security

Согласно сообщению Bloomberg, стартап в области ИИ и облачной безопасности Upwind Security завершил новый раунд финансирования на сумму 300 миллионов долларов, в котором ведущую роль сыграли Bessemer Venture Partners, а некоторые существующие инвесторы также приняли участие, после чего оценка компании достигла 3,8 миллиарда долларов.Upwind Security имеет штаб-квартиру в Сан-Франциско и в основном предоставляет услуги кибербезопасности для приложений ИИ и облачных приложений. Новые средства планируется использовать для расширения функций безопасности ИИ своей основной облачной платформы, с целью более близкого взаимодействия с разработчиками.

Сообщение ChainCatcher, GoPlus Security выпустила предупреждение о безопасности, сообщив, что realio[.]fund, принадлежащий Realio Network, подвергся атаке, злоумышленники захватили систему подписей платформы и перевели активы из казначейства и кошельков под управлением на Ethereum, BNB Chain, Algorand, Stellar и родной цепи Realio.В этом инциденте было затронуто около 127.9 миллионов RIO, стоимостью около 6.2 миллионов долларов, злоумышленники в настоящее время обналичили около 317 тысяч долларов.

Сообщение ChainCatcher, стартап в области безопасности AI Mate Security объявил о завершении раунда финансирования A на сумму 35 миллионов долларов, который возглавил Canaan Partners, а также в него инвестировали Insight Partners, Team8 и венчурный фонд Microsoft M12. Общая сумма финансирования превысила 50 миллионов долларов.С момента выхода компании из режима секретности прошло менее года. Mate Security была основана бывшими сотрудниками Wiz и Microsoft, а её основной продукт — "Граф безопасности контекста (Security Context Graph)", который, создавая уровень организационных знаний, наделяет AI безопасного агента бизнес-контекстом, позволяя ему принимать решения при обработке предупреждений с учетом реальной операционной ситуации компании, что эффективно снижает уровень ложных срабатываний.

ChainCatcher сообщает, что по данным Techcrunch, компания по обеспечению безопасности данных на основе ИИ Cyera во вторник объявила о подписании намерений приобрести Oasis Security за примерно 1 миллиард долларов, при этом сделка, как ожидается, будет в основном наличной, а оставшаяся часть будет выплачена акциями Cyera. Недавно Cyera завершила финансирование на сумму 600 миллионов долларов с оценкой в 12 миллиардов долларов.Oasis сосредоточена на безопасности не-человеческих идентичностей, таких как агенты ИИ, была основана в 2022 году и привлекла около 195 миллионов долларов финансирования, среди инвесторов — Accel, Craft Ventures, Cyberstarts и другие. У Cyera и Oasis есть общие инвесторы, недавно Cyera последовательно приобрела Ryft и Genie Security, после чего планирует интегрировать технологии Oasis в единую платформу безопасности идентичностей и данных. Годовой регулярный доход Cyera превышает 150 миллионов долларов, но компания еще не вышла на прибыль, за пять лет она привлекла около 2,3 миллиарда долларов финансирования.

Сообщение от ChainCatcher, согласно PR Newswire, QIZ Security объявила о завершении раунда финансирования на сумму 17 миллионов долларов США, который возглавили Bessemer Venture Partners и Merlin Ventures, а также в котором участвовали Evolution Equity Partners, Qbeat Ventures, Singtel Innov8, Qino Cyber Capital и другие.Компания позиционирует себя как платформу для управления криптоактивами и постквантовой криптографией (PQC), предлагая постоянное обнаружение криптоактивов, моделирование рисков и управление, помогая крупным клиентам из финансового, телекоммуникационного, медицинского секторов и критической инфраструктуры достичь "криптоагильности", чтобы справиться с риском квантовых вычислений "Q-Day", который может возникнуть уже в 2029 году и угрожает существующим системам шифрования, и сотрудничает с Cisco, AWS, Google, CrowdStrike, Deloitte, EY, IBM и другими для содействия в планировании миграции корпоративной квантовой безопасности.

According to The Block, the Donjon security team under Ledger has bypassed the firmware verification mechanism of the TROPIC01 chip used in the Trezor Safe 7 through precise laser attacks in a laboratory environment, allowing unauthorized firmware to be loaded as long as the attacker possesses the physical device.Chip manufacturer Tropic Square further discovered that there are additional attack vectors in the MAC-and-Destroy security mechanism used for PIN verification on this chip, but details will not be disclosed until the enhanced version of the chip is launched at the end of 2026.Trezor stated that the PIN, mnemonic backup, and private keys have never been stored on a single chip, and they have notified partners, so ordinary users do not need to take action. Currently, the feasibility of attacks can be reduced by disabling the chip's MAINTENANCE mode.

