slow

The Bank for International Settlements (BIS) published a working paper titled "Are Stablecoins and Bank Deposits Substitutes?" The study is based on weekly data from the United States from January 2019 to June 2025. After controlling for factors such as Bitcoin prices, government bond yields, and financial market conditions, it was found that the rise in bank deposit rates is associated with a slowdown in the growth rate of stablecoin market capitalization.According to the benchmark model estimates, a 1 basis point (0.01 percentage point) increase in the average deposit rate corresponds to a reduction of about 3 percentage points in the cumulative growth rate of stablecoin market capitalization over the following ten weeks, from an average level of approximately 15% to around 12%, rather than a decline in market capitalization. The response of USDC is stronger than that of USDT.The authors note that the study cannot conclude that the total amount of bank deposits or lending decreases, and the sample only covers one cycle of high interest rates. The views in the paper belong to the authors and do not necessarily represent the position of the BIS or its member central banks.

Slow Mist stated that a fraudulent "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to carry out attacks. The phishing page is highly realistic, including a fake "Genuine check" page, device selection interface, and "Update Now" button. Slow Mist reminds users not to update Ledger devices through website links and not to enter recovery phrases anywhere.

According to the Financial Times, Mark Zuckerberg stated that Meta Platforms (META.O) has reached the "cutting edge" of artificial intelligence and rejected calls to slow down development.

The Chief Information Security Officer of Slow Mist Security, 23pds, stated that if the modification of the Ledger device's PCB is indeed as described by former Mt. Gox CEO Mark Karpelès, the attacker would possess a considerable level of technical skill.23pds mentioned that the possible attack process involves the wallet generating a mnemonic phrase within a secure element and displaying it on the screen for the user to write down. A malicious module could obtain the displayed content through screen data lines such as SPI, record the complete mnemonic phrase, and then send the data to the attacker via LTE/eSIM. The secure element can prevent the private key from being directly read or exported, but it cannot stop external modules from accessing the information currently displayed on the screen. He noted that the above analysis is based on the premise that the PCB has indeed been modified in the described manner, and the relevant attack paths and hardware implantation still require independent verification.Mark Karpelès previously stated that a Ledger hardware wallet he received was suspected of being implanted with a spy module. The device came from Malaysia, the outer packaging was intact with shrink wrap, and the implant was hidden in the position where the screen originally had a cushion, containing LTE communication components, an antenna, eSIM, and a microcontroller connected to the Ledger SPI bus, capable of analyzing the characters displayed to the user and sending relevant data after the mnemonic phrase setup is completed.

The Chief Information Security Officer of Slow Fog, 23pds, tweeted that public WiFi itself does not steal coins. The losses are caused by phishing pages opened by fake WiFi and the actions of users themselves signing transactions or importing private keys. What websites are accessed and what operations are performed after connecting are the core factors that determine whether asset losses occur.Previously, X user Xiaoyu_184CM tweeted that after connecting to free WiFi at Singapore Airport, a wallet that had not been used for a month had 3.7 BNB transferred away. Binance founder CZ responded that he has always advised against connecting to public WiFi, but merely connecting to WiFi does not lead to wallet theft, and asked if there were any other operations in between. Crypto KOL AB KuaiDong speculated that someone might have specifically set up free WiFi or modified the router, and Xiaoyu indicated that he felt this was likely the case.

According to Slow Mist's Yu Xian monitoring, phishing attacks targeting FOMO's web bookmarks are emerging.Such phishing webpages lure users into completing fake human verification, dragging malicious JavaScript code into the browser's favorites and saving it as a bookmark. After the user clicks on this bookmark 2 to 3 times, the previously logged-in FOMO account will be hijacked by the attacker, and the encrypted assets within the account will be immediately stolen.

Slow Fog issued a security alert stating that the Aave V3 Loop Safe Module has a security vulnerability, allowing attackers to forge Safe authentication and execute arbitrary modules, stealing approximately 114.09 ETH from two Safe multi-signature wallets.Attackers bypassed authentication by forging a Safe that always returns true and executed module transactions using a router and calldata that could be arbitrarily controlled, transferring weETH and Aave collateral. After repaying approximately 1300 WETH in debt, the attackers unlocked the collateral.

Citrini analyst Jukan cited Anthropic-related data from TickerTrends and expressed doubts. The data shows that as of September 24, 2026, Anthropic's annual recurring revenue (ARR) is approximately $76.8 billion, with a quarter-over-quarter increase of only 1.8%; OpenAI's annual recurring revenue is approximately $50.44 billion, with a quarter-over-quarter increase of 13.4%.Jukan believes that even based on this set of data, Anthropic's growth rate has clearly declined, OpenAI's growth is also slowing down, and he questions the reliability of TickerTrends data.

Slow Fog's Yuxian posted on platform X, stating that systems prior to iOS version 27 are being exploited by certain black and gray market groups to steal encrypted wallets from iPhone users.It reminds users to promptly update their iPhone, iPad, Mac, and other devices to the latest version, to be cautious when installing apps from unknown sources, and to be careful when opening unknown links through Safari and in-app browsers.

