mal

Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after installing a transcription application using a download link provided in the Claude chat window. The link pointed to a counterfeit website and bundled malware that attempted to steal all information from his device upon execution. Numa Lunah mentioned that he cleared and reinstalled the affected laptop and found no sensitive information leaked.Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide written by him and contained instructions to re-download the malware and steal credentials every time it was loaded. Microsoft Defender Experts had warned that attackers had shifted from search engine optimization poisoning to large language model response poisoning, with related tactics including recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Crypto industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.

GoPlus Security issued a security alert stating that a fraud gang has hijacked the realtrumpcoins[.]com website and the @realtrumpcoins1 account, maliciously issuing GOLD tokens. The gang inflated its market value to approximately $60 million before selling off and executing a Rug Pull, profiting over $8.2 million.On-chain data shows that the developers' initial funds trace back to a KuCoin-associated hot wallet, with another 15 trading wallets funded by Binance-associated hot wallets. These wallets all conducted transactions through the same malicious routing contract.GoPlus Security also pointed out that the gang deployed another malicious meme coin, Trump Digital Platinum (PLATINUM), whose contract can empty any holder's balance at any time, warning users to avoid purchasing and to be aware of the risks.

The cryptocurrency payment platform Rain stated that its monitoring system detected a vulnerability affecting a small number of programs using outdated versions of Solana contracts, while other programs were not affected. Rain immediately launched an investigation to determine the scope of the incident.The Rain team has successfully upgraded all programs using outdated versions of Solana contracts, and the related issues have been resolved. Rain will continue to monitor the situation and has hired a third-party forensic expert to conduct an investigation, while also cooperating with law enforcement and relevant regulatory agencies. All affected users will receive full compensation, and Rain has begun the remediation process and is committed to completing the handling swiftly and responsibly.

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

According to the "Science and Technology Innovation Board Daily," Alibaba Qianwen is currently testing a multi-Agent collaboration feature on the Qianwen creation platform in a small scope, mainly aimed at professional creative scenarios such as AI short dramas, comic dramas, marketing advertisements, and image design. Currently, only a small number of professional creators have been granted testing qualifications.This feature enables multiple Agents to collaborate, linking together the stages of creative planning, script writing, visual design, storyboard generation, and final production. Different Agents can cooperate based on task division to complete the entire production process from concept to final product. Users can participate in discussions throughout the process, adjust the creative direction at any time, or delegate some tasks to AI for independent completion.Recently, Qianwen has launched Qianwen creation for the professional content production field, and it has already integrated Alibaba's latest models such as Wan 3.0, Wan 3.0 Prime full version, and Qwen-Image 3.0 Pro.

According to a report by Decrypt, security company Socket released research results linking 77 Firefox extensions to what it calls a "wallet theft factory," with 40 confirmed to have malicious behavior.These extensions disguise themselves as Web3 products like OKX, Rabby Wallet, and TronLink, tricking users into importing wallets through fake wallet interfaces or using modified real wallet code to steal mnemonic phrases and private keys as users input them. Mozilla's signature records show that this activity lasted from March 9 to August 3, and multiple extensions were still online at the time of Socket's report.About half of the extensions displayed realistic wallet interfaces and prompted users to import existing wallets, thereby intercepting the inputted mnemonic phrases or private keys; another 13 were modified versions of Rabby that sent account data stored in wallets to external servers while functioning normally; and 5 specifically collected saved credentials and clipboard content.Additionally, 37 extensions disguised themselves as password generators, dark mode toggles, VPNs, currency converters, and note-taking tools, but actually ran sports score applications sharing the same hardcoded credentials. Nine confirmed malicious extensions were initially released as score applications for sports like football and basketball, with subsequent updates replacing them with wallet theft code.Socket named this activity the "wallet theft factory," but cautioned that it has not confirmed whether all extensions are controlled by the same operator. The Socket team stated that any user who has entered mnemonic phrases or private keys into these extensions should consider it a "permanent leak" and immediately transfer funds to a new wallet, as uninstalling the extensions cannot undo the mnemonic phrases sent elsewhere.

According to Caixin, the Hong Kong police responded to the abnormal liquidation case of Star Bridge Capital's gold trading, stating that multiple reports have been received, with the reported amount of funds that could not be retrieved totaling approximately HKD 6.63 million. After investigation, the case is temporarily classified as fraud and has been handed over to the third team of the Central District Criminal Investigation Unit for follow-up, with no arrests made yet.According to information obtained by the affected investors in this case, as of 1:50 PM, the number of people who have reported to the Hong Kong police (and have obtained a report number) is approximately 180.

