mal

Starknet lending protocol Vesu announced that an oracle incident occurred on September 4. A malfunctioning upstream Pragma price source led to the abnormal liquidation of 47 positions and $3 million in collateral across multiple Vesu liquidity pools between 04:08 and 04:10 UTC. The price source self-corrected within two minutes and has not been affected since.Pragma has collaborated with relevant parties to deploy a fix for the root cause, and Vesu expects liquidity pool curators to lift the suspension of the pools in the coming hours. Vesu stated that its contracts are operating as designed, the protocol has no vulnerabilities, and no fixes need to be deployed; the issue was due to incorrect input prices. Vesu is working with Pragma, StarkWare, Starknet Foundation, and liquidity pool curators to recover the funds taken through these liquidations. Affected users should keep their Earn positions open to avoid losing refund eligibility; if liquidated during the incident, please submit a support ticket on Discord. A complete technical report will be released soon.

Renowned Ethereum builder and investor Ryan Berckmans posted on X, stating that the idea that Robinhood "gives back very little to ETH" is nonsense. They pay on-chain users and new ETH holders, conduct marketing, attract new enterprise clients envious of Robinhood's success, and help mature L1 hubs radiate to L2. Half of Robinhood's active users come from other places in Ethereum and exert healthy competitive pressure on Base.He mentioned that Ethereum alignment is a real concept, but it is not portrayed as income maximization by Ethereum opponents. Helping to grow Ethereum and ETH is alignment, while threatening Ethereum or ETH is misalignment, such as during Lido's dominance. Robinhood is one of the most Ethereum-aligned entities globally. Buying large amounts of ETH or not selling order fees would be better, but this is just icing on the cake of an already huge pie.We do not rely on Robinhood to buy ETH to win. The next batch of Tom Lee will buy ETH, Wall Street Tom Lee, corporate Tom Lee, government Tom Lee, family office Tom Lee, sovereign wealth Tom Lee will be everywhere. ETH will reach trillions in value storage as Ethereum goes global. The two major indicators measuring the progress of value storage are L1 application capital and the number of sufficiently successful L2s, and Robinhood helps grow the latter. We like Robinhood as it is now.

According to GMGN information, trading activity on the Robinhood Chain has gradually resumed. However, the network's browser still shows the block count remaining at 4 minutes ago.

According to on-chain analyst Ai Yi (@ai_9684xtpa), the BSC token $MARSCOIN surged 80% shortly after being listed on Binance spot trading. The average holding cost of the top address on the profit list is only $0.00133 (current price $0.1805), with a total profit of $2.31 million.After the spot announcement was released, this address has begun to sell off in small batches, and currently still holds 10.44 million tokens, valued at approximately $1.92 million.

According to 36Kr, Zhipu has recently opened an official flagship store on Tmall. Data shows that within 48 hours of opening, brand searches surged 50 times compared to the previous period, driving a more than 160% increase in transactions for subscription products like AI tokens on Taobao and Tmall.Previously, Tmall launched the AI Space Station (Token Recharge Center), which initially integrated major model providers such as Alibaba Cloud, Zhipu, Kimi, MiniMax, and DeepSeek, allowing users to directly purchase related subscription services just like "recharging phone credits."

According to a report by the Financial Associated Press, the General Office of the Ministry of Industry and Information Technology has issued the "Entrepreneurship Support Plan for Small and Medium-sized Enterprises in Artificial Intelligence (2026-2028)." Over three years, it aims to cultivate a large number of innovative and dynamic artificial intelligence startups with significant growth potential in key areas such as industry applications, data services, and intelligent computing power. More than 10,000 new technology and innovation-oriented small and medium-sized enterprises will be nurtured, with over 2,000 "specialized, refined, distinctive, and innovative" small giant enterprises emerging, along with a number of gazelle and unicorn companies.Focusing on the field of artificial intelligence, the plan will establish 10 high-standard technology enterprise incubators and 10 national public service demonstration platforms (bases) for small and medium-sized enterprises. It will also cultivate 10 national-level characteristic industrial clusters for small and medium-sized enterprises. The entrepreneurial and innovative vitality of small and medium-sized enterprises in artificial intelligence will continue to surge, and a preliminary pattern of high-quality development for small and medium-sized enterprises empowered by artificial intelligence will take shape.

