Tuesday 8 September 2026

The $320 Million "White Hat" Bitcoin Heist That Nobody Knows Whether to Celebrate

A self-described "white hat" crew just drained $320 million in Bitcoin from the Liquid Network — and they're promising to give most of it back once the bug is fixed.

Lead story

The $320 Million "White Hat" Bitcoin Heist That Nobody Knows Whether to Celebrate

Someone just walked off with 4,000 Bitcoin — worth roughly $320 million — from the Liquid Network, the Bitcoin sidechain operated by Blockstream. Their message to the world: relax, we're the good guys.

The self-described white-hat hackers exploited an undisclosed vulnerability in Liquid's bridge mechanism and drained the funds before, they claim, a malicious actor could. They've promised to return "most" of the Bitcoin once the vulnerability is patched and verified. Note the word "most." That hedge is doing a lot of work in an otherwise altruistic narrative.

Why Liquid matters. Liquid is not a scrappy DeFi experiment. It's a federated Bitcoin sidechain used by exchanges, trading desks, and institutional players to move large amounts of BTC quickly and confidentially. It's the kind of infrastructure that underpins real settlement flows — not just retail speculation. A vulnerability that lets someone drain the bridge is about as serious as it gets for a layer-2 Bitcoin network.

The "white hat" framing is genuinely complicated. In traditional software security, a white-hat researcher finds a bug, reports it privately, and waits for a fix. Draining $320 million first — and holding the funds as collateral — is a different posture entirely. It's closer to what the crypto community calls a "vigilante rescue": unauthorised, unilateral, and dependent entirely on the good faith of people who just proved they can keep $320 million without asking permission.

There's precedent. The 2021 Poly Network hack saw a thief return over $600 million after initially claiming they'd done it "for fun." The Euler Finance attacker returned $177 million in 2023 after an extended on-chain negotiation. In both cases, the funds came back — eventually, mostly. The track record is imperfect but not dismal.

What Blockstream has said. As of publication, the company has confirmed the incident is under investigation and that it is working to identify and patch the underlying flaw. It has not confirmed the attackers' white-hat claims, nor disputed them. The silence is strategic — the last thing you want to do is antagonise the people currently holding your users' funds.

What to watch. The key variables here are: whether the vulnerability is disclosed publicly and patched before the funds are returned (which would validate the white-hat claim); whether "most" ends up being 99% or something more creative; and whether regulators in any jurisdiction decide that "we meant well" isn't a valid defence for the largest Bitcoin theft in years.

For Australian crypto exchanges and institutional traders with Liquid Network exposure — and there are several — this is a live custody and counterparty risk question right now. The Australian Digital Asset Association has previously flagged the need for clearer custodial frameworks under existing financial services law; this incident makes that case harder to ignore.

The irony is that if these hackers are telling the truth, the Liquid Network may have just been saved by the very people who robbed it. The crypto industry has a complicated relationship with that kind of heroism — and so, increasingly, do regulators.

Also today

PEEP Toolkit Turns Your Browser Into a Silent Backdoor

Researchers have detailed PEEP, a post-exploitation framework that abuses Chrome and Edge by injecting a fake bookmarks extension directly into browser profiles — bypassing the Web Store and any user prompts by forging Chromium's own Secure Preferences file. It requires the attacker to already have admin or code-execution access, so it's a persistence tool rather than an initial foothold. Once in, it lets attackers execute host-level commands through the browser process. The technique is particularly nasty because browser extensions are rarely scrutinised the same way traditional malware artefacts are — and Chromium is everywhere, including in most Australian corporate environments.

The Hacker News ↗

Vishing, Token Theft, and Residential Proxies: Executives Are the Target

A threat cluster is running a slick multi-stage playbook against Microsoft 365 tenants: fake IT helpdesk calls to executives, adversary-in-the-middle token theft to defeat MFA, and sign-ins through residential proxies to evade geo-blocking. The operation specifically targets directors, VPs, and C-suite staff — people who have broad access and are used to being handed things quickly by IT. Once in, the attackers exfiltrate data and pivot to extortion. The combination of social engineering and technical token theft makes this hard to stop with any single control. Australian organisations running M365 should review conditional access policies and ensure executive accounts require phishing-resistant MFA.

The Hacker News ↗

N-able N-central Needs Its Fourth Hotfix in Five Weeks

N-able has pushed its fourth emergency hotfix for the N-central remote monitoring and management platform since early August — this time patching an unauthenticated remote code execution flaw. Every on-premises build below version 2026.3.1.14, including servers that installed Hotfix 3 the previous day, needs the update immediately. N-able's incident notice says the flaw has been exploited in the wild; its release notes hedge with "unconfirmed." That contradiction is itself a red flag. RMM platforms are prized targets because they sit inside the network with broad access to managed endpoints — making them the master key to every client an MSP serves. Australian MSPs relying on N-central should treat this as a P1.