Federal Reserve's Kashkari downplayed market concerns about rising U.S. Treasury yields, stating that the market is functioning well and the recent surge is unlikely to affect discussions on monetary policy.Kashkari noted that trading in the U.S. Treasury market is proceeding normally, liquidity is ample, and the federal funds rate remains the primary tool for reducing inflation.

The Base chain SAND contract of the metaverse project The Sandbox is suspected of experiencing an abnormal minting event. The related address 0x6762...257e is alleged to have obtained minting permissions, allowing it to mint SAND at will, with over 500 million tokens already issued. The specific reason is yet to be confirmed by the official source.

According to Caixin, Star Bridge Capital (SBCFX) experienced an abnormal liquidation incident in London gold trading. After the incident, the Hong Kong office of the platform was empty, and some investors faced huge losses. According to multiple investors, their automated trading in London gold (XAUUSD) derivatives through the Star Bridge Capital platform encountered extreme abnormal trading on the evening of August 19: the system automatically generated huge reverse short positions within just 1 to 3 seconds, followed by a rapid rise in international gold prices, leading to collective liquidations of accounts, with some accounts' funds reaching zero, and some even incurring negative debts.The so-called London gold liquidation refers to the risk of trading in the opposite direction of gold price movements, and due to leverage and other reasons, resulting in excessive losses, where the available margin in the investor's account is exhausted, falling below the maintenance margin ratio, leading to forced liquidation by the platform and total loss of principal.Affected investors estimate that this incident involves about 2,000 to 3,000 people, including a large number of mainland investors. Currently, some investors have reported to the Hong Kong police and requested the platform to refund 70% of the principal according to the previously promised "maximum loss of 30%" rule.Some investors claim that Star Bridge Capital offers leverage of up to 500 times, and some funds were deposited via USDT stablecoins, increasing the difficulty of tracking funds. Public information shows that Star Bridge Capital's business scope covers foreign exchange, commodities, indices, cryptocurrencies, etc., and it claims to be a licensed and compliant international trading platform.

In a research report released by the Bank of Italy in July 2026, a "mystery shopper" empirical investigation was conducted for the first time, tracking 200 USDC transfers across ten corridors between Italy and Argentina, Brazil, South Africa, the UAE, and Japan. The results showed that the total cost of stablecoin remittances fluctuated greatly, with a minimum of only 0.3% and a maximum close to 9%. On-chain transfers accounted for an average of only 0.4%, with the bulk of costs concentrated in fiat withdrawal and deposit stages—traditional intermediary fees such as exchange buy-sell spreads, credit card fees, and withdrawal fees were the decisive factors. Compared to traditional channels like Wise, stablecoins have a cost advantage in some corridors like Brazil to Italy, but the costs are higher in corridors like UAE to Italy, showing a high degree of "corridor specificity."In terms of speed, blockchain transfers themselves take only a few minutes, but end-to-end efficiency entirely depends on the quality of the traditional payment infrastructure in the destination country. Countries with instant payment systems, such as Brazil (PIX), Italy (TIPS), and Argentina (Transferencias 3.0), can keep the entire process under 20 minutes; whereas countries like South Africa, which rely on traditional bank transfers, see the arrival time extended to 1 to 2 business days. The report pointed out that the efficiency of stablecoin remittances is jointly determined by their own infrastructure and the surrounding traditional payment infrastructure, with both being complementary rather than substitutive. The report also analyzed the impact of global regulatory fragmentation: the EU's MiCA and the US's GENIUS Act represent mature compliance frameworks; Japan's strict "safety first" access, while lowering nominal costs, complicates processes leading users to offshore platforms; countries like India and Turkey are in a transitional regulatory phase; while countries like Egypt and Saudi Arabia, with prohibitive measures, have failed to suppress demand, instead pushing transactions into gray channels.

Crypto analyst Ali Charts posted on the X platform that Bitcoin has established strong support in the range of $61,849 to $63,111, where over 2 million BTC have changed hands previously. UTXO Realized Price Distribution (URPD) data indicates that there is almost no resistance ahead; if it breaks through $75,733, the next major supply zone will appear in the range of $83,307 to $84,569, where approximately 1 million BTC have changed hands previously.