On September 2, Curve DAO approved proposal 1492, appointing yRisk as the risk provider for crvUSD and Llamalend, concluding the selection process that began in July. The proposal passed with 621 million veCRV votes in favor, with only 5.33 votes against, and was executed 87 minutes after the voting ended. yRisk will receive a one-year revocable grant, including a principal of 125,000 frxUSD (held in sfrxUSD) and 568,000 CRV, while their previously requested annual funding amount was $250,000.yRisk consists of two members, who claim to be the main developers of Resupply, as well as core developers for Yearn and Resupply. Resupply is a stablecoin and lending protocol built on crvUSD and CurveLend, which lost $9.6 million in June 2025 due to a donation attack vulnerability, although this incident was not mentioned in the proposal. The reviewer, Swiss Stake, confirmed yRisk's experience with Curve but expressed concerns about their limited two-member team and the workload required to cover multiple Llamalend market monitoring scopes.LlamaRisk, which previously held the position, announced the early termination of its cooperation with Curve on May 29, ceased related work on June 30, and returned approximately 270,000 crvUSD of unallocated funds to the treasury. Curve founder Michael Egorov initiated a proposal solicitation on July 7.

Several mainstream overseas AI services encountered issues tonight. Claude has already experienced two rounds of failures this evening. Sonnet 5 started showing errors at 20:37 Beijing time and announced recovery at 20:56; half an hour later, Anthropic reported a larger scope of multi-model error rate increase, affecting Mythos/Fable 5.1, Mythos/Fable 5, as well as Opus 5, 4.8, and 4.6. claude.ai, Claude API, Claude Code, and Claude Cowork are still in a partial failure state.Subsequently, Grok also went down. xAI marked Grok Web as "outage" from 21:30 Beijing time, and recovery has not yet been announced.Now OpenAI has also joined the list of failures. At 22:58 Beijing time, the OpenAI status page added an incident for "increased error rates for ChatGPT and Codex," stating that they are investigating the issue.

Binance customer service responded to user inquiries regarding losses from AKEUSDT contract trading, stating that during September 3, 05:44 (UTC+8), the AKE token experienced severe price fluctuations across the entire market. Multiple mainstream trading platforms and on-chain trends were basically consistent, indicating market volatility rather than abnormal pricing on a single platform.Binance explained that since Binance has not launched AKE spot trading, the AKEUSDT contract price is calculated based on the spot market prices across the entire network, rather than Binance's own spot market. The liquidation mechanism uses the mark price, which comprehensively references multiple market price data to reduce the impact of abnormal fluctuations. After verification, Binance's system is operating normally, and no anomalies were found in the pricing mechanism; this incident falls under the normal risk of leveraged positions in extreme market conditions.

A Binance user posted a complaint on the X platform, stating that more than thirty arbitrage positions in the AKEUSDT contract were all forcibly liquidated, resulting in a single-day loss of over 5 million USDT, with the principal nearly reduced to zero. The user accused the market makers of malicious short squeezing and targeted attacks, calling for the platform to intervene and investigate.According to the user, AKE rose from 0.0076 USDT to 0.044859 USDT within 8 hours, from September 2 at 21:00 to September 3 at 5:44, an increase of about 6 times, with the last 7 minutes seeing a direct doubling from 0.022432 to 0.044859. The user believes that such an extreme rate of market movement, without fundamental support and with a highly concentrated position, clearly constitutes manipulative behavior, and the platform should disclose risk control logs and compensate users for their losses. The user also compared this incident to the abnormal market conditions of the TUT contract on August 9, arguing that the structures of the two events are highly similar. As of the time of publication, Binance has not publicly responded to this incident. This complaint is a unilateral user statement, and the relevant facts await further verification by the platform.

According to a report by Malwarebytes, scammers are using the hype around "GTA 6" to set up phishing websites, claiming to sell leaked versions of the game for $50 or 1 SOL, luring visitors to connect their wallets and sign malicious transactions. The website contains approximately 2.4 MB of malicious scripts that can identify wallet assets on seven chains: Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base, and Fantom, and immediately transfer assets or gain permissions for subsequent transfers of tokens and NFTs based on the permissions signed by the victims.Before triggering, the script checks the visitor's IP to evade ten countries, including Armenia and Russia. Malwarebytes advises users to be cautious of any websites claiming to sell leaked versions of GTA 6, to carefully verify the authorization content before signing transactions, and to refuse operations that transfer the entire balance or request token access permissions.

On September 2, the domestic large model manufacturer Zhipu opened an official flagship store on Tmall, selling products such as the Coding Plan package.Currently available products include personal versions like Lite, Pro, Max, etc., which can be purchased via monthly/quarterly/annual subscriptions. In the future, buying Tokens will also be possible on the e-commerce platform.

