lit

Zero-Knowledge Proof Infrastructure Succinct has fixed a security vulnerability in its SP1 that could allow invalid proofs to be deemed valid.According to The Defiant, the flaw existed in the native Rust verification path from version 6.0 to 6.8.0, while on-chain Groth16 and Plonk verification executed by the Solidity verifier were not affected.

Bitwise released a report indicating that Bitcoin is currently holding resiliently around $82,000, a price level close to the spot ETF holding cost. Key support levels below include the short-term holder cost price of approximately $74,800 and the real market average of about $77,600. The former can serve as a reference for judging the short-term market direction, while the latter corresponds to the price level at which half of the invested capital in the market is in profit or loss. The price range formed by these two points may become the dividing line between bulls and bears.The trading range for Bitcoin over the past 30 days and 60 days has narrowed to 1.8% and 3.0%, respectively, with the implied volatility at-the-money for each term also approaching the lower end of the distribution range over the past three years. Among them, the 3-month and 6-month implied volatility are at the 0.8 and 0.2 percentiles of historical distribution, indicating that the market's pricing for future volatility has dropped to extremely low levels.So far this week, net inflows into U.S. Bitcoin spot ETFs have reached $1.074 billion, rising in sync with the cumulative trading volume of the spot market, providing support for Bitcoin prices and offsetting some macro pressures. However, realized profits in the market have also increased, particularly among long-term holders. Meanwhile, the net position change indicator for long-term holders is negative, suggesting they may be in a distribution phase, which could be one reason for the ongoing consolidation of Bitcoin prices.

According to the latest episode of the Gatecast podcast, Gate founder and CEO Dr. Han shared the product philosophy and future plans of Gate Money. He stated that Gate is extending years of accumulated experience into the fields of asset management and daily payments, reaching a broader user base, with the goal of doubling the user scale of Gate Money in the next one to two years.Leveraging the technical systems, institutional clients, and market-making liquidity accumulated from years of trading operations, Gate supports the exchange between various types of assets; relying on a global licensing layout and partnerships with banks and payment networks, Gate Money creates conditions for users' fund collection, payment, and consumption applications. These capabilities collectively form the operational foundation of Gate Money, enabling the platform to reduce exchange and fund circulation costs in different usage scenarios.Through various capabilities such as holding, exchanging, appreciating, and paying, Gate Money connects multiple types of assets with life needs. Dr. Han illustrated the consumption use of assets beyond investment by using the example of "buying coffee with stocks." In eligible regions, users can open bank accounts in their own names, using familiar payment methods, with transfers processed by underlying blockchain technology; idle funds can also participate in appreciation through yield products.Looking ahead, Dr. Han also shared the application prospects of AI Agent providing round-the-clock assistance in asset allocation and fund management. With the integration of investment, wealth management, and daily payments, Gate Money will continue to expand the application boundaries of various assets, promoting Gate's services deeper into more everyday life scenarios.

On October 22, TRON officially released GreatVoyage-v4.8.2.4 (Empedocles). This update focuses on enhancing the consistency and stability of operation execution in a few special scenarios, and further optimizes the storage of smart contracts and metadata processing logic in edge cases, which helps to improve the execution reliability of nodes in complex operating environments and the overall stability of the network.This version is a mandatory upgrade. TRON reminds relevant nodes to complete the update as soon as possible to avoid affecting block synchronization. For specific version changes and upgrade methods, please refer to the official version release notes and deployment documentation.

OKX will launch the CT (Concrete) Flash Profit Lite event from October 28 at 15:00 to November 3 at 15:00. Users can share a reward of 1,000,000 CT by subscribing to BTC, ETH, OKB, or CT.During the event, users must complete identity verification to participate. Sub-accounts and institutional users are not allowed to participate.

Bitcoin core developer Antoine Poinsot announced an adjustment to the security vulnerability disclosure policy in the Bitcoin development mailing list. He stated that in the past, vulnerabilities were often kept secret for a long time to allow users to complete upgrades before details were made public, but this also led to fixes not being backported to older versions, requiring users to wait for the next major release. Poinsot pointed out that large language models make some vulnerabilities very easy to rediscover, and the protection that continued delays in fixing can provide is now quite limited.According to the new policy, vulnerabilities deemed "easy to discover" will be fixed as soon as possible in all maintained major versions, with security announcements released simultaneously. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through simple LLM prompts. Other vulnerabilities will still follow the disclosure timeline based on severity: low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium to high-severity vulnerabilities will be disclosed two weeks after the last affected version reaches its end of life (usually one year after the fix is released in a new major version). Critical vulnerabilities are not covered by the standard policy and may require ad hoc procedures.Bitcoin ecosystem security researcher Luke de Wolf stated that he previously disagreed with Poinsot's security strategy but believes this update is a good adjustment. In August of this year, the volunteer-based Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with only about one-fifth being reproducible at that time. In the same month, Core Lightning developers urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports, while keeping technical details confidential for two weeks.

U.S. Secretary of Defense Lloyd Austin has prohibited all Pentagon personnel from using non-public information to place bets on upcoming military operations, involving prediction market platforms such as Kalshi and Polymarket. In a memo sent to senior Pentagon officials and defense agencies on Tuesday, he stated that all Department of Defense personnel are prohibited from using non-public information for financial transactions, with the relevant restrictions covering both classified and unclassified information.Austin wrote in the memo that adversaries will observe movements in these markets, and the safety of U.S. military personnel often depends on the enemy not knowing what is about to happen. He also pointed out that, aside from operational security, financial betting can distort judgment: a logistics personnel betting on the date of an operation will be concerned about that date, and an analyst holding a position on the outcome will also be concerned about that outcome.Before this directive was issued, U.S. Army soldier Gannon Ken Van Dyke was charged in April for allegedly profiting over $400,000 on Polymarket by using classified information regarding the operation to capture Venezuelan leader Nicolás Maduro. Prosecutors claimed he participated in the planning and execution of the operation and used advance knowledge to bet on the outcome of Maduro's ousting; he pleaded not guilty to all charges. In February, Israeli authorities also arrested and charged a military reservist and a civilian for allegedly using classified information to bet on events related to Israeli strikes against Iran on Polymarket.

