News linked to both this project and an event.
According to official sources, in response to recent security incidents involving Bybit, Bitget, and Binance, OKX founder and CEO Star stated that security should not be an area of commercial competition, but rather a shared responsibility of the entire crypto industry. Over the past decade, major exchanges have made significant progress in private key protection, but potential risks remain in access control and wallet management systems. He emphasized that no system is absolutely secure, and any major security breach at any exchange could undermine trust in the entire industry.Star called on major exchanges in the crypto industry to strengthen cooperation and jointly establish stricter industry security standards and coordinated response mechanisms, including adding verification and security delays for large withdrawals to unknown addresses and smart contract authorization transactions, and implementing key security restrictions at the cryptographic signing layer. Meanwhile, the industry should establish real-time security incident reporting, joint monitoring of suspicious funds, and rapid response mechanisms, and promote collaborative research in areas such as quantum-resistant cryptography and AI-driven security threat defense. He emphasized that no single company can safeguard the future of the crypto industry alone.
Odaily reports: Bitcoin News posted on X that hardware wallet manufacturer COLDCARD stated its official X account had published a fake security advisory directing users to a phishing website disguised as a wallet migration guide; the post has been deleted, but no corresponding login, session, or access records were found. COLDCARD said its credentials and offline two-factor authentication remain secure, leading it to suspect that the attacker may have obtained X platform-level or administrator privileges, and it has asked X's security team to investigate urgently. The company also mentioned unverified reports of X administrator accounts being sold on darknet markets, but has not yet found a connection to this incident.
Odaily reports: Crypto trader Rune stated on X platform that PaperTrade's official documentation has actually disclosed a "vulnerability" risk in the protocol-level pricing mechanism. According to the document screenshots he shared, attackers can exploit the BBO (Best Bid and Offer) of the Hyperliquid order book for price manipulation. This risk involves unresolved price manipulation paths, contract economic mechanisms and risk exposure controls, as well as operational-level protective measures and permission management mechanisms.Additionally, Rune retweeted a post by community user boblob, which revealed that two wallets were suspected of actively exploiting and "attacking" the PaperTrade platform, conducting trades worth approximately $20 million that briefly caused ETH price fluctuations of about 10-20 basis points on the Hyperliquid platform. boblob further added that the obvious issues currently present in the PaperTrade protocol need to be fixed as soon as possible, otherwise they may affect the protocol's long-term sustainability.
OpenAI has released a report stating it recently banned two groups that used its models to conduct covert influence operations (IO). These operations combined AI with traditional techniques to create "fake front" entities and fake identities. OpenAI stated that the Russia-linked operation "Dark Clark" controlled a fake think tank called the "Social Research Center (SRC)," and is suspected of using ChatGPT to write internal reports, generate content, and conduct influence activities in Latin America. OpenAI assessed this operation as Level 5 on the IO Breakout Scale, marking the first time it has identified a case reaching this level since it began disclosing such operations.OpenAI stated that AI has not changed the fundamental patterns of these influence operations, but has enhanced their scale, efficiency, language capabilities, and content production capacity, making it easier for attackers to create fake identities, fabricate content, and disseminate information to real media channels.
According to The Block, StarkWare announced it has successfully executed the first post-quantum Bitcoin transaction. Avihu Levy, Head of Applications, used a "signature grinding" approach to repeatedly generate millions of candidate signatures before the transaction entered the Bitcoin mempool, thereby avoiding the exposure of mathematical data related to public keys that could be exploited by future quantum computers to forge signatures. This method incurs significant computational costs, with a single transaction potentially taking several hours. Because the transaction format is unrecognized by standard Bitcoin nodes, it bypassed the public mempool and was submitted directly to miners for inclusion via MARA’s Slipstream service. StarkWare noted that while this technique can serve as a transitional safeguard, Bitcoin will still require protocol-level upgrades or a hard fork to systematically mitigate quantum computing threats.
The SlowMist security team stated that approximately 16.6 WETH were stolen from an unverified contract due to an unrestricted low-level call vulnerability. The attacker exploited the contract's existing ERC20 allowance to bypass owner checks and complete unauthorized transfers.
Odaily news "On-chain detective" ZachXBT posted in his personal channel, stating that Telegram continues to allow scam advertisements to be displayed to subscribers in his channel, impacting user experience and posing potential security risks.ZachXBT stated that if users are Telegram Premium members and wish to support upgrading his channel, they can help it reach the required level by using the channel's Boost function, thereby unlocking the ability to disable ads. Currently, the channel needs to reach Level 50 to enable the ad-disabling option.ZachXBT has long focused on scams, hacker attacks, and on-chain fund tracking within the crypto industry, and has repeatedly exposed incidents involving phishing attacks, fake projects, and fund theft.This time, he raised concerns about Telegram's advertising mechanism, arguing that the platform allowing scam advertisements to appear in crypto community channels may increase the risk of users encountering malicious links and fraudulent activities.
Odaily news: The Zcash Foundation has announced the release of Zebra 4.5.1 version update to fix a consensus-critical security vulnerability and strongly recommends that all node operators upgrade immediately. The vulnerability, identified as GHSA-2prc-cj5x-4443, involves a sigops (signature operation count) counting error in P2SH transactions, which could lead to potential consensus fork risks. This fix corrects an incomplete patch in the previously released 4.5.0 version, which was just released yesterday.The Zcash development team stated that the issue stems from discrepancies in sigop counting logic between different implementations, which could cause nodes to produce different results when verifying transactions, thereby affecting consensus consistency on the chain. The fix resolves this by reverting and adjusting the Rust implementation logic to ensure alignment with the expected protocol behavior.The Zcash Foundation emphasized that there is currently no workaround for this issue, and upgrading to 4.5.1 is the only method to ensure nodes remain on the correct chain and avoid potential fork risks.
The Zcash Foundation officially announced the release of Zebra 4.4.0, which addresses multiple critical consensus-level security vulnerabilities. All node operators are strongly advised to upgrade immediately. The vulnerabilities include a denial-of-service (DoS) flaw that could permanently halt the discovery of new blocks; a signature operation (sigop) counting error in block validation that may cause consensus divergence; abnormal handling of transparent transaction signature hashes; and a memory allocation amplification attack risk. The Zcash Foundation stated that some of these vulnerabilities could cause Zebra nodes to accept blocks rejected by zcashd, potentially triggering a chain fork. Without timely upgrades, nodes risk interruption of block discovery, consensus forks, and amplified resource consumption. No alternative mitigations are currently available.