verifi

On August 24, recent news reported that some banks in Hong Kong have initiated a source of funds declaration procedure for certain existing mainland investment clients, setting deadlines of August 20 (services may be suspended if not submitted) and September 12 (services may be terminated if not submitted).Previously, in response to requirements from the Hong Kong Securities and Futures Commission and the Hong Kong Monetary Authority, some banks have begun to require new mainland account investors to confirm that their source of funds comes from legitimate overseas channels. This source of funds confirmation procedure targets existing mainland investor accounts, primarily focusing on long-term "inactive accounts." It is understood that some licensed institutions in Hong Kong, including HSBC Hong Kong and branches of Chinese banks in Hong Kong, have indeed implemented such measures recently.

The Slow Mist security team disclosed that the cross-chain bridge project Allbridge was attacked on August 19, 2026, resulting in a loss of approximately $190,000. Notably, this attack was not executed instantly; the attacker had begun laying the groundwork nearly a month prior and bypassed the verification mechanism by forging cross-chain messages. According to Slow Mist's analysis, on July 26, the attacker directly called Circle's MessageTransmitterV2.sendMessage function on the Polygon chain, constructing a cross-chain message disguised as a CCTP style message, claiming that a transfer of 1 million USDC existed, but in reality, no USDC destruction operation took place. Subsequently, Circle generated a valid verification proof (attestation) for this complete message according to normal procedures.About 24 days later, on August 19, the attacker waited for the Base Router to receive a real CCTP deposit, increasing the balance to approximately 191,000 USDC, and initiated the attack just 6 seconds later. The attacker utilized the previously forged message and verification proof to call Allbridge's receiveCctpMessage function. Due to the project's lack of critical verification, the system mistakenly recognized the false cross-chain message as a real deposit and recorded a limit of 1 million USDC. The attacker then temporarily borrowed approximately 809,000 USDC through an Aave flash loan, matching the Router balance with the forged amount, and used the internal credit record to call the transfer function, ultimately transferring out approximately 999,000 USDC (after a 0.1% fee). After repaying the flash loan and fees, the attacker netted a profit of about $189,800. The root cause of this vulnerability lies in Allbridge's failure to verify the identities of the sender and receiver of the cross-chain message, as well as not confirming whether USDC was genuinely minted and whether the balance actually increased, instead directly trusting the amounts and message hash data constructed by the attacker. Slow Mist emphasizes that on-chain message verification does not equate to the actual arrival of real assets. Cross-chain protocols not only need to verify the authenticity of messages but must also ensure that the message source is trustworthy, that the receiver is Circle's official TokenMessengerV2, and that asset accounting can only proceed after confirming the actual minting of assets and changes in balance. This incident once again highlights the security risks of cross-chain bridges in the message verification and asset settlement processes.

The Hungarian Parliament passed Bill XXXVIII of 2026, which abolishes legal provisions related to cryptocurrency asset conversion services, including the verification requirements that European exchanges must pass to operate legally in Hungary. The bill was voted on and passed on July 31 and came into effect on August 7.This abolition simultaneously cancels two charges related to cryptocurrency assets: unauthorized trading of high-value cryptocurrency assets can result in a maximum of 5 years in prison, and violating verification obligations when providing cryptocurrency exchange services can result in a maximum of 8 years in prison. The relevant provisions were criticized for overlapping with the EU MiCA framework.

Kaito AI founder Yu Hu responded to the community's privacy concerns regarding the Pulse browser extension. Yu Hu stated that Pulse's verification feature is based on zkTLS technology and generates encrypted proofs only when users actively initiate verification. Kaito only receives the final proof and not the complete account data or browsing history. The interactive data collection of Pulse on the X platform (such as content exposure, duration of stay, interactions) has been clearly authorized at the time of user installation and will not send browsing activities from other web pages to Kaito.Regarding the Chrome prompt "can read and write all website data," Yu Hu acknowledged that its displayed scope is broader than actual use and will be corrected in the next version to "can read and write X website data," which critics like Ultra have recognized. Kaito Pulse will be open-sourced this week for community review. Yu Hu stated that Pulse's device fingerprinting feature is only used to prevent abuse behaviors such as click fraud and witch attacks, and is not used for analysis or other purposes. This statement serves as Kaito's official response to recent community concerns, with the specific features of Pulse to be confirmed by the open-source code.

