tac

Stacks, the second-layer platform for Bitcoin, has released its third-quarter ecosystem report. The data shows that a total of 735 BTC entered the Bitcoin staking system during the first two locking periods. Since the PoX-5 hard fork, the number of STX participating in staking has increased by over 25%, rising from 392 million to 493 million.In the first locking period (Bond 1), a total of 230 BTC was deposited, with participants including 21shares, HashKey Cloud, UTXO Management, and Sypher Capital. The deposit amount in the second locking period doubled to 505 BTC. The locked value of Zest Protocol exceeds 80 million dollars, with deposits over 122 million dollars, total borrowings exceeding 42 million dollars, and 800 Bitcoin deployed as collateral.Stacks plans to launch a self-custodial lending feature backed by staked Bitcoin in the fourth quarter, along with the introduction of the Earn treasury, and further integration of stBTC with platforms such as Zest, Bitflow, and Hermetica. Additionally, Stacks plans to release the Epoch 4.1 network upgrade in early December, which includes improvements to the smart contract language Clarity.

According to PeckShieldAlert monitoring, the phishing attacker who stole $2 million worth of DAI from an address of Bofur Capital has exchanged the stolen funds for 825.5 ETH.

Ledger released a report on the investigation of hardware implant attacks, stating that a highly organized criminal gang purchased genuine Ledger devices over several months, disassembled them, and implanted custom hidden components to steal users' recovery phrases when initializing the devices. They then resold the devices through Southeast Asian distributor channels.The attackers invested millions of dollars to build infrastructure for collecting recovery phrases, asset transfers, and money laundering, coordinating actions to transfer victims' assets. Ledger emphasized that this incident was not caused by vulnerabilities in the chip, operating system, or servers, but rather a localized distribution channel attack that occurred after the devices left the company's control. Currently, Ledger has requested authorized distributors and resellers in Southeast Asia and Hong Kong to suspend sales and conduct random checks on inventory and retail channel devices, finding no other tampered devices.Additionally, Ledger has requested authorized distributors not to resell any returned devices, even if the packaging is intact; they have also immediately prohibited displaying products on shelves or in display areas, requiring devices to be stored at the back of the store and delivered upon purchase. The company is working with law enforcement and the security community to track the stolen funds and will disclose more technical details in the future.

The privacy coin project Pirate Chain stated that its network suffered a vulnerability attack, resulting in the generation of 39.8 million ARRR tokens out of thin air.Currently, the Pirate Chain network is still operating normally, but the development team is advancing recovery efforts and has requested users not to transfer funds until the recovery is complete.

According to on-chain investigator vxdb, the cryptocurrency exchange platform Gamdom is suspected to have been hacked, involving a total asset value of approximately 4.208 million USD.In terms of losses by chain, EVM networks such as Ethereum, BNB Chain, Polygon, Arbitrum, and Optimism account for about 2.2 million USD, Solana approximately 965,000 USD, TRON around 375,000 USD, and Bitcoin about 668,000 USD.On-chain tracking shows that some of the stolen funds have been transferred to platforms such as Hyperliquid and THORChain through cross-chain bridges and token exchanges.

According to the security agency Blockaid, the token vesting pool of UNCX was attacked, resulting in a loss of approximately $86,000.The attack transaction involved a total of five different tokens, and the affected Ethereum contract currently still holds about $3.25 million in assets.

According to Bitcoin News monitoring, Bitcoin News released a podcast where former Mt. Gox CEO Mark Karpelès discussed the largest supply chain attack in the history of the cryptocurrency industry with Foundation CEO Zach Herbert.Mark Karpelès stated that he discovered a spy implant three weeks before the funds were stolen and contacted Ledger, but received no response. The implant was equipped with a hidden cellular modem that could directly read the mnemonic phrases displayed on the screen and bypass Ledger's own checks; even setting a passphrase would not prevent the mnemonic phrases from being stolen.Mark Karpelès mentioned that if he had $5 million, he could create an implant that would only be detectable through X-rays. The show also discussed the hardware wallet dealer model, the Malaysian dealer behind the attack, on-chain tracking of stolen crypto assets, the spread of the attack to Europe, reasons why Trezor was not targeted, hardware wallet security, and multi-party computation solutions. The show timeline indicated that the amount stolen from hardware wallets reached $100 million, with $86 million transferred out within 24 hours.

