ln

The cross-chain exchange protocol NEAR Intents released a post-mortem report attributing a $3.8 million vulnerability to a flaw in the deposit notification feature. The protocol deploys a public settlement contract on NEAR that maintains an internal ledger of deposited tokens, while withdrawals transfer tokens out via a cross-chain bridge. The report was published by NEAR Intents General Manager Alex Shevchenko on October 16, stating that the attacker withdrew $3.8 million before the protocol was shut down on October 1 and returned all funds within 36 hours of detection, with all affected users fully compensated.The report indicates that the feature notifies third-party contracts when tokens are deposited. The attacker created a contract that intentionally caused the notification to fail, allowing the token contract to refund the deposit while NEAR Intents retained the corresponding ledger credit. Through 23 failed deposit transactions, the attacker accumulated $3.8 million in unsupported balance, referred to in the report as ghost funds, and subsequently withdrew real tokens based on this and transferred them to other chains via the Omni infrastructure. Shevchenko stated that this was a vulnerability in the NEAR Intents contract, not in the Omni infrastructure.Withdrawals occurred between September 29 and October 1. The settlement contract was paused and reopened on October 1, with affected routes gradually restored, and contract-side deposits resumed on October 2. The report noted that the vulnerability went undetected because monitoring only compared the original chain assets with the total balance of NEAR side tokens, without comparing the total internal user balances with the actual tokens held by the contract; the team has since added this check and will automatically pause the contract when there is a balance inconsistency. The fix for the October vulnerability was deployed on October 2, but another serious vulnerability report regarding the same feature prompted its complete removal on October 7, with the relevant researcher receiving a $300,000 reward.

The privacy coin project Pirate Chain stated that its network suffered a vulnerability attack, resulting in the generation of 39.8 million ARRR tokens out of thin air.Currently, the Pirate Chain network is still operating normally, but the development team is advancing recovery efforts and has requested users not to transfer funds until the recovery is complete.

The liquid staking token bOSMO issued by Backbone Labs nearly exhausted its contract support after a large redemption in the Osmosis community pool. A disclosure on the Osmosis forum on October 15 revealed that approximately 40,508 OSMO were designated for compensation to 1,037 accounts. The disclosure author Johnny Wyles stated that the staking contract has overpaid for each redemption since at least April 2026, settling at approximately 1.676 OSMO per bOSMO, while the declared exchange rate of the contract was about 1.117 OSMO.The vulnerability repeatedly counted the OSMO staked on Backbone's own validators, allowing redeemers to receive about 50% more assets, at the cost of diluting the support for remaining holders. The defect was exposed when preparing to liquidate the community pool position, and the passed governance proposal 1049 authorized the withdrawal of the Margined managed treasury position and the destruction of the reclaimed OSMO when it ceased managing liquidity operations. The pool's bOSMO treasury holds approximately 1.137 million bOSMO, accounting for about 97% of the total supply of the token; the redemption transaction executed on October 9 at 21:59 ET destroyed 776,000 bOSMO and began unbinding approximately 1.3 million OSMO.Compensation is based on the qualified balance at block 72,237,940, calculated at 1.1174 OSMO per bOSMO. bOSMO purchased after the snapshot is not included in the compensation, and underlying holders in the liquidity pool and other contracts are also included;

Polygon Labs official announcement, Bor v2.1.3 is officially released to the public, previously distributed in private version form to validators and major infrastructure providers. This update fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution, both submitted by security researchers through the Immunefi bug bounty program.Unbounded keccak256 cache issue: Attackers can fill hundreds of MiB of cache during the speculative execution phase by constructing specific transactions, leading to node memory exhaustion and delayed block production. The fix is to set a capacity limit on the shared cache. Repeated code hash calculation issue in parallel execution: A single transaction can cause the parallel processor to take about 11 seconds, severely affecting node activity. The fix is to cache code hash results on a per-transaction basis.In addition, this update also includes several internal hardening measures: the transaction pool address filtering adds interception for EIP-7702 SetCode authorization, RPC batch execution pool concurrency limit fixes, consistency fixes for reading balances across self-destruct boundaries in parallel execution, and an automatic cleanup mechanism for pending transactions (default 3 hours). The affected versions are Bor v2.1.1 and v2.1.2. v2.1.3 is a non-hard fork, and nodes can upgrade individually without coordination. No exploitation records of the two vulnerabilities have been found on the mainnet and testnet Amoy.

