News linked to both this project and an event.
Bitwise CEO posted on X that client assets in Bitwise-managed treasuries, private funds, and ETFs are safe, and the team will continue to monitor the Binance-related situation. He stated that spot and lending markets may experience volatility in the short term, Binance has received industry support, and cybersecurity defense will remain an important topic for all companies this year and in the future.
According to a comment letter submitted by the Hyperliquid Policy Center (HPC) to the U.S. Securities and Exchange Commission (SEC) on October 19, the HPC generally supports the SEC's proposed Crypto Asset Regulation (File No. S7-2026-27) and urges its prompt adoption. The proposal includes a $5 million startup exemption (four-year term), a $75 million fundraising exemption (per 12 months), a safe harbor for investment contracts, and state-level advance applicability provisions for "qualified purchasers." The HPC also puts forward five recommendations: 1. Airdrops: Incorporate airdrop analysis into the final rule text and use "clear and specific consideration" as the criterion for determining a "monetary investment"; 2. Secondary Markets: Clarify the status of secondary market trading and intermediaries, enabling assets issued under exemptions to trade immediately outside the registration framework, and recommend exempting relevant trades and platform determinations under Section 36 of the Exchange Act; 3. Safe Harbor: Its use should not be construed as an admission that an investment contract or issuer status exists, and protections should extend through the period during which key management tasks are being performed; 4. Buybacks: Incorporate the SEC Division of Corporate Financing's recent buyback guidance into the rules, standardize the "central party" concept, and distinguish between programmatic buybacks and discretionary buybacks; 5. Federal Advance Applicability: Issuers meeting safe harbor conditions may opt out of reporting obligations or adopt a simplified annual certification to avoid state regulatory intervention. The HPC stated that without the aforementioned adjustments, the actual
Odaily News: Nasdaq-listed company BTQ Technologies has announced a strategic partnership with MoonPay Korea to provide post-quantum cryptography (PQC) security solutions for its Korean won-backed stablecoin infrastructure. The two parties will jointly develop a quantum migration roadmap and conduct a proof of concept for BTQ's Quantum-Safe Stablecoin Network (QSSN) with Korean banking institutions, exploring quantum-resistant security mechanisms covering stablecoin issuance, distribution, wallets, and settlement processes. MoonPay Korea is building infrastructure to connect the Korean stablecoin market with MoonPay's global network, which covers approximately 180 countries and regions, with over 35 million customers and more than 1,500 enterprise clients.
Starknet has published an introduction to its Quantum-Safe Bitcoin (QSB) scheme, stating that StarkWare researchers have verified a quantum-safe locking mechanism on the Bitcoin mainnet that requires no soft fork, no new opcodes, and no changes to consensus rules. The first QSB output was spent on August 26, 2026, in Bitcoin mainnet block 964,199, with the associated GPU computation cost reduced from approximately $320 to about $50. QSB builds its locking mechanism through hash computation, but each transaction still requires substantial computation, and moving assets into the scheme still requires a traditional transaction that carries quantum risk. The transaction does not comply with Bitcoin Core's default relay rules, and there is currently no accompanying wallet, address format, or recovery process. StarkWare stated that QSB is an emergency research solution, and that the long-term solution still requires the introduction of post-quantum signature mechanisms via a soft fork. Starknet's full quantum resistance also depends on the progress of Ethereum's underlying upgrades.
community member ugurmersin has proposed an alternative to Proposal 613, suggesting that custody of the Ecosystem Protection and Continuity Fund (EPCF) and mainnet Chainlink SVR revenue be transferred from the Safe controlled by the Compound Foundation to a Community Multisig, adopting a 9-party 5/9 multisig mechanism. The proposal does not advocate shutting down the EPCF, but rather preserving its purpose, size, 48-month term, and emergency fund deployment capability.As of October 8, the EPCF held 500,000 USDC and 4.5834 million USDC deposited in cUSDCv3, while mainnet Chainlink SVR revenue held 355.95 ETH. The proposal states that the original Proposal 613 had planned to shut down the EPCF and transfer the funds to the Governor Timelock, and was canceled by the Proposal Guardian on October 7.
