Berlin authorities have refused to meet an alleged 30 Bitcoin ransom demand after a cyberattack hit two state agencies, while officials have yet to confirm the amount of data claimed to have been stolen.

The Berlin Senate Chancellery said it would not disclose details about the attackers, their demands or the information potentially taken from government systems while the investigation remains active. A Senate spokesperson told German news agency dpa that officials could not comment “for investigative reasons” at this stage.

The position leaves several details of the attack unconfirmed by the state government, including reports that the ransomware group Rhysida obtained sensitive files and threatened to publish them unless Berlin paid roughly 2 million euros in Bitcoin.

Berlin has refused the reported 30 Bitcoin demand

Berlin Mayor Kai Wegner confirmed after a special Senate meeting on Friday that the state was facing an extortion attempt following the cyberattack.

“The state of Berlin will not allow itself to be blackmailed,” Wegner said.

He did not publicly identify the attackers or disclose the amount demanded. Interior Senator Iris Spranger joined Wegner in briefing the public following the meeting, while authorities continued examining what information had left government systems.

German magazine Der Spiegel reported that Rhysida was behind the attack, citing information posted by the ransomware group on its dark web leak site. Security sources cited by the publication reportedly identified Rhysida as the group responsible for the extortion attempt.

The attackers demanded 30 BTC and threatened to release the information if Berlin did not pay, according to the report. At current prices, the demand was worth roughly 2 million euros.

Rhysida reportedly claimed to have taken almost six terabytes of data. The alleged files include information from tens of thousands of administrative offense proceedings, contracts, passwords, login credentials, emergency plans and documents related to critical infrastructure.

Berlin authorities have not independently confirmed the amount of data claimed by the group or the full list of compromised records.

The distinction has become important to the official account of the incident because the government’s assessment changed after the attack was discovered. Officials initially said only publicly accessible information had been taken before the Senate Chancellery acknowledged last Wednesday that non-public data was affected.

Cyberattack forced two Berlin agencies off the state network

The attack became public on Aug. 14 and affected Berlin’s Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment.

Both agencies were temporarily disconnected from Berlin’s state network as officials worked to contain the incident.

The separation lasted for about a week and disrupted some administrative services. German reports said residents were temporarily unable to apply for or receive housing benefits while the affected systems remained isolated.

Investigators are still determining when the intrusion began and how much information left the network. Reports citing the investigation said data may have been extracted between Aug. 7 and Aug. 12, several days before officials detected the attack.

The Berlin State Criminal Police Office and prosecutors are investigating the breach. Wegner said state and federal security authorities were working to identify the perpetrators while officials continued checking which files had been accessed or removed.

Spranger said the attack had not compromised preparations for Berlin’s Sept. 20 state election, describing the election infrastructure as fully secured.

The ransomware case follows another government cyberattack involving a Bitcoin demand reported by crypto.news in July. Hackers took control of Kenyan President William Ruto’s official website and demanded 5 BTC while threatening to disclose unspecified information.

Kenyan authorities temporarily restricted access to the website and opened an investigation. The country’s ICT Authority said at the time that investigators had found no evidence that sensitive information had been accessed, stolen or lost.

Rhysida has operated as a ransomware group since 2023

Rhysida emerged in 2023 and has been linked to attacks against government bodies, healthcare organizations and other institutions in several countries.

The group has previously targeted organizations including the British Library and the Chilean Army. Its operations generally combine network intrusion with demands for payment, while the threat of publishing stolen information can be used to pressure victims.

Bitcoin and other cryptocurrencies have repeatedly featured in ransomware cases because attackers can direct payments to blockchain addresses without using conventional bank accounts.

Public blockchain transactions can still be followed. A crypto.news report on blockchain forensics detailed how investigators can trace cryptocurrency movements between addresses and use transaction patterns and other information to connect funds with services or individuals.

Law enforcement agencies have recovered cryptocurrency from ransomware operations in previous cases. In August 2025, U.S. authorities seized $1.09 million in cryptocurrency linked to the BlackSuit ransomware group alongside four servers and nine domains.

BlackSuit had been linked to more than 450 known U.S. victims and over $370 million in ransom demands since 2022. One victim paid 49.3 BTC in 2023 after an attack, with investigators later recovering part of the payment, according to the Justice Department.

A separate U.S. case in July involved a suspected member of the Scattered Spider hacking group. Federal prosecutors charged 19-year-old Peter Stokes over an alleged corporate intrusion and an unsuccessful $8 million cryptocurrency ransom demand.

The Justice Department said Scattered Spider-linked intrusions had resulted in more than $100 million in ransom payments, with attackers using techniques including phishing and impersonating employees when contacting corporate help desks.

Berlin has not confirmed Rhysida’s data claims

Berlin’s investigation remains focused on establishing the extent of the breach while the government withholds details that officials say could affect the inquiry.

