[GCSA Discloses KuCoin Phishing, Bitkub Supply Chain Risks, and Avalanche Contract Vulnerability; Attackers Transferred Approximately 1.0134 Million USDC] According to Odaily Planet Daily, the Global Cyber Security Alliance (GCSA) has released three independent technical investigation reports disclosing several recent digital asset security risks. Attackers impersonated security@(ku.com) to trick users into downloading remote control programs. GCSA discovered that the relevant domains were not previously configured with DMARC; after being notified, KuCoin has completed rectification and implemented a DMARC isolation strategy. After the original version of the MCP toolkit referenced in Bitkub's official documentation was removed, a third party re-registered the npm package name. The lack of a fixed version installation method and the risk of plaintext keys may have led to credential leakage. Currently, there is no actual evidence of theft, and Bitkub has not yet responded to the notification. The TranchePool vault within the Avalanche ecosystem was attacked due to a flaw in its cross-day settlement logic. Attackers used flash loans and duplicate withdrawals to transfer approximately 1.0134 million USDC within 202 seconds. The incident pertains to a vulnerability in an upper-layer application; the underlying network was unaffected. GCSA stated that it has reported the incident to relevant platforms and released the original analysis and evidence for industry reference.