ChangeNOW Fixes Website Integration Flaw and Introduces NOW AI Security Lab

ChangeNOW says it fixed a vulnerability in an integration used on its website after identifying the issue on October 15 with help from independent security researchers. The company has no evidence that anyone exploited the flaw, but it is reviewing possible exposure scenarios and warning clients that email addresses and transaction details may have been accessible.

The incident affected a website integration, according to ChangeNOW. The company says its transaction infrastructure was not affected and customer funds were never at risk. It has not described the integration, the vulnerability’s technical cause, how long it may have existed, or how many clients could have been affected. Those limits leave the scope of possible information exposure uncertain.

What the disclosure establishes

There are two distinct questions in ChangeNOW’s account: whether the flaw was exploited, and whether information could have been exposed. The company reports no evidence of exploitation, while still treating exposure as a possibility. That distinction matters because a lack of confirmed misuse does not establish that no one else found the issue or accessed information through it.

ChangeNOW says researchers helped identify the vulnerability, but it does not say whether they were the first or only people to discover it. The company is therefore reviewing potential scenarios and notifying clients as a precaution. It has not published technical details that would let outside readers assess the flaw’s severity or independently determine which records were reachable.

The information named as potentially exposed includes email addresses and transaction details. The company has not specified what transaction details might mean in this case, or whether any other categories of information were involved. Clients should treat unexpected messages that refer to real activity as requiring careful verification: a message can appear credible if it uses information connected to a transaction or past support contact.

What clients are being told to do

ChangeNOW advises clients to check the sender before replying to an unexpected message, opening links, or sharing information. It says it contacts clients exclusively through [email protected] and will never request a private key, seed phrase, or password by email.

That guidance focuses on the risk that exposed details could make an unsolicited message more convincing. A reference to a genuine transaction does not, by itself, prove that a message came from ChangeNOW. Clients should use the stated support address to verify suspicious contact and avoid sending credentials or wallet secrets by email.

The company has not said that fraudulent messages have been sent, nor has it reported confirmed misuse of client data. Its warning is based on the possibility that information may have been exposed and the uncertainty over whether other parties could have found the flaw. That is a precautionary notice, not a report of confirmed downstream activity.

NOW AI’s stated role

Alongside its disclosure, ChangeNOW announced NOW AI, described as a dedicated protection lab intended to improve security across its products. The company says the lab will apply technology to defensive work, including identifying threats earlier and building stronger protections into its products. It links the launch to the wider concern that AI tools can make malicious activity easier to automate and scale.

The company says the vulnerability disclosure accelerated the lab’s launch. It has not yet detailed NOW AI’s staffing, technical methods, scope, or timeline, and says it plans to share more on a dedicated page. Until those details are available, the announcement sets out an intended focus rather than measurable results or a defined set of controls.

For users and developers, the immediate issue remains the website integration flaw and the unknown scope of any possible exposure. The company’s statement draws a boundary between that website component and the transaction infrastructure, while leaving open questions about what data the integration could reach. Further detail about the affected integration and the review’s findings would help clients understand the practical limits of the incident.

ChangeNOW describes itself as a crypto platform that has operated since 2017, with services including storage, swaps, trading, staking, and asset management. Its website is ChangeNOW.io. For now, the clearest takeaways are that the company says it patched the flaw, has no evidence of exploitation, and is treating potential exposure seriously while it reviews what may have been accessible.