Rhysida’s claims about the stolen material originate from the group’s dark web communications and have not been fully verified by the Berlin government. Officials have confirmed that non-public information was affected, reversing the initial assessment that the compromised material was limited to publicly accessible data.

The Senate Chancellery has not disclosed whether investigators have verified the reported 30 BTC demand, the nearly six terabytes allegedly taken or the individual categories of information Rhysida claims to possess.

Wegner said authorities at the state and federal levels were working to identify the group responsible, while the Berlin State Criminal Police Office and prosecutors continued their investigation into the attack.

DeFi lending infrastructure has suffered another high-value breach on Flow EVM, with Blockaid reporting that the protocol More Markets lost roughly $9.3 million in assets from a lending reserve. The incident, described in a Monday post by Blockaid on X, centers on an overborrow strategy using a liquid staking token.

Blockaid said the attacker drained about 15.5 million Wrapped Flow (WFLOW) tokens—valued at approximately $9.3 million—from the mFlowWFLOW lending reserve. The exploit reportedly involved Ankr Staked FLOW (ankrFLOW), together with Aave V3’s “efficiency mode” (E-mode), to expand borrowing capacity beyond what the reserve should allow.

Key takeaways

• Blockaid attributes the More Markets Flow EVM reserve drain to an overborrowing approach using Ankr Staked FLOW (ankrFLOW) and Aave V3 E-mode.
• About 15.5 million Wrapped Flow (WFLOW), worth around $9.3 million, were taken from the mFlowWFLOW lending reserve.
• The month-to-date total losses from crypto hacks reached $139.7 million in August, placing the month as the third-largest by stolen value so far in 2026.
• The August figure is sharply lower than July’s $254 million in stolen funds, suggesting either fewer major breaches or reduced impact from exploits.
• Cronos paused its network on Sunday following a separate reported $75 million exploit tied to the Tectonic DeFi lending protocol.

How the More Markets reserve was drained

According to Blockaid’s account of the event, the attacker targeted More Markets’ lending reserve that holds mFlowWFLOW. Blockaid said the stolen amount consisted of 15.5 million Wrapped Flow (WFLOW) tokens, which it valued at approximately $9.3 million based on blockchain data it shared publicly.

Blockaid further claimed that the exploit depended on two linked mechanisms: the use of Ankr Staked FLOW (ankrFLOW) and Aave V3’s E-mode. E-mode is designed to increase borrowing power for specific asset groups when their values are expected to move together—commonly a liquid staking token and its corresponding underlying token.

In practical terms, this means that when the protocol’s configuration treats certain pairs as sufficiently correlated, the borrowing limits can become more permissive. Blockaid’s report indicates the attacker leveraged that increased borrowing power to overextend against the reserve, resulting in the loss of WFLOW tokens from mFlowWFLOW.

E-mode designed for correlation—what this incident suggests

E-mode in Aave V3 is intended to make capital more efficient by rewarding users when asset prices track each other closely. Blockaid’s description of this exploit highlights a recurring risk in DeFi: when an attacker can obtain collateral exposure through a token wrapper or staking derivative, the assumed relationship between the assets may be insufficiently protective during the exploit window.

Blockaid specifically tied the strategy to Ankr Staked FLOW (ankrFLOW) in combination with E-mode for correlated assets. While E-mode is not inherently wrong—its goal is to reflect genuine market linkage—incidents like this underscore that protocols still need robust defenses around liquidation mechanics, borrowing limits, and whether the collateral’s behavior under stress matches the assumptions baked into risk parameters.

For investors and users, the takeaway is not that E-mode should be avoided, but that reliance on correlated asset groups can raise the stakes for monitoring. Protocol teams typically need to ensure that their accounting, oracle choices, and validation logic remain resilient when liquidity conditions change quickly.

Broader hack landscape: August losses mount

Blockaid’s reported loss adds to a fast-moving set of crypto-security events. DefiLlama’s data on hacks shows that total cryptocurrency losses from hacks reached $139.7 million in August, making it the third-largest month by value stolen so far in 2026.

The same DefiLlama dataset cited in the reporting indicates a meaningful change from earlier in the year: July saw approximately $254 million stolen. While August has a lower total than July, the ongoing frequency of incidents—spanning multiple ecosystems and chains—suggests that attackers remain active and that DeFi lending remains a frequent target.

Another DeFi lending event: Cronos halts after Tectonic exploit

Alongside the More Markets issue, the market also digested another major DeFi lending-related disruption. On Sunday, Cronos halted its blockchain network following a reported $75 million exploit targeting the DeFi lending protocol Tectonic.

That earlier incident, reported by Cointelegraph, involved a sizable compromise that prompted an emergency network pause by Cronos. Together, the two stories emphasize how quickly lending platforms can become central points of failure—especially when borrowing configurations intersect with token derivatives and liquidity-linked assumptions.

At the time of publication, More Markets had not publicly confirmed the incident or disclosed whether users suffered losses. Cointelegraph said it contacted Blockaid for more details but did not receive a response by publication, and it was unable to reach More Markets for comment.

