risk

The U.S. Securities and Exchange Commission (SEC) announced the inspection priorities for the fiscal year 2027, continuing to conduct risk-oriented inspections of over 34,000 registered entities, focusing on investment advisors, funds, brokers, clearing agencies, and other market participants.The SEC stated that the fiscal year 2027 will focus on the fiduciary duty and conflicts of interest of investment advisors, retail investor protection, private funds and private credit, brokers' anti-money laundering and transaction supervision, operational resilience, and cybersecurity, among other areas. Emerging technologies and market infrastructure are also listed as priorities.Among these, the SEC will pay attention to the impact of advanced technologies, including "superintelligence," on market operations, compliance, fraud prevention, and investor protection, while also assessing the risks brought by government bond clearing reform, tokenization, and related changes in market structure.

On October 23, Binance wallet web developer Jackson.ll (@0xOar) posted that there are more ways to use Agent ID, but users should carefully check the risk warnings. He stated that enabling developer mode for Agent means that unverified contract transactions can be signed, and the related potential risks need to be noted. It is recommended to close it as soon as possible after completing the operation or wait for verified developer products.Binance co-founder He Yi subsequently retweeted the post. Previously, several exclusive Binance Agent wallet projects had appeared on the market, and some projects required enabling developer mode.

The official listing account of the cryptocurrency exchange Kraken announced that the token SFI of the peer-to-peer risk-adjusted protocol Saffron will be launched soon, with trading starting on October 23. According to the introduction, Saffron's smart contracts will restructure the underlying decentralized finance yields based on the risk preferences indicated by users.

Analysts indicate that regulatory-led measures can encourage institutional participation in the cryptocurrency ecosystem in the short term, but only legislation can make the framework more robust in the long term. Currently, the cryptocurrency industry has to rely on a series of fragmented regulatory actions, which may be overturned in the next two years due to political changes. At the same time, the U.S. Securities and Exchange Commission (SEC) has issued a five-year "innovation exemption" for tokenized stocks, requiring that tokens must possess the financial and voting rights of the original stocks.Additionally, the U.S. Commodity Futures Trading Commission (CFTC) is exploring allowing leveraged cryptocurrency trading on regulated U.S. platforms, while the Office of the Comptroller of the Currency (OCC) has granted national trust charters to an increasing number of stablecoin issuers and digital asset companies, placing activities such as custody and reserve management under federal regulation. The Financial Accounting Standards Board (FASB) is also considering allowing companies to classify certain stablecoins as cash equivalents to support their broader use in payments and liquidity management.

The credit risk indicators of Meta Platforms have soared to an all-time high, and bond prices have fallen. The company plans to increase capital expenditures, raising market concerns about the rising debt for AI infrastructure.The five-year credit default swap prices rose by 8.9 basis points, reaching approximately 119.3 basis points per year. Meta stated it will invest about $825 billion in AI-related leases and contracts.

Zhao Changpeng stated that no cryptocurrency wallet can achieve absolute security, and there is no software without vulnerabilities or technology that is 100% secure.He pointed out that any action carries risks, and so does inaction; it is inevitable to encounter problems, setbacks, and challenges that need to be addressed during the process. Zhao Changpeng advised users to stay informed about the latest developments, manage risks effectively, and actively solve problems.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

The National Development and Reform Commission has released a new version of the "Regulations on Foreign Investment Management," which better ensures the development and security of foreign investment from an institutional perspective. The regulations consist of 76 articles, divided into six chapters: General Principles, Guidance and Services for Foreign Investment, Supervision of Foreign Investment, Protection of Foreign Investment, Legal Responsibilities, and Supplementary Provisions.The regulations will take effect on December 1, 2026, at which point the "Regulations on Overseas Investment Management" issued in 2017 will be simultaneously abolished. The state supports investors in conducting foreign investment activities based on market principles and actively participating in international cooperation and competition. Investors enjoy the autonomy of foreign investment according to the law, making independent decisions, bearing risks independently, and being responsible for their own profits and losses.

The yield spread between France's 10-year government bonds and Germany's government bonds has risen to a 15-year high, reaching 160.9 basis points. The yield on France's 10-year government bonds increased by 6 basis points to 5.0601%, the highest level since July 2002. Fiscal pressure and ongoing protests are undermining market confidence, and the yield spread between Eurozone government bonds and German government bonds has also widened.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

The Polkadot Community Foundation issued a security warning on the Polkadot forum stating that versions 3.1, 3.3, 3.4, and 3.5 of the browser extension for the third-party wallet Fearless Wallet contain malicious code, which may send users' private keys to a server controlled by attackers when unlocking the wallet.The related code was added on February 19, 2025, with a code change named "TON ecosystem," and it will take effect intermittently from February 2025 to October 10, 2026.

According to Cointelegraph, blockchain security company CertiK stated that although Google, Apple, and Microsoft have blocked 8 affected certificates issued by the Indian digital certificate authority eMudhra, cryptocurrency trading bots and exchange applications may still be exposed to related vulnerability risks, and browser fixes may not cover software that uses independent security systems.Peiyu Wang, Senior Director of Digital Asset Security at CertiK, pointed out that attackers could exploit the compromised certificates to impersonate exchanges, wallet interfaces, and APIs, replace deposit addresses, or induce users to approve malicious transactions. However, such attacks also require intercepting or redirecting network traffic, and the compromised certificate authority keys alone cannot expose wallet private keys. Cryptocurrency service operators should update software and certificate trust stores and ensure that applications reject affected certificates.