The Hacker News ↗

Thomson Reuters C-Track Breach Hits Courts Across 11 US States

Thomson Reuters has disclosed a breach of C-Track, its court case-management platform, affecting judicial systems across 11 US states and Canada. An unauthorised party accessed C-Track files — the nature of which, in a court management context, likely includes case records, scheduling data, and potentially sensitive legal documents. Check Point's weekly threat report flags this alongside a separate warning about the Rhysida ransomware group's continued activity in Europe. Court administration systems are high-value targets precisely because they hold sensitive data and often run on legacy infrastructure. Thomson Reuters also operates significant legal and tax data services in Australia, though no AU exposure has been confirmed.

Check Point Research ↗

Nightmare Eclipse Drops Zero-Days for CrowdStrike, Nvidia, and Avast

A threat actor calling themselves Nightmare Eclipse has publicly released proof-of-concept exploit code targeting zero-day vulnerabilities in CrowdStrike Falcon, Nvidia drivers, and Avast's security software — all three chains leading to privilege escalation and a SYSTEM-level shell. The targets are striking: two of them are security products, meaning the tools organisations rely on to detect threats can themselves become the attack surface. There's no patch confirmed for any of the three at time of writing. If you're running CrowdStrike or Avast in your environment — and a significant portion of Australian enterprise does — this is worth watching closely until vendor advisories arrive.

SecurityWeek ↗

North Korea Embeds a Backdoor in HAProxy for Long-Term Espionage

North Korean hackers have deployed a new Linux espionage toolkit that buries a persistent backdoor inside HAProxy — the widely-used open-source load balancer found in countless server environments. The campaign is targeting automotive and media organisations in South Korea for what appears to be long-term surveillance rather than immediate disruption. HAProxy is popular precisely because it's lightweight and trusted, which makes it a smart place to hide. The technique echoes North Korea's broader pattern of embedding malware in legitimate infrastructure components where it's unlikely to attract scrutiny. Security teams running HAProxy in Linux environments should review binary integrity and watch for anomalous outbound connections.

SecurityWeek ↗

How a Lenovo Login Flaw Let Hackers Into 5,000 Dropbox Accounts

A vulnerability in Lenovo's single sign-on system allowed attackers to hijack Dropbox accounts that had been linked via Lenovo ID — the kind of "log in with your device account" convenience feature that ships quietly and gets forgotten. Researchers found the flaw could be exploited to gain access to roughly 5,000 Dropbox accounts without knowing the user's Dropbox credentials. It's a clean illustration of how OAuth and federated identity shortcuts create hidden attack surfaces: the weakest link isn't your password, it's the secondary identity provider you linked three years ago during a laptop setup wizard. Lenovo IDs are common in corporate fleet environments, which broadens the potential blast radius.

Graham Cluley / Bitdefender ↗

A Crossbench Bill Would Ban High-Risk Automation Across the APS

An Australian crossbench bill tabled in parliament this week would introduce whole-of-service safeguards on automated decision-making across the Australian Public Service, effectively banning high-risk automation without appropriate human oversight and review mechanisms. The proposal comes as AI-driven decisions are quietly spreading across welfare, immigration, and regulatory systems. Separately, The Mandarin reports that the Australian Federal Police has adopted responsible-use frameworks to guide its own AI law enforcement tools. Taken together, the week's signals suggest the federal government is navigating real pressure to formalise AI accountability — from both legislators and within agencies themselves.

The Mandarin ↗

NSW Police Gets $15M for Encrypted Device Forensics

The NSW Government has allocated an additional $15 million to NSW Police for digital forensics technology, specifically targeting the ability to access encrypted devices and platforms as part of an organised crime crackdown. The funding signals a deliberate push to close the gap between law enforcement capability and the encryption tools now routinely used by criminal networks. It also raises ongoing questions about the legal and technical frameworks governing device access — questions that intersect with the federal government's existing telecommunications assistance laws. For defenders, it's a reminder that endpoint encryption remains both a privacy protection and a law enforcement friction point.

iTnews ↗

Apple's September Launch: Foldable iPhone and a RAM-Driven Price Hike

Apple's September 9 event is expected to debut the company's first foldable iPhone Ultra alongside new AirPods and HomePod hardware. But the bigger story may be pricing: The Verge reports that soaring memory costs — driven by a global DRAM shortage — are forcing price increases across the iPhone line. Micron's supply constraints have rippled through the entire consumer electronics market, reversing decades of steady memory price declines. Analysts are calling it "chipflation." For Australian consumers, who already pay a premium on Apple hardware relative to US pricing, another price hike will land particularly hard — especially with exchange rate headwinds still in play.

The Verge ↗

Seattle Times and Newsday Join the Growing OpenAI Copyright Lawsuit Queue

Two more prominent US news organisations — the Seattle Times and Newsday — have sued OpenAI and Microsoft for copyright infringement, alleging their journalism was used to train AI models without permission or compensation. The suits arrive just as OpenAI began rolling out GPT-6 Astra, adding a pointed timing element to the legal filings. The cases join a growing pile of media litigation that OpenAI is managing alongside licensing deals struck with other publishers. The outcome of these cases will shape the economics of AI training data globally — including for Australian news publishers who are watching closely as they weigh their own options under the Copyright Act.

The Verge ↗

Sources consulted