Blahalla

Friday Squid Blogging: Jurassic Fish Chokes on Squid

www.schneier.com · 3 months ago

false

Inconsistent Privacy Labels Don't Tell Users What They Are Getting

www.darkreading.com · 3 months ago

false

LinkedIn secretly scans for 6,000+ Chrome extensions, collects data

www.bleepingcomputer.com · 3 months ago

LinkedIn is reportedly using JavaScript scripts to scan visitors’ browsers and collect device data. These scripts identify over 6,000 installed browser extensions and gather information such as CPU core count, screen resolution, and battery status. The company claims this scanning is to protect the platform and users by identifying extensions that violate its terms of service, but critics allege it’s used to gather data on competitor software usage. LinkedIn disputes claims of misuse, attributing the report to a banned user attempting to re-litigate a legal dispute.

LinkedIn secretely scans for 6,000+ Chrome extensions, collects data

www.bleepingcomputer.com · 3 months ago

Microsoft's LinkedIn is scanning visitors' browsers for over 6,000 installed extensions and collecting device data using hidden JavaScript scripts. The practice, revealed in a report called "BrowserGate," links this information to user profiles to identify companies using competitor products. LinkedIn claims the scanning is to protect its platform and users from extensions violating its terms of service, and denies using the data to infer sensitive information. A German court has previously ruled against the report's author, finding their data practices violated the law.

NASA’s Artemis II Astronauts Took iPhones Into Space

www.nytimes.com · 3 months ago

false

What If HSMs Were as Easy to Use as They Are Powerful? A native macOS app for YubiHSM 2 management

charles.dev · 3 months ago

false

Security lapse lets researchers view React2Shell hackers’ dashboard

www.csoonline.com · 3 months ago

A threat group, identified as UAT-10608, is exploiting the React2Shell vulnerability, CVE-2025-55182, to steal credentials from unpatched servers at a massive scale. Researchers discovered a password-protected database containing harvested data from compromised systems including AWS, Microsoft Azure, OpenAI, and GitHub. The automated exploitation framework has successfully compromised 766 hosts in a single 24-hour period, demonstrating an industrial-scale operation leveraging tools like Shodan and Censys. Experts warn that unpatched systems are actively being targeted, and even after patching, stolen credentials can enable persistent attacks and significant data breaches.

A core infrastructure engineer pleads guilty to federal charges in insider attack

www.csoonline.com · 3 months ago

A core infrastructure engineer recently pleaded guilty to launching an insider extortion attack against a former employer. The attack involved unauthorized remote desktop sessions, account deletions, password changes, and scheduling tasks on a domain controller, followed by a demand for bitcoin totaling approximately $750,000. Security experts emphasize that standard security procedures, such as immutable backups, the principle of least privilege, and monitoring tool usage, should have prevented the attack. Analysts recommend tiered administration models and segregated duties to limit potential damage from any single administrator.

OpenAI Buys Streaming Show ‘TBPN,’ Aiming to Change Narrative on A.I.

www.nytimes.com · 3 months ago

OpenAI has acquired TBPN, the online technology talk show known for live daily coverage, in a deal with undisclosed terms. OpenAI said the purchase is intended to help create a space for a real, constructive conversation about the changes AI creates and to scale TBPN's real-time tech media presence. TBPN founders Jordi Hays and John Coogan are expected to keep running the show, though analysts have raised questions about editorial independence and whether competitors will continue to grant interviews.

Hims & Hers warns of data breach after Zendesk support ticket breach

www.bleepingcomputer.com · 3 months ago

Telehealth company Hims & Hers Health has announced a data breach impacting customer support tickets. The breach occurred between February 4 and February 7, 2026, with unauthorized access to tickets containing personal information like names and contact details. Hackers reportedly exploited an Okta SSO account to access the company’s Zendesk instance, stealing millions of support tickets as part of a broader campaign. Hims & Hers is offering free credit monitoring and advising customers to be cautious of potential phishing attempts.

