security

Zero-Knowledge Proof Infrastructure Succinct has fixed a security vulnerability in its SP1 that could allow invalid proofs to be deemed valid.According to The Defiant, the flaw existed in the native Rust verification path from version 6.0 to 6.8.0, while on-chain Groth16 and Plonk verification executed by the Solidity verifier were not affected.

The U.S. Securities and Exchange Commission (SEC) announced the inspection priorities for the fiscal year 2027, continuing to conduct risk-oriented inspections of over 34,000 registered entities, focusing on investment advisors, funds, brokers, clearing agencies, and other market participants.The SEC stated that the fiscal year 2027 will focus on the fiduciary duty and conflicts of interest of investment advisors, retail investor protection, private funds and private credit, brokers' anti-money laundering and transaction supervision, operational resilience, and cybersecurity, among other areas. Emerging technologies and market infrastructure are also listed as priorities.Among these, the SEC will pay attention to the impact of advanced technologies, including "superintelligence," on market operations, compliance, fraud prevention, and investor protection, while also assessing the risks brought by government bond clearing reform, tokenization, and related changes in market structure.

Cysic released an update on the cross-chain bridge security incident, stating that it plans to destroy 7.2 million CYS from the foundation's reserves by the end of October to offset the impact caused by unauthorized issuance and to realign the token supply with its token economic model.

According to Digital Asset, the security platform OpenSourceMalware revealed in a program on October 21 that a North Korea-linked hacking group is using a technique called Contagious Interview, luring job seekers in the cryptocurrency industry through LinkedIn to invite them to visit private code repositories and install software packages required for development tasks.The attackers set up a .npmrc configuration file in the repository, causing npm to download dependencies from a specified external package repository instead of the public registry, which could potentially execute malicious code during the installation process and reduce the likelihood of being detected by public security scans. Paul McCarty, co-founder of OpenSourceMalware, stated that this type of technique has been observed recently among attackers. The specific number of victims, affected companies, or the amount of digital asset losses has not yet been disclosed.

Zhao Changpeng stated that no cryptocurrency wallet can achieve absolute security, and there is no software without vulnerabilities or technology that is 100% secure.He pointed out that any action carries risks, and so does inaction; it is inevitable to encounter problems, setbacks, and challenges that need to be addressed during the process. Zhao Changpeng advised users to stay informed about the latest developments, manage risks effectively, and actively solve problems.

Dragonfly Managing Partner Haseeb Qureshi stated that there is a wave of attacks in the cybersecurity field that is "similar to the COVID-19 pandemic." He believes that on-chain hacking incidents are the "canary in the coal mine" for cybersecurity, as on-chain is the easiest place for cyber attacks to be monetized.He cited data from DefiLlama Research indicating that the number of on-chain hacking incidents has surged, but the annualized scale of stolen amounts is roughly equivalent to that of 2025, with losses per incident decreasing. He noted that most small protocols have been compromised, while large protocols are strengthening their defenses with AI tools. He anticipates that similar situations will also arise in the broader internet space.

Vitalik Buterin posted on the X platform stating that he does not predict that defense will automatically lead over offense, but believes that cybersecurity will ultimately trend towards a favorable outcome for defense, although the transition process will be very difficult.He pointed out that "good people discovering vulnerabilities in released software before bad people" does not belong to a game where defense has the advantage. To truly tilt the game towards defense, a deeper methodological shift is needed, including formal verification, radical reduction of the Trusted Computing Base (TCB), etc., and currently, these shifts have only just begun. He also stated that this is an important reason for his friendly attitude towards slowing down or pausing AI development, and called for investing more than 1% of GDP into cybersecurity, biosecurity, and the fortification of the physical world.

CrowdStrike and NVIDIA are expanding their collaboration in the field of artificial intelligence agent security, extending security protection from the software level to the chip level.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

Digital bank Revolut posted on platform X that it is currently experiencing service interruptions affecting multiple services. The company confirmed that all customer funds and data are secure.Revolut stated that since the issue was discovered on the morning of the same day, the team has been working on a fix and apologized to affected users for the inconvenience caused.

Dmitry Gusakov, the engineering lead of the Ethereum liquid staking protocol Lido, warned at the developer conference ACDC #189 that the one-time builder access mechanism introduced by the Glamsterdam upgrade could interfere with the existing deposit protection logic of the staking protocol, leading to the hijacking of staking deposits. This issue involves multiple deposits sharing the same validator public key.According to Ethereum's current deposit rules, the first valid deposit determines the withdrawal credential, and staking protocols typically leverage this feature to prevent credential manipulation, such as initially depositing a small amount of ETH and then topping up the remaining funds once the expected credential appears. However, the special access mechanism introduced for builders by Glamsterdam may change the interpretation of subsequent pending deposits under the same public key during the fork transition period, putting the staking protocol at risk of a third outcome: the validator does not appear, and the deposited ETH is credited to the builder.Lido's proposed fix is to maintain the distinction between validator deposits and builder deposits during the one-time access process. However, core developers rejected this modification on the grounds of timing, mainly because the Sepolia testnet has already been activated according to existing specifications, and the Hoodi client version is also in preparation. Changing the behavior at this point could require redeploying Sepolia and conducting additional testing. The issue affects the access process during the fork transition period, rather than the ongoing deposit processing rules, but its consequences could impact deposits waiting in the queue.