Odaily News: The US IRS released Revenue Procedure 2026-20 on October 6, updating and replacing Revenue Procedure 2025-31 issued in November 2025, clarifying that qualifying investment trusts and grantor trusts may participate in PoS staking while retaining tax benefit treatment. The IRS recognizes compliant staking as a "property preservation activity," keeping the trust on the passive side and preserving its investment trust and grantor trust status (IRC Sections 671 to 677).The safe harbor contains 14 requirements, including that shares be listed on a national exchange, that only a single digital asset be held, that assets be custodied by a qualified custodian, that the liquidity policy be approved by the SEC, and that staking rewards not be hoarded. The guidance applies to tax years ending on or after November 10, 2025.
Odaily reports: Greenfield Capital, an early investor in Safe, has published an open letter stating that it has filed a regulatory complaint with the Swiss Federal Foundation Supervisory Authority (ESA) regarding the Safe Ecosystem Foundation. Greenfield Capital stated that it has never sold any SAFE tokens since investing in Safe in 2022, but the total assets held in Safe accounts have declined from approximately $6.6 billion at the beginning of 2024 to about $3 billion. Over the same period, total DeFi TVL grew by roughly 40% and stablecoin supply increased by 135%, while stablecoins within Safe grew by only 11%. The firm believes that Safe's share of the self-custody market is declining.Greenfield Capital stated that about a year ago, it was unable to form a reliable judgment based solely on information provided by the Safe team, so it conducted an independent review together with former employees, major users, ecosystem developers, and other investors, and concluded that the issues identified all ultimately related to governance. The firm had previously requested refreshing the foundation's board of directors with experienced and independent members, restructuring management and bringing in operators with experience scaling infrastructure businesses, and having the board lead a review of strategy, product, organizational structure, and tokenomics while setting quantifiable key performance indicators. Greenfield Capital said that since late 2025, it has made these requests to the foundation both directly and through legal counsel, but the foundation only established a strategy committee without decision-making authority and appointed people from existing circles to fill board vacancies, which ultimately led to the filing of the regulatory complaint with ESA. The firm emphasized that this action is not a lawsuit against individuals and that it does not intend to take over Safe; its concerns are limited solely to foundation governance and board composition. It remains positive about the work of the Safe Labs operating team and will continue to cooperate as an ecosystem participant and Safenet validator.
SlowMist has issued a security alert stating that a vulnerability has been discovered in the Aave V3 Loop Safe Module. Attackers exploited forged Safe authentication and arbitrary Module execution to steal approximately 114.09 ETH from two Safe multisig wallets.The attackers bypassed authentication by forging a Safe that always returns true, and leveraged an arbitrarily controllable router and calldata to execute module transactions, transferring weETH and Aave collateral. The attackers repaid approximately 1,300 WETH in debt to unlock the collateral.
Yuga Labs blockchain vice president Quit posted on X that the NFT theft incident asset claim website nftsaresafu.xyz has officially launched. Affected users whose NFTs were successfully preserved can now proceed with claims, but must first revoke authorization to PaymentProcessor.Quit stated that approximately $6 million worth of NFTs were successfully rescued this time, but some assets could not be preserved. Additionally, some NFT collections cannot be claimed at present due to Transfer Validator restrictions, and coordination with the relevant project teams will be handled in the coming days. The claim process involves EIP-7702 delegated wallets, which may cause transaction simulation anomalies or risk warnings on wallets such as Rabby.
Odaily News, Vitalik posted on the X platform, expressing his hope to include the recursive STARK memory pool proposal EIP-8288 in the Ethereum I-star upgrade, stating that it can be seen as the next step after Frames. This solution can place quantum-safe signature data off-chain, reducing signature costs; the fuel cost of quantum-safe privacy transactions is also expected to drop from approximately 10 million to tens of thousands. The solution aggregates transaction dependencies through frames and recursive STARKs, with nodes sending one STARK of about 100 to 300KB per time cycle; the on-chain overhead is one STARK and 96 bytes per statement to be proven.