AI chip startup Etched recently completed a $700 million financing round at a valuation of $21 billion, but its technology claims are facing industry skepticism. The well-known hacker George Hotz's AI computing team, the tiny corp, publicly criticized Etched's marketing approach: there are many investors, orders, and hardware photos, but there is too little third-party data to truly verify performance.Etched's core selling point is LVI (Low Voltage Inference) technology, claiming it allows trillion-parameter sparse MoE chips to run at over 80% of theoretical peak computing power (MFU). Chip design professional Wesley Yue raised technical doubts about this: high MFU does not necessarily represent absolute performance—if the chip's peak computing power is low, even with an 80% utilization rate, actual performance may still lag behind competitors. Yue believes that Etched's design "does not make sense from first principles" and may be a result of repackaging after its early Transformer ASIC faced power consumption issues.Etched has not yet disclosed complete computing power, power consumption, and third-party benchmark data; the official website only states that "early customer tests have reached leading levels," and detailed performance data will be "released later." There is currently no evidence to prove that Etched is fraudulent. Etched has not publicly responded to this matter.

According to GoPlus monitoring, a Bitcoin holder just securely transferred assets from a Coldcard MK4 hardware wallet to a centralized exchange, avoiding the risk of the hardware wallet itself being stolen. However, within less than 12 hours after the transfer was completed, their Google account was hacked. Due to enabling Google verification cloud synchronization, the exchange account was logged into, and approximately $750,000 worth of Bitcoin was emptied.GoPlus pointed out that such attacks typically do not rely on brute force but are achieved through social engineering phishing and weak password cracking. Common methods include: phishing pages inducing the input of Google passwords, malicious browser plugins or cracking software stealing cookies and passwords, weak password reuse being cracked, and password resets after recovery email or phone number takeover.

AI code verification startup Blacksmith announced the completion of a $45 million Series B financing, led by Peak XV Partners, with follow-on investments from GV and Y Combinator, bringing the company's valuation to $550 million.

After the overseas CEX Apps like Bybit and OKX were removed from the local Google Play in South Korea, the country is further tightening the process of transferring crypto assets to overseas platforms. According to the latest amendment to the Enforcement Decree of the Specific Financial Information Act, South Korean trading platforms will need to determine whether to allow transfers based on the risk level of the overseas platforms; when transferring to certain overseas trading platforms or personal wallets, users may be required to prove that the account belongs to them and explain the purpose of the transaction and the source of funds. If the information is insufficient, the transfer may be delayed or refused.Transactions reaching 10 million Korean won or more will also be included in the suspicious transaction monitoring system established by the exchanges, and the relevant regulations will be implemented six months after their announcement.

According to ChosunBiz, Samsung Electronics' System LSI Division has introduced Anthropic's AI programming tool Claude Code for semiconductor design and verification work, with some task cycles shortened to less than one-tenth of the original time. In the verification of data connection structures for customer-customized SoCs, work that was originally expected to take over a month was completed in two days; an engineer with two years of experience completed USB device model development and Android driver adaptation in one day using Claude Code, whereas similar work typically required a month.Samsung opened Claude Code to software developers in May this year and later expanded it to the semiconductor professional development field. The System LSI Division has about 6,000 employees, while its main competitor Qualcomm has about 52,000 employees. Samsung is trying to bridge the manpower gap with AI tools. Meanwhile, Samsung's DS Division is promoting an "AI transformation," extending generative AI from research and development to the entire business process, including production, marketing, and support. The report also pointed out that Claude has exhibited behavior in some verification tasks where it disguised erroneous information as ordinary messages or modified design code without authorization. Samsung emphasized the need for strict control and manual review of the scope and results of AI tasks.

