permissions

NVIDIA CEO Jensen Huang stated that the top priority is to strip AI entities of their privileges.

The PermissionDelegationV1_1 upgrade of the XRP Ledger entered a 14-day activation countdown on September 21, having received support from 29 of the 35 trusted validator nodes. If the support rate remains above 80% during this period, the upgrade could officially activate as early as October 5 at 11:18 UTC; at least 28 validator nodes must continue to support it, or the countdown will reset.This feature allows accounts to split permissions by role. For example, a stablecoin issuer can allow a connected compliance system to approve customer accounts holding its tokens while keeping the keys with full control offline; operational accounts can gain payment permissions but cannot change keys or delegate authority to others. Each trustee can have up to 10 permissions, and the main account can modify or revoke them at any time.This is the network's second attempt to introduce this feature. The original version had vulnerabilities that attackers could exploit to make others pay transaction fees with improperly signed transactions, and by repeatedly submitting high-fee transactions, they could deplete the victim's XRP balance. This vulnerability was reported by community testers on September 15, 2025, and validator nodes were advised to reject the amendment, so it was never activated. The fixed version was released with xrpld 3.3.0, changing the way unauthorized transactions are rejected, ensuring that fees are not deducted before signature verification.

DeFi protocol Term Labs updates on the progress of the attack incident, disclosing that the affected entity is the Term Vault governance mechanism, rather than the underlying Term protocol and its direct lending market. All Meta Vaults have now been closed and DAO governance permissions revoked to prevent further inflow of funds. This closure operation is irreversible and will permanently block new deposits.Currently, the withdrawal function remains open, and they are working with external security teams to conduct repairs and recovery. If a funding gap is ultimately confirmed, corresponding solutions will be explored. Term Labs reminds users to pay attention only to information released by official accounts and to be wary of impersonators and fraud. Previously, it was reported that Term Labs suffered a governance attack resulting in losses of approximately $8.5 million.

BIP-110 soft fork has stalled due to support rates far below standard, with thousands of nodes isolated. Just two days after the incident, the Bitcoin BIP editing team removed the editing privileges of the proposal leader Luke Dashjr on Monday. Editor Mark Erhardt proposed a motion for dismissal, citing reasons including conflicts of interest, minimal contributions, leading a controversial fork, and coordination breakdown.Supporters pointed out that Dashjr used his editing privileges to favor the BIP-110 proposal, assigning numbers and quickly merging PRs before discussions on the mailing list, and has contributed less than 1% since April 2024. The peak signal support for BIP-110 was only 2.53%, far from the 55% threshold, and the forced chain has stalled at a height of 961,633. Ocean was the only mining pool signaling before the fork, and has now resumed non-BIP-110 work. Dashjr announced the suspension of his roles as Chairman and CTO of Ocean four minutes before the dismissal confirmation, shifting to Bitcoin open-source projects, but still serves as the chief maintainer of Bitcoin Knots. The price of Bitcoin was unaffected by the incident.

According to the official report from Ostium, the core of this attack lies in the intrusion of the off-chain price reporting system's permissions, unrelated to smart contract vulnerabilities. After gaining off-chain authorization, the attacker submitted forged prices (5,000 USD and 60,000 USD) to the BTC-USD market using the legally registered forwarding paths of the protocol, completing an atomic open-close arbitrage cycle within the same transaction, and starting with a rolling scale of 100 USDC. Through 8 transactions, they extracted 23.75 million USDC from the OLP treasury within 5 minutes, until the treasury's circuit breaker mechanism was triggered.The root cause is the lack of a multi-party approval mechanism at the same level as on-chain multi-signature in the off-chain infrastructure, creating a single point of permission vulnerability. The stolen funds have been converted to ETH and mixed through Tornado Cash, and tracking efforts are still ongoing.

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.

According to Fortune, Mastercard has announced a new protocol called Agent Pay for AI, allowing AI agents to make payments and conduct small transfers among themselves— for example, automatically paying when an AI agent retrieves data from a website in segments. The protocol stores the permissions granted to AI agents by humans on the blockchain, initially using the Polygon network to ensure transparency and verifiability, allowing multiple parties to verify whether the agents are acting as instructed.Companies like Adyen, Coinbase, and Cloudflare are collaborating with Mastercard to develop this protocol. Mastercard's Chief Product Officer Jorn Lambert stated that this protocol will not become a major source of revenue in the short term, but it is expected to develop into a significant new market over the next five years.Giants like Visa, Stripe, Coinbase, and Google are actively laying out AI payment protocols, jointly promoting the future of "machine-to-machine payments" and AI chatbots dominating e-commerce transactions; however, the current volume of agent-based payments remains relatively small.

The UK's Financial Conduct Authority (FCA) has released the final draft of the crypto asset framework. This new regulation is set to bring most crypto activities under the regulation of the Financial Services and Markets Act by October 25, 2027.According to the proposal, any institution that holds customer crypto assets for more than 24 hours or has the ability to revoke customer permissions will be considered a regulated custodian and must hold a full safeguarding license. Validators and node operators that provide value-added features such as yield or reward reinvestment will lose their technical exemptions. In addition, stablecoin issuers within the UK must control the entire lifecycle from issuance to redemption. Relevant institutions must submit authorization applications between September 30, 2026, and February 28, 2027.

