rif

Hardware wallet manufacturer Keystone's device verification keys were stolen, halting shipments and destroying 18,835 unsold devices, with 25,964 buyer records leaked.

According to a report by unfolded, Janus Henderson has launched the tokenized fund JQQQ, which is the first tokenized fund authorized by the Nasdaq-100 Index. JQQQ is issued on the Stellar chain based on Centrifuge technology and is only available to qualified non-U.S. professional investors, with a minimum investment of $100,000.The Nasdaq expanded the scope of index authorization earlier in 2026. Currently, JQQQ has not disclosed its assets under management and trading volume.

The Ethereum institutional privacy technology organization EthSystems announced the completion of formal verification for its privacy pool (shielded pool), ranging from written specifications to the bytecode running on the Sepolia test network. The verification used different tools in layers: models, circuits, and hashes with Lean; contracts with Halmos and Kontrol; wallets with Aeneas and Verus; and validators and deployment verified through byte-by-byte reconstruction.Double spending and value conservation have been verified by the Lean theorem prover. During the verification, a total of 6 issues were discovered, 3 of which were found in the verification tools themselves. The team also listed the assumptions that still rely on: hash collision resistance, validators rejecting forged proofs, and contract behavior being consistent with the model.

According to a Reuters report, sources say that the United States and Canada are working to reach an agreement to ease U.S. tariffs on Canadian steel and automobile imports.

The innovation exemption for tokenized securities trading venues launched by the U.S. SEC in September is sparking controversy within the industry regarding blockchain qualification standards. This exemption allows eligible companies to trade tokenized U.S. stocks without registering as traditional securities exchanges, but requires their smart contracts to be auditable, public, and deployed on a public, permissionless blockchain.Currently, three companies have submitted operational intent notices to the SEC. TSV LLC plans to use the privacy-focused Canton Network; OKXICE and Kephas Corp. intend to utilize their respective enterprise group's developed Ethereum Layer 2 networks.In a letter submitted on Thursday, the Solana Policy Institute requested the SEC to tighten the definition of "permissionless," focusing on who actually controls the blockchain, including who can validate or block transactions and modify network rules. Hedera advocates for an expansion of the exemption's scope, arguing that only authorized entities should participate in validation, which should not disqualify their network.The Securities Industry and Financial Markets Association (SIFMA) also called for clarification on which blockchains are eligible and questioned whether stock tokenization should require explicit prior consent from the issuing company, rather than requiring companies to opt out. The financial regulatory advocacy group Better Markets urged the SEC to withdraw the exemption and instead engage in formal rulemaking.An SEC official stated that companies can begin operations 30 days after submitting a notice, provided they meet the exemption criteria, without waiting for SEC approval, which does not imply SEC endorsement of their chosen blockchain. The official noted that the regulatory agency intends to maintain a broad definition to allow space for companies to experiment; further frequently asked questions may be released, but substantive adjustments would require action from the commission.Meanwhile, more companies are opposing the tokenization of their stocks. As of Friday, among the 62 companies initially listed by OKXICE, 22 have raised objections, exceeding one-third. New objectors include Wells Fargo, Arm, and Intuit.

The White House announced that Trump further adjusted the scope of tariffs on Canadian products imposed under Section 338 of the Tariff Act of 1930.

Market news reports that U.S. President Trump is expected to cancel some tariffs on Canada.

Zero-Knowledge Proof Infrastructure Succinct has fixed a security vulnerability in its SP1 that could allow invalid proofs to be deemed valid.According to The Defiant, the flaw existed in the native Rust verification path from version 6.0 to 6.8.0, while on-chain Groth16 and Plonk verification executed by the Solidity verifier were not affected.

On October 22, the Frontier Red Team of the artificial intelligence company Anthropic released research stating that large language models can automatically write formal proofs on a larger scale. The team collaborated with Theorem to use Claude to prove safety properties on over 100 real open-source libraries at the RISC-V assembly level, claiming this is the first known instance of using AI for large-scale formal verification of production software at the assembly level. During the proof-writing process, vulnerabilities that had gone undetected for years were also discovered.The experiment converted existing compilable fuzz tests from Google OSS-Fuzz into specifications: under assumptions of single-threaded static binaries, fixed memory budgets, RISC-V CPUs, and Linux, for any input less than 64 MB, the program should exit normally without triggering memory safety errors or assertion failures. Within weeks, Claude proved the aforementioned properties for 239 entry points in 123 OSS-Fuzz libraries after patching the identified issues. The proofs targeted compiled RISC-V instructions, approximately 180 million lines of Rocq, and were checked by the Rocq kernel. The page states that this does not mean these libraries are free of vulnerabilities, as remaining issues may lie outside trusted components or the scope of the proofs.The page also mentions that the team had Claude formalize RFC 1950 and proved that the zlib implementation in the Linux kernel conforms to that specification at the x86 binary level; an interpreter written in Rust covering a large subset of Python showed a 99.95% consistency with CPython behavior across over 1.7 million randomly generated programs. In 36 small verification tasks, Opus 5.5 proved that about half required approximately 40% fewer tokens than Opus 5. The team also pointed out that the proofs targeted single-threaded, statically linked RISC-V binaries, and the proof checker cannot determine whether the specifications align with reality.

