xpos

Bitcoin News posted on the X platform stating that Trezor claims its customer data was exposed due to a security breach at the logistics provider ShipMonk. Customers who placed orders in the past 90 days in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal may be affected. The exposed data includes full names, shipping addresses, phone numbers, email addresses, and order numbers.Trezor stated that its systems were not compromised, and the devices remain secure, but it warns affected customers to be vigilant against carefully designed phishing attacks that exploit the leaked information.

CLR revealed on platform X that pump.fun is attracting users to migrate from the FOMO platform through an incentive program. According to the disclosed agreement documents, pump.fun plans to offer eligible users a one-time signing bonus of $20,000 and a fixed monthly salary of $30,000. The agreement requires users to: migrate funds and trading positions from the FOMO platform to pump.fun; use a new wallet that has not been used by other platforms as an exclusive wallet; bind their X (formerly Twitter) account to the pump.fun wallet; publicly declare on their X homepage that this wallet is the only public wallet; and permanently delete and close their FOMO platform account.In addition, users must also meet real trading requirements, including completing at least $25,000 in trading volume on pump.fun each month (or 25% of the previous average monthly trading volume on the FOMO platform).

According to Bloomberg, former OpenAI researcher Leopold Aschenbrenner's AI fund Situational Awareness has splurged $400 million this week to support a private company, which is the semiconductor manufacturing startup Source Foundry. It is reported that VC giant Sequoia Capital has also provided support for this startup. So far, representatives from Situational Awareness and Source Foundry have not responded to requests for comments, while Sequoia Capital has declined to confirm the hedge fund's investment situation.It is reported that Source Foundry is dedicated to developing a semiconductor manufacturing process that is simpler, cheaper, and faster than existing methods, aiming to bridge the widening gap between the demand for AI computing power and the capacity expansion of chip manufacturing. Analysts believe that Leopold Aschenbrenner's large-scale investment reflects the ongoing strong demand in the market for new chip manufacturing technologies, as AI developers' demand for computing power is increasing day by day. However, this investment also reveals that Situational Awareness has formed a highly concentrated risk exposure before facing significant financial pressure due to severe fluctuations in its publicly held technology positions.

Bank of America strategists indicate that investor bullish sentiment has reached extreme levels, suggesting a reduction in exposure to risk assets. The Bull-Bear Index rose from 9.4 to 9.7, marking the highest level since 2021. The rise in the stock market, inflows into high-yield bond funds, and narrowing credit spreads are the reasons for the optimistic sentiment.Hartnett stated that we are still in the summer "withdrawal/rotation" phase, advising investors to reduce allocations to risk assets and shift towards defensive assets and the dollar.

ether.fi announced that it has removed all re-staking exposure of weETH, making it a purely liquid staking token (LST), with the re-staking function transferred to the independent token weETHs based on Symbiotic.Previously, ether.fi bundled Ethereum staking yields with EigenLayer re-staking exposure into a single token, making it the largest protocol based on the EigenLayer re-staking model. Currently, its re-staked assets on EigenLayer account for less than 1%, with plans to reduce this to zero by the third quarter of 2026 and completely remove EigenPod withdrawal vouchers in the fourth quarter.ether.fi CEO Mike Silagadze stated, "The end of an era. It's sad. I still believe re-staking will return in some form, just a bit too early."

According to Jinshi, the Bank of England is investigating the rapid growth of investment banks operating in London with exposure to Asian stocks, as officials hope to avoid highly concentrated bets on a few companies related to artificial intelligence.Hedge funds and other institutional investors are rushing to invest in companies providing key infrastructure for the artificial intelligence semiconductor industry in Asia, such as SK Hynix and TSMC. The Bank of England is concerned that these stocks are gradually becoming an increasingly important part of the positions held by major brokers, with holdings highly concentrated in a few companies.

According to a report by The Paper, the Intermediate People's Court of Xilin Gol League in Inner Mongolia upheld the original verdict in the second trial of the case involving Ma for illegal business operations. This case is part of a series of cases where the Sifang payment platform provided funding and payment settlement for gambling platforms. Some defendants in this case were accused of receiving commissions or rebates in the form of virtual currencies such as USDT.It was found that from May 24, 2022, to October 18, 2023, Ma and four others illegally collected and paid funds through third-party payment accounts, and received USDT virtual currency and bank card payments through virtual wallets. They settled amounts exceeding 2.95 billion yuan through 105 merchants of 10 third-party payment companies.Ultimately, the court determined that Ma was guilty of illegal business operations, sentencing him to four years and six months in prison and imposing a fine of 3 million yuan. The five individuals who turned themselves in have been sentenced to prison terms ranging from 3 to 6 years for illegal business operations.

