extension

According to a report by the Korean Central News Agency cited by the Korean News Agency, Kim Yo-jong, the Minister of the General Affairs of the Workers' Party of Korea, made a statement on the Binance hacking incident on the 4th, marking her second comment on the matter within three days.Kim Yo-jong stated that North Korea does not view the Binance hacking incident as an accidental or isolated event, but rather as an extension of Washington's hostile policy towards North Korea, with the United States attempting to gain political benefits from this incident. She expressed that "dialogue is clearly included" among the options for maintaining peace, but for North Korea, dialogue does not necessarily equate to national interests; there is no need for North Korea to sit down with "untrustworthy and hostile individuals," and she hinted at the possibility of taking strong countermeasures.Previously, on November 2, Kim Yo-jong had made a statement saying that the allegations were "a political provocation by the United States" and "absurd rumors." U.S. President Trump had previously stated that if North Korea was behind the hacking incident, he would communicate with North Korea about it.

On October 30, security researcher Paul McCarty (6mile) posted on the OpenSource Malware blog that Anthropic's Claude Code VS Code extension was tampered with that day, and a malicious version 2.1.313 was published to the Open VSX registry. The extension is identified as anthropic.claude-code@2.1.313, and a 66-line loader was inserted before the normal extension code in the main JavaScript package. The researchers stated that currently, only the analyzed Open VSX version has been confirmed as a malicious sample, and a threat report has been submitted for the same version in the Microsoft VS Code marketplace out of caution.The article states that the unpacked extension and bundled binaries are consistent with the normal version, with differences only in extension.js. The extension loads this file after VS Code starts and when the Webview opens, triggering without the user needing to initiate a Claude conversation. The loader writes an attacker key labeled svc-telemetry to the user's SSH configuration, attempts to enable local SSH services, establishes a reverse tunnel to 134.209.82.225, and sets persistence on macOS, Linux, and Windows, then sends host reconnaissance information to port 8099 at that address via unencrypted HTTP. No additional executable files or scripts are downloaded during the injection phase.The researchers stated that the owner of the affected Open VSX extension is Anthropic employee Igor Kofman, and it is currently unclear whether his account or another release link was exploited; Dean Hardcastle informed him at the time of the incident. The article clarifies that the source of the analyzed directory has not been established, and the related findings cannot independently prove that Anthropic's official marketplace or distribution infrastructure has been compromised; the identity of the attacker and the ownership of the infrastructure have also not been verified. The text suggests searching for related file paths, key annotations, and startup items, blocking ports 22 and 8099 of 134.209.82.225, and rotating credentials accessible by affected accounts on a clean system.

MetaMask has set Stellar as the default network for mobile applications and browser extensions. Existing multi-chain accounts will receive Stellar addresses derived from their mnemonic phrases and will support XLM, USDC, and Soroban tokens.

The self-custody wallet Kraken Wallet under the cryptocurrency trading platform Kraken announced on X that the Kraken Wallet browser extension is now live. The official source then provided the download link to the Chrome Web Store, allowing users to install and use it in their browsers.Washington Sanchez, the product lead for Kraken Wallet, introduced that the extension supports multiple networks including Bitcoin, Ethereum, Solana, Ink, Base, and Robinhood Chain. Users can create and import wallets using mnemonic phrases or private keys, with private key support including BIP39. Users can also utilize a watch-only wallet or log in using email, Google, Apple, and passkeys. The extension supports single-chain and cross-chain exchanges as well as cross-chain bridging, with a fee of 10 basis points.

Blockchain security company Socket discovered 16 counterfeit Rabby and OKX wallet extensions on the Firefox browser. According to Socket, Mozilla removed these extensions before October 5.Socket pointed out that removing these malicious extensions does not ensure the safety of wallet users whose mnemonic phrases have already been compromised.

The Polkadot Community Foundation issued a security warning on the Polkadot forum stating that versions 3.1, 3.3, 3.4, and 3.5 of the browser extension for the third-party wallet Fearless Wallet contain malicious code, which may send users' private keys to a server controlled by attackers when unlocking the wallet.The related code was added on February 19, 2025, with a code change named "TON ecosystem," and it will take effect intermittently from February 2025 to October 10, 2026.

