fix

According to The Defiant, the decentralized lending protocol Morpho deployed its fixed-term, fixed-rate lending agreement Midnight to Ethereum on September 8, expanding the product from the Base network to Ethereum, allowing Ethereum users to access USDC loans collateralized by WBTC or cbBTC. Morpho co-founder Merlin Egalite stated that the Ethereum launch will start with the "USDC | cbBTC and USDC | WBTC markets" and will gradually expand.The core difference between Midnight and Morpho Blue lies in interest rate certainty. Blue uses open loans where interest rates fluctuate according to a formula; Midnight, on the other hand, trades credit units at market-priced rates with fixed terms, allowing borrowers to determine financing costs in advance, and lenders can lock in returns instead of bearing interest rate changes with each block. Midnight lenders purchase credit units at prices below the one-to-one redemption value at maturity.However, the largest potential source of funds for Midnight remains constrained. The Morpho Vaults, holding approximately $5 billion in deposits, can only allocate to the Morpho Blue market until the DAO enables the Midnight configuration. Morpho co-founder and CEO Paul Frambot stated that enabling the Vault configuration requires just one DAO transaction, but Vault activation is expected to be achieved in the fourth quarter. At launch, the total deposits in the Ethereum Midnight market were approximately $7.41 million, with outstanding loans of about $2.63 million.

According to Bitcoin News, Blockstream has notified "white hat" hackers that the vulnerability has been fixed, and 4,000 BTC can be safely returned. The hacker, who previously extracted about 4,000 BTC from the Liquid network, expressed willingness to return the funds but needed to wait for the vulnerability to be fixed. The entire negotiation process was conducted publicly through Bitcoin OP_RETURN messages.The hacker initially proposed to return "most" of the BTC but later changed their stance, requesting that the vulnerability be fixed first: "Please fix the vulnerability first. The latest submitted code puts the chain at risk. Ensure that every node has been patched, and then we will confirm the fix and safely return the funds."The hacker also sent encrypted details of the vulnerability to Blockstream. About two hours ago, Blockstream responded with a PGP-signed OP_RETURN message: "The cross-chain bridge nodes have been patched and can safely return the funds." Currently, 3,998.5 BTC remains under the hacker's control.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

Term Labs released a technical report on the security incident, confirming that all fixed-rate loan positions in the affected vault have been restored as of August 25. The incident was limited to the liquid balance within the Term vault, and Term V1 and V2 contracts were not compromised, with the direct lending market remaining open.Attack process: From August 17 to 18, the attacker funded an operational wallet through Tornado Cash and submitted a malicious proposal disguised as a governance proposal, setting the governance delay parameter to zero and removing the window for LP blocking changes. On August 23, the attacker executed two batches of attacks, extracting assets from the ETH and USDC strategies and transferring them to the attacker's wallet. Term Labs stated that it has cooperated with law enforcement, the affected vault and strategies have been closed, and the contracts have been upgraded and migrated before expiration.

Nomura Securities' digital asset subsidiary Laser Digital announced a partnership with Keyring Network to serve as the risk governance entity for the institutional lending market, with the first market set to launch on Euler Finance. The parties did not disclose committed capital, fee terms, or launch dates.According to the cooperation framework, Keyring provides infrastructure and tools, including access verification, quantitative risk parameter setting, and clearing framework design; Laser Digital's asset management department contributes governance standards, portfolio structure, and market practices. Both parties pointed out that institutional participation in DeFi lending faces four major obstacles: licensing, vulnerability risks, governance, and settlement. The solution combines zero-knowledge licensing, quantitative risk modeling, network insurance, and Keyring's settlement technology.According to DefiLlama data, Euler has a total value locked of $368.8 million across 17 chains, with outstanding loans of $555.4 million. Laser Digital previously supported ZIGChain's emerging market private credit in August, while Keyring introduced a zero-knowledge identity layer for the DeFi vault on Avalanche in August 2025. Nomura established Laser Digital in 2022, with operational headquarters in Dubai and Switzerland.

According to CoinDesk, U.S. Treasury Secretary Yellen has reportedly urged Japan to raise interest rates to curb the continuous depreciation of the yen, highlighting how traditional monetary policy is susceptible to government and external factors.In contrast, Bitcoin's monetary policy is pre-set by code, with new coin issuance following a fixed rhythm and halving approximately every four years, providing higher predictability. However, Bitcoin still struggles to escape the impacts of traditional financial markets in the short term.If Japan's interest rate hike leads to a rapid appreciation of the yen, long-accumulated low-interest yen financing trades may be closed out, potentially triggering sell-offs in stocks, bonds, and crypto assets. In August 2024, the Bank of Japan's interest rate hike strengthened the yen and put pressure on risk assets, including Bitcoin.From a technical perspective, the BTC 50-day moving average is currently trending upward and is close to crossing above the 200-day moving average, which may form a "golden cross." However, analysts believe that moving averages have a lagging nature, and the historical predictive effectiveness of the golden cross as an independent indicator is not stable.