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

thehackernews.com · 3 months ago

A China-aligned threat actor, TA416, has resumed targeting European government and diplomatic organizations since mid-2025, after a two-year period of minimal activity in the region. The group, also linked to DarkPeony and Mustang Panda, uses various techniques, including OAuth redirects, Cloudflare Turnstile abuse, and malicious C project files to deploy the PlugX backdoor. TA416 has also expanded operations to target Middle Eastern government entities amid geopolitical conflicts and frequently iterates on its attack methods. Researchers have observed the exploitation of internet-facing infrastructure, including CVE-2025-31324 and CVE-2025-0994, to gain initial access.

Google patches fourth Chrome zero-day so far this year

www.csoonline.com · 3 months ago

Google has released a security update to address a fourth zero-day vulnerability in Chrome this year. The vulnerability, CVE-2026-5281, affects the Dawn WebGPU implementation and allows for arbitrary code execution. Previous vulnerabilities this year include CVE-2026-2441, a CSS memory management fault, CVE-2026-3909, a Skia graphics library buffer overflow, and CVE-2026-3910, an issue in the V8 JavaScript engine. Users are advised to update to Chrome version 146.0.7680.178 or later.

Internet Bug Bounty program hits pause on payouts

www.csoonline.com · 3 months ago

The Internet Bug Bounty program, which rewards researchers for finding software bugs, has paused submissions. HackerOne, the program's administrator, cited artificial intelligence making it easier to find vulnerabilities as a reason for the change, shifting the balance between discoveries and remediation. The program, funded by major software companies, has awarded over $1.5 million since 2012. Node.js is among the projects impacted by the pause, and similar programs like Curl and Google have also recently restricted submissions.

Apple Breaks Precedent, Patches DarkSword for iOS 18

www.darkreading.com · 3 months ago

Apple has issued patches for the DarkSword exploit chain, extending security updates to older iOS versions, including iOS 18, after the exploit leaked online. This move, which follows a similar action regarding the Coruna exploit kit, addresses a significant threat that allows for command-and-control capabilities via SMS and privilege escalation. Security experts note the severity of DarkSword, particularly its ability to operate without rooting the device, making detection more difficult. Apple's response highlights a growing market for iOS exploit kits and underscores the challenges of relying solely on patching strategies.

Claude Code is still vulnerable to an attack Anthropic has already fixed

www.csoonline.com · 3 months ago

Security researchers have identified a vulnerability in Anthropic’s Claude Code, allowing attackers to bypass security measures using a command sequence exceeding 50 subcommands. The tool may prompt users to authorize actions without proper security analysis if presented with such a long command. The vulnerability, documented within the code itself, is addressed by the tree-sitter parser, which is currently disabled in public builds. Attackers could potentially exploit this to steal credentials and compromise software supply chains.

Die Linke German political party confirms data stolen by Qilin ransomware

www.bleepingcomputer.com · 3 months ago

The German political party Die Linke has confirmed that the Qilin ransomware group stole data from its network and is threatening to leak it publicly. The attackers targeted internal data and employee information, though the membership database was not compromised. Qilin, described as a Russian-speaking group with financial and political motivations, claimed responsibility for the attack on April 1st. This incident follows a similar attack on the CDU political party earlier this year, which involved the WineLoader backdoor tracked to APT29.

CERT-EU blames Trivy supply chain attack for Europa.eu data breach

www.csoonline.com · 3 months ago

CERT-EU has linked a recent data breach of the Europa.eu platform to a supply chain attack on the Trivy vulnerability scanner. Attackers stole 350 gigabytes of data, including personal information, after compromising an AWS API key. The breach, attributed to the TeamPCP group, exploited a misconfiguration in Trivy’s GitHub Actions environment, now identified as CVE-2026-33634. CERT-EU advises organizations to update Trivy, rotate credentials, and audit CI/CD pipelines.

Android Alert: 50 Google Play Apps Linked to ‘NoVoice’ Malware Reached 2.3M Downloads

www.techrepublic.com · 3 months ago

Malware dubbed "NoVoice" has impacted over 2.3 million downloads through apps available in the Google Play Store. The malware initially hides its activity during code review, then exploits vulnerabilities in Android software, some dating back to 2016, to gain root access and evade defenses. Once established, it collects device data, communicates with a command and control server, and can steal information from apps like WhatsApp. Google has removed the malicious apps and devices with security updates from May 2021 onward are protected.

