fix

The Bitcoin wallet Electrum officially announced the release of version 4.8.3, stating that this update fixes a serious security issue and urges all users to upgrade. The official statement indicates that detailed information about the vulnerability will be released later.Its GitHub changelog marks 4.8.3 as a security update, with a release date of October 23. The Electrum official website reminds users to only download the software from the official website and to verify the GPG digital signature to confirm the source and integrity of the installation package.

Zero-Knowledge Proof Infrastructure Succinct has fixed a security vulnerability in its SP1 that could allow invalid proofs to be deemed valid.According to The Defiant, the flaw existed in the native Rust verification path from version 6.0 to 6.8.0, while on-chain Groth16 and Plonk verification executed by the Solidity verifier were not affected.

According to CoinDesk, the patch for the XRP Ledger vulnerability was delayed until November as the number of validator supports dropped to 26 (out of a total of 35), resetting the countdown timer for its effectiveness.Currently, the number of supports has risen back to 31, but due to the need to recalculate the two-week countdown, this fix has missed the originally impending effectiveness window.

The blockchain security research organization Asymmetric Research disclosed that there was a vulnerability in the governance program svmgov on the Solana chain: when validators did not participate in voting, independent votes submitted early by their delegators might not be counted in the final results. This vulnerability was reported to the Solana Foundation on July 10 and was fixed on the mainnet on August 3, ahead of the governance vote on August 24.Asymmetric Research estimated based on on-chain data that if the vulnerability had not been fixed, the approval rate of the SGP-0002 proposal, which aims to accelerate the decline of SOL inflation, could have dropped from the actual 67% to 66.65%, below the passing threshold of 66.67%. This vulnerability was fixed before the voting, and did not actually change the outcome of the proposal.

According to The Defiant, THORChain announced that its v3.21 upgrade will fix the FIN contract vulnerability on Rujira and allow the previously paused application layer to restart. The network has set the upgrade target at block height 28,366,100, with an expected time around October 23. After the restart, trading, lending, borrowing, and automated trading on Rujira will resume. Rujira's products run through smart contracts within THORChain, rather than on an independent blockchain, and the application layer can pause these contracts without affecting the underlying layer of THORChain.According to Rujira, the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding a position. The team paused the application layer with the support of node operators, and only one position from the Rujira team itself was affected, with no loss of user funds. Rujira attributed the vulnerability to a flaw in the position transfer function, rather than the trading logic of the liquidity strategy. On September 27, Rujira stated that the fix is located at the underlying layer and has been scheduled for the v3.21 upgrade.Regarding the restart window, Rujira proposed a conditional grace period in its plan on October 15: if the application layer is ready to resume, any credit account position with a loan-to-value ratio above 100% and meeting liquidation conditions will request node operators to pause the credit account contract for an additional 24 hours, allowing borrowers to replenish collateral before liquidation resumes. Borrowers can replenish collateral through Rujira Borrow or by directly transferring assets to the credit account address. Rujira indicated on October 10 that positions still deemed unsafe after the grace period may be liquidated when the liquidator triggers the process.

The XRP Ledger vulnerability fix package named fixCleanup3_4_0 is expected to officially take effect around 09:34 UTC on October 23. This fix package has received votes from 29 validators, surpassing the threshold of over 80% approval among the network's default 35 validators, and must be maintained continuously for two weeks. The countdown has been ongoing for nine days. Since there is no margin in the vote count, if any validator withdraws support, the countdown will restart.This fix package partially addresses the unsecured lending system that Ripple has been promoting to banks and payment companies since June, but this system has not yet been activated. Currently, the lending amendment has only 19 votes, and the vault amendment for holding funds has 21 votes, neither of which has started the countdown. Therefore, even if both reach 29 votes today, the lending function will not be available until early November at the earliest.As designed, lenders will deposit XRP or other tokens into the vault, and loan brokers will then lend out the funds for a fixed term. The ledger is responsible for recording the loans and tracking repayments, while brokers assess the borrower's qualifications off-chain. Since borrowers do not need to provide collateral, the broker's judgment becomes the only guarantee for lenders against default losses. Ripple has promoted this scheme to payment companies that need liquidity during cross-border settlement. Additionally, the fix package also closes a vulnerability that allowed accounts authorized to destroy tokens to create new tokens under specific conditions and adjusts the rounding of vault amounts as well as the rules for determining loan overdue and default.

Polygon Labs official announcement, Bor v2.1.3 is officially released to the public, previously distributed in private version form to validators and major infrastructure providers. This update fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution, both submitted by security researchers through the Immunefi bug bounty program.Unbounded keccak256 cache issue: Attackers can fill hundreds of MiB of cache during the speculative execution phase by constructing specific transactions, leading to node memory exhaustion and delayed block production. The fix is to set a capacity limit on the shared cache. Repeated code hash calculation issue in parallel execution: A single transaction can cause the parallel processor to take about 11 seconds, severely affecting node activity. The fix is to cache code hash results on a per-transaction basis.In addition, this update also includes several internal hardening measures: the transaction pool address filtering adds interception for EIP-7702 SetCode authorization, RPC batch execution pool concurrency limit fixes, consistency fixes for reading balances across self-destruct boundaries in parallel execution, and an automatic cleanup mechanism for pending transactions (default 3 hours). The affected versions are Bor v2.1.1 and v2.1.2. v2.1.3 is a non-hard fork, and nodes can upgrade individually without coordination. No exploitation records of the two vulnerabilities have been found on the mainnet and testnet Amoy.

