News linked to both this project and an event.
According to a post by the Newton Foundation (@NewtonFndn), the attacker involved in the recent Binance breach appears to have made an operational error, directly transferring approximately 8 million NEWT tokens, along with 17 other tokens (ANIME, ANKR, ARPA, BARD, CELR, DENT, DOLO, FTT, GLM, HIGH, HOT, KNC, LQTY, RARE, RESOLV, SIGN, WOO) to the NEWT token contract address (0xd0ec028a3d21533fdd200838f39c85b03679285d). Valued at current prices, the total amounts to approximately $3.5 million. The foundation stated that the NEWT token contract itself was not compromised. Featuring an immutable design with no owner or administrator, all management rights were relinquished on-chain in 2025, and upgrade functionality has been permanently disabled. As a result, no one, including the foundation, can retrieve these tokens.
According to Odaily, the Newton Foundation stated that the attacker in the Binance hacking incident appears to have made an operational error today by transferring approximately 8 million NEWT and 17 other tokens directly to the NEWT token contract address. The total value of the involved assets is approximately $3.5 million at current prices.The Newton Foundation stated that the NEWT token contract itself was not compromised. Because the contract uses an immutable design, all admin permissions were renounced in 2025, and upgrade functionality was permanently disabled, no one (including the Foundation) can retrieve the tokens mistakenly transferred to the contract. These assets are now permanently locked, and the attacker can no longer control or sell them. The Foundation has shared the investigation results with Binance and will continue to provide assistance.
The Onchain Foundation stated that due to the Binance security incident, it has temporarily suspended the LSK buyback program and expects to resume it next week once the situation becomes clearer. The foundation noted that Binance has confirmed it will cover all losses, so it is expected that this incident will not impact the LSK buyback program. After the buyback resumes, the Onchain Foundation will issue a separate announcement.
Initia officials stated that, with support from the Initia Foundation, the 1:1 asset backing for assets affected by the October 23 security incident will be fully restored when the chain resumes operations. The Initia Foundation has approved funding to cover the reserve shortfalls for Noble USDC, WETH, and AUSD0 used as collateral for iUSD, amounting to up to 1.08 million USDC, 105 ETH, and 1.4 million AUSD0, respectively. The specific amounts remain subject to verification and require final transfer approval.
According to the official announcement from Foundation, regarding the recent phishing email incident, the team's investigation found that its email system recorded over 23,000 phishing email sending attempts, of which 19,057 were sent via Mailgun and another 1,503 via Google Workspace. Since some mailboxes received multiple emails and some sending attempts failed or were blocked, the actual number of affected individuals cannot currently be confirmed.
Odaily reports: Bitcoin News posted on X that Foundation Devices stated attackers launched over 23,000 phishing email attempts targeting its hardware wallet customers, exploiting customer records the company believed had been deleted but were still retained in historical database tables. Investigators confirmed that 19,057 of these emails were sent via Mailgun, while another 1,503 were sent through Google Workspace; the number of affected customers remains undetermined.Foundation Devices stated that after the legacy WooCommerce database migration, customer names, shipping information, refund records, and incomplete checkout information in the old tables remained accessible; recent Shopify order information may also have been exposed. The company said there is no evidence that the Passport hardware wallet or its private keys were compromised, and the investigation is ongoing.
According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."
On-chain analyst PeckShield (@PeckShieldAlert) has tracked an address flagged as the Cysic attacker depositing 300 ETH (approximately $721,140) and 30.4 BNB (approximately $22,590) into Tornado Cash. According to the Cysic Foundation, a security incident involving the Cysic cross-chain bridge occurred on October 17, during which the attacker minted 10 million CYS tokens without authorization on the BNB Chain.
The Cysic Foundation has issued a notice to the parties responsible for the unauthorized issuance of the CYS token, demanding the return of 275.872 ETH within 72 hours, which accounts for approximately 90% of the confirmed related proceeds. As a bounty for asset recovery, the party may retain the remaining approximately 30.652 ETH. The foundation stated that it has reconstructed key stages of the attack and preserved relevant technical and on-chain evidence; if payment is not received within the deadline, it will escalate the matter and cooperate with law enforcement to launch a criminal investigation.