According to CoinDesk, stablecoin payment startup Velocity announced that it has completed a total of $48 million in Series A funding, with a valuation of $200 million. This round includes an additional $10 million investment from Visa Ventures, Circle Ventures, Haun Ventures, Ripple, Translink Capital, and Mirana Ventures. Previously, the company completed $38 million in Series A funding in July.Velocity is headquartered in London, and its platform aims to help payment companies and banks use stablecoins for settlement, liquidity, and fund management without replacing existing systems. CEO Eric Queathem, who previously worked at Worldpay, which handled over $2 trillion in payment volume annually, believes that for the past 15 years, capital has been concentrated on improving the consumer front-end experience, while the back-end settlement layer has been neglected.Visa's involvement is particularly noteworthy, as Velocity does not believe that stablecoins will replace bank cards, but rather expects blockchain digital assets to take on more funding and settlement functions beneath the existing payment experience. Queathem anticipates that in the next five years, global enterprises will hold on-chain assets, and the partial on-chain funding of enterprises will create a greater infrastructure demand than merely stablecoin deposits and withdrawals.

According to EU-Startups, Zurich-based preventive healthcare company Aeon announced the completion of its seed round extension financing and simultaneously acquired the German blood diagnostics platform Aware Health, bringing the total amount of seed round financing to over 12 million euros (approximately 14 million dollars).This round was co-led by Araya Ventures, with existing investors Concentric, GoHub Ventures, Kadmos Capital, Calm/Storm Ventures, N&V Capital, and Bigwave Capital participating.

According to "Digital Assets," the number of signatures for the petition in the South Korean National Assembly to postpone the taxation of virtual assets by 2 years has exceeded 32,000. The threshold for the National Assembly petition is 50,000 signatures, and if an additional 18,000 signatures are collected before September 20, the petition will be formally submitted for review by the relevant standing committee.The reason for the petition is that taxing digital assets will lead to a significant decline in exchange revenues, which in turn will result in a decrease in corporate tax revenue. Currently, the government insists on implementing the taxation normally starting in January 2027, while the People Power Party opposes it, citing reasons such as inadequate infrastructure.

Indian enterprise voice AI startup Ringg announced that it has secured a $10 million investment from Peak XV Partners, as an extension of its Series A funding; the company had previously completed a $5.5 million Series A funding earlier this year, bringing the total funding to $15.5 million.Ringg initially started with text-to-speech technology and has now shifted to providing AI agent services for enterprises, with clients including Cred, Flipkart, Practo, Groww, and PolicyBazaar. Its voice AI has been integrated into approximately 1,200 clinics of Practo for patient appointments and post-visit follow-ups.

According to a report by Decrypt, security company Socket released research results linking 77 Firefox extensions to what it calls a "wallet theft factory," with 40 confirmed to have malicious behavior.These extensions disguise themselves as Web3 products like OKX, Rabby Wallet, and TronLink, tricking users into importing wallets through fake wallet interfaces or using modified real wallet code to steal mnemonic phrases and private keys as users input them. Mozilla's signature records show that this activity lasted from March 9 to August 3, and multiple extensions were still online at the time of Socket's report.About half of the extensions displayed realistic wallet interfaces and prompted users to import existing wallets, thereby intercepting the inputted mnemonic phrases or private keys; another 13 were modified versions of Rabby that sent account data stored in wallets to external servers while functioning normally; and 5 specifically collected saved credentials and clipboard content.Additionally, 37 extensions disguised themselves as password generators, dark mode toggles, VPNs, currency converters, and note-taking tools, but actually ran sports score applications sharing the same hardcoded credentials. Nine confirmed malicious extensions were initially released as score applications for sports like football and basketball, with subsequent updates replacing them with wallet theft code.Socket named this activity the "wallet theft factory," but cautioned that it has not confirmed whether all extensions are controlled by the same operator. The Socket team stated that any user who has entered mnemonic phrases or private keys into these extensions should consider it a "permanent leak" and immediately transfer funds to a new wallet, as uninstalling the extensions cannot undo the mnemonic phrases sent elsewhere.

According to GoPlus monitoring, the VSCode extension Solidity Pro has been poisoned, and historical versions have malicious capabilities such as data theft and remote execution.It is recommended that developers immediately check the relevant extensions they have installed and increase their vigilance towards third-party plugins.

The cross-chain bridge protocol Across Protocol published an update on platform X regarding the progress of the ACX exchange plan related to "The Bridge Across." It stated that the team is working with legal advisors to address the final obstacles, and the timeline has been slightly delayed, with the exchange portal expected to go live by the end of August.This plan is part of Across's efforts to advance the exit and structural transformation of the ACX token, allowing holders to choose to exchange ACX for equity in the new entity or redeem it through the exchange portal. Across noted that some exchanges may begin delisting ACX, which is a normal expectation and does not affect the exchange plan. Users are advised to transfer their tokens to a self-custody wallet to participate when the portal goes live.