Readers should watch for follow-up disclosures from More Markets regarding the affected reserve, whether funds were fully recovered, and any post-incident changes to collateral or E-mode configuration. For the wider DeFi community, the key uncertainty is how closely future risk models will account for real-world token behavior during fast-moving market or liquidity conditions.

Zakura released an open-source cryptography toolkit on Aug. 29 that it says can reduce the time required to construct some private Zcash transactions from more than three seconds to below 200 milliseconds.

The toolkit, called Zakura Common, replaces several cryptographic components used by wallets and full nodes. The developers said the changes improve proof generation, transaction verification, wallet scanning and hashing without altering Zcash’s consensus rules.

Zakura released the software under dual MIT and Apache 2.0 licenses. Wallet and node developers can therefore integrate the libraries without waiting for a hard fork or synchronized network upgrade.

Zcash wallets generate privacy proofs faster

Zcash shielded transactions conceal the sender, recipient and transferred amount. A wallet must create a zero-knowledge proof showing that the hidden transaction follows the network’s rules before broadcasting it.

That computation happens on the user’s device. Slow proof generation can therefore delay a payment before validators or nodes begin processing it.

Zakura’s benchmarks showed mobile proof generation running more than 14 times faster under the new stack. Desktop performance improved by more than five times.

The developers said those gains could bring transaction construction below 200 milliseconds “in many cases.” The figure is a benchmark result rather than a guaranteed time for every device, wallet or transaction.

Hardware, operating systems, transaction complexity and wallet implementations may produce different results.

Zakura Common improves more than proof generation

The toolkit also made Sinsemilla hashing more than 21 times faster, according to Zakura. Zcash uses Sinsemilla within its Orchard shielded protocol for cryptographic commitments and related operations.

Trial decryption improved by more than 1.5 times. Wallets use that process while scanning blockchain data to identify shielded transactions belonging to their users.

Zakura also reported fourfold to eightfold gains in zk-SNARK verification. Faster verification could help full nodes validate transactions sooner and reduce the risk of block-processing delays.

“Shielded wallets that use Zakura Common, and full nodes like Zakura itself, all benefit,” Zcash co-founder Sean Bowe said.

The release does not shorten Zcash block production or settlement on its own. It primarily targets the cryptographic work performed before broadcasting and while checking transactions.

Wallet developers can adopt the toolkit immediately

Zakura version 1.3.0 has moved to the new cryptography stack. Vizor Wallet is among the first wallet projects adopting the libraries, according to the development team.

Other wallets must integrate and test Zakura Common before their users receive the same performance gains. Adoption will therefore depend on individual development schedules rather than a single network activation date.

The update arrives as Zcash wallet development becomes more distributed. In January, former Electric Coin Company developers formed CashZ to continue work based on the Zashi wallet code.

Wallet integrations have also expanded access to shielded transfers. A previous ShapeShift wallet integration added Zcash privacy support across its non-custodial platform.

ZEC briefly rose before the broader pullback

ZEC initially rose about 5% following the Zakura Common announcement and traded near $839. The timing indicates a market reaction but does not prove the software release caused the entire move.

CoinGecko subsequently placed ZEC near $829 on Aug. 31, down about 0.8% over 24 hours. The token traded between approximately $808 and $888 during that period.

The next evidence will come from real wallet deployments. Developers will need to confirm whether the benchmark gains persist across consumer devices, larger shielded transactions and different operating environments.

Zakura is also preparing for the proposed NU7 upgrade, which could reduce Zcash block times to about 25 seconds. The team says its current software can already operate under that target, although NU7 requires a separate network governance and activation process.

Decentralized finance (DeFi) vault infrastructure protocol More Markets had a lending reserve drained of about $9.3 million in digital assets on Flow EVM, according to Web3 security platform Blockaid.

The attacker drained about 15.5 million Wrapped Flow (WFLOW) tokens, valued by Blockaid at approximately $9.3 million, from the mFlowWFLOW lending reserve, according to blockchain data shared by Blockaid in a Monday X post.

Blockaid said the attacker used Ankr Staked FLOW (ankrFLOW), a liquid staking token, alongside E-mode to overborrow from the reserve.

E-mode, short for efficiency mode, is an Aave V3 feature that increases borrowing power for assets whose prices are expected to move together, such as a liquid staking token and its underlying asset.

The exploit pushed total losses from cryptocurrency hacks to $139.7 million for August, making it the third-largest month by value stolen so far in 2026. However, it marks a significant decrease from $254 million stolen during July, according to DefiLlama data.

On Sunday, Cronos halted its blockchain network after a reported $75 million exploit targeting DeFi lending protocol Tectonic.

More Markets had not publicly confirmed the incident or disclosed whether users suffered losses at the time of publication. Cointelegraph contacted Blockaid for more details but did not receive a response by publication and was unable to reach More Markets for comment.

Related: Humanity Protocol to prioritize operational security following $36M hack

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.