: Blockchain technology company Starkware stated that on August 26, a transaction using researcher Avihu Levy's Quantum-Safe Bitcoin (QSB) scheme was mined on the Bitcoin mainnet, without requiring a soft fork, hard fork, or modification of consensus rules.The transaction consumed 10,000 sats and was processed through MARA Foundation's Slipstream service, as the non-standard format typically cannot propagate through Bitcoin's public mempool. The test consumed several hours of GPU computation, costing approximately $150 to $200.QSB employs hash-based quantum-resistant spending conditions and reduces quantum attack risks through signature trial mining, but still requires users to proactively migrate funds and cannot protect assets whose public keys have already been exposed. Starkware CEO Eli Ben-Sasson still supports introducing a protocol-level solution via a soft fork. (Bitcoin.com News)
Odaily News: The U.S. Securities and Exchange Commission (SEC) has proposed rules related to crypto assets, aiming to establish a clear framework for eligible investment contracts and provide a targeted securities offering regime for token issuances, enabling related entities to raise funds while retaining investor protection measures. The proposed rules would allow crypto companies to issue up to $5 million in tokens over four years, or up to $75 million in tokens within 12 months, and provide a safe harbor to prevent cryptocurrencies from being deemed "investment contracts." Issuers would be required to disclose financial statements and provide ongoing reporting. The SEC did not include the previously anticipated "innovation exemption" for crypto stocks. The proposal comes just days after the U.S. Senate failed to advance the Digital Asset Market Clarity (CLARITY) Act; the public will have 60 days to submit comments after the proposal is published in the Federal Register. SEC Chair Paul Atkins stated that congressional legislation remains essential for establishing rules that can be applied over the long term, and the SEC will continue to support Congress in advancing the CLARITY Act to President Trump. The Commodity Futures Trading Commission (CFTC) plans to discuss cryptocurrency, AI, and prediction market regulation on Thursday. (Cointelegraph)
Odaily News: Kostas Chalkias, co-founder and chief cryptographer of Mysten Labs, the development company behind the Sui blockchain, stated that he has leased a dedicated factory at a secret location and plans to scale up production of quantum-safe hardware wallet cards for Sui. The project aims to keep the cost of a single quantum card key under $10, with NFC quantum signing expected to take 1 to 2 seconds. Chalkias noted that the project is being advanced in his personal time outside of work and may include funding to provide cards for users who cannot afford them. The initiative is partly driven by a recent incident involving Coldcard hardware wallets, though the vulnerability was not a quantum attack. Coldcard manufacturer Coinkite disclosed that a firmware vulnerability in Coldcard, traceable to a 2021 update, bypassed the hardware random number chip and generated keys using a predictable software process linked to device serial numbers. Attackers have been moving funds since July 30, with losses climbing to approximately 2,055 BTC, affecting over 7,700 addresses and nearing a value of $130 million. At the protocol level, Sui plans to integrate two quantum-resistant signature schemes approved by the U.S. National Institute of Standards and Technology (NIST), designed for everyday accounts and high-value Move vaults, respectively. Existing accounts can be rotated to quantum-safe keys based on their original recovery phrases, without needing to migrate to new wallets. (Bitcoin.com News)
Humanity released a post-mortem report on the H token security incident that occurred between June 8 and 9, stating that the incident was not caused by a smart contract vulnerability, but rather by a malware intrusion into a developer's device, which led to the leakage of private keys. Humanity stated that the attacker still holds the ProxyAdmin permissions for the ETH bridge and the BNB Chain token. Preliminary investigations confirmed that a colleague's device was infected with malware, which the attacker used to obtain the hot wallet private key of the administrator and the private keys for signing on 6 Gnosis Safe wallets. The team has hired an external security agency to conduct a forensic investigation and stated that they are formulating a recovery plan for affected users.
Humanity released an incident update stating that its H token was subject to a coordinated attack on Ethereum and BSC on the evening of June 8, resulting in approximately $36 million worth of tokens stolen and dumped across both chains. The project disclosed that the attack originated from a compromised employee laptop, which led to the leakage of multiple owner keys for the Gnosis Safe controlling the Hyperlane bridge ProxyAdmin. On Ethereum, the attacker seized ownership of the ProxyAdmin and upgraded the contract to a malicious implementation, transferring approximately 141.2 million H tokens in a single transaction. On BSC, after similarly gaining control of the ProxyAdmin, the attacker deployed a malicious implementation with infinite minting capabilities, minting 200 million H tokens in two transactions and continuously dumping them. Humanity has suspended deposits and withdrawals on the affected cross-chain bridge and is cooperating with exchanges and law enforcement to investigate the incident and seek partial recovery of the stolen funds.
