News Heat Trend
Project Overview
Code is a crypto payments organization has built an app to take on one of the internet's oldest dreams: micropayments, the ability to spend tiny amounts of value for digital goods (like access to blog posts, live streams or digital art). Code builds upon the kin (KIN) cryptocurrency.
Self-Custody Proposal Would Require RIAs to Clarify Bankruptcy Protections for Crypto Assets
Odaily News: A Fox Business crypto reporter posted on X that a self-custody proposal focuses on bankruptcy protections and would require registered investment advisers to sign written agreements with clients clarifying that adviser-self-custodied crypto assets will be treated as financial assets under Article 8 of the Uniform Commercial Code. The move may be intended to reduce the risk of clients losing crypto assets if an adviser becomes insolvent.
VAST completes approximately 3 billion yuan in financing and releases Tripo P2.0 foundation model
AI 3D company VAST (Sanqi Wanwu) has announced the completion of Series B and Series B+ financing rounds, totaling approximately 3 billion yuan, led by Matrix Partners China. Perfect World, BlueFocus, Singdun Energy Investment, Yanqu Games, ThunderSoft, 37 Interactive Entertainment, as well as CDH VGC, CICC Capital, CMC Capital and others participated as co-investors, with existing shareholders Fortune Capital, Primavera Capital, and Source Code Capital continuing to follow up. According to official sources, VAST has raised approximately 5 billion yuan in cumulative financing in less than six months.It is also reported that VAST has released the latest version of its flagship 3D foundation model, Tripo P2.0, from the Tripo P series. The funds from this round of financing will be invested in the iteration of 3D native models and data capabilities, expansion of training and inference infrastructure, product development, and commercial implementation. (Sina Finance)
AI Code Verification Startup Blacksmith Closes $45 Million Series B Round, Led by Peak XV Partners
According to TechCrunch, AI code verification startup Blacksmith announced the completion of a $45 million Series B funding round, led by Peak XV Partners, with participation from GV and Y Combinator, valuing the company at $550 million.
AI programming startup Cognition completes over $1 billion in funding, valuation reaches $25 billion
: AI programming startup Cognition announced the completion of a new funding round of over $1 billion, with its pre-money valuation surging to $25 billion, doubling from the $10.2 billion post-money valuation achieved just 8 months ago.This funding round was led by Lux Capital and General Catalyst, with continued participation from Founders Fund and 8VC. New investors include Ribbit Capital, Atreides, and Layer Global.According to official data, the company's AI programmer product, Devin, has achieved a 50% month-over-month growth in enterprise user adoption over the past 6 months. The company's current Annual Recurring Revenue (ARR) has reached $492 million, with customers including major institutions such as Mercedes-Benz, NASA, Goldman Sachs, and Santander Bank.Facing competition from native AI coding tools such as Anthropic Claude Code, OpenAI Codex, and Google Jules, Cognition stated that Devin's continued growth and the acquisition of Windsurf assets demonstrate that independent AI programming agents still possess commercial viability.
Binance Wallet Exploited via EIP-7702 Delegation Redirected to Malicious Code; Source of Attacker's Authorization Not Yet Confirmed
according to Bitcoin News monitoring, attackers allegedly used EIP-7702 delegation to point the Binance Wallet to malicious code, thereby transferring funds. How the attacker obtained authorization is still under investigation, with two possibilities currently: the private key was stolen, or the attacker obtained a malicious authorization signature through a compromised signing process. Neither scenario has been confirmed. If the private key was not stolen, this attack may expose a significant vulnerability in the exchange's transaction authorization mechanism, rather than a private key security issue.
A Malaysian man's crypto wallet was allegedly hacked, resulting in losses of approximately $3.05 million.