According to Bitcoin News, the Bitcoin Lightning Network development kit LDK has fixed multiple security vulnerabilities, including a channel reconnection vulnerability that could be exploited by malicious counterparties, leading to the theft of funds. The LDK official released versions 0.1.13, 0.2.7, and 0.3-rc3 on October 3, recommending operators interacting with untrusted channel counterparties in production environments to upgrade. Currently, the related disclosures have not confirmed any actual losses caused by these vulnerabilities.

According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update that fixes vulnerabilities that could allow malicious nodes to steal funds. The most serious vulnerability involves Lightning channel reconnections. According to Bitcoin Optech, malicious nodes may falsely claim that they did not receive previously confirmed channel updates.The vulnerable LDK software could subsequently sign conflicting commitment transactions without properly recording the related transactions, allowing attackers to regain Bitcoin after forwarding the payment is completed. Versions LDK 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.

The XRP Ledger Foundation published a post on platform X to clarify the recent security vulnerability incident of the XRP Ledger, stating that the vulnerability could be used to bypass the limit of the total supply of XRP fixed at 100 billion coins, but it was fixed two weeks ago with version 3.4.1. After verification, no new XRP has been created, and the total amount of XRP currently circulating in the ledger is approximately 99.986 billion coins.The foundation stated that the vulnerability requires hundreds of deliberately constructed operations to trigger and that normal payment transactions are unlikely to be involved. In the future, they will strengthen formal verification, AI adversarial testing, security research collaboration, and vulnerability bounty programs with RippleX and the community. Regarding the repair process, the foundation explained that publicly releasing a patch could allow attackers to use AI to accelerate vulnerability analysis. To address this situation, the XRPL community coordinated efforts. Participants including the XRP Ledger Foundation, RippleX, core developers, and validators reached a social consensus to agree on a plan to directly release the repair program.In addition, version 3.4.1 was also adopted as the mandatory version for the network only after going through the normal amendment voting process and receiving over 80% support from validators for two consecutive weeks. Protocol changes still need to be completed through the amendment mechanism. Previously, J. Ayo Akinyele, the engineering lead at RippleX, also posted on platform X expressing high concern about the recently disclosed critical vulnerability issue in the XRP Ledger (XRPL) payment engine, which is a serious security issue that has existed in the codebase for over 10 years and theoretically could lead to XRP being over-created, breaking the fixed supply limit. However, the vulnerability was discovered by the security research organization Veria AI through Ripple's vulnerability bounty program before it could be exploited.

Regarding the critical vulnerability in the payment engine reported by Veria AI, RippleX engineering lead J. Ayo Akinyele stated that the XRP Ledger (XRPL) payment engine has a serious vulnerability that has existed for over 10 years, which could lead to the issuance of XRP beyond its fixed supply. This vulnerability was discovered through a bug bounty program and has not yet been exploited.The development team has released the xrpld 3.4.1 patch version and coordinated with validators to complete the network upgrade before public disclosure. Akinyele mentioned that AI is accelerating the speed of vulnerability discovery, and XRPL will increase proactive security investments, clean up technical debt, advance formal verification, and systematically eliminate potential risks in old code.

The XRP Ledger recently fixed a payment system vulnerability that could be traced back to 2015. This vulnerability could allow attackers to bypass the system's calculation limits on token exchange amounts through a specially designed payment transaction, generating and spending large amounts of XRP out of thin air, undermining the mechanism that caps the total supply of XRP at 10 billion.It was disclosed that attackers could create hundreds of accounts, allowing these accounts to post offers to exchange a small amount of tokens for a large amount of XRP, and then execute a transaction simultaneously. Due to a flaw in the software's calculation of the total transaction amount, the seller's account could receive the full XRP, while the buyer's account would need to pay almost nothing. Researchers Cayden Liao and Veria AI reported the vulnerability on September 22, and RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network. The development team released version 3.4.1 of xrpld on September 25 to fix the vulnerability.

According to security researcher BeakSec, Telegram Desktop previously had a high-risk vulnerability CVE-2026-107181. Attackers could pre-place command files in the group where the victim is located, then induce them to click on links redirected through the browser, using inter-process communication command injection to send local files to a group controlled by the attacker; if the session file is stolen and the user has not set a local password, the account may be taken over.The researcher stated that versions 7.2.8 and earlier are affected, and the vulnerability has been fixed in version 7.2.9 released on September 17.

