slow

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

Tencent Group Senior Executive Vice President, CEO of Cloud and Smart Industries Group, Tang Daosheng, published an article in Tencent's internal publication, responding to external doubts about "Tencent being slow in AI." He stated that it is impossible to be completely untroubled; the Hunyuan large model has undergone multiple reconstructions, and Hunyuan Hy3 has shown outstanding performance among large models with equivalent parameters. However, due to the company's overall lack of computing power, the training of models and product development has been significantly slowed down, resulting in a considerable impact.Tang Daosheng mentioned that waking up early may not be the most critical factor; the second half of AI has just begun, and enduring longer provides the opportunity to seize the continuously emerging new opportunities.

The Slow Mist security team disclosed that the cross-chain bridge project Allbridge was attacked on August 19, 2026, resulting in a loss of approximately $190,000. Notably, this attack was not executed instantly; the attacker had begun laying the groundwork nearly a month prior and bypassed the verification mechanism by forging cross-chain messages. According to Slow Mist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as a CCTP style message, claiming that a transfer of 1 million USDC existed, but in reality, no USDC destruction operation took place. Subsequently, Circle generated a valid verification proof (attestation) for this complete message according to normal procedures.About 24 days later, on August 19, the attacker waited for the Base Router to receive a real CCTP deposit, increasing the balance to approximately 191,000 USDC, and initiated the attack just 6 seconds later. The attacker utilized the previously forged message and verification proof to call Allbridge's receiveCctpMessage function. Due to the project's lack of critical verification, the system mistakenly recognized the false cross-chain message as a real deposit and recorded a limit of 1 million USDC. The attacker then temporarily borrowed approximately 809,000 USDC through an Aave flash loan, matching the Router balance with the forged amount, and used the internal credit record to call the transfer function, ultimately transferring out approximately 999,000 USDC (after a 0.1% fee). After repaying the flash loan and fees, the attacker netted a profit of about $189,800. The root cause of this vulnerability lies in Allbridge's failure to verify the identities of the sender and receiver of the cross-chain message, as well as not confirming whether USDC was genuinely minted and whether the balance actually increased, instead directly trusting the amounts and message hash data constructed by the attacker. Slow Mist emphasizes that on-chain message verification does not equate to the actual arrival of real assets. Cross-chain protocols not only need to verify the authenticity of messages but must also ensure that the message source is trustworthy, that the receiver is Circle's official TokenMessengerV2, and that asset accounting can only proceed after confirming the actual minting of assets and changes in balance. This incident once again highlights the security risks of cross-chain bridges in the message verification and asset settlement processes.

Design software company Canva has lowered its annual revenue growth forecast by one-third to 20% due to AI feature delivery costs far exceeding expectations. CEO Melanie Perkins stated that user demand for AI features "significantly exceeded expectations," but the company has decided to postpone the large-scale launch of related products until it optimizes its architecture, reduces unit costs, and improves its business model. Since the release of Canva AI 2.0 in April, the cost per task has decreased by nearly 90%, but the volume of designs generated by AI users is three times that of previous versions, and economic pressures remain.This case reflects a common dilemma in the software industry: the cost of AI inference is breaking the traditional software "zero marginal cost" profit logic. Pitchbook analysts pointed out that Canva and Figma are the "most obvious signals" of this trend. Figma's free cash flow profit margin in the second quarter has dropped from 27% in the first quarter to 14%, and revenue growth in the third quarter is expected to slow from 48% to 36%. Canva previously sold employee shares at a valuation of $42 billion, and the market had anticipated its IPO in 2026, but analysts now believe the IPO may be delayed until next year.

According to Arkham Research, Bitmine, the world's largest Ethereum treasury company, currently holds approximately 5.81 million ETH, valued at nearly $11 billion. After 14 months of continuous accumulation, its holdings have reached 4.8% of the ETH supply, achieving about 96% of its publicly set acquisition target of 5%. Unlike Bitcoin treasury companies such as Strategy, Bitmine has used over 5 million ETH for staking to earn interest, with an annualized staking income estimated at approximately $257 million based on a yield of about 2.63%.According to Arkham's analysis, the most likely scenario for the trajectory after reaching the 5% target is that Bitmine will slow down its purchases. On-chain data shows that its acquisition pace has already slowed this year, and after surpassing 5%, it may shift towards balance sheet management and maximizing staking returns. The second most likely scenario is to continue buying at the same pace. Considering that Tom Lee, co-founder of Fundstrat, who leads this strategy, has consistently been bullish, it is possible that they will continue to increase their holdings after breaking through 5%. The least likely scenario is to completely stop buying. If this largest enterprise-level ETH buyer in the market exits the demand side, it may temporarily weaken bullish sentiment, but even without new additions, its staking holdings will still grow passively through network rewards.

