audit

According to Decrypt, a volunteer security team stated that it scanned 150 Bitcoin code repositories using cutting-edge artificial intelligence models and discovered a dozen vulnerabilities. The team has built multiple AI-based review systems, targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects. Team members claim that, on average, each person can find about one serious vulnerability per hour, and in the past 12 hours, they have submitted security reports to multiple projects, but specific affected projects have not yet been made public.

The Bitcoin security organization Bitcoin Red Team, composed of 16 volunteers, stated that during a rapid AI-assisted review of Bitcoin ecosystem projects, nearly 5,000 potential issues were discovered. The members of the organization include AnchorWatch CEO Rob Hamilton and Bitcoin developer Calle, among others.Calle mentioned that the Bitcoin Red Team used AI tools alongside manual reviews to scan for vulnerabilities in open-source code repositories related to Bitcoin, averaging about one critical vulnerability discovered per person per hour. Calle revealed that within 29.8 hours of launching, the team had identified 4,962 potential issues across 390 projects, with as many as 720 considered high-risk or critical issues, and currently, 21.4% of the findings are reproducible. This security review initiative was launched a few days after the Coldcard hardware wallet vulnerability incident, in which stolen Bitcoin valued at over $100 million was involved.

Bitget's licensed RWA issuance platform Reality announced a deepened cooperation with the American auditing firm The Network Firm. After the upgrade, The Network Firm will provide daily Proof of Reserve (PoR) audit reports for the rToken, a U.S. stock token issued by Reality, based on the attestation standards set by the American Institute of Certified Public Accountants (AICPA). The aim is to verify that each issued rToken corresponds to the stocks or ETF assets held in the custody account. The underlying stocks and ETFs continue to be held by the FINRA-registered and SIPC-protected U.S. brokerage firm Alpaca Securities LLC, forming an independent and transparent structure for issuance, verification, and custody.The rToken issued by Reality currently supports 634 tokenized stocks and ETFs and is deeply integrated with the Bitget ecosystem, allowing for core scenarios such as unified account margin and collateralized lending. Previous data showed that the assets under management (AUM) of Bitget's stock token rToken exceeded $100 million one month after its launch.

According to The Block, Texas Governor Greg Abbott ordered the Public Utility Commission (PUCT) and the grid operator ERCOT to conduct audits on all data center projects in the queue within the state this week. ERCOT subsequently suspended the "Batch Zero" large electricity approval process, which was scheduled to announce results this month.Currently, data center applications account for about 90% of the 474 GW interconnected queue of ERCOT.Bernstein analysts noted in a client report released on Tuesday that this regulatory review will suppress speculative development and compress the supply of new electricity capacity, thereby enhancing the scarcity value of approved electricity capacity, benefiting existing Bitcoin mining companies and AI operators.The report specifically mentioned that Cipher Digital (CIFR), CleanSpark (CLSK), and Core Scientific (CORZ) are significantly affected by the audit, as their recent expansion plans rely on access to the Texas grid; while Terawulf (WULF) has a stronger risk resistance due to its power assets being distributed across multiple states, including Kentucky, Maryland, and New York; Riot Platforms (RIOT) and IREN benefit from already having large-scale approved operating assets in ERCOT.

Developers on Reddit used Claude Code to scan the Coldcard open-source firmware for vulnerabilities, identifying the core issue within 8 minutes:The firmware called a software pseudo-random number generator instead of a hardware true random number generator when generating private keys, and this vulnerability led to the theft of approximately $70 million in BTC from 1,196 wallets.At the same time, community users also reported that an independent scan using Zhizhu GLM 5.2 (trained on June 16, not connected to the internet) similarly discovered the same vulnerability.This bug has existed in the open-source wallet code for over five years.

Project Eleven has launched a new zero-knowledge proof system, providing a recovery method for the quantum-vulnerable Bitcoin proposed to be frozen under BIP-361, including the Bitcoin held by Satoshi Nakamoto.The solution leverages the property that quantum computers can break elliptic curve signatures but cannot break the one-way hash used in modern wallet key derivation, allowing the true owner holding the seed material to prove control. Benchmark tests show that the Project Eleven prototype is significantly faster than previous solutions, but the prototype has not yet been audited and is incomplete. It requires controversial modifications to blockchain rules before it can protect existing Bitcoin on the chain.

