xpos

Cryptocurrency hardware wallet manufacturer Keystone disclosed that its website experienced a security breach, allowing unauthorized third parties to access customer names, contact information, shipping addresses, and order details. Keystone stated that it has blocked access, fixed the vulnerability, and launched an investigation, while also notifying affected customers, but did not disclose the number of individuals impacted.Security researcher Taylor Monahan warned that the leaked shipping addresses could expose customers to targeted scams and personal attacks. Keystone stated in 2023 that it would shorten the retention period for customer data to 180 days, but some customers reported receiving breach notifications more than two years after purchasing their devices.

Succinct's zero-knowledge proof system SP1 has revealed a high-severity reliability vulnerability. This vulnerability was disclosed through GitHub announcement GHSA-p7v2-jjv3-8p8f, affecting SP1's native Rust verifier versions 6.0 to 6.8.0, allowing the mainnet Prover Network to potentially accept invalid proofs: malicious provers can submit proofs of invalid executions, and the network verifiers will still accept them.The cause of the vulnerability is that the verifier only reads the labels of the data (declaration dimensions) without verifying whether the actual number of stored elements equals the product of the dimensions, allowing attackers to forge labels to pass invalid proofs. The Groth16 and Plonk checks using fixed-shape wrap proofs are unaffected, and the on-chain Solidity checker is also safe. Succinct released the fixed version 6.8.1 on September 24, which has been deployed to the mainnet; this version adds deserialization length checks.The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users running the native Rust verifier and accepting untrusted provers need to upgrade to 6.8.1.

The tokenized Pre-IPO platform OpenStocks has launched on the BNB Chain, offering tokenized economic exposure products for four private companies, including Anthropic (oANTHROPIC), Figure AI (oFIGUREAI), Neuralink (oNEURALINK), and Anduril (oANDURIL). These products are BEP-20 tokens on the BNB Chain mainnet, supporting 24/7 trading with no minimum amount restrictions. Transactions settle on-chain within seconds, using a self-custody model where users trade by connecting their own BNB Chain wallets, and OpenStocks does not act as a custodian.The platform clearly states that these tokens provide only economic exposure to the private stock prices of the companies and do not represent equity, granting holders no ownership, voting rights, dividend rights, or information rights, and OpenStocks has no affiliation with the aforementioned companies. The token prices are set by the on-chain DEX liquidity pools, with PancakeSwap Infinity as the primary trading venue. Tokens are traded against USDT, and the price users pay depends on the quotes in the pool at the time of transaction. The trading page simultaneously displays the latest on-chain token price and the reference price of the underlying company, as well as the implied company valuation based on that price.The platform is not open to individuals within the United States, U.S. citizens, and other ineligible persons, with Singapore being a prohibited jurisdiction. OpenStocks states that it is not a broker-dealer, investment advisor, exchange, transfer agent, or custodian, does not provide investment advice, and has no affiliation with the companies involved.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

According to the Science and Technology Innovation Board Daily, during the sixth RISC-V China Summit, ZTE Microelectronics' subsidiary, Lirui Micro, unveiled the high-performance RISC-V CPU chip, Mount Everest 200, designed for intelligent computing centers. Lirui Micro stated that Mount Everest 200 is the industry's first RISC-V CPU chip aimed at intelligent computing center scenarios, with detailed product specifications to be officially released by the end of this year.Mount Everest 200 focuses on three major scenarios: Agent clusters, inference super-node Hosts, and enterprise-level intelligent computing hybrid inference. It natively supports RISC-V AI instruction acceleration and is optimized for KV Cache and long-context large model inference. This chip integrates various acceleration engines, including Matrix, Vector, compression, and encryption, supports high-speed interconnect interfaces such as DDR5, PCIe, and CXL, and can adapt to RISC-V native AI and GPU acceleration card MoE large model hybrid inference solutions.

Matt Cole, the CEO of Bitcoin Treasury Company Strive, stated on the X platform that the long-term trend of currency depreciation will continue to drive the appreciation of scarce assets. Bitcoin, as digital gold, is still in its early stages of development, and as the market matures, its long-term performance is expected to surpass that of gold.Cole pointed out that over the past 55 years, gold has had a compound annual growth rate that exceeded the growth rate of the U.S. M2 money supply during multiple periods. Specifically, since 1970, the rates have been 9% and 6.7%, respectively; since the global financial crisis, they have been 9.5% and 6.3%; and since the COVID-19 pandemic, they have been 18.3% and 6.5%. Cole believes that as the debt crisis continues to worsen, the long-term outperformance of scarce assets relative to the dollar may further expand.For Strive, the key to outperforming Bitcoin lies in maintaining a high Bitcoin exposure multiplier and sufficient liquidity, rather than simply reducing financing costs. He emphasized that establishing and maintaining high Bitcoin exposure while avoiding financial risks is extremely challenging, and the market currently underestimates Strive's competitive advantages in Bitcoin exposure amplification and liquidity management. Its core investment philosophy is to reduce dollar exposure in the long term and increase Bitcoin allocation.

