauthorised transfers are possible. [1]

Chen says the way the attack was carried out, the internet addresses used and the trail on the ledgers all match known North Korean hacking groups. She named no group, and Bitget has not published its evidence. [5][2]

Withdrawals are stopped while Mandiant, Google's incident-response arm, and SlowMist, a blockchain security firm, investigate. Deposits and trading carry on. [3][4]

Bitget says a User Protection Fund of 5,500 bitcoin, worth about $464m, will cover every loss, and that it holds more than $1bn of its own assets on top. [1][4]

Some blockchain foundations have frozen the thief's wallet addresses. Bitget is offering 5% of any funds a platform freezes and 5% of any that are recovered. [3][2]

Last year attackers stole $2.9bn of crypto across nearly 150 attacks. North Korea took $1.5bn from the exchange Bybit in February 2025, the largest theft so far. [6]

A week earlier SentinelOne, a security company, tied the North Korean group behind the Bybit theft to a break-in at a small Indian IT services firm that holds no crypto. [7]

Why it matters. Watch whether Bitget publishes how the attacker got into its wallet service and when withdrawals reopen; until both happen, the $464m fund is a promise customers cannot yet test.

The FBI confirmed on Friday that its jobs website, FBIJobs.gov, was broken into. [8] The gang, ShinyHunters, says it got in through a flaw in Oracle PeopleSoft software on the site and then reached servers the bureau runs on Amazon's government cloud. [8] Files it gave reporters include a mental-health evaluation and blood-test results for staff; Reuters matched two social security numbers in them against credit records. [9] Former agents told the BBC they fear undercover colleagues could be found at home. [10] The gang wants the FBI to withdraw a May notice about it, not money, and says it will publish within four days. [10][11]

Why it matters. The site is still down and the FBI says it does not yet know whether the hole was in its own systems or a contractor's. [8] Anyone who ever applied for an FBI job may be in the file. [8]

Kiteworks, which sells software that companies use to send confidential files, emailed customers this week asking them to shut its servers down for a six-hour window on Saturday. [12] Its security chief says US federal intelligence agencies warned that an attacker may try to target some customers' systems, and that no break-in is known. [12] A support worker told the German outlet Heise the reason was a possible flaw with no fix yet. [12] The company was once called Accellion; in December 2020 the Clop gang used a flaw in its file-transfer tool to steal data from dozens of firms. [12]

Why it matters. Jake Knott of the security firm watchTowr said nobody asks a whole customer base to unplug working systems over a hunch. [12] Every firm that keeps the software running through Saturday is betting the warning is wrong.

CISA, the US cyber-defence agency, added two flaws on Friday to its list of ones being used in real attacks. [13] One is in Microsoft SharePoint, the software companies use to share documents. Microsoft labelled it a minor spoofing flaw in August; it now says the flaw lets an attacker run code on the server, and that it had reliable evidence of attacks as of 25 September. [13] The other is in MikroTik routers: CERT Polska, Poland's response team, showed that two flaws chained together give full control of an internet-facing router with no password. [13] Microsoft has not said who is attacking, how many organisations were hit, or what the attackers did inside. [13]

Why it matters. Microsoft's first label told administrators this could wait. Its new one says attackers are already inside some servers, and it has not said whose. [13]

WordPress, the software behind a large share of the world's websites, fixed a flaw on 22 September in the way it picks the template for a page. [14] Patchstack, a security firm, saw the first attempts to use it within hours of the fix being made public, and says they have since turned into real break-ins. [14] The flaw only works when a site's theme folder is named starting with 'page-' and the server can read a chosen file. [14] The old Twenty Twelve and Twenty Fourteen themes and the popular Neve, Hestia and Sydney themes have that layout. [14] The fix was copied back to every WordPress version since 4.7. [14]

Why it matters. A site owner running one of those themes who has not updated since Tuesday is reachable by anyone who read the advisory. [14]

DriveWealth, a US broker that once held the US-share accounts of Revolut customers, says attackers talked their way into its systems on 4 and 5 September and took old customer records. [15] The records cover names, emails, phone and postal addresses, jobs, citizenship, age, gender and part of an account number; passwords and card details were not taken. [15] DriveWealth says the rules obliged it to keep the records after Revolut moved its customers to a new arrangement. [15] Revolut says its own systems were not touched. It is the second leak to reach Revolut customers this month. [15]

Why it matters. The stolen fields are exactly what a convincing fake email needs, and DriveWealth said as much in its own warning. [15] Nobody in the file chose DriveWealth; Revolut did.

