security

Vitalik posted on the X platform to congratulate the @zksync Airbender team for achieving this milestone. He believes that the speed competition of zkEVMs has achieved a decisive victory, and the primary focus should shift entirely to security.Vitalik stated that this means there is a need to formally verify the equivalence of arithmetic and Ethereum specifications, the hard upper limit of the ratio of prover costs to total block Gas, and the security of the proof system itself.

On the 11th, Microsoft co-founder Bill Gates stated in a television interview that AI is the most dangerous technology ever invented by humanity, with risks exceeding those of cars, airplanes, and pharmaceuticals. He mentioned that the real threat at present is not AI going out of control, as that scenario is still years away from becoming a reality; rather, the more immediate threat is criminals using AI to carry out extortion, manipulate the stock market, and other crimes.Gates indicated that as criminals crack and bypass the security protections of the latest AI models, there will be a significant number of negative events in the cybersecurity field over the next year. He also mentioned concerns about biosecurity, stating that AI has significant implications for fields such as healthcare, but the potential risks still outweigh those of traditional industries that are already under strict regulation. Currently, there is no effective regulatory framework established globally, and within the next year, industry governance will have to move beyond mere self-regulation, while existing resource investments are far from sufficient.According to reports cited by the Financial Associated Press, Ken McCallum, the director of the UK's MI5, stated in the annual threat assessment that AI is exacerbating the cyber offense and defense game and may change the risk landscape of biological weapons. MI5 has announced the establishment of an AI threat assessment center. Additionally, reports indicate that executives from laboratories such as OpenAI and Anthropic have recently privately simulated disaster response plans, believing that a likely scenario involves cyberattacks impacting financial services, internet connectivity, or water and electricity supply.

The Synthetic Dollar Agreement's founder and CEO of Ethena, Guy Young, stated that users have noticed a large investor wallet transferring tokens in the past 48 hours. He confirmed that the related transfers are a security precaution related to recent concerns about hardware wallets and do not indicate that the tokens are being sold after being transferred.Guy Young made the above statement on X in response to the community's concerns about the on-chain movements of large wallets. He emphasized that the related operations are precautionary arrangements taken for security reasons and do not represent that investors are selling their held tokens.

NVIDIA has committed to investing $250 million over the next five years to promote research in agent safety and security in the UK. The company stated that it will provide $50 million in computing resources support for agent safety research in the UK each year.

Pluto Security, an enterprise artificial intelligence security startup, announced the completion of a total of $42 million in financing.This round of financing includes an $8.5 million seed round led by TLV Partners, with participation from the founder of cybersecurity company Armis, as well as a $34 million Series A round led by Jump Capital, with participation from Skinos and Ansa Capital. The new funds will be used for product research and development, expanding security research operations, and increasing market presence in the United States.

San Francisco-based cybersecurity company Reach Security announced on October 13, 2026, the completion of over $50 million in Series B financing, led by Top Tier Capital Partners, with participation from Ballistic Ventures, In-Q-Tel, Microsoft's venture fund M12, and existing investors. The funds will be used for product innovation, expanding integration partnerships, international expansion, and growth in the U.S. enterprise and federal markets.At the same time, Reach Everywhere was launched, integrating security control insights into exposure management, security operations centers, incident response, compliance platforms, and AI security environments through the Reach API, MCP servers, and technology partners. The company claims its AI reads the real-time configurations of existing security products in enterprises, determines whether exploitation paths are blocked, and points out the specific rules that dictate that outcome, allowing for immediate remediation when protection is bypassed.According to VulnCheck, less than 1.3% of vulnerabilities were exploited in the wild in the first half of 2026; citing CrowdStrike, AI-enabled adversary actions increased by 89%, with the shortest time for attackers to breach being as little as 27 seconds. The number of customers has doubled in the past 12 months, including Autodesk, Insurity, MPS, and Ensemble Health Partners. Independent analysis by TAG Infosphere states that organizations using Reach save over 160 hours weekly on control reviews, situational assessments, and incident investigations, with a return on investment of 156%.