The privacy public chain Zano team stated that a hotfix has been deployed in response to the inflation vulnerability that occurred last Friday, and the network is currently running stably on the updated chain. The chain previously rolled back the block height to 3,833,000, erasing the confirmed transaction records from the past 30 days.The Zano team indicated that third-party wallets, exchanges, and payment service providers must first update their nodes to the updated chain in order to safely resume transfers of ZANO and Zano issued assets. Service providers will announce recovery progress through official channels, and the recovery process for affected users is being prepared. The native asset ZANO saw a price drop of 32% this week and a decline of 40.6% since 2026. The official Zano X account stated that users can update their iOS, Android, and desktop wallets, and the team will soon announce more details on the recovery process.

Bitget stated that the vulnerabilities related to the security incident discovered on September 24 have been confirmed and fixed. The platform will gradually resume withdrawals after completing further security checks. Mandiant, a cybersecurity company under Google, and Slow Mist Technology are assisting in the investigation.The resumption schedule is as follows (UTC):September 28, 8:00: Bitcoin network BTCSeptember 29, 8:00: Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism network ETHSeptember 30, 8:00: Ethereum, BNB Smart Chain, Solana, Tron network USDTOctober 2, 8:00: Other tokens, fiat currencies, and peer-to-peer transactionsBitget mentioned that the suspension of withdrawals is a temporary security measure and is unrelated to the availability of user assets; account balances have not been affected, and the protection fund will cover the financial impact caused by this platform-level incident. The situation is currently under control, and unauthorized transfers will not occur again. Trading and deposit services are still operating normally. Users do not need to take any action in advance; the specific reopening situation will be subject to notifications from the platform and official channels.

Coinbase launches Bitcoin-collateralized fixed-rate, fixed-term USDC loans through Morpho Midnight, allowing borrowers to obtain USDC without selling their Bitcoin. The interest rate and repayment date for the product are determined at the start of the loan; if borrowers do not repay the USDC and interest before the due date, the collateralized Bitcoin may be reclaimed.The existing active or outstanding loan volume of Bitcoin-collateralized loans with floating rates supported by Morpho at Coinbase has exceeded 1.4 billion dollars, with collateral valued at approximately 3 billion dollars.

Coinbase has launched fixed-rate loans supported by the decentralized lending protocol Morpho, allowing users to collateralize Bitcoin to borrow USDC, locking in the interest rate and repayment date at the start of the loan. This product marks the first enterprise-level deployment of Morpho Midnight, with Coinbase responsible for the application experience, Morpho providing the credit infrastructure, and the Base network handling settlement.The existing active scale of Coinbase's Morpho floating-rate loans has exceeded 1.4 billion dollars, corresponding to collateral of about 3 billion dollars. This business will launch Bitcoin collateralized lending in early 2025, with plans to expand collateral to assets such as XRP and Dogecoin.

According to The Block, Coinbase announced the launch of fixed-rate Bitcoin collateralized loans through Morpho Midnight, allowing users to borrow USDC and determine the interest rate and repayment date at the time of borrowing. This new option is alongside Coinbase's existing floating-rate loans (based on Morpho Blue), which have outstanding loans exceeding $1.4 billion, corresponding to collateral of approximately $3 billion.Morpho launched Midnight on Base in July, introducing fixed rates and clear loan terms for on-chain lending. A Morpho spokesperson stated that Coinbase is the first mainstream consumer platform to offer Midnight loans on a large scale; since Midnight's launch, deposits have reached approximately $30 million. The outstanding loans for Morpho Blue across all integrations amount to $5.2 billion, with deposits reaching $16 billion.A Coinbase spokesperson did not disclose specific interest rates, stating that rates are determined by the supply and demand of both parties on the on-chain order book. Currently, Coinbase offers loans that mature at the end of the month or the end of the following month, and borrowers must repay before the due date; otherwise, lenders have the right to liquidate their collateral. Jacob Frantz, Coinbase's head of revenue and investment products, stated that Coinbase Borrow allows users to obtain liquidity without selling assets, and fixed-rate borrowing gives users greater choice in credit management. Morpho indicated that Midnight could also be used in the future to build structured credit products and loans collateralized by tokenized real-world assets, with more integrations in progress.

According to the official API data released by Kalshi, most of the dollar trading volume in the Ethereum perpetual contract trading on this exchange comes from a single recurring fixed-size order.In response, Kalshi stated that its related incentive program has been publicly filed. This data was compiled by The Defiant based on Kalshi's public API data.

Liquid Capital founder Jack Yi posted on the X platform, stating that he has repeatedly mentioned that July and August are the last times to buy the dip. The core idea is that the third wave of decline since 1011 is the final drop, and no one can determine where it will fall, influenced by factors like black swan events, similar to how the FTX incident caused BTC to drop excessively.However, the cycle time and volatility patterns will not be wrong; when the time comes, it is time to buy the dip. One should never expect to buy at the lowest price. As for why sometimes the statements are vague, after all, no one can be 100% accurate. Just like if you get it right ten times, no one remembers, but if you get it wrong once, it will always be on the chain. Also, outrageous rumors can ignite more enthusiasm than facts.