The New York State Department of Financial Services in the United States has issued an alert regarding two critical PHP vulnerabilities, urging regulated entities to quickly identify and remediate known exploited vulnerabilities.

NVIDIA announced the launch of the Minerva platform, achieving end-to-end observability for AI factories.

According to Onchain Lens monitoring, Fidelity's FBTC ETF wallet (bc1qfse...5cww9k) purchased and withdrew 282.63 BTC from Binance, worth 23.08 million USD.

According to CoinDesk, Ben Edgington, the coordinator of the Ethereum rapid finality research direction, along with several researchers, submitted a draft proposing to reduce the transaction finality waiting time from about 16 minutes to about 4 minutes, improving it by approximately four times.The current goal is to push this draft into the formal upgrade proposal process. The core idea of the draft is to separate the original "block selection" and "finality confirmation" mechanisms of validators, allowing finality to progress at a faster pace and facilitating future adoption of quantum-resistant signatures.Faster finality is expected to reduce the costs incurred by cross-chain transfer services due to capital occupation. The Ethereum Foundation's research provides an example: if a service advances about 1 million dollars per hour, under a 16-minute delay, approximately 267,000 dollars would be pending recovery, which could be reduced to about 67,000 dollars after shortening to 4 minutes.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

According to CoinDesk, the patch for the XRP Ledger vulnerability was delayed until November as the number of validator supports dropped to 26 (out of a total of 35), resetting the countdown timer for its effectiveness.Currently, the number of supports has risen back to 31, but due to the need to recalculate the two-week countdown, this fix has missed the originally impending effectiveness window.

The privacy coin project Pirate Chain has released a mandatory update v6.14, requiring all nodes, mining pools, and exchanges to discontinue the old version and upgrade immediately. Attackers exploited two validation vulnerabilities to mint approximately 39.82 million counterfeit ARRR in the transparent coinbase pool, temporarily increasing the supply by about 20%. Both vulnerabilities have been fixed.After reaching a consensus among the community, mining pools, exchanges, and dPoW notarization nodes, the chain has been rolled back to block 4,176,944 before the attack, and all counterfeit tokens have been removed. Balances have been restored to their state before the attack, with the maximum supply remaining at 200 million coins. The new version will automatically re-index the entire chain upon its first launch, and a complete technical review report will be released later.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

According to Lookonchain monitoring, in the past 24 hours, a certain whale has accumulated purchases of various tokens worth approximately 7.22 million USD, including: 378,129 LIT (approximately 1.4 million USD), 6.61 million ENA (approximately 1.34 million USD), 3 million ONDO (approximately 1.34 million USD), 1.154 million AERO (approximately 948,000 USD), 241.8 ETH (approximately 591,000 USD), 2,944 QNT (approximately 589,000 USD), 61,252 UNI (approximately 443,000 USD), 1,387 TAO (approximately 368,000 USD), and 4.33 billion PEPE (approximately 195,000 USD).

According to information from GitHub, a core protocol draft named "Decoupled Consensus" has appeared in the Ethereum EIP repository. It proposes to separate the beacon chain's head voting from the finality proof voting to enhance fork choice security, shorten finality time, and lay the groundwork for a subsequent transition to post-quantum cryptography (PQ).The proposal is co-authored by Francesco D'Amato, Roberto Saltini, Yann Vonlanthen, Mikhail Kalinin, and Ben Edgington, and is currently still in the early draft stage, with multiple details yet to be determined. The submitters primarily hope to obtain an EIP number at this stage. The proposal is pending further review and has not yet been merged.

According to Slow Fog's disclosure, LiteLLM has once again encountered a supply chain attack, with the malicious version litellm@1.107.0 affecting PyPI packages and Docker images, including floating tags such as latest and main-stable.The injected malicious code will automatically execute upon Python startup, stealing sensitive data such as cloud credentials, AI API keys, SSH private keys, and supporting remote code execution. The affected versions have been removed or replaced. Slow Fog recommends that users avoid using version 1.107.0, rebuild the affected environment from a clean image, rotate potentially leaked credentials, and pin the version to 1.106.2.

David Hoffman, the founder of Bankless, retweeted the compliance updates of the perpetual contract trading platform Lighter on X, stating, "Lighter's big market is back." During the Lighter third-quarter investor conference call the previous night, Hoffman, as an investor, asked whether, given that Lighter has had extensive prior communication with the U.S. Commodity Futures Trading Commission, the approval for the Designated Contract Market (DCM) and Derivatives Clearing Organization (DCO) licenses is expected to be granted earlier than the stipulated 180-day review period.Lighter's founder and CEO Vladimir Novakovski responded that extensive prior communication would make the process much smoother. He stated that the U.S. Commodity Futures Trading Commission currently has a lot on its plate, so he could not provide a specific timeline, but internally there is a fast-acting team, and the approval process is expected to go relatively smoothly. Previously, Hoffman had liquidated his ETH holdings and shifted to tokens like LIT, ZEC, and NEAR, which have all significantly outperformed ETH since then.