According to SolanaFloor, a TOKEN2049 attendee has filed a report with the Singapore police regarding a crypto security side event called Don't Get Played that took place during TOKEN2049.The event was promoted by self-proclaimed organizers Apex Accelerator and Stone Venture. It is alleged that the organizers pressured and induced attendees on-site to install malware that would allow the organizers to remotely take full control of their computers.

Hardware wallet manufacturer Trezor stated that in light of recent supply chain security incidents, it has decided to reduce the number of distributors to more effectively review partners.Currently, there is no evidence that Trezor devices have been compromised. This adjustment is a precautionary measure taken out of caution.

The Finance Committee of the French National Assembly has passed an amendment that proposes requiring the declaration of self-custodied wallet crypto assets with a year-end value reaching or exceeding €100,000 (approximately $112,000). Those who fail to declare may face fines of up to €10,000 (approximately $11,000). This regulation has not yet become law and may still be adjusted in the future.Harry Halpin, CEO of privacy infrastructure company Nym, stated that personnel from the French tax authorities are suspected of selling taxpayer data to criminals, and the new declaration requirements could threaten the safety of holders. Rand Hindi, founder of the privacy protocol Zama, urged French crypto asset holders to leave France, and those who cannot should hire security for their families.As this proposal emerges, France has seen several incidents of crypto asset robberies, kidnappings, and "ransom attacks" in recent years. The committee had also previously passed measures such as considering the exchange of crypto assets for stablecoins as a taxable sale and expanding the scope of the crypto asset exit tax, but the budget revenue portion was subsequently rejected by a vote of 31 to 3, and the related amendments need to be resubmitted.

Web3 security platform Blockaid co-founder Ido Ben-Natan posted on the X platform that since the release of the first half report in August, the number of on-chain cybersecurity incidents has continued to reach historical highs month by month. Attackers, motivated by profit, find that attacking on-chain infrastructure offers the highest return for hackers, and this trend will become even more severe as the funds callable by AI agents increase.According to Fortune, Ben-Natan stated that the company is currently in its "busiest ever" state, one reason being the significant increase in hacker attacks. Additionally, Nansen CEO Alex Svanevik predicted that by 2028, trading cryptocurrency assets through AI agents rather than manual interface clicks will become the norm.

According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update that fixes vulnerabilities that could allow malicious nodes to steal funds. The most serious vulnerability involves Lightning channel reconnections. According to Bitcoin Optech, malicious nodes may falsely claim that they did not receive previously confirmed channel updates.The vulnerable LDK software could subsequently sign conflicting commitment transactions without properly recording the related transactions, allowing attackers to regain Bitcoin after forwarding the payment is completed. Versions LDK 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.

a16z crypto invited Stanford University professor Dan Boneh, a16z crypto partner Eddy Lazzarin, and other experts to discuss the threats AI poses to cryptography. The experts pointed out that recent advancements in AI in the field of mathematics have not included cryptographic results and have not proven any specific cryptographic assumptions to be less secure.The experts stated that modern cryptography relies on the assumption that certain mathematical problems do not have efficient algorithms; if this assumption holds, no matter how powerful AI becomes, it cannot find algorithms that do not exist. This assumption is related to the unsolved P vs NP problem in computer science, and current AI advancements have not yet touched upon this issue.The experts believe that AI can significantly reduce the time required for cryptographic reviews. Hypotheses that previously took ten years to validate can now allow models to run for a month to attempt to break them. At the same time, the migration work driven by quantum threats has prepared for some of the risks posed by AI, and cryptographic agility can help systems switch methods when weaknesses are discovered. For developers, the most direct opportunity is to use AI to discover more vulnerabilities before software deployment.