According to Cointelegraph, cybersecurity company Morphisec has revealed that a counterfeit desktop application disguised as "Claude Opus 5 Free Desktop" from Anthropic is being used to spread the Windows malware RevStealer. This software can steal data from over 50 types of cryptocurrency wallets, while also collecting sensitive information such as browser passwords, cookies, VPN configurations, message logs, and screenshots.RevStealer has anti-detection mechanisms that perform environmental checks on the target device before execution; if it detects characteristics of a debugging or virtual environment, it will stop running. In addition, Russian cybersecurity company Kaspersky has also disclosed another new malware framework targeting cryptocurrency investors called OkoBot, which can harvest wallet files, inject malicious extensions, and capture wallet application windows to steal assets.

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.

Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after installing a transcription application using a download link provided in the Claude chat window. The link pointed to a counterfeit website and bundled malware that attempted to steal all information from his device upon execution. Numa Lunah mentioned that he cleared and reinstalled the affected laptop and found no sensitive information leaked.Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide written by him and contained instructions to re-download the malware and steal credentials every time it was loaded. Microsoft Defender Experts had warned that attackers had shifted from search engine optimization poisoning to large language model response poisoning, with related tactics including recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Crypto industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.

GoPlus Security issued a security alert stating that a fraud gang has hijacked the realtrumpcoins[.]com website and the @realtrumpcoins1 account, maliciously issuing GOLD tokens. The gang inflated its market value to approximately $60 million before selling off and executing a Rug Pull, profiting over $8.2 million.On-chain data shows that the developers' initial funds trace back to a KuCoin-associated hot wallet, with another 15 trading wallets funded by Binance-associated hot wallets. These wallets all conducted transactions through the same malicious routing contract.GoPlus Security also pointed out that the gang deployed another malicious meme coin, Trump Digital Platinum (PLATINUM), whose contract can empty any holder's balance at any time, warning users to avoid purchasing and to be aware of the risks.

The cryptocurrency payment platform Rain stated that its monitoring system detected a vulnerability affecting a small number of programs using outdated versions of Solana contracts, while other programs were not affected. Rain immediately launched an investigation to determine the scope of the incident.The Rain team has successfully upgraded all programs using outdated versions of Solana contracts, and the related issues have been resolved. Rain will continue to monitor the situation and has hired a third-party forensic expert to conduct an investigation, while also cooperating with law enforcement and relevant regulatory agencies. All affected users will receive full compensation, and Rain has begun the remediation process and is committed to completing the handling swiftly and responsibly.

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

According to the "Science and Technology Innovation Board Daily," Alibaba Qianwen is currently testing a multi-Agent collaboration feature on the Qianwen creation platform in a small scope, mainly aimed at professional creative scenarios such as AI short dramas, comic dramas, marketing advertisements, and image design. Currently, only a small number of professional creators have been granted testing qualifications.This feature enables multiple Agents to collaborate, linking together the stages of creative planning, script writing, visual design, storyboard generation, and final production. Different Agents can cooperate based on task division to complete the entire production process from concept to final product. Users can participate in discussions throughout the process, adjust the creative direction at any time, or delegate some tasks to AI for independent completion.Recently, Qianwen has launched Qianwen creation for the professional content production field, and it has already integrated Alibaba's latest models such as Wan 3.0, Wan 3.0 Prime full version, and Qwen-Image 3.0 Pro.

According to a report by Decrypt, security company Socket released research results linking 77 Firefox extensions to what it calls a "wallet theft factory," with 40 confirmed to have malicious behavior.These extensions disguise themselves as Web3 products like OKX, Rabby Wallet, and TronLink, tricking users into importing wallets through fake wallet interfaces or using modified real wallet code to steal mnemonic phrases and private keys as users input them. Mozilla's signature records show that this activity lasted from March 9 to August 3, and multiple extensions were still online at the time of Socket's report.About half of the extensions displayed realistic wallet interfaces and prompted users to import existing wallets, thereby intercepting the inputted mnemonic phrases or private keys; another 13 were modified versions of Rabby that sent account data stored in wallets to external servers while functioning normally; and 5 specifically collected saved credentials and clipboard content.Additionally, 37 extensions disguised themselves as password generators, dark mode toggles, VPNs, currency converters, and note-taking tools, but actually ran sports score applications sharing the same hardcoded credentials. Nine confirmed malicious extensions were initially released as score applications for sports like football and basketball, with subsequent updates replacing them with wallet theft code.Socket named this activity the "wallet theft factory," but cautioned that it has not confirmed whether all extensions are controlled by the same operator. The Socket team stated that any user who has entered mnemonic phrases or private keys into these extensions should consider it a "permanent leak" and immediately transfer funds to a new wallet, as uninstalling the extensions cannot undo the mnemonic phrases sent elsewhere.