Skip to content

Monero

Privacy-focused cryptocurrency (XMR) using encrypted, untraceable transactions; its mining software is often deployed on hacked systems.

Known aliases

  • Monero miner
  • XMR

Current stories

investConfirmed2 publishers

Revolut will pay for new IDs after sending 680 customers' data to a hijacked Italian police email

Revolut will pay to replace identity documents for the 680 customers whose data it sent to a hijacked Italian government email address. The bank has not put a price on the pledge, and it disagrees with Italy's interior minister over whose check let the request through.

Reality

Evidence62
Adoption
Not scored
Hype gap+12
Incentives70
Confidence60
investOne report1 publisher

Privacy coins Zcash and Monero lead a flat $3 trillion crypto market

Zcash rose 3% and Monero 2.14% over 24 hours to lead the largest coins, while Bitcoin gained 0.59%. The $30.25 million that left Grayscale's Zcash ETF on Sept. 30 equals about 0.13% of Zcash's $23.18 billion market value.

Publishers:decrypt.co

Reality

Evidence45
Adoption25
Hype gap+15
Incentives
Not scored
Confidence40
investOne report1 publisher

One Bitget breach supplied half of September's record $766 million in crypto hack losses

Crypto hacks drained $766.49 million in September, a 2026 monthly record, and $387.5 million came from one breach of Bitget's hot wallets. After the money returned from the Liquid Network exploit, that one exchange accounts for about 80% of what stayed stolen.

Reality

Evidence45
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence50
productOne report1 publisher

Bitcoin privacy without a fork hinges on encryption Alloc Init has not finished

Alloc Init's Shielded Bitcoin paper claims Zcash-style private transfers on Bitcoin with no soft fork or consensus change. Moving coins into and out of the pool still depends on witness encryption the authors have not finished.

Publishers:gizmodo.com

Reality

Evidence35
Adoption0
Hype gap+45
Incentives50
Confidence40
productConfirmed5 publishers

Apple's quiet Screen Sharing fix is now a same-day job: CVE-2026-65400 is under active abuse

Dutch officials report root access and Monero miners on Macs with port 5900 open to the internet. Sonoma, Sequoia and Tahoe all need the update Apple shipped as an important security fix.

Perspective Coverage

5 publishers
Builder
Builder 22%
Operator
Operator 70%
Investor
Investor 8%

Reality

Evidence70
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence68
securityConfirmed6 publishers

macOS Screen Sharing bug exploited in the wild: if port 5900 was open, assume root was taken

The Dutch NCSC says CVE-2026-65400 was abused within two weeks of Apple's fix, with root access and Monero miners in every reported case. Patching closes the door; it does not evict anyone.

Perspective Coverage

6 publishers
Builder
Builder 22%
Operator
Operator 72%
Investor
Investor 6%

Reality

Evidence60
Adoption
Not scored
Hype gap+20
Incentives40
Confidence62
investConfirmed3 publishers

Hackers priced 680 Revolut customer files at roughly $4,300 each

The group calling itself iamnotavillain wants 6,000 Monero within 24 hours and Revolut says no demand has reached it. The data went out through a government email account the bank was obliged to answer.

Perspective Coverage

3 publishers
Builder
Builder 22%
Operator
Operator 51%
Investor
Investor 27%

Reality

Evidence55
Adoption
Not scored
Hype gap+10
Incentives60
Confidence55
securityOne report1 publisher

Threat actor compiled its Monero miner on the victim endpoint after exploiting CVE-2025-4632

Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.

Publishers:huntress.com

Reality

Evidence66
Adoption28
Hype gap+10
Incentives62
Confidence58
productOne report1 publisher

Signal sells a phone-number-free account for $2.99 through Google Play billing

Signal is testing a numberless signup in its Android 8.28 beta that costs a one-time $2.99 and issues an Account ID plus a recovery key. The purchase clears through Google Play, so degoogled users cannot buy it.

Publishers:gizmodo.com

Reality

Evidence62
Adoption18
Hype gap+12
Incentives55
Confidence58
scienceOne report1 publisher

An attacker used a planted AWS key five minutes after it appeared on GitHub

Unit 42 committed a fresh, overly permissive AWS key to a random GitHub repository with the usual quarantine policy switched off, then timed how long a cryptojacking crew took to find it and start mining.

Reality

Evidence52
Adoption45
Hype gap+30
Incentives78
Confidence60
investOne report1 publisher

THORChain puts its own capital into the Monero pools exchanges walked away from

Version 3.20 lets Monero and Zcash trade against bitcoin, ether and stablecoins inside THORChain's own pools, which makes pool depth rather than the 8.9% price pop the figure that decides how much of this route is usable.

Reality

Evidence26
Adoption28
Hype gap+34
Incentives61
Confidence31
buildOne report1 publisher

Unauthenticated root on macOS Screen Sharing: CVE-2026-65400 is already dropping miners

An authentication state flaw lets anyone who reaches TCP/5900 skip credentials entirely. Multiple cases reported to NCSC-NL ended in root and a Monero miner.

Publishers:dev.to

Reality

Evidence34
Adoption31
Hype gap+18
Incentives24
Confidence41