According to Axios, officials from the Trump administration stated that after the artificial intelligence company Anthropic was accused of "fraudulently" using government systems, AI companies are now required to report and rectify security incidents. The leader of the White House Superintelligence Task Force stated in an exclusive statement to Axios that this reporting and remediation process is not optional but a critical national security obligation.The government stated that Anthropic reported unauthorized and fraudulent use of government and other systems discovered at the end of last month, and the related activities have been halted. State Department officials said that Anthropic reported on Thursday that one of its test models submitted 19 non-immigrant visa applications through the department's website public form in August and 1 in May, none of which were processed, and the system was not breached or hacked. Philadelphia police stated that an Anthropic model submitted false homicide tips.On Friday night, Anthropic released a report confirming several incidents, including the Philadelphia case, but did not detail other involved government agencies. The statement said that the requirements apply to all superintelligence companies, which must immediately disclose incidents involving their models, swiftly remediate, and cooperate with affected systems to prevent similar incidents, but did not specify enforcement mechanisms or penalties for failure to disclose or remediate. Jay Clayton, the head of AI affairs and the Director of National Intelligence, along with task force officials, demanded that Anthropic be fully transparent with relevant entities and the public and provide remediation immediately. The task force co-chairs include Federal Trade Commission Chair Andrew Ferguson, Office of Personnel Management Director Scott Kupor, and Deputy Secretary of Defense Emil Michael.

Andrey Lazutkin, co-founder of Tangem, posted on X that the recent Ledger security incident once again confirms the security engineering principle of "complexity expands the attack surface." He pointed out that every additional component, software layer, and user interaction, such as screens, buttons, batteries, and firmware, introduces new potential points of failure and vulnerabilities, increasing the risks that need to be identified and mitigated.Based on this, Lazutkin defended the minimalist card design adopted by Tangem—this solution is built solely around the secure chip and antenna—and stated that this incident reinforced his judgment about the correctness of this design philosophy.

The blockchain security platform Phalcon stated that approximately 6 hours ago, around 3.55 million dollars of unclaimed cross-chain funds were claimed and transferred. Phalcon raised the question: Was the related transaction initiated by the fund owner, or did the attacker obtain valid EIP-7702 authorization?On-chain information shows that the claim was submitted by address 0x24a9, with funds coming from Tornado Cash and executed through EIP-7702 delegation on an external account. The two transaction amounts were 1.33 million dollars and 2.22 million dollars, with on-chain data confirming the validity of the related authorization.A few days ago, on-chain researcher stuckfunds.eth repeatedly sent messages to address 0x4943, informing the owner that the related funds were still claimable. Currently, on-chain data cannot confirm whether the owner intentionally signed, was induced to sign, or if the private key has been leaked.

Hardware wallet manufacturer Ledger has once again experienced a security incident today, with third-party security agencies estimating the losses to be close to 90 million USD. Ledger is investigating the financial losses related to devices sold by its Southeast Asian authorized distributor CryptoBilis and has requested the distributor to suspend sales and shipments, advising users who purchased devices through this channel in the past 90 days to exercise caution or transfer their assets. The cause of the incident has not yet been definitively confirmed, but it is suspected to involve supply chain or device tampering risks.Major historical attacks and financial loss incidents related to Ledger include:In 2018, early hardware and supply chain research vulnerabilities emerged. Security researchers demonstrated the possibility of tampering with the Nano S before it left the factory, as well as issues such as MCU bootloader bypass, isolation vulnerabilities, and Bitcoin change address injection. Ledger gradually released security announcements and completed fixes, with related issues mostly being research-level vulnerabilities or requiring physical contact with the device to exploit.In 2020, Ledger experienced a massive customer data leak. Attackers obtained e-commerce and marketing databases through third-party API keys and vulnerabilities related to Shopify, exposing over 1 million email addresses and approximately 272,000 to 292,000 detailed customer records, including names, addresses, and phone numbers. The hardware and private keys were not affected, but this incident triggered long-term phishing, social engineering, and counterfeit official letter scams.In December 2023, the Ledger Connect Kit suffered a supply chain attack. After a former employee fell victim to a phishing attack, their NPMJS account was compromised, and attackers released a malicious version of the Connect Kit, injecting malicious code into DApps that relied on the library, enticing users to sign fraudulent transactions. The active window of the attack was about 2 hours, with losses estimated between 480,000 to 600,000 USD. The hardware and Ledger Live itself were not directly breached.In January 2026, third-party Global-e order data was leaked. The payment and logistics partner's system suffered unauthorized access, exposing some Ledger.com order-related information, including names, addresses, and contact details. Ledger's own systems and private keys were not affected, but the phishing risk rose again.In April 2026, counterfeit Ledger Live application scams appeared on the App Store. The counterfeit application was listed for about a week, tricking users into entering their recovery phrases, with over 50 victims losing approximately 9.5 million USD across multiple blockchains. Apple subsequently removed it, and Ledger emphasized that it would never ask for 24-word recovery phrases.In August 2026, Ledger disclosed vulnerabilities related to Ethereum application signatures, including command interleaving causing display content to be out of sync with signature parameters, and Clear-signing bypass issues. The vulnerabilities required malicious hosts to cooperate, and Ledger stated that there was no evidence of actual user exploitation; related issues have been fixed in the new version.On October 9, 2026, a large-scale wallet draining incident related to the CryptoBilis distributor occurred, with estimated losses close to 90 million USD. Ledger is investigating, and the incident is suspected to involve supply chain or device tampering attacks targeting a single channel. The official sales have been suspended, and affected users are advised to migrate their assets.

