authentication

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.

The Zodiac team released a security incident analysis report regarding the impact on the Zodiac Roles Modifier, disclosing that the root cause of the vulnerability lies in a flaw in the ERC-1271 transaction signature verification logic: the system only determines the validity of the signature based on the returned "magic value" without verifying whether the call itself was successful, which may disguise a failed verification as a valid signature, bypassing the module authentication mechanism.

According to Decrypt, Google's Threat Analysis Group confirmed that cybercriminals used an AI model to discover and exploit a zero-day vulnerability in a popular open-source web management tool that could bypass two-factor authentication. Google stated that this is the first time the company has confirmed AI-assisted zero-day vulnerability development in a real-world environment. Before attackers could exploit it on a large scale, Google worked with the affected vendor to patch the vulnerability. Google's report noted that the vulnerability was a logic error, where the software trusted a condition that could bypass two-factor authentication. Unlike traditional scanners that look for crashes or error codes, AI analyzed the expected behavior of the software and detected logical contradictions, allowing attackers to bypass security checks without compromising encryption.

Anthropic has launched an authentication mechanism in some use cases of Claude to prevent abuse, enforce usage policies, and fulfill legal obligations. This process is supported by Persona, requiring users to submit a government-issued photo ID and possibly undergo real-time selfie verification.Anthropic states that the verification data is only used to confirm identity, not for model training, and will not be used for marketing or advertising. If verification fails, users can retry multiple times within the process or submit a form to request manual assistance. Accounts may be banned in cases of repeated violations of usage policies, terms of service, registration from unsupported regions, or use by individuals under 18 years of age.

Due to pressure from multiple state attorneys general, Bitcoin ATM operator Bitcoin Depot will require customers to provide personal identification for verification each time they use its ATMs.The company stated that this move aims to combat account sharing, identity theft, and account takeover, marking a significant advancement in preventing fraud and illegal activities. Earlier this month, the Massachusetts Attorney General filed a lawsuit against the company, accusing it of deliberately profiting from scams targeting the elderly. FBI data shows that losses from cryptocurrency ATM fraud in the U.S. will reach $333 million by 2025. Currently, Bitcoin Depot operates 8,800 ATMs in North America.

XION recently published an article introducing its new infrastructure and application scenarios. XION announced the official launch of the DKIM module and the ZK module, becoming the first blockchain to directly store email authentication keys (DKIM) on-chain, as well as the first consumer-grade L1 public chain to implement zero-knowledge verification at the protocol level.XION pointed out that existing email verification solutions (including projects like zkEmail) rely on centralized DNS servers to obtain encryption keys. When email service providers rotate keys, the old verifications become invalid, and there are no historical records available. XION's DKIM module permanently stores these keys in the on-chain state, completely eliminating the reliance on centralized DNS infrastructure. Its ZK module implements zero-knowledge proof verification at the protocol level, achieving an efficiency that is 10 times that of smart contract solutions. The two work together, allowing users to prove any information in an email without exposing the email itself.XION stated that currently about 61% of employees who witness misconduct remain silent, as traditional options are often "anonymous but ignored" or "speak up but risk unemployment." With the above infrastructure, XION has realized various application scenarios, including:Anonymous reporting and workplace evaluations (proving employment status without exposing personal information)Wallet recovery without mnemonic phrases (using email as a backup key)Purchase behavior and certificate verification (without excessive sharing of personal information)Trust-based ticket resale and insurance claims, etc.It supports Gmail and Apple Mail from launch, covering approximately 3.8 billion email users globally (accounting for over 90% of the global email market). Currently, the XION platform has over 800,000 monthly active users, with more than 150 brands including Uber, Amazon, and BMW already onboarded. The official statement claims this is a verification infrastructure built for the existing internet, "capable of verifying anything while leaking zero information."