Polygon Labs disclosed that it has fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks, with the related fixes privately deployed before public disclosure. According to a forum post released on Wednesday, the team packaged the fixes into the Austin hard fork of the Bor client and the Kyoto hard fork of the Heimdall client, both of which followed the standard process for fixing issues that affect consensus: first validated on the Amoy testnet, and then publicly disclosed once the mainnet was activated and the network was secure.The Austin fork fixed two denial-of-service paths in block processing, including a vulnerability where malicious block producers could crash peer nodes by filling them with oversized field data. The Kyoto fork addressed a broader range of consensus hardening issues, with the most severe vulnerability allowing an attacker to force the entire validator set to perform costly and coordinated work with just one crafted transaction—the cost of constructing the transaction is low, but the network processing cost is high. Polygon emphasized that none of the vulnerabilities were observed to be exploited on the mainnet and have been proactively addressed. The two upgrades are now mandatory for node operators and have taken effect without the need for state migration or resynchronization.This disclosure comes at a critical transformation period for Polygon, which has completed the migration of the traditional MATIC token to POL as part of a comprehensive overhaul of its network architecture. The news did not boost the price of POL; according to CoinGecko data, POL traded at approximately $0.09983 on Sunday, down 2.3% in 24 hours, down about 6.8% over the past week, and down about 60.8% over the past year, with a market capitalization of approximately $1.07 billion.

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.

Polygon disclosed multiple previously undisclosed security vulnerabilities that were recently fixed through two hard forks, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial of service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that these vulnerabilities were fixed through the Austin and Kyoto hard forks, and the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most serious issue involved Heimdall, where a carefully crafted transaction could force validators to perform excessive processing work, thereby disrupting the network. The Austin hard fork also fixed two denial of service risks in Bor that could slow down block processing or cause node crashes.Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively deployed before the details were made public. Nodes running outdated client versions have fallen out of consensus after the hard fork activation height and must upgrade to rejoin the standard network. All Polygon PoS nodes are required to upgrade to Bor v2.1.0, and validators and full nodes must upgrade to Heimdall v0.11.0, both upgrades are now effective on the mainnet.

The cryptocurrency payment platform Rain stated that its monitoring system detected a vulnerability affecting a small number of programs using outdated versions of Solana contracts, while other programs were not affected. Rain immediately launched an investigation to determine the scope of the incident.The Rain team has successfully upgraded all programs using outdated versions of Solana contracts, and the related issues have been resolved. Rain will continue to monitor the situation and has hired a third-party forensic expert to conduct an investigation, while also cooperating with law enforcement and relevant regulatory agencies. All affected users will receive full compensation, and Rain has begun the remediation process and is committed to completing the handling swiftly and responsibly.

The fixed-rate lending protocol TermMax (parent company Term Structure Labs) announced a strategic investment from YZi Labs, with the amount undisclosed. TermMax is a selected project in the YZi Labs incubation program EASY Residency for the third quarter. The protocol has raised over $8 million in total financing, with previous investors including lead investor Cumberland DRW from the 2023 seed round, as well as HashKey Capital, Decima Fund, Longling Capital, MZ Web3 Fund, and other institutions.The TermMax mainnet is set to launch in April 2025 and is currently deployed on 10 EVM-compatible chains, operating 60 fixed-rate markets and 40 strategy vaults, with a total locked value of tens of millions of dollars and over 1.5 million registered wallets. The protocol achieves fixed-rate lending by splitting debt into three tradable tokens: FT (zero-coupon bonds), XT (interest and option value), and GT (leverage position certificates), with settlement using physical delivery.Its token $TMX completed its TGE on August 25, with trading on the first day across platforms such as Binance Alpha, Kraken, Bitget, MEXC, and KuCoin. It is reported that TermMax will subsequently advance in three directions: on-chain yield curves, interest and options markets for tokenized stocks, and the institutional financing platform TermPrime.

Ledger's Chief Technology Officer Charles Guillemet stated that there has recently been "FUD" targeting Ledger in the market, as a smart contract security company claimed to have discovered vulnerabilities in the Ledger Ethereum application. Guillemet mentioned that there indeed were vulnerabilities related to certain Clear Signing processes in the Ledger Ethereum application, but these vulnerabilities were discovered by Ledger's security research team Donjon using AI-driven vulnerability research tools, and the fixes were completed and deployed two weeks ago. Users can obtain protection by timely updating their Ledger device firmware and applications.The relevant security company contacted Ledger's bug bounty program only after the fixes were completed, did not follow responsible disclosure processes, and did not communicate with the bug bounty team, yet implied in subsequent content that the issue had not been resolved. This approach is not true security research but rather a way to create panic for attention. AI is changing the cybersecurity landscape, and both attackers and defenders can enhance efficiency with AI, but AI-driven security research can only truly enhance the security of the entire ecosystem when basic security principles such as responsible disclosure and pre-release verification are followed.Guillemet finally reminded Ledger users to keep their device firmware, Ledger applications, and related software up to date to automatically receive the latest security fixes and research results. Users should not be influenced by the related "FUD" and should timely update their software and maintain safe habits.