Web3 security company GoPlus Security pointed out that there has been a recent surge in smart contract vulnerability attacks, particularly targeting older contracts that have been deployed for many years. Attackers are leveraging AI technology to quickly discover and exploit these vulnerabilities.Recent typical incidents include:On June 9, a Token of Power (TOP) contract deployed 7 years ago was attacked on Ethereum, resulting in a loss of approximately $1.5 million;On May 25, a WUSD.fi contract deployed 3 years ago was attacked, resulting in a loss of approximately $200,000;On June 14 and June 18, Aztec Network was attacked twice in a row due to an old contract deployed 2 years ago, with total losses exceeding $4 million.GoPlus Security believes that traditional auditing methods are insufficient to effectively cover legacy contracts, and adopting AI-based Always-on Audit services may be the most effective solution currently available, capable of conducting security checks on old contracts in a short period while balancing reliability and cost.

The founder of DefiLlama, 0xngmi, announced the launch of a new off-chain proof/verification service, which will be used to verify and audit off-chain data, including information such as bank account balances, to help projects achieve reliable verification of real-world assets and other off-chain data.

According to a report by The Wall Street Journal, the prediction market platform Polymarket is suspected of paying dozens of social media creators to instruct them to record fake betting and high-profit videos on a simulated website that closely resembles the official site, using this as a promotional tactic to attract new users. The report indicates that the campaign required creators to conceal the official sponsorship relationship and specifically targeted the domestic audience in the United States.The investigation shows that the related marketing videos have accumulated over 140 million views on platforms such as TikTok, YouTube, and Instagram, involving up to $1.9 million in false bets. In response, Polymarket did not directly address the specific details of the investigation but stated in a statement that, as part of promoting industry transparency, the platform is conducting a comprehensive audit of active promotional content to ensure it strictly complies with internal standards and applicable regulatory and legal disclosure requirements.

Zcash founder Zooko Wilcox posted to express gratitude to Anthropic for helping to protect Zcash users.At the request of Shielded Labs, they conducted a security audit of Zcash using Mythos, and no other serious vulnerabilities were found in the Zcash protocol. Shielded Labs and other teams are continuing to advance security reinforcement work, and updates will be released later.

According to official news, Tether announced that it has appointed a new independent director to the board of Bitcoin reserve company Twenty One Capital (XXI) to fill the previous vacancy in the audit committee. The company stated that this appointment complies with the independence requirements of the SEC's Securities Exchange Act Rule 10A-3 and the New York Stock Exchange listing rules.This vacancy arose after Tether acquired the shares of XXI held by SoftBank Group on May 20, leading to the termination of the governance agreement between the two parties, and the resignation of the directors appointed by SoftBank, one of whom was a member of the audit committee.It was introduced that Twenty One Capital currently holds over 43,500 bitcoins and is positioned as a vertically integrated Bitcoin company, with business covering Bitcoin mining, asset reserves, capital markets, and financial services.Tether CEO Paolo Ardoino stated that XXI is building one of the most important Bitcoin companies in the world, and therefore the company prioritizes ensuring that the board has an independent oversight mechanism that meets SEC and NYSE requirements to match its strong balance sheet.

According to CoinDesk, security engineer Taylor Hornby, who discovered a serious vulnerability in Zcash using the Anthropic Opus 4.8 AI model, stated that Monero (XMR) has been added to the audit queue, and more privacy coin projects will undergo security reviews in the future.Hornby previously discovered a critical vulnerability in the Zcash Orchard privacy pool on May 29, which had gone unnoticed since May 2022 and could theoretically allow attackers to create unlimited undetectable fake ZEC. The development team at Shielded Labs completed an emergency fix before June 1 and subsequently disclosed the details of the vulnerability. As a result of the incident, ZEC dropped by as much as 38% within 24 hours after the news broke, with the market concerned that attackers may have exploited the vulnerability to steal funds from the privacy pool without leaving on-chain traces.Hornby stated that he was commissioned by the nonprofit organization Shielded Labs in April of this year to identify protocol vulnerabilities before attackers could exploit them. Although he had the means to profit from the vulnerability, he chose to report the issue to the development team, stating that "such betrayal is unacceptable." Additionally, Hornby plans to apply for funding from the Zcash community to support subsequent security research efforts.

According to Bits.media, the Central Bank of Brazil has tightened the licensing rules for virtual asset service providers, requiring them to undergo independent financial audits before obtaining operational licenses starting June 1. The auditing firms must not only examine the company's financial status but also review its compliance with anti-money laundering and counter-terrorism financing regulations, including whether the platform separates its own funds from customer assets, its risk management practices, and employee training. Auditors must be registered with the Brazilian Securities Commission. Cryptocurrency exchanges, brokerage firms, and custody services applying for a license for the first time must comply with these requirements from the start of the registration process, and companies that already hold licenses must also pass independent audits when renewing.Brazil first clarified in legislation in 2022 that virtual asset services are regulated by the central bank, establishing a category for licensed virtual asset service providers in November 2025. Additionally, Brazil recently imposed a complete ban on 28 betting and prediction market platforms, including Polymarket and Kalshi, on the grounds that they did not comply with local derivatives trading requirements. Starting October 1, Brazilian electronic foreign exchange providers will be prohibited from using cryptocurrencies for international remittances.

