Apparently it’s also applied to Bitcoin/Index/**

it’s not. The index is not obfuscated. If there is no obfuscation key, all zeros are recorded.

Is there a way to set the obfuscation key for a chain state?

no.

Why is the chain-state obfuscation key not the same as it is used everywhere else?

ChainState obfuscation was introduced for a long time before Blocksdir obfuscation took place. It was implemented by storing obfuscation keys directly in the database itself. Having the same obfuscation key can be a problem, as ChainState and BlocksDir don’t necessarily have to go together and ChainState can be deleted without deleting blocksdir.

Crypto Journalist

Amin Ayan

Crypto Journalist

Amin Ayan

About Author

Amin Ayan is a crypto journalist with over four years of experience in the industry. He has contributed to leading publications such as Cryptonews, Investing.com, 99Bitcoins, and 24/7 Wall St. He has…

Share

Last updated: 

July 29, 2025

A new study has revealed the extent of sensitive information leaked through ransomware attacks and data breaches, including key financial documents and crypto keys.

The report, published by cybersecurity firm Lab 1, analyzed over 141 million records from 1,297 breach incidents.

Unlike most breach assessments that focus on structured data like usernames and passwords, Lab 1’s analysis targeted unstructured files, the type often overlooked but potentially more damaging.

Hidden Dangers: Financial Docs, Crypto Keys, and Emails Exposed

The breaches include financial documents, cryptographic keys, email archives, and internal business records.

According to Lab 1 CEO Robin Brattel, the goal was to expose the risks hidden in everyday files that rarely draw attention.

“We focused on the huge risks associated with unstructured files that often hold high-value information, such as cryptographic keys, customer account data, or sensitive commercial contracts,” he said.

The findings are alarming. Financial documents appeared in 93% of the breach incidents studied, accounting for 41% of all analyzed files.

Nearly half included bank statements, and over a third contained International Bank Account Numbers.

In 82% of the cases, customer or corporate personally identifiable information (PII) was exposed, much of it originating from customer service interactions.

A staggering 51% of incidents included emails containing U.S. Social Security numbers.

Perhaps most concerning was the discovery of cryptographic keys in 18% of the breaches.

These keys can be used to bypass authentication systems, giving attackers a powerful advantage in future cyber intrusions. Source code and internal scripts were also widely leaked, appearing in 17% of the analyzed data sets.

The study underscores a shift in cybercriminal tactics. Hackers are increasingly operating like data scientists, mining stolen data for high-value assets to use in fraud, identity theft, or ransomware follow-ups.

“With cybercriminals now behaving like data scientists to unearth these valuable insights to fuel cyberattacks and fraud, unstructured data cannot be ignored,” Brattel warned.

16 Billion Logins Leaked: New Mega Breach Puts Crypto Users at Risk

Last month, a massive data breach exposed more than 16 billion login credentials from platforms like Apple, Google, Facebook, Telegram, and GitHub, according to cybersecurity researchers at Cybernews.

The breach, among the largest ever recorded, is not a single leak but a combination of datasets gathered through infostealer malware, credential stuffing attacks, and undisclosed breaches tracked since early 2024. Some individual sets held as many as 3.5 billion entries.

Researchers warned the leaked credentials—many recently harvested—pose a severe threat to users, especially those in crypto, due to the inclusion of sensitive login details, cookies, and tokens.

The structure of the data suggests it was harvested by modern malware, making it far more dangerous than older, recycled leaks.

One dataset tied to Telegram included 60 million records, while another, allegedly linked to Russia, had over 455 million.

Much of the data was found in unsecured Elasticsearch databases and object storage systems, briefly exposed but long enough to be copied.

Although the exact source remains unclear, cybersecurity experts suspect criminal actors compiled the records.

With such a vast trove of credentials, attackers now have tools for phishing, ransomware, and unauthorized access to crypto wallets, especially for users lacking multi-factor authentication.

Cryptowzrd, his latest update With X, highlighted EthereumIt is an unjustly close one, suggesting that the market is still looking for a clear direction. Despite the uncertainty, he remains optimistic, noting that both Bitcoin and BTC dominance show strength that will benefit ETH in the near future, as $2,800 is marked as the next major resistance.

Mixed signal across Ethereum key time frames

In the post, Cryptowzrd pointed to the mixed range of Ethereum across key time frames. Monthly candles ended indecisively, informing them of short-term hesitations, and quarterly candles closed with strong bullishness Convicted. This, he suggests, will set a stage of movement that will be more upward in the coming months as higher time frames begin to insist on domination.