According to Cointelegraph, the PHP Foundation admitted that a critical security vulnerability discovered as early as 2024 has yet to be patched due to flawed decision-making processes and understaffing within the security team, calling the delay a structural failure. The vulnerability could allow unauthenticated attackers to remotely execute code on affected servers. On August 11, security firm Calif and OpenAI independently reported the same issue, with Calif also demonstrating unconditional remote code execution, prompting the matter to be elevated to the highest security priority. PHP released emergency patches for two related critical vulnerabilities on Wednesday. Around the time of the patch release, government websites or services in the Netherlands, Finland, France, Germany, and Australia were temporarily taken offline, with the Netherlands shutting down its digital identity service. The Wikimedia Foundation also took some supporting services offline, causing disruptions to certain Wikipedia features. Japanese Prime Minister Sanae Takaichi called on website operators to install the patches as soon as possible. In the crypto sector, monitoring by SlowMist's MistEye service found that out of 1,488 evaluated domains, 793 showed direct PHP fingerprints. Cardano governance organization Intersect temporarily took its member portal offline. Both Coinbase and BitGo stated that their platforms were unaffected. Binance co-founder Changpeng Zhao advised users to exercise extreme caution when visiting websites over the next few days. PHP security team
Odaily reports: The PHP Foundation has stated that due to hesitant decision-making and insufficient resources, remediation work for a critical security vulnerability first discovered in 2024 stalled and restarted multiple times, and it characterized the delay as a "structural failure." PHP is a programming language widely used for websites and web applications.PHP has released emergency patches for two related critical vulnerabilities. Unauthenticated attackers could exploit the flaws to execute code on affected servers without logging in. Some government websites or online services in the Netherlands, Finland, France, Germany, and Australia were temporarily taken offline to prepare for patch installation.Security firm Calif and OpenAI separately reported the same underlying issue on August 11, and Calif also demonstrated unconditional remote code execution. Blockchain security firm SlowMist investigated PHP usage in the crypto industry and found direct PHP fingerprints on 793 of the 1,488 domains it assessed.Intersect has temporarily closed its Members Area, Coinbase said it has not found any affected PHP instances, and digital asset infrastructure company BitGo said its platform was not affected. Binance co-founder Changpeng Zhao reminded users to exercise heightened caution when visiting websites recently, and OpenAI has released a Codex skill for checking for vulnerable PHP versions. (Cointelegraph)
The Polkadot Community Foundation issued a security warning on the Polkadot Forum stating that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the browser extension for the third-party wallet Fearless Wallet contain malicious code, which may transmit users' private keys to attacker-controlled servers when unlocking the wallet. The relevant code was added on February 19, 2025, via a code commit titled “TON ecosystem”, and was triggered intermittently from February 2025 to October 10, 2026.
Odaily reports: Blockchain security research firm Asymmetric Research has disclosed that Solana's on-chain governance program svmgov previously had a vulnerability: when validators did not participate in voting, independent votes submitted in advance by their delegators might not be counted in the final results. The vulnerability was reported to the Solana Foundation on July 10 and was fixed on mainnet on August 3, earlier than the governance vote on August 24. Based on on-chain data calculations, Asymmetric Research estimates that if the vulnerability had not been fixed, the approval rate of the SGP-0002 proposal, which aims to accelerate the decline in SOL inflation, could have dropped from the actual 67.00% to 66.65%, below the 66.67% passage threshold. The vulnerability was fixed before the vote and did not actually change the proposal's outcome.
The Cysic Foundation released an incident report stating that on October 17, its cross-chain bridge experienced a security incident in which an attacker minted 10 million CYS without authorization on the BNB Smart Chain. Upon discovering the anomaly, the project team suspended the cross-chain bridge, placed related addresses on an on-chain blacklist, and hired a professional security firm to investigate the attack vectors and fund flows.