Documents disclosed by the U.S. Securities and Exchange Commission (SEC) indicate that the investment advisory firm Unique Wealth has submitted a 13F-HR report to the SEC, showing that it holds approximately $10.4 million in Bitcoin-related positions.The 13F-HR is a quarterly holdings report submitted by institutional investment managers to the SEC, used solely to disclose securities holdings that meet the reporting threshold, excluding directly held crypto assets. Therefore, the aforementioned positions typically represent Bitcoin exposure in the form of securities such as spot Bitcoin ETFs.

The Thailand Securities and Exchange Commission has completed the rule-making for Bitcoin ETFs, and the new regulations will take effect on October 16. Bitcoin has been included as a qualified asset in the first phase.According to the rules, the average net exposure of the relevant funds for each accounting year must reach at least 80% of the net asset value. The custodian must be licensed by the Thailand Securities and Exchange Commission, and fund shares can only be traded on the Thailand Stock Exchange. Securities companies are not allowed to provide margin financing. Thai mutual funds and private funds will be permitted to invest in locally listed cryptocurrency ETFs, but initially, the issuance and provision of depositary receipts related to overseas cryptocurrency ETFs are prohibited.

According to Hupzy, the current net exposure of hedge funds to the "Magnificent 7" in the U.S. stock market has risen to 22%, a record high, surpassing the peak of 21% on June 2024, and increasing by 7 percentage points since July of this year. In comparison, at the bottom of the bear market in 2022, this indicator was only 8%.The record-long positions reflect strong confidence from institutions in technology stocks, but it also means that trading may be overly crowded and does not necessarily indicate that the market will continue to rise. If the relevant investment logic changes, large-scale liquidations could trigger a sharp reversal and directly impact the perpetual contract market for the S&P 500 index; a decline in risk appetite may also further pressure Bitcoin.Additionally, the net exposure of hedge funds in the semiconductor sector is currently at 12%, slightly below the peak of 14% in June 2024, but significantly up from 2% at the beginning of 2025. Over the past three months, the increase in hedge fund exposure to the Magnificent 7 has been the largest since 2023.

Decentralised.co published a discussion on the path of stock tokenization, stating that the exposure to on-chain stocks held by traders and investors through tokenization and synthetic perpetual contracts has exceeded 6 billion dollars. The total market size of on-chain stock tokens is 3.21 billion dollars, with a 10% increase over the past 30 days; the open interest of perpetual contracts for stocks, indices, and ETFs on trade.xyz is 3.01 billion dollars, accounting for 94% of the total stock token market size.The process of stock tokenization is divided into four stages: initially, it is mostly offshore packaged certificates, followed by becoming collateral, then brokers tokenizing the shares that users already hold, and finally, the company registering the shares themselves on-chain. Most stock tokens are debt certificates that do not include voting rights or ownership of shares. Taking Robinhood as an example, after the related entity purchases shares and they are held by a custodian, it issues debt securities corresponding to one share to users, with dividends reinvested and stock splits adjusting the number of shares represented; if the issuer fails to perform, the securities agent will sell the shares and pay the holders, while the issuer can only maintain the price through arbitrage within a limited time frame.The market size of the top 100 tokenized stocks increased from 2.09 billion dollars to 3.03 billion dollars within 90 days, and the number of holding addresses grew from 417,000 to 4.21 million, with Binance and Robinhood contributing 86% of the new addresses. About 97.5% of the addresses hold less than 100 dollars, with exchanges and large wallets holding most of the value. The borrowing rates for collateralized loans against related stock tokens on Kamino, Jupiter Lend, and Ether.fi are approximately 4% to 5.75%.

BasedApp disclosed a data breach, with unauthorized parties accessing its internal operating system, exposing customer KYC data. The exposed items listed in the post include names, dates of birth, nationalities, addresses, passport or NRIC numbers, email addresses, phone numbers, and wallet addresses associated with the aforementioned identity information.The post also mentioned that someone gained administrator access to the BasedApp team's AI-agent backend through Google Quick Login, exposing the Telegram bot token, AI API key, OpenClaw gateway token, and OpenAI keys.