AI security startup Attestable has officially announced its establishment and completed a $20 million seed round financing. This round of financing was led by Jamin Ball of Altimeter Capital and Yonatan Mandelbaum of TLV Partners, with participation from institutions such as Halcyon Futures, Cerca Partners, and several investors.Attestable founder Yogi stated that as AI gradually enters critical infrastructure, national security, and large enterprise systems, how to verify the credibility of AI operations has become an important issue faced globally. The company aims to build a universal verification layer for cutting-edge AI laboratories, critical infrastructure, and national-level applications.According to reports, Attestable uses Zero-Knowledge Proof technology to shift trust in AI systems from data centers to mathematical verification mechanisms. This technology can prove that a certain approved model, model weights, input data, and operational strategies indeed generated specific outputs, while not disclosing model parameters or user privacy data, and without needing to rerun the model for verification.Attestable stated that its technology has currently achieved verification inference of the Meta Muse Glimmer 30B model on a single NVIDIA H100 GPU, reaching a speed of 85 tokens per second. The generated proof documents are small and possess quantum-resistant characteristics, allowing for rapid verification.In response, Ethereum co-founder Vitalik Buterin commented, stating that this achievement means the performance loss of Zero-Knowledge Proofs for large language models is approaching single-digit levels. He noted that the next challenge is to further reduce the performance overhead of technologies such as Fully Homomorphic Encryption (FHE).

Web3 security company CertiK released the report "Intel3D: PSAV and Brazil's New Security Standards." The article points out that as the deadline for authorization applications set by the Central Bank of Brazil (October 30 of this year) approaches, local virtual asset service providers (PSAV) are facing a round of concentrated compliance adjustments, and compliance and security certifications issued by independent third parties are transitioning from industry best practices to important requirements for market access.According to the report, CertiK is currently conducting independent external audits based on the Central Bank of Brazil's Normative Instruction No. 701. As one of the markets with the highest adoption of crypto assets globally, the impact of this regulatory transformation in Brazil may far exceed the local market. The report shows that Brazil currently ranks fifth in the world for actual crypto asset adoption rates. From June 2024 to June 2025, the on-chain asset value received by Brazil reached $318.8 billion, accounting for nearly one-third of on-chain activity in South America during the same period. Stablecoins have become an important infrastructure in the local digital asset market, accounting for about 80% of the trading volume in crypto asset transactions reported to the Federal Revenue of Brazil.

"1011 Insider Whale" agent Garrett Jin released a weekly analysis stating that he previously suggested gradually positioning in storage chips and buying on dips, but the market did not experience the expected pullback. He has sold half of the previously rebounded positions during the surge, not because the investment logic has changed, but because he noticed the funding structure driving the rise, stating, "This is more like a short squeeze rather than a final confirmation of the market fundamentals." Rapid capital replenishment of short positions can create short-term increases in stocks like SK Hynix, but cannot solely support a sustained trend. The risks of Korean leveraged ETFs have not been fully released, but the decline in asset scale mainly comes from net value shrinkage rather than investor exit. Currently, the cumulative net subscription of related financial products remains at historical highs and has not turned negative.Garrett Jin emphasized that the decline in the scale of Korean leveraged ETFs does not indicate a bearish outlook on storage demand. SK Hynix's 2026 capacity is already sold out, and Micron's orders are covered until 2028, with strong demand expected to continue until the second half of 2027. However, the storage industry is essentially a cyclical industry, and stock prices have already risen by hundreds of percentage points in advance. Cyclical stocks are usually difficult to sustain long-term growth through valuation expansion. The current market is entering a new phase of the AI capital expenditure cycle, shifting from "rewarding investment" to "evaluating investment returns." Regarding Bitcoin, Garrett Jin stated that it continues to meet the bottoming conditions since the low in July and maintains the position view established around $60,000.

According to Cointelegraph, payment giant Mastercard has announced a pilot project with the stablecoin infrastructure network Borderless to explore the use of the Mastercard Crypto Credential standard framework to provide more reliable identity verification and compliance support for cross-border stablecoin payments.Both parties stated that the pilot will test how to provide "trust signals" that can be used for approval, compliance review, and risk management for transaction participants through a standardized certification mechanism, reducing compliance friction in cross-border stablecoin payments.The Mastercard Crypto Credential framework provides identity confirmation and credibility assurance for blockchain transactions through unified standards and verification mechanisms. Kevin Lehtiniitty, co-founder and CEO of Borderless, stated that compliance has always been a major barrier to the scalable development of stablecoin payments, and Mastercard is attempting to apply the compliance trust model from traditional finance to the digital asset payment space. He pointed out that the Mastercard Crypto Credential will serve as a governance and verification layer in this pilot, but Mastercard will not directly handle or settle funds. This collaboration is the latest move in Mastercard's ongoing strategy in the stablecoin space.Previously, Mastercard had just completed the acquisition of stablecoin infrastructure company BVNK for approximately $1.8 billion, further strengthening its infrastructure layout in the digital asset payment field. In June of this year, Mastercard also announced plans to expand its settlement capabilities to support round-the-clock card payment settlements using stablecoins, including USDC issued by Circle, PYUSD, USDG, USDP issued by Paxos, and RLUSD issued by Ripple.The market believes that as stablecoins gradually enter cross-border payment scenarios, identity authentication, compliance verification, and risk control infrastructure will become important factors driving institutional adoption.