Odaily News: According to Bitcoin News monitoring, Bitcoin News released a podcast in which former Mt. Gox CEO Mark Karpelès and Foundation CEO Zach Herbert discussed the largest supply chain attack in crypto industry history. Mark Karpelès stated that he discovered the spy implant 3 weeks before the funds were stolen and contacted Ledger, but received no response. The implant had a built-in hidden cellular modem that could directly read the seed phrase on the screen and passed Ledger's own checks; even setting a passphrase could not prevent the seed phrase from being stolen. Mark Karpelès said that with $5 million, he could create an implant that would only be detectable through X-ray. The episode also discussed the hardware wallet reseller model, the Malaysian reseller behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The episode timeline shows that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.
Odaily Report: On-chain detective ZachXBT retweeted the XRP Ledger Foundation's explanation regarding a previous critical security vulnerability and criticized its bug bounty mechanism.ZachXBT stated that XRPL, which holds billions of dollars in assets, only paid a $250,000 reward to the white hat hacker who discovered the critical vulnerability. He believes that this level of reward could weaken security researchers' incentive to proactively report vulnerabilities, and may even encourage attackers to exploit vulnerabilities for massive gains rather than responsibly disclosing the issue.Previously, the XRP Ledger Foundation confirmed that the vulnerability could theoretically bypass the XRP total supply limit, but no additional XRP was found to have been created as a result, and the vulnerability has been fixed through version 3.4.1.
Odaily News: The XRP Ledger Foundation posted on the X platform to clarify the recent XRP Ledger security vulnerability incident, stating that the vulnerability could potentially have been used to bypass the limit that fixes XRP's total supply at 100 billion, but it was fixed two weeks ago via version 3.4.1. Furthermore, upon verification, no new XRP was found to have been created, and the total amount of XRP currently circulating on the ledger is approximately 99.986 billion.The Foundation stated that the vulnerability would have required hundreds of deliberately constructed operations to trigger, and normal payment transactions would almost never involve it. In the future, it will strengthen formal verification, AI adversarial testing, security research collaboration, and bug bounty programs with RippleX and the community. Regarding the fix process, the Foundation explained that publicly releasing a patch could allow attackers to use AI to accelerate vulnerability analysis. To address this situation, the XRPL community engaged in coordination. Participating parties including the XRP Ledger Foundation, RippleX, core developers, and validators reached a social consensus and agreed to adopt the approach of directly releasing the fix. In addition, version 3.4.1 only became a version the network was required to adopt after going through the normal amendment voting process and receiving support from more than 80% of validators for two consecutive weeks. Protocol changes still need to be completed through the amendment mechanism.Previously, RippleX engineering lead J. Ayo Akinyele also posted on the X platform, stating that he attaches great importance to the recently disclosed critical vulnerability in the XRP Ledger (XRPL) payment engine. This vulnerability is a serious security issue that has existed in the codebase for more than 10 years and could theoretically lead to the over-creation of XRP, breaking through the fixed supply cap. However, before the vulnerability could be exploited, it was discovered by the security research firm Veria AI through Ripple's bug bounty program.
The Drift Foundation has outlined the compensation plan following the protocol hack: users will receive 1 DFX token for every 1 USDT lost, with redemption amounts depending on the recovery pool balance that currently covers only about 1% of total claims; Tether has committed to providing up to $127.5 million USDT to support protocol restart and user compensation, with funds matched against Velocity's net protocol revenue rather than disbursed as a lump sum; the claims deadline is January 1, 2028, allowing users to choose to hold DFX or trade it on secondary markets such as Raydium, with the only official link being dfx.drift.trade.
Greenfield Capital has filed a complaint with the Swiss federal foundation regulator ESA regarding governance issues at the Safe Ecosystem Foundation, alleging that Safe Foundation directors instructed personnel to hand over a substantial amount of SAFE tokens following the Bybit hack, and threatened to force Gnosis to sell its holdings—which account for approximately 10% of the total SAFE supply—and sever ties with Safe.
Ripple与XRP Ledger基金会（XRPLF）联合成立新组织XRP Asia，旨在推动亚太地区XRP Ledger（XRPL）生态发展，总部位于新加坡，由前Hedera基金会亚太及金融科技/支付业务负责人Sabrina Tachdjian领导，该组织将支持开发者培训、黑客松、合作伙伴计划、创业支持以及生态活动，并对接基础设施服务商、孵化及资助项目，以及连接投资者和生态合作伙伴。