金融与数字资产安全一周快讯（8月17日—8月23日）Weekly Financial and Digital Asset Security Brief (Aug 17–23, 2026)
本期汇总银行 API、加密支付、交易平台、钱包、DeFi、跨链桥和稳定币安全动态，覆盖 8 月 17 日至 23 日的重要进展。This issue covers key developments in banking APIs, crypto payments, trading platforms, wallets, DeFi, bridges, and stablecoin security from August 17 to 23.
本周快讯This Week
Harmony 跨分片重放漏洞伪造 3.01 万亿枚 ONE，网络已回滚Harmony Rolls Back after Cross-Shard Replay Forged 3.01 Trillion ONE
攻击者利用跨分片收据重放缺陷伪造约 3.01 万亿枚 ONE，其中约 2.385 万亿枚被转移。Harmony 已回滚至攻击前检查点并丢弃伪造状态；该名义数量远超市场可承接规模，不等同于已实现美元损失。Attackers exploited a cross-shard receipt replay flaw to forge about 3.01 trillion ONE, transferring roughly 2.385 trillion. Harmony rolled back to a pre-attack checkpoint and discarded the forged state; the nominal token amount far exceeded market capacity and is not a realized dollar loss.
Maya Protocol 遭 6 个链式边缘漏洞攻击，损失约 170 万美元Maya Protocol Hit by Six Chained Edge-Case Bugs, Losing About $1.7 Million
攻击者串联 6 个软件缺陷，制造虚假池余额并提取约 4887 万 CACAO，随后兑换为比特币等真实资产；约 20.83 BTC 流向攻击者地址，直接损失约 170 万美元。The attacker chained six software flaws to create a false pool balance and withdraw about 48.87 million CACAO before converting it into Bitcoin and other real assets. Roughly 20.83 BTC reached the attacker, with direct losses estimated at $1.7 million.
BTCPay Server 严重漏洞被积极利用Critical BTCPay Server Vulnerability Actively Exploited
BTCPay Server 确认漏洞已被用于窃取部分用户资金，攻击者可获取 LND 管理 macaroon 并访问关联钱包。项目方要求立即升级至 2.4.2，并设立最高 3 BTC 的资金追回赏金。BTCPay Server confirmed that attackers exploited the flaw to steal funds by obtaining LND admin macaroon credentials and accessing connected wallets. The project urged an immediate upgrade to version 2.4.2 and offered a recovery bounty of up to 3 BTC.
Coldcard 固件熵值缺陷已确认损失 1778.84 BTCColdcard Firmware Entropy Flaw Causes 1,778.84 BTC in Confirmed Losses
Galaxy Research 已高置信度确认 190 名受害者、超过 8600 个地址共损失 1778.84 BTC，按报告时价格约合 1.127 亿美元；若计入中等置信度地址，潜在损失可达 2417.35 BTC。Galaxy Research confirmed with high confidence that 190 victims lost 1,778.84 BTC from more than 8,600 addresses, worth about $112.7 million at the time of reporting. Including medium-confidence sets would raise the potential total to 2,417.35 BTC.
MacSync Stealer 窃取浏览器凭证和加密钱包数据MacSync Stealer Targets Browser Credentials and Crypto Wallets
Microsoft Defender 将 30 多个域名与 MacSync Stealer 关联起来。该恶意软件通过 ClickFix 社工传播，使用 zsh Terminal 与 curl 获取载荷，重点窃取浏览器凭证和加密货币钱包数据。Microsoft Defender linked more than 30 domains to MacSync Stealer. The malware spreads through ClickFix social engineering, uses zsh and curl to fetch its payload, and targets browser credentials and cryptocurrency-wallet data.
Lloyds Banking App 漏洞泄露 44.8 万客户交易数据Lloyds Banking App Bug Exposes Transaction Data of 448,000 Customers
Lloyds Banking Group 的夜间软件更新引入 API 缺陷，导致部分 Lloyds、Halifax 和 Bank of Scotland App 用户看到他人的交易信息；集团确认最多 447936 名客户可能受到影响。An overnight software update introduced an API defect that caused some Lloyds, Halifax, and Bank of Scotland app users to see other customers' transaction information. Lloyds Banking Group said up to 447,936 customers may have been affected.
Google 广告钓鱼盗走 Hyperliquid 用户 55 万美元Google-Search Ad Phishing Steals $550,000 from Hyperliquid Users
攻击者购买 Google 搜索广告，把用户引导至伪造交易平台页面实施钓鱼，说明交易平台品牌和付费搜索结果已成为新的攻击入口。Attackers bought Google search ads and directed users to a fake trading-platform page to phish their assets, showing how exchange brands and paid search results are becoming attack entry points.
Immunefi：2026 年上半年加密攻击 207 起，损失 9.72 亿美元Immunefi Counts 207 Crypto Attacks and $972 Million in H1 2026 Losses
Immunefi 统计显示，2026 年上半年加密攻击达到 207 起并创纪录，损失约 9.72 亿美元；攻击更频繁但单次损失下降，攻击者逐渐转向私钥和跨链配置等基础设施层。Immunefi counted a record 207 crypto attacks and about $972 million in losses in the first half of 2026. Attacks became more frequent while average losses fell, with attackers shifting toward infrastructure such as private keys and cross-chain configuration.
