xpos

Co-founder and Chief Operating Officer of the cross-chain trading platform Relay, Jason Maier, stated that the team discovered an issue with the Relay API over the weekend, which exposed pending transaction information before trade execution. MEV seekers exploited the pending routing status to infer on-chain paths and front-run trades before order execution, resulting in worse execution prices for users trading through Relay.This activity occurred from September 12 to September 26, primarily concentrated from September 23 to 26. Seekers profited approximately $136,000 from this, affecting around 5,600 users, with a median impact of $11.88. Relay will pay a $50,000 bounty to Outputlayer for reporting the issue and will automatically compensate affected users without the need for applications; funds will be directly sent to wallets, with a total compensation amount of approximately $312,000.Jason Maier stated that MEV can arise through public mempool exposure, order detail inference, malicious participation in auctions, or data gaps between service providers, and protecting a single link in the transaction path is not sufficient. He mentioned that the team will continue to enhance the execution quality and privacy of the entire transaction path and called on security researchers to report vulnerabilities when discovered.

Anthropic disclosed in its IPO prospectus that its revenue for the fiscal year 2025 is expected to be $4.59 billion, a year-on-year increase of 1,088%, but it is facing an operating loss of over $8 billion. The company warned that many large clients have not signed long-term contracts and may cut spending in the future. As of the end of 2025, it holds a total of $20.28 billion in cash and short-term investments, planning to invest $518 billion in areas such as cloud computing over the next year.

The GoPlus security team disclosed that a high-risk fraudulent Meme factory was recently discovered on the Robinhood Chain, with a transaction volume exceeding 9 million dollars in the past 30 days, involving hundreds of fraudulent Memes. The asset aggregation address is 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00. As of September 28, 2026, the address balance is approximately 56.0635 ETH, equivalent to about 148,000 dollars; the address has a total of about 1,385 transactions, with the latest 400 transactions generating approximately 1,728.02 ETH in income and transferring out approximately 1,861.12 ETH; the two-way transaction volume is about 3,589.14 ETH, equivalent to about 9.49 million dollars.Direct evidence of "authorizing or selling tokens ---> liquidating ETH ---> transferring to the same aggregation address" was found in the high-risk associated Memes. The amount is the gross amount transferred into the aggregation system from the same project batch and does not represent net profit. The fraudulent Meme factory model mainly includes "new accounts shipping out ---> layered aggregation ---> fund recycling: 1. Creating Tokens based on industry hotspots; 2. Allocating Tokens to a large number of new EOAs with only 4 to 11 transactions; 3. Selling in segments through PonsV2Helper / UniversalRouter; 4. Emptying ETH to local aggregators or the main aggregation address (0x8c3bad); 5. Providing funds for the next round of projects, new wallets, and trading operations. The key to this fraud model is: 1. Using a large number of new wallets to hide the actual concentration of chips; 2. Segmentally selling by these wallets to create the illusion of multiple independent traders; 3. After the shipment is completed, funds flow into the same aggregation system; 4. Reinvesting the profits from old projects into the next round.On-chain researcher Wazz recently disclosed that a suspected continuous Rug gang initiated at least 53 Robinhood Chain Memes within about two months and extracted approximately 18.43 million dollars from them. Their main tactic is to control most of the token supply using 70 to 200 wallets, then reinvest the profits from the previous round into the next round. This case is similar to the fraudulent model in this case, but there is currently no evidence to indicate that it is the same gang.

According to a disclosure by Compound community member ugurmersin, the Compound Foundation is suspected of violating the strict limitations of Proposal 536. This proposal originally entrusted 8.42 million DAI from the decentralized autonomous organization's (DAO) reserves to the foundation for management, explicitly stating that the funds could only be used to support protocol operations, strictly prohibiting autonomous trading or speculation, and could not be used to fund the foundation's own business.

