toolkit

The decentralized prediction market platform Polymarket is suspected to have been hacked, with the threat actor xorcat posting over 300,000 data records and a corresponding exploit toolkit on a well-known cybercrime forum.It is reported that the attacker extracted data through undisclosed API endpoints, pagination bypass, and CORS misconfigurations in Polymarket Gamma and CLOB API. The leaked content includes: 10,000 users' complete personal information (including names, proxy wallets, and base addresses), 4,111 comments, 1,000 reports (including 58 ETH addresses and administrator verification address identifiers), 48,536 Gamma market metadata, over 250,000 active CLOB market fixed product market maker addresses, and 9,000 social graph data of followers.The toolkit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (Axios NO_PROXY bypass, CVSS 9.9, which can trigger server-side request forgery), CVE-2024-51479 (Next.js middleware authentication bypass, CVSS 7.5), and CORS misconfigurations. Additionally, the toolkit includes automated continuous pull scripts and a complete red team report.

According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.

According to Decrypt, stablecoin issuer Tether has announced the launch of the open-source software development kit QVAC SDK, which supports running AI applications directly on devices without relying on cloud servers.The toolkit is compatible with iOS, Android, Windows, macOS, and Linux platforms, built on the llama.cpp branch QVAC Fabric, and supports functions such as text generation, speech processing, visual recognition, and translation. It achieves peer-to-peer model distribution and delegated inference through the Holepunch protocol stack. Tether plans to subsequently add decentralized training and fine-tuning capabilities and launch specialized toolkits for robotics and brain-computer interfaces.

According to official news, the cryptocurrency project World Liberty Financial, supported by the Trump family, announced the launch of the AgentPay SDK, an open-source, self-hosted payment toolkit designed for AI agents. This SDK integrates self-hosted key management, policy-based transaction authorization, and can connect to commonly used AI development tools such as Claude Code, Codex, Cursor, and OpenClaw.The AgentPay SDK allows AI agents to hold, transfer, and operate USD1 stablecoins on EVM chains, with transactions signed locally. The policy engine can set single and daily limits, requiring manual approval when thresholds are exceeded. The SDK also includes a built-in Bitrefill purchasing feature. World Liberty Financial stated that USD1 is positioned as the economic operating layer for autonomous AI systems, aimed at addressing the issue of how AI agents can make payments securely and reliably. The SDK currently supports Ethereum and BSC networks.

According to official news, OKX has officially released the Agent Trade Kit, an open-source MCP toolkit designed for AI-native trading workflows, covering the complete link from market discovery to strategy execution. Currently, the Agent Trade Kit has 83 tools, making it the CEX AI product with the most tools in the industry. Among them, options AI trading, algorithmic delegation, and bot strategy management are exclusive capabilities of OKX, which also features a built-in simulation mode that allows users to validate strategies in a zero-risk environment. In terms of security, the Agent Trade Kit is fully open-source, and the API Key exists only locally, with the AI having no access to the keys throughout the process.It is reported that the OKX Agent Trade Kit and OKX Onchain OS cover both on-chain and CEX scenarios, making it the most comprehensive AI trading ecosystem in the industry.

According to Bitcoin News, Lightning Labs has officially released a set of open-source tools that allow AI agents to autonomously send and receive Bitcoin payments through the Bitcoin Lightning Network without the need for human approval, accounts, login credentials, or API keys.The toolkit uses the L402 protocol, built on the HTTP 402 "Payment Required" standard. Websites can send Lightning Network invoices to AI agents, and after payment, the agents receive a digital payment receipt as an access key to unlock services or data. The toolkit also includes the "lnget" tool, which can automatically handle paid content access requests in the background. Additionally, the toolkit supports AI running Lightning nodes, managing permissions, hosting paid services, and completing transactions between agents, while also incorporating spending limits and remote signing protection.

ChainCatcher news, Circle announced the launch of the developer toolkit Bridge Kit, which simplifies the integration work for cross-chain transfers, starting with support for CCTP and USDC.Bridge Kit encapsulates the core functionalities of CCTP V2 into concise SDK methods, providing detailed step-by-step documentation, example code ready for production, and built-in monetization logic, allowing developers to benefit from every transfer. Whether upgrading existing integrations or building new applications, Bridge Kit helps developers bring prototypes to production as quickly as possible.

ChainCatcher news, Tether officially releases the fully open-source wallet development toolkit WDK, which also includes a starter wallet for iOS and Android systems. This starter wallet is a compact and fully functional example that demonstrates the convenience of developing a complete digital asset wallet using Tether's wallet development toolkit.

ChainCatcher news, Tether CEO Paolo Ardoino released demo information about the wallet development kit WDK on the X platform, showcasing the key points of the product, including: 100% built by Tether, reusable encapsulated UI components, upcoming open source, fully non-custodial, suitable for any platform/operating system (including mobile and desktop), supports USDT, USDT 0, and passed security audits, etc.

