GCSA discloses KuCoin phishing, Bitkub risks, and Avalanche ecosystem vulnerabilities.

GCSA has released a report disclosing several security risks. Attackers impersonated security@ku.com to trick KuCoin users into downloading remote control programs. KuCoin has implemented a DMARC isolation policy. The MCP toolkit referenced in Bitkub's official documentation is at risk of third-party re-registration of package names and plaintext keys, but there is currently no evidence of credential leakage. The Avalanche ecosystem's TranchePool was attacked due to a flaw in its cross-day settlement logic. Attackers exploited flash loans and duplicate withdrawals to transfer approximately 1,013,400 USDC within 202 seconds. This incident is a vulnerability in the upper-layer application; the underlying network was not affected.