dent

According to the official announcement, Anthropic has confidentially submitted a draft Form S-1 registration statement to the U.S. Securities and Exchange Commission (SEC) to advance its initial public offering (IPO) of common stock. The company stated that this move means it can choose to go public after the SEC completes its review, but the specific issuance timing still depends on market conditions and other factors. Currently, the number of shares to be issued and the issuance price have not yet been determined. Anthropic also emphasized that this announcement is made pursuant to Section 135 of the Securities Act of 1933 and does not constitute an offer to sell securities or a solicitation of an offer to buy securities.

Coinbase released a retrospective report on the large-scale service interruption event on May 7, 2026.The outage lasted approximately 8 hours, with full recovery taking about 12 hours. During this time, trading, deposits, withdrawals, and most core services were unavailable or severely degraded. Coinbase stated that the outage was caused by multiple cooling units failing simultaneously in the cooling system of a data center in one availability zone (use1-az4) in the AWS us-east-1 region, triggering cabinet thermal protection shutdowns, which led to EC2 instances and EBS volumes going offline, affecting multiple internet services.During the recovery process, the Coinbase trading matching engine lost quorum due to the cluster architecture deployed in a single AWS data center losing most nodes. It required urgent code adjustments and the reconstruction of a new node group to restore operation, gradually restarting market trading during the recovery.Additionally, the AWS-managed Kafka (MSK) service experienced control plane failures, preventing the automatic re-election of partition leaders, further blocking quotes, fees, and some settlement and data flow systems, which expanded the overall impact.After manual partition migration in collaboration with the AWS engineering team, the system gradually returned to normal. Coinbase stated that this incident exposed its shortcomings in cross-availability zone automatic switching capabilities and disaster recovery for managed middleware. The company will upgrade its cross-region hot backup architecture, strengthen regular failure drills, and migrate the Kafka system from dual availability zones to a three availability zone deployment, while also working with AWS to advance root cause fixes and improvements.

Zama protocol founder Rand posted on the X platform that, with the assistance of on-chain detective ZachXBT, the root cause of the cUSDC contract freeze has been identified. This freeze was caused by a court-issued injunction against addresses related to the Overnight Finance hacker, which had deposited approximately $12.5 million USDC into the cUSDC contract, accounting for over 99% of the funds within the contract, leading to the entire contract being frozen.Rand emphasized that this freeze is unrelated to the protocol itself or privacy technology, and it is not a sanction against Zama, but rather a typical DeFi judicial restriction scenario. The project adheres to compliance and privacy principles, not confusing the parties involved in transactions, only hiding balances and amounts. Currently, Zama is communicating with multiple parties to advance a resolution, has suspended the cUSDC, cUSDT, and cWETH contracts, and will restore them after completing the investigation and handling of the involved addresses, and will release a detailed review report as soon as possible.

Regarding the incident "DxSale accused of using a backdoor to withdraw $7.3 million in liquidity funds," the security company GoPlus stated that the attack may have been an inside job, and there is still $15.5 million in funds and LP urgently needing rescue. GoPlus recommends that the project team immediately check whether their project LP is locked in the contracts 0xEb3a9C56, 0x81E0eF68, 0x2D045410, 0x5b5e9448, and if so, take immediate measures to withdraw. Since the initial funding source was Bybit, KYC tracing is recommended; the final withdrawal channels are multiple Binance addresses, and it is suggested that the relevant security teams submit on-chain evidence to apply for freezing the attacker's address.GoPlus calls on the project to strengthen security mechanisms, stating that critical admin functions must have a time lock, and Owner permissions must use multi-signature. GoPlus emphasizes that as of now, DxSale has not issued any public incident response statement, and its silence is also worth noting.

SUPERFORTUNE AI posted on platform X that the team is investigating the GUA security incident that occurred on May 27. This incident caused severe fluctuations in token prices, and preliminary investigations indicate that the incident may involve address tampering in a multi-signature transaction.The announcement stated that the plan was to send additional unlocked tokens to the airdrop claim contract address, but during the execution of the transaction, the funds were mistakenly sent to another hacker address. The team noted that this hacker address had never interacted with any addresses related to SUPERFORTUNE before, so the likelihood of an "address poisoning attack" as a method of attack is low. Additionally, SUPERFORTUNE stated that its internal processes already include a multi-address verification mechanism, and the team is still continuing to investigate the incident and will update the community on the latest developments.