According to Bernama, a man in Perak, Malaysia, reportedly had his crypto wallet compromised, resulting in losses of approximately 12.47 million ringgit (roughly $3.05 million USD). The Perak state police chief stated that the victim discovered on the afternoon of October 9 that his digital assets had been transferred without authorization. Preliminary investigations indicate that the transactions were conducted via blockchain networks. Law enforcement is collaborating with the Cryptocurrency Unit of the Commercial Crime Investigation Department to trace the flow of funds and investigate those involved. The case is currently being investigated under Section 420 of the Malaysian Penal Code concerning fraud, while the specific attack method remains undisclosed.
Two Men Arrested for Illegally Stealing Electricity to Mine, Police Seize 30 Bitcoin Mining Rigs
According to The Star, the Perak Central Regional Police, in cooperation with the National Energy Company (TNB), carried out an operation in Seri Iskandar to dismantle an illegal cryptocurrency mining site and arrest two local men. The suspects are alleged to have illegally tapped into power lines to supply electricity to Bitcoin mining rigs, with police seizing 30 Bitcoin mining rigs, routers, desktop switches, and a roll of wiring at the scene. The case is being investigated under Section 427 of the Penal Code and Section 37(1) of the Electricity Supply Act 1990. Police emphasized that stealing electricity for mining not only violates the law but could also cause significant losses to power companies and pose fire hazards.
LDP lawmakers' group plans to discuss prediction market regulation, focusing on harmonizing gambling-related laws
According to NADA NEWS, the Liberal Democratic Party's parliamentary group, the "Digital Advanced Financial Parliamentary Alliance," intends to place prediction markets on its discussion agenda to examine their legal status and regulatory framework in Japan. Japan's existing laws have not yet explicitly defined prediction markets, and related operations could potentially constitute the crime of gambling under the Penal Code.
Bulgarian Parliament Passes Bill Granting Tax Authorities Full Access to Crypto Users' Data
: On September 9, Bulgaria's National Assembly passed amendments to the Tax and Social Security Procedure Code with 149 votes in favor, 0 against, and 10 abstentions, which will allow the Bulgarian National Revenue Agency to obtain detailed information on crypto asset users. The bill was approved by the 240-seat parliament.The amendments implement two European Union (EU) directives, requiring crypto asset-related businesses to register and report to the Bulgarian National Revenue Agency users' names, addresses, dates and places of birth, tax residences, and tax identification numbers, as well as to submit transaction data for various types of crypto assets, including gross amounts received, number of transactions, number of fiat buy and sell transactions, and crypto asset exchange activity.Privacy advocates criticized the scope of data collection as overly broad, arguing that mandatory disclosure of personal information could pose security risks. Crypto traders and small businesses said the registration and reporting requirements will increase compliance costs; supporters of the bill argue it aligns with EU standards and helps curb tax evasion. The relevant directives require EU member states to complete adoption by December 31, 2025. (Bitcoin.com News)
Sparrow Wallet Releases Version 2.5.4, AI-Assisted Code Review Fixes Multiple Security Vulnerabilities
According to Decrypt, privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on August 28. Developer Craig Raw stated that the update was driven by an AI-assisted code review, with the majority of fixes originating from it. This review was prompted by the recent seed generation code vulnerability exploit affecting Coldcard, as well as the release of unrestricted AI models in China, which has significantly enhanced vulnerability scanning capabilities across large codebases. Key updates include: validating the authenticity of transactions returned by Electrum servers, enforcing stricter BitBox02 hardware wallet security requirements (firmware v9.4.0 or higher required), patching local DNS leaks, and masking sensitive credentials in debug logs. Raw noted that there are no indications of any exploits being leveraged, user funds remain secure, and he still advises all users to update at their earliest convenience.