According to CoinDesk, data shows that the share of Bitcoin options in the cryptocurrency derivatives market continues to rise. The Bitcoin Volatility Index BVIV issuer Volmex stated that last week, the open interest of Bitcoin options accounted for slightly less than 60% of all Bitcoin derivatives open interest, up from about 50% at the beginning of the year, reflecting a market shift from purely betting on price direction to a greater focus on risk management.As of last Friday, the total open interest in the Bitcoin derivatives market was approximately $129 billion, of which U.S. Bitcoin ETF-related options accounted for about $36 billion, and BlackRock's IBIT options accounted for about $35 billion. Including options on native crypto platforms, the Bitcoin options market size is approximately $76 billion. ETF options currently account for about 47% of the Bitcoin options market, while the open interest of IBIT options has increased from about $11 billion in January 2025 to nearly $35 billion now.

According to official social media news, Huobi HTX will hold a live broadcast today at 20:00 titled "BTC 80,000 Defense Battle: Are Bulls Bottom Fishing or Bears Harvesting?" At that time, crypto KOLs such as Zhengrong Shuo, Damo Ge, Crypto.0824, and Ray Lazy Sheep will discuss the long and short game around BTC at the $80,000 mark, analyzing the support strength of key price levels, potential rebound signals, and downside risks in conjunction with the macro environment, capital flow, and market sentiment. They will also share insights on position management and risk response strategies from the perspective of ordinary investors amidst market fluctuations.

According to Cointelegraph, Yat Siu, co-founder of Animoca Brands, pointed out that the crypto industry is gradually evolving into a "digital Wall Street," deviating from its original mission of decentralized finance. He believes that to bring the next billion users on-chain, the industry needs a new solution, rather than just relying on tokenization or new wallets. Siu emphasized that only AI agents capable of independently holding user keys and interacting with the blockchain can truly achieve autonomous control of user assets.Siu questioned the current AI agent platforms on the market, particularly Meta's Muse. He noted that Meta's terms of service allow it to "remove user agents at any time and for any reason," which constitutes a significant trust flaw. He believes that personal agents relied upon by users should not be owned and controlled by centralized platforms. Animoca is building the MINDS agent, a multi-agent orchestration system designed to provide user autonomy and support various communication channels and AI model choices.Siu estimates that currently only about 10% of crypto asset holders are truly on-chain, and he believes that AI agents will be a key factor in changing this ratio. He further pointed out that since AI agents use code as their native language, their capabilities in handling complex security issues will surpass those of ordinary users, providing a new perspective for the secure development of the crypto field.

Cryptocurrency market maker Wintermute today updated its market report, stating that multiple events such as the Federal Reserve's interest rate decision, the U.S. midterm elections, and third-quarter earnings reports are approaching, and the current narrow trading range of Bitcoin may soon be broken. If Bitcoin breaks above $87,000, it may confirm an upward breakout; if it effectively falls below $82,500, the price could further dip to just above $70,000.On the macro front, the overall CPI in the U.S. rose from 3.4% in August to 3.7%, with core CPI increasing by 0.3% month-on-month, higher than the market expectation of 0.2%, intensifying concerns about energy prices transmitting to core inflation. Wintermute pointed out that the recent rise in U.S. Treasury yields reflects more of a withdrawal of funds from crowded AI growth stock trades rather than an improvement in inflation expectations. The market currently expects the Federal Reserve to maintain interest rates at its meeting on October 28, but if hawkish signals are released, it may strengthen expectations for a rate hike in December, pushing up U.S. Treasury yields and suppressing risk assets.Internally, the cryptocurrency market shows a trend of funds concentrating on mainstream coins. The report indicates that Bitcoin's weekly decline was 1.99%, the Nasdaq index fell by 5.52%, and altcoins overall dropped by 5.69%. Funds continue to flow into BTC and ETH while withdrawing from most altcoins, with high beta and small-cap tokens facing more significant pressure. Wintermute believes that the current risk-reward ratio for mainstream coins is relatively more attractive, and a broad rally in altcoins may need to wait for Bitcoin to strengthen further.Wintermute also noted that the current implied volatility is relatively low, and with the Federal Reserve's decision and midterm elections approaching, the market may be underestimating the risk of subsequent volatility. The Federal Reserve's decision on October 28 will be a key catalyst in the near term, and the performance of AI-related companies' earnings reports will also influence the market's judgment on computing power investments, financing costs, and business models.

Dmitry Gusakov, the engineering lead of the Ethereum liquid staking protocol Lido, warned at the developer conference ACDC #189 that the one-time builder access mechanism introduced by the Glamsterdam upgrade could interfere with the existing deposit protection logic of the staking protocol, leading to the hijacking of staking deposits. This issue involves multiple deposits sharing the same validator public key.According to Ethereum's current deposit rules, the first valid deposit determines the withdrawal credential, and staking protocols typically leverage this feature to prevent credential manipulation, such as initially depositing a small amount of ETH and then topping up the remaining funds once the expected credential appears. However, the special access mechanism introduced for builders by Glamsterdam may change the interpretation of subsequent pending deposits under the same public key during the fork transition period, putting the staking protocol at risk of a third outcome: the validator does not appear, and the deposited ETH is credited to the builder.Lido's proposed fix is to maintain the distinction between validator deposits and builder deposits during the one-time access process. However, core developers rejected this modification on the grounds of timing, mainly because the Sepolia testnet has already been activated according to existing specifications, and the Hoodi client version is also in preparation. Changing the behavior at this point could require redeploying Sepolia and conducting additional testing. The issue affects the access process during the fork transition period, rather than the ongoing deposit processing rules, but its consequences could impact deposits waiting in the queue.