The Slow Mist security team issued an alert that an unverified contract exposed an unrestricted low-level call vulnerability due to selector 0x42be3129, lacking access control and target data validation, resulting in approximately 16.6 WETH being stolen.The attacker exploited the existing ERC20 allowance of the contract to bypass the owner check and execute unauthorized transferFrom operations.

According to Gate market data, Reddit fell 10.2% in pre-market trading after the company reported a slowdown in user growth in the United States for the second quarter.

According to Jinshi, Germany's inflation rate is expected to be 2.8% in July 2026, with the core inflation rate, excluding food and energy, expected to be 2.4%. Energy prices are expected to rise by 8.3% year-on-year, a significant acceleration compared to last month.Analyst Giuseppe Dellamotta stated that the decline in core inflation is good news for the European Central Bank. If the Eurozone CPI shows a similar trend, the likelihood of an interest rate hike in September will decrease. The market will pay attention to the developments in the Middle East situation; if the situation eases, it will reduce the urgency for the European Central Bank to tighten monetary policy.

According to official news, OKX, in collaboration with Elliptic, SlowMist, and OttoSec, has released the "Web3 Security and Risk Control Report for the First Half of 2026." The report points out that the focus of Web3 attacks is gradually shifting from smart contract code to more complex scenarios such as signature processes, user devices, operational infrastructure, and AI Agents.Data shows that in the first half of 2026, the OKX risk control system intercepted over 5.7 million high-risk transactions, including approximately 2.41 million transactions related to hacking and theft, about 1.48 million transactions related to phishing, and around 990,000 transactions related to fraud. The OKX Web3 on-chain intelligence label library currently has over 1 billion labels, covering more than 420 chains, and has integrated capabilities such as address screening, transaction monitoring, and sanction address control into infrastructures like DEX and Exchange OS.In addition, in terms of user protection, OKX has intercepted over 7 million visits to risky websites, completed over 200,000 device risk assessments, identified over 60,000 high-risk apps, and intercepted or alerted on over 4 million high-risk signature operations. The report also introduces the "risk control pre-positioning" design in scenarios such as Exchange OS, Outcomes, RWA, and Agentic Wallet.

According to Jinshi reports, World Bank Chief Economist Gill stated that the global economy is only "a few months" away from the worst-case scenario, at which point global growth will slow to 1.3%, and inflation is expected to rise to 4.5%.

The founder of Slow Fog, Yu Xian, retweeted a tweet on the X platform regarding the potential poisoning attack risks of Claude Code and published an analysis of the poisoning attack details targeting Grok Build CLI and Claude Code CLI.It pointed out that the security mechanisms of Grok Build CLI are not unified, with different code paths having different trust assumptions, creating gaps that serve as channels for attackers. Attackers may execute arbitrary commands through malicious project configuration files without the user's knowledge, thereby stealing API keys, cloud credentials, or controlling local devices.Researchers constructed a testing environment and found that on Mac systems, if Claude Code is affected, executing specific test commands can trigger the local calculator to launch, proving the existence of potential command execution risks.If the attack is successful, attackers may further steal API keys from AI services like Claude and OpenAI, resulting in account cost losses, gain access to servers and data by obtaining cloud service credentials from AWS, Alibaba Cloud, Tencent Cloud, modify code repositories to implant backdoors, and use local devices as jump points to attack corporate internal networks. It is reported that the related vulnerabilities have existed for a year.

According to Jinshi, a key indicator of producer price inflation in the United States unexpectedly slowed in June, with the producer price index (PPI) excluding food and energy rising 4.7% year-on-year and 0.2% month-on-month. The overall PPI increased 5.5% year-on-year.The general business conditions index for manufacturing activity at the New York Federal Reserve Bank rebounded in July due to an increase in new orders and shipments, with the employment index reaching its highest level since December 2022.