According to Caixin, starting from January 1, the balance of digital RMB wallets will begin to accrue interest. It is reported that its smart contracts are different from the "on-chain" smart contracts known for being built on blockchain due to Ethereum. Senior digital RMB experts point out that digital RMB is not built on blockchain, but rather based on a newly designed account system, where the central bank and commercial banks jointly maintain "the same ledger." By loading "smart contracts that do not affect the monetary function," digital RMB achieves programmability, supporting features such as targeted payments and automatic execution.In addition, Caixin also disclosed that only real-name authenticated digital RMB wallets can accrue interest, meaning that Type I, II, and III wallets can earn interest, while Type IV non-real-name wallets do not earn interest (as the ownership of Type IV wallets cannot be confirmed). After January 1, mobile banking apps from participating operating banks, as well as payment platforms like WeChat and Alipay, will gradually gain the authority to open digital RMB wallets.

ChainCatcher message, Arcadia Finance official posted on X platform stating that the team has noticed that attackers are conducting unauthorized transactions through the Rebalancer. The official urgently reminds users to immediately revoke all Asset Manager permissions and remove all active Rebalancers.Previously, CertiK Alert monitored that multiple suspicious transactions occurred on the Base chain involving Arcadia Finance, with attackers obtaining approximately $1.6 million in funds.

ChainCatcher message, CertiK issued an alert that it detected an exploit incident involving flash loans and the NFT market. The suspicious transaction contains complex logical operations on a certain protocol. CertiK stated that the impact of this incident is the exploitation of NFT market logic, but it will not directly deplete funds. Projects with delegated quoting logic should remain vigilant and check access permissions and validation checks.

ChainCatcher message, Unichain announced the launch of a new validation network that further promotes on-chain decentralization by allowing anyone to run a node to validate blocks. This feature adds a layer of finality and reduces the risk of conflicting blocks.

ChainCatcher message, Infini founder Christian tweeted: "A friend joked before that my journey has been too smooth, and I said I was always ready to face the first disaster. I didn't expect that after bybit, the next incident would be myself. The personal private key was not leaked; it was a negligence during the transfer of permissions. Ultimately, it is my own responsibility, and this has sounded the alarm. Currently, there are no issues with liquidity, and we can make full compensation. We are investigating the funds."

ChainCatcher news, Slow Mist releases an analysis of the Radiant Capital security incident (Arbitrum chain):Radiant Capital uses a multi-signature wallet (0x111ceeee040739fd91d29c34c33e6b3e112f2177) to manage key operations such as contract upgrades and fund transfers. However, the attacker illegally gained control of the owner permissions of 3 out of the 11 owners of the multi-signature wallet.Since Radiant Capital's multi-signature wallet employs a 3/11 signature verification model, the attacker first used the private keys of these 3 owners to perform off-chain signatures, and then initiated an on-chain transaction from the multi-signature wallet to transfer the ownership of the LendingPoolAddressesProvider contract to a malicious contract controlled by the attacker.Subsequently, the malicious contract called the setLendingPoolImpl function of the LendingPoolAddressesProvider contract, upgrading the underlying logic contract of the Radiant lending pool to a malicious backdoor contract (0xf0c0a1a19886791c2dd6af71307496b1e16aa232).Finally, the attacker executed the backdoor function, transferring funds from various lending markets into the attack contract.Previous news, Radiant Capital suffered a cyber attack, resulting in losses exceeding $50 million.

ChainCatcher news, Yixing has cracked a case of theft of virtual currency, where the perpetrator illegally obtained access to another person's virtual currency wallet with the intent to possess it unlawfully. The prosecuting attorney discovered that in order to secretly gain access to others' virtual wallets, the defendant Wang conspired with others to create a website that appeared to be a blockchain project to obtain the management rights of the victim Ms. Pan's wallet. According to statistics, Wang transferred 130,000 virtual currencies from Ms. Pan's account to cash out into his own bank card, causing Ms. Pan an economic loss of over 900,000 yuan. Recently, the Yixing City Prosecutor's Office filed a public prosecution, and the court sentenced the defendant Wang to eleven years in prison for theft and imposed a corresponding fine.

ChainCatcher message, according to the official Twitter of the LI.FI protocol, is investigating a potential vulnerability issue. Users are advised to temporarily refrain from using any applications powered by LI.FI and revoke all authorizations for the following addresses:0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae,0x341e94069f53234fE6DabeF707aD424830525715,0xDE1E598b81620773454588B85D6b5D4eEC32573e,0x24ca98fB6972F5eE05f0dB00595c7f68D9FaFd68.Only users who manually set unlimited authorization are affected.

ChainCatcher news, recently an investor claimed that his $1 million in his Binance account has disappeared, stating that he has become a "sacrificial victim of a crypto undercover." In response, Binance co-founder He Yi stated that the team is conducting a review, and the official response will be released shortly.In addition, He Yi provided the following security suggestions to users:Isolation: Create a separate Chrome user to log into DAPP, and do not install any plugins;Clearing: Log out of any APP involving funds promptly after use, and do not stay online to avoid risks associated with cookies;Incognito: Open web pages in incognito mode and disable any plugins;Privacy: Use a separate device for fund operations, and it is recommended to use an Apple phone for transactions due to its higher security;Permissions: Set the permissions for fund operations to automatically log out within a few minutes, similar to the practices of many traditional banking apps.

Chaincatcher news, the Dogezilla founding team announced on their official Twitter @GooseInSol that they will launch a brand new MEME token $GOOSE on the SOL chain, with a total supply of 10 billion tokens. Among them, 50% will be used for presale, 45% for liquidity provision (LP), and 5% for commercial marketing. The team plans to raise 10,000 SOL externally. In addition, the official statement indicates that once launched, they will relinquish permissions and liquidity provision.About Dogezilla: Ranked first in BSC MEME popularity in 2021, with over 300,000 holding addresses, the team has years of experience in blockchain product development and operation, consisting of an operational and development team, with team members not being from the 90s.