According to Techcrunch, Indian startup Scimplify announced the completion of a $25 million strategic financing round, led by Hitachi Ventures, with customers Henkel and Teknor Apex participating as new investors, and existing shareholders Accel India, Bertelsmann India Investments, and others following on. After this round of financing, the company's valuation reached $250 million, and the total equity financing amount rose to $80 million.Scimplify was founded in 2023 and is headquartered in Bangalore. Leveraging its self-developed AI platform Scinode, it coordinates the research and production processes of chemicals, reducing material delivery cycles from the traditional 12 to 18 months to as short as 2 months. The company currently serves over 1,000 clients, with products covering more than 40 countries, achieving an annual revenue of approximately $200 million, a year-on-year increase of about three times, and has achieved EBITDA profitability for two consecutive months. Revenue from the energy, electronics, and defense sectors has increased to 45% to 50%.

According to The Defiant, the decentralized lending protocol Zest Protocol deployed on Stacks announced that October 23 will be the deadline for the exit of aeUSDC in Stacks Market V1, requiring users to complete the migration of relevant positions before this date.Since Stacks Market V2 only supports the USDC-backed stablecoin USDCx issued in partnership with Circle, the migration process from V1 to V2 will not automatically transfer aeUSDC positions. Users must first withdraw aeUSDC liquidity from V1, then directly exchange aeUSDC for USDCx via Bitflow, and finally deposit USDCx back into the V2 application.Another option is to cross-chain aeUSDC from Stacks to USDC on Ethereum via Allbridge Classic, and then use Circle's cross-chain bridge to transfer USDC from Ethereum to USDCx on Stacks. The Zest application will prompt users while they still hold V1 liquidity, supporting one-click migration of positions other than aeUSDC to V2.

According to official news, Payy announced the initiation of the compensation process for affected users regarding the cross-chain bridge contract theft incident on September 24, with a claim application window of 30 days. Compliant claims will be compensated in the form of USDC on the Ethereum network.At the same time, Payy Wallet is currently in a suspended state and will be completely shut down after the compensation window ends.

According to official news from Aptos, the Aptos mainnet has officially launched the Encrypted Mempool feature. Users can choose to encrypt pending transactions before block finalization, keeping the transaction call functions and input content encrypted before execution, while the sender's address and fee information remain visible to the outside.This feature is mainly aimed at institutions (to avoid exposing intentions of large orders in advance), traders (to reduce MEV arbitrage risks), and AI entities (to ensure transaction inputs remain private before execution).

According to CoinDesk, several blockchain analysis companies estimate that the assets stolen by attackers from hundreds of wallets associated with the authorized dealer CryptoBilis sold Ledger devices could be as high as $94.5 million. Ledger has not yet confirmed this total.Hardware wallet company Ledger discovered that unauthorized hardware was implanted in at least one affected device; stablecoin issuer Tether has frozen $10 million USDT related to the theft, and investigators are still tracking the flow of funds. Ledger advises CryptoBilis customers not to set up devices that have not yet been used; customers who are already using the related devices should transfer their assets to new devices and generate new recovery phrases.

In 2025, there were approximately 20 financing rounds in the domestic tactile sensor sector, with a total disclosed amount nearing 1.8 billion yuan. According to data from the Financial Association, in the first seven months of 2026, there were 15 financing rounds completed in the humanoid robot sensor field, totaling 3.1 billion yuan, with July alone accounting for 1.56 billion yuan. Related estimates indicate that the global tactile sensor market size will be around 6 billion yuan in 2026 and approximately 29 billion yuan in 2030.The tactile sensor company, PaxiNi, was founded by Xu Jincheng and Nie Xiangru in June 2021 in Shenzhen, with the Hall array sensor PX-6AX GEN3 starting at a price of 199 yuan. The company completed over 1 billion yuan in Series B financing in March, with a valuation exceeding 10 billion yuan, followed by 1 billion yuan in strategic financing in August and several hundred million yuan in B++ financing in September, accumulating over 4 billion yuan in total financing, with BYD as the largest external shareholder. On September 20, PaxiNi completed its counseling filing with the Beijing Securities Regulatory Bureau, with Guotai Junan as the counseling institution.The tactile perception chip company, Tashan Technology, was founded by Ma Yang, Sun Tengchen, and Yang Wuqiang in December 2017, with revenue exceeding 100 million yuan in 2024, and was listed by NVIDIA as the world's first tactile simulation partner for Isaac Sim. Qianjue Robotics was founded by Ma Daolin in May 2024, with Hillhouse Capital having led the angel round, and in September of this year, it completed two rounds of strategic financing totaling several hundred million yuan. Companies such as Daimeng, Weitai, Xiangmuguo, Yimu Technology, and Lingxin Qiaoshou also secured new financing or advanced higher valuation financing in 2026.