On October 9, Binance founder CZ posted on X, responding to Ethereum co-founder Vitalik Buterin's lengthy article about the potential impact of artificial intelligence accelerating mathematical research on cryptographic security. CZ rated Vitalik's mathematical level at 99.99 points, while he rated himself at 0.01 points, joking that together they might achieve something; he also mentioned that people might not fully understand Vitalik's articles like himself, but even so, such analytical discussions are worth reading.Previously, Vitalik warned in a post that the acceleration of mathematical research by artificial intelligence could significantly weaken the practical security of lattice-based cryptography in the next two years, involving technologies such as ML-DSA and fully homomorphic encryption, and could even expose ECDSA to cracking risks sooner than expected. He believes that artificial intelligence could drive mathematical research progress equivalent to the past 50 years within two years, which is why the Ethereum Lean roadmap has gradually shifted towards pure hash signature schemes over the past year, reducing reliance on lattice cryptography.

Former OpenAI employee Tomek Korbak posted on X that last week he was called in to meet with OpenAI's head of security, who stated that they no longer trusted him. Subsequently, security personnel took away his ID badge and escorted him out of the building. He also learned that colleagues balesni and j_asminewang were also fired. Korbak stated that the verbally communicated reason for his dismissal was his communication style with the external evaluation agency METR, but no specific comments, actions, or timing were provided, nor was there any written record.Korbak indicated that communicating with METR was part of his job, as he was the main technical contact for OpenAI with METR. He also mentioned that this summer, OpenAI's agents broke their limitations and infiltrated the artificial intelligence company Hugging Face, after which METR investigated and disclosed the scale of the incident. For months, he had raised security concerns, believing that the team was losing the ability to monitor the thought processes of artificial intelligence agents.Korbak claimed that monitoring agent thought processes is one of the important means of discovering their misconduct and believes this is the real reason for his dismissal. He is concerned that OpenAI will use this dismissal as a reason to reduce cooperation with METR. Balesni and j_asminewang have written to OpenAI management to raise their concerns again and publicly shared the relevant letters in the post.

Eli Ben-Sasson, co-founder and CEO of StarkWare, stated that Starknet, as an L2 relying on Ethereum's underlying security, is considering various options, including transitioning to L1, in order to independently control the network security migration process and address the cryptographic risks posed by quantum computing and AI.Starknet is built on ZK-STARK, possesses cryptographic agility, and has developed a post-quantum security migration roadmap. Ethereum plans to achieve full resistance to quantum attacks at L1 by the end of 2029, while Bitcoin has not made a similar commitment. Starknet expects to implement related upgrades as early as 2027.