According to ChainCatcher news reported by Cointelegraph, North Korean hackers appear to have developed malware that can evade Apple's security checks. Researchers at Jamf Threat Labs, who focus on Apple, indicate that these applications seem to be experimental. This is the first time they have seen such technology used to infiltrate Apple's macOS operating system, but it does not run on the latest systems.Researchers found that Microsoft's VirusTotal online scanning service reported these applications as harmless, but they are actually malicious. Variants of these applications are written in Go and Python, utilizing Google Flutter applications. Flutter is an open-source development toolkit used for creating cross-platform applications.Out of six malicious applications, five are signed with developer accounts and have been temporarily notarized by Apple. Researchers wrote, "The domains and techniques in the malware are very similar to those used in other North Korean hacker malware, with indications that the malware was once signed and even temporarily passed Apple's notarization process."

ChainCatcher news, according to The Block, two Ethereum researchers revealed in a message released today that they have resigned from their positions due to controversy arising from their roles as advisors for the restaking platform EigenLayer.Ethereum researchers Justin Drake and Dankrad Feist posted on the X platform that they resigned from their advisory roles to focus on the development of the Ethereum base layer. Drake stated that he stepped down from this position in September.

ChainCatcher news, according to Cointelegraph, Galaxy cryptocurrency researcher Christine Kim believes that due to the current complexity of the Pectra fork and the increased demand for upgrades, the possibility of splitting into two independent upgrades (Prague upgrade and Electra upgrade) is "very high." Christine Kim previously summarized the 196th Ethereum Core Developers Meeting (ACDE), stating that Ethereum developers are seriously considering executing the Pectra upgrade in two phases.In addition, Christine Kim also added that if developers decide to split the Pectra upgrade into two hard forks, the scope could change significantly. It is reported that Ethereum developers will make a decision on this during the next Ethereum All Core Developers teleconference on September 19.

ChainCatcher news, according to Cointelegraph, researchers behind the Ethereum network have grown from around 25 people in Q1 2019 to a peak of 550 people in Q1 2024, an increase of 2,100%.According to developer report data, Ethereum has the highest number of monthly active developers among blockchains. As of July 1, Ethereum has a total of 2,788 full-time developers, with a total developer count exceeding 8,865. The Base blockchain ranks second, with 889 full-time developers and a total developer count of 3,991.

ChainCatcher news reports that the vulnerability bounty platform OpenBounty has faced criticism from peer security researchers after users discovered that their submitted vulnerability reports were published on a public blockchain. When OpenBounty receives a report, it automatically publishes the content of these reports as transactions on Shentu, a blockchain operated by OpenBounty's parent company, Shentu Foundation. The publicly disclosed details include the threat level of the vulnerability, the location of potentially vulnerable code, and comments from the report authors. OpenBounty lists over 30 different cryptocurrency projects offering vulnerability bounties, with a total deposit value exceeding $11 billion.Independent security researcher Pascal Caversaccio stated that publicly disclosing potential vulnerabilities is extremely irresponsible, as any hacker can sift through these reports and exploit them. Security researchers also complained that OpenBounty listed and accepted vulnerability bounty reports from other security companies and cryptocurrency projects that had not authorized them. Among the bounties listed on the OpenBounty website are those from top decentralized exchange Uniswap and lending protocol Compound.Michael Lewellen, Solutions Architect at the crypto security company OpenZeppelin, stated, "As a security advisor for Compound DAO at OpenZeppelin, I can authoritatively say that they have not been authorized to manage vulnerability bounties on behalf of the protocol."Dmytro Matviiv, CEO of the vulnerability bounty platform HackenProof, said, "Listing bounties without permission could have legal consequences. The vulnerability bounty market operates under a carefully considered legal process. Within this system, permission from the bounty issuer must be obtained before placing a bounty on a vulnerability bounty platform."A spokesperson for CertiK confirmed that the entity controlling the OpenBounty platform, Shentu, was once part of CertiK; however, Shentu has been operating independently since 2020. Nevertheless, four years after the split, the code on the OpenBounty platform still links to domain names that include CertiK in their names. However, CertiK's spokesperson stated that these domains are managed independently by Shentu.

ChainCatcher news, according to Cointelegraph, a Web3 Foundation researcher has proposed a new request for comments (RFC-0092) to shorten the unbonding period for staked tokens on Polkadot from 28 days to 2 days.

According to ChainCatcher's message and a post by on-chain data researcher @Noah_nftn, there are six market makers for LayerZero: GSR, Wintermute, Amber Group, Auros, Animoca Brands, and one unknown institution. Now, Wintermute and GSR have deposited ZRO into exchanges for testing, including OKX, Bybit, Gate.io, KuCoin, and Bitfinex, with a relatively small token ratio.

ChainCatcher news, according to Wired, two researchers successfully cracked the password of a digital wallet that had been forgotten for 10 years and recovered approximately $3 million worth of Bitcoin.Due to a flaw in the version of RoboForm password manager from ten years ago, along with a bit of luck, the researchers were able to uncover the password for a cryptocurrency wallet containing a fortune. Michael, who lives in Europe and requested anonymity, had stored the cryptocurrency in a password-protected digital wallet. He used the RoboForm password manager to generate the password and stored it in a file encrypted with TrueCrypt. Later, the file became corrupted, and Michael was unable to access the 20-character password he generated to protect 43.6 Bitcoin (worth about 4,000 euros or $5,300 in 2013).

