News linked to both this project and an event.
According to SlowMist, its security personnel discovered during routine threat intelligence monitoring that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js has been implanted with a malicious loader. The loader hides the address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com; note that the domain starts with the letter 'q'). This script reads page-accessible Cookie, localStorage, and sessionStorage data, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[.]com/c.php, enabling attackers to hijack sessions or take over accounts. This data collection behavior is not restricted by target site policies, and unmatched pages may also be affected. According to SlowMist's analysis, the script also targets three categories of sites: mgbx[.]com, bikingex[.], and bitxex[.]io. It scans deposit pages every 200 milliseconds and replaces recognized deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, by wrapping the Clipboard API, replacing copy buttons, and intercepting copy events, the script ensures users only see and copy tampered addresses. If users transfer funds to these addresses, the assets will flow into the attacker's wallet.
pump.fun has launched perpetual contract trading services on its frontend based on Hyperliquid's Builder Code mechanism.pump.fun stated in its official documentation that when users trade on Hyperliquid through its perpetual contract feature, pump.fun charges a developer fee (Builder Fee) of up to 0.10% on the notional value of each order submitted by users (including opening, adding to, or closing positions). Additionally, for each transfer of assets to or from Hyperliquid via the cross-chain bridge provided within the app, pump.fun charges a fee of up to 0.25%, which is charged on top of the fees collected by the cross-chain bridge operator itself and may be displayed together with the operator's fee as a combined cross-chain fee amount.
According to Bernama, a man in Perak, Malaysia, reportedly had his crypto wallet compromised, resulting in losses of approximately 12.47 million ringgit (roughly $3.05 million USD). The Perak state police chief stated that the victim discovered on the afternoon of October 9 that his digital assets had been transferred without authorization. Preliminary investigations indicate that the transactions were conducted via blockchain networks. Law enforcement is collaborating with the Cryptocurrency Unit of the Commercial Crime Investigation Department to trace the flow of funds and investigate those involved. The case is currently being investigated under Section 420 of the Malaysian Penal Code concerning fraud, while the specific attack method remains undisclosed.
Odaily News: Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after using a download link provided in a Claude chat window to install a transcription application. The link pointed to a fake website bundled with malware, which attempted to steal all information from his device upon execution.Numa Lunah said he wiped and reinstalled the affected laptop and found no signs of sensitive data leakage. Subsequently, he discovered a contaminated Claude Code skill file named SKILL.md in his backups. The file was disguised as a style guide written by himself and contained instructions to re-download malware and steal credentials every time it was loaded.Microsoft Defender Experts previously warned that attackers have shifted from search engine optimization poisoning to large language model response poisoning. These tactics include recommending attacker-controlled download links, AI-branded fake installers, and contaminated code repositories and agent skills. Individuals working in the crypto industry may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSONs, exchange API keys with withdrawal permissions, and deployer keys. (Bitcoin.com News)
BNB Chain has announced the official mainnet launch of its AI Agent development platform, BNB Agent Studio.Developers can now use a single prompt in AI coding tools like Cursor and Claude Code to complete Agent wallet creation, on-chain identity registration (ERC-8004), and deployment, without needing to separately set up wallets, identities, payments, custody, or LLM integration.Once deployed, Agents can use the x402 protocol to automatically deduct fees from users' pre-funded wallets to cover LLM usage, and they can be discovered and invoked by other Agents via the ERC-8183 task interface. The entire process runs on the AWS Bedrock AgentCore.The platform is also launching a limited-time free trial, where users can experience the full deployment process on the BSC testnet using their GitHub account.
Bitget Launches the “Code 0511” New User Campaign, Running from May 11 to May 18. During the campaign period, users who complete KYC verification will receive 1–5 USDT; those who complete their first deposit and futures trading task—each totaling at least 100 USDT—will receive an additional 10 USDT. Moreover, new users whose futures trading volume reaches specified thresholds can claim further rewards, with a maximum cumulative reward of 641 USDT. Full campaign rules are published on the official Bitget platform. Eligible users must click the “Join Now” button to register before participating.
Bitget Wallet has launched a Labor Day QR code payment campaign, running from April 28 to May 7, further driving the adoption of stablecoin payments in everyday consumption and travel scenarios across the Asia-Pacific (APAC) region. During the campaign, users who complete offline QR code payments using USDT or USDC will receive RLUSD cashback for each transaction. From May 1 to May 7, Bitget Wallet will randomly select one paying user per day to receive an additional 1,000 RLUSD cashback. To lower the barrier to first-time usage, Bitget Wallet will also airdrop XRP to eligible participants—serving as the account reserve required to activate RLUSD withdrawals. RLUSD is a compliant U.S. dollar-pegged stablecoin issued by Ripple and regulated by the New York State Department of Financial Services (NYDFS). This campaign marks Bitget Wallet’s first real-world consumer application following its integration of the XRP Ledger (XRPL) mainnet and onboarding of the RLUSD payment ecosystem at the end of March—and represents a key milestone in advancing Bitget Wallet’s Everyday Finance strategy.
Binance has announced support for users to make payments at all merchants in Bolivia using Binance QR codes. Over 100 cryptocurrencies—including USDT and BTC—are supported. Users simply confirm transactions via the app, and Binance automatically converts their funds into the local currency at the time of payment. Binance stated that the QR code payment service is available exclusively to Binance users whose identity verification location is in Bolivia, and users must hold cryptocurrency in their Binance account (Binance Spot, Deposit, or Earn).