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

The founder of Slow Fog, Yu Xian, retweeted a tweet on the X platform regarding the potential poisoning attack risks of Claude Code and published an analysis of the poisoning attack details targeting Grok Build CLI and Claude Code CLI.It pointed out that the security mechanisms of Grok Build CLI are not unified, with different code paths having different trust assumptions, creating gaps that serve as channels for attackers. Attackers may execute arbitrary commands through malicious project configuration files without the user's knowledge, thereby stealing API keys, cloud credentials, or controlling local devices.Researchers constructed a testing environment and found that on Mac systems, if Claude Code is affected, executing specific test commands can trigger the local calculator to launch, proving the existence of potential command execution risks.If the attack is successful, attackers may further steal API keys from AI services like Claude and OpenAI, resulting in account cost losses, gain access to servers and data by obtaining cloud service credentials from AWS, Alibaba Cloud, Tencent Cloud, modify code repositories to implant backdoors, and use local devices as jump points to attack corporate internal networks. It is reported that the related vulnerabilities have existed for a year.

India imposes a uniform 30% tax on the income from virtual digital assets and an additional 1% withholding tax on the transfer amount. Approximately 54 cryptocurrency service providers in the country have registered with the financial intelligence department, serving 39 million verified users, who collectively hold about $2.1 billion in assets.The Reserve Bank of India (RBI) has repeatedly expressed to Parliament its preference for a prohibitive policy towards private cryptocurrencies and stablecoins, urging banks to avoid related exposures to protect financial stability. The long-promised cryptocurrency bill has yet to be completed.Indian government agencies are also using permissioned blockchain in non-trading scenarios. AIIMS Delhi uses blockchain to manage teacher recruitment records, the Cotton Corporation of India tracks cotton bales through a blockchain identification system, and the aviation regulator DGCA is building a digital service platform associated with blockchain.

According to The Block, a global anti-fraud operation led by INTERPOL has arrested over 5,800 suspects and successfully uncovered a cryptocurrency money laundering network that used cross-chain token exchange methods to conceal illegal fund flows.One suspect's digital wallet processed over $122.5 million in funds in just 10 months. On-chain analysts pointed out that while cross-chain operations increase tracking difficulty, it does not mean that fund flows cannot be traced. Such cases indicate that financial crimes continue to evolve alongside the advancement of blockchain technology.

According to a report from Hongxing News, an investigation report leaked from a scam park in Myanmar shows that global telecom fraud is accelerating towards an "AI industrialization + cross-border encrypted payment" system. The scam network completes fund circulation through cryptocurrency and uses automated tools based on large models for multi-language script generation, identity disguise, and emotional manipulation.According to the investigation analysis, these systems extensively utilize OpenAI's ChatGPT and Google's Gemini at the functional level to support "scaled social fraud." The funding side achieves rapid laundering and transfer through on-chain payments and cross-border channels, forming a dual structure of "AI customer acquisition + encrypted settlement," which gives the fraud industry a high degree of automation and transnational diffusion capability. In addition, Starlink, owned by Musk, has become the number one network service provider for the scam park in Myanmar, with American ISP providers carrying nearly one-fifth of the park's traffic.In response to the related accusations, OpenAI stated that the behavior of scammers using ChatGPT is highly similar to that of ordinary users, making identification difficult. However, they have banned about 100,000 suspicious accounts monthly through behavioral pattern recognition and risk control systems. Google stated that its AI models have safety barriers in place and emphasized its commitment to "responsible AI development" to limit the tools' use for fraud and other illegal purposes.

According to CoinDesk, researchers from the blockchain security company Hexens have discovered a "stale cache" type obfuscation vulnerability in the Aptos blockchain Move virtual machine. Attackers only need about $3,000 in server costs to launch an attack in a simulated environment with nearly a 90% success rate, without requiring validator permissions or insider knowledge.In simulated tests, researchers ran about 20 attacks, successfully executing 17-18 times, and verified the potential control over cross-chain protocol management permissions such as LayerZero, Wormhole, and USDC CCTP.Hexens assesses that this vulnerability directly threatens DeFi, stablecoins, and liquid staking protocols on the Aptos chain, involving low single-digit billion-dollar assets; if spread through cross-chain bridges, stablecoin minting, and centralized exchanges, the systemic risk exposure could reach up to $70 billion. The Aptos team completed the fix and deployed it to the mainnet within hours of receiving the vulnerability report on February 25, and currently, no user funds have been compromised.

According to Cointelegraph, a study based on 857,000 active users of Polymarket shows that about 60% of users who placed their first bets during the World Cup had never interacted with blockchain protocols before.Alvin Kan, Chief Operating Officer of Bitget Wallet, stated that prediction markets have changed the traditional logic for crypto users to get involved—users no longer need to understand blockchain technology first, but can participate directly because they have opinions on real-world events. This has made prediction markets a new entry point for some users into the crypto space.Data shows that the trading volume of Polymarket's World Cup champion contracts has exceeded $3.1 billion, with sports contracts contributing over $4.9 billion in trading volume to Polymarket in the past 30 days, and reaching $8.5 billion on Kalshi, becoming the main trading category on both platforms.