Humility Protocol released a security incident update on the X platform, stating that its H token suffered a coordinated attack on the Ethereum and BSC chains yesterday, with confirmed losses exceeding $36 million in stolen and dumped assets.Preliminary investigations indicate the incident originated from a compromised employee computer, which led to the leakage of private keys for the multi-signature wallet controlling the Hyperlane Bridge ProxyAdmin. Specifically, the attacker obtained 3 out of 6 private keys of the Gnosis Safe wallet on the Ethereum chain, transferred ownership of the ProxyAdmin to a wallet under their control, upgraded the bridge contract to a malicious implementation, and subsequently transferred approximately 141.2 million H tokens in a single transaction.Simultaneously, the attacker also gained control of 3 out of 5 private keys of the Safe wallet on the BSC chain, took over the ProxyAdmin using the same method, deployed a malicious contract with unlimited minting functionality, and minted 200 million H tokens in two separate transactions to their own wallet.Humility stated that it has suspended all deposit and withdrawal operations on the affected bridge services and is collaborating with partners such as exchanges to mitigate losses. Meanwhile, it is cooperating with the police investigation and attempting to recover part of the stolen funds.
Ledger's Donjon security research team successfully bypassed the firmware verification system of the TROPIC01 chip inside the Trezor Safe 7 using laser attacks in a laboratory setting. Chip manufacturer Tropic Square subsequently discovered another attack path affecting the chip's MAC-and-Destroy security mechanism. This vulnerability currently impacts all TROPIC01 chips in production within the field. Trezor stated that the TROPIC01 chip is one of three independent security layers within the Trezor Safe 7, and user funds, wallet backups, and private keys are not stored on it.The chip's hardware encryption storage mechanism completely withstood Ledger's extraction attempts during initial testing. Tropic Square has delayed the release of technical details regarding the vulnerability until the launch of a reinforced silicon version of the TROPIC01 chip later in 2026, with full details expected to be disclosed in the spring of 2027.A firmware mitigation is currently available by disabling the chip's MAINTENANCE mode. Trezor CEO Matej Zak stated that PINs, wallet backups, and user fund keys have never been stored on a single chip. (The Block)
SUPERFORTUNE AI released a 24-hour investigation update stating that the May 27 GUA security incident was not, as previously suspected, address poisoning—but rather resulted from the leakage of private keys belonging to multi-signature signers. The attacker then forged valid signatures pointing to a malicious address and exploited the “premium address” feature—where the malicious address shared the same first four and last four characters as the legitimate address—to mislead the remaining signers into completing the signing process via the Safe interface.
Odaily news Squid posted on X platform, stating that this incident is unrelated to the Squid core protocol and contracts. All Squid users and integrators are unaffected and no action is required.Today, a third-party Gnosis Safe module on the Base and Ethereum networks was attacked, resulting in a loss of approximately $3.2 million. The vulnerable contract is verified on Basescan under the name "SquidRouterModule," but this contract was not built, deployed, or operated by Squid. It is a third-party smart wallet product that chose to integrate with Squid and other protocols, and has no connection with Squid.The attack principle is that this third-party module accepts a constant string provided by the caller as a message security proof. This string is publicly visible in the verified contract code. By inputting this string, the attacker could execute arbitrary calldata arrays and freely steal funds. The victim's Safe wallet had added this problematic contract as a trusted Safe Module, allowing the contract to control any tokens within the Safe without requiring a signature. Squid's own router contract (0xce16...D666) has a different architecture and was unaffected. Squid users' funds, authorizations, and integrations are completely safe.Early public reports may have mentioned "SquidRouter" due to the contract verification name on Basescan. The accurate description should be: a third-party SquidRouterModule was attacked, not Squid's Router contract. This contract shares the name with Squid, but it is not Squid's code. Squid is continuously monitoring the situation and will provide updates if there are any significant changes.
Odaily Planet Daily reported that Iran has launched a state-backed digital marine insurance platform, Hormuz Safe, which provides maritime insurance for vessels transiting the Persian Gulf and the Strait of Hormuz, settled in Bitcoin and other cryptocurrencies. The Iranian government believes that if the platform captures a significant share of the Persian Gulf shipping insurance market, it could generate over $10 billion in revenue. Hormuz Safe aims to bypass the SWIFT network and Western intermediaries, reducing reliance on traditional financial infrastructure. The platform faces challenges related to international recognition, and ship owners, trading companies, or port authorities interacting with it may risk triggering secondary sanctions. (Cryptobriefing)