El Salvador Splits Bitcoin Reserve

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, El Salvador split its bitcoin reserve to mitigate quantum risks, an Indian court jailed cops for crypto kidnapping, a PowerShell-based cryptojacking attack, a malvertising campaign targeted Android users with fake app, a Venus Protocol hack, malware hid in npm packages using ethereum smart contracts for evasion and Bunni DEX exploit.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

Darktrace researchers uncovered a case of NBMiner malware deployed through a PowerShell attack chain that injected malicious code into legitimate Windows processes. Detected in July on a retail and e-commerce network, the attack began when an infected desktop connected to a suspicious IP address and downloaded a heavily obfuscated PowerShell script, infect.ps1. The script used multi-stage payloads involving Base64 and XOR encoding, AutoIt executables and process injection into Windows’ Character Map to evade detection.

The malware bypassed sandboxing by delaying execution, checked for antivirus protections and attempted to escalate privileges through User Account Control bypasses. Once injected, the NBMiner payload decrypted itself in memory and connected to the Ravenminer pool to mine Ravencoin cryptocurrency using the Kawpow algorithm. Darktrace said the attack showcases increasingly sophisticated cryptojacking methods.

Bitdefender Labs has uncovered a large-scale malvertising campaign abusing Meta’s ad network to target Android users with cryptocurrency-stealing malware. The scheme promotes a fake “TradingView Premium” app through Facebook ads that delivers a version of the Brokewell Trojan.

Once installed, the malware demands extensive permissions, hides behind update prompts and overlays fake login screens. It can steal wallets, intercept second factor authentication codes, record screens and activate cameras and microphones. Researchers observed at least 75 malicious ads between July 22 and Aug. 22.

El Salvador’s National Bitcoin Office said it divided the country’s 6,284-BTC reserve worth over $682 million into 14 separate addresses to bolster security. Until now, the entire reserve was held in a single wallet. Each new address contains fewer than 500 BTC, a move the office said reduces exposure to future quantum computing threats by keeping unused addresses protected through hashed public keys.

The office, directed by President Nayib Bukele, says it buys one bitcoin daily for the strategic reserve. The assertion contrasts with a July International Monetary Fund filing in which the country’s central bank president and finance minister said that no public sector BTC purchases have been made since February under a loan agreement.

Analysts say quantum risks to bitcoin’s cryptography are decades away, but the office framed the split as aligning with best practices in reserve management and long-term security planning.

An Indian anti-corruption court sentenced 14 men, including 11 police officers and a former legislator, to life imprisonment for their role in a 2018 kidnapping tied to cryptocurrency extortion, reported the Hindustan Times.

Special Judge B.B. Jadav in Ahmedabad convicted the group of kidnapping, extortion and criminal conspiracy after hearing testimony from more than 170 witnesses.

The victim, businessman Shailesh Bhatt, was lured to a gas station by men posing as federal agents before being abducted and taken to a farmhouse. There, police officers allegedly threatened him at gunpoint and demanded 176 BTC and $3.6 million. Bhatt eventually handed over proceeds from the sale of 34 BTC, worth about $150,000, though the cash ransom fell through.

All convicted officers were also found guilty under corruption statutes. Former legislator Nalin Kotadiya, who evaded arrest for months, was among those sentenced. Bhatt faces separate charges for orchestrating his own crypto kidnappings.

A Venus Protocol user lost about $13.5 million after approving a malicious transaction that allowed an attacker to siphon funds, blockchain security firm PeckShield said. The victim’s wallet reportedly used an updateDelegate function to grant token approvals, enabling the attacker’s address to transfer assets.

Venus Protocol temporarily paused its lending platform during the investigation but later said the protocol itself was not breached.

Launched in 2020, Venus is a decentralized lending platform primarily deployed on BNB Chain, with additional rollouts on ethereum, arbitrum, optimism, opBNB and zkSync. The incident briefly pushed its governance token XVS down nearly 9% before partial recovery. Venus has since restored operations.

ReversingLabs researchers discovered two malicious npm packages, dubbed colortoolsv2 and mimelib2, which used ethereum smart contracts to conceal commands for delivering downloader malware. Published in July, the packages were part of a broader campaign in which attackers used social engineering and fake repositories to trick developers into integrating malicious code.

The packages fetched commands from smart contracts, complicating detection. Once installed, the packages pulled second-stage malware via obfuscated scripts. To boost credibility, attackers created fake GitHub repositories posing as crypto trading bots, inflating commit histories, stars and watchers with fabricated accounts.

Decentralized exchange Bunni underwent an $8.4 million exploit, with attackers draining about $6 million from unichain and $2.4 million from ethereum, said security firm Hacken. The attack exploited vulnerabilities in Bunni’s ethereum-based smart contracts, though full technical details are not disclosed yet.

About half of the stolen unichain funds were swapped into ether and bridged to ethereum in 100-ETH transfers via Across Protocol.

Built on Uniswap V4, Bunni offers adaptive pools and incentive tokens to boost liquidity provider returns. The platform confirmed the exploit on X, formerly Twitter, announcing that all smart contract functions had been paused across networks. Bunni later clarified that only two pools – the USDC/USDT pair on ethereum and the ETH/weETH pair on unichain – were impacted. Investigations continue, with all deployments paused pending further review.