According to The Block, Aztec Labs has acquired Obsidion, the company behind the open-source privacy identity verification tool ZKPassport. Its co-founders Michael Elliot and Theo Madzou, along with their team, will join Aztec Labs to continue developing ZKPassport and related applications.Aztec Labs is building the Ethereum privacy layer two network Aztec Network, which raised approximately $60 million worth of ETH through the AZTEC token sale last year, and previously secured about $125 million in venture capital.ZKPassport allows users to read passports or government documents via mobile NFC, generating cryptographic signatures locally for verifying age, nationality, and "real identity" without exposing full privacy. It has been used for ticketing at the Devconnect conference and for compliance identity verification in the Aztec community token sale. Aztec stated that it will continue to keep the ZKPassport protocol and iOS application open source.

Stake DAO posted on platform X in response to the security incident, stating that its team is aware of the current security event and advises against interacting with vsdCRV.Previously, an anomaly occurred with contracts related to Stake DAO on Arbitrum, resulting in the minting of 54 trillion vsdCRV. The security team has classified this as a suspected infinite minting exploit.

According to The Block, since the KelpDAO cross-chain bridge attack in mid-April, the total value locked (TVL) in DeFi has decreased by about 14%, from approximately $172 billion to $148 billion. The attackers exploited vulnerabilities in off-chain infrastructure rather than smart contract vulnerabilities, stealing about $292 million and exposing new infrastructure risks.The outflow of funds has continued for more than five weeks, indicating that investors are broadly withdrawing marginal capital rather than just targeting specific protocols that were attacked. Lending, as the largest DeFi category, saw its locked amount decrease from about $53 billion to $40 billion, marking the largest decline. Liquidity re-staking protocols also experienced significant drops. The KelpDAO attack indicates that as the security of smart contracts improves, off-chain infrastructure is becoming a more easily exploitable attack surface.

According to the on-chain analysis platform Bubblemaps, the same address cluster it marked has sold approximately $600,000 worth of CWU tokens, but the related addresses still hold about 85% of the CWU supply. The token previously attracted attention due to support from the former president of Ghana.

AI predicts the market project NeoSoul collaborates with 0G to launch the prediction credentials on-chain identity credential campaign, with the first batch of credentials opening for minting on May 27. This campaign is aimed at NeoSoul and 0G ecosystem users, focusing on early identity verification, community participation, and on-chain interactions within 0G. Eligible users can obtain credentials minted through the 0G network as their early on-chain identity credentials.According to reports, NeoSoul has previously been conducting on-chain activities within the 0G ecosystem and has created over 100,000 Agents in total. This credentials campaign will set different levels of identity, and users can unlock corresponding credentials based on their task completion status. Specific rules can be found on the official website.It is reported that credential holders will have the opportunity to receive more ecosystem rewards and qualifications for future activities.

Tether-supported mobile wallet Oobit clarified in a post on platform X that previously, after "on-chain detective" ZachXBT disclosed that the stablecoin issuer StablR's two smart contracts (EURR and USDR) suffered a vulnerability attack of approximately $13.5 million, related funds attempted to exit through Oobit. However, its compliance team identified the abnormal behavior and successfully froze EURR funds worth six figures, while also closing the exit channel. This incident did not affect any user funds, and Oobit's own system was not breached. They are currently cooperating with StablR and investigators to advance subsequent handling.Earlier reports indicated that StablR suffered a loss of approximately $28 million due to a hacker attack, with both EURR and USDR losing their peg.

The founder of Slow Fog, Yu Xian, posted on the X platform to interpret the Squid security incident. He stated that sampling found that the related Safe wallets were all single-signature, and the owners were all different, but the issue was not with the private keys; the problem lay in the modules (SquidRouterModule) used by these Safe addresses, which had vulnerabilities. Attackers could forge messages, easily bypass relevant validations, and initiate subsequent exchange operations to transfer funds from the target Safe wallet. In addition, Yu Xian also disclosed information about the address where the attackers' profits were deposited.Previously, it was reported that a third-party Gnosis Safe module was exploited on Base and Ethereum, resulting in a loss of approximately $3.2 million, with the victims being 86 Gnosis Safes that had added this contract as a trusted Safe Module. The contract was named "SquidRouterModule" on Basescan, and subsequently, Squid clarified that it was not affected by the Gnosis Safe-related vulnerability incident.

Ondo Finance announced that its founder and CEO Nathan Allman has passed away unexpectedly. Ondo stated, "Nate's talent, humility, and execution shaped Ondo as it is today. He always believed that technology could create a more open and accessible financial system, and this philosophy will continue to be reflected in everything we build in the future."The announcement stated that Ondo has established an experienced management team, and Ondo Finance's long-time president Ian De Bode will take over as CEO. Ondo noted that Ian has led the company's strategy, products, and daily operations for over two years and has the full support of the management team.