According to Jinshi reports, the Israeli Parliament's Foreign Affairs and Defense Committee voted on August 3 to approve the government's application for an extension, prolonging the military emergency mobilization order for two months until September 30 of this year.According to the decision, the Israel Defense Forces are permitted to call up a maximum of 240,000 reservists. Since the outbreak of the new round of the Israel-Palestine conflict in 2023, such applications for extending the emergency mobilization period have been approved every few months.

On July 29, Tibo, the product lead for OpenAI Codex, announced on X that all usage limits for ChatGPT Work and Codex users have been reset, and released a statement regarding the issue of rapid consumption of GPT-5.6 Sol usage.In the previous weeks, a large number of users reported that the consumption speed of Codex limits exceeded expectations. OpenAI emphasized that it has not reduced the usage quotas of any subscription plans. After investigation, several reasons were found: Sol is more inclined to work for longer periods, execute more tool calls, and coordinate complex workflows than previous models; it consumes more tokens at the same reasoning level; programmatic tool calls (code mode) allow Sol to execute tool calls in parallel, resulting in more responses and higher usage per round; the distribution of impact is extremely uneven, with median user efficiency being acceptable, but heavy users handling complex tasks consuming far more than expected.OpenAI stated that multiple improvements have been completed, and it is expected that usage endurance will be extended by about 18% in typical usage scenarios. Tomorrow, the five-hour limit that was paused during the investigation will be restored. OpenAI acknowledged that "capabilities and efficiency do not always improve synchronously, and some issues only become apparent after large-scale real-world use; we should have realized this earlier."

According to the security agency Slow Fog, the malicious TRAE IDE extension juannegro.solidity disguises itself as a Solidity plugin and acts as a cross-platform malware delivery mechanism. This extension automatically executes and establishes persistence after the IDE starts, and it also uses Ethereum smart contracts to store and retrieve dynamic C2 configurations, allowing attackers to update C2 endpoints and payloads without needing to re-release the extension.Although the extension has been removed from Open VSX, it was still available through the TRAE marketplace as of July 18. Users who have installed it should immediately delete it and check their systems for compromise.

According to the latest official announcement from the Chrome Web Store, the platform will officially implement the updated Developer Program Policy starting August 1, 2026. This update clearly delineates boundaries for regulated goods and services, listing "prediction markets" as a prohibited product category, strictly prohibiting any extensions from offering, facilitating, or supporting real-money trading based on prediction results.In addition, the new regulations further tighten data privacy and AI safety standards. The policy requires that user data collected by extensions must be strictly and exclusively used for the single purpose disclosed; if there is a change in data processing methods, users must be proactively notified. At the same time, extensions designed to circumvent AI-driven service safety protections, usage restrictions, and other protective mechanisms are explicitly prohibited. After August 1, if any extensions are found to be non-compliant with the above policies, the Chrome Web Store will take enforcement actions.

According to The Defiant, ENS community member Christoph Jentzsch proposed on the X platform that the ENS DAO dissolve itself, stating that "the ENS DAO has collapsed," and suggested destroying the ENSv2 Universal Router keys and reallocating the remaining funds, officially transforming ENS into a public infrastructure. Jentzsch, who wrote code for "The DAO" in 2016 and currently operates Tokenize.it, stated that he does not hold any formal position in ENS governance.Previously, ENS co-founder Nick Johnson unilaterally vetoed the security council renewal vote using about half of the active voting power of the protocol, while about two weeks ago he supported another proposal to expand the ENS Foundation's control over the treasury by delegating nearly half of the active voting power to himself.

Sonic Labs released the latest progress update, announcing that the Fantom Opera network will continue to operate until at least the end of 2026, and will continue to provide funding support for the cross-chain bridge during this period.The team stated that this decision was based on community feedback, as there were previous plans to cease operations of Fantom Opera by the end of this month. Meanwhile, Sonic Labs announced a new management structure, appointing Matt Visser as CEO and Kosta Kourkoumelis as COO, and indicated that they will publicly disclose team member responsibilities in the future, gradually phasing out the unified "Contributor" label.In addition, the project team stated that they will begin to lift some restrictions on community accounts, allowing for the expression of normal critical opinions, while establishing dedicated communication channels for disclosure, support, feedback, and developer collaboration, and planning to launch a more comprehensive ticket support system and community engagement activities. The team indicated that they will regularly disclose operational progress in the future.

According to monitoring by Catcher Predict, in the event "The U.S. announces a new Iran agreement or ceasefire extension" on the prediction market Polymarket, the "Yes" option in the sub-market "June 16" experienced significant fluctuations in winning probability, soaring from 36% an hour ago to the current 54.5% (a fluctuation of 18.5%). Please note the impact of related breaking news.