According to The Block, the Blockchain Association sent a letter on Tuesday to U.S. Senate Majority Leader John Thune and Democratic Leader Charles Schumer, expressing strong support for the Clarity Act. The letter was signed by 160 former national security and law enforcement officials, emphasizing that the market structure for digital assets is a priority for law enforcement and national security.The letter states that the Clarity Act expands law enforcement and financial crime prevention capabilities within the digital asset ecosystem, including key anti-illegal finance and law enforcement provisions, such as expanding the Bank Secrecy Act and sanctions obligations, and establishing a Treasury-led law enforcement agency and private sector information-sharing mechanism. The Blockchain Association emphasizes that these are not measures to relax regulation, but rather tools to enhance law enforcement. The bill has passed the Senate Banking Committee and is currently awaiting a vote by the full Senate. The Blockchain Association also plans to hold a virtual town hall on Thursday to discuss the bill.

edgeX released an update regarding the abnormal price fluctuations of the EDGE token, stating that the protocol has not been compromised in any way, and this incident is not a hacker attack, exploit, or security vulnerability.Current confirmed information indicates that this is an attempt by certain external parties to deliberately manipulate the market price of EDGE, which is a matter of market integrity rather than platform security. The team is actively investigating and collaborating with relevant exchanges and platforms, and a comprehensive update will be released after the investigation is complete.

The Zcash Foundation announced the release of the Zebra 4.5.1 version update to fix a consensus-level security vulnerability and strongly recommends that all node operators upgrade immediately.The vulnerability, identified as GHSA-2prc-cj5x-4443, involves a sigop (signature operation count) statistical error in P2SH transactions, which could lead to potential consensus fork risks. This fix corrects the incomplete patch issue from the previous 4.5.0 version, which was just released yesterday.The Zcash development team stated that the problem originated from discrepancies in sigop counting logic across different implementations, which could cause nodes to produce different results when validating transactions, thereby affecting on-chain consensus consistency. The fix was implemented by reverting and adjusting the Rust implementation logic to ensure alignment with the expected behavior of the protocol.The Zcash Foundation emphasizes that there is currently no workaround for this issue, and upgrading to 4.5.1 is the only way to ensure that nodes remain on the correct chain and avoid potential fork risks.

The "Anthropic" plan allows the EU's cybersecurity agency to use the powerful artificial intelligence tool "Mythos," which can discover and exploit vulnerabilities in computer systems.According to informed sources, Anthropic will allow the European Cybersecurity Agency to join the "Glass Wings" project. This project aims to let key institutions test the capabilities of "Mythos" before widespread deployment. A spokesperson for the European Commission stated that negotiations with Anthropic are progressing but declined to comment further.

The blockchain security agency PeckShield has issued an alert stating that Gnosis Pay is currently undergoing a security attack. Meanwhile, Gnosis co-founder Martin Köppelmann has publicly urged users to immediately withdraw their GNO and EURe assets to mitigate potential risks.Market analysis indicates that Gnosis Pay, as an important infrastructure connecting payment scenarios with on-chain assets, may face short-term selling pressure on Gnosis GNO and the euro stablecoin EURe if it is confirmed that funds have been stolen or protocol vulnerabilities exploited, further affecting market sentiment for Gnosis ecosystem-related projects.Currently, the official has not disclosed the scale of the attack, the amount of losses, or specific technical details, and the situation is still developing. Users holding related assets or using Gnosis Pay services should closely monitor official follow-up announcements and assess their risk exposure in a timely manner.

Circle released the "Post-Quantum Security White Paper," proposing a phased post-quantum resilience roadmap focused on the long-term security of the Arc blockchain ecosystem.The roadmap covers multiple technical directions, including quantum secure signatures, private execution environments, validator hardening, infrastructure migration, and account recovery, applicable to core components such as the Arc network, USDC, smart contracts, and validators.Circle stated that it plans to provide post-quantum signature support when the Arc mainnet launches (in 2026) to enhance the ecosystem's ability to respond to future quantum computing threats.

The Zcash Foundation has released the node client Zebra version 4.5.0 update, which includes multiple security fixes, including a critical consensus vulnerability and several high-risk denial of service (DoS) issues. All node operators are strongly advised to upgrade immediately.It is reported that this core fix includes a sigop counting error caused by P2SH script parsing (which may lead to a consensus fork with zcashd), a defect in the NU5 block validation cache logic, a risk of transparent address balance overflow crashes, as well as multiple crashes and resource exhaustion vulnerabilities in RPC interfaces and memory pool handling. Additionally, some vulnerabilities can be exploited by malicious nodes, leading to node freezes, reboot loops, or even permanent shutdowns.