According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update that fixes vulnerabilities that could allow malicious nodes to steal funds. The most serious vulnerability involves Lightning channel reconnections. According to Bitcoin Optech, malicious nodes may falsely claim that they did not receive previously confirmed channel updates.The vulnerable LDK software could subsequently sign conflicting commitment transactions without properly recording the related transactions, allowing attackers to regain Bitcoin after forwarding the payment is completed. Versions LDK 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.

On-chain detective ZachXBT responded to the XRP Ledger Foundation regarding security fixes, stating that the foundation's treasury holds billions of dollars but only paid $250,000 to the white hat hacker who discovered the serious vulnerability of "infinite XRP issuance." He claimed that this would encourage attackers to choose not to report vulnerabilities in good faith but instead exploit them to steal hundreds of millions of dollars.ZachXBT also stated that because of this, it is difficult for people to view the XRP Ledger or Ripple as legitimate institutions. Previously, the XRP Ledger Foundation clarified that the relevant vulnerability did not lead to the issuance of additional XRP, and the patch was driven by community consensus.

The XRP Ledger Foundation published a post on platform X to clarify the recent security vulnerability incident of the XRP Ledger, stating that the vulnerability could be used to bypass the limit of the total supply of XRP fixed at 100 billion coins, but it was fixed two weeks ago with version 3.4.1. After verification, no new XRP has been created, and the total amount of XRP currently circulating in the ledger is approximately 99.986 billion coins.The foundation stated that the vulnerability requires hundreds of deliberately constructed operations to trigger and that normal payment transactions are unlikely to be involved. In the future, they will strengthen formal verification, AI adversarial testing, security research collaboration, and vulnerability bounty programs with RippleX and the community. Regarding the repair process, the foundation explained that publicly releasing a patch could allow attackers to use AI to accelerate vulnerability analysis. To address this situation, the XRPL community coordinated efforts. Participants including the XRP Ledger Foundation, RippleX, core developers, and validators reached a social consensus to agree on a plan to directly release the repair program.In addition, version 3.4.1 was also adopted as the mandatory version for the network only after going through the normal amendment voting process and receiving over 80% support from validators for two consecutive weeks. Protocol changes still need to be completed through the amendment mechanism. Previously, J. Ayo Akinyele, the engineering lead at RippleX, also posted on platform X expressing high concern about the recently disclosed critical vulnerability issue in the XRP Ledger (XRPL) payment engine, which is a serious security issue that has existed in the codebase for over 10 years and theoretically could lead to XRP being over-created, breaking the fixed supply limit. However, the vulnerability was discovered by the security research organization Veria AI through Ripple's vulnerability bounty program before it could be exploited.

Papertrade's official response to the allegations of price manipulation and the existence of obvious loopholes in the protocol states: It has never been possible for small orders to have the same priority as large orders. If this were done, the front end would suffer from congestion due to junk trading, and the consequences would be much worse than the existing queuing mechanism.Under these constraints, we have designed the fair launch to be as inclusive as possible.Last night, the attempts to manipulate BTC/ETH on Hyperliquid BBO were not due to flaws in the mechanism that took six months to design. These situations had already been considered; it was only because the position limits were set very loosely in the early stages to cope with congestion that such occurrences were possible. If position limits were set during peak demand for launching, it would only exacerbate the slow experience, and the queuing mechanism itself, due to the uncertainty of opening/closing confirmation times, naturally provides protection against manipulation.As congestion eases, we have begun to tighten position limits on-chain and at the relay level. In such a system, manipulation attacks are always possible— the key is whether the attempt is economically viable. The official goal is to set parameters to a point where it is almost never profitable; even if successful, the tail risk is extremely high, and the expected value is negative.

According to Bitcoin.com News, Juan Curutchet, the head of financial and foreign exchange institution regulation at the Central Bank of Argentina (BCRA), recently stated that in the short term, cryptocurrency assets will not be allowed to integrate into the banking and payment service systems, and the regulations prohibiting financial institutions from providing cryptocurrency services established in 2022 will continue to be maintained.Juan Curutchet pointed out that Argentina's current economic vulnerability is insufficient to support the advancement of related measures, and whether the ban will be lifted in the future depends on the economic situation. Related topics may be discussed during the second term of Milei.

