News linked to both this project and an event.
Odaily reports: OKX Star posted on X, stating: "OKX detects and responds to various cyberattacks every month, including advanced persistent threat (APT) attacks targeting the crypto industry. More than a year ago, OKX launched LLM-based automated penetration testing. Regarding the security incidents recently encountered by our peers, we will certainly learn lessons seriously, comprehensively strengthen self-inspections, continuously improve our security system, and always remain humble and vigilant."
zkLink has announced a bounty program in response to the recent security incident affecting zkLink Nova, aimed at facilitating the recovery of affected funds. Security researchers or white-hat contributors who provide information that materially assists in fund recovery may receive a reward of up to 20% of the recovered amount, with specific eligibility and reward amounts to be determined by zkLink based on the value of the information provided.Additionally, if the exploiter returns all funds, they may retain 20% as a white-hat bounty, and zkLink commits not to take further legal action regarding the returned funds. Related communications can be conducted through zkLink's official X account or email.
SlowMist Chief Information Security Officer 23pds stated that, based on historical forensic experience, the one-time transfer of Binance's assets indicates the attacker successfully bypassed the risk control system. Whether the intrusion vector involved a leaked private key or compromised signing machines still requires priority verification. He personally leans toward the private key leakage hypothesis and believes the attacker most likely employed custom-built withdrawal tools. He advises security teams to prioritize investigating private key leak pathways and anomalies associated with unauthorized withdrawal tools during attribution and forensic investigations.
Odaily reports: According to Lookonchain monitoring, the Binance attacker has completed the sell-off of 7 tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, cumulatively converting to 70,480 ETH, valued at approximately $158.25 million based on current quoted prices. Among them:UNI: sold 7.02 million tokens, worth $39.63 million, at an average price of $5.65;ENA: sold 217.5 million tokens, worth $33.93 million, at an average price of $0.16;PEPE: sold 7.77 trillion tokens, worth $31.66 million, at an average price of $0.0000041;LINK: sold 2.57 million tokens, worth $26.05 million, at an average price of $10.14;AAVE: sold 127,953 tokens, worth $14.27 million, at an average price of $111.55;ONDO: sold 21.85 million tokens, worth $6.62 million, at an average price of $0.30;WLD: sold 17.32 million tokens, worth $6.09 million, at an average price of $0.35.
Odaily Report: During the Binance attack, an obvious arbitrage opportunity emerged on-chain. According to a community user's review, the attacker, in order to avoid Tether freezing, swapped a large amount of USDT for ETH through DEXs, causing the ETH price on Uniswap to briefly rise to $2,560–$2,750, with some individual trades exceeding $3,000, while Aave's ETH price obtained through the Chainlink oracle remained at $2,250–$2,290. A price gap of 15% to 30% appeared between on-chain and oracle prices, lasting nearly an hour.Arbitrageurs exploited this price gap by depositing USDC/USDT as collateral into Aave, borrowing ETH at the oracle price, then selling it at high prices on DEXs, and buying back ETH to repay the loans once the spread narrowed. According to the user's statistics, within 6 hours after the incident, a total of 61 addresses borrowed ETH on Aave mainnet (excluding the hacker's address). Among them, the most profitable address sold 12,289 ETH at an average price of approximately $2,580, then bought back 12,314 ETH at an average price of approximately $2,297, earning about $3.47 million. The top ten arbitrage addresses collectively profited approximately $6.36 million.The user stated that the arbitrageurs exploited the price disconnection between centralized exchanges and DEXs, and that the Aave contract itself had no vulnerability. As DEX prices fell back and Aave froze the mainnet V3 market, the arbitrage window gradually closed. The above profits are based on transaction-by-transaction on-chain statistics and have not yet deducted Gas fees.
Bonk Guy posted on X stating that the Binance incident is unlikely to trigger systemic risk. Binance is reportedly generating annual revenue of approximately $16-17 billion, and nearly half of the funds involved in this incident have already been frozen or may be recovered. The amount that may ultimately be unrecoverable is approximately $3.2 billion, equivalent to about 2 to 2.5 months of Binance's revenue, which remains manageable relative to its operating scale.Bonk Guy noted that both Changpeng Zhao (CZ) and He Yi have publicly stated that user funds are safe and that all losses will be fully covered. He believes the likelihood of systemic risk and a bank run is extremely low, and that the market should be more vigilant about panic selling and media overhyping, reminding investors not to make trading decisions based on panic sentiment.
