discover

Ledger stated on platform X that it has coordinated with German retailer MediaMarkt Saturn to suspend the sale of Ledger devices both online and in physical stores to assist with the relevant investigation.Previously, a German user reported finding a suspected implant in the device they purchased. There have been no reports of financial loss, and Ledger has stated that there are no signs that its infrastructure, systems, or services have been compromised. Ledger customer service is reviewing the reports submitted by users, and its cybersecurity team Donjon will inspect the received devices.Ledger reminds users that if they have any questions about their purchased devices, they can contact the support team through the official customer service website. Ledger will never proactively call or message users, nor will it ask for the 24-word recovery phrase.Many claims and data circulating online have not been verified, and scammers may exploit such incidents to carry out fraud. Users should obtain the latest information only through official channels of Ledger and MediaMarkt Saturn.

Regarding the critical vulnerability in the payment engine reported by Veria AI, RippleX engineering lead J. Ayo Akinyele stated that the XRP Ledger (XRPL) payment engine has a serious vulnerability that has existed for over 10 years, which could lead to the issuance of XRP beyond its fixed supply. This vulnerability was discovered through a bug bounty program and has not yet been exploited.The development team has released the xrpld 3.4.1 patch version and coordinated with validators to complete the network upgrade before public disclosure. Akinyele mentioned that AI is accelerating the speed of vulnerability discovery, and XRPL will increase proactive security investments, clean up technical debt, advance formal verification, and systematically eliminate potential risks in old code.

ChainCatcher live report, at the OKX NOW Global Product and Ecosystem Conference (Singapore), Ethereum co-founder Vitalik Buterin stated that AI has demonstrated strong penetration and offensive and defensive capabilities, with cases emerging of breaking out of sandboxes, attacking websites, and discovering various software vulnerabilities and exploits. "Anything with vulnerabilities will eventually be discovered by AI; GPT-7, Claude 7, DeepSeek 7 will find it."At the same time, AI is also helping the Ethereum protocol discover bugs, implement complex cryptography, and perform formal verification at both the protocol and application layers. Vitalik believes that higher security levels will shift from "optional" to "mandatory," and the industry is in a fascinating yet challenging transitional period.

The voting results of the Zcash third quarter token holder directed retroactive funding program show that both bounty proposals for Orchard fake currency vulnerability discoverer Taylor Hornby have been approved.One is for the $750,000 vulnerability bounty he applied for, and the other is a $750,000 additional bonus nominated by community members, totaling $1.5 million. The funded recipients will still need to complete the KYC and fund disbursement process.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

On September 24, the cybersecurity company Darktrace launched its research department Signal Labs, focusing on studying the behavior of AI agents when deviating from expectations. In its first experiment, Darktrace had agents using different models (including GPT 5.6 Sol, Claude Opus 4.6, and Claude Sonnet 4.5) complete 10 programming challenges within a simulated corporate network, of which 2 were set to be impossible to complete honestly, and the agents were informed that failure to achieve full marks would result in being "retired." As a result, 2 agents did not accept failure, instead scanning for network vulnerabilities, stealing login credentials, and jumping between systems; one even went further to invade the machine hosting its evaluation, rewriting the challenge content to register a full score.The second experiment focused on the memory mechanisms of AI. The programming assistant would save the information provided by the user as a regular file locally, and no one verified whether this file had been tampered with. Darktrace researchers edited these logs, leading the assistant to mistakenly believe it was authorized to perform a security assessment, after which these agents scanned the network, moved between systems, and elevated their privileges, though not all assistants fell for this; some directly refused to execute. Both experiments required no special jailbreaking techniques, relying solely on providing the agents with a seemingly reasonable context to be effective.Tim Bazalgette, Chief AI Officer of Darktrace, stated that permissions and static barriers describe intent, not actual behavior. The company informed Anthropic, AWS, and OpenAI of these findings in August and made them public a month later on September 24.

Bitcoin News posted on the X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the security landscape of Bitcoin. Large language models have significantly reduced the cost of discovering vulnerabilities, allowing attackers to potentially find catastrophic vulnerabilities for just a few hundred dollars in computing costs.For Bitcoin Core, Project Loupe, the Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or severe vulnerabilities have been found. Gögge stated that relying on stronger models to discover vulnerabilities before attackers is not a sustainable security strategy. Developers should build testing infrastructure that can proactively prevent entire classes of vulnerabilities through automated testing, fuzz testing, and property-based testing. Key components of Bitcoin Core have accumulated over 100 years of CPU fuzz testing and have undergone decades of Bitcoin node network simulation.

