News linked to both this project and an event.
Odaily Report: Marc Zeller, founder of the Aave Chan Initiative (ACI), posted on X stating that the Aave protocol is fine.The Binance hacker injected 60 million USDT into the protocol within just 3 minutes and borrowed 19,762 wETH (approximately $44.9 million), at which point Tether had not yet frozen the address, nor had the Aave Guardian frozen the Aave V3 Core pool's reserves (this operation occurred 46 minutes later).However, USDT is backed by real dollars, and from the protocol's perspective, although this position is the proceeds of crime, it is overcollateralized — with a health factor of 1.04, holding $59.9 million in collateral against $44.9 million in debt.Of course, the protocol now has a large borrower with little incentive to repay the loan, but the liquidation mechanism will still operate as usual. If the ETH price rises above approximately $2,365 (+4%), the position will be liquidated just like any other position.Currently, the Aave V3 Core pool's total wETH reserves stand at 2.16 million wETH, and the hacker's debt accounts for "only" 0.9% of that, so Aave does not need to take any special action against the hacker. There are currently 345,000 wETH available (capital utilization rate of 81.6%), so if wETH depositors wish to withdraw, liquidity is fully sufficient. There is no reason or need for a bank run to occur.This situation is far less alarming than the Kelp hacker incident (which involved zero-value collateral). In theory, a governance proposal could be passed to force liquidation of the hacker by upgrading the pool (if the USDT liquidation threshold were lowered, it would affect all USDT depositors), but there is no practical benefit to doing so, as the normal liquidation mechanism can easily absorb this debt.
Bitcoin News posted on X that Bitcoin Core has discovered 3 new vulnerabilities, one of which could allow an attacker to remotely crash nodes. This vulnerability can affect nodes running Windows, macOS, or BSD by exhausting memory, while Linux nodes are not affected by this attack; another vulnerability can gradually exhaust node memory, and a third may corrupt blockchain undo data.
Odaily reports: Bitcoin Core developers have merged a security policy adjustment. For vulnerabilities that can be easily discovered or rediscovered through simple large language model (LLM) prompts, the previous long-term confidential disclosure mechanism will no longer be used. The new rules allow developers to mark such issues as "easy to find" during vulnerability classification, then backport fixes to all still-supported versions and release them as soon as possible through minor version updates, along with a security advisory and some vulnerability details.Previously, Bitcoin Core scheduled disclosure based on vulnerability severity, with medium- and high-risk vulnerabilities usually only made public after the affected versions stopped being maintained. This adjustment stems from AI tools lowering the threshold for vulnerability discovery: in July this year, a Bitcoin Red Team composed of 16 developers used AI models to scan about 390 Bitcoin-related projects and recorded 4,962 findings in one day, of which 85 were listed as critical issues. Developers noted that continuing to extend the confidentiality period for such vulnerabilities can no longer effectively prevent attacks and instead delays the release of fixed versions; however, the new rules also mean that fixes may lack longer testing time. Currently, no vulnerability has been officially marked as falling into the "easy to find" category under the new rules. (CoinDesk)
According to Cointelegraph, Bitcoin Core developer Antoine Poinsot stated on Thursday on the bitcoin-dev mailing list that large language models (LLMs) have made certain software vulnerabilities extremely easy to rediscover. Maintaining long-term secrecy is already of limited value and instead delays the release of patched versions, prompting the team to update its vulnerability disclosure policy. The new policy dictates that "easily discoverable" vulnerabilities, which can be identified with minimal cost such as through simple LLM prompts, will be patched as soon as possible across all supported major versions, alongside the simultaneous release of security advisories. Other vulnerabilities will continue to be disclosed based on severity: low-severity vulnerabilities will be disclosed two weeks after the release of the major version containing the fix; medium-to-high-severity vulnerabilities will be disclosed two weeks after the end-of-life (EOL) of the last affected version, typically around one year after the patch release; critical vulnerabilities will be handled through a dedicated process.
Bitcoin Core has adjusted its security vulnerability disclosure policy, defining easily discoverable vulnerabilities as those that can be found through simple large language model prompts, and will release fixes as soon as possible across all major versions still under maintenance, while publishing security advisories.Bitcoin Core developer Antoine Poinsot stated that in the past, vulnerabilities were typically kept confidential during a longer disclosure embargo period to allow users to upgrade, but large language models have lowered the threshold for rediscovering certain vulnerabilities, limiting the protective value of delayed fixes.Low-severity vulnerabilities will be disclosed two weeks after the major version containing the fix is released; medium- and high-severity vulnerabilities will be disclosed two weeks after the affected version reaches end of life, typically about one year after the fix enters a new version. Critical vulnerabilities are not subject to the standard policy and will be handled through ad hoc procedures.In August, the volunteer organization Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with about one-fifth having been reproduced at the time. Core Lightning developers that same month asked node operators to upgrade or take nodes offline, and delayed disclosure of technical details for two weeks. (Cointelegraph)
On-chain investigator ZachXBT stated that FreedomXMR (FXMR), a centralized money laundering service that appeared on Hyperliquid Core (HL Core) in August 2026, had over 87% of its incoming funds directly linked to illegal activities. A review of historical inflows exceeding $10,000 revealed that over $20 million could be directly traced to ransomware, security exploits, malware, and social engineering incidents, involving multiple theft cases such as the DCENT Wallet, Fetch.ai, Axelar, and Gamdom.