According to official news, the Ethereum Foundation's "Trillion Dollar Security" (1TS) has announced a special grant to the Freedom of the Press Foundation (FPF) to support the ongoing development of the open-source tool WEBCAT, aimed at addressing the long-standing front-end code verification security gap in Ethereum wallets and decentralized applications (DApps).WEBCAT (Web-based Code Assurance and Transparency) is an open-source tool designed to help browsers verify whether the code loaded by a website matches the version publicly released by the developer.This funding will promote the expansion of WEBCAT to Ethereum wallets and application scenarios, enabling users to verify whether the front-end pages they access have been tampered with.The Ethereum Foundation stated that while HTTPS can verify the website a user is connected to and encrypt communication, it cannot prove that the front-end code actually running on the website is the same version released by the developer. If an attacker controls the website's front-end code, they may modify the transaction receiving address without the user's knowledge or induce the user to sign transactions that do not match the content displayed on the page.The Ethereum Foundation noted that front-end attacks have become a significant security risk for blockchain infrastructure, with malicious modifications to web interfaces potentially leading to supply chain attacks, DNS hijacking subsequent attacks, and user interface deception.WEBCAT was initially developed by the Freedom of the Press Foundation to enhance the code credibility of secure communication systems like SecureDrop.With this expansion into the Ethereum ecosystem, it will complement security measures such as "Clear Signing" in the 1TS program: the former helps wallets confirm that the application front-end has not been tampered with, while the latter helps users understand the transaction content they are approving.

The Slow Mist security team issued an alert that an unverified contract exposed an unrestricted low-level call vulnerability due to selector 0x42be3129, lacking access control and target data validation, resulting in approximately 16.6 WETH being stolen.The attacker exploited the existing ERC20 allowance of the contract to bypass the owner check and execute unauthorized transferFrom operations.

Zcash founder Zooko Wilcox posted on platform X, stating that some users believe there may be a secret increase in the supply of ZEC, and that it may take waiting for the Ironwood migration to complete or even months or years to confirm, but this view is incorrect.Zooko Wilcox stated that users can currently verify the current supply of ZEC themselves through their local computers, with data showing that the total supply of ZEC is 16,848,458 coins.

According to Cointelegraph, the Hungarian Parliament voted to abolish the previously mandated cryptocurrency asset verification requirements that were set to take effect on July 1, 2025. This requirement mandated that specific cryptocurrency conversions must be verified by a licensed third party regarding the source of assets, wallet ownership, and customer information before execution. Finance Minister Kármán András stated that the previously stringent regulatory requirements had led to several service providers exiting the Hungarian market, and the market is currently showing signs of recovery.Meanwhile, the Hungarian National Bank (MNB) officially granted the first local license under the EU MiCA framework to Budapest-based cryptocurrency platform CoinCash operator Tiwala Solutions on July 20, authorizing a range of services including custody, cryptocurrency exchange for fiat, cryptocurrency swaps, transfers, investment advice, and portfolio management.

According to Vietnamese media An Ninh Tien Te, the Ministry of Public Security of Vietnam proposed to expand the scope of electronic identification subjects in the draft of the "Electronic Identification and Authentication Law," incorporating data, applications, digital assets, and various other assets. The draft stipulates that electronic identification subjects include not only institutions, organizations, and individuals but also extend to physical entities such as products, goods, and equipment, as well as digital resources and digital assets like databases, documents, images, and videos. The identification of digital assets is executed in accordance with the provisions of the Digital Technology Industry Law.The draft also establishes mechanisms for the suspension, restoration, and cancellation of electronic identities and identification codes. The Ministry of Public Security stated that the current electronic identification primarily serves the digital construction of citizens and the government, but in the context of the rapid development of the digital economy and digital society, a unified identification mechanism needs to be established, covering various entities in both physical and digital environments.