Related readings

He emphasizes that both ETH and ETHBTC’s daily candles today are equally indecisive, reflecting the current uncertainty of the market. However, Bitcoin domination It begins to fade, he considers the possibility that ETHBTC will pick up strength.

According to Cryptowzrd, ETHBTC already shows signs of life, heading up from the monthly double bottom layer. He believes it is beautiful, strong The candles formed from the 0.02270 BTC area help inject fresh momentum into Ethereum and drive towards a critical level of radar of $2,800 resistance.

He added that $2,400 will remain Ethereum’s main daily support zone unless there is a negative underlying development. As far as this applies, it’s wider structure It remains unharmed, and bullish papers remain valid.

Looking ahead, Cryptowzrd plans to turn his attention to a lower time frame tomorrow. Play volatility and set up Brewing, he carefully looks at the opportunity for a quick scalp as Ethereum navigates this important area.

I’m waiting to check the chart for the next day

In his last comment, Analyst We noted that Ethereum’s daytime charts experienced increased volatility throughout the day. Despite the choppy price action, he sees a clear setup formation that can present solid trading opportunities in the short term.

Related readings

Definitive happen Also, exceeding the $2,550 resistance level is a strong bull signal and could open the door for potentially long entries. On the back, if the price returns to $2,380 support and forms a bullish inversion pattern, it could also serve as a useful trigger for long positions.

With these scenarios in mind, analysts plan to closely monitor the intraday charts. His focus is on finding a clean, high quality setup. This matches the price structure and momentum to effectively spend the next scalp trade.

Getty Images Featured Images, Charts on tradingView.com

Hello LND Developers and Community,

Despite being fully synchronized after Bitcoin core node (v29.0.0, RPI5 fresh IBD, txindex = 1), we are facing a very unusual and important issue that on-chain funds related to past LND channel closures are inaccessible. However, both the ListUnSpent software and the external wallet software (Sparrow) are unable to view this UTXO, and importantly, the address holding the fund cannot be derived from my LND root key using standard methods.

System and history:

LND: v0.18.5-beta (upgraded from v0.5.2-beta). Only one wallet.db has been identified that is used throughout.

Bitcoin Core: V29.0.0 (RPI5), fully synced, IBD, TXINDEX = 1 report synced: true. Datadir/MNT/HDD/BITCOIN.

Channel History: Opened in March 2019 (LND V0.5.2, Funding TX: 7060 … 9D71), later closed the power by peers.

Sweep Transaction: April 1, 2024 (block 837257), TX 4C0407B1188E0BA39313B1D9C87C49F6C81D99AA2839026C8AF8C989CE102244 used the channel output and sent 0.01495 BTC to P2WPHH. BC1QT728QPLPUH6D98EVKL4A990ZDHWPWVUR6QG8QZ.

On-Chain Verification: Explorers confirm that this UTXO (4C04 …:0) is present and does not exist in BC1QT7 … G8QZ.

Core Issues and Conflicts:

After full IBD, make sure the txindex is synced on the Bitcoin Core node.

getrawtransaction 4c04... true Success: Node knows the history of funding transactions.

scantxoutset start '("addr(bc1qt7...)")' Returns UTXO successfully. This directly confirms that the node’s chainstate (UTXO set) database is correct and contains the previous output of BC1QT7 … G8QZ.

{
  "success": true, ...
  "unspents": ( { "txid": "4c04...", "vout": 0, ... "address": "bc1qt7...", "amount": 0.01495437 ... } ),
  "total_amount": 0.01495437
}

listunspent ... '("bc1qt7...")' (use -rpcwallet="" or any other loaded wallet) Returns (): Despite the UTXO present in the chain state, wallet-specific RPC calls cannot list it.

Sparrow Wallet (a fresh install connected to this node) shows a balance of 0. Import the confirmed LND root XPRV and configure BIP84 (M/84’/0’/0”, native Segwit P2WPKH), Sparrow completes the scan, but shows 0 balance and uses utxos.

Parallel Wallet Derived Failure:

Verified root XPRV (extracted from the correct Wallet.db via Chantools Showrootkey), using extensive checks using the offline tool (bip39-Standalone.html) (m/84’/0’/0’/0’/* and m/84’/0’/0’/0’/1/*). BC1QT728QPLPUH6D98EVKL4A990ZDHWPWVUR6QG8QZAfter checking millions of addresses.