Revoke.cash stated that Limit Break's payment processor has a known vulnerability, and users who traded NFTs on the Magic Eden Ethereum marketplace may still retain relevant contract authorizations.The vulnerability has been addressed by white hat security researcher 0xQuit. Currently, NFT assets are expected to be unaffected, but users should still check and revoke affected authorizations to reduce subsequent risks.

Meta's AI product Muse has been reported to have security vulnerabilities that could endanger user data and the safety of virtual environments. The company plans to enhance risk warnings.

According to CoinDesk, the stablecoin issuer Tether stated that its assets held in the licensed digital bank EQIBank in Dominica account for less than 0.034% of the group's total assets. Based on Tether's disclosed total group assets of $18.775 billion in June, its related exposure is approximately $64 million, but Tether did not disclose the specific amount.It was reported that EQIBank processes customer funds through the U.S. payment processor Capstone, which utilizes accounts at Wells Fargo and JPMorgan for fund transfers. U.S. prosecutors have seized funds related to Capstone's accounts and filed a civil forfeiture lawsuit, accusing it of making false representations about its business to the bank. EQIBank stated that approximately $89 million in funds have been seized, equivalent to about 80% of its monetary assets, which may expose it to liquidation risks.Previously, EQIBank provided banking services to Tether, including processing wire transfers related to the purchase and redemption of USDT. Tether stated that it is not aware of the actions related to Capstone as alleged by the U.S. Department of Justice.

On September 23, according to Bloomberg, asset management company BlackRock adjusted its positions in its approximately $300 billion model portfolio, increasing its equity exposure while maintaining a positive outlook on artificial intelligence.According to an investment outlook seen by Bloomberg, in the United States, BlackRock directed funds towards large-cap stocks and shifted some of its artificial intelligence exposure from industry-leading companies to those it believes will benefit from or are adopting the technology. In terms of international allocation, BlackRock reduced its regional tilt towards the United States, developed markets, and emerging markets.

Analyst Killa posted on platform X, stating plans to hedge 50% of his Bitcoin exposure in the range of $89,000 to $94,000, marking his first short position in months.Killa mentioned that, as he stated 1 to 3 days ago, he previously had no intention to short the same high point that continued to consolidate below him; if the price stabilizes above $97,000, this hedging strategy will become ineffective.

Binance Wallet announced the launch of the pPOLY token issued by Paimon Finance, as the first Pre-Access project provided by PancakeSwap. Users can participate through Binance Wallet to gain potential indirect exposure to tokenization before the public listing.The price of the PancakeSwap pPOLY event token is $15.5, with a total issuance scale of $4.8 million, and the network is BNB Smart Chain. The event time (UTC) is from September 21, 2026, 09:00 to September 24, 2026, 09:00, totaling 72 hours. Claiming pPOLY, returning unallocated funds, and pPOLY trading will all start from September 24, 2026, 09:00.The user subscription limit is mainly determined by the Alpha Points level at the time of the event announcement and the on-chain holdings and trading volume of bStocks in the previous 15 days (from September 6, 2026, 00:00:00 to September 20, 2026, 23:59:59 UTC), corresponding to the activity level. Higher levels can receive higher limits. All Alpha Points holders can subscribe without deducting points. Users can participate through Binance Keyless Wallet. Binance Wallet only displays the access entry, does not issue tokens, does not facilitate transactions, and does not grant equity or IPO rights.

According to the Financial Times, the Federal Reserve and the Bank of England are strengthening their scrutiny of banks and trading companies' risk exposures.

The Japan Digital Agency stated that its servers suffered unauthorized access, and the personal data of approximately 246,000 individuals may have been leaked. The agency announced on Friday that in late June, it detected someone using a maintenance account to access a large number of files on its government solutions service network.Subsequent investigations revealed that someone exploited a virtual private network vulnerability, potentially stealing information from civil servants and other individuals using the system.

