Mercado Bitcoin attack reaches hot wallets and deposit addresses across…XCPE firmware backdoor turns 1.3 million Android devices…WorkOS breach exposes customer conversations through an AI-assisted…NCSC says AI will amplify long-tolerated technical debt
Mercado Bitcoin attack reaches hot wallets and deposit addresses across ten chains
The exchange stopped deposits and withdrawals after an attack reached hot wallets; independent tracing indicates the signing exposure extended to thousands of customer deposit addresses.
Security.io Intelligence Desk · Tuesday, 3 November 2026
Executive consequence
Mercado Bitcoin confirmed a security incident on 2 November and suspended deposits and withdrawals. Bloomberg Línea reported an estimated US$40 million hot-wallet loss.
Decision today
Freeze trust in all legacy deposit addresses and signing paths pending cryptographic re-keying.
Google Threat Intelligence Group and Synthient reported that the XCPE firmware backdoor was pre-installed across Android device brands and connected more than 1.3 million devices to criminal affiliate infrastructure.
Do today
Query DNS, proxy and firewall telemetry for the published XCPE infrastructure.
WorkOS confirmed unauthorised access to an internal sales application and said business contacts, account histories, conversation summaries, Slack excerpts and operational metadata were accessed. It reported no evidence that customer application data or production services were reached.
Do today
Verify WorkOS notifications through a trusted contact channel.
The NCSC's new annual review and AI-cyber assessment say AI is highly likely to increase the speed, scale and efficiency of existing hostile operations.
Do today
Fund the highest-risk legacy-technology removals with named executive owners.
WordPress fixed CVE-2026-119977 in version 7.1.4 and branch-specific backports. The flaw exposes a predictable staged installer during full-package upgrades, allowing unauthenticated remote code execution if an attacker wins a short race.
Do today
Block web access to wp-content/upgrade before upgrading affected sites.