Odaily reports, according to Bitcoin News monitoring, Core Lightning stated that attackers are targeting nodes still running version 26.06.7 and earlier. The 26.06.8 patch released on September 22 fixes a channel closure issue that could jeopardize funds, as well as vulnerabilities that cause crashes and memory exhaustion. The project has not yet disclosed the name of the vulnerability used by attackers, nor has it reported any stolen funds. Node operators who have not yet upgraded are becoming attack targets.
the Core Lightning team, which develops the Bitcoin Lightning Network node software, is warning node operators running version 26.06.7 or earlier to upgrade to the latest version as soon as possible. The team said it has received reports of attackers targeting unpatched nodes, but did not disclose the vulnerability exploited by the attackers or the potential impact.Core Lightning said on September 16 that it was investigating an issue that could affect experimental features and user funds, and on September 22 released version 26.06.8 to fix the vulnerability and update the software. This announcement did not state whether the previously reported attacks were related to the vulnerability fixed in this version. (Cointelegraph)
Odaily reports: Bitcoin News posted on X that Core Lightning is urging node operators to immediately disable experimental features, as developers are investigating a vulnerability that could put channel funds at risk. This is Core Lightning's second warning within a few weeks, following an August patch and the release of the 26.06.7 upgrade after a series of AI-generated CVE reports. Core Lightning has not yet disclosed how the experimental feature could be exploited.
Odaily reports: Bitcoin News posted on X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the Bitcoin security landscape. Large language models have significantly reduced the cost of vulnerability discovery, and attackers may be able to find catastrophic vulnerabilities with only a few hundred dollars in computing costs. For Bitcoin Core, Project Loupe, Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or critical vulnerabilities have been found. Gögge stated that relying on stronger models to find vulnerabilities before attackers do is not a sustainable security strategy. Developers should build testing infrastructure through automated testing, fuzzing, and property-based testing that can prevent entire classes of vulnerabilities in advance. Key components of Bitcoin Core have cumulatively completed over 100 years of CPU fuzzing and decades of Bitcoin node network simulation.
According to CoinDesk, Bitcoin Core 32.0 entered its final testing phase on September 14, with its official release scheduled for October 10. This update adds a transaction fee estimator based on real-time mempool status, enabling fee estimates to be lowered more quickly once network congestion subsides. It also enables multi-threaded parallel reading of transaction data to speed up node blockchain synchronization, defaulting to 8 threads. Security-wise, it resolves a wallet naming vulnerability on non-Windows systems since version 24.0 that allowed attackers to execute arbitrary commands on the node host via a specially crafted wallet name. Additionally, it patches an out-of-memory vulnerability in the newly added built-in web server; testing indicates that 16 unauthenticated connections can spike node memory usage from 46MB to roughly 3GB in approximately one minute. This update does not include any changes to Bitcoin's consensus rules.
Odaily News: Bitcoin Core 32.0 entered its final testing phase on September 14, with the official version planned for release on October 10.This version will improve fee estimation, speed up block processing, and make PSBT version 2 the default option for multiple wallet commands, without changing Bitcoin's consensus rules.Developers also fixed a command execution vulnerability affecting certain wallet configurations, as well as a memory exhaustion vulnerability in the new web server. (CoinDesk)
According to the official ZKsync X account (@zksync), ZKsync has announced a security upgrade for its EraVM chain. Core measures include introducing an instant upgrade framework, extending the proving delay from 3 hours to 24 hours, and deploying a second prover, EraBender, to defend against AI-driven vulnerability attacks. Over the next six months, all Boojum/EraVM chains will gradually phase out the legacy execution environment, with each chain formulating and publishing its own transition schedule. Users who hold funds directly in EOAs do not need to take any action at this time. Users who hold funds through smart contracts such as multisigs, smart accounts, DEXs, and lending protocols must take action as required once the transition plans for their respective chains are finalized. The ZKsync Atlas chain remains unaffected by this upgrade.
Odaily News: Blockchain project Core DAO has announced a coordinated emergency hard fork, caused by validators receiving CORE rewards exceeding the blockchain's originally scheduled issuance. Core DAO stated that the incident is under control, malicious validators can no longer continue to obtain excess rewards, and the upgrade will not roll back the network or revoke confirmed transactions.Core DAO previously stated that a small number of validators had accumulated rewards significantly higher than the protocol's set issuance, and that the incident only involved reward distribution, with user assets remaining secure. Coinbase, Bithumb, Coinone, Bitget, and LBank had restricted CORE deposits, withdrawals, or transfers.Core DAO has not yet disclosed the amount of excess CORE issued, the duration of the related activity, whether the extra tokens entered circulation, or the cause of the vulnerability, and stated that it will publish a technical post-mortem report. (Cointelegraph)
Odaily News: Bitcoin News posted on X platform that Core Lightning version 26.06.7 has been released, fixing multiple vulnerabilities that were responsibly disclosed over the past three weeks. Recently, there has been an increase in AI-generated security reports targeting open-source Bitcoin projects. Specific vulnerability details will be kept confidential for two weeks to allow node operators to complete upgrades before technical details and source code are published. Developers warned that immediately disclosing the fixes could allow attackers to reverse-engineer the vulnerabilities and attack nodes that have not yet been updated. All Core Lightning node operators should upgrade immediately. Docker images are not yet available, and developers have explicitly warned users not to wait for the Docker image.