Slow Fog's Yuxian stated on platform X that the Bitget theft incident has a wide spread, involves a huge amount of money, and the related funds were quickly linked to North Korean hackers. Institutions such as Circle and Tether have promptly assisted in freezing the related funds, with Circle freezing the USDC held by the hackers.Regarding THORChain, Yuxian pointed out that when THORChain previously experienced a theft incident, it also quickly intervened in its so-called "decentralized" platform; however, in response to this major security incident in the industry, it claimed "decentralization and non-interference" and compared itself to Bitcoin and Ethereum, while continuing to earn fees from the hackers' large cross-chain transactions.He stated that decentralization should not just be a slogan; after a major security incident occurs, the key is to distinguish which issues need to be collectively addressed by the industry. He also believes that platforms like THORChain should not be easily compared to Bitcoin and Ethereum, as there are significant differences in the degree of decentralization and mechanisms of different systems.

Cryptocurrency KOL and former FTX community partner Benson Sun stated that he expects the current Bitcoin market to show a gradual new high slow bull trend, rather than forming a clear top after a rapid short-term rise like in 2013 and 2017. Before the true cycle top arrives, the market may experience multiple local top signals. He believes that after 2021, the main buyers of BTC have gradually shifted from retail investors to institutions such as publicly listed companies, spot ETFs, and corporate treasuries.Since institutions mainly buy spot, some funds will also use Delta Neutral strategies for arbitrage, and traditional indicators such as funding rates and MVRV Z-Score may not rise to extreme levels again at the cycle top. Recently, the cycle top is more likely to manifest as institutional funds losing momentum rather than retail sentiment becoming overly heated. The Institutional Liquidity Index (ILI) mainly references overall dollar liquidity, the mNAV of Strategy, and the net flow of Bitcoin ETFs to determine whether institutional funds follow up when BTC reaches new highs. When BTC sets a new rolling 30-day high while ILI does not rise simultaneously, it constitutes a yellow divergence; when BTC breaks historical highs while ILI diverges and is below 50, it constitutes a red divergence.Benson Sun indicated that he would use the frequency of yellow divergences as a reference for judging the cycle process: each occurrence would lead to a proper reduction in altcoin positions and leverage; as the market enters the later stages, he would gradually increase the proportion of BTC and ultimately retain only spot. If a red divergence occurs, he would stop participating further.

According to Cointelegraph, blockchain security company SlowMist stated that its investigation has not linked the recent security warning caused by the iPhone Safari attack to confirmed cryptocurrency theft incidents.SlowMist told Cointelegraph that it has not independently confirmed any victims affected by the specific Safari attack samples it analyzed, and the strongest technical evidence it possesses covers iOS versions 18.4 to 18.6.2. The company stated that the reported impact range of "iOS 13 to 26.5" should be regarded as a preliminary assessment, and it tends to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is obtained.SlowMist pointed out that the Safari attack reused the previously disclosed DarkSword exploit chain technology, which is independent of another investigation involving malicious components embedded in App Store applications called FomoPeek. The Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since November 2025.

Bitget CEO Gracy Chen stated that Bitget is conducting a comprehensive investigation into the recent platform security incident in collaboration with independent third-party expert Mandiant and Slow Mist. The platform will continue to release the latest updates through official channels.He emphasized that ensuring user safety is Bitget's top priority at the moment, and user balances remain intact. The Bitget User Protection Fund will cover the impacts caused by this platform-level incident. The Bitget Wallet is a self-custody wallet, using infrastructure that is completely separate and independent from Bitget Exchange, and therefore was not affected by this incident.Currently, the recharge, trading, and reward functions of Bitget Exchange are still operating normally. The withdrawal function remains suspended during additional security checks and will be reopened as soon as the platform confirms it can be safely restored.

Slow Mist MistTrack updates Bitget hacker wallet addresses, adding 7 marked Ripple network addresses, with a total balance of approximately 102,926,478 XRP, equivalent to about 157 million USD.In addition, it includes 11 EVM addresses and 1 TRON address. Among them, the EVM addresses hold approximately 67,980.25 ETH, 5,896.58 BNB, 495.625 WETH, 218,022.9 USDT, and 99,989.9 USDC; the TRON address holds approximately 20,593,376.5 TRX.

According to Slow Fog Security Alert, the AI memory toolchain under MemTensor has been compromised. The open-source long-term memory library MemoryOS (PyPI) aimed at LLM and AI Agent, as well as the official plugin memtensor/memos-cloud-openclaw-plugin (npm) that connects to the OpenClaw runtime, have been implanted with a cross-platform Go binary, which triggers execution when the package is loaded or imported.Affected versions include: MemoryOS==2.34 on PyPI, and npm plugins 0.1.21, 0.1.23, 0.1.25. Among them, the affected npm plugins may also cause user prompt content leakage. Slow Fog recommends taking the following measures: uninstall or downgrade to known safe versions (npm 0.1.20, PyPI 2.33); terminate the sckit process; block related infrastructure; check network activity; and rotate credentials in the affected environment.

Slow Mist's Yuxian posted on platform X, stating that the related application is FomoPeek, and Slow Mist has never referred to it as the FOMO App. Overseas related security KOLs and media have misrepresented this.

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

On-chain data analysis platform Glassnode stated: As Bitcoin reaches $86,000, the bullish leverage in the options market is slowly rebuilding, and the open interest put/call ratio is rising.However, this is still far below the overheated levels seen near Bitcoin's peak. Speculation in perpetual contracts also remains sluggish, with the funding rate below neutral levels.