At the recent "Build and Scale in 2026" themed forum held in Hong Kong, guests including Lulu, the APAC market head of Billions, Laughing, the APAC head of KiteAI, Carter Feldman, founder and CEO of Psy Protocol, and Bitcoinmaodu, CEO of Huazhi Education RWA, engaged in a roundtable discussion on the topic of "Web3 New Phase: From 'Technological Vision' to 'Mainstream Consumption'."Lulu, the APAC market head of Billions, pointed out that the fundamental challenge in the AI era is the issue of identity and trust. She emphasized that future infrastructure must strike a balance between privacy protection and regulatory auditing, and believes that by 2026, the market's core will shift from speculation to infrastructure, particularly in meeting the identity and accountability verification (KYA) required by AI agents.Laughing, the APAC head of KiteAI, focused on the payment security of AI agents. He stated that blockchain technology is needed for permission control and behavior auditing of AI agents, establishing a "responsibility attribution closed loop" to build a secure and trustworthy payment system.Carter Feldman, founder and CEO of Psy Protocol, believes that the current blockchain cannot support the billions of concurrent transactions brought by AI agents. They are building a high-performance blockchain that supports AI scale and protects privacy. He pointed out that AI agents will ultimately bring massive users and sustainable transaction fee revenue to blockchain, driving the industry into a profit-driven phase.Bitcoinmaodu, CEO of Huazhi Education RWA, shared the Web3 practical path of Huazhi Education in the private education sector. He stated that education is a long-underestimated real asset, and RWA provides a new organizational method for private education. By assetizing course content, faculty contributions, and learning outcomes, Huazhi Education is promoting the transformation of traditional private education from a "cost center" to a "sustainable value network," making education a truly accumulative and replicable asset system.The attending guests unanimously agreed that the current period is crucial for building infrastructure, as Web3 is moving from concept to addressing real pain points. Identity verification, agent payment security, and RWA compliance in the AI era will become the core driving forces for industry development in 2026.

According to The Block, the crypto prediction market platform Polymarket confirmed on December 24 that multiple user accounts were hacked due to a security vulnerability in a third-party authentication provider. Affected users reported on social media that their funds were drained even with two-factor authentication enabled. The issue appears to be related to the email login service provided by Magic Labs, which is a common registration method for many first-time cryptocurrency users.Polymarket stated that it has resolved this security issue and there is currently no ongoing risk, but it did not disclose the number of affected users or the amount of losses.

According to TechCrunch, the decentralized biometric authentication project World, co-founded by Sam Altman, has released the latest version of its application, introducing several new features, including end-to-end encrypted chat integration and Venmo-like cryptocurrency transfer capabilities.The new application is referred to by the development team as a "super app," with the World Chat feature utilizing end-to-end encryption technology, providing a security level equivalent to Signal, and using colored chat bubbles to indicate whether the conversation partner has been verified through the World system. This feature aims to incentivize users to verify their identities, allowing them to confirm the real identity of their chat partners.In terms of digital payments, the new application expands its cryptocurrency transfer capabilities, enabling users to receive salaries directly through virtual bank accounts and deposit funds from bank accounts, all of which can be converted into cryptocurrency. Using these payment features does not require verification through World’s identity verification system.It is reported that World scans users' irises for authentication through its Orb device, having scanned nearly 20 million people so far, with a goal of scanning 1 billion people.

ChainCatcher message, cryptocurrency developer Zak Cole disclosed that a new type of phishing attack is targeting the X (formerly Twitter) accounts of members of the crypto community. This attack disguises itself as an authorization request from the Google Calendar app, tricking users into granting full account control permissions. Attackers exploit the application authorization mechanism of the X platform, completely bypassing passwords and two-factor authentication.MetaMask security researchers have confirmed that this attack is active in the wild. Users are advised to visit the connected apps page on X to check and revoke any suspicious "Calendar" app authorizations to ensure account security.

ChainCatcher news, according to Semafor, Reddit is in talks to use the iris scanning device Orb from Sam Altman's Worldcoin for user authentication.According to two insiders, World ID may soon become a way for Reddit users to verify themselves as unique individuals while remaining anonymous on the platform. The discussions between Reddit and World ID's parent company, Tools for Humanity, highlight the growing market for new authentication technologies, as artificial intelligence fills online platforms with false content, and governments around the world are considering new age verification laws to prevent children and teenagers from accessing social media.If World ID becomes one of Reddit's third-party providers, it will be good news for Tools for Humanity, which was founded six years ago with the noble goal of providing universal basic income to the world through a cryptocurrency called Worldcoin in exchange for using Orb to scan irises.

ChainCatcher news, according to DL News, FTX announced that approximately $2.5 billion in customer claims have been canceled due to nearly 400,000 users not completing identity verification (KYC) by March 3. According to documents from the Delaware bankruptcy court dated April 2, 392,000 claims have been completely dismissed and removed, involving up to 2,377 pages.Although the initial estimate of unverified claims was about $1 billion, creditor representative Sunil Kavuri stated that the actual amount could exceed $2.5 billion, which includes $655 million in small claims and $1.9 billion in large claims.These canceled claims are part of the total $33.6 billion in disputed claims that FTX expects to reject. FTX stated that this process is crucial for addressing the failures of the previous management in user data collection and due diligence.