According to The Defiant, the Core Lightning (CLN) maintainers for the Bitcoin Lightning Network have notified node operators that if they are unable to upgrade to the upcoming patched version, they should run their nodes offline using the --offline parameter. The team stated it will release binaries containing fixes for multiple disclosed vulnerabilities, but specific vulnerability details will remain confidential for two more weeks; as of press time, the relevant binaries and security advisory have not been published. CLN had previously noted that it received several AI-generated CVE reports over the past ten days, and the team is working with open-source contributors to verify, classify, and patch them. The latest public release is v26.06.6, issued on July 22, and the v26.09 release, originally slated for late September, continues to proceed as planned.
: Bitcoin News posted on X that Core Lightning developers have received a large number of AI-generated CVE reports over the past 10 days, and have verified the existence of vulnerabilities that need to be fixed. The team has now escalated its response, will release signed binaries, and will keep vulnerability details confidential for a two-week period. Core Lightning strongly urges all users to upgrade during this period; users who have not upgraded should take their nodes offline. Previous versions, including 26.04, will no longer be supported.
Odaily News: BIP-110 supporters are discussing a hard fork to change the stalled minority chain's mining algorithm from SHA-256d to BLAKE2b. Transaction history before the fork remains shared by both chains. If transaction and signature rules remain consistent, the same transaction could be replayed on the other chain, creating a replay attack.BIP-110's peak miner support was approximately 2.53%. After the consensus rules took effect on August 8, the minority chain produced only two consecutive blocks before stalling, while the Bitcoin main chain continued operating and widening the block height gap. The BIP-110 proposal was subsequently marked as closed, and supporters shifted focus to discussing the BLAKE2b proof-of-work scheme.Bitcoin Knots plans to add a new signature hash option, but RDTS will still maintain compatibility with Bitcoin Core's existing signature hash types. Regular transactions may continue to be valid on both chains. Users will need to use the new option and rely on wallets or hardware signing firmware that support it to achieve asset separation.Luke Dashjr stated on August 18 that Bitcoin should bear the responsibility for replay protection, calling it "Spamcoin." If the BLAKE2b fork proceeds around September 1, exchanges, wallets, and holders will need to distinguish between cross-chain transactions and chain-specific transactions. (Bitcoin.com News)
据 Cointelegraph 报道，比特币政策研究所（BPI）联合 Anchorage Digital、BitGo、Bitwise、Blockstream、Kraken、Ledger、MARA、Trezor 等多家加密机构，发布公开信敦促各大前沿 AI 实验室为比特币及开源软件开发者建立或扩展可信访问计划。 信中指出，Bitcoin Core 等开源维护者目前缺乏对 AI 实验室网络安全程序的访问渠道，被迫依赖能力较弱的开源模型，而比特币网络当前保护着逾 1 万亿美元资产，任何开源基础设施漏洞均可能危及用户毕生积蓄。BPI 同时披露，已收到多份报告显示包括潜在境外势力在内的复杂攻击者正借助先进 AI 能力持续发动攻击。
Odaily News: Part of hardware wallet manufacturer Coldcard's firmware had a random number generation vulnerability in 2021, causing some mnemonic phrases generated by the devices to carry predictable risks. The vulnerability was only discovered years later, and by then approximately 5,200 addresses and around 2,000 BTC had been stolen, with losses totaling about $130 million. Following the incident, some investors turned to Wall Street custody products. U.S. spot Bitcoin ETFs saw net inflows of approximately $626 million within days of the event. ETF analyst Eric Balchunas noted that security incidents like this could further drive capital flows into ETFs. The Bitcoin core community continues to uphold the principle of self-custody. Casa co-founder Jameson Lopp said recent events should not weaken user confidence in self-custody, as third-party custody carries risks as well. Early Bitcoin Core developer Peter Todd stated that self-custody has a better long-term security track record than centralized institutions. Michael Tanguma, co-founder of Bitcoin custody platform Onramp, said both approaches have flaws: concentrating large amounts of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Michael Tanguma proposed a "multi-institution custody" approach, in which multiple regulated institutions each hold keys through a multi-signature mechanism, and any transaction requires joint signing by multiple institutions to reduce the risk of single points of failure. Critics argue that while multi-institution custody improves security, it also introduces permissioned management, which conflicts with the decentralized ideals Bitcoin originally pursued. As Bitcoin enters pension funds, trusts, and institutional asset allocation, the industry is seeking custody solutions suitable for long-term wealth management. How to strike a balance among security, decentralization, and usability remains a challenge facing the Bitcoin ecosystem.