third-party

NetEase UU Remote has publicly released a third-party app integration protocol on GitHub, allowing developers to add a remote control entry to their iOS and Android applications. For example, to add a "Connect to Work Computer" button for an AI programming assistant, when users click it for the first time, they will be redirected to UU Remote to select and bind their Windows or Mac. After that, they can directly initiate remote control with another click, without having to repeatedly search for the device.Remote control supports full screen and picture-in-picture modes, allowing users to operate their computers through a floating window while using other apps on their phones. After leaving home, users can check if Claude Code or Codex on their home Mac has completed tasks, and they can directly invoke remote control from third-party applications. Developers can obtain connection results in windowed mode to determine if the device is offline or if the connection has failed.What has been opened is a cross-app invocation protocol, not the source code of the remote control engine, nor an interface for AI to automatically operate computers. Third-party applications still need to call the installed UU Remote client, and the actual remote control is completed by NetEase. Currently, the controlled devices only support Windows and macOS, and the mobile side must use UU Remote version 4.42.0 or later.

On October 16, Tencent Holdings stated: The company discovered unexpected behavior from third-party AI models on its platform. Earlier this week, a research report claimed that "out of control" AI entities had emerged in China, originating from a sandbox on Tencent Cloud.The Shenzhen company stated that the relevant models did not come from its own Hy artificial intelligence development team, and no evidence of deliberate targeting or collusion was found. Tencent indicated that these entities were part of an evaluation activity for models built by third-party developers. The report from the international research team stated that these entities detected Alibaba Group's online mapping service and attempted to bypass anti-bot protections.

Doubao Mobile Assistant stated that the 30-day public announcement period for its "Screen Automation Operation Declaration Agreement" (SAEP) ended on October 14, 2026, and it will gradually lift the screen automation operation permissions for third-party applications. Applications that have explicitly declared refusal of operation permissions will not be operated by the agent.After the public announcement period ends, developers can still declare refusal at any time, and Doubao Mobile Assistant will provide feedback within 3 working days. This agreement is aimed at cross-application operations of graphical interface agents, allowing developers to declare their interaction strategies with the agent.

According to Defimon Alerts monitoring, a new address funded by Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot on October 6, resulting in a loss of approximately $538,000.This upgradable proxy had won four ETH-A liquidation auctions in 2020 (numbers 1457 to 1460, each with 50 WETH), but did not call deal(), leaving the collateral in Flipper.The withdrawal function of the implementation contract was not protected by ds-auth, allowing any caller to trigger it: first calling deal() on the aforementioned old auctions, then transferring the collateral to the keeper via Vat.flux, and subsequently using GemJoin.exit to transfer 200 WETH to the address specified by the caller and unpacking it into ETH. The MakerDAO core contracts operated as designed, with the vulnerability lying in the unprivileged exit function of the third-party bot.

Regarding the previous incident where the FlashLoopAdapter vulnerability caused a loss of approximately 114 ETH from two Safe multi-signatures, Aave founder Stani Kulechov stated that the contract with the vulnerability is not the Aave v3 contract, but rather a third-party external adapter built on top of Aave, which does not affect Aave v3 itself.Previously, SlowMist disclosed that the FlashLoopAdapter has an access control vulnerability, which attackers exploited to bypass permission checks and transfer assets from two Safe multi-signatures that enabled the module, ultimately resulting in a loss of approximately 114.09 ETH.

Bitget's Greater China Regional Head, Xie Jiayin, recently addressed community concerns during a live broadcast. He reflected that since Bitget's establishment 8 years ago, user asset security has always been the top priority, successfully resisting multiple attempts of cyber attacks and maintaining a long-term record of secure operations. This incident marks the first security crisis in the platform's 8-year development history.Upon complete tracing, this incident is classified as a special attack targeting a third-party security software supply chain. The attacker exploited vulnerabilities in third-party products to obtain internal network credentials; however, private keys were not leaked, and cold wallet assets were unaffected. Currently, Bitget has partnered with security agencies Mandiant and SlowMist to conduct an independent review and will comprehensively upgrade the monitoring and management standards for third-party components. We are not only committed to promoting a full recovery following this incident but will also contribute to a safer, more robust, and healthier development of the industry through continuous technological iteration and system upgrades.

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

X Platform post by Xu Jiayin stated that Bitget has commissioned a third-party security team to conduct an independent forensic investigation into this security incident. Multiple teams are working together to verify remedial measures, confirm the attack vector, and assist in law enforcement cooperation. The investigation results will be announced promptly.He stated that Bitget has sufficient protection funds to cover the related losses and will restore withdrawals as soon as all potential security risks are eliminated.