The Chief Information Security Officer of Slow Fog, 23pds, stated that researchers have exposed a high-risk vulnerability in CI/CD called Cordyceps, affecting the open-source repositories of major companies such as Microsoft, Google, Apache, and Cloudflare. Attackers do not need corporate accounts or any system permissions; they can simply register a free GitHub account, submit a malicious PR, and leave a comment to forge approvals, steal server keys, and push malicious code, completely taking control of the corporate code repository.

According to CoinPost, Japan's national corporate pension fund plans to start investing in cryptocurrencies in the fiscal year 2026, with an allocation ratio of about 1% of its total operating assets (approximately 21.3 billion yen).The report states that the asset allocation ratio for the fiscal year 2025 is: 80% in yen, 15% in US dollars, and 5% in other currencies. However, in the fiscal year 2026, the yen allocation ratio will decrease to 70%, and a new 10% allocation will be made for currencies from developed countries. The remaining 5% will consist of emerging market currencies, gold, and cryptocurrencies.The main purpose is to diversify currency risk. The fund's executive director, Ai Yuki, stated that due to the potential weakening of the US dollar as a benchmark currency, they decided not to increase their holdings in US dollars and instead use cryptocurrencies like Bitcoin as a hedge against currency depreciation, as Bitcoin has a lower correlation with the US dollar index.After approximately six years of investigation, the fund has determined that the cryptocurrency market has matured as the investor base has expanded. In the future, the fund will continue to explore the possibility of expanding cryptocurrency investments, including funds for arbitrage trading of various cryptocurrencies.

According to an analysis of the latest leaked data by WIRED, the secretive society Dialog, co-founded by Peter Thiel, has an extremely ruthless and biased "grading and elimination" mechanism.Dialog implements a secret rule of "rating upon entry." Although the club has thousands of members, only 192 personal profiles (including 130 formal members and some candidates) were leaked and reviewed by WIRED. They reveal the club's counterintuitive hierarchy of disdain: C-level is the highest VIP, B-level is the overwhelming majority of ordinary members, while the A-level, usually regarded as the best, is actually the least known bottom tier.This rating is directly tied to members' wallets. Only about 25% of VIP "C" level big shots are required to pay the full attendance fee, while among the bottom "A" level members, the proportion paying the full attendance fee of tens of thousands of dollars is as high as 70%.Ironically, the AI screening mechanism introduced by Dialog is extremely superstitious about so-called "national recognition." For example, actor Josh Brolin, who played "Thanos," has never attended but wins VIP "C" level status due to box office success and millions of fans; meanwhile, academic giant Tyler Cowen was deemed "not famous enough among ordinary people" by the AI and nearly classified into the ordinary tier, only barely promoted to C-level through human intervention.The "value-added points" serve as a scythe for eliminating "useless people," specifically measuring members' resource connections and intellectual contributions to other club giants. After each gathering, staff review members' performances like "code review," and those with too low value-added points, cultural mismatches, or declining visibility will be ruthlessly removed from the invitation list.Additionally, the leaked database also exposed its built-in social and dating matching system (10% of members join the singles pool), which has a "no-match list" while recommending pairings.This so-called objective assessment system is also filled with biases: women make up one-third of the members but only receive 18% of VIP seats; politically, it is even harder to escape differential treatment. Although more than half of the members identify as "left-leaning," the probability of "right-leaning" members obtaining VIP status is more than twice that of left-leaning members, and even the "left-leaning" label of an environmental leader was forcibly rewritten to "right-leaning" by staff in the background.

As India's tax enforcement intensifies, cryptocurrency investors face stricter reporting and compliance requirements in the 2026 tax season, with incorrect declarations potentially triggering fines and audits. Reports indicate that under current rules, cryptocurrency gains are still subject to a 30% uniform capital gains tax, and a 1% Tax Deducted at Source (TDS) is levied on transactions exceeding a certain amount, while losses cannot be offset across assets. The new Income Tax Act (2025) came into effect on April 1, 2026, but the core tax framework remains largely unchanged.In terms of reporting, investors must fill out a dedicated Schedule VDA section in the ITR-2 or ITR-3 forms and are required to record each transaction individually, including all operations such as trading, exchanging, transferring, and clearing, rather than just summarizing gains. The report emphasizes that regulatory focus has clearly escalated. The Indian tax authorities will directly obtain user-level transaction data through trading platforms, custodians, and wallet service providers, and will automatically cross-check this with reported information; discrepancies will trigger system flags and audits.Data shows that the Indian tax authorities have issued over 44,000 notices and discovered approximately 88.8 billion rupees (about 930 million USD) in unreported virtual asset income. Meanwhile, the tax department is enhancing its tracking capabilities by combining on-chain analysis tools with international data-sharing mechanisms. Additionally, starting in 2027, India will align with the OECD cryptocurrency reporting framework to achieve automatic exchange of cross-border transaction data, and overseas exchange holdings will gradually come under regulatory scrutiny.Analysis points out that common errors include misuse of reporting forms, omission of airdrop and staking income, and failure to correctly match 1% TDS records, among others. The report emphasizes that cryptocurrency tax compliance is shifting from "post-reporting" to "real-time traceability," and investors need to strengthen year-round record management.