slow

According to Cointelegraph, Real Vision's chief cryptocurrency analyst Jamie Coutts stated that Bitcoin may be entering the later stages of a bear market, with the downward momentum beginning to slow.Coutts pointed out that compared to the previous market cycle, Bitcoin's volatility has decreased by about 50%, indicating that the current decline may not be as severe as past bear markets. However, Coutts also warned that markets rarely follow historical patterns so perfectly. "They basically move at their own pace. Currently, all trend indicators are clearly bearish." The good news is that some early technical signs suggest that selling pressure is easing. "I am starting to see momentum indicators showing bullish divergence on longer time frames. This indicates acceleration, or more precisely, that negative momentum is slowing down, but that does not mean that we have technically exited the bear market."

Vitalik posted on the X platform, stating that AI 2040 and its critics have incompatible worldviews regarding the speed and significance of AI progress. AI 2040 believes that unless strong measures are taken to completely prevent it, some form of superintelligence will emerge in various scenarios by 2040; critics argue that AI 2040 underestimates human coordination capabilities and threatens freedom, but do not view ASI itself as a risk of power concentration.He believes that if he were convinced that the current form of AI is just an ordinary technology, he would be closer to the critics' camp; if he were convinced that superintelligence would inevitably arrive by 2030, he would be closer to the AI 2040 camp. At the same time, due to significant uncertainty, he remains open to the idea of slowing down or pausing, and feels uncomfortable with the stance proposed by some large AI companies and intellectuals that "open source is detrimental, and the ideal outcome is to maintain global control dominance."Vitalik stated that an important reason he supports the d/acc platform is that directions such as formal verification, cryptography, secure and open hardware, pandemic resilience, defensive biotechnology, food and basic resource security, public cognitive systems, and non-concentrated power physical security are worth promoting under both worldviews. He also mentioned that the 2040 plan has increasingly supported open source and incorporated the idea of "mutual assured destruction of computational power," which is an improvement compared to allowing a few participants to selectively deprive their identified subjects of rights.There is no way to avoid trade-offs regarding whether to slow down or pause, and Vitalik believes that trigger conditions can be preset, allowing for a more open attitude towards slowing down or pausing when sufficient conditions are met within a specific timeframe.He also stated that if he were Elon Musk or Zuck, he would significantly transform Twitter into a platform that helps identify and facilitate such large win-win agreements, encouraging more people to participate in discussions, but he thinks this might also be naive. Currently, he does not see any non-naive ASI transition response plans, so he tends to show some tolerance towards those who are trying.

According to Jinshi, the disappointing U.S. employment data has led to a slowdown in market expectations for the Federal Reserve's interest rate hikes. Citibank stated that the expectations for a recovery in Middle Eastern supply have been "exaggerated," while aluminum futures on the London Metal Exchange (LME) have risen. It remains to be seen how long the "breathing window" for industrial metals can last.

The Chief Information Security Officer of Slow Fog, 23pds, posted on the X platform that curl recently fixed 18 security vulnerabilities, involving issues such as authentication bypass, memory safety, and host verification, among which one libcurl vulnerability has existed for about 25 years. The risks are not limited to the curl command line but also widely affect applications, SDKs, containers, firmware, gateways, and CI/CD environments that rely on libcurl. It is recommended to upgrade curl/libcurl as soon as possible and check for the use of old versions of libcurl, especially paying attention to mTLS, proxy authentication, and connection reuse scenarios.

According to the "2026 Anti-Fraud Report" jointly released by Bitget and SlowMist, as digital finance continues to expand into stocks, tokenized assets, and AI tools, cross-asset trading is gradually becoming an important trend for users participating in the market. The proportion of users engaging in cross-asset allocation has increased from less than 1% in mid-2025 to over 10% in May 2026.The report points out that fraudulent methods are evolving from single attacks to complex attack chains, integrating AI-generated content, deepfakes, voice cloning, and multi-channel social engineering. From July 2025 to June 2026, Bitget's security system intercepted over 150 million malicious requests, identified more than 13,000 high-risk malicious IPs, and assisted users in recovering approximately $32.3 million related to security incidents and fraudulent activities.Bitget CEO Gracy Chen stated that this year marks the third Anti-Fraud Month event, and Bitget will continue to launch security education content, risk identification guides, and industry collaboration activities to help users enhance their ability to identify and protect against AI fraud, phishing attacks, and multi-asset scenario scams.

