hub

Slow Fog released a threat intelligence report stating that they recently received user feedback about a GitHub repository named sol-live, which disguises itself as a Solidity interview practice project. However, it hides commands in the .vscode/settings.json file to download and execute remote scripts, which may trigger malicious payloads when users start the project with custom terminal configurations.Slow Fog's analysis shows that the related malicious payloads can collect browser login databases, wallet extension storage, and macOS Keychain files. They also have the capability to scan and upload local files, execute remote commands, provide interactive Shell access, and monitor the clipboard. In macOS and Linux environments, the malicious terminal configuration must be actively initiated by the user to execute; the attack chain on Windows has not been confirmed due to issues with quote handling.

The Shanghai Municipal Cyberspace Administration and the Data Bureau released "Several Measures to Promote High-Level Opening Up in Shanghai and Facilitate Cross-Border Data Flow," supporting the construction of international data centers and supporting the computing power service industry and related cross-border digital services.Promote the construction of the National Blockchain Network (Shanghai Hub), strengthening foundational capabilities such as distributed digital identity, privacy computing, and cross-chain services.

The free and open-source tool REA (Reverse Engineer Anything) saw its star count on GitHub rise from less than 10,000 on October 6 to over 100,000 by October 12, with more than 30,000 added in a single day on October 11. This tool integrates AI programming assistants like Claude Code and OpenAI Codex with professional reverse engineering suites like Ghidra, bridging the model context protocol MCP launched by Anthropic. Since its creation in April of this year, REA had long gone unnoticed; its readme file states that the tool does not claim to restore original source code or automatically clone applications, nor does it come with a decompiler.REA has been used for various reverse engineering attempts on software and games: players have made Spider-Man swing through Gotham City in "Batman: Arkham City," someone stuffed about 1,600 items from "Minecraft" into "Elden Ring" to battle Boss Malenia, and mod authors have brought firearms and menus from "Escape from Tarkov" into "The Elder Scrolls V: Skyrim." Old console exclusives are also breaking free from their platforms; in September, enthusiasts used open-source AI models and recompilation tools to bring "Fable 2," which had never been released on PC, to Windows, with AI completing the startup in about an hour, followed by a long manual fix; another developer has made "GTA 5" run natively and smoothly on iOS.

The cryptocurrency exchange platform Coinbase has obtained a Financial Services License (FSP) issued by the Financial Services Regulatory Authority (FSRA) of the Abu Dhabi Global Market (ADGM). This license allows it to arrange investment transactions and provide custody for tokenized securities. Coinbase describes this license as the regulatory foundation for its international tokenization hub and the first of its two major non-U.S. institutional businesses established in the UAE, the other being its derivatives business in Dubai.According to the scope of the license, the FSP covers the arrangement and custody of tokenized stocks fully backed by underlying shares. Holders of digital securities can gain economic exposure such as dividends, while voting rights and redemption rights are subject to the conditions outlined in each prospectus. Coinbase states that investors only need a crypto wallet to trade, and secondary transfers do not require a brokerage account or banking relationship, but redeeming profits for fiat currency still requires a bank or brokerage account.Brett Tejpaul, Co-President of Coinbase Institutional: Currently, there is no major financial center that has established a framework that simultaneously regards tokenized stocks as securities, blockchain-native tokens, and composable DeFi assets. Arvind Ramamurthy, Chief Market Development Officer of ADGM, stated that the Coinbase hub reflects the center's progressive, robust, and internationally aligned regulatory framework. The FSRA issued its first virtual asset rules in 2018, which include protective measures such as sanctions screening and the ability to freeze or seize assets at the wallet level. ADGM applies English common law, and the FSRA's authority differs from that of the UAE Securities and Commodities Authority; registered entities do not automatically obtain a passport in other Gulf Cooperation Council jurisdictions.

