GitHub said attackers accessed its internal repositories after an employee’s device was compromised through a malicious VS Code extension. The company says customer data appears unaffected, but thousands of internal repos may have been exposed and the investigation is ongoing.

A fake OpenAI repository on Hugging Face spread malware that stole crypto wallets, browser data, and developer credentials from Windows users. The fake project briefly became the platform’s top trending repo and reportedly reached around 244,000 downloads before it was removed.

A crypto trader known as Unihax0r lost over $200,000 after two of his wallets were drained across Ethereum, Base, and BSC in a fast multi-chain attack on 11 May 2026. Investigators believe the issue came from a private key leak linked to a Telegram trading bot called SIGMA, which may have exposed the wallets to the attacker.

A hacker claimed to have taken over 300,000 Polymarket user records and tried to sell them on the dark web. Polymarket denied any breach, saying the data is already public through its on-chain systems and tools.

Hackers used Gmail’s dot handling trick and a flaw in Robinhood’s account setup to send fake login alert emails that looked real. The emails came from Robinhood’s own system and tricked some users into clicking phishing links and entering sensitive details on fake websites.

ZetaChain paused cross-chain transfers after an attack hit its GatewayEVM contract, affecting only internal wallets and not user funds. The team has blocked the attack path and is investigating, as wider DeFi security concerns continue.

Scallop lost about 150,000 SUI after an attacker exploited an old rewards contract, while the main protocol and user funds were not affected. The bug let the attacker inflate rewards and drain the pool, showing risks from unused code still active on-chain.

Hackers stole about $292 million from KelpDAO’s bridge and used it on Aave, leaving over $236 million in bad debt. Justin Sun urged the attacker to negotiate returning the funds.

Drift Protocol was hit by a major exploit that drained about $295 million from its platform on Solana. It is also shifting its settlement system from USDC to USDT as part of the relaunch.

A cybercrime behind a $100 million fraud went to extraordinary lengths to destroy his former life—allegedly faking his own death and starting over a new leaf in a foreign country under a new identity—thinking he will never be discovered.