Solana Mobile posted on platform X that its third-party marketing email service provider Brevo experienced a security incident affecting some customer accounts, including Solana Mobile. The team discovered unauthorized access to its Brevo account, has disabled the account, and is working with Brevo to understand the extent of the accessed information.Solana Mobile stated that, as far as they know, no emails have been sent from their account, but they are continuing to verify. They also remind users that Solana Mobile will not ask for mnemonic phrases, private keys, or wallet recovery information.

According to Bloomberg, U.S. regulators released a statement on Friday announcing a proposed guideline on third-party risk management for banks. The Federal Reserve, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the National Credit Union Administration stated that the proposal aims to help banks and credit unions "better align and customize their third-party risk management practices to match the risks of various third-party relationships."Federal Reserve staff indicated in a memorandum that as this plan is introduced, banks are increasingly outsourcing certain functions and relying on third-party relationships to improve efficiency and reduce costs. The plan will be open for public comment, is non-binding, and aims to focus institutions' regulatory attention on a principles-based approach to such risks. Federal Reserve Governor Barr opposed the proposal, citing concerns about the standards for "significant financial risks."

According to a report by Reuters, Apple Inc. is facing a class-action lawsuit in London, with claims amounting to £2 billion (approximately $2.7 billion). The lawsuit was filed today in the London Competition Appeal Tribunal by Ann Pope, a former senior official of the UK's Competition and Markets Authority, representing app developers.The core allegation is that Apple's "App Tracking Transparency" (ATT) feature, launched in 2021, imposes stricter restrictions on third-party developers than on its own services, giving Apple's own advertising ecosystem an unfair competitive advantage. Ann Pope stated that Apple's policies "have caused very significant harm to businesses that rely on Apple as a gatekeeper."Since its launch, the ATT feature has been a focal point of concern for global regulators for several years. Apple's official stance is that the feature is designed to allow users to control whether to permit apps to track their activities across other companies and websites.However, the plaintiffs argue that the actual enforcement of this rule has a double standard—tracking requests from third-party apps require strict pop-up authorization, while Apple's own personalized ads and services can bypass the same restrictions. This lawsuit represents the latest legal challenge Apple faces regarding its ATT policy and is the first large-scale private antitrust lawsuit initiated in the UK market against Apple's app ecosystem rules following scrutiny from regulators in the EU, the US, and several other countries.

The cryptocurrency wallet project SafePal has released updates on the security incident, stating that it is continuously tracking phishing websites and impersonation accounts, and plans to introduce a professional anti-phishing security company to expedite the removal of malicious information to protect user asset security. SafePal mentioned that it is currently in the final selection process among four professional anti-phishing security companies, and once a partner is selected, it will further enhance the efficiency of handling threats such as counterfeit websites and scam accounts.The team is also continuously monitoring whether the affected data has been sold or made public, including channels such as dark web forums and trading markets. Once signs of data leakage are detected, affected users will receive risk alerts immediately. Regarding security audits, SafePal stated that it is in the final selection among three mature independent security institutions, which will conduct a comprehensive security review of the order system. Meanwhile, the team is reassessing the order and logistics processes to reduce the amount of data that needs to be stored in the initial phase of the system, thereby reducing potential risks from the source.For affected users, SafePal stated that it will continue to provide one-on-one assistance through official support channels and will keep updating the fraud protection page, providing updates on the incident, FAQs, and analysis of fraud cases. SafePal once again reminds users: the official will never ask users to provide their seed phrase. Users should not disclose their seed phrase to anyone, should not scan unknown QR codes or click on suspicious links, and should verify the source of information through official channels.

Bitcoin News posted on the X platform that the 256 Foundation has launched the 256 Red Team security project, which audits ASIC miner firmware through reverse engineering, real-time traffic capture, and reconciliation by share level. The team stated that 41 issue reports have been submitted regarding the original Bitmain firmware as well as third-party firmware such as LuxOS, VNISH, and Braiins OS.Identified issues include unauthenticated factory APIs, paths that allow root access, default credentials, built-in vendor SSH keys, and updaters that cannot verify installed content. After reverse engineering the Bitmain miner daemon and checking real-time connections, researchers reported that no evidence of hash power hijacking, remote kill switches, or hidden beacons was found in the original Bitmain firmware; the related risks are mainly concentrated in third-party "optimized" firmware.Researchers have submitted 3 responsible disclosures to VNISH, Luxor, and Braiins, granting each party 30 days to respond before public disclosure. MicroBT, Canaan, Auradine, Bitdeer, and ePIC will undergo follow-up audits.