SlowMist: Udesk Customer Service Script Infected with Malicious Code, Can Steal User Session Data and Replace Deposit Addresses
According to SlowMist, its security personnel discovered during routine threat intelligence monitoring that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js has been implanted with a malicious loader. The loader hides the address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com; note that the domain starts with the letter 'q'). This script reads page-accessible Cookie, localStorage, and sessionStorage data, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[.]com/c.php, enabling attackers to hijack sessions or take over accounts. This data collection behavior is not restricted by target site policies, and unmatched pages may also be affected. According to SlowMist's analysis, the script also targets three categories of sites: mgbx[.]com, bikingex[.], and bitxex[.]io. It scans deposit pages every 200 milliseconds and replaces recognized deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, by wrapping the Clipboard API, replacing copy buttons, and intercepting copy events, the script ensures users only see and copy tampered addresses. If users transfer funds to these addresses, the assets will flow into the attacker's wallet.
pump.fun has launched perpetual contract trading services based on Hyperliquid, charging a Builder Fee of up to 0.1% per order
pump.fun has launched perpetual contract trading services on its frontend based on Hyperliquid's Builder Code mechanism.pump.fun stated in its official documentation that when users trade on Hyperliquid through its perpetual contract feature, pump.fun charges a developer fee (Builder Fee) of up to 0.10% on the notional value of each order submitted by users (including opening, adding to, or closing positions). Additionally, for each transfer of assets to or from Hyperliquid via the cross-chain bridge provided within the app, pump.fun charges a fee of up to 0.25%, which is charged on top of the fees collected by the cross-chain bridge operator itself and may be displayed together with the operator's fee as a combined cross-chain fee amount.
A Malaysian man's crypto wallet was allegedly hacked, resulting in losses of approximately $3.05 million.
According to Bernama, a man in Perak, Malaysia, reportedly had his crypto wallet compromised, resulting in losses of approximately 12.47 million ringgit (roughly $3.05 million USD). The Perak state police chief stated that the victim discovered on the afternoon of October 9 that his digital assets had been transferred without authorization. Preliminary investigations indicate that the transactions were conducted via blockchain networks. Law enforcement is collaborating with the Cryptocurrency Unit of the Commercial Crime Investigation Department to trace the flow of funds and investigate those involved. The case is currently being investigated under Section 420 of the Malaysian Penal Code concerning fraud, while the specific attack method remains undisclosed.
Refi Hub Co-founder Hit by Malicious Claude Link Attack, Contaminated Skill File Attempts to Steal Credentials
Odaily News: Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after using a download link provided in a Claude chat window to install a transcription application. The link pointed to a fake website bundled with malware, which attempted to steal all information from his device upon execution.Numa Lunah said he wiped and reinstalled the affected laptop and found no signs of sensitive data leakage. Subsequently, he discovered a contaminated Claude Code skill file named SKILL.md in his backups. The file was disguised as a style guide written by himself and contained instructions to re-download malware and steal credentials every time it was loaded.Microsoft Defender Experts previously warned that attackers have shifted from search engine optimization poisoning to large language model response poisoning. These tactics include recommending attacker-controlled download links, AI-branded fake installers, and contaminated code repositories and agent skills. Individuals working in the crypto industry may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSONs, exchange API keys with withdrawal permissions, and deployer keys. (Bitcoin.com News)
BNB Agent Studio is Now Live on BNB Chain Mainnet
BNB Chain has announced the official mainnet launch of its AI Agent development platform, BNB Agent Studio.Developers can now use a single prompt in AI coding tools like Cursor and Claude Code to complete Agent wallet creation, on-chain identity registration (ERC-8004), and deployment, without needing to separately set up wallets, identities, payments, custody, or LLM integration.Once deployed, Agents can use the x402 protocol to automatically deduct fees from users' pre-funded wallets to cover LLM usage, and they can be discovered and invoked by other Agents via the ERC-8183 task interface. The entire process runs on the AWS Bedrock AgentCore.The platform is also launching a limited-time free trial, where users can experience the full deployment process on the BSC testnet using their GitHub account.
