mal

According to GoPlus warning, a user lost approximately $316,000 worth of USDC to a phishing attack due to signing a malicious Permit2 transaction.

edgeX released an update regarding the abnormal price fluctuations of the EDGE token, stating that the protocol has not been compromised in any way, and this incident is not a hacker attack, exploit, or security vulnerability.Current confirmed information indicates that this is an attempt by certain external parties to deliberately manipulate the market price of EDGE, which is a matter of market integrity rather than platform security. The team is actively investigating and collaborating with relevant exchanges and platforms, and a comprehensive update will be released after the investigation is complete.

Privacy Agreement Zama founder Rand posted on platform X that the freezing measures against the cUSDC contract under Zama have been lifted, and all systems have returned to normal operation.According to his introduction, a U.S. court previously ordered Circle to temporarily freeze a contract worth $12.5 million in USDC held by Zama without prior notice. The court has now determined that the freezing measure was unreasonable and has lifted the temporary restraining order (TRO), and the related cUSDC contracts and assets have been fully restored. Rand stated that this incident did not affect the team's trust in USDC, and Zama still plans to launch the cUSDC product later this month.

edgeX announced, "We have observed sudden and unusual price fluctuations of the EDGE token and are currently actively investigating the reasons. The team is urgently understanding the specific situation and will publish updates as soon as relevant information is confirmed. The official reminder to users is to rely only on information released through edgeX's official channels and to treat unverified market speculation with caution."Previously, the edgeX platform token EDGE experienced a "flash crash," dropping over 77% to $0.315, and the 24-hour decline has now narrowed to 41.13%.

According to Viet Nam News, the Ministry of Finance of Vietnam proposed in the revised draft of the "Support Law for Small and Medium Enterprises" to allow small and medium enterprises to use digital assets, virtual assets, intellectual property, intangible assets, and future formed assets as collateral for bank loans, in order to improve the financing availability for private enterprises and technology startups.The draft also encourages credit institutions to issue loans more based on credit ratings, business plans, market expansion potential, and corporate cash flow, reducing reliance on traditional collateral such as real estate. The Ministry of Finance of Vietnam stated that this policy aims to unleash private economic resources and is consistent with Resolution No. 68 - NQ / TW.

Sui stated on platform X that the mainnet has been restored and transactions are proceeding normally. During the deployment of the long-term repair plan yesterday, the end of the epoch was triggered, causing a pause. When the validating nodes restarted to deploy the new binary files, the random number initializer that runs at the beginning of each epoch could not complete because its quorum threshold was higher than the Sui consensus mechanism. After the validating nodes restarted, there was a potential vulnerability in the fault state preservation mechanism, which prevented the network from completing the transition to the next epoch. Currently, the validating nodes have implemented a fix that addresses the underlying vulnerability and the affected epoch, and network activity has resumed.

The Polymarket development team stated, "The current trading functionality is experiencing issues. The team has confirmed the cause of the problem and is deploying a fix. Real-time status updates can be viewed on the official status page."

According to 10x Research analysis, the Ethereum options market has seen an unusually large volume of put option buying, with contract flows at strike prices of $1800 and $1900 being about five times the normal levels.The institution believes that while Ethereum is cheap today, cheap does not equate to a buying opportunity. Fundamentals ultimately determine price, and marketing narratives can only sustain deviations for a limited time; eventually, reality will re-establish dominance.

According to Slow Fog's disclosure, the security agency MistEye detected a cross-registry supply chain attack incident, where attackers targeted developers in the fields of cryptocurrency, DeFi, Solana, Sui/Move, and AI by publishing malicious packages on npm, PyPI, and crates.io. This attack activity includes more than 34 malicious packages and over 384 related versions. The attackers may steal cryptocurrency wallets, SSH keys, cloud credentials, GitHub/AWS tokens, browser data, environment variables, and developers' confidential information.Some of the malicious payloads also attempted to achieve persistence through .cursorrules, CLAUDE.md, Git hooks, shell hooks, cron, systemd, and SSH. Developers are advised to immediately remove the affected packages, isolate the affected systems, retain logs, rotate exposed credentials, rebuild CI environments and developer machines from clean images, and review GitHub, cloud services, SSH, and wallet activity logs.