Current Status and Emergency Questions:

I have an on-chain fund in bc1qt7…g8qz (per scantxoutset) the nodes fundamentally know, but they are not accessible via standard wallet RPC (listunspent) and external wallet (sparrow). To consolidate this is that you cannot derive this particular address from the LND root key using the standard BIP84 path.

Seek expert help:

Why can’t external wallets like Sparrow and external wallets like Sparrow not display UTXO when ScantxOutset on the same node confirm its presence in the UTXO set? Is this a known core bug, an issue with how Wallets queries addresses other than owners, or is it something else?

Given the derivation failure, is it possible for LND (especially after major version jump) to wipe out funds from the Aezeed root key to addresses that cannot be derived via the standard BIP84 path? Is a bug or a particular state likely to lead to using different derivation schemes, or can you use important keys that are unrelated to the main wallet in the sweep output?

Advanced methods or tools (LND debug commands, using specific Chantools, alternative wallet software known to handle edge cases) are:

a) Force Sparrow/LND to recognize UTXO based on node chain state confirmation?

b) Does it help clearly track the derived paths (even non-standard) used to generate bc1qt7…g8qz from wallet.db/xprv?

This situation seems very unusual. The insights and guidance are highly appreciated.

thank you.

Security researcher Yohanes Nugroho has released a decryptor for the Linux variant of Akira ransomware, which utilizes GPU power to retrieve the decryption key and unlock files for free.

Nugroho developed the decryptor after being asked for help from a friend, deeming the encrypted system solvable within a week, based on how Akira generates encryption keys using timestamps.

The project ended up taking three weeks due to unforeseen complexities, and the researcher spent $1,200 on GPU resources to crack the encryption key, but eventually, he succeeded.

Using GPUs to brute force keys

Nugroho’s decryptor does not work like a traditional decryption tool where users supply a key to unlock their files.

Instead, it brute-forces encryption keys (unique for each file) by exploiting the fact that the Akira encryptor generates its encryption keys based on the current time (in nanoseconds) as a seed.

An encryption seed is data used with cryptographic functions to generate strong, unpredictable encryption keys. Since the seed influences the key generation, keeping it secret is critical to prevent attackers from recreating encryption or decryption keys through brute force or other cryptographic attacks.

Akira ransomware dynamically generates unique encryption keys for each file using four different timestamp seeds with nanosecond precision and hashes through 1,500 rounds of SHA-256.

These keys are encrypted with RSA-4096 and appended at the end of each encrypted file, so decrypting them without the private key is hard.

The level of timing precision in the timestamps creates over a billion possible values per second, making it difficult to brute force the keys.

Also, Nugroho says that Akira ransomware on Linux encrypts multiple files simultaneously using multi-threading, making it hard to determine the timestamp used and adding further complexity.

The researcher narrowed down the possible timestamps to brute-force by looking at log files shared by his friend. This allowed him to see when the ransomware was executed, the file metadata to estimate the encryption completion times, and produce encryption benchmarks on different hardware to create predictable profiles.

Initial attempts using an RTX 3060 were far too slow, with a ceiling of only 60 million encryption tests per second. Upgrading to an RTC 3090 didn’t help much either.

Eventually, the researcher turned to using RunPod & Vast.ai cloud GPU services that offered enough power at the right price to confirm the effectiveness of his tool.

Specifically, he used sixteen RTX 4090 GPUs to brute-force the decryption key in roughly 10 hours. However, depending on the amount of encrypted files that need recovery, the process may take a couple of days.

The researcher noted in his write-up that GPU experts could still optimize his code, so performance can likely be improved.

Nugroho has made the decryptor available on GitHub, with instructions on how to recover Akira-encrypted files.

As always, when attempting to decrypt files, make a backup of the original encrypted files, as there’s a possibility that files can be corrupted if the wrong decryption key is used.

BleepingComputer has not tested the tool and cannot guarantee its safety or effectiveness, so use it at your own risk.

Rubrik disclosed last month that one of its servers hosting log files was breached, causing the company to rotate potentially leaked authentication keys.

The company has confirmed to BleepingComputer that the breach was not a ransomware incident and that it did not receive any communication from the threat actor.