StablR officially announced on the X platform that it has identified a security vulnerability affecting its euro stablecoin EURR and dollar stablecoin USDR, and is actively controlling the vulnerability and mitigating its impact. Protecting users and user funds is its top priority, and details and follow-up measures will be announced as soon as the relevant issues are verified.According to previous reports, the StablR stablecoin became unpegged after an attack, and the attacker has profited approximately 2.8 million dollars.

According to Cointelegraph, Bitcoin journalist Joe Nakamoto stated that approximately 70% of violent kidnapping incidents (wrench attacks) targeting cryptocurrency holders and their families occur in France. Since 2026, there have been 41 cryptocurrency-related kidnappings in France, averaging one every two and a half days.Nakamoto attributes this to the centralized storage of KYC (Know Your Customer) data. In the 2020 data breach incident involving hardware wallet manufacturer Ledger, the personal information, home addresses, and emails of over 270,000 users were exposed, providing criminals with precise attack targets. Casa CEO Jameson Lopp stated, "France is the canary in the coal mine, revealing how the surveillance system built by financial regulation can directly harm Bitcoin holders."In response to such threats, industry experts recommend that holders use custodial services with security features that can trigger asset freezes and notify law enforcement in the event of an attack; they also suggest preparing a "decoy" wallet with a small amount of funds and maintaining a low profile in public to avoid exposing holding information.

According to Polymarket's Vice President of Engineering Josh Stevens, with the assistance of ZachXBT, BitcoinVN, and ChangeNOW, $164,000 in funds have been frozen in the Polymarket private key leak incident, accounting for approximately 28.6% of the total amount transferred, which is $573,200. Josh stated that this incident did not affect Polymarket or the UMA smart contract, user funds are safe, and the platform is operating normally. Investigations show that the incident originated from a private key that had existed for about 6 years, which was used for internal recharge configuration, leading to funds being continuously sent to the affected address. The relevant team is continuing to track the flow of the remaining stolen funds.

In response to the China Securities Regulatory Commission's announcement regarding the rectification of illegal cross-border securities, futures, and fund operations and related penalties, Wang Shan, Chief Operating Officer of Tiger Brokers (Hong Kong) Global Limited, stated that the company is aware of the relevant notice issued by the China Securities Regulatory Commission (CSRC). The company indicated that the relevant notice does not directly apply to its Hong Kong entity, as the company holds a license issued by the Hong Kong Securities and Futures Commission (SFC) and operates independently under its regulation.

Bitcoin mining company MARA Holdings allocated approximately $4.3 million for CEO Fred Thiel's personal security expenses in fiscal year 2025, which includes $430,780 for vehicle bulletproof modifications, as well as expenses for bodyguards and residential security facilities. According to documents submitted to the U.S. SEC, MARA also provided approximately $3.9 million in security expenses for CFO Salman Khan, including $438,380 for vehicle bulletproof costs.Reports indicate that as incidents of "ransom attacks" targeting executives and investors in the crypto industry increase, crypto companies are significantly ramping up their investment in executive physical security. The so-called "ransom attack" typically refers to forcing victims to hand over private keys or account access through kidnapping, violence, or coercion. Data shows that in 2025, there were 72 confirmed incidents of crypto-related entity coercion globally, a year-on-year increase of 75%. Among these, France recorded 19 incidents, the highest in the world.

Polymarket staff Shantikiran Chanal posted on platform X that they have noted a security report related to reward distribution, and user funds and market settlements are in a secure state. The investigation points to a wallet used for internal operations experiencing a private key leak, rather than an issue with the contract or core infrastructure. More updates will be released later.Previously, ZachXBT stated that the Polymarket UMA CTF Adapter contract was suspected to have been attacked on Polygon, with over $520,000 currently leaked.

THORChain has released its fourth update regarding the attack incident on May 15, and the proposal ADR028 has been announced, with voting for node operators now open.According to the recovery plan, the protocol will first absorb losses through its own liquidity, with the remaining portion to be shared by synthetic asset holders; the specific distribution ratio of the two is still under evaluation. The protocol's own liquidity will be reduced to zero, and will be gradually replenished through system revenue. This plan will not issue or sell RUNE, nor will it dilute any holders.On the technical side, GG20 will be temporarily retained and has completed patch upgrades. Trading will resume after the vulnerabilities are fixed and node rotation is successfully conducted, with a future release pace that is slower and more security-conscious. Innocent nodes located in the same vault as the attacker will be protected, while the attacker nodes will be fully confiscated. The recovered RUNE will be paired with the recovered assets, and any excess will be destroyed.The protocol also offers a white hat bounty to the attacker to recover funds; if some are returned, the recovery plan will be adjusted proportionally. THORChain remains neutral and permissionless, and there will be no review of the attacker's Swap transactions after trading resumes. Node operators are currently voting on the proposal direction, and the numbers in the ADR are only indicative, with adjustments to be made through Mimir later.