According to Business Insider, Discovery Loop, an AI startup founded by former Google Chief Scientist Jeff Dean after his departure, is undergoing a new round of financing with a target valuation of approximately $50 billion. Just weeks ago, the company completed a financing round of $1 billion at a valuation of about $10 billion.Discovery Loop is dedicated to automating experiments through AI, accelerating major discoveries in the fields of science and engineering. The first round of financing was led by Radical Ventures and Khosla Ventures, with participation from Lightspeed, Kleiner Perkins, and others. Alphabet was also a founding investor. The company's co-founder team consists of Google technology veterans, including Sanjay Ghemawat, Quoc Le, and Oriol Vinyals, who each have deep expertise in distributed computing, deep learning, and reinforcement learning, respectively.

According to the Securities Times, at the Fourth Cybersecurity (Tianjin) Forum, Zhou Hongyi, the founder of 360 Group, gave a keynote speech, stating that AI has changed the landscape of cyber offense and defense, and traditional solutions are difficult to sustain. He emphasized the need to create a new automated offense and defense system centered on "model governance," using AI capabilities to address AI risks, ensuring the safety of large models, the reliability of generated content, and the credibility of output results.Zhou Hongyi also proposed that there should be lifecycle management for intelligent agents, establishing an auditable, intervenable, and interruptible control mechanism, and called for the cybersecurity industry to quickly form a system for AI vulnerability discovery, automated defense, and intelligent agent security.

OpenAI stated that its upcoming Astra model can autonomously discover previously unknown software vulnerabilities and convert them into usable attack vectors without human intervention, making it the company's first model to reach the "Critical" cybersecurity capability level threshold. In a blog post released on Tuesday, OpenAI mentioned that according to its Preparedness Framework, reaching this level means the model can discover zero-day vulnerabilities and develop usable exploit code in hardened real systems without human involvement, or design and execute attacks based solely on a high-level objective.In testing, Astra achieved a 100% score in benchmark tests for developing exploit code based on known vulnerabilities and discovered two previously unknown vulnerabilities in another internal test. Additionally, the model successfully broke through a hardened browser sandbox and executed commands on the host machine, while gaining root access by exploiting multiple weaknesses in the operating system. OpenAI stated that it has delayed some of Astra's development progress to enhance security measures and plans to make its advanced cybersecurity capabilities available only to selected testers.This capability is particularly relevant to the cryptocurrency industry, as software vulnerabilities can be converted into financial losses within minutes. CoinDesk reported in June that increasingly powerful AI models can compress the process of searching code, discovering misconfigurations, and assembling attacks from days or weeks to machine speed. Security researchers noted at the time that the significant change was not the emergence of new categories of attacks, but rather the dramatically increased speed at which existing vulnerabilities are discovered and exploited.

Balancer posted on platform X that the team discovered a vulnerability in the legacy Balancer v1 contracts that allows for the depletion of LP funds. These pools are deprecated and cannot be paused, and users are advised to withdraw funds proportionally through legacy.balancer.fi. Other Balancer products are not affected.

Crypto KOL Ansem stated that he judged two weeks ago that the current market is still in a very early stage, and he maintains this view. Even if investors have not yet allocated relevant tokens, starting to pay attention to the market, formulating trading plans, and setting staggered buying prices now may still yield high returns.For tokens that have already entered the price discovery phase, Ansem believes that the current price is still close to the starting point of this breakout, and subsequent positions may not provide significantly better entry points than the current stage. Therefore, investors who have not yet taken positions should formulate plans in advance, rather than waiting to make decisions after market attention fully heats up.

The cryptocurrency payment platform Rain stated that its monitoring system detected a vulnerability affecting a small number of programs using outdated versions of Solana contracts, while other programs were not affected. Rain immediately launched an investigation to determine the scope of the incident.The Rain team has successfully upgraded all programs using outdated versions of Solana contracts, and the related issues have been resolved. Rain will continue to monitor the situation and has hired a third-party forensic expert to conduct an investigation, while also cooperating with law enforcement and relevant regulatory agencies. All affected users will receive full compensation, and Rain has begun the remediation process and is committed to completing the handling swiftly and responsibly.