Cosmos Labs disclosed that on September 22, Neutron encountered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. The Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out, Hub validators temporarily paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address. When the network was restored, these were transferred to a 4/6 multi-signature address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu through a one-time change. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. The current multi-signature address holds approximately 1.227 million ATOM, which can only be returned after authorization from a Cosmos Hub governance proposal. The related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.

The Cosmos ecosystem protocol Neutron faced a governance proposal that was manipulated by an attacker. The related address spent approximately 20,199 USDC to buy NTRN and staked 31.6 million NTRN about 12 minutes before the voting ended, ultimately allowing the proposal to pass with an 82% approval rate. Subsequently, the management rights of 11 contracts were transferred to the attacker, and they migrated to malicious code, stealing approximately 4.4 million dollars in assets.To recover the funds, Cosmos Hub validators coordinated a chain halt for nearly 24 hours and 48 minutes, and during the restart process, approximately 1.23 million ATOM were transferred from the attacker's wallet to a new address, with plans to return them to the original holders.

The official Cosmos Hub announced on platform X that the validators have successfully restarted the Cosmos Hub network as scheduled, block production has resumed, the network is operating normally, and they will continue to monitor the network status and provide further updates.

Market news shows that OpenAI and GitHub have won the copyright lawsuit regarding AI programming tools.

On September 14, Aave Labs released an ARFC on the Aave governance forum, seeking approval to deploy a new Aave V4 Isolated Hub and Spoke to integrate institutional custody collateral as collateral for stablecoin loans. Institutional borrowers will deposit collateral with Anchorage and maintain custody during the loan period, with the custody balance represented on-chain by non-transferable custody collateral tokens CoCT, minted and burned by CustodySync designed by Chainlink.Borrowers will stake CoCT on the Spoke and withdraw stablecoins from the Isolated Hub. The entire loan lifecycle, including liquidation, is synchronized between the custodian and Aave through Chainlink infrastructure. The proposal is limited to a single Isolated Hub and a single Spoke governed by the Aave DAO, without altering existing Hubs, Spokes, or reserves. The underlying assets will always remain in custody, with Anchorage holding the assets as the custodian and acting as the counterparty for account control protocols; Chainlink does not hold the assets.CoCT is a restricted transfer ERC-20, only allowing Hub, Spoke, and CustodySync, with minting and burning exclusive to CustodySync, and each borrower's position corresponding to a contract. The initial plan is to launch a CoCT for BTC held in custody by Anchorage. The next steps involve ARFC discussions, and if supported, it will proceed to Snapshot, followed by submitting the final parameters for AIP.

Bitget has now integrated the automated trading platform TV-Hub. Users can build trading strategies in TradingView and automatically send trading signals to their Bitget accounts for execution via TV-Hub. This integration supports Bitget USDT margin contract trading, covering both crypto and TradFi perpetual contract markets, and supports strategies such as stop-loss and take-profit, position management, dollar-cost averaging, and hedging.Previously, Bitget has connected with platforms like WunderTrading and Hummingbot. To support this launch, TV-Hub will provide free usage services for all Bitget API connections until October 31.

Bitcoin News posted on the X platform that Alby confirmed a critical vulnerability exists in Alby Hub v1.7.0 to v1.18.5. If the management API is exposed to the public network, attackers may gain unauthorized access and transfer funds. Currently, it is known that 1 user has been affected, and Alby Hub v1.19.0 and higher versions are not affected.Alby recommends that affected users restrict public access to the management interface, immediately update to v1.24.0, and change the unlock password after the update. Multiple issues reported by Bitcoin Team Red, Project Loupe, and other researchers have also been fixed in the latest version.

