News linked to both this project and an event.
The core platforms, including the Allium App, Explorer, and Explorer API, have been restored to service, though some features are still being recovered. For the latest updates, please refer to the official status page. Allium stated that it will release a summary of the investigation findings and response measures upon completion of the investigation.
Odaily reports: Bitcoin Core developers have merged a security policy adjustment. For vulnerabilities that can be easily discovered or rediscovered through simple large language model (LLM) prompts, the previous long-term confidential disclosure mechanism will no longer be used. The new rules allow developers to mark such issues as "easy to find" during vulnerability classification, then backport fixes to all still-supported versions and release them as soon as possible through minor version updates, along with a security advisory and some vulnerability details.Previously, Bitcoin Core scheduled disclosure based on vulnerability severity, with medium- and high-risk vulnerabilities usually only made public after the affected versions stopped being maintained. This adjustment stems from AI tools lowering the threshold for vulnerability discovery: in July this year, a Bitcoin Red Team composed of 16 developers used AI models to scan about 390 Bitcoin-related projects and recorded 4,962 findings in one day, of which 85 were listed as critical issues. Developers noted that continuing to extend the confidentiality period for such vulnerabilities can no longer effectively prevent attacks and instead delays the release of fixed versions; however, the new rules also mean that fixes may lack longer testing time. Currently, no vulnerability has been officially marked as falling into the "easy to find" category under the new rules. (CoinDesk)
According to Cointelegraph, Bitcoin Core developer Antoine Poinsot stated on Thursday on the bitcoin-dev mailing list that large language models (LLMs) have made certain software vulnerabilities extremely easy to rediscover. Maintaining long-term secrecy is already of limited value and instead delays the release of patched versions, prompting the team to update its vulnerability disclosure policy. The new policy dictates that "easily discoverable" vulnerabilities, which can be identified with minimal cost such as through simple LLM prompts, will be patched as soon as possible across all supported major versions, alongside the simultaneous release of security advisories. Other vulnerabilities will continue to be disclosed based on severity: low-severity vulnerabilities will be disclosed two weeks after the release of the major version containing the fix; medium-to-high-severity vulnerabilities will be disclosed two weeks after the end-of-life (EOL) of the last affected version, typically around one year after the patch release; critical vulnerabilities will be handled through a dedicated process.
Bitcoin Core has adjusted its security vulnerability disclosure policy, defining easily discoverable vulnerabilities as those that can be found through simple large language model prompts, and will release fixes as soon as possible across all major versions still under maintenance, while publishing security advisories.Bitcoin Core developer Antoine Poinsot stated that in the past, vulnerabilities were typically kept confidential during a longer disclosure embargo period to allow users to upgrade, but large language models have lowered the threshold for rediscovering certain vulnerabilities, limiting the protective value of delayed fixes.Low-severity vulnerabilities will be disclosed two weeks after the major version containing the fix is released; medium- and high-severity vulnerabilities will be disclosed two weeks after the affected version reaches end of life, typically about one year after the fix enters a new version. Critical vulnerabilities are not subject to the standard policy and will be handled through ad hoc procedures.In August, the volunteer organization Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with about one-fifth having been reproduced at the time. Core Lightning developers that same month asked node operators to upgrade or take nodes offline, and delayed disclosure of technical details for two weeks. (Cointelegraph)
The Hyperliquid Policy Council (HPC) stated that it has submitted a comment letter to the U.S. SEC supporting its proposed Regulation Crypto Assets, and recommended five adjustments in the final rules to further clarify regulatory boundaries for token issuances, airdrops, secondary market trading, and safe harbors.
According to CoinShares' market report, the US September CPI rose 0.6% month-over-month and 3.7% year-over-year, exceeding the 3.6% market expectation. Gasoline prices surged 9.1% during the month, accounting for roughly half of the overall increase. Core CPI rose 0.3% month-over-month and 2.6% year-over-year. In the same period, US September retail sales increased 0.8% month-over-month, beating the ~0.3% forecast, while August data was revised up to 1.3%. However, retail sales excluding gasoline only grew by 0.2%, down from 1.0% in August. The report pointed out that inflation remains elevated and economic demand continues to show resilience, driving a hawkish repricing of Federal Reserve policy that weighed on Bitcoin and the broader digital asset market. Data showed that market sentiment notably weakened following the CPI release, with global digital asset investment products recording $434 million in outflows so far this week. Regarding interest rate expectations, as of October 15, Polymarket data indicated a roughly 75% probability that the Fed would hold rates unchanged at its October meeting and about a 25% probability of a 25-basis-point hike. Following the CPI release, futures markets shifted markedly toward a hawkish stance, with expectations of another rate hike within the year rising significantly.
the Core Lightning team, which develops the Bitcoin Lightning Network node software, is warning node operators running version 26.06.7 or earlier to upgrade to the latest version as soon as possible. The team said it has received reports of attackers targeting unpatched nodes, but did not disclose the vulnerability exploited by the attackers or the potential impact.Core Lightning said on September 16 that it was investigating an issue that could affect experimental features and user funds, and on September 22 released version 26.06.8 to fix the vulnerability and update the software. This announcement did not state whether the previously reported attacks were related to the vulnerability fixed in this version. (Cointelegraph)
Odaily reports: Bitcoin News posted on X that Core Lightning is urging node operators to immediately disable experimental features, as developers are investigating a vulnerability that could put channel funds at risk. This is Core Lightning's second warning within a few weeks, following an August patch and the release of the 26.06.7 upgrade after a series of AI-generated CVE reports. Core Lightning has not yet disclosed how the experimental feature could be exploited.