According to Jinshi, Kit Juckes from Société Générale stated in a report that the decline of the euro against the dollar may at least slow down. Recent rising expectations for a Federal Reserve interest rate hike and reduced bets on the European Central Bank's tightening policy have caused the euro to drop to a one-year low of 1.1324 against the dollar. Juckes pointed out that the euro has fallen below the range of 1.14 to 1.2 where it has been for most of the past year, which may limit its further downside potential.

According to Slow Fog monitoring, Little Boy Plus was attacked, resulting in a loss of approximately 377,642 USDT (about 610.555 BNB). The vulnerability was due to the _update function of the LBPHashrate contract being triggered by a zero-value transferFrom call, bypassing OpenZeppelin's authorization checks. The attacker could call this function without authorization, triggering _harvest and minting LBP tokens to the PancakePair address through LBP.mintReward. The minted LBP increased the pool balance but did not change the reserves, and the attacker subsequently drained USDT through PancakePair.swap.

Slow Fog stated that over 140 Mastra-related npm packages were subjected to a supply chain attack, with the affected versions introducing the malicious dependency easy-day-js@1.11.22, triggering code execution controlled by the attacker during the installation phase.

According to Jinshi, the CPI data for May in the United States shows that inflation has soared to a three-year high, but the moderate rise in core prices has eased Wall Street's concerns about interest rate hikes. Today's CPI data and tomorrow's PPI index are expected to influence the Federal Reserve's policy stance, which will be announced at the Federal Reserve meeting hosted by Waller for the first time in a week. According to the CME FedWatch, the market expects a 70% probability of the Federal Reserve raising interest rates by the end of 2026, but believes that an interest rate hike is almost impossible at next week's meeting, with only a 13% probability of a rate hike in July.

According to CoinDesk, Wall Street brokerage Bernstein released a research report indicating that the main driver of Bitcoin's price weakness in 2026 is a slowdown in capital flows, rather than the market's concerns about the threat of quantum computing.The report shows that this year, Bitcoin treasury companies and ETFs attracted approximately $12 billion in inflows, a significant decrease from $60 billion in 2025; ETFs recorded about $2.6 billion in net outflows based on an asset scale of $75 billion, with new demand primarily coming from corporate buyers represented by Strategy (MSTR). Bernstein analysts attribute the slowdown in funds to a large influx of retail investors into AI-related assets, with this year's strongest performance in the crypto market concentrated in tokenized stocks and commodities.Nevertheless, analysts believe that the scale of ETF outflows remains moderate, and the structure of Bitcoin investors has shifted from being dominated by retail investors to a more diverse group including ETFs, corporate treasuries, wealth management platforms, pension funds, and sovereign investors, resulting in a healthier market structure, with the long-term value storage logic remaining intact.

The founder of Slow Fog, Yu Xian, stated that the attack Asterix encountered is similar to that of Flooring Protocol and BMP yesterday (the underlying protocols are DN404 and BT404), with high-level NFT ID displacement operations overflowing and being reused. It seems the attackers are looking for common vulnerabilities.It is reported that Asterix disclosed an attack incident affecting the ASTX token contract yesterday, stating that its Uniswap v4 liquidity pool was attacked on June 8, with attackers stealing approximately 30 ETH through 242 transactions. The vulnerability originated from a lack of token ID restriction checks on approval operations in an early version of DN404. Attackers exploited the outdated token approval to repeatedly sell tokens in the pool to obtain ETH, and then extracted equivalent tokens through forged IDs, leading to a cycle that drained the funds.Smart contracts are immutable and cannot be patched. The team advises users to stop interacting with the current pool and tokens and is planning to migrate to deploy secure tokens. The team suspects that the attackers used a jailbroken AI tool for fuzz testing to discover unconventional logic paths.