Regarding the incident "DxSale accused of using a backdoor to withdraw $7.3 million in liquidity funds," the security company GoPlus stated that the attack may have been an inside job, and there is still $15.5 million in funds and LP urgently needing rescue. GoPlus recommends that the project team immediately check whether their project LP is locked in the contracts 0xEb3a9C56, 0x81E0eF68, 0x2D045410, 0x5b5e9448, and if so, take immediate measures to withdraw. Since the initial funding source was Bybit, KYC tracing is recommended; the final withdrawal channels are multiple Binance addresses, and it is suggested that the relevant security teams submit on-chain evidence to apply for freezing the attacker's address.GoPlus calls on the project to strengthen security mechanisms, stating that critical admin functions must have a time lock, and Owner permissions must use multi-signature. GoPlus emphasizes that as of now, DxSale has not issued any public incident response statement, and its silence is also worth noting.

Base Azul has launched its mainnet, and this upgrade makes the Base network faster and more secure.

According to Fortune magazine, the UK AI agent security and governance platform Geordie AI has completed a $30 million Series A funding round, led by Balderton Capital, with participation from Crosspoint Capital, and additional investments from General Catalyst and Ten Eleven Ventures, resulting in a post-money valuation of $155 million. This is the largest Series A funding round to date for a cybersecurity startup in Europe.The company was co-founded by former executives from the UK cybersecurity company Darktrace and the code security company Snyk. Its platform can discover and monitor AI agents operating within enterprises in real-time, identifying risks and dynamically constraining agent behavior. Geordie is currently deployed in approximately 30 client environments, including financial data company AlphaSense and the Franco-American joint venture AI biotechnology company Owkin.

SUPERFORTUNE AI posted on platform X that the team is investigating the GUA security incident that occurred on May 27. This incident caused severe fluctuations in token prices, and preliminary investigations indicate that the incident may involve address tampering in a multi-signature transaction.The announcement stated that the plan was to send additional unlocked tokens to the airdrop claim contract address, but during the execution of the transaction, the funds were mistakenly sent to another hacker address. The team noted that this hacker address had never interacted with any addresses related to SUPERFORTUNE before, so the likelihood of an "address poisoning attack" as a method of attack is low. Additionally, SUPERFORTUNE stated that its internal processes already include a multi-address verification mechanism, and the team is still continuing to investigate the incident and will update the community on the latest developments.

The prosecution materials released by the U.S. Attorney's Office for the Southern District of New York show that Google security engineer Michele Spagnuolo has been arrested and charged for allegedly using significant non-public information to bet on Google user search result-related markets on Polymarket.The prosecution materials state that Spagnuolo used Google internal tools to track the list of the most searched people in 2025 and transferred approximately 3.8 million USDC to a Polymarket address; his associated account AlphaRaccoon placed a bet that D4vd would become one of the most searched people in late November after accessing internal tools for several hours.The prosecution materials also state that AlphaRaccoon transferred 5 million USDC from the Polymarket account to a wallet and moved the funds through exchange services and privacy tools, with some of the funds ultimately entering an account at a payment processing institution in Italy. Spagnuolo is accused of profiting over 1.2 million dollars from the related transactions and currently faces charges of commodity fraud, telecommunications fraud, and money laundering.

According to CoinDesk, the latest research from Project Agorá, led by the Bank for International Settlements (BIS), shows that tokenization technology is expected to significantly improve settlement speed and reconciliation efficiency in cross-border payments, while reducing transaction failures and operational risks.The project involves BIS collaborating with seven central banks and over 40 financial institutions, including the New York Fed, Bank of England, Bank of Japan, and Swiss National Bank. The research suggests that tokenizing central bank reserves and commercial bank deposits can support "atomic settlement" across currencies and jurisdictions, allowing transactions to "either complete simultaneously or fail simultaneously," thereby reducing the credit and execution risks commonly associated with cross-border payments.Currently, Project Agorá has completed the simulation testing phase and plans to enter the "real-value" trading testing phase to explore on-chain settlement applications for certain currencies and institutions in a real funds environment.

Stake DAO posted on platform X in response to the security incident, stating that its team is aware of the current security event and advises against interacting with vsdCRV.Previously, an anomaly occurred with contracts related to Stake DAO on Arbitrum, resulting in the minting of 54 trillion vsdCRV. The security team has classified this as a suspected infinite minting exploit.