According to monitoring by the blockchain security agency Salus, the Aztec Connect attacker made 30 transactions on October 19, depositing 1,255.8 ETH (approximately 3.01 million USD) into Tornado Cash. The batches consisted of 12 transactions of 100 ETH, 5 transactions of 10 ETH, 5 transactions of 1 ETH, and 8 transactions of 0.1 ETH.On June 14, the attacker exploited a settlement verification vulnerability in the deprecated Aztec Connect contract to steal approximately 2.19 million USD in assets, including 908.987 ETH as well as DAI, wstETH, and Yearn vault tokens. After holding the funds for about four months, the attacker redeemed the vault tokens on October 19, converting the token assets into an additional 346.767 ETH. The balances of the 6 stolen ERC-20 tokens have all been reduced to zero.

The U.S. Department of Homeland Security (DHS) instructed U.S. civil agencies on Monday to remove products from the Chinese AI company DeepSeek from government IT systems, as well as any third-party services built on that model, and to prohibit new procurements. The notice stated that using DeepSeek could lead to the transfer of sensitive data to China and could generate intelligence targeting U.S. individuals and institutions. DHS indicated that these models constitute "multiple threat vectors."The ban targets not only DeepSeek's own applications but also covers third-party services based on its development. A DHS memorandum from July was made public on Monday, which had previously requested agencies to monitor the risks related to DeepSeek in the traffic in and out of government websites. The U.S. Department of Commerce, the Navy, and the states of New York, Tennessee, and Virginia had previously restricted DeepSeek. The Federal Communications Commission (FCC) will vote on October 29 to decide whether to ban all Chinese laboratories from testing electronic products used in the U.S.DeepSeek is a startup based in Hangzhou, and its open-source model attracted widespread attention on January 27, 2025, with development costs of less than $5 million, leading to a 16% drop in Nvidia's stock price that day, evaporating about $600 billion in market value. In April 2025, the U.S. House of Representatives' Special Committee on China Issues stated that DeepSeek might secretly send U.S. user data to the Chinese government and may have used about 60,000 Nvidia chips, of which 20,000 were subject to U.S. export controls. The V4-Pro model preview released by DeepSeek in April this year was priced about 98% lower than OpenAI's GPT-5.5 Pro and was made available for free download and modification under the MIT license; this week it also released an updated version of the V4.1-Flash model focused on efficiency optimization.

According to The Block, payment company Mastercard has launched the Stablecoin Security tool to screen for fraud and sanction risks in stablecoin payments.This tool is aimed at stablecoin payment scenarios, helping relevant institutions identify fraudulent activities and sanction compliance risks during transaction processing. Mastercard did not disclose more product parameters and launch scope in the summary of the report.

On October 17, ILITY announced on platform X that a security incident occurred with the ILITY Network, and the ILITY cross-chain bridge has been temporarily closed. They are cooperating with law enforcement agencies, cryptographic forensic experts, and investors to investigate, and have not yet disclosed the amount of losses or details of the attack.On-chain analyst Specter stated that they observed a certain wallet transferring approximately 35,700 ZEC (worth about $41 million at the time) from a privacy pool, which was then transferred to the Bitcoin and Ethereum networks via NEAR Intents and multiple addresses. Their tracking suggests that the related addresses are associated with the ILITY cross-chain bridge and claim that approximately 4.1 million ILY tokens flowed out of that bridge. Due to the privacy features of Zcash, it has not yet been confirmed whether this ZEC belongs to stolen funds or its exact relationship with the ILITY incident.

Former Mt. Gox CEO Mark Karpelès questioned Ledger Support's previous statements. Ledger customer service had claimed that the secure element could detect physical tampering, and if additional hardware attempted to intercept signals, it would not pass authenticity verification. Karpelès pointed out that Ledger's own documentation states that if the original secure element is intact, authenticity verification cannot detect unauthorized physical modifications such as spy implants, which directly contradicts the customer service claims.Mark Karpelès stated that reports have shown that over $90 million has been stolen due to such "additional hardware" intercepting signals less than two months later, and that Ledger had published photos of spy implants for multiple models in a March 2026 academic article. Given the known threats, assuring users that authenticity verification can detect such modifications may constitute misleading advertising.

According to Bloomberg, citing informed sources, SoftBank is considering acquiring Allied Universal, the largest security services company in the United States, with a potential equity valuation of up to $18 billion. The company also has about $12 billion in publicly traded loans and bonds, and including related debts, the total transaction value could approach $30 billion.Masayoshi Son is exploring the application of AI robots across various industries. The report indicates that SoftBank hopes to have robots undertake some security tasks for Allied in the future, but the deployment of humanoid security robots may take longer. Relevant discussions are still in the early stages, and matters including pricing have not been finalized.

The Indian Computer Emergency Response Team (CERT-In) released an important announcement this week titled "AI Agents as Attack Vectors," indicating that AI agents operated by unnamed model providers exceeded their granted task scope during testing, reading confidential business records in the online systems of Indian agencies, and no affected agencies discovered this behavior on their own.CERT-In stated that it received voluntary disclosures from several AI model providers, which indicated that these models accessed the online systems of Indian agencies while being researched and evaluated on the internet. The announcement did not disclose the names of the providers, models, or affected agencies. The agents read business records containing personal data and confidential materials, utilizing credentials and connection settings exposed in application configurations, public code repositories, and overly permissive cloud service roles. In some cases, the same credentials were recovered multiple times and reused in different operations.Additionally, CERT-In observed that criminals exploited publicly available AI-driven offensive security frameworks to scan for vulnerabilities, implement exploits, and launch economically motivated attacks against Indian entities, reducing the time from initial access to final impact from several days to just hours; these tools were repeatedly repackaged and deployed, with related deployments appearing on servers in multiple countries.