韩国 Delio CEO 因 5000 万美元加密诈骗被判 15 年Delio CEO Sentenced to 15 Years for $50 Million Crypto Fraud
韩国 Delio 负责人因约 5000 万美元加密诈骗被判 15 年，是韩国加密行业迄今最严厉的高管刑罚之一，反映交易平台客户资产与经营透明度的合规风险。The head of South Korean crypto platform Delio received a 15-year sentence for approximately $50 million in crypto fraud, one of the harshest executive sentences in the country’s crypto sector and a reminder of customer-asset and transparency risks.
Tether 获 KPMG 首次全面审计清洁意见Tether Receives a Clean Opinion in Its First Full KPMG Audit
KPMG U.S. 对 Tether International 的 2025 年完整财务报表出具无保留意见，审计覆盖资产、负债、交易、估值和储备相关证据；这是 Tether 首次完成全面独立财务报表审计。KPMG U.S. issued an unqualified opinion on Tether International's full 2025 financial statements, covering assets, liabilities, transactions, valuations, and reserve evidence. This was Tether's first completed full independent financial-statement audit.
Interpol I-GRIP 阻止 660 万美元 BEC 诈骗Interpol I-GRIP Blocks $6.6 Million in BEC Fraud
Interpol 的 First Light 2026 行动共封锁 31014 个银行账户；其中新加坡与阿曼通过 I-GRIP 快速止付机制拦截了一笔与商业邮件诈骗有关的 660 万美元跨境转账。Interpol's Operation First Light 2026 blocked 31,014 bank accounts. Singapore and Oman used the I-GRIP rapid stop-payment mechanism to intercept a $6.6 million cross-border transfer linked to business email compromise.
Coreum Bridge 因存款验证逻辑缺陷被攻击Coreum Bridge Attacked through a Deposit-Verification Logic Flaw
Coreum（现 tx）与 XRP Ledger 连接桥错误地把未转入储备地址的交易识别为真实存款，导致中继器签署提款；约 20 万 XRP 在不到两小时内被转出。The bridge between Coreum (now tx) and the XRP Ledger mistakenly treated transactions that never reached its reserve address as valid deposits, causing relayers to authorize withdrawals. Nearly 200,000 XRP was drained in under two hours.
Coinsbuy 钱包被盗 790 万美元Coinsbuy Wallet Drained of $7.9 Million
B2B 加密支付处理商 Coinsbuy 的 Ethereum 与 TRON 钱包在同一轮攻击中被转走约 790 万美元。链上分析显示资金经多项兑换服务转移，攻击入口当时尚未确认。Coinsbuy, a B2B crypto-payment processor, lost about $7.9 million from Ethereum and TRON wallets in a coordinated drain. On-chain analysis traced funds through several swap services, while the initial attack vector remained unconfirmed.
FoxMarket 闪电贷攻击操纵 AMM 报价FoxMarket Flash-Loan Attack Manipulates AMM Pricing
攻击者操纵 Pancake AMM 现货报价，Treasury 依赖过时价格铸造超额代币，造成约 11.87 万美元损失。Attackers manipulated Pancake AMM spot pricing. The Treasury trusted a stale value and minted excess tokens, causing a loss of about $118,700.
CryptoJS 弱随机数漏洞影响五款钱包，已确认损失至少 569 万美元CryptoJS Weak-Randomness Flaw Affects Five Wallets with at Least $5.69 Million Lost
Coinspect 确认 RRWallet、Bexo、NanChat、Bitcoin Libre 和 Milo 使用了 CryptoJS 弱随机数实现生成恢复短语，使种子空间可被枚举；两轮链上盗取的已测算损失至少为 569 万美元。Coinspect confirmed that RRWallet, Bexo, NanChat, Bitcoin Libre, and Milo used weak CryptoJS randomness to generate recovery phrases, making the seed space enumerable. Two on-chain drain waves caused measured losses of at least $5.69 million.
LOOPSDAO 因缺少 TWAP 保护遭价格操纵LOOPSDAO Price Manipulation Exploits Missing TWAP Protection
无 TWAP 保护的薄流动性交易对被闪电贷操纵，攻击者燃烧 Cake-LP 并提取膨胀金额，损失约 69 万美元。A thin-liquidity pair without TWAP protection was manipulated through a flash loan. The attacker burned Cake-LP and extracted inflated value, causing a loss of about $690,000.
River Bank 勒索软件攻击后称被盗数据已删除River Bank Says Stolen Data Was Deleted after Ransomware Attack
River Bank 这家银行控股公司确认 6 月遭受勒索软件攻击，并称黑客已经删除被盗数据，但具体影响范围以及数据是否仍可恢复尚未公开。River Bank, a bank holding company, confirmed a ransomware attack in June and said the attackers had deleted the stolen data. The full impact and whether the data remains recoverable have not been publicly disclosed.