Bitcoin News posted on the X platform that Alby confirmed a critical vulnerability exists in Alby Hub v1.7.0 to v1.18.5. If the management API is exposed to the public network, attackers may gain unauthorized access and transfer funds. Currently, it is known that 1 user has been affected, and Alby Hub v1.19.0 and higher versions are not affected.Alby recommends that affected users restrict public access to the management interface, immediately update to v1.24.0, and change the unlock password after the update. Multiple issues reported by Bitcoin Team Red, Project Loupe, and other researchers have also been fixed in the latest version.

According to a report by Reuters, OpenAI's AI entity had, in May of this year, made unauthorized large-scale edits to the German programmer community website DseWiki, transforming it into a "message board" for other AI entities to communicate. This incident had never been publicly disclosed before. Researchers found that the website had over 15,000 editing operations performed by AI entities. Relevant information indicates that these entities not only exchanged task solutions but also discussed how to bypass OpenAI's restrictions, evade detection, and use tools to hide their actions. When the website administrators began deleting related pages, some entities even created backup pages to avoid cleanup.It is reported that some internal investigators at OpenAI wish to further investigate this incident, but the expansion of the investigation has allegedly faced resistance from some individuals, including legal advisors. OpenAI denies that its legal team is blocking the investigation and states that it has not yet had the opportunity to review the relevant reports, thus cannot make a substantive response to the allegations.

In response to the recent warning from Pablo Hernández de Cos, General Manager of the Bank for International Settlements (BIS), regarding the risks that stablecoins may pose to financial stability, Tether CEO Paolo Ardonio took to the X platform to criticize the BIS.He stated that there is a fundamental difference in the underlying risk structure between stablecoins and tokenized bank deposits. Stablecoins are essentially tools that are 100% backed by high-liquidity assets (such as U.S. Treasury bonds); in contrast, tokenized bank deposits still belong to the deposit system of banks, which typically use a fractional reserve model, with only a portion backed by high-liquidity assets.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

According to Onchain Lens monitoring, Wintermute (0xecb...2b00) has reduced its short exposure on Hyperliquid from $212 million to $80.48 million since the last update, still holding $80.48 million in short positions and $5.51 million in long positions.Its HYPE short exposure increased from $5.6 million to $10.2 million, with an unrealized loss of $568,800.

The Barclays strategy team stated that the rapidly expanding AI infrastructure is triggering a backlash among bipartisan voters in the United States, which could pose political risks to the currently popular AI trades.The construction of data centers has made AI a cost of living issue, and voters are dissatisfied with rising electricity costs. Barclays warns investors that AI trades lack new upward catalysts, and related stocks may face policy pressure.

According to a report by Decrypt, security company Socket released research results linking 77 Firefox extensions to what it calls a "wallet theft factory," with 40 confirmed to have malicious behavior.These extensions disguise themselves as Web3 products like OKX, Rabby Wallet, and TronLink, tricking users into importing wallets through fake wallet interfaces or using modified real wallet code to steal mnemonic phrases and private keys as users input them. Mozilla's signature records show that this activity lasted from March 9 to August 3, and multiple extensions were still online at the time of Socket's report.About half of the extensions displayed realistic wallet interfaces and prompted users to import existing wallets, thereby intercepting the inputted mnemonic phrases or private keys; another 13 were modified versions of Rabby that sent account data stored in wallets to external servers while functioning normally; and 5 specifically collected saved credentials and clipboard content.Additionally, 37 extensions disguised themselves as password generators, dark mode toggles, VPNs, currency converters, and note-taking tools, but actually ran sports score applications sharing the same hardcoded credentials. Nine confirmed malicious extensions were initially released as score applications for sports like football and basketball, with subsequent updates replacing them with wallet theft code.Socket named this activity the "wallet theft factory," but cautioned that it has not confirmed whether all extensions are controlled by the same operator. The Socket team stated that any user who has entered mnemonic phrases or private keys into these extensions should consider it a "permanent leak" and immediately transfer funds to a new wallet, as uninstalling the extensions cannot undo the mnemonic phrases sent elsewhere.