Step Finance says compromised execs' devices led to $40M crypto theft

BleepingComputer
Actively Exploited

Overview

Step Finance reported a significant security breach resulting in the theft of $40 million worth of cryptocurrency. The incident occurred after hackers compromised the devices of several executives within the company. This breach raises concerns about the security of sensitive information and the potential vulnerability of key personnel in organizations handling digital assets. The theft not only affects Step Finance but also highlights the risks associated with managing cryptocurrencies, especially in terms of device security. As digital assets continue to grow in popularity, companies must prioritize securing their executives' devices to prevent future breaches.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Step Finance digital assets
  • Action Required: Companies should enhance device security protocols, including multi-factor authentication and regular security training for executives.
  • Timeline: Newly disclosed

Original Article Summary

Step Finance announced that it lost $40 million worth of digital assets after hackers compromised devices belonging to the company's team of executives. [...]

Impact

Step Finance digital assets

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Companies should enhance device security protocols, including multi-factor authentication and regular security training for executives.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability.

Related Coverage

22 BRIDGE:BREAK Flaws Expose 20,000 Lantronix and Silex Serial-to-IP Converters

The Hacker News

Researchers at Forescout Research Vedere Labs have discovered 22 vulnerabilities in serial-to-IP converters made by Lantronix and Silex. These flaws could allow attackers to take control of nearly 20,000 devices and manipulate the data being transmitted through them. This is particularly concerning because serial-to-Ethernet converters are widely used in various industries, making them attractive targets for cybercriminals. Organizations using these devices need to be aware of the potential risks and take steps to secure their systems. The vulnerabilities are significant enough that they could lead to unauthorized access and data breaches if not addressed promptly.

Apr 21, 2026

Mastodon hit by DDoS attack, disrupting flagship server

SCM feed for Latest

Mastodon, a decentralized social media platform, experienced a distributed denial-of-service (DDoS) attack that began early Monday morning. The attack disrupted the functionality of its flagship server, impacting users who rely on the platform for communication and social interaction. Mastodon confirmed that they were investigating the incident around 7 a.m. ET. DDoS attacks can overwhelm a server with traffic, making it unavailable to legitimate users, which raises concerns about the platform's reliability and security. This incident highlights the ongoing challenges that online services face in protecting against cyber threats.

Apr 21, 2026

The Ungoverned Workforce: Cybersecurity Insiders Finds 92% Lack Visibility Into AI Identities

Hackread – Cybersecurity News, Data Breaches, AI and More

A recent study by Cybersecurity Insiders revealed that 92% of organizations lack visibility into AI identities within their systems. This lack of oversight poses significant risks as companies increasingly adopt AI technologies. Without proper monitoring, businesses may struggle to protect sensitive data and manage potential security breaches. The findings indicate a pressing need for organizations to improve their understanding and management of AI-related identities to mitigate these risks. As AI continues to integrate into various business operations, enhancing visibility and control over these identities will be crucial for maintaining cybersecurity.

Apr 21, 2026

UK probes Telegram, teen chat sites over CSAM sharing concerns

BleepingComputer

The UK's communications regulator, Ofcom, is investigating the messaging platform Telegram due to concerns that it is being used to share child sexual abuse material (CSAM). This investigation follows evidence indicating that Telegram may not be effectively moderating content to prevent the distribution of such harmful materials. The focus on Telegram is part of a broader effort to hold online platforms accountable for the safety of their users, particularly vulnerable populations like children. This inquiry raises significant questions about the responsibilities of tech companies in monitoring and controlling illegal content on their platforms. As the investigation unfolds, it could lead to increased scrutiny and potential regulatory changes affecting not just Telegram, but other similar platforms as well.

Apr 21, 2026

Unchecked AI Agents Cause Cybersecurity Incidents at Two Thirds of Firms

Infosecurity Magazine

A recent report from the Cloud Security Alliance reveals that two-thirds of businesses are experiencing cybersecurity incidents linked to unchecked AI agents. These incidents include data exposure, operational disruptions, and financial losses. As companies increasingly adopt AI technologies, they face challenges in managing these agents effectively, leading to vulnerabilities. The report emphasizes the urgent need for organizations to implement better controls and oversight to mitigate these risks. Failure to do so could result in severe consequences for both their operations and their customers.

Apr 21, 2026

CISA flags new SD-WAN flaw as actively exploited in attacks

BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a vulnerability in the Catalyst SD-WAN Manager, which has been confirmed as actively exploited in attacks. U.S. government agencies have just four days to secure their systems against this threat. Attackers may be taking advantage of this flaw to gain unauthorized access or disrupt services. This situation emphasizes the need for agencies to promptly patch their systems to mitigate potential risks. Failure to address the vulnerability could lead to significant security breaches and data loss.

Apr 21, 2026