Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Investment Banking/Venture

Breach intelligence, attack campaigns, and threat reports targeting the Investment Banking/Venture sector.

89 threat reports
Page 1 of 8
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Investment Banking/Venture Threat Reports

Showing 1–12 / 89 reports
MetaMask Infrastructure Breach: How Validator Compromises Threaten DeFi Security
MetaMask Infrastructure Breach: How Validator Compromises Threaten DeFi Security
Financial Services1 month ago

MetaMask Infrastructure Breach: How Validator Compromises Threaten DeFi Security

In October 2026, MetaMask disclosed an ongoing infrastructure security incident affecting its validator operations within its non-custodial staking services. The cryptocurrency wallet provider took immediate precautionary measures by exiting affected Ethereum validators from its staking operations, coordinating with clients and partners including Lido Finance. While MetaMask stated there was no immediate threat to user wallets and emphasized the non-custodial nature of their services, the incident prompted the exit of validators by October 7th, potentially incurring rewards forfeitures and downtime penalties to mitigate network risks. This incident highlights the growing sophistication of attacks targeting cryptocurrency infrastructure and the interconnected nature of DeFi protocols, as validators play critical roles in blockchain security and transaction verification across multiple platforms.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
MetaMask Security Incident Triggers Emergency Ethereum Validator Exit
MetaMask Security Incident Triggers Emergency Ethereum Validator Exit
Financial Services1 month ago

MetaMask Security Incident Triggers Emergency Ethereum Validator Exit

MetaMask disclosed an ongoing security incident in October 2026 affecting part of its infrastructure, prompting the precautionary exit of affected Ethereum validators from its non-custodial staking operations. While the company stated no immediate threat to MetaMask wallets was identified, the incident forced coordination with external partners and security advisors to address and remediate the issue. The incident impacted MetaMask's validator operations within the Lido protocol, with all affected validators expected to complete the exit process by October 7, 2026, potentially incurring foregone rewards and downtime penalties. This incident highlights the growing sophistication of attacks targeting cryptocurrency infrastructure and staking services, reflecting broader trends in threat actors increasingly focusing on decentralized finance (DeFi) platforms and blockchain infrastructure as high-value targets with significant financial impact potential.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Vietnamese Cybercriminal Charged in $16 Million Pig Butchering Cryptocurrency Scam
Vietnamese Cybercriminal Charged in $16 Million Pig Butchering Cryptocurrency Scam
Financial Services1 month ago

Vietnamese Cybercriminal Charged in $16 Million Pig Butchering Cryptocurrency Scam

A Vietnamese national, Trung Nguyen Van, was arrested at the US-Mexico border and charged with money laundering for his role in a massive pig butchering cryptocurrency scam that defrauded victims of over $16 million. Van operated between February 2018 and December 2024, with his crypto wallets receiving approximately $53 million from wire fraud schemes targeting US citizens. The scammer used a fake investment platform called 'Triangle' to lure victims into transferring cryptocurrency, which was then moved to private, unhosted wallets off centralized blockchain networks, making recovery nearly impossible. This case highlights the growing sophistication of cryptocurrency-based social engineering attacks, which accounted for $8.6 billion in losses in 2025 according to FBI reports. As pig butchering scams increasingly target high-net-worth individuals through social media and dating platforms, organizations face heightened risks from both direct targeting and employee victimization that could compromise corporate assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
North Korean Hackers Steal $351.6M from Bitget in Sophisticated Backend Compromise
Bitget's $351.6M Crypto Theft: How North Korean Hackers Exploited Backend Vulnerabilities
Financial Services1 month ago

North Korean Hackers Steal $351.6M from Bitget in Sophisticated Backend Compromise

On September 24, 2026, cryptocurrency exchange Bitget suffered a massive security breach resulting in the theft of $351.6 million from hot and warm wallets. Suspected North Korean threat actors compromised a critical backend system within Bitget's wallet infrastructure, used it to spoof transaction data, and triggered the authorization process to move funds out. The attack affected multiple cryptocurrency assets including ETH, XRP, BNB, AVAX, USDT, and USDC across seven different blockchain networks. While customer account balances remained accurate and trading continued normally, withdrawals were temporarily suspended as a precautionary measure during the ongoing investigation. This incident highlights the continued escalation of North Korean state-sponsored cryptocurrency theft operations, representing one of the largest single exchange compromises in 2026. The sophisticated backend compromise demonstrates evolving attack techniques that bypass traditional security controls, emphasizing the urgent need for enhanced infrastructure protection and transaction authorization mechanisms in the rapidly growing digital asset sector.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
RatHat Malware: The Dawn of AI-Powered Android Banking Trojans
RatHat Malware: The Dawn of AI-Powered Android Banking Trojans
Banking/Mortgage1 month ago