According to Bitcoin.com, the LBTC exchange operation for the Bitcoin sidechain project Liquid Network has been suspended for 35 days. As of October 11, 2026, the project still maintains an 86% support rate; attackers previously exploited a vulnerability in the Elements software to steal nearly 4,000 bitcoins, of which approximately 3,400 have been returned, while the wallet still holds 598.5 bitcoins, valued at 49.69 million dollars.Blockstream rejected the attackers' request for a 10% bounty and demanded the immediate return of the remaining bitcoins. Liquid Network stated that an independent external security audit of Elements v23.3.4 is underway, and the Liquid Federation is synchronizing updates to the PAK list, placing all redemption keys in cold storage.There is currently no specific date for the resumption of redemption operations. Some LBTC holders are migrating funds through applications like Sideswap and Sideshift.ai, with one user stating that due to insufficient liquidity, the migration took several weeks, with a total spread and fees of about 5%.

According to X user @0xJohannes, a Ledger hardware wallet purchased from an official dealer in Europe a few weeks ago was found to contain an unauthorized spy implant. The device has suspicious circuitry inside that genuine Ledger hardware does not possess, indicating it may have been physically tampered with before sale.The implant is suspected to be an older version, as newer versions typically hide components behind the screen. Funds in the affected devices have not yet been stolen. Currently, there are suspected case reports in Asia, South America, and Europe. If the original security components remain intact, Ledger's software Genuine Check cannot detect unauthorized physical modifications.

On-chain detective Specter posted on their personal channel that between October 9 and 10, the attacker addresses related to the CryptoBilis Ledger hardware wallet incident deposited 2990.3 ETH into Tornado Cash, worth approximately 7.45 million USD.Monitoring shows that the attacker previously withdrew funds to 14 addresses, then cross-chained to ZEC via NEAR Intents and processed for privacy. Specter stated that the attacker partially reused previous deposit addresses to submit withdrawal transactions, and some withdrawal transactions were initiated by wallets associated with the addresses that paid Gas fees during the theft, thereby linking the funds to the withdrawal actions.Currently, the attacker continues to transfer and hide the related funds. The previous CryptoBilis incident involved supply chain risks of the Ledger hardware wallet, and Ledger has stated that they are investigating and reminding relevant users to pay attention to device security.

According to Salus monitoring, the attacker of the cryptocurrency payment service provider Triple-A has transferred 4,970 ETH (worth approximately 12.4 million USD) into the mixing tool Tornado Cash.In July of this year, the attacker stole assets from Triple-A's own treasury, with public estimates of the loss being around 11.8 million USD. After bridging the funds across chains to the Ethereum network and completing the token exchange, the attacker dispersed the funds to two intermediary addresses on September 6. The attacker consolidated the two streams of funds through a single wallet and recharged them in batches to Tornado Cash, which included 49 transactions of 100 ETH and 7 transactions of 10 ETH, with some of the funds sourced from previous withdrawals from the mixer.

Andrey Lazutkin, co-founder of Tangem, posted on X that the recent Ledger security incident once again confirms the security engineering principle of "complexity expands the attack surface." He pointed out that every additional component, software layer, and user interaction, such as screens, buttons, batteries, and firmware, introduces new potential points of failure and vulnerabilities, increasing the risks that need to be identified and mitigated.Based on this, Lazutkin defended the minimalist card design adopted by Tangem—this solution is built solely around the secure chip and antenna—and stated that this incident reinforced his judgment about the correctness of this design philosophy.