Bitget Launches New User Futures Campaign with Up to $656 USDT Rewards per User
Bitget Launches the “Code 0511” New User Campaign, Running from May 11 to May 18. During the campaign period, users who complete KYC verification will receive 1–5 USDT; those who complete their first deposit and futures trading task—each totaling at least 100 USDT—will receive an additional 10 USDT. Moreover, new users whose futures trading volume reaches specified thresholds can claim further rewards, with a maximum cumulative reward of 641 USDT. Full campaign rules are published on the official Bitget platform. Eligible users must click the “Join Now” button to register before participating.
Cursor: Security incident discovered involving an extension, estimated to affect up to 5,000 users
Odaily reports: Cursor, the AI coding tool under SpaceX, posted on X: "We have discovered a security incident affecting a tampered Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, affecting up to 5,000 users. This malicious extension version was not developed by Anthropic, and it does not affect other extensions downloaded from the official website, Grok Bot, Grok, or our other SpaceXSI products.In response, we shut down the extension marketplace this afternoon, worked with the relevant service providers to remove the malware, and reopened the marketplace after confirming there was no further risk. If you are affected, please refer to the instructions in the official blog post to learn how to identify the malicious package and take measures to mitigate any potential impact. We have asked all customers to update Claude Code for VS Code to version 2.1.314."
Binance Wallet Exploited via EIP-7702 Delegation Redirected to Malicious Code; Source of Attacker's Authorization Not Yet Confirmed
according to Bitcoin News monitoring, attackers allegedly used EIP-7702 delegation to point the Binance Wallet to malicious code, thereby transferring funds. How the attacker obtained authorization is still under investigation, with two possibilities currently: the private key was stolen, or the attacker obtained a malicious authorization signature through a compromised signing process. Neither scenario has been confirmed. If the private key was not stolen, this attack may expose a significant vulnerability in the exchange's transaction authorization mechanism, rather than a private key security issue.
Critical Remote Code Execution Vulnerability Disclosed on U.S. Election Assistance Commission Website
Cybersecurity firm XBOW disclosed that it discovered a critical remote code execution (RCE) vulnerability in a publicly accessible web application for the U.S. Election Assistance Commission (EAC), which can be exploited without authentication. The application is used for resource and logistics calculations, and is not a voting machine or voter registration system.
Researchers Disclose Zero-Click Vulnerability in Telegram Emoji Stickers Enabling Code Execution on iOS
Researchers disclosed a zero-click vulnerability in Telegram's emoji sticker feature at a security conference held in Tokyo, and demonstrated that attackers can execute code on iOS devices without any user interaction. However, Telegram disputes the risk assessment of the vulnerability, and the available information has not yet clarified the specific scope of impact or remediation progress.
SlowMist: Udesk Customer Service Script Infected with Malicious Code, Can Steal User Session Data and Replace Deposit Addresses
According to SlowMist, its security personnel discovered during routine threat intelligence monitoring that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js has been implanted with a malicious loader. The loader hides the address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com; note that the domain starts with the letter 'q'). This script reads page-accessible Cookie, localStorage, and sessionStorage data, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[.]com/c.php, enabling attackers to hijack sessions or take over accounts. This data collection behavior is not restricted by target site policies, and unmatched pages may also be affected. According to SlowMist's analysis, the script also targets three categories of sites: mgbx[.]com, bikingex[.], and bitxex[.]io. It scans deposit pages every 200 milliseconds and replaces recognized deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, by wrapping the Clipboard API, replacing copy buttons, and intercepting copy events, the script ensures users only see and copy tampered addresses. If users transfer funds to these addresses, the assets will flow into the attacker's wallet.
PHP Officially Urges Users to Update Immediately to Avoid Severe Remote Code Execution Vulnerabilities
Odaily reports: PHP has issued a security advisory regarding two previously disclosed critical remote code execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Attackers may exploit these vulnerabilities to execute malicious code without authentication, and PHP officially strongly recommends that all users upgrade immediately.These vulnerabilities affect PHP environments that handle web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Among these, Apache mod_php poses a particularly prominent risk, as attacks can be triggered before application code runs.Official patched versions have been released: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users still running PHP 8.1 or earlier should contact their distribution or long-term support (LTS) vendor to confirm patch availability, or upgrade to a supported version. Officials emphasize that temporary mitigation measures cannot fully eliminate the risk—installing security updates immediately is the only complete way to address the vulnerabilities.