Regarding the critical vulnerability in the payment engine reported by Veria AI, RippleX engineering lead J. Ayo Akinyele stated that the XRP Ledger (XRPL) payment engine has a serious vulnerability that has existed for over 10 years, which could lead to the issuance of XRP beyond its fixed supply. This vulnerability was discovered through a bug bounty program and has not yet been exploited.The development team has released the xrpld 3.4.1 patch version and coordinated with validators to complete the network upgrade before public disclosure. Akinyele mentioned that AI is accelerating the speed of vulnerability discovery, and XRPL will increase proactive security investments, clean up technical debt, advance formal verification, and systematically eliminate potential risks in old code.

The XRP Ledger recently fixed a payment system vulnerability that could be traced back to 2015. This vulnerability could allow attackers to bypass the system's calculation limits on token exchange amounts through a specially designed payment transaction, generating and spending large amounts of XRP out of thin air, undermining the mechanism that caps the total supply of XRP at 10 billion.It was disclosed that attackers could create hundreds of accounts, allowing these accounts to post offers to exchange a small amount of tokens for a large amount of XRP, and then execute a transaction simultaneously. Due to a flaw in the software's calculation of the total transaction amount, the seller's account could receive the full XRP, while the buyer's account would need to pay almost nothing. Researchers Cayden Liao and Veria AI reported the vulnerability on September 22, and RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network. The development team released version 3.4.1 of xrpld on September 25 to fix the vulnerability.

According to Catcher Predict monitoring, in the market prediction on Polymarket for the event "LoL: Movistar KOI Fénix vs TLN Pirates - EMEA Masters Playoffs," the option "Movistar KOI Fénix" in the sub-market "Game 4 Winner" has experienced a drastic fluctuation in win rate, soaring from 54.5% an hour ago to the current 82.5% (a fluctuation of 28%). Please note the impact of relevant breaking news.

According to security researcher BeakSec, Telegram Desktop previously had a high-risk vulnerability CVE-2026-107181. Attackers could pre-place command files in the group where the victim is located, then induce them to click on links redirected through the browser, using inter-process communication command injection to send local files to a group controlled by the attacker; if the session file is stolen and the user has not set a local password, the account may be taken over.The researcher stated that versions 7.2.8 and earlier are affected, and the vulnerability has been fixed in version 7.2.9 released on September 17.

Immunefi Security Chief Gonçalo Magalhães stated that an unnamed Base treasury suffered a vulnerability exploit of approximately 6 million dollars, while there were still about 31.7 million dollars in assets within the treasury at the time of the incident.According to the briefing, the attacker added a malicious contract to the treasury's lending whitelist through a Safe multi-signature wallet, subsequently withdrawing 1,783 aBaswstETH, which were then exchanged for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães pointed out that the whitelist's restricted addresses appeared secure, but approved addresses could withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remedial measures.

ChainCatcher live report, at the OKX NOW Global Product and Ecosystem Conference (Singapore), Ethereum co-founder Vitalik Buterin stated that AI has demonstrated strong penetration and offensive and defensive capabilities, with cases emerging of breaking out of sandboxes, attacking websites, and discovering various software vulnerabilities and exploits. "Anything with vulnerabilities will eventually be discovered by AI; GPT-7, Claude 7, DeepSeek 7 will find it."At the same time, AI is also helping the Ethereum protocol discover bugs, implement complex cryptography, and perform formal verification at both the protocol and application layers. Vitalik believes that higher security levels will shift from "optional" to "mandatory," and the industry is in a fascinating yet challenging transitional period.