FBI Declares Surveillance System Breach a ‘Major Incident’

www.techrepublic.com · 3 months ago

The Federal Bureau of Investigation has classified a breach of an internal surveillance system as a "major incident" under federal law. The breach, linked to China, involved a system holding data from surveillance operations and personally identifiable information on FBI investigation subjects. Attackers accessed the system by exploiting a commercial Internet Service Provider’s vendor infrastructure. The incident has prompted a Justice Department working group to bolster cyber resilience, and officials acknowledge the embarrassment of the compromise.

Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers

thehackernews.com · 3 months ago

Security researchers have observed threat actors utilizing HTTP cookies to control PHP web shells on Linux servers, enabling remote code execution. These web shells rely on attacker-supplied cookie values to activate malicious functionality and remain dormant during normal application execution. Attackers are exploiting vulnerabilities or using valid credentials to set up cron jobs that periodically recreate malicious PHP loaders, creating persistent backdoors. Microsoft recommends strengthening authentication, monitoring for unusual activity, and auditing scheduled tasks to mitigate this threat.

Blast Radius of TeamPCP Attacks Expands Amid Hacker Infighting

www.darkreading.com · 3 months ago

Multiple organizations have recently experienced breaches linked to the TeamPCP supply chain attacks, including AI startup Mercor and the European Commission. Threat actors exploited a compromised version of the Trivy code-scanning tool, gaining access to the European Commission’s cloud environment and harvesting credentials. Cybercriminal groups ShinyHunters and Lapsus$ have claimed responsibility for data exfiltration, complicating attribution and raising concerns about the broader risk profile of these attacks. Security experts advise immediate revocation and rotation of exposed secrets and heightened vigilance across cloud and SaaS environments.

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io · 3 months ago

A researcher has uncovered several security vulnerabilities in the Linux kernel using Anthropic's Claude Code AI model. The AI identified flaws such as a heap buffer overflow in the NFS driver, some of which have existed undetected for over two decades. Newer versions of the AI, like Claude Opus 4.6, demonstrate significantly improved capabilities in finding such issues. While the AI has identified hundreds of potential bugs, each must be manually verified to confirm their validity.

npm-sentinel: 21 malicious npm packages in 24h including LLM API MITM, encrypted skill backdoors, and Redis weaponization via postinstall

yuribm.dev · 3 months ago

Researchers have identified several critical vulnerabilities within the npm package ecosystem related to AI coding tools and infrastructure. Attackers are employing techniques like persistent prompt injection, man-in-the-middle attacks against the Claude Code API, and weaponizing Redis to steal credentials and establish reverse shells. Additionally, malicious actors are distributing phishing toolkits, credential stealers disguised within React components, and heavily obfuscated packages to harvest API keys. These attacks include dependency confusion exploits targeting Verisign and internal corporate packages, alongside instances of version squatting. The researcher emphasizes responsible disclosure practices, coordinating with vendors prior to public release. CVEs referenced include: 2026-04-02, 2026-04-03.

Evolution of Ransomware: Multi-Extortion Ransomware Attacks

www.bleepingcomputer.com · 3 months ago

Ransomware attacks are increasingly impacting critical sectors like healthcare, finance, and manufacturing, with a 49% surge in publicly disclosed incidents in 2025. Threat actors have evolved beyond encryption to employ double and triple extortion tactics, stealing data and threatening public exposure to pressure victims. Traditional security measures are proving insufficient, necessitating a new approach that focuses on data protection even after a breach. Penta Security’s D.AMO platform combines encryption, access control, and backup recovery to protect against multi-extortion ransomware.

AI Breakthroughs, Security Breaches, and Industry Shakeups Define the Week in Tech

www.techrepublic.com · 3 months ago

Several significant developments occurred this week in the technology sector. AI innovation is accelerating, with Alibaba releasing Qwen3.5 Omni and Microsoft and Google launching new AI tools. Anthropic experienced data leaks, including the accidental publication of 500,000 lines of code related to Claude Code, though no customer data was compromised. Security concerns emerged with NoVoice malware impacting millions of Android devices and a cyberattack against Hasbro disrupting operations. Apple released iOS 18.7.7 to address a Safari hijack vulnerability, and Google enhanced Google Drive with AI-based ransomware detection.