Odaily News: Hong Kong's 2026 Policy Address proposes that the Securities and Futures Commission (SFC) refine the virtual asset licensing regime and formulate regulatory guidelines to clarify the compliance pathway for virtual asset service providers. It also aims to improve the regulatory framework for tokenized investment products, promoting the issuance, trading, and launch of innovative products for gold and other suitable real-world asset tokenized products on licensed platforms.The Hong Kong Monetary Authority (HKMA) will explore more tokenized deposit applications, collaborate with mainland China to study trade finance use cases, and complete pilot transactions by the end of this year. It plans to finalize the Ensemble central bank digital currency 24/7 operational arrangements around the end of this year. HKEX intends to partner with designated banks to launch a tokenized warehouse receipt financing pilot within 2027. Its blockchain multi-asset tokenization platform has already incorporated Core Climate-listed carbon credits and plans to include LME-approved warehouse commodity receipts as a pilot next year.
Odaily News: Sparrow Wallet v2.5.4 has been released following an extensive AI-assisted review, featuring multiple security hardening updates aimed at reducing users' reliance on external servers such as Electrum.Additionally, this version strengthens Ledger, Keycard, Trezor, Payjoin, PSBT, and multi-signature handling, removes Bitcoin Core credentials and other sensitive information from debug logs, restricts permissions for existing wallet and backup directories to owner-only access, closes residual local DNS resolution leaks when using Tor, and reinforces validation for wallet import, signing, downloads, and server responses. The update expands Sparrow Wallet's scope of independent verification for transaction data, hardware devices, and other inputs, reducing dependence on data provided by external servers. (Bitcoin News)
According to sources, the Japanese government is considering adjusting tax policies to allow companies to apply for tax relief if they use proceeds from the sale of non-core businesses for reinvestment and acquisitions. This initiative aims to encourage enterprises to expand their core business scale through asset optimization and mergers and acquisitions.
Odaily News: According to the official announcement, Bitget has listed 23 stock spot rTokens, including rHDV (iShares Core High Dividend ETF), rJEPI (JPMorgan Equity Premium Income ETF), rLUV (Southwest Airlines), and rOMC (Omnicom Group), covering multiple sectors such as financials, healthcare, and consumer goods. To date, the Bitget platform supports a total of 682 rTokens.It is reported that rTokens, identified by the letter "r" followed by a stock ticker (e.g., rNVDA for Nvidia), are issued by Reality, Bitget's licensed RWA protocol, and provide direct access to global liquidity pools such as Nasdaq and NYSE through a partnership with the compliant broker Alpaca. Their features include: 1:1 reserve backing of the underlying assets, held by licensed custodians; stock dividends distributed 1:1 in token form; support for synchronized mapping of corporate actions (such as stock splits); and the ability to use holdings as joint margin for unified accounts and USDT-margined contracts, allowing users to flexibly manage their funds while holding global equity assets.
Grayscale Research Director Zach Pandl stated in a post on platform X that Ethereum is like a "small country," while ETH has only one core "government function": protecting property rights and value exchange within the system. Unlike traditional countries that provide public services through taxation, Ethereum mainly relies on "seigniorage," i.e., issuing new ETH, to fund network security. Under this framework, stakers responsible for maintaining network security are equivalent to the group providing public services, receiving rewards through newly issued ETH. Therefore, Ethereum's staking mechanism and ETH issuance policy essentially constitute the network's fiscal policy and monetary policy simultaneously; more security guarantees usually mean stronger property rights protection, but at the cost of higher ETH issuance volume and potential other risks. Some community members believe that Ethereum's monetary and fiscal policy design should consider the security trade-offs brought by these key ratios, but the current mechanism has not yet fully incorporated these factors. Zach Pandl added that the above analogy may not be entirely accurate as it does not yet involve other important factors such as the ETH burn mechanism, MEV, governance, etc.; how the future ETH issuance policy will be adjusted remains to be seen based on community governance results.