QCP Capital released the latest market analysis stating that BTC has broken through the previous trading range of $82,500 to $85,700 that lasted for a week, reaching a high of $86,913 during the day, the highest since September 23. It is currently trading around $85,900, up 14.6% from the low of $74,968 on September 15. QCP pointed out that during this round of increase, the annualized funding rate for perpetual contracts was only 5.4%, indicating that the market was mainly driven by spot funds rather than leveraged trading. QCP believes that this round of BTC's rise diverges from traditional macro market signals. In September, the yield on the 30-year U.S. Treasury bond rose to 5.62%, and the 10-year yield reached 5.29% at one point, while gold recorded its worst month of the year. Although rising real interest rates typically put pressure on gold and risk assets, BTC still rose.QCP believes that this market trend is more consistent with concentrated capital trading driven by institutional fund inflows, regulatory catalysts, and technical improvements, rather than purely a currency depreciation trading logic. Regarding institutional funds and regulatory factors, the U.S. Bitcoin spot ETF recorded net inflows of approximately $3.5 billion and $2.6 billion in August and September, respectively. QCP noted that the innovative exemption policy released by the U.S. SEC on September 17 provided a new regulatory catalyst for the market, but since the CLARITY Act failed to pass in the Senate earlier, market structure legislation may be delayed until 2027. Therefore, current regulatory support comes more from the administrative level, and long-term policy certainty remains limited.In the options market, yesterday's options trading nominal amount was approximately $2.5 billion, involving 54 transactions with a nominal amount exceeding $5 million each. Among them, one client sold in batches call options expiring on October 30 with a strike price of $90,000, totaling over 4,000 contracts with a nominal amount of $346 million; at the same time, they actively bought call options with the same strike price expiring on November 27. QCP believes that this operation reflects that some traders are rolling their positions from October to November to position for the U.S. midterm elections, quarterly Treasury refinancing, and market volatility around the December Federal Reserve meeting.On the macroeconomic front, the Federal Reserve will hold a monetary policy meeting from October 27 to 28. QCP stated that after Federal Reserve official Williams said there was no need to rush to adjust policies further, and with the August core PCE coming in below expectations, market expectations for maintaining interest rates in October have warmed. However, the market still expects an approximately 80% probability of a 25 basis point rate hike in December. The U.S. non-farm payroll report for September, to be released tonight, will be an important short-term test, with the market expecting an increase in non-farm payrolls of 84,000 to 93,000, an unemployment rate holding at 4.1%, and an average hourly wage year-on-year growth rate expected to be 3%.On the technical front, the support level of $82,500 has been tested three times in the past week, while $87,400 is the location of the September high and is a key resistance for BTC to further challenge $90,000. The implied volatility term structure in the options market is in a contango state, with a 7-day implied volatility of 30.3 and a 90-day implied volatility of 37.1; the 30-day risk reversal indicator is approximately -2.5 volatility points, indicating an increase in demand for short-term put protection. QCP believes that although BTC shows resilience in a macro environment of rising real interest rates, the market is still mainly driven by capital flows and position changes, and it cannot yet be considered that macro risks have been eliminated. U.S. employment data, Treasury supply, and the intensive policy events in the coming weeks may still trigger market volatility.

Slow Fog issued a security alert stating that the Aave V3 Loop Safe Module has a security vulnerability, allowing attackers to forge Safe authentication and execute arbitrary modules, stealing approximately 114.09 ETH from two Safe multi-signature wallets.Attackers bypassed authentication by forging a Safe that always returns true and executed module transactions using a router and calldata that could be arbitrarily controlled, transferring weETH and Aave collateral. After repaying approximately 1300 WETH in debt, the attackers unlocked the collateral.

NEAR Protocol posted on platform X that Sal Ternullo, CEO of NEAR Treasury Company SVRN, has introduced a new proposal on the NEAR governance forum to reduce the maximum annual token issuance rate from 2.5% to 1.6% for a duration of 24 months, and to lower the staking yield from the current approximately 5.4% to about 3.5%.The proposal is currently seeking feedback from validators, House of Stake delegators, and NEAR community members, with a complete plan expected to be announced next week for voting.In response to the recent NEAR Intents security incident, NEAR Protocol further clarified that the blockchain network is operating normally, and the related incident was not caused by vulnerabilities in NEAR Protocol or the native token NEAR. The NEAR Protocol network continues to produce blocks and process transactions without any downtime.

According to Law360, the cryptocurrency asset theft case involving Uranium Finance has begun trial in the U.S. District Court for the Southern District of New York.Prosecutors allege that Maryland cybersecurity consultant Jonathan Spalletta exploited a vulnerability in the protocol's smart contract to launch an attack in 2021, during which approximately $53.3 million was transferred from 26 liquidity pools in a second attack, leading to the protocol ceasing operations. The statements related to this are allegations by the prosecution and not a conclusion of guilt.

Zcash founder Zooko posted that Zcash has issued over 8 million dollars in retroactive grants this round, with millions of dollars awarded to those who contributed to protecting all users during this year's AI vulnerability crisis.The more significant meaning of this funding is that Zcash once again proves that its self-funding and self-governance system is sustainable, resistant to capture, and capable of continuous evolution. Zcash will conduct multiple rounds of similar funding every year in the future while continuously improving the mechanism.