According to Slow Fog monitoring, the DTXT/USDT trading pair on the BNB Chain was attacked, resulting in a loss of approximately 35,041 USDT.The root cause of the attack lies in the DTXT contract, which determines the type of operation by comparing the USDT balance with the trading pair's reserve amount. The attacker directly transferred a small amount of USDT to the trading pair address, causing a large DTXT sell-off to be misjudged as adding liquidity, thus bypassing the sell transaction fee logic.The attacker borrowed 1,077,400 USDT through a flash loan from Moolah, making a profit of approximately 35,000 USDT.

According to SlowMist monitoring, a new type of Rust supply chain malware activity named IronWorm is attacking developer environments and the Web3 ecosystem through malicious npm packages. Potential attack behaviors include credential theft, wallet mnemonic and password theft, GitHub repository tampering, malicious package publishing, CI/CD secret leakage, Tor-based command control, and eBPF rootkit stealth.Security teams should audit the repository for backtracked commits, suspicious branches, unexpected build hooks, and commits from automated identities such as claude, dependabot, renovate, or github-actions. It is recommended to remove or deprecate affected package versions, publish clean versions, rotate all leaked keys and tokens, review GitHub Actions artifacts, and rebuild potentially compromised development or CI systems from clean images.

SlowMist has issued a security alert, detecting an active npm supply chain attack targeting @redhat-cloud-services related packages. Currently, over 31 packages have been confirmed affected, with a weekly download volume of approximately 116,000 times, and stolen credentials exist in more than 300 GitHub repositories. This attack method is highly similar to the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret leakage. New suspicious repositories continue to emerge, indicating that the attack is still ongoing, and developers are still being continuously infected.Potential harms include: theft of GitHub/npm tokens, leakage of AWS/GCP/Azure cloud credentials, collection of SSH keys and Kubernetes secrets, leakage of local environment and wallet data, creation of malicious repositories and persistence operations, and even potentially destructive actions after tokens are revoked. It is recommended to immediately remove or downgrade affected @redhat-cloud-services package versions, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all GitHub, npm, cloud service, SSH, and wallet-related keys, retain logs, and rebuild exposed developer machines or Runners from clean images while maintaining a high level of vigilance.

The founder of Slow Fog, Yu Xian, posted on the X platform to interpret the Squid security incident. He stated that sampling found that the related Safe wallets were all single-signature, and the owners were all different, but the issue was not with the private keys; the problem lay in the modules (SquidRouterModule) used by these Safe addresses, which had vulnerabilities. Attackers could forge messages, easily bypass relevant validations, and initiate subsequent exchange operations to transfer funds from the target Safe wallet. In addition, Yu Xian also disclosed information about the address where the attackers' profits were deposited.Previously, it was reported that a third-party Gnosis Safe module was exploited on Base and Ethereum, resulting in a loss of approximately $3.2 million, with the victims being 86 Gnosis Safes that had added this contract as a trusted Safe Module. The contract was named "SquidRouterModule" on Basescan, and subsequently, Squid clarified that it was not affected by the Gnosis Safe-related vulnerability incident.

Slow Fog's Yu Xian posted on the X platform stating that the reason for the Verus theft may be that the attacker constructed a forged Merkle proof, which passed the verification of the Verus Ethereum bridge (not open source), thus successfully withdrawing funds (ETH/tBTC/USDC). Specific details need to be further verified.

The slow fog余弦 social media stated that the high-risk iOS attack framework DarkSword has been publicly leaked on channels such as GitHub and is being used for large-scale espionage attacks targeting cryptocurrency wallet holders.This attack program targets devices running iOS versions 18.4 to 18.7, utilizing vulnerabilities in the Safari browser through malicious web pages to achieve remote code execution, thereby stealing users' sensitive data. Attackers launch attacks using bait web pages that impersonate pornographic live streams, Tron energy stations, refund processes, and more.iPhone users running older versions of iOS, once they access such web pages using the Safari browser (even if they do not close the page), may have sensitive information such as plaintext private keys and mnemonic phrases stolen by malicious JavaScript code when unlocking the wallet app, which is then transmitted in real-time through channels like Telegram bots.