Core Lightning maintains that node operators should shut down their nodes unless they upgrade to an unreleased version. This warning was spread via Discord and amplified by Cashu protocol developer Calle, who stated that there is a serious vulnerability. The fix binary has not yet been released, and the details of the vulnerability are under a two-week confidentiality period.This is the fourth security alert for Bitcoin infrastructure in four weeks. Previously, a Coldcard firmware vulnerability led to approximately $114 million in BTC being stolen, and issues have also arisen with Boltz and BTCPay Server. The CLN team stated that they have received multiple AI-generated CVE reports in the past 10 days and are intensifying verification and fixes.

The Solana ecosystem DeFi protocol Kamino announced the launch of Kamino Fixed Rates, positioned as an on-chain fixed-term, fixed-rate credit architecture solution. The product is now live in a private testing version, with a public version planned for release in the third quarter of 2026.According to the introduction, Kamino Fixed Rates aims to provide a lending framework for the on-chain credit market with both the term and interest rate locked in advance. Kamino also released a related light paper for the market to review the product design and mechanism description.

The Ethereum client Besu has fixed five security vulnerabilities discovered by the blockchain security company CertiK in version 26.7.1 released on July 27, and published four detailed security announcements on August 14. The details of the vulnerabilities were disclosed later to allow node operators to complete the upgrade deployment.Jialiang Chang, CertiK's Director of Security Engineering and Senior Audit Partner, stated that the arrangement of releasing patches first and details later provides an 18-day buffer period, allowing node operators to identify affected deployments, test the new version, and coordinate with validators or consortium participants to complete the upgrade. The relevant vulnerabilities involve block broadcasting processing, future height consensus proposal caching, WebSocket subscription limits, and JSON-RPC filter creation. If not fixed, attackers could exhaust node memory or thread resources, affecting node availability and consensus processing.CertiK conducted adversarial testing on peer-to-peer, HTTP RPC, WebSocket RPC, and consensus interfaces in a private multi-node test network using the Chain Scan method, and provided reproducible testing tools to the Besu team. CertiK is updating Chain Scan to expand around-the-clock multi-node testing for public chain networks.

In response to the recent rumors about "vulnerabilities in the Ledger Ethereum application," Ledger's Chief Technology Officer Charles Guillemet tweeted that there was indeed a bug related to a specific clearance process, which was discovered by Ledger's security team Donjon using AI vulnerability research tools.The vulnerability has been fixed and deployed two weeks ago. Users just need to keep the Ledger application updated to be protected.

Serenity stated that leveraged traders have shifted from AI stocks back to Hyperliquid (crypto market) and biotech targets, which they believe may help AI stocks recover more quickly. The Korean ETF EWY rose mainly due to the stock buyback of SK Hynix, while Samsung's foundry prices were raised by about 10% to 15%.Serenity mentioned that SK Hynix disclosed its CPO roadmap, which involves a photonic intermediary layer connecting memory, potentially expanding the addressable market and driving demand in the supply chain for lasers, photonic integrated circuits, and packaging. In addition, following the successful IPO of Changxin Memory (CXMT), Yangtze Memory (YMTC) is seeking to go public in the next quarter.Optoelectronic manufacturer Tyntek hit the daily limit, with its order visibility extending to 2028, reflecting an imbalance in supply and demand for optoelectronic diodes in the photonic industry. Furthermore, the shortage of high-end PCB drilling needles continues, with AI data centers, servers, and optical communications driving demand for PCBs, HDI, and packaging substrates, while tungsten prices are also rising.

The cryptocurrency wallet Rabby Wallet posted on platform X that the team has fixed a vulnerability after discovering it and released an update on August 11. The mobile application is not affected.The conditions that triggered the vulnerability are extremely limited: the wallet must be connected to a malicious website, and the user must manually set the auto-lock timer to 10 minutes (other settings are not affected). No exploitation in the wild has been found so far.

Decred announced that the mandatory patch version v2.1.6 has been released, which includes a fix for a critical security issue related to consensus, preventing potential periodic de-anonymization mixing attacks.In addition, this patch also addresses several possible network-related denial of service (DoS) attack issues and improves the expiration duration of mixing sessions. The official urges users to upgrade as soon as possible, while noting that the Windows version of Decrediton has not yet been released and is expected to be launched the following day.