RatHat Malware: The Dawn of AI-Powered Android Banking Trojans

RatHat is a sophisticated Android banking trojan discovered in September 2026 that represents a significant evolution in mobile malware capabilities. Developed by Chinese threat actors, the malware combines traditional Android Remote Access Trojan (RAT) functionality with artificial intelligence-powered interface automation. RatHat spreads through malvertising campaigns, SMS phishing, and fraudulent APK downloads outside Google Play Store. The malware exploits Android's Accessibility permissions to enable Developer Options and Wireless Debugging, establishing persistent shell-level access through dual Go-based agents that provide mutual restoration capabilities. What makes RatHat particularly dangerous is its AI-powered navigation system that serializes Android's Accessibility tree into XML and leverages external AI assistants to intelligently navigate device interfaces, making remote control operations more adaptive than traditional script-based automation. The malware targets banking and cryptocurrency applications with HTML overlays, intercepts SMS messages and notifications for OTP theft, and employs sophisticated anti-removal mechanisms including fake Google Play error messages. This incident highlights the emerging convergence of AI technology with cybercriminal operations, representing a new paradigm where malware can adapt and respond to user interface changes in real-time without requiring constant operator intervention or frequent code updates.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Revolut's 2026 Social Engineering Breach: When Trust Becomes a Vulnerability
Revolut's 2026 Social Engineering Breach: When Trust Becomes a Vulnerability
Financial Services1 month ago

Revolut's 2026 Social Engineering Breach: When Trust Becomes a Vulnerability

In September 2026, fintech giant Revolut disclosed a targeted social engineering attack where threat actors impersonated a government agency to fraudulently obtain sensitive customer data. The attackers used valid domain authentication credentials to request personally identifiable information via email, successfully deceiving Revolut into sharing financial records, passport copies, transaction histories, and account details of high-net-worth customers. The company immediately blocked the fraudulent address and notified relevant authorities upon discovering the deception, though the exact number of affected customers remains undisclosed. This incident highlights the growing sophistication of social engineering attacks targeting financial institutions and the critical need for enhanced verification protocols when handling government data requests, particularly as threat actors increasingly exploit trusted communication channels to bypass security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Trezor's Third-Party Email Provider Breach Exposes 347,000 Users to Cryptocurrency Phishing Campaign
Trezor's Third-Party Email Provider Breach Exposes 347,000 Users to Cryptocurrency Phishing Campaign
Financial Services1 month ago

Trezor's Third-Party Email Provider Breach Exposes 347,000 Users to Cryptocurrency Phishing Campaign

In September 2026, cryptocurrency hardware wallet manufacturer Trezor disclosed a sophisticated phishing campaign targeting 347,000 users following a breach of their third-party email provider Brevo. Threat actors compromised Brevo's systems and sent convincing phishing emails claiming a critical hardware vulnerability in Trezor devices, tricking 2,500 users into clicking malicious links before the campaign was shut down within 20 minutes. This incident represents Trezor's third major security breach in recent years, following previous compromises of their support portal and shipping provider. This attack demonstrates the evolving sophistication of supply chain targeting, where attackers compromise trusted third-party service providers to reach high-value cryptocurrency users with credible social engineering tactics.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover
Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover
Financial Services2 months ago

Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover

In September 2026, Bitcoin wallet company Alby disclosed a critical vulnerability in Alby Hub versions v1.7.0 through v1.18.5 that allowed attackers to completely take over internet-exposed Lightning wallets and drain funds. The flaw affected self-hosted Bitcoin wallets where owners had inadvertently exposed their Hub management interfaces to the public internet, often following Alby's own documentation that recommended such configurations. At least one user was confirmed affected, with the company providing limited details about the vulnerability mechanism pending responsible disclosure. The incident highlights the ongoing security challenges in cryptocurrency infrastructure, particularly as Bitcoin adoption accelerates and self-custody solutions become more mainstream. With ransomware groups increasingly targeting cryptocurrency platforms and the rise of state-sponsored attacks on financial infrastructure, vulnerabilities in wallet software present critical risks to both individual users and the broader digital asset ecosystem.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Liquid Network Suffers $320M Bitcoin Theft Through Elements Software Vulnerability
Liquid Network Suffers $320M Bitcoin Theft Through Elements Software Vulnerability
Financial Services2 months ago