Security company Socket Security disclosed that a cryptocurrency theft operation named TrapDoor is launching active supply chain attacks in package repositories such as npm, PyPI, and Crates.io. A total of 34 malicious packages and 384 versions and components have been identified, with attackers continuously pushing new versions across various ecosystems.TrapDoor primarily targets developers in the cryptocurrency, DeFi, AI, and security fields, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, environment variables, and API keys. Socket detected that the median detection time for malicious versions was 5 minutes and 27 seconds, with the fastest detection occurring 58 seconds after release.

Pyth Network's free product Pyth Core experienced downtime this morning (UTC time) and has resumed normal operation at 13:00 UTC (21:00 Beijing time). The paid product Pyth Pro was not affected, and platforms using Pyth Pro, such as Kalshi, Coinbase, and LMAX, continued to operate without interruption. Pyth Network stated that Pyth Core is an old version of the oracle layer planned to be deprecated by a DAO resolution on July 31, and teams that have not yet migrated should switch to Pyth Pro as the new infrastructure for ongoing support.

According to Blue Whale News, the China Securities Regulatory Commission previously announced that it has initiated an investigation and issued a prior notice of administrative penalties against Tiger Brokers (NZ) Limited, Futu Securities International (Hong Kong) Limited, and Changqiao Securities (Hong Kong) Limited for illegal securities business operations within the country and related entities.Tiger responded by stating: "The company has noted the relevant notification and will strictly comply with regulatory requirements to actively cooperate with related work. Currently, all of the company's business operations are normal. Tiger always prioritizes compliance and maintains close communication with regulatory agencies."

According to CoinDesk, bipartisan lawmakers Steven Horsford, Max Miller, Suzan DelBene, and Mike Carey jointly reintroduced the "Digital Asset Protection, Accountability, Regulatory, Innovation, Taxation, and Revenue Act" (also known as the "Equality Act") this Wednesday. The new version of the bill mainly covers the following points: first, it stipulates that regulated payment stablecoins do not generate gains or losses if the cost basis is not less than 99% of the redemption value; second, it establishes a safe harbor for broker-dealer transactions or taxpayer account transactions; third, it clarifies that "wash sale" rules apply to digital assets; fourth, it requires the IRS to assess the current tax burden of small cryptocurrency transactions and to study the feasibility of establishing a tax exemption for transactions under $200 and the potential risks of abuse.The cryptocurrency industry has long advocated for tax exemptions on small transactions to promote the use of cryptocurrencies in everyday payment scenarios. Lawmaker Horsford stated that tax policy is the foundation of the cryptocurrency regulatory framework, and that current tax laws have not clearly addressed many core issues related to digital assets.

Keone Hon, co-founder of Monad, posted on the X platform that the Monad network is unaffected and operating normally, while security researchers are investigating the eBTC-related incident of the Echo Protocol. Researchers have determined that the vulnerability led to approximately $816,000 being stolen. Previously, it was reported that the Echo Protocol was attacked on the Monad chain, where hackers minted 1,000 eBTC and withdrew funds via Curvance.

According to Cointelegraph, Casa co-founder Jameson Lopp warned that a new phishing technique has emerged, where attackers abuse legitimate Google recovery forms to hide malicious links within lengthy messages filled with a lot of blank space.

Vitalik Buterin published an article discussing the application prospects of Formal Verification in the field of blockchain security.The article points out that a new paradigm is emerging in Ethereum's cutting-edge research and development, where code is directly written using EVM bytecode, assembly, or Lean, and its correctness is verified using automatically checkable mathematical proofs in Lean. Researcher Yoichi Hirai refers to this paradigm as "the ultimate form of software development."Vitalik believes that AI-assisted formal verification is expected to enhance both code efficiency and security, particularly suitable for security core modules such as STARK, ZK-EVM, quantum-resistant signatures, and consensus algorithms.The article also emphasizes that formal verification is not a panacea and may still fail due to issues such as incomplete proof coverage, specification errors, and hardware side channels; in the future, software may differentiate into "security cores" and "non-security edges," with Ethereum becoming one of the important security cores.

The Chief Information Security Officer of Slow Fog, 23pds, disclosed on platform X that node-ipc has been compromised again. The released three malicious versions of node-ipc (9.1.6, 9.2.3, 12.1) carry the same credential-stealing payload, with the package being downloaded over 10 million times per week.

Aptos posted on platform X stating that Aptos is the first L1 to support dynamically scheduled formal verification, which can be mathematically proven to operate as designed. Aptos claims that AI writes specifications, mathematically proves their correctness, and Move Prover serves as the oracle, which is the trust layer between the market and machines.