Cybersecurity company Check Point Research discovered that the StopAndProtect ransomware campaign uses nearly 2,000 compromised WordPress sites to spread malware, steal data, monitor victims, and deploy ransomware. This campaign was identified in mid-May. As of July 24, it has compromised over 6,000 unique IP addresses, including 1,852 in the United States, and 630 each in Russia and India.The compromised websites were also used to host malware, send commands, and store stolen files, screenshots, and activity logs. Attackers lure Windows users into running PowerShell commands through fake CAPTCHAs, thereby stealing credentials and cryptocurrency wallet recovery phrases, and spreading through networks and USB devices. Researchers have collected over 31,000 screenshots and more than 700 data compression packages, and believe that the attackers may have inadvertently infected themselves.

BounceBit posted on platform X that the team has discovered an issue affecting the BounceBit Chain and has suspended node deployment to fix the problem. BB trading and exchange deposits and withdrawals are temporarily unavailable.The official statement emphasizes that the issue is limited to the chain itself, and CeDeFi applications, smart contracts, and vaults are not affected. There has been no private key leakage or damage to user wallets. The chain upgrade is scheduled for August 23 at 17:00 UTC+8.

Meta Platforms announced the launch of a new Meta AI feature aimed at small businesses.

Abnormal AI announces a strategic partnership with OpenAI to accelerate enterprise artificial intelligence applications.

According to Curve.finance Governance, Swiss Stake AG submitted a progress report for H1 2026 stating that Llamalend V2 has passed the ChainSecurity audit and has launched on Optimism and the Ethereum mainnet, supporting LP Token and PT collateral while introducing new admin fee revenue for Curve DAO.FXSwap has entered the production optimization phase, focusing on research around liquidity concentration, price_scale, and dynamic fees. FastBridge has launched on Arbitrum, Optimism, and Fraxtal, reducing the time to withdraw crvUSD from Layer 2 to Ethereum from about 7 days to approximately 15 minutes. The team has secured the second phase of 8.725 million CRV and additional CRV and crvUSD funds to support operations until the end of 2026, and plans to submit a proposal to increase the DAO protocol fee share from 10% to 30%.

According to the latest ranking of stock derivatives exchanges released by RootData, as of the time of publication, Gate has the smallest spread among the 30 listed exchanges, currently at 0.004%. Among other top-ranked exchanges, Binance has a spread of 0.012%, Hyperliquid at 0.011%, and OKX at 0.009%.It is reported that this spread is the 24h trading volume weighted spread, and a lower value usually indicates lower trading costs.

According to the Economic Daily, TSMC's advanced packaging CoWoS capacity is in short supply, and it has been reported that some backend orders have overflowed to Intel's factory in Malaysia, where Intel is assisting with packaging using part of its capacity to serve common major customers, breaking the past ecosystem competition norms. TSMC Chairman Wei Zhejia previously stated at a conference call that TSMC focuses on advanced packaging in the frontend and welcomes "more manufacturers to supply capacity" for the shortage in the backend, providing flexible alternatives for common customers.The report points out that the bottleneck in advanced packaging capacity mainly lies in the backend ramp-up speed being lower than that of the frontend process, and the widening gap in CoWoS capacity has forced orders to overflow. SemiAnalysis Chipbook data shows that approximately $1.3 billion worth of HBM has been shipped to Malaysia, and industry analysis indicates that Intel's local factory should already have the capability for large-scale HBM integration. Intel CEO Pat Gelsinger stated that the EMIB-T technology is ensuring reliable yield, and in the context of insufficient CoWoS capacity, "Intel is in a unique position to provide support." Companies with overlapping supply chains such as Unimicron, ASE Technology Holding, and Jiadeng are expected to benefit simultaneously, with Unimicron's stock price rising over 7% on that day. Intel's EMIB-T related applications are targeted for mass production by 2027.

According to KOL Kuai Dong (@_FORAB), several cryptocurrency practitioners reported this morning that their addresses on other exchanges inexplicably received small deposits from HTX exchange, and shortly after receiving them, their accounts were frozen. Previously, several exchanges, including Binance and OKX, announced that in response to sanctions from the EU and the UK, they would no longer process deposits and withdrawals from HTX, otherwise accounts could be forcibly frozen. Some users in the community claimed that this action is similar to "address poisoning," which could trigger KYT/AML risk control on other platforms.However, HTX market manager MollyFu stated that the official side absolutely did not engage in such behavior; it is either a misunderstanding or someone is deliberately causing trouble. The platform has been processing tens of thousands of deposits and withdrawals daily in the past two days, and accounts are normal. They will not randomly airdrop to users on other platforms; if testing is conducted, it will only be done on a small scale through their own accounts. HTX stated that they have held an internal meeting to discuss the matter and are quickly investigating the cause, promising to provide an explanation to the community.