Cursor: Security incident discovered involving an extension, estimated to affect up to 5,000 users
Odaily reports: Cursor, the AI coding tool under SpaceX, posted on X: "We have discovered a security incident affecting a tampered Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, affecting up to 5,000 users. This malicious extension version was not developed by Anthropic, and it does not affect other extensions downloaded from the official website, Grok Bot, Grok, or our other SpaceXSI products.In response, we shut down the extension marketplace this afternoon, worked with the relevant service providers to remove the malware, and reopened the marketplace after confirming there was no further risk. If you are affected, please refer to the instructions in the official blog post to learn how to identify the malicious package and take measures to mitigate any potential impact. We have asked all customers to update Claude Code for VS Code to version 2.1.314."
PHP Officially Urges Users to Update Immediately to Avoid Severe Remote Code Execution Vulnerabilities
Odaily reports: PHP has issued a security advisory regarding two previously disclosed critical remote code execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Attackers may exploit these vulnerabilities to execute malicious code without authentication, and PHP officially strongly recommends that all users upgrade immediately.These vulnerabilities affect PHP environments that handle web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Among these, Apache mod_php poses a particularly prominent risk, as attacks can be triggered before application code runs.Official patched versions have been released: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users still running PHP 8.1 or earlier should contact their distribution or long-term support (LTS) vendor to confirm patch availability, or upgrade to a supported version. Officials emphasize that temporary mitigation measures cannot fully eliminate the risk—installing security updates immediately is the only complete way to address the vulnerabilities.
CoreWeave launches Physical AI Launchables to simplify physical AI workloads
Odaily reports: AI cloud service provider CoreWeave has announced the launch of Physical AI Launchables, unveiled at the NVIDIA GTC Berlin event. The product offers physical AI workload templates built and tested by CoreWeave engineers, aimed at robotics, autonomous vehicle, and simulation teams, enabling task launch via a single command and reducing upfront preparation work such as environment configuration, storage setup, and task scheduling.The first batch of templates covers five tools—NVIDIA Isaac Sim, CARLA, MuJoCo, NVIDIA AlpaSim, and NVIDIA Cosmos 3—supporting workflows such as data generation, model evaluation, and policy training, and integrating Cosmos Data Factory-related agent skills usable for video, image, and text data augmentation, auto-labeling, and data curation. The platform also provides specially optimized skills for coding agents such as Claude Code and Codex, supporting automatic task launch, run-status monitoring, and result retrieval.CoreWeave is also collaborating with physical AI software vendors including Cadence, Encord, and Voxel51 to bring related products onto its cloud infrastructure.
Oracle Launches Industry Application AI Agent Studio, Supporting Codeless and Low-Code Development of Industry Agents
According to an Oracle announcement, the company has launched the Industry Application AI Agent Studio, a no-code and low-code platform designed for industry applications that can be used to create, test, orchestrate, deploy, and manage AI Agents and multi-agent workflows. Built on Oracle AI Agent Studio for Fusion Applications, the platform can access existing application data, tools, and business processes, and supports features such as natural language and visual orchestration, cross-application workflows, Model Context Protocol (MCP), multiple generative AI models, testing and debugging, security controls, lifecycle management, and monitoring.
