Feb 24, 2026
1 new drain, 1 update.
New
-
Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down
Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published.
People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)·Multiple EVM chains·Since Feb 24, 2026·
Updated
-
Critical◐Partly contained
IoTeX ioTube bridge drained of about $4.4M after attacker abused a compromised employee machine
On 21 February 2026 an attacker who had compromised an IoTeX employee's machine, reportedly through social engineering, upgraded the ioTube bridge's Ethereum-side Validator contract to a malicious version. That let them drain about $4.4M in bridge reserves (WBTC, ETH, USDC, USDT, DAI and others) and mint 410M CIOTX. IoTeX froze about 45M IOTX in attacker wallets, paused its chain for three days and opened a claims portal for affected users.
IoTeX ioTube bridge (Ethereum side)·Ethereum·$4.4M stolen·Since Feb 21, 2026·