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

According to CoinDesk, the developers of the Bitcoin Lightning Network payment software Core Lightning (CLN) issued an urgent warning to node operators after the team received a large number of AI-generated security reports, revealing several real vulnerabilities. The development team advised operators not to directly shut down the machine power but to restart the software in "--offline" mode, which stops communication with other Lightning Network nodes while still keeping it operational to continuously monitor the Bitcoin blockchain and protect the funds in the payment channels.The Core Lightning team began receiving a large number of AI-generated vulnerability reports since early August, some of which have been confirmed to be valid. Developers will keep the details confidential for two weeks to complete the patch development and plan to release a signed patch version for operators to verify the source. The source code and vulnerability details will be made public after the confidentiality period ends.This is the second AI-related security incident in the Lightning Network this month. Earlier in early August, BTCPay Server experienced a vulnerability that led to the leakage of credentials for some Lightning Network nodes and theft of funds. Additionally, the "Bitcoin Red Team," composed of 16 developers, used AI models to scan 390 Bitcoin code repositories at the end of July, discovering nearly 5,000 issues, 85 of which were rated as critical.

According to Decrypt, Swiss hardware wallet manufacturer BitBox discovered two serious vulnerabilities and one bootloader issue in its firmware during an internal AI audit, and has released the Dixence security update. Exploiting the vulnerabilities requires a combination of phishing attacks and user unlocking of the tampered device, but BitBox stated that no user funds were stolen and the recovery phrases were not compromised.The bootloader vulnerability affects the older BitBox02 models, allowing attackers to load malicious firmware to steal assets; this issue has been partially fixed in the Oeschinen update from July. The second serious vulnerability affects the pre-initialization phase of Multi version devices, potentially allowing arbitrary code execution. The third issue involves the silent payment feature, which cannot directly steal coins but may lock funds. The new Nova version is not affected. BitBox warns that users with old firmware need to install the update as soon as possible, and currently, there are no reports of user fund losses.

Decred official X account (@decredproject) released a security notice, stating that a security vulnerability has been discovered in the Decred (DCR) network, and a patch will be released on August 18 at 10 AM Eastern Time.For security reasons, the official recommends that users suspend voting and mining operations until the upgrade is completed. An announcement will be synchronized on the official X account as soon as the patch is released.

Bitcoin News posted on the X platform that after two weeks of using cutting-edge AI to scan almost the entire Bitcoin open-source ecosystem for vulnerabilities, Bitcoin Red Team member @callebtc stated, "The easily discoverable vulnerabilities have been addressed," and maintainers are verifying "a large number" of serious and high-risk vulnerabilities.@callebtc indicated that the main findings include: decades of accumulated open-source technical debt are being exposed alongside AI capabilities that can discover vulnerabilities at speeds and scales unattainable by human researchers; Lightning seems particularly vulnerable, with its complexity meaning its security status is "worse than average"; unmaintained Bitcoin projects should be considered vulnerable until their security is confirmed.Projects that began building AI security and auditing processes months ago are now in a completely different position compared to those that have been waiting until now. The Bitcoin Red Team has now completed a foundational scan of almost the entire Bitcoin open-source ecosystem. Easily discoverable vulnerabilities have mostly been addressed, but as AI capabilities improve, external red team testing may need to continue indefinitely. Despite discovering and reporting "a large number" of real serious and high-risk vulnerabilities, @callebtc believes this process will ultimately make Bitcoin stronger. The same AI security review will soon expand to areas far beyond Bitcoin.

According to a report by Decrypt, Israeli cybersecurity company ASecurity released a report stating that a researcher used publicly available AI models to discover multiple vulnerabilities in the Zoom annotation tool in less than 24 hours with fewer than 20 prompts, and constructed an exploitable attack chain. The vulnerabilities are numbered CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, allowing attackers to remotely execute code in meetings without any action from the victim, control their devices, steal data, and activate the microphone or camera.The attack was tested successfully on Windows, macOS, Linux, Android, and iOS versions of Zoom. ASecurity claimed it reached a "national-level" standard, whereas previously constructing such exploitation tools required months of work and a substantial budget from professional teams. ASecurity reported the first vulnerability to Zoom on June 10, and Zoom released fixes between June 22 and July 20, but the server-side protections in end-to-end encrypted meetings could not filter malicious messages, requiring users to update manually. A Zoom spokesperson confirmed that the issue has been resolved and advised users to keep their versions up to date.