SlowMist Security Alert: PHP Exposed with Two Critical Remote Code Execution Vulnerabilities, Official Patch Expected Tonight
SlowMist has issued a security alert stating that PHP released a security advisory on October 20, disclosing two critical security vulnerabilities that could lead to remote code execution (RCE), tracked as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Currently, PHP officials have not yet released a fix patch, and the specific affected versions and exploitation conditions remain to be confirmed.According to available information, PHP officials plan to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). SlowMist recommends that relevant organizations promptly check the PHP versions in their servers and business systems, with particular attention to PHP services exposed to the public internet, and upgrade in a timely manner once the patch is released; systems that cannot be upgraded immediately should restrict access sources and take isolation measures when necessary.
Anthropic Opens Office in Singapore, Signs MOU with Government
According to the Anthropic official website, Anthropic announced the opening of its fifth Asia-Pacific office in Singapore and signed a Memorandum of Understanding (MoU) with Singapore's Ministry of Digital Development and Information. The two parties will collaborate in areas such as AI safety, model evaluation, and responsible AI adoption. Singapore is one of Claude's most active global markets, where over a thousand government agencies and enterprises, including GovTech Singapore, DBS, Grab, and GIC, have already deployed Claude. Among them, over 1,500 engineers at GovTech Singapore have adopted Claude Code to advance government system modernization, while Grab leverages Claude-driven sales assistants to save approximately 40,000 labor hours per quarter.
Related news
Malicious Version of Claude Code Extension Discovered in Cursor Extension Marketplace, Affecting Up to 5,000 Users
Cursor recommends that affected users check authorized_keys for the svc-telemetry key, run the official fix script, and rotate the related credentials.
Cursor: Security incident discovered involving an extension, estimated to affect up to 5,000 users
Odaily reports: Cursor, the AI coding tool under SpaceX, posted on X: "We have discovered a security incident affecting a tampered Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, affecting up to 5,000 users. This malicious extension version was not developed by Anthropic, and it does not affect other extensions downloaded from the official website, Grok Bot, Grok, or our other SpaceXSI products.In response, we shut down the extension marketplace this afternoon, worked with the relevant service providers to remove the malware, and reopened the marketplace after confirming there was no further risk. If you are affected, please refer to the instructions in the official blog post to learn how to identify the malicious package and take measures to mitigate any potential impact. We have asked all customers to update Claude Code for VS Code to version 2.1.314."
Binance Wallet Exploited via EIP-7702 Delegation Redirected to Malicious Code; Source of Attacker's Authorization Not Yet Confirmed
according to Bitcoin News monitoring, attackers allegedly used EIP-7702 delegation to point the Binance Wallet to malicious code, thereby transferring funds. How the attacker obtained authorization is still under investigation, with two possibilities currently: the private key was stolen, or the attacker obtained a malicious authorization signature through a compromised signing process. Neither scenario has been confirmed. If the private key was not stolen, this attack may expose a significant vulnerability in the exchange's transaction authorization mechanism, rather than a private key security issue.
Critical Remote Code Execution Vulnerability Disclosed on U.S. Election Assistance Commission Website
Cybersecurity firm XBOW disclosed that it discovered a critical remote code execution (RCE) vulnerability in a publicly accessible web application for the U.S. Election Assistance Commission (EAC), which can be exploited without authentication. The application is used for resource and logistics calculations, and is not a voting machine or voter registration system.
Anthropic Launches Claude Intelligent Reporting Tool to Monitor Employee AI Usage and Costs
Anthropic has launched a smart reporting feature for Claude Enterprise users, helping business managers analyze their teams' usage of Claude, workflows, output types, and associated costs. Administrators can select a reporting period of up to 28 days, covering products such as Claude conversations, Claude Code, and Claude Cowork.
Researchers Disclose Zero-Click Vulnerability in Telegram Emoji Stickers Enabling Code Execution on iOS
Researchers disclosed a zero-click vulnerability in Telegram's emoji sticker feature at a security conference held in Tokyo, and demonstrated that attackers can execute code on iOS devices without any user interaction. However, Telegram disputes the risk assessment of the vulnerability, and the available information has not yet clarified the specific scope of impact or remediation progress.