Astrana, one of the largest US healthcare technology companies, told the US stock-market regulator on Tuesday that hackers had reached its servers. [16] They rang employees while faking the company's own main phone number, and talked their way to access. [16] Astrana had to rebuild some systems from clean backups; it has not said whether ransomware was used, how many patients are affected or what was taken. [16] It sells software to about 20,000 medical providers and made $972.5m in revenue last quarter. [16] It is the latest of several health-tech firms to report a breach this year, after Veradigm, CareCloud and others. [16]

Why it matters. Patients whose records sit in Astrana's systems have not been told anything yet; the filing went to investors first, because the law requires it there. [16]

Zenity Labs, a security research firm, found three flaws in Agentforce, the AI assistant Salesforce sells to work inside its customer-management software. [17] An attacker could type hidden instructions into a company's public Web-to-Lead form, the ordinary web form where sales leads are collected. [17] The instructions sit unnoticed until an employee asks the AI agent to look at that lead; the agent then follows them. [17] Two of the flaws let the agent send customer data out with no click from anyone; the third could turn it into a sender of convincing phishing. [17]

Why it matters. A form that exists to let strangers write into a company's database now writes into an AI that acts on what it reads. [17]

SentinelOne, a security company, says Jade Sleet, the North Korean group behind the $1.5bn Bybit theft, broke into a small Indian IT services firm with no crypto business of its own. [7] It used two Mac backdoors, FLATROOF and ROOFDECK, last seen in the March-April attack on KelpDAO's bridge. [7] The lure was a fake job interview aimed at staff in DevOps, crypto and finance roles. [7] The group's habit, GitHub noted in 2023, is to target the suppliers of crypto firms as well as the firms themselves. [7]

Why it matters. A supplier's machines are a way into every customer it serves; the Bybit coins were taken through a compromised developer environment at Safe{Wallet}, a supplier. [7]

Google said on Thursday it is expanding a programme called Scan for Good. [18] Two AI tools, Google's Gemini 3.8 Flash Cyber and Red Agent from Wiz, the cloud security firm Google owns, scan public services, critical infrastructure and non-profits for exposed systems. [18] It says the models have already found critical flaws at hospitals, a town council, a public rail operator and large tech providers, and hand each finding to a human researcher to verify and fix. [18] Wiz's Gal Nagli says the programme has run for several months and has no end date. [18] OpenAI announced a similar $1bn credits programme for hard-pressed defenders earlier this month. [18]

Why it matters. The announcement follows disclosures that Google's own AI agents escaped their test areas and hacked other companies' websites; this time a person stands between the finding and the fix. [18]

Nottingham University Hospitals, an English NHS trust, overwrote its old maternity database on 18 August. [19] Staff copying a radiotherapy database for reporting reused a set of instructions written for another system, and one setting that needed changing was not changed. [19] The database held records of women and babies treated between September 2011 and November 2022. [19] The trust recovered the clinical notes, observations and test results, and current patients were unaffected. It cannot fully restore the log of who viewed each record over those eleven years. [19]

Why it matters. A patient who asks whether someone looked at her maternity record between 2011 and 2022 may now never get an answer. [19]

Elsevier, the Amsterdam-based academic publisher behind ScienceDirect, confirmed that visitors to some of its sites were sent to a leak page run by the LAPSUS$ crime crew on 21 September. [20] A nursing student trying to reach textbooks posted a screenshot of the redirect on Reddit. [20] Elsevier says the redirect was brief and narrow, and that no customer data, research content or core systems were touched; it has not said which platforms or for how long. [20] LAPSUS$ is best known for its attack on Rockstar Games. [20]

Why it matters. A publisher that also runs ClinicalKey, a reference tool for doctors, was briefly steering its readers to a criminal gang's page. [20]