Blockaid reported detecting an attack on the Tranche Vault associated with Valinor Digital on Avalanche. The attacker leveraged flash loans to mint artificially inflated tranche shares, then proceeded to redeem the vault’s remaining USDC. As of this post, the attacker had transferred approximately $1.01 million from the vault across roughly two transactions.
According to monitoring by on-chain analyst Onchain Lens (@OnchainLens), the BSC-based prediction market platform Predict Fun was allegedly compromised via a vulnerability, with approximately $300,000 in suspected stolen funds transferred from multiple contracts through intermediary wallets to Relay. These funds were reportedly routed into Tornado Cash following a cross-chain transfer.
Odaily reports: Vitalik posted on X platform that he believes it is acceptable for Kimi 3.1 to intentionally exclude high-end offensive cyber capabilities from its training data. Compared to treating users differently based on identity, treating them differently based on use case is far less problematic; society needs time to prepare, harden systems, review old code, and formally verify new code before a full-scale wave of powerful cyberattacks arrives. Vitalik also stated that if the first major wave of AI risk is not properly addressed, society could move toward a scenario of highly restricted models, widespread KYC and surveillance, where users might be divided into different tiers based on credentials and nationality, receiving different levels of model access.
Odaily reports: Bitcoin Core developers have merged a security policy adjustment. For vulnerabilities that can be easily discovered or rediscovered through simple large language model (LLM) prompts, the previous long-term confidential disclosure mechanism will no longer be used. The new rules allow developers to mark such issues as "easy to find" during vulnerability classification, then backport fixes to all still-supported versions and release them as soon as possible through minor version updates, along with a security advisory and some vulnerability details.Previously, Bitcoin Core scheduled disclosure based on vulnerability severity, with medium- and high-risk vulnerabilities usually only made public after the affected versions stopped being maintained. This adjustment stems from AI tools lowering the threshold for vulnerability discovery: in July this year, a Bitcoin Red Team composed of 16 developers used AI models to scan about 390 Bitcoin-related projects and recorded 4,962 findings in one day, of which 85 were listed as critical issues. Developers noted that continuing to extend the confidentiality period for such vulnerabilities can no longer effectively prevent attacks and instead delays the release of fixed versions; however, the new rules also mean that fixes may lack longer testing time. Currently, no vulnerability has been officially marked as falling into the "easy to find" category under the new rules. (CoinDesk)
According to Cointelegraph, Bitcoin Core developer Antoine Poinsot stated on Thursday on the bitcoin-dev mailing list that large language models (LLMs) have made certain software vulnerabilities extremely easy to rediscover. Maintaining long-term secrecy is already of limited value and instead delays the release of patched versions, prompting the team to update its vulnerability disclosure policy. The new policy dictates that "easily discoverable" vulnerabilities, which can be identified with minimal cost such as through simple LLM prompts, will be patched as soon as possible across all supported major versions, alongside the simultaneous release of security advisories. Other vulnerabilities will continue to be disclosed based on severity: low-severity vulnerabilities will be disclosed two weeks after the release of the major version containing the fix; medium-to-high-severity vulnerabilities will be disclosed two weeks after the end-of-life (EOL) of the last affected version, typically around one year after the patch release; critical vulnerabilities will be handled through a dedicated process.
Zipcoin has announced it is ceasing operations, stating that the project's codebase and related keys have been fully compromised, and attackers may control the project's wallets and infrastructure. The team noted that attempts to migrate the code and rotate credentials over the past 12 hours failed to identify a viable security solution. Zipcoin further disclosed that the project was impacted by the UNCX incident on October 15, during which hackers stole tokens from multiple Ethereum-based assets—including ZC, PAAL, and EDGEN—accounting for approximately 1.1% of their respective supplies, which were subsequently sold on open markets. The team had previously repurchased tokens from the market to offset the shortfall against future team commitment allocations.
Odaily reports: Papertrade founder Jez posted on X in response to the controversy over the non-transferability of the PAPER token, stating that the team was aware of certain unresolved technical issues before the protocol launched, including potential attack risks posed by the perpetual contract market, but had originally expected more time to find solutions.Jez noted that the team had previously estimated that a large perpetual contract market might take about 6 months to launch, but the relevant market progressed much faster than expected, forcing the team to make a decision before finding an effective solution. To safeguard the protocol's long-term healthy development, PAPER has currently been set to a non-transferable status.He emphasized that PAPER represents users' rights to the protocol's revenue, and its long-term value depends on whether Papertrade itself can continue to attract traders, rather than whether the token can be freely traded. The team is unwilling to restrict the protocol's business growth in order to support PAPER perpetual contract trading.In response to community concerns that the rule change harms the interests of early users, Jez stated that the adjustment was not a hasty decision but a risk management choice made by the team based on actual operating data from the first week since the protocol launched, and that the team will continue to adjust protocol parameters in the future to ensure long-term sustainability.