According to Protos, Bitcoin treasury company Twenty One Capital received formal notification from the New York Stock Exchange (NYSE) that it was deemed non-compliant due to insufficient independent directors on the audit committee and must complete rectification by June 5; otherwise, it will be marked as BC (below compliance standards) starting June 9.Previously, Tether completed the acquisition of approximately 89.1 million Class A shares held by SoftBank and terminated the related governance agreement, resulting in the resignation of two directors appointed by SoftBank, one of whom was a member of the audit committee. This left the company with only one independent director on the audit committee during the transition period, which does not meet NYSE requirements. Twenty One Capital stated that it will appoint new independent audit committee members as soon as possible.

According to The Block, FTX's former major external law firm Fenwick & West has agreed to pay $54 million to settle claims related to its alleged assistance in facilitating Sam Bankman-Fried's fraudulent activities. In addition, the auditing firm Prager Metis has agreed to pay $11.75 million, and former Miami Heat player Udonis Haslem, as a former promoter of FTX, will pay $420,000, bringing the total to approximately $66 million.The above settlement marks the second round of resolutions in the FTX class action lawsuit, with relevant documents submitted to the Miami federal court on Friday. Fenwick denies any wrongdoing and states that it was unaware of FTX's fraudulent activities. Notably, the firm still faces another civil lawsuit for $525 million in Washington, D.C., which is not covered by this settlement.FTX collapsed in November 2022, and Bankman-Fried was sentenced to 25 years in prison for stealing approximately $8 billion in customer funds and is currently appealing. FTX's bankruptcy estate has returned over $5 billion to creditors.

The TON Network expansion project TAC has disclosed that a security incident occurred with the TON-TAC asset bridge on May 11. Four days later, approximately 80% of the affected assets have been returned. TAC today released a post-incident analysis report detailing the events. The root cause of the vulnerability was a lack of a single verification in the sorter software: the attacker deployed a counterfeit Jetton wallet on TON, and the sorter accepted the counterfeit tokens because it did not verify the code hash of the sender's wallet. The total loss was approximately $2.86 million, involving USDT, BLUM, and tsTON. Following a public appeal, about 90% of the assets were returned to the multi-signature address controlled by TAC on May 14, with the remaining 10% retained by the attacker.The cross-chain bridge remains paused, awaiting independent review of the repaired sorter software by the auditing party and TON partners. Cross-chain operations will resume once the verification of the repaired software is completed and the gap is filled with recovered assets and TAC Foundation token reserves. Due to the need for multi-party coordination, a precise timeline cannot be provided. The remaining funding gap will be filled by the TAC Foundation treasury, ensuring that users and protocols incur no financial losses. TAC reminds users that official updates are only published through this account and Telegram, and any unsolicited "recovery" or "support" private messages are scams.

Documents from the U.S. Department of Justice show that Trump has reached an unusual settlement agreement with the federal government, terminating a $10 billion lawsuit filed by him and his businesses against the Internal Revenue Service (IRS), and further expanding the relevant terms.The agreement states that the IRS will be "permanently prohibited" from investigating or continuing existing audits related to tax returns previously submitted by Trump, his businesses, and family members. The Department of Justice stated that this restriction only applies to the scope of existing audits.Meanwhile, the U.S. government has agreed to establish a "Deweaponization Fund" of up to $1.8 billion to compensate individuals or groups claiming to have been improperly treated during government investigations. This arrangement has been criticized by some Democratic lawmakers as a "disguised transfer of benefits," and has also raised questions within the Republican Party.Former IRS Commissioner pointed out that there has never been a precedent showing that the tax agency would permanently waive its right to review the historical filings of specific individuals or businesses, emphasizing that tax enforcement principles should remain consistent for all taxpayers. The Senate indicated that there are still many unresolved issues with this agreement, which is expected to continue to spark political controversy and regulatory discussions.

According to Techfundingnews, London-based AI audit automation startup Calibre has announced the completion of a $3.3 million Pre-Seed funding round, led by Vicus Ventures and CIV.Calibre was founded by former Palantir executives with the goal of using AI Agents to enhance efficiency in the certification and auditing industry. The company believes that current auditors spend a significant amount of time on document review and process organization rather than applying professional judgment. Calibre plans to deploy AI Agents to automatically handle repetitive tasks such as document review, information extraction, and compliance verification, aiming to reduce labor costs and improve efficiency in the certification industry.Investors believe that the certification and auditing industry has long faced issues of cumbersome processes and high reliance on manual labor, and that AI Agents are expected to become an important infrastructure in this field.