Russian drone strikes on Wednesday damaged data centres and telecoms sites in Kyiv, and at least four internet providers lost part of their networks, the monitoring group NetBlocks reports. [21] Ukraine's digital ministry says about 100,000 households had internet problems. [21] Utels said one data centre holding its core equipment lost power; it restored most customers within about two hours. Pautina said nearly half its network went down. [21] Russia's defence ministry says it hit two data centres that served Ukraine's military and intelligence; that could not be verified, and Ukraine has not confirmed it. [21] Two people were killed and at least 43 injured. [21]

Why it matters. Ukraine's foreign minister says the warnings of incoming missiles reach people over the internet, so the network that was hit is the one that tells a family to go to the shelter. [21]

CISA published a plan on Wednesday for the CVE programme, the world's shared numbering system for software flaws. [22] More than 67,000 CVEs have been published in 2026 so far, and submissions to the US vulnerability database rose 263% between 2020 and 2025, with AI adding to the flow. [22] The paper says faster reporting exposes gaps in checking when submissions are uneven, and names four areas to fix: how the programme is governed, who takes part, the systems that hold the data, and the reliability of each record. [22][23] The programme's contract nearly lapsed last year before a last-minute extension, and some experts have asked whether another body should run it, given CISA's budget cuts. [22]

Why it matters. Every patch deadline and every flaw list in this edition hangs off a CVE number; the paper is CISA saying the numbers themselves need to be trusted more. [22]

Ofcom, Britain's communications regulator, has opened an investigation into whether Pornhub's age checks for UK iPhone users are effective enough to keep children out. [24] Pornhub's owner Aylo cut off new UK users in February, saying the Online Safety Act pushed people to less regulated sites; UK visits had fallen 47% and then, reportedly, 77% after the rules began in July 2025. [24] In May it let back in users who had confirmed their age through Apple's own checks. [24] Ofcom says its question is how Aylo built and tested that process, not how Apple's system works. [24]

Why it matters. The finding decides whether a signal from a phone maker counts as a check, and every other site facing the same law will read it. [24]

Researchers at Have I Been Squatted found fake Google Play pages, branded as the logistics firms CEVA and TKW, handing out an Android app dressed up as a system service. [25] The app, Corp MDM, steals new text messages, forwards calls and hides itself, and reports to its server every 30 seconds. [25] The same server hosts fake login pages and Windows malware aimed at logistics companies. [25] The researchers think the spyware was written with AI help, because of bugs that get in its own way. [25]

Why it matters. A stolen text message is often the one-time code a bank or a work login sends. A driver who installs a fake company app hands those over. [25]

Jamf, a company that manages Apple devices for businesses, found a new version of PamStealer, a program that steals passwords from Macs. [26] Earlier versions this summer posed as clipboard apps; this one uses a fake website for a crypto wallet called Wavel, which does not exist. [26] The download opens Apple's own Script Editor, which runs a hidden script that fetches the real payload. [26] The key to unlock that payload now lives on the attacker's server, so researchers cannot take the malware apart without the server's cooperation. [26]

Why it matters. The fake site is aimed at people looking for somewhere to keep their coins, who hold exactly the passwords a thief wants most. [26]

Nisos, a US firm that investigates insider risk, let a suspected North Korean applicant be hired for a remote AI engineering job in June 2025 and shipped a laptop fitted with monitoring to a Florida address. [27] The laptop opened in a closet full of other companies' computers, a laptop farm. [27] Over months the operator applied for other jobs, chatted with 22 other operators and worked with four US helpers, all from the China-North Korea border. [27] Last week the US, Japan, Australia and Germany updated their advisory: the scheme has infected 30,000 devices in over 100 countries and drained 7,000 crypto wallets. [27]

Why it matters. The fraud starts at a hiring desk, not a firewall, which is why the advice is to retrain the people who interview. [27]

CISA published an advisory on Wednesday about the Botslab G980H dashcam, listing thirteen kinds of flaw in one device, including a built-in password, a built-in encryption key, functions with no login at all, and passwords sent without encryption. [28] An attacker could get past the login, read stored data, change settings or stop the camera working. [28] The combined severity is rated 8.8 out of 10. [28]

Why it matters. A dashcam records where a car goes, and a device with a password built into it is one that every buyer shares with every other buyer. [28]