Vitalik Buterin (@VitalikButerin) stated that the ideal path for supporting various cryptographic algorithms lies in EIP-8288: users locally generate arbitrary signatures, produce STARK proofs, and submit them on-chain via a STARK aggregator. This avoids consuming calldata on-chain, so Ethereum no longer needs to add new precompiles. He also noted that if lattice cryptography (Lattice) is proven to be secure against AI attacks, it could still be utilized for accounts, wallets, and similar applications via precompiles in the future. Previously, Starknet co-founder Eli Ben-Sasson pushed back against related views from a16z, arguing that the rich mathematical structure of lattice cryptography makes it susceptible to AI attacks. Furthermore, the simplified variant based on Module SIS only emerged in 2012 and lacks sufficient maturity. He recommended waiting another three to five years until AI has thoroughly stress-tested these approaches before deploying them to custody large asset balances.
According to The Gulf Times, Sharjah Police successfully dismantled four interconnected transnational criminal networks, resulting in the arrest of 33 individuals and companies, marking the largest case in the department's history. The four groups had clearly defined roles: infiltrating systems to steal data, laundering funds through virtual assets, exploiting social engineering to seize digital wallets, and using violence to coerce victims into surrendering wallet passwords. Investigators pinpointed targets based on the suspects' lavish lifestyles (luxury cars, luxury watches, and jewelry) and secured a breakthrough through a young suspect possessing advanced digital skills. Following an examination of hundreds of pieces of digital evidence, authorities carried out targeted operations.
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
According to The Information, citing sources familiar with the matter, OpenAI is in early-stage acquisition talks with New York-based software security firm Trail of Bits, with the deal size currently undisclosed. The move aims to expand OpenAI’s cybersecurity business. Trail of Bits focuses on open-source software vulnerability detection and remediation, and has conducted security audits for crypto projects such as Uniswap, Aave, and Worldcoin. Prior to this, both parties jointly launched the open-source software security initiative “Patch the Planet” in June.
CZ posted a warning urging Ledger hardware wallet users to be more vigilant, especially those who recently purchased devices. He stated that based on currently available information, the incident appears to be related to a supply chain attack involving a certain vendor, and a small number of users may have purchased counterfeit or tampered Ledger devices.CZ said that Ledger is one of the most established and secure hardware wallets in the industry, having long withstood market tests, but similar incidents can still occur. He expressed hope and belief that BNB ecosystem participants and the entire crypto industry will assist in tracking and recovering the related funds.
Odaily News: Dragonfly Managing Partner Haseeb Qureshi stated that the "bunker mode" proposed by Ethereum researcher Justin Drake to address the risk of AI cracking cryptographic signatures amounts to "cryptographic doomerism," and argued that migrating tokens to new addresses is not a real solution.Qureshi said that "bunker mode" can only protect assets that users have not yet transferred out of new addresses. If tokens in other addresses are attacked and heavily sold off, those assets could still lose value. He suggested that blockchain networks adopt a "Cryptographic Recovery Mode," using hash-based backup signature schemes that allow users to bind recovery mechanisms in advance, so that validators can assist in recovering assets after cryptographic signatures are cracked.Previously, Ethereum researcher Justin Drake warned that with the rapid improvement of AI mathematical capabilities, the ECDSA signature algorithm protecting crypto wallets could face the risk of being cracked within "months rather than years," and advised users to gradually migrate funds to new wallets that have not exposed public keys. Glassnode data shows that approximately 6.26 million BTC are currently held in addresses with potential risk. (Cointelegraph)
Odaily News: U.S. Commodity Futures Trading Commission (CFTC) Chair Mike Selig stated that the CFTC's proposed crypto asset regulatory framework will establish a federal-level oversight system to protect exchange customers from fraud, market manipulation, and theft of customer funds, preventing a repeat of the FTX collapse. Mike Selig noted that the CFTC is working to introduce market-based regulatory mechanisms for crypto exchanges; he stated that critics who oppose these measures and support maintaining the status quo may objectively be benefiting fraudsters, manipulators, and those who misappropriate customer funds, and warned that the absence of such regulation could leave the door open for the next Sam Bankman-Fried figure.