Verified status as of August 2, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-48449 in Adobe Campaign Classic: the source articles reported no exploitation. NVD rates it 10 (CRITICAL) on CVSS v3.1.
TL;DR
Coldcard hardware wallet firmware vulnerability enabled attackers to steal 1,082.65 BTC worth $70.2 million in 41 minutes. Separately, attackers compromised Adform's ad-tech infrastructure to inject wallet-swapping code into customer sites. Both attacks exploit supply-chain and hardware weaknesses in cryptocurrency infrastructure.
Executive Summary
- A March 2021 firmware flaw in Coldcard Bitcoin wallets allowed threat actors to drain 1,196 Bitcoin addresses of 1,082.65 BTC (~$70.2 million) in 41 minutes on July ⚠ 30, 2026.
- Attackers poisoned a JavaScript file served by advertising platform Adform on July 27, 2026, injecting code that rewrites cryptocurrency wallet addresses on customer websites; Adform detected and remediated the incident the same day.
- Microsoft reported a CaptiveCrunch operation delivering CornFlake RAT via fake browser updates over hijacked hotel Wi-Fi networks, capturing webcam, audio, and keystrokes.
- A Chinese-speaking threat actor has targeted Central Asian government organizations since January 2025 using OctLurk and SilkLurk malware.
- Rails framework received a critical patch for an arbitrary file read and RCE vulnerability in Active Storage affecting unauthenticated attackers.
Top Threats Today
1. Coldcard Hardware Wallet Firmware Flaw Enables $numerous Bitcoin Theft
Severity: HIGH Affected: Finance
An attacker exploited a random number generator (RNG) flaw in Coldcard hardware wallet firmware to drain cryptocurrency from 1,196 Bitcoin addresses, stealing 1,082.65 BTC (approximately $70.2 million at the time) in just 41 minutes on July 30, 2026 [1]. Galaxy Research mapped the sweep and traced it to the firmware vulnerability [1]. A separate report estimates the compromised amount at $88.6 million and attributes the flaw to seeds generated using the flawed RNG [2]. Coldcard is a Bitcoin-only hardware wallet produced by Canadian firm Coinkite [1].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- If you hold BTC in a Coldcard wallet, immediately verify the firmware version and device genesis date against Coinkite's security advisories
- Consider moving cryptocurrency holdings to a device with patched firmware or an alternative hardware wallet
- Monitor the blockchain for unauthorized transactions on addresses associated with affected wallets
- Contact Coinkite support to confirm whether your device serial was generated during the vulnerable firmware period
2. Adform Supply-Chain Attack Injects Crypto Wallet-Swapping Code
Severity: HIGH Affected: Finance
Threat actors modified a JavaScript file served by advertising technology firm Adform, transforming it into a browser-side tool that rewrites cryptocurrency wallet addresses in real time on customer websites [1]. Adform detected the malicious code on July 27, 2026, removed it, notified affected clients, and reported the incident to authorities [1]. The attack targets end users visiting websites that depend on Adform's ad network, intercepting wallet deposit and withdrawal addresses at the browser level. ⚠
Sources:[1] The Hacker News
Recommended Action
- If your organization uses Adform ad services, verify that JavaScript tags have been reloaded and updated since July 27, 2026
- Review transaction logs for any cryptocurrency movements during the compromise window and flag unexpected address changes
- Implement Content Security Policy (CSP) headers to restrict inline script execution and monitor external script sources
- Audit customer-facing websites for injected or modified JavaScript that could alter blockchain addresses
3. Rails Active Storage Critical Vulnerability Allows Unauthenticated File Read and RCE
Severity: HIGH Affected: Technology
A critical vulnerability in the Ruby on Rails Active Storage framework allows unauthenticated attackers to read arbitrary files from a Rails application and potentially escalate to remote code execution (RCE) [1][2]. Rails has released patches to address the flaw [1][2].
Sources:[1] BleepingComputer[2] SecurityWeek
Recommended Action
- Update Rails and Active Storage to the latest patched version immediately
- Review application logs for suspicious file-read requests or unusual Active Storage API calls
- Run intrusion detection signatures for Active Storage exploitation attempts
- If patching is delayed, restrict network access to Active Storage endpoints using WAF or network ACLs
4. CaptiveCrunch Delivers CornFlake RAT via Hijacked Hotel Wi-Fi
Severity: HIGH Affected: Technology
Microsoft researchers identified a CaptiveCrunch operation that delivers CornFlake, a remote access trojan (RAT), by serving fake browser update prompts over hijacked hotel Wi-Fi networks [1]. The malware can capture webcam images, microphone audio, and keystroke data [1]. This attack targets travelers and business users relying on public Wi-Fi infrastructure.
Sources:[1] The Hacker News
Recommended Action
- Use a VPN when connecting to public Wi-Fi networks, especially in hotel environments
- Disable automatic updates and verify browser/OS updates only through official vendor channels
- Enable browser security features that warn on suspicious update prompts
- Cover or disable webcams on devices that connect to untrusted networks
5. Chinese-Speaking APT Targets Central Asian Governments with OctLurk and SilkLurk
Severity: HIGH Affected: Government
A Chinese-speaking threat actor is suspected of conducting cyber attacks against government organizations primarily in Central Asia—including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic—since January 2025, using malware families OctLurk and SilkLurk [1]. The campaign represents sustained targeting of diplomatic and administrative infrastructure in the region.
Sources:[1] The Hacker News
Recommended Action
- Government and diplomatic agencies in targeted regions should assume compromise and conduct full network forensics
- Hunt for OctLurk and SilkLurk IOCs across network logs and endpoints
- Implement enhanced monitoring on critical government networks and isolated segments
- Share indicators with CISA and regional information-sharing networks
Today’s Action Checklist
- ☐ URGENT: If operating Coldcard wallets, check device firmware version and verify wallet seed integrity
- ☐ URGENT: Review transaction logs for unauthorized cryptocurrency transfers or address swaps (Adform impact)
- ☐ HIGH: Patch Rails Active Storage to latest version; verify no exploitation artifacts in application logs
- ☐ HIGH: Hunt for CornFlake RAT and CaptiveCrunch campaign indicators on employee devices that use public Wi-Fi
- ☐ MEDIUM: Government organizations in Central Asia: initiate incident response and forensic investigation if not yet completed