ChainCatcher news, Stripe's product manager Jeff Weinstein posted on X that they are launching a software development kit (SDK) specifically built for AI agents. This toolkit supports large language model (LLM) calls to payment, billing, issuance, and other APIs, integrating with Vercel, LangChainAI, CrewAIInc, and allows the use of any model through functions.

ChainCatcher news, according to Coindesk, Polygon Labs has released the latest version of its zero-knowledge proof system, Plonky3, which is more flexible than the previous Plonky2. Zero-knowledge proof systems are core components of the blockchain ecosystem, responsible for generating proofs to summarize off-chain transactions and relaying information back to the main chain.Plonky3 has now been released as open-source software under the MIT and Apache licenses. Polygon plans to integrate all proof systems into a single codebase and framework to enhance future technological development.

ChainCatcher news, MetaMask's parent company Consensys has released a new toolkit called "MetaMask Delegation Toolkit" to simplify the user experience of blockchain applications and plans to allow developers to use its new product.The toolkit allows users to log in instantly without interacting with traditional wallets, eliminating confirmation pages or pop-ups when users switch between DApps and wallets.Additionally, Consensys stated that the toolkit is designed to simplify the development of smart contracts and allows developers to reallocate gas costs, enabling certain individuals to not have to pay any fees.

ChainCatcher news, the decentralized AI computing platform Ritual has announced the open-sourcing of the toolkit infernet-ml for building machine learning workflows on Infernet.

ChainCatcher news, Paradigm and Wevm have collaborated to launch the Frog toolkit based on Farcaster Frames, allowing developers to build high-quality, high-performance, and lightweight frameworks with minimal code.In addition, Frog comes with a built-in debugger that supports live reloading, enabling developers to establish a tight feedback loop between the code and the framework interface. Frog is integrated on top of the small and fast JavaScript web framework Hono, allowing users to build frameworks using JSX and integrate them into any platform or runtime, such as Cloudflare, Vercel, Next.js, Bun, etc.

ChainCatcher news, the decentralized auction platform Bounce Brand has announced the launch of BounceBox. BounceBox is similar to the App Store of the Bitcoin staking chain BounceBit, offering a wide range of Web3 components that provide users with convenient tools for building dApps, akin to setting up an online store.

ChainCatcher news, the Tokyo-based crypto investment firm CGV has officially announced a strategic investment in the Bitcoin ecosystem aggregation toolkit and automated asset issuance platform Biis.It is reported that Biis is positioned as a "BRC ecosystem toolbox" for developers and users, aiming to provide a comprehensive set of integrated tools for project developers and users. It integrates a series of technology stacks, including: batch distribution and aggregation of BRC20 tokens, batch distribution and aggregation of BRC-721 NFT assets, and other integrated tools; in the future, it will also launch a fully automated asset release platform that supports multiple asset release modes such as Free Mint/AirDrop/IDO, and will provide a Dao voting system for inscriptions to facilitate automated project releases and community decentralized governance. There are also plans to open source its code in the future.

ChainCatcher News, the American Cancer Society (ACS) has ventured into Web3 to explore alternative forms of capital allocation and has chosen the Gitcoin Grants Stack as its preferred toolkit. This marks the second time Gitcoin technology has been utilized by a prominent nonprofit organization, the first being a powerful QF collaboration pilot project in 2022 in partnership with UNICEF.It is reported that Gitcoin is part of the OKX Ventures portfolio, focusing on public goods funding and developer community support. The two have jointly supported the first-ever Schelling Point conference held in the Asia-Pacific region in Singapore this year. Gitcoin Steward Council member and OKX Ventures partner Jeff Ren stated, "We are very excited to see traditional sectors innovating through blockchain technology, and Gitcoin is bringing positive social impact to the developer community and the broader society. This symbolizes the push for positive social impact and the enhancement of mass adoption, and OKX Ventures will continue to support these efforts and related enterprises."

ChainCatcher message, OpenSea announces the launch of the Solidity open-source repository Shipyard for NFT developers. Shipyard combines multiple NFT libraries and implementations, providing resources for building various types of NFT projects, offering developers: dynamic on-chain metadata, seamlessly transferable NFTs, and encoders and decoders for implementing Seaport Improvement Proposals (SIPs).

ChainCatcher news, the Hedera team announced the launch of the open-source stablecoin issuance and management toolkit Stablecoin Studio, to support Web3 stablecoin platforms, institutional issuers, enterprises, and payment providers in developing stablecoin applications using Hedera network services.It is reported that the toolkit provides oracle-based proof of reserves functionality, commercial custodian integration points, and easily configurable KYC/AML compliance features.