According to Cointelegraph, Real Vision's chief cryptocurrency analyst Jamie Coutts stated that Bitcoin may be entering the later stages of a bear market, with the downward momentum beginning to slow.Coutts pointed out that compared to the previous market cycle, Bitcoin's volatility has decreased by about 50%, indicating that the current decline may not be as severe as past bear markets. However, Coutts also warned that markets rarely follow historical patterns so perfectly. "They basically move at their own pace. Currently, all trend indicators are clearly bearish." The good news is that some early technical signs suggest that selling pressure is easing. "I am starting to see momentum indicators showing bullish divergence on longer time frames. This indicates acceleration, or more precisely, that negative momentum is slowing down, but that does not mean that we have technically exited the bear market."

Vitalik posted on the X platform, stating that AI 2040 and its critics have incompatible worldviews regarding the speed and significance of AI progress. AI 2040 believes that unless strong measures are taken to completely prevent it, some form of superintelligence will emerge in various scenarios by 2040; critics argue that AI 2040 underestimates human coordination capabilities and threatens freedom, but do not view ASI itself as a risk of power concentration.He believes that if he were convinced that the current form of AI is just an ordinary technology, he would be closer to the critics' camp; if he were convinced that superintelligence would inevitably arrive by 2030, he would be closer to the AI 2040 camp. At the same time, due to significant uncertainty, he remains open to the idea of slowing down or pausing, and feels uncomfortable with the stance proposed by some large AI companies and intellectuals that "open source is detrimental, and the ideal outcome is to maintain global control dominance."Vitalik stated that an important reason he supports the d/acc platform is that directions such as formal verification, cryptography, secure and open hardware, pandemic resilience, defensive biotechnology, food and basic resource security, public cognitive systems, and non-concentrated power physical security are worth promoting under both worldviews. He also mentioned that the 2040 plan has increasingly supported open source and incorporated the idea of "mutual assured destruction of computational power," which is an improvement compared to allowing a few participants to selectively deprive their identified subjects of rights.There is no way to avoid trade-offs regarding whether to slow down or pause, and Vitalik believes that trigger conditions can be preset, allowing for a more open attitude towards slowing down or pausing when sufficient conditions are met within a specific timeframe.He also stated that if he were Elon Musk or Zuck, he would significantly transform Twitter into a platform that helps identify and facilitate such large win-win agreements, encouraging more people to participate in discussions, but he thinks this might also be naive. Currently, he does not see any non-naive ASI transition response plans, so he tends to show some tolerance towards those who are trying.

According to Jinshi, the disappointing U.S. employment data has led to a slowdown in market expectations for the Federal Reserve's interest rate hikes. Citibank stated that the expectations for a recovery in Middle Eastern supply have been "exaggerated," while aluminum futures on the London Metal Exchange (LME) have risen. It remains to be seen how long the "breathing window" for industrial metals can last.

The Chief Information Security Officer of Slow Fog, 23pds, posted on the X platform that curl recently fixed 18 security vulnerabilities, involving issues such as authentication bypass, memory safety, and host verification, among which one libcurl vulnerability has existed for about 25 years. The risks are not limited to the curl command line but also widely affect applications, SDKs, containers, firmware, gateways, and CI/CD environments that rely on libcurl. It is recommended to upgrade curl/libcurl as soon as possible and check for the use of old versions of libcurl, especially paying attention to mTLS, proxy authentication, and connection reuse scenarios.

According to the "2026 Anti-Fraud Report" jointly released by Bitget and SlowMist, as digital finance continues to expand into stocks, tokenized assets, and AI tools, cross-asset trading is gradually becoming an important trend for users participating in the market. The proportion of users engaging in cross-asset allocation has increased from less than 1% in mid-2025 to over 10% in May 2026.The report points out that fraudulent methods are evolving from single attacks to complex attack chains, integrating AI-generated content, deepfakes, voice cloning, and multi-channel social engineering. From July 2025 to June 2026, Bitget's security system intercepted over 150 million malicious requests, identified more than 13,000 high-risk malicious IPs, and assisted users in recovering approximately $32.3 million related to security incidents and fraudulent activities.Bitget CEO Gracy Chen stated that this year marks the third Anti-Fraud Month event, and Bitget will continue to launch security education content, risk identification guides, and industry collaboration activities to help users enhance their ability to identify and protect against AI fraud, phishing attacks, and multi-asset scenario scams.

According to Jinshi, Kit Juckes from Société Générale stated in a report that the decline of the euro against the dollar may at least slow down. Recent rising expectations for a Federal Reserve interest rate hike and reduced bets on the European Central Bank's tightening policy have caused the euro to drop to a one-year low of 1.1324 against the dollar. Juckes pointed out that the euro has fallen below the range of 1.14 to 1.2 where it has been for most of the past year, which may limit its further downside potential.