ChainCatcher news, Pyth announced on social media that it has launched the Pyth Ecosystem Grants program, aimed at providing bounties for researchers and developers.It is reported that the bounties are offered through the Superteam platform, covering content such as adding methods to parse Pyth benchmark prices in Aptos contracts, creating dashboards for Pyth usage on EVM, Sui, and Aptos, etc.

According to ChainCatcher, The Block reported that two researchers helped a man recover the lost password to his cryptocurrency wallet, which contained 43.6 bitcoins, currently worth about $2.96 million.The man, referred to as Michael, created a cryptocurrency wallet sometime in 2013 and then used RoboForm to create his unique password. Due to security concerns, Michael stored the password in an encrypted file, choosing not to store it in RoboForm. However, when the encrypted file became corrupted, Michael no longer had access to the 20-character password needed to access the 43.6 bitcoins in the wallet.Although Michael does not fully remember when he created his password, the researchers noted that he transferred bitcoins into his wallet on April 13, 2013. They used specific time parameters to test many passwords until they found the correct one, which was created on May 15, 2013.Michael transferred a portion of the bitcoins to the two researchers. He also sold another small portion, so he now holds 30 bitcoins, worth about $2 million. Michael stated that he intends to hold his bitcoins until the value of a single token reaches $100,000.He added that he is glad he was unable to access the wallet, as holding the tokens for a long time has increased their value over time.

ChainCatcher news, Coinbase's Head of Institutional Research David Duong and Senior Sales Trader Greg Sutton stated that the introduction of a spot Bitcoin ETF in the U.S. could lead to a "regulated" Bitcoin shortage. Once these ETFs begin trading, two key risks may arise: the first risk is that the launch of a spot Bitcoin ETF could create issues for institutional procurement of BTC, as issuers need to purchase enough Bitcoin to hold in the ETF; the second risk involves a more popular institutional trading strategy known as "basis trading," which refers to exploiting the price difference between the spot price of Bitcoin and Bitcoin futures contracts.According to data from Velo, potential profits from basis trading have surged by 20% over the past two weeks due to a significant increase in trading volume of both spot and futures contracts for Bitcoin. However, as institutional investors increasingly invest directly in Bitcoin (through spot ETF products), the basis will narrow, leading to a substantial decrease in the profitability of the trades.

ChainCatcher message, Paradigm researcher @samczsun pointed out that there is a serious flaw in Twitter, where hackers can gain full access to accounts simply by clicking on a link. This means that hackers can tweet, retweet, like, block, and more, but cannot change the user's password. Until this issue is resolved, it is recommended that users install the ad blocker uBlock Origin to reduce the risk of such attacks.

ChainCatcher news, Ethereum co-founder Vitalik Buterin, along with researchers from Chainalysis, the University of Basel, and other institutions, jointly published a paper titled "Blockchain Privacy and Regulatory Compliance: Towards a Practical Equilibrium."The paper studies Privacy Pools, an enhanced privacy protocol based on smart contracts. It discusses the advantages and disadvantages of this protocol and demonstrates how it can be applied to create a separating equilibrium between honest and dishonest users.The core idea of the paper is to allow users to publish zero-knowledge proofs to demonstrate that their funds originate from known (or not) legitimate sources without publicly revealing their entire transaction graph. This is achieved by proving membership in a custom association set that satisfies certain attribute requirements, which are stipulated by regulatory or social consensus. This paper may represent a first step towards a future where individuals can prove compliance with regulatory requirements without disclosing their entire transaction history.

ChainCatcher news, according to The Block, researchers at San Diego State University have developed a fully automated fraud detection system called GiveawayScamHunter. The system found that from June 2022 to June 2023, 87,617 accounts on the X platform (formerly Twitter) created 95,111 scam lists.It is reported that the Twitter Lists feature effectively organizes users' followers, people of interest, tags, and topics, helping them focus on important matters. Users can customize, organize, and prioritize the tweets they see on their timeline. Users can add other users to lists without permission, and the only way to remove themselves from a list is to block the creator, which provides an opportunity for scammers.According to a research paper published on August 10, "more than 365 victims were targeted by free cryptocurrency scams, resulting in an estimated economic loss of $870,000," and such issues have not been fully resolved.The team concluded that although they reported the results and account information to the X platform, as of the time of writing, nearly 44% of the accounts posting spam remain active.

ChainCatcher news, according to Blockworks citing informed sources, the crypto news website The Block laid off 27 people last Friday, affecting departments such as editorial, research, engineering, sales, and operations, with nearly half coming from editorial and research.In December last year, The Block's former CEO Michael McCaffrey resigned after it was revealed by the media that he had secretly lent millions of dollars to SBF, and Bobby Moran took over. According to an Axios investigation, The Block has yet to become profitable. (source link)