ChainCatcher news, according to market data from RootData, the Proton token (XPR) has increased by 80.61% in the last 24 hours, currently priced at $0.0042.According to the Web3 asset data platform RootData, Proton is a Layer 1 proof-of-stake blockchain designed for consumer applications and peer-to-peer payments. Proton aims to provide a secure, verified identity account that integrates with a financial settlement layer, allowing users to directly associate this identity with fiat accounts, withdraw funds, purchase cryptocurrencies, and seamlessly use the cryptocurrency within applications, all without sending any user-sensitive privacy information. Proton is jointly developed by Metal and Lynx.

ChainCatcher news, Sign product lead clairemxd.eth posted on X: "The journey of Sign began in 2021 with EthSign, a hackathon project born from CEO Xin's simple idea that digital signatures should be verifiable and accessible on the blockchain. After several iterations of the EthSign product, we launched the Sign Protocol, a full-chain authentication infrastructure that allows users to sign data on-chain in a structured format.The Sign App, launched in 2025, is the first product and the focus of Sign this year. The Sign App connects users' real-world identification documents with blockchain wallets in a user-friendly manner, seamlessly proving users' identities while protecting their privacy.The Sign App is privacy-centric and aims to empower users with control over their identities. However, the Sign App is not just about identity verification; it also creates a universal trust layer for the Web3 ecosystem. In the future, we hope the Sign App will evolve into a leading on-chain wallet identity resolver, providing a resolver framework for applications to easily verify user identities."

ChainCatcher news, according to CoinDesk, informed sources revealed that DeFi giant Lido co-founders Konstantin Lomashuk and Vasiliy Shapovalov are preparing a blockchain authentication platform codenamed Y, directly competing with Sam Altman's World Network. Unlike World Network, which uses iris scanning for authentication, the Y project will verify user identities based on social media and blockchain activity data, combined with the Ethereum Attestation Service. This solution aims to address the risks of biometric data leakage and minimize the potential for fraud.

ChainCatcher news, OpenAI founder Sam Altman's World project (formerly known as Worldcoin) announced that World ID has launched an authentication program in Brazil. As the project intensifies efforts to increase the total number of registrations, Brazil has become an attractive region in the eyes of World. According to World Bank data from 2023, the country is not only relatively friendly to cryptocurrencies but also has a population of over 215 million.

ChainCatcher news, according to Decrypt, Kraken recently stated that it discovered scammers wearing Halloween-style rubber masks attempting to deceive staff, but they were unsuccessful. It is reported that when users try to regain access to their Kraken accounts, they may be required to have a video call with a support agent to verify their identity.The attackers displayed some red flags during the first round of checks, such as failing to name the assets held in the account. These signals led the agent in charge of the matter to request a video call to grant access to the account. During the call, Kraken staff asked several questions and checked the person's ID, at which point the attackers exposed suspicious circumstances.Kraken's Chief Security Officer Nick Percoco stated that some exchanges do not pay as much attention to details as Kraken does to its team's requirements, and some companies support outsourcing, which makes it easier for problems to arise.

ChainCatcher news, the blockchain identity authentication platform Humanity Protocol has announced the launch of its testnet on platform X. Users can register for a Human ID, and in a few weeks, they will be able to register their palm prints through the application.According to RootData, Humanity Protocol has announced the completion of a new round of financing of $30 million at a valuation of $1 billion, led by Kingsway Capital, with participation from Animoca Brands, Blockchain.com, and Shima Capital.

ChainCatcher news, according to Cointelegraph, Parity Technologies, the parent company of Polkadot, plans to launch a Web3 authentication solution ------ Proof-of-Ink. This solution generates tattoos through a unique algorithm to prove users' digital citizenship, aiming to address key barriers to the mass adoption of Web3.Gavin Wood, co-founder of Ethereum, Polkadot, and Kusama, revealed at the Berlin Web3 conference that Proof-of-Ink is scheduled to launch in the fourth quarter of 2024. The system will require users to tattoo a uniquely generated pattern on specific parts of their bodies as proof of their digital identity. Each tattoo design is created based on a blockchain-generated random number, ensuring the uniqueness of each user. In addition to Proof-of-Ink, Wood disclosed that two other digital identity solutions are in development, expected to be launched next year, but did not provide specific details.