According to CoinMeta, GCSA released a report disclosing multiple security risks. Attackers impersonated security.com to induce KuCoin users to download remote control programs. KuCoin has already enabled DMARC isolation policies. The MCP toolkit cited in Bitkub official documentation poses risks of third-party re-registration of package names and plaintext keys; however, there is currently no evidence of credential leakage. Within the Avalanche ecosystem, TranchePool was attacked due to a flaw in its cross-day settlement logic. Attackers exploited lightning loans and repeated withdrawals to transfer approximately 1.0134 million USDC within 202 seconds. This incident is a vulnerability in the upper-layer application, and the underlying network was not affected.