According to a report by Semafor, the New York Federal Reserve has begun visiting JPMorgan Chase, Wells Fargo, Barclays, and Morgan Stanley to review their loan situations and risk exposures related to private credit companies.This review partly stems from JPMorgan Chase's move in March to write down a significant amount of loans in its private credit portfolio, particularly loans to software companies threatened by artificial intelligence.

Arkham posted on the X platform that in February 2025, it identified over 1,000 addresses belonging to Kelsier Ventures (Hayden Davis) and published the complete collection for the first time.At that time, these addresses held nearly $300 million in crypto assets, primarily in LIBRA tokens; the current value has fallen to $2 million.

Michael Saylor, the founder of Bitcoin Treasury Company Strategy, posted on the X platform stating that Bitcoin can serve different types of investors. BTC provides direct ownership, MSTR offers leveraged Bitcoin exposure, while STRC provides income opportunities, and its 30-day price volatility is lower than all "Seven Giants" stocks.Michael Saylor added that digital capital is the foundation of digital equity and digital credit.

Bitcoin Magazine reported that the Chief Business Officer of the cryptocurrency exchange platform Coinbase stated that the company is working with advisors from six globally systemically important banks to increase exposure to Bitcoin.Coinbase Chief Business Officer: The company views this as an opportunity to expand the market and provide individuals with more ways to access Bitcoin. Globally systemically important banks are large banks identified by the Financial Stability Board that have a significant impact on the global financial system.

The Rollup founder Andy commented on the MetaMask infrastructure security incident, stating that, according to sources, unless significant negative news arises, there will be a small-scale withdrawal of staked ETH. It is recommended to take proactive measures for all re-staked ETH positions that have exposure to Lido.Andy expressed hope for a positive outcome, but he believes it may be wiser for the protocol and investors to actively respond. He mentioned that the current situation seems to be under control, but based on his recent communications with multiple parties, no one is clear about what exactly has happened.

The official ether.fi account posted on the X platform, stating that it has learned about a previous security incident related to Ethereum node operators. WEETH has no risk exposure and will not be affected. All funds are safe.Metamask announced earlier today that it is dealing with a security incident affecting some of Metamask's infrastructure. No direct threats to the MetaMask wallet have been identified at this time.As a precaution, Metamask is actively working with customers, partners, and security consultants to withdraw affected validators to maintain the security of Metamask's non-custodial staking business.

On September 29, according to a report by Phoenix Technology citing Sina Technology, Doubao, a subsidiary of ByteDance, is advancing its product planning in the personal assistant direction. Insiders revealed that continuing the strategy of last year's Doubao mobile assistant in the personal agent direction, internal testing of related exploratory products began in April this year, codenamed Spell, mainly led by the Doubao mobile assistant team, but has not been officially announced due to reasons such as the release of the Doubao mobile phone.The insider stated that as personal assistant products like Muse and Instinct have gained attention overseas, Doubao is also accelerating the external release of personal agent capabilities, planning to integrate the Spell project more deeply with Doubao products. The new product will be jointly managed by the Spell project and the Doubao dialogue team, and it is expected to be launched externally soon. According to "Big Factory Daily," the Doubao product line has received a new task during the Mid-Autumn Festival, requiring a rapid reconstruction of a product that benchmarks Muse, with a beta version developed by September 30 for internal testing, involving the entire Doubao product line and multiple upstream and downstream teams in this holiday development.Previously, the technical preview version of the Doubao mobile assistant made its debut in December 2025, first launched on the ZTE Nubia M153 engineering prototype. In September 2026, the consumer version was officially released, landing on the Nubia NaviX Ultra model. Reports indicate that Spell can be seen as Doubao's extension of the personal agent capabilities accumulated on mobile devices into an independent application form.

Co-founder and Chief Operating Officer of the cross-chain trading platform Relay, Jason Maier, stated that the team discovered an issue with the Relay API over the weekend, which exposed pending transaction information before trade execution. MEV seekers exploited the pending routing status to infer on-chain paths and front-run trades before order execution, resulting in worse execution prices for users trading through Relay.This activity occurred from September 12 to September 26, primarily concentrated from September 23 to 26. Seekers profited approximately $136,000 from this, affecting around 5,600 users, with a median impact of $11.88. Relay will pay a $50,000 bounty to Outputlayer for reporting the issue and will automatically compensate affected users without the need for applications; funds will be directly sent to wallets, with a total compensation amount of approximately $312,000.Jason Maier stated that MEV can arise through public mempool exposure, order detail inference, malicious participation in auctions, or data gaps between service providers, and protecting a single link in the transaction path is not sufficient. He mentioned that the team will continue to enhance the execution quality and privacy of the entire transaction path and called on security researchers to report vulnerabilities when discovered.