Using undocumented AWS CodeBuild endpoints to extract privileged tokens from AWS CodeConnections allowing lateral movement and privilege escalation through an organisation's codebase

thomaspreece.com · 3 months ago

A critical vulnerability has been identified in AWS CodeBuild involving an undocumented API that allows unauthorized access to sensitive credentials, including GitHub and Bitbucket tokens. This flaw, affecting CodeConnections, enables attackers to gain full administrative access to connected repositories, potentially compromising code, pipelines, and infrastructure. The vulnerability bypasses standard security measures and exists even without specific configurations. Mitigating the risk involves blocking the GetConnectionToken action through SCPs.

If you're running OpenClaw, you probably got hacked in the last week

blink.new · 3 months ago

A critical vulnerability, identified as CVE-2026-33579, impacts OpenClaw versions before 2026.3.28, potentially allowing attackers with basic pairing access to gain full administrative control. The vulnerability arises from a flawed authorization process during device pairing and is easily exploited, especially in instances lacking authentication. Users are strongly advised to immediately upgrade to version 2026.3.28, enable authentication, and review system logs for suspicious activity. Considering managed hosting solutions is recommended to reduce self-hosting security burdens.

Picking Up 'Skull Vibrations'? Could Be XR Headset Authentication

www.darkreading.com · 3 months ago

Researchers at Rutgers University have developed VitalID, a new biometric authentication system for extended reality headsets. The software uses XR headset motion sensors to track low-frequency vibrations in a user's skull, identifying unique biometric signatures based on breathing and heartbeat patterns. VitalID aims to provide passive, continuous authentication within XR sessions, acting as a reauthentication signal rather than a complete replacement for existing authentication methods. A patent application has been filed, and licensing is being offered for this technology.

Claude Source Code Leak Highlights Big Supply Chain Missteps

www.darkreading.com · 3 months ago

Recent cyberattacks have exposed vulnerabilities in software supply chains, impacting projects like the Trivy security scanner, Axios Javascript package, and Anthropic's Claude Code. These incidents stem from misconfigured GitHub Actions, compromised developer accounts, and human error, such as accidentally publishing source code. Experts highlight the need for stronger security around maintainers, CI/CD environments, and ecosystem-wide detection to mitigate the cascading effects of these breaches. Securing development pipelines and implementing robust secret management practices are crucial for preventing widespread compromise.

Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain

www.darkreading.com · 3 months ago

false

New Progress ShareFile Flaws Expose Servers to Unauthorized Remote Takeover

gbhackers.com · 3 months ago

Security researchers have identified critical vulnerabilities in the Progress ShareFile Storage Zone Controller, enabling unauthorized remote takeover of servers. The flaws, CVE-2026-2699 and CVE-2026-2701, allow attackers to bypass authentication and execute malicious code. These vulnerabilities impact on-premises Storage Zone Controller instances, which are used by organizations for data sovereignty, and approximately 30,000 instances are exposed online. Progress has released version 5.12.4 to address the issues, and immediate patching is strongly recommended.

TrueConf Zero-Day Exploited in Asian Government Attacks

www.securityweek.com · 3 months ago

Hackers, believed to be linked to China, exploited a vulnerability in TrueConf video conferencing software to target government entities in Asia. The zero-day, CVE-2026-3502, allowed attackers to tamper with software updates and execute malicious code on vulnerable systems. This compromised a central server, distributing a malicious update to dozens of government entities, enabling reconnaissance and lateral movement. The vulnerability has been patched in version 8.5.3, and the US Cybersecurity and Infrastructure Security Agency has added it to their list of known exploited vulnerabilities.

Characterizing Abusive IP Proxies

www.first.org · 3 months ago

false

In Other News: ChatGPT Data Leak, Android Rootkit, Water Facility Hit by Ransomware

www.securityweek.com · 3 months ago

A new Android banking trojan, Mirax, is available for cybercriminals to rent, allowing remote device control and overlay attacks on financial apps. Italian authorities have fined Intesa Sanpaolo $36 million for failing to protect customer data, leading to a significant breach. Researchers found a vulnerability in ChatGPT that allowed sensitive data to be leaked through DNS queries, which was patched in February. Broadcom has released a patch for CVE-2026-3991, a high-severity vulnerability in Symantec DLP products, allowing privilege escalation. A ransomware attack impacted a North Dakota water facility, and the FBI classified a breach of its wiretap infrastructure as a major incident linked to Chinese hackers.

Microsoft Forces Unmanaged Windows 11 Devices to Upgrade to Version 24H2

gbhackers.com · 3 months ago

Microsoft is automatically upgrading unmanaged Windows 11 devices from version 24H2 to version 25H2, similar to security patch deployments. A recent update, KB5085516, resolves network connectivity issues impacting users with personal Microsoft accounts. A hardware-specific incident involving Samsung devices and the Galaxy Connect app caused storage drive access denials, which has been addressed by removing the faulty application and re-publishing a previous version. Additionally, a bug preventing enterprise deployments via the Windows Update Standalone Installer has been fixed with KB5079391.

Critical ShareFile Flaws Lead to Unauthenticated RCE

www.securityweek.com · 3 months ago

Security researchers have identified two critical vulnerabilities in the ShareFile content collaboration platform that can be combined to achieve unauthenticated remote code execution. CVE-2026-2699 allows unauthorized access to administrative configuration pages through an Execution After Redirect flaw. Attackers can leverage this to modify ShareFile settings, including connecting to a malicious network and exfiltrating files. A second vulnerability, CVE-2026-2701, enables arbitrary file uploads, allowing attackers to deploy a web shell and gain full control of the system.

Infrastructure Engineer Pleads Guilty to Locking 254 Windows Servers at Former Employer

gbhackers.com · 3 months ago

A former infrastructure engineer has pleaded guilty to federal hacking and extortion charges after compromising his previous employer's network. Beginning in November 2023, the individual deployed a hidden virtual machine and used built-in administrative tools to delete domain administrator accounts and alter user passwords, effectively locking out the organization from 254 Windows servers and 3,284 workstations. He then demanded a ransom of 20 Bitcoin, threatening further disruption if unpaid. Investigators linked the attack to the engineer through remote access logs and an email account using the same username as the password changes.

CrowdStrike Next-Gen SIEM Can Now Ingest Microsoft Defender Telemetry

www.darkreading.com · 3 months ago

false

What 16 security engines found in 2,900 MCP servers

mcpampel.com · 3 months ago

false

Microsoft still working to fix Exchange Online mailbox access issues

www.bleepingcomputer.com · 3 months ago

Microsoft is working to resolve ongoing issues affecting access to Exchange Online mailboxes for Outlook mobile and macOS users. The problem, initially linked to a virtual account and tracked as EX1256020, resurfaced with a new tag EX1268771. Microsoft is restarting services to address the intermittent disruptions impacting users and continuing to investigate the underlying cause. Previously this month, Microsoft also resolved issues affecting Outlook web access and Microsoft Copilot sign-in.

Company that Secretly Records and Publishes Zoom Meetings

www.schneier.com · 3 months ago

A company called WebinarTV is secretly recording and publishing Zoom meetings. They search the internet for public Zoom meeting invites, join the meetings, and record them without using Zoom’s built-in recording features. This means Zoom is unable to prevent these recordings. The practice raises significant privacy and surveillance concerns.

UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack

thehackernews.com · 3 months ago

North Korean threat actors, tracked as UNC1069, successfully compromised the Axios npm package through a sophisticated social engineering campaign. Attackers impersonated a company founder to gain access to the maintainer's Microsoft Teams account, then deployed a remote access trojan to steal npm account credentials. This allowed them to publish two malicious versions of Axios, 1.14.1 and 0.30.4, containing the WAVESHAPER.V2 implant. The incident highlights the increasing risk to open-source maintainers and the potential for widespread impact given the popularity of compromised packages.

Kimsuky Uses Malicious LNK Files to Drop Python Backdoor

gbhackers.com · 3 months ago

The threat actor Kimsuky is employing malicious LNK files to deploy a Python-based backdoor, utilizing a more complex execution chain to evade detection. This new technique involves a LNK file launching PowerShell, which then initiates a sequence of XML, VBScript, PowerShell, and BAT scripts. The operation leverages Windows Task Scheduler, Dropbox for command and control, and bundled Python runtimes to establish persistence and exfiltrate data, often using filenames like "Resume (Sungmin Park).hwp.lnk." The backdoor itself offers capabilities such as file deletion, command execution, and data retrieval.

Mobile Attack Surface Expands as Enterprises Lose Control

www.securityweek.com · 3 months ago

Mobile device security is a growing concern for enterprises, with a fragmented and expanding attack surface. A recent analysis of over 1.7 million mobile devices revealed that 53% ran outdated operating systems, 18% connected to risky hotspots, and 8% experienced phishing attacks. Many popular apps contain known security flaws, and the emerging threat of Shadow AI poses a significant, often undetected risk. Adversaries are utilizing sophisticated spyware like Predator, Pegasus, and CVE-2025-43300, along with other vulnerabilities such as CVE-2025-24201, CVE-2025-10585, CVE-2025-48543, and CVE-2024-53104 to exploit weaknesses and compromise data. Organizations need to improve mobile device inventory, configuration management, and software update deployment to better defend against these evolving threats.

React2Shell Exploited in Large-Scale Credential Harvesting Campaign

www.securityweek.com · 3 months ago

A threat actor, identified as UAT-10608, is exploiting vulnerable Next.js applications in a large-scale credential harvesting campaign. The attacker is using automated scanning to target systems affected by CVE-2025-55182, also known as React2Shell, which allows for arbitrary code execution. Researchers have confirmed over 766 systems have been compromised, with more than 10,000 files collected, including sensitive data such as SSH keys, cloud credentials, and GitHub tokens. Compromised credentials should be rotated to prevent further damage.

CISA Includes TrueConf Security Flaw in KEV Catalog After Exploitation in the Wild

gbhackers.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability affecting the TrueConf Client to its list of known exploited vulnerabilities. This flaw, tracked as CVE-2026-3502, allows attackers to substitute malicious code for legitimate software updates, resulting in arbitrary code execution. CISA is urging all organizations to apply vendor mitigations and has set a patching deadline of April 16, 2026, for federal agencies. Failure to address this vulnerability could lead to unauthorized access and potential system takeover.

14,000+ F5 BIG-IP APM Instances Exposed Online as Attackers Exploit RCE Vulnerability

gbhackers.com · 3 months ago

Over 17,100 F5 BIG-IP Access Policy Manager devices are currently exposed online, creating a significant attack surface. The vulnerability, CVE-2025-53521, was initially classified as a denial-of-service flaw, but has now been confirmed as a remote code execution vulnerability. This allows attackers to potentially take control of affected systems and access internal networks, as these devices often sit at the network’s edge. The US Cybersecurity and Infrastructure Security Agency has added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog, urging immediate patching and increased security measures.

T-Mobile Sets the Record Straight on Latest Data Breach Filing

www.securityweek.com · 3 months ago

T-Mobile has clarified a recent data breach notification, stating it involved unauthorized access by a vendor employee impacting one customer account. The compromised data included full name, email address, physical address, account number, PIN, date of birth, driver’s license number, and Social Security number. Financial account information and call records were not affected, and the customer’s PIN has been reset. T-Mobile reported no credentials were compromised and has notified authorities and the affected customer.

Axios npm compromise traced to targeted social engineering attack

gbhackers.com · 3 months ago

The widely used Axios npm package was recently compromised due to a targeted social engineering attack. Attackers impersonated a legitimate company and gained access to the maintainer’s system, allowing them to publish malicious versions of the package containing a remote access trojan that affected macOS, Windows, and Linux systems. The attackers bypassed security measures by leveraging the maintainer’s authenticated environment, highlighting a vulnerability in the human layer of software supply chain security. This incident underscores the increasing risk to open-source maintainers and the need for stronger support and security practices.

North Korean Hackers Drain $285 Million From Drift in 10 Seconds

www.securityweek.com · 3 months ago

A North Korean threat actor likely orchestrated a sophisticated heist of $285 million from the decentralized finance platform, Drift. The attackers pre-planned the attack for eight days, creating infrastructure and pre-signing transactions to ensure rapid execution. They gained control of an admin key, created a fake market for a worthless token, disabled safety systems, and drained funds from multiple vaults within ten seconds before initiating a complex laundering operation across numerous wallets and blockchains. The sheer speed and complexity of the operation, involving over 860,000 transactions within 34 hours, has significantly complicated efforts to recover the stolen assets.