Sometimes the difference between security and compromise comes down to a single click – and a healthy dose of suspicion. And it’s because scammers are getting increasingly sophisticated with their phishing attempts. It’s to the point where even following standard security best practices isn’t enough to protect you. Case in point: last week’s near-successful phishing attack on Zach Latta.
Related Posts
Coinbase Avoids a Major Supply Chain Attack On Its Blockchain AI Toolkit
Coinbase, the largest crypto exchange in the US, has successfully evaded a supply chain attack that could have compromised its open-source infrastructure.
On March 23, Yu Jian, founder of blockchain security firm SlowMist, flagged the incident in a post on X, referencing a report from Unit 42, the threat intelligence division of Palo Alto Networks.
How Coinbase Stopped a Major Cyber Attack
According to Unit 42, the attacker targeted ‘agentkit’, an open-source toolkit managed by Coinbase that supports blockchain-based AI agents.
The threat actor forked agentkit and onchainkit repositories on GitHub, inserting malicious code intended to exploit the continuous integration pipeline. The suspicious activity was first detected on March 14, 2025.
“The payload was focused on exploiting the public CI/CD flow of one of their open source projects – agentkit, probably with the purpose of leveraging it for further compromises,” Unit 42 reported.
The attacker exploited GitHub’s “write-all” permissions, which allowed the injection of harmful code into the project’s automated workflow. This method could have enabled access to sensitive data and created a path for broader compromises.
However, Unit 42 reported that the payload collected sensitive information. It did not contain advanced malicious tools like remote code execution or reverse shell exploits.
Meanwhile, Coinbase responded quickly, collaborating with security experts to isolate the threat and apply necessary mitigations. This rapid action helped the company avoid deeper infiltration and prevented potential damage to its infrastructure.
The stakes were high considering Coinbase’s standing as the largest crypto exchange in the US and a key custodian for spot Bitcoin ETFs.
A breach of this nature could have caused major disruption across the crypto industry, especially after Bybit’s recent $1.4 billion security incident.
Despite the failed attempt, the attacker has since shifted focus to a larger campaign now drawing global attention.
In light of this, SlowMist founder advised developers using GitHub Actions—especially those working with tj-actions or reviewdog—to audit their systems and confirm that no secrets have been exposed.
“If your company uses reviewdog or tj-actions, do a thorough self-examination,” Yu Jian stated on X.
This incident highlights the growing importance of securing open-source tools as the crypto ecosystem expands. Data from DeFillama shows that the crypto industry has recorded exploits of more than $1.5 billion this year.
The post Coinbase Avoids a Major Supply Chain Attack On Its Blockchain AI Toolkit appeared first on BeInCrypto.
BlackRock’s ETHA Surges Past $1 Billion in Net Inflows
BlackRock’s iShares Ethereum Trust (ETHA), the first spot ether exchange-traded fund (ETF) to launch in the United States, has surpassed…
US Bitcoin ETF Holdings Fall Below Satoshi As Outflows Continue
Bitcoin ETF outflows have nearly amounted to $750 million in the last two days as the crypto market consistently fell. BlackRock, the largest issuer, has offloaded around 2,000 BTC in the previous 24 hours.
Together, the ETF issuers sold off enough BTC that they collectively hold less than Satoshi. They surpassed him three months ago and continued buying huge amounts of Bitcoin, indicating truly massive sales.
Bitcoin ETF Outflows Continue
Since the Bitcoin ETFs first got SEC approval last year, they’ve had a transformative impact on the market. Lately, however, they’ve been turning bearish.
Towards the end of February, the market saw $2.7 billion in outflows, and this trend continued. The last four consecutive weeks had outflows, and the market already lost nearly $750 million this week alone.
This marks the seventh consecutive day of outflows for this ETF market. IBIT, BlackRock’s product, led these losses with $151 million in the last 24 hours.
In mid-February, some analysts began speculating that BlackRock would begin selling its Bitcoin, and ETF analyst Shaun Edmondson noticed how large of a trend it’s becoming:
“I know the markets are very ‘risk off’ at the moment with the Tariff uncertainty, but this is yet another outflow day from the US Spot ETFs, collectively now falling below Satoshi again. Given the bullish narrative from the SEC, Strategy raising 21 billion, State [Bitcoin Reserve] race and National [Bitcoin Reserve] bill, I find this a little surprising,” Edmondson claimed.
BlackRock alone has offloaded around 2,000 BTC since Edmondson posted yesterday’s daily tallies. It’s unclear how far the ETF issuers want to take this trend, but these Bitcoin sales are very concerning.
These issuers surpassed Satoshi’s Bitcoin holdings in December, so these outflows have already eaten up three months’ worth of vociferous purchasing.
Still, despite this ETF pessimism, Bitcoin’s actual price could be doing a lot worse. The entire crypto market has been hit with massive outflows, and BTC fell accordingly.
However, the US CPI report this morning was better than anticipated, which allowed Bitcoin a little breathing room. It’s anyone’s guess, however, how long this reprieve will actually last.
The post US Bitcoin ETF Holdings Fall Below Satoshi As Outflows Continue appeared first on BeInCrypto.