Liquid Network Suffers $320M Bitcoin Theft Through Elements Software Vulnerability

In September 2026, unknown attackers claiming to be white hat hackers exploited a vulnerability in the Elements software powering Liquid Network's Bitcoin sidechain, withdrawing nearly 4,000 bitcoin worth approximately $320 million. The attackers used a bug in Elements to create unauthorized L-BTC tokens and then executed a peg-out transaction through SideSwap's authorization key, draining 95% of Liquid's bitcoin reserves. After communicating with Blockstream through encrypted messages embedded in Bitcoin transactions, the attackers returned 3,400 bitcoin but retained approximately 598.5 bitcoin worth $47 million. This incident highlights the growing sophistication of cryptocurrency protocol attacks and the blurred lines between legitimate security research and extortion in the DeFi ecosystem, particularly as Bitcoin layer-2 solutions become increasingly targeted by threat actors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Phantom Deal Campaign Exploits M&A Processes in Sophisticated Enterprise Fraud
Phantom Deal Campaign Exploits M&A Processes in Sophisticated Enterprise Fraud
Investment Banking/Venture2 months ago

Phantom Deal Campaign Exploits M&A Processes in Sophisticated Enterprise Fraud

The 'Phantom Deal' campaign represents a sophisticated evolution of advance fee scams targeting large enterprises through fake merger and acquisition proposals. Threat actors conducted extensive reconnaissance on companies like Gen (Norton/Avast parent company), impersonating executives via WhatsApp and creating fraudulent documentation from legitimate firms like PwC. The attackers attempted to trick employees into authorizing substantial financial transfers, with one attempt involving €626,735.45, by leveraging detailed corporate intelligence and social engineering tactics that exploited M&A processes and confidentiality requirements. This campaign highlights the growing sophistication of business email compromise attacks as threat actors increasingly target high-value corporate transactions. With M&A activity remaining robust and remote work normalizing digital-only communications, similar social engineering campaigns pose escalating risks to enterprise financial controls and decision-making processes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cronos Blockchain Halts After $74M Tectonic Protocol Exploit
Financial Services2 months ago

Cronos Blockchain Halts After $74M Tectonic Protocol Exploit

In August 2026, the Cronos blockchain network experienced a devastating $74 million exploit targeting the Tectonic DeFi lending protocol. Attackers artificially inflated the price of Tectonic's TONIC token by 100 times within 20 minutes, then used it as collateral to borrow legitimate assets. While the total exploit value reached $74 million, attackers only managed to extract approximately $6 million in Ethereum before Cronos validators executed an emergency consensus halt, freezing the blockchain to prevent further damage. The incident reduced Tectonic's total value locked from $122 million to under $3 million. This incident highlights the growing sophistication of DeFi price manipulation attacks and demonstrates how attackers are exploiting oracle vulnerabilities and lending protocol weaknesses to execute large-scale thefts. The rapid response by blockchain validators represents an evolution in DeFi incident response capabilities, though it raises questions about decentralization versus security trade-offs.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Provenance Blockchain State Divergence: $500K DeFi Vulnerability Analysis
Financial Services2 months ago

Provenance Blockchain State Divergence: $500K DeFi Vulnerability Analysis

In March 2026, Trail of Bits discovered a critical vulnerability in Provenance Blockchain, a Cosmos SDK-based financial services platform, that allowed any user to grant themselves admin control over marker accounts without holding tokens. The bug affected 82 markers representing live financial assets worth approximately $500,000, including validator incentive funds and community grant programs. Exploitation required only two transactions: one to gain admin permissions through a flawed authorization check, and another to either mint new tokens or drain escrowed assets. This incident highlights the growing risks in blockchain application security as DeFi and tokenized assets become mainstream. State synchronization vulnerabilities in smart contract platforms represent a critical attack vector that can bypass traditional access controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports