Passkey flaws, $130M wallet heist, and 1,300+ npm packages hit

Google synced passkey flaws allow silent account takeover

Unit 42 research has uncovered multiple flaws in Google’s synced passkey ecosystem that allow an attacker to take over accounts protected by synced passkeys without user interaction. The issues stem from Chrome’s implementation on Windows, where local folders storing passkey data are accessible without elevated privileges, and where Chrome can request signatures from a hardware-bound device identity key without triggering a PIN or biometric prompt. This allows an attacker to silently forward the signature and take over a targeted account.

Multiple Flaws in Google’s Synced Passkey Implementation Allow Attackers to Take Over Your Accounts →

Hackers steal over $130 million from Coldcard hardware wallets

Hackers have stolen around $130 million from users of Coldcard hardware wallets, made by Coinkite, by exploiting a flaw in how the devices generated seed phrases. According to blockchain security firms and Galaxy Research, at least a dozen different hackers are targeting Bitcoin owners who use the device, and more than one group appears responsible. Security researchers at Block found the seed phrases were predictable, allowing attackers to brute-force and generate them without physical access to the devices.

Hackers steal over $130 million by exploiting bug in offline hardware wallets →

ChainDrop worm compromises 1,300+ npm packages

The self-propagating malware ChainDrop has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the npm registry. The supply-chain attack began after the threat actor compromised the GitHub account of Keyv’s maintainer, spreading to packages associated with Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. Because the packages were built and published through legitimate GitHub Actions workflows, the compromised releases carried valid provenance information.

Massive ChainDrop npm supply-chain attack infects hundreds of packages →

N-able issues hotfix for N-central ‘god mode’ flaw under active attack

Security experts are urging managed service providers to patch immediately after N-able issued a hotfix for a critical vulnerability in its N-central platform. The flaw, tracked as CVE-2026-18577, affects all versions of N-central across on-premises and hosted deployments. Researchers at Huntress said the vulnerability grants hackers unauthenticated “god mode” access, allowing them to run scripts, push tools, and open remote sessions across every downstream endpoint the server manages.

MSPs urged to patch immediately after N-able issues hotfix for N-central ‘god mode’ flaw →

Boltz suspends Bitcoin swaps citing AI-assisted attacks

Boltz, a non-custodial Bitcoin swap service, has suspended its swap service indefinitely, citing a surge in AI-assisted attacks that are outpacing its ability to patch vulnerabilities. The company said swaps are disabled until further notice, with no ETA for return. Boltz lets users move Bitcoin between the Lightning Network and the blockchain’s base layer without taking custody of funds, and the platform currently holds around $262,000 in total value locked.

This Bitcoin Bridge Shut Itself Down Because AI Was Finding Bugs Too Fast →