据 Cointelegraph 报道，比特币政策研究所（BPI）联合 Anchorage Digital、BitGo、Bitwise、Blockstream、Kraken、Ledger、MARA、Trezor 等多家加密机构，发布公开信敦促各大前沿 AI 实验室为比特币及开源软件开发者建立或扩展可信访问计划。 信中指出，Bitcoin Core 等开源维护者目前缺乏对 AI 实验室网络安全程序的访问渠道，被迫依赖能力较弱的开源模型，而比特币网络当前保护着逾 1 万亿美元资产，任何开源基础设施漏洞均可能危及用户毕生积蓄。BPI 同时披露，已收到多份报告显示包括潜在境外势力在内的复杂攻击者正借助先进 AI 能力持续发动攻击。
According to Bloomberg, the U.S. Securities and Exchange Commission (SEC) recently issued an internal letter explicitly exempting asset-backed securities (ABS) related to AI data centers from core investor protection regulations introduced after the 2008 financial crisis, including the "risk retention" clause requiring issuers to retain a portion of the debt. The SEC determined that data centers are not financial assets that liquidate over time, therefore securities linked to them should not be subject to the same regulatory constraints as ABS related to auto loans or mortgages. Although this move does not constitute a formal rule change, since companies had previously voluntarily complied with relevant regulations out of compliance prudence, the substantive impact cannot be underestimated. In terms of market size, the annual issuance volume of data center ABS has surged from $2.4 billion in 2020 to $15.5 billion in 2025, growing more than sixfold in five years, and is expected to hit a new record high in 2026.
Odaily News: Part of hardware wallet manufacturer Coldcard's firmware had a random number generation vulnerability in 2021, causing some mnemonic phrases generated by the devices to carry predictable risks. The vulnerability was only discovered years later, and by then approximately 5,200 addresses and around 2,000 BTC had been stolen, with losses totaling about $130 million. Following the incident, some investors turned to Wall Street custody products. U.S. spot Bitcoin ETFs saw net inflows of approximately $626 million within days of the event. ETF analyst Eric Balchunas noted that security incidents like this could further drive capital flows into ETFs. The Bitcoin core community continues to uphold the principle of self-custody. Casa co-founder Jameson Lopp said recent events should not weaken user confidence in self-custody, as third-party custody carries risks as well. Early Bitcoin Core developer Peter Todd stated that self-custody has a better long-term security track record than centralized institutions. Michael Tanguma, co-founder of Bitcoin custody platform Onramp, said both approaches have flaws: concentrating large amounts of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Michael Tanguma proposed a "multi-institution custody" approach, in which multiple regulated institutions each hold keys through a multi-signature mechanism, and any transaction requires joint signing by multiple institutions to reduce the risk of single points of failure. Critics argue that while multi-institution custody improves security, it also introduces permissioned management, which conflicts with the decentralized ideals Bitcoin originally pursued. As Bitcoin enters pension funds, trusts, and institutional asset allocation, the industry is seeking custody solutions suitable for long-term wealth management. How to strike a balance among security, decentralization, and usability remains a challenge facing the Bitcoin ecosystem.
据 The Block 报道，德克萨斯州州长 Greg Abbott 本周一下令要求公用事业委员会（PUCT）及电网运营商 ERCOT 对州内所有在队列中的数据中心项目展开审计，ERCOT 随即暂停了原定本月公布结果的"Batch Zero"大型用电审批流程。目前数据中心申请占 ERCOT 474GW 互联队列的约 90%。 Bernstein 分析师在周二发布的客户报告中指出，此次监管审查将抑制投机性开发、压缩新增电力容量供给，从而提升已获批电力容量的稀缺价值，利好现有比特币矿企及 AI 运营商。报告点名 Cipher Digital（CIFR）、CleanSpark（CLSK）及 Core Scientific（CORZ）受审计影响较大，因其近期扩张计划依赖德州电网接入；而 Terawulf（WULF）因电力资产分布于肯塔基、马里兰及纽约等多州，抗风险能力较强；Riot Platforms（RIOT）和 IREN 则因已在 ERCOT 拥有大规模获批运营资产而受益。
Trader Doctor Profit stated that his current key positioning is the "Galactic Three", namely Circle, Coinbase, and ETH, believing that the three correspond to compliant stablecoin issuance, crypto asset custody and trading, and tokenization and smart contract infrastructure respectively, and are core targets in the reshaping of the financial system in this new cycle.
HTX DeepThink columnist and HTX Research analyst Chloe (@ChloeTalk1) pointed out in her analysis that global risk assets continued to come under pressure this week. Federal Reserve Chair Kevin Warsh attempted to weaken forward guidance (Forward Guidance) for the first time, hoping to make market prices a more direct economic feedback mechanism. However, the market did not interpret the rise in long-term interest rates as a natural tightening of financial conditions, but instead interpreted it as inflation risks resurfacing and a decline in Federal Reserve policy credibility. The 30-year US Treasury yield rose to 5.2%, the US dollar weakened, and US stocks retreated, reflecting that investors are beginning to demand higher risk premiums rather than betting on an improvement in economic fundamentals.
: Bitcoin News posted on X platform, stating that Bitcoin Core developer instagibbs claimed to have successfully reproduced the reported COLDCARD vulnerability on a newly initialized COLDCARD MK3 device, using only the number of button presses during the setup process, and said, "Sorry, now is the time to panic." He believes the issue affects MK2/MK3 devices, but stated that it is currently unable to confirm whether the MK4 has the vulnerability. Developer Antoine Poinsot stated that the key difference is that the MK4 uses a hardware random number generator to provide entropy for the seed and actually utilizes the microcontroller's True Random Number Generator (TRNG), while the MK3 does not. The proof of concept and mnemonic phrase verification are still under review.