On October 21, the UK's Financial Conduct Authority (FCA) published Consultation Paper 26/36 titled "Guidance on the Regulatory Scope of Cryptoassets," which explains how to determine whether related activities require authorization when the business model involves a certain degree of decentralization.The FCA pointed out that the use of software, smart contracts, distributed ledger technology, distributed governance mechanisms, or other technological arrangements does not, by itself, determine whether there are regulated activities that require authorization. Automation merely describes the manner in which functions are executed and does not determine whether that function constitutes part of a regulated activity. The so-called "true DeFi" is not a statutory concept in the "Regulated Activities Order" or the "Cryptoasset Regulations"; the degree of decentralization is a continuum and does not constitute an independent or separate regulatory framework.At the same time, the FCA also published Guidance Consultation Paper 26/7, which explains how regulated firms should manage DeFi risks, focusing on operational resilience and financial crime risks, and provides examples of measures that firms may consider taking. Both consultation papers will close for comments on November 18, and the FCA plans to publish the final guidance in January 2027. Starting from October 25, 2027, the new regulations will bring new cryptoasset activities under regulatory oversight, and firms wishing to continue related business must submit authorization applications by February 28, 2027.

According to Salus monitoring, the attackers of Drift Protocol transferred 4,600 ETH, worth approximately 11.23 million USD, to Tornado Cash in 46 transactions from another long-dormant wallet between 15:00 and 15:19 Beijing time. This wallet had not made any outgoing transactions for about 202 days and still held 20,285.82 ETH at the time of monitoring.Salus stated that another wallet previously tracked had deposited an additional 6,110 ETH into Tornado Cash on top of the previously disclosed 19,600 ETH, bringing the total deposits of that wallet to 25,710 ETH. The two tracked wallets have cumulatively deposited 30,310 ETH into Tornado Cash.

The Blockchain Association submitted a letter to the SEC regarding the "Regulation of Crypto Assets" proposal, suggesting raising the startup exemption limit to $10 million and the fundraising exemption to $150 million (supporting on-chain transparency as an alternative to audits and excluding airdrops), and establishing a third-party registration safe harbor for existing tokens.The Blockchain Association calls for clear objective decentralization standards for tokens to escape the "investment contract" attribute (such as open source and no unilateral review rights), while strengthening federal regulations' priority jurisdiction over state legislation, supporting 24/7 trading on exchanges and self-custody.

Castle Securities CEO Griffin stated that there is almost certainly a bubble in the AI field, although bubbles are often accompanied by significant technological breakthroughs. Companies are carefully reviewing the bills from Anthropic and OpenAI, and some companies are struggling to derive value from AI.

According to on-chain analyst Yu Jin's monitoring, the hacker who stole $285 million in assets from Drift Protocol at the beginning of April transferred 25,710 ETH, worth $61.24 million, through Tornado 3 hours ago.The hacker had exchanged the stolen assets for 131,564 ETH at an average price of $2,154 in early April, and transferred 24,400 ETH through Tornado in July; the current address still holds 81,454 ETH, worth $194 million.

The American Blockchain Association stated that it has submitted comments on the proposed implementation rules for Section 3 of the GENIUS Act by the U.S. Department of the Treasury. The association recommends clarifying the scope of "digital asset service providers" to exclude self-custody software, validators, and businesses that only trade their own assets; regarding criminal liability for participating in the illegal issuance of stablecoins, it should be based on actual knowledge and substantial assistance coordinated with the issuer.The association also suggested that trading platforms could determine the compliance of foreign stablecoins based on the official issuer list and trading bans, and adjust the criteria for determining user locations in unlicensed agreements.

In an executive order, U.S. President Trump stated that, effective immediately, certain sanctions, restrictions, and tariffs specified in the "Graham Sanctions on Russia and Iran Act" are waived.

As Trump's tariff policy restricts foreign steel supplies, U.S. steel prices have risen to their highest level in over four years, with hot-rolled coil prices increasing by 52%, reaching $1,255 per short ton. This move has boosted the profits of domestic steel producers but raised costs for manufacturers.