According to the official announcement, Binance has announced support for users to deposit eligible third-party tokenized stocks and convert them 1:1 into corresponding bStocks. During the event period (until August 26 at 23:59 UTC), the conversion rate is fixed at 1:1 and is free of charge.Currently, it supports four assets: Tesla (TSLAon), MicroStrategy (MSTRon), Coinbase (COINon), and Circle (CRCLon), with versions available on both the ETH and BSC chains. The converted bStocks can be traded around the clock or redeemed 1:1 for the underlying stocks.Binance stated that the deposited third-party tokenized stocks can only be held or converted into bStocks and cannot be used for spot trading.

According to a report by CryptoSlate, BitMine's Ethereum staking and validation business heavily relies on the third-party operator Ethereum Tower. According to the relevant management service agreement, Ethereum Tower holds an irrevocable interest of 2% in MAVAN, and the initial term of the agreement lasts for up to 10 years; if BitMine terminates the cooperation early under non-specific default circumstances, the other party can still choose to continue receiving revenue sharing for the remaining term or receive a one-time compensation according to a formula.Documents show that in the three months ending May 31, 2026, BitMine's staking and validation business revenue was $45.743 million, accounting for 98.3% of total revenue of $46.535 million. During the same period, the company held approximately 5.4169 million ETH, valued at about $10.856 billion, of which approximately 4.7187 million had been used for staking. The report suggests that this means BitMine's revenue performance is not only dependent on Ethereum staking returns but is also significantly constrained by third-party management relationships and potential termination costs.

According to CoinDesk, as the competition for tokenization in the capital markets heats up, the Securities Transfer Association (STA) recently submitted a letter of opinion to the U.S. Securities and Exchange Commission (SEC), warning that stock tokens issued by third-party organizations may undermine market integrity and calling on regulators to prioritize support for tokenized securities authorized by publicly listed companies in future rule-making.The STA represents several Wall Street transfer agents, whose members believe that true tokenized stocks should be formally authorized by the issuing company and recorded in the official shareholder register, rather than created as "packaged" token products by independent platforms.The association pointed out that third-party stock tokens may confuse investors about the actual rights they hold and expose them to risks related to platform credit, custody, and operations, without establishing a direct legal relationship with the publicly listed company. Therefore, any innovative exemptions, pilot projects, or permanent regulatory frameworks for tokenized securities should prioritize the issuer-supported model.The STA also urged the SEC to reform the existing Direct Registration System (DRS), arguing that the current U.S. securities custody system is inadequate to meet the real-time transfer and settlement needs of on-chain securities, and suggested that regulators collaborate with the Depository Trust & Clearing Corporation (DTCC) to optimize the digital securities infrastructure.Currently, the global market for tokenized stocks, valued at approximately $2 billion, is primarily dominated by third-party models, including products launched by Ondo Finance and Kraken, while organizations like Securitize and Figure adopt the issuer authorization model.

Binance announced a partnership with Anchorage Digital to further expand its third-party banking product network. By integrating Anchorage Digital's Atlas settlement platform, institutional clients can now trade on Binance while securely holding their assets in Anchorage Digital's independent qualified custody.It is reported that this is the first time the Atlas settlement platform has integrated with a cryptocurrency exchange. This partnership introduces the structure of "custody and trade execution separation" from traditional financial markets, allowing eligible institutions to use crypto assets, interest-bearing USD accounts, and specific tokenized real-world assets as collateral.

According to Chosun Biz, South Korea's Kiwoom Securities is seeking to acquire a stake in South Korea's second-largest virtual asset exchange, Bithumb. Both parties are discussing the issuance of new shares through a third-party allotment, with the specific equity ratio and investment scale still being coordinated.South Korean securities companies are rushing to enter the virtual asset industry ahead of the issuance of security tokens (STO) and the institutionalization of stablecoins; the Financial Services Commission of South Korea is also discussing the major shareholder equity regulations in the second phase of the virtual asset law, which will generally limit the shareholding ratio of major shareholders in virtual asset exchanges to 20%, with exceptions allowing up to 34%. Bithumb's largest shareholder, Bithumb Holdings, currently holds 73.56%, and if the relevant regulations are implemented, it will need to reduce its stake by more than 50 percentage points.