Rubrik is a cybersecurity company that specializes in data protection, backup, and recovery and has over 3,000 employees in more than 22 global offices. The company has over 6,000 customers worldwide, including high-profile companies like AMD, Adobe, Pepsico, Home Depot, Allstate, Sephora, GSK, Honda, Harvard University, and TrelliX.

In a security advisory published on February 2 and first spotted by Kevin Beaumont, Rubrik says it detected unusual activity on a server hosting their log files.

“The Rubrik Information Security Team recently discovered anomalous activity on a server that contained log files. We promptly took the server offline to mitigate the risk,” reads Rubrik’s security advisory.

“An investigation supported by a third party forensic partner has confirmed that the incident was isolated to this one server and we found no evidence of unauthorized access to any data we secure on behalf of our customers, or our internal code.”

However, Rubrik says that a small number of log files contained access information, causing the company to rotate authentication keys out of an abundance of caution.

The company says that there are no signs that this information was misused.

Furthermore, Rubrik says their investigation has not found evidence that the threat actors gained access to customer data or their internal source code.

Rubrik previously suffered a data breach in 2023 after the company’s data was stolen as part of the wide-scale Fortra GoAnywhere data theft attacks by the Clop ransomware gang.

The FTX SAGA has entered yet another chapter since the exchange collapsed almost three years ago. The company has begun repaying an estimated $1.2 billion to the first wave of previous FTX users.

First, let’s talk about paying back FTX.

The repayment has started and is probably on the way

Starting at UTC on February 18th at 3pm, Exchange has repaid the first batch of over 1,500 former FTX users. The group covers less than $50,000.

Repayments are already eye-catching amounts, but they are a drop in buckets compared to the total payments FTX has to settle. This could swell to more than $16 billion if all users file a claim.

The collapse of FTX in November 2022 now seems like ancient history, but it sent shockwaves throughout the crypto industry.

This is part of the size of the replacement. Having a subsidiary of more than 130 people means there is a domino effect on the event, leading to bankruptcy and employment cuts within these companies.

It also had a major impact on the value of Bitcoin. The world’s most valuable cryptocurrency slipped to around $16,000 during this period after its previous highest amount of $65,000.

Regulators have responded quickly, and as a result, they have taken a more stringent approach to cryptography. For example, the US has fined exchanges like Binance. I ordered to pay over $4 billion 2023.

Meanwhile, former FTX CEO Sam Bankman-Fried is currently serving a 25-year sentence for stealing clients’ money from exchanges.

How FTX repayments affect the market

The $1.2 billion payment is a significant amount. So some of this will be reinvested in the crypto market, and will help to increase the demand for meme coins, especially the best wallet tokens.

Furthermore, repayments could restore confidence in Crypto’s reputation, which was hit by the FTX fiasco. Investors who have been bearished by the exchange’s collapse may once again have a reason to dip their toes into the code.

But not everyone can expect to be satisfied with the good news.

This is because when FTX goes bankrupt, users are paid according to the crypto price, resulting in an interest of 9% per year. $BTC holders are particularly unhappy as the value of digital currency has increased by almost 400% since 2022.

Life after FTX

The Crypto market has changed dramatically since the collapse of FTX. For example, the number of meme coins and token pre-sale is booming, giving investors more options to grow their money.

One of the best pre-sale today is Best Wallet Token ($ best). The project is led by the creators of top-class Crypto wallets, and is committed to bringing exclusive benefits to token holders.

One will allow users to vote for important decisions that impact the best wallet ecosystem. If you love the product and want to make it better, you can hear your voice as you have the $ best token.

Apart from that, investors have their first dibs on the team’s new projects and future token releases. This will help you buy coins while they are still cheap, giving you an advantage over non-token owners.

Finally, when you have $BEST, you can enjoy lower trading fees and higher APY staking opportunities.

Coinsult had already audited the best wallet tokens in November 2024, and no major issues were found among them. This makes it a safe and reliable project to invest without the risks associated with some token pre-sale.

The project has raised over $102 million so far, making it one of the hottest new cryptocurrencies of 2025. You can grab the best $ at $0.02405 each, but the price is about to rise again in under 2 days, so buy, better.

A few tips before investing

As we’ve seen at $BTC prices over the past few years, the crypto market is very unstable. Therefore, do your own research before investing.

You should also consider consulting with your financial advisor about your financial decisions. The information in this article is not for educational purposes only, not as investment advice.