The Record from Recorded Future News Jonathan Greig
September 10th, 2025
Nearly 200,000 Solana coins were stolen from SwissBorg, or about 2% of its assets, according to the platform's CEO. The company pledged to pay users back.
The SwissBorg platform said about $41 million worth of cryptocurrency was stolen during a cyber incident affecting a partner company this week.
The Switzerland-based company confirmed industry reports of an incident but said its platform was not hacked. CEO Cyrus Fazel explained that an external decentralized finance wallet held by a partner was breached on Monday.
The stolen funds represent 2% of SwissBorg’s total assets, according to Fazel, and about 1% of users had cryptocurrency stolen. In total, 192,600 Solana (SOL) coins were stolen — which is worth more than $41 million as of Tuesday afternoon.
In an update on Tuesday, the company pledged to make all affected customers whole and is still investigating the incident.
SwissBorg officials said they are working with several blockchain security firms to investigate the incident and thanked Chainalysis as well as cryptocurrency investigator ZachXBT and others for their assistance in addressing the issue.
The partner company that was attacked, Kiln, released its own statement confirming that it was suffering from a cyberattack and said the root cause has been discovered. Kiln is a cryptocurrency infrastructure company.
“SwissBorg and Kiln are investigating an incident that may have involved unauthorized access to a wallet used for staking operations. The incident resulted in Solana funds being improperly removed from the wallet used for staking operations,” Kiln said in a blog post.
“Upon detection, SwissBorg and Kiln immediately activated an incident response plan, contained the activity, and engaged our security partners. SwissBorg has paused Solana staking transactions on the platform to ensure no other customers are impacted.”
Experts explained that the attack was sourced back to Kiln’s application programming interface (API) — which is used by SwissBorg to communicate with Solana. The hackers breached the API and stole funds through it.
Swissborg said it is also working with law enforcement on the incident and is trying to recover the stolen funds.
Fazel published a video about the incident, telling users that the platform has dealt with multiple cyberattacks in the past.
“We have all the agencies around the world that are really helping us to make sure that we are looking at every transaction. Some of the transactions actually have been blocked. All the different exchanges around the world are helping us,” he said.
“We have enough funds, and we'll find a compensation that will match your expectation. We are doing everything in our effort to make sure that this incident, as big as it is, will eventually be a small drop in the ocean of SwissBorg.”
The attack comes less than a month after a popular cryptocurrency platform in Turkey temporarily suspended deposits and withdrawals following the theft of $49 million worth of coins.
Overall, more than $2 billion in cryptocurrency was stolen by hackers in the first half of 2025, according to the blockchain security firm Chainalysis.
The Spanish police have arrested two individuals in the province of Las Palmas for their alleged involvement in cybercriminal activity, including data theft from the country's government.
The duo has been described as a "serious threat to national security" and focused their attacks on high-ranking state officials as well as journalists. They leaked samples of the stolen data online to build notoriety and inflate the selling price.
"The investigation began when agents detected the leakage of personal data affecting high-level institutions of the State across various mass communication channels and social networks," reads the police announcement.
"These sensitive data were directly linked to politicians, members of the central and regional governments, and media professionals."
The first suspect is believed to have specialized in data exfiltration, while the second managed the financial part by selling access to databases and credentials, and holding the cryptocurrency wallet that received the funds.
The two were arrested yesterday at their homes. During the raids, the police confiscated a large number of electronic devices that may lead to more incriminating evidence, buyers, or co-conspirators.
Cyber criminals bribed and recruited a group of rogue overseas support agents to steal Coinbase customer data to facilitate social engineering attacks. These insiders abused their access to customer support systems to steal the account data for a small subset of customers. No passwords, private keys, or funds were exposed and Coinbase Prime accounts are untouched. We will reimburse customers who were tricked into sending funds to the attacker. We’re cooperating closely with law enforcement to pursue the harshest penalties possible and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack.
What happened
Criminals targeted our customer support agents overseas. They used cash offers to convince a small group of insiders to copy data in our customer support tools for less than 1% of Coinbase monthly transacting users. Their aim was to gather a customer list they could contact while pretending to be Coinbase—tricking people into handing over their crypto. They then tried to extort Coinbase for $20 million to cover this up. We said no.
What they got
Name, address, phone, and email
Masked Social Security (last 4 digits only)
Masked bank‑account numbers and some bank account identifiers
Government‑ID images (e.g., driver’s license, passport)
Account data (balance snapshots and transaction history)
Limited corporate data (including documents, training material, and communications available to support agents)
Europol, the European Union's law enforcement agency, confirmed that its Europol Platform for Experts (EPE) portal was breached and is now investigating the incident after a threat actor claimed they stole For Official Use Only (FOUO) documents containing classified data.
#Breach #Computer #Data #EPE #Europol #InfoSec #Leak #Security #Theft
Microsoft warns that the Russian APT28 threat group exploits a Windows Print Spooler vulnerability to escalate privileges and steal credentials and data using a previously unknown hacking tool called GooseEgg.
#APT28 #Computer #Credential #Escalation #Exploit #GooseEgg #InfoSec #NSA #Print #Privilege #Security #Spooler #Theft #Windows
Senior execs' emails accessed in network breach that wasn't caught for 2 months.
Microsoft on Friday revealed that it was the target of a nation-state attack on its corporate systems that resulted in the theft of emails and attachments from senior executives and other individuals in the company's cybersecurity and legal departments.
The Windows maker attributed the attack to a Russian advanced persistent threat (APT) group it tracks as Midnight Blizzard (formerly Nobelium), which is also known as APT29, BlueBravo, Cloaked Ursa, Cozy Bear, and The Dukes.
In a 'confidential' email notification sent by Okta and seen by BleepingComputer, the company states that attackers gained access to its GitHub repositories this month and stole the company's source code.
Cybereason recently an attack assessed to be the work of Chinese APT Winnti that operated undetected, siphoning intellectual property and sensitive data - the two companion reports examine the tactics and techniques of the overall campaign as well as more detailed analysis of the malware arsenal and exploits used...