The DeFi lending protocol Venus Protocol has launched the Liquidity Hub, aimed at establishing a unified capital allocation layer for the Venus ecosystem. Users only need to deposit one type of asset to receive the corresponding Hub Token. The Liquidity Hub will automatically seek better APY combinations based on different market yield opportunities and allocate funds to products such as Core, Flux, and Fixed-Rate Vaults, without requiring users to manually manage positions across multiple products.The Liquidity Hub is not a new lending market but a unified liquidity entry built on top of Venus's existing products. Capital allocation, rebalancing, and the flow of underlying assets are all recorded on-chain, maintaining openness, transparency, and verifiability. Currently, Liquidity Hub v1 has been deployed on the BNB Chain, and in the future, it will connect to more lending markets, institutional yield products, and new sources of yield.

Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after installing a transcription application using a download link provided in the Claude chat window. The link pointed to a counterfeit website and bundled malware that attempted to steal all information from his device upon execution. Numa Lunah mentioned that he cleared and reinstalled the affected laptop and found no sensitive information leaked.Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide written by him and contained instructions to re-download the malware and steal credentials every time it was loaded. Microsoft Defender Experts had warned that attackers had shifted from search engine optimization poisoning to large language model response poisoning, with related tactics including recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Crypto industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

EthHub founder Eric Conner stated that he has written a new ERC proposal, ERC-8391, aimed at providing an asset status interface for tokenized stocks and RWAs. Tokenized stocks can be traded on-chain around the clock, but the New York Stock Exchange is only open for 32.5 hours a week. Smart contracts find it difficult to distinguish whether outdated prices are due to the weekend market closure or due to price feed failures or a company being acquired during the market closure; both scenarios have the same on-chain bytes, but the correct responses are opposite. Information such as trading halts, price locks, and redemption windows cannot be reflected in the price.This standard will regulate the queryable issues of contracts, covering market phases, trading halts, valuation activity, and redemption windows. Oracles can feed data into it, and tokens will respond.

According to Fortune, cryptocurrency exchange Coinbase has chosen Abu Dhabi in the UAE as its "International Tokenization Hub," aiming to bring more traditional financial assets onto the blockchain. This move is seen as a significant advancement for Abu Dhabi in attracting global cryptocurrency and fintech companies.Coinbase plans to promote the tokenization of real-world assets (RWA) through this hub, leveraging Abu Dhabi's regulatory environment and policy support to expand its presence in the Middle East and international markets. In recent years, Abu Dhabi has continuously improved its digital asset regulatory framework, attracting multiple cryptocurrency institutions to settle there.

The GitHub official status page shows that the platform is currently experiencing service disruptions, with multiple core functionalities experiencing decreased availability.According to the latest announcement, the error rate for GitHub's web interface and API requests reached about 20%, while the error rate for repository archive downloads and raw repository content downloads was around 50%. Additionally, SAML and OIDC authentication, SCIM, and Team Sync functionalities are also affected.Currently affected services include: decreased performance of Pull Requests; decreased performance of Issues; decreased performance of Actions; decreased performance of Webhooks; anomalies in API Requests; decreased availability of GitHub Copilot.GitHub stated that the team is continuously investigating the root cause of this incident and will provide further updates once more information is available.As of now, GitHub has not disclosed the specific cause of the outage, nor has it indicated whether it involves a security incident. This service disruption may affect developers and enterprise users who rely on GitHub for code hosting, continuous integration and deployment, and AI-assisted development.

Coinbase posted on the X platform stating that the company has designated the Abu Dhabi Global Market (ADGM) as its international tokenization center. After obtaining the new FSRA license, the company can now offer global securities to any user with a wallet.Coinbase stated that the next frontier of global finance is the on-chain space, and the company is advancing related developments from the UAE.

According to Bloomberg, Thailand's True Internet Data Center is seeking approximately $2 billion in equivalent loans to build new data center facilities to help Thailand develop into a regional AI and cloud services hub.In terms of financing structure, the loan will be divided into three parts, with about $1.8 billion denominated in US dollars, and the other two parts denominated in Thai baht. Sources familiar with the matter requested anonymity as the details of the transaction have not yet been publicly disclosed.