BTC $82,237.10 +0.91%
ETH $2,437.57 +0.96%
BNB $728.63 -0.01%
XRP $1.33 +0.74%
SOL $105.28 +1.08%
TRX $0.3331 +0.36%
DOGE $0.0811 -0.51%
ADA $0.2303 +0.80%
BCH $278.61 +3.74%
LINK $12.46 +0.30%
HYPE $82.04 +1.58%
AAVE $157.60 +2.52%
SUI $1.04 +2.19%
XLM $0.1831 +0.40%
ZEC $1,232.69 +8.32%
AAPL $342.53 -0.50%
AMZN $254.35 +1.23%
GOOGL $349.47 +1.96%
MSFT $538.53 +1.52%
META $736.38 +0.87%
NVDA $217.97 -0.70%
TSLA $364.68 +0.03%
SNDK $1,378.48 +0.94%
INTC $94.86 -1.76%
SPCX $149.10 -1.48%
MU $923.33 +2.98%
AMD $554.58 -1.25%
BTC $82,237.10 +0.91%
ETH $2,437.57 +0.96%
BNB $728.63 -0.01%
XRP $1.33 +0.74%
SOL $105.28 +1.08%
TRX $0.3331 +0.36%
DOGE $0.0811 -0.51%
ADA $0.2303 +0.80%
BCH $278.61 +3.74%
LINK $12.46 +0.30%
HYPE $82.04 +1.58%
AAVE $157.60 +2.52%
SUI $1.04 +2.19%
XLM $0.1831 +0.40%
ZEC $1,232.69 +8.32%
AAPL $342.53 -0.50%
AMZN $254.35 +1.23%
GOOGL $349.47 +1.96%
MSFT $538.53 +1.52%
META $736.38 +0.87%
NVDA $217.97 -0.70%
TSLA $364.68 +0.03%
SNDK $1,378.48 +0.94%
INTC $94.86 -1.76%
SPCX $149.10 -1.48%
MU $923.33 +2.98%
AMD $554.58 -1.25%

pe

All
Article
Flash

Ledger: Criminal gangs spent millions of dollars to carry out hardware implant attacks, which are part of local distribution channel attacks

Ledger released a report on the investigation of hardware implant attacks, stating that a highly organized criminal gang purchased genuine Ledger devices over several months, disassembled them, and implanted custom hidden components to steal users' recovery phrases when initializing the devices. They then resold the devices through Southeast Asian distributor channels.The attackers invested millions of dollars to build infrastructure for collecting recovery phrases, asset transfers, and money laundering, coordinating actions to transfer victims' assets. Ledger emphasized that this incident was not caused by vulnerabilities in the chip, operating system, or servers, but rather a localized distribution channel attack that occurred after the devices left the company's control. Currently, Ledger has requested authorized distributors and resellers in Southeast Asia and Hong Kong to suspend sales and conduct random checks on inventory and retail channel devices, finding no other tampered devices.Additionally, Ledger has requested authorized distributors not to resell any returned devices, even if the packaging is intact; they have also immediately prohibited displaying products on shelves or in display areas, requiring devices to be stored at the back of the store and delivered upon purchase. The company is working with law enforcement and the security community to track the stolen funds and will disclose more technical details in the future.

first_img Anthropic opens employee access to METR, advancing independent security assessments

On October 15, Anthropic announced that it has begun providing employee-like access to a team from the nonprofit organization METR for the purpose of evaluating its models and safety practices. The company stated that last month it committed to strengthening independent third-party evaluations and signed the White House "Superintelligence Agreement," which includes a commitment to collaborate with independent external auditors or evaluators. Over the past year, Anthropic has worked with METR to review several risk reports, and METR will publish its risk assessment results.Anthropic has equipped six METR employees with company hardware, office space, and access to internal tools and systems roughly equivalent to those of its own risk assessment team. With a few explicitly defined categories such as client data, attorney-client privileged information, and model architecture information, employees are encouraged to share information as they would with colleagues working on alignment risk. METR may publish analyses of risk levels, events, or practices, which Anthropic cannot veto, but can request the removal of pre-defined narrow category information; METR may publicly state the circumstances of redaction and indicate whether it believes the redaction is reasonable without disclosing the content that was redacted. This arrangement is limited to small teams working under enforceable agreements, and other METR employees are isolated from working with this team.Anthropic is also collaborating with SecureBio and Accenture on assessments and is in early discussions with other organizations, including Hugging Face. SecureBio is reviewing the chemical and biological weapons section of the August 2026 risk report, having previously completed and published a pilot review of the previous risk report.

first_img Backbone Labs bOSMO contract vulnerability leads to support exhaustion, Osmosis announces compensation plan

The liquid staking token bOSMO issued by Backbone Labs nearly exhausted its contract support after a large redemption in the Osmosis community pool. A disclosure on the Osmosis forum on October 15 revealed that approximately 40,508 OSMO were designated for compensation to 1,037 accounts. The disclosure author Johnny Wyles stated that the staking contract has overpaid for each redemption since at least April 2026, settling at approximately 1.676 OSMO per bOSMO, while the declared exchange rate of the contract was about 1.117 OSMO.The vulnerability repeatedly counted the OSMO staked on Backbone's own validators, allowing redeemers to receive about 50% more assets, at the cost of diluting the support for remaining holders. The defect was exposed when preparing to liquidate the community pool position, and the passed governance proposal 1049 authorized the withdrawal of the Margined managed treasury position and the destruction of the reclaimed OSMO when it ceased managing liquidity operations. The pool's bOSMO treasury holds approximately 1.137 million bOSMO, accounting for about 97% of the total supply of the token; the redemption transaction executed on October 9 at 21:59 ET destroyed 776,000 bOSMO and began unbinding approximately 1.3 million OSMO.Compensation is based on the qualified balance at block 72,237,940, calculated at 1.1174 OSMO per bOSMO. bOSMO purchased after the snapshot is not included in the compensation, and underlying holders in the liquidity pool and other contracts are also included;
app_icon
ChainCatcher Building the Web3 world with innovations.