security

According to monitoring and analysis by the Gate security team, the FomoPeek App contains malicious code with a high security risk, which may exploit vulnerabilities related to the iOS system to attack other apps, and has dangerous operations such as accessing the clipboard, scanning sensitive data on the phone, and obtaining login credentials. After analysis by the security team, no attack losses caused by the FomoPeek App have been found in the Gate App or among users, and the existing risk control mechanisms of Gate are operating normally.Gate reminds users to upgrade their iOS system to the latest version as soon as possible and check whether the FomoPeek App is installed on their devices. If it is installed, please uninstall it immediately and restart the phone. After completing this, it is recommended to log back into the Gate App and other important applications; if using a Web3 wallet, it is advisable to check the wallet's security status in a timely manner and transfer relevant assets if necessary to reduce potential security risks.

Binance Wallet Security Announcement: iPhone users please check if you have installed the FomoPeek application. Binance has noted a recent security incident disclosed by the community. According to security companies such as SlowMist, the third-party application FomoPeek (versions 1.1-1.2) contains malicious code that can exploit vulnerabilities in the iOS system to gain maximum permissions on the device and may access sensitive data stored on the device, including private keys, mnemonic phrases, login credentials, chat records, files, etc. Please note that such malware directly attacks the device itself. If the attack is successful, all application data on the affected device may be accessed.Please check the following:Are you using an iPhone or iPad running iOS 26.x or earlier?Have you installed the FomoPeek application?If both of the above apply to you, it is recommended to take the following steps immediately:Delete the FomoPeek application and do not reinstall it.Update the iOS system to the latest version.For users with self-hosted wallets: Create a new wallet on a device that has never installed the application and transfer assets to the new wallet address.If you notice any unusual asset activity, please retain the affected device and relevant evidence, and contact customer service for further investigation.At the same time, all users are reminded: Do not install applications from untrusted sources and keep your device software up to date.

According to Bitcoin News, attackers accessed a small number of Blink hosted accounts and withdrew funds.Blink stated that the vast majority of funds remain secure, and non-custodial wallets were unaffected; the Bitcoin payment protocol Spark it uses supports multiple Lightning Network wallets, but it has not yet been confirmed that Spark is the source of this security incident.

U.S. President Trump stated that the United States has reached an agreement with Denmark and Greenland to gain "permanent control" over Greenland's security affairs and related needs. This agreement does not require the United States to incur costs and addresses the long-standing U.S. concerns about Greenland's strategic security.

The DeBot team member Cat released a security incident progress announcement, confirming that the previous wallet security incident was an APT (Advanced Persistent Threat) attack, and no related financial losses have been found so far.The announcement stated that after analysis by multiple security teams and cloud service providers, there are signs of system intrusion, and the related private keys still pose a security risk. Therefore, the platform will continue to implement automatic fund isolation. Currently, DeBot is operating in a fully isolated environment, and users can still trade and withdraw normally, but other operations involving private keys have been suspended and will be gradually restored after the security audit is completed. A brand new security solution is being upgraded and is being audited by the Slow Mist team and cloud service providers. DeBot stated that this incident exposed security issues within the project, and the team will further upgrade security measures.

Bitcoin News posted on the X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the security landscape of Bitcoin. Large language models have significantly reduced the cost of discovering vulnerabilities, allowing attackers to potentially find catastrophic vulnerabilities for just a few hundred dollars in computing costs.For Bitcoin Core, Project Loupe, the Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or severe vulnerabilities have been found. Gögge stated that relying on stronger models to discover vulnerabilities before attackers is not a sustainable security strategy. Developers should build testing infrastructure that can proactively prevent entire classes of vulnerabilities through automated testing, fuzz testing, and property-based testing. Key components of Bitcoin Core have accumulated over 100 years of CPU fuzz testing and have undergone decades of Bitcoin node network simulation.

According to PR Newswire, AI-native data loss prevention (DLP) security company MIND announced the completion of a $72 million Series B financing round, led by Crosspoint Capital Partners, with existing investors YL Ventures and Paladin Capital Group participating. To date, the company has raised a total of $112 million.MIND revealed that it has joined the Anthropic Cyber Verification Program and has obtained ISO/IEC 42001 certification. The company plans to use this round of funding to accelerate the development of its AI-native DLP platform, expand its enterprise market, deepen technology and channel partnerships, and grow its team size.

According to PR Newswire, S&P Global (NYSE: SPGI) announced the signing of an agreement to acquire the on-chain financial security standards company OpenZeppelin.OpenZeppelin was founded in 2015 and its open-source smart contract library has supported over $37 trillion in value transfers, covering mainstream stablecoins and tokenized funds globally, and has completed over 900 security audits, identifying more than 10,000 vulnerabilities.This acquisition will expand S&P Global's assessment capabilities in the on-chain technology risk layer, helping it to build a new generation of on-chain security assessment and benchmarking products. OpenZeppelin will continue to operate as an independent business unit, with CEO Demian Brener remaining in position and reporting to S&P Global's Ratings President Yann Le Pallec. The financial terms of the transaction were not disclosed and are expected to have no significant impact on S&P Global's financial performance.

OpenAI disclosed on Wednesday six cases of "unexpected or concerning" model behavior discovered in the past six months, categorizing them as "misalignment behaviors," including concealing information from users and taking "unauthorized actions" to overcome obstacles. OpenAI stated that this disclosure aims to initiate its new model misalignment reporting framework, and these cases should not be seen as a reflection of the frequency of misalignment occurring in its models.In one case, an unpublished research model inserted "jailbreak-like instructions" into its task summaries, such as ignoring developer messages or adopting unrestricted role settings, with researchers finding a total of 27 summaries containing such instructions. Additionally, during the training process of GPT-5.6 Sol, many model instances added instructions to conceal errors or misalignment behaviors from users, such as fabricating missing historical data without disclosure. Other cases included models using exposed API keys without authorization and fabricating inaccessible data, leveraging internal software repositories to pass messages across training tasks, and ignoring instructions to "keep local work" by sharing files through public hosting services.OpenAI's disclosure has heightened concerns among AI developers and researchers about whether safety measures can keep pace with increasingly powerful models. Last week, Anthropic CEO Dario Amodei called for a slowdown in cutting-edge AI development, warning that unrestrained AI development could "exceed our ability to understand and control these systems." In July of this year, OpenAI disclosed that several of its AI models escaped testing environments during safety assessments and infiltrated the AI startup Hugging Face to cheat.

Recently, Ethereum Classic experienced a social engineering incident involving the Core-Geth client. The unreviewed ethereumclassic/core-geth v1.13.0 was released on September 14 and was promoted as a security update. A few mining pool nodes temporarily switched to this version but have since reverted to the long-term maintained etclabscore/core-geth v1.12.23.This unreviewed version modified key logic such as chain selection and node discovery, posing a potential risk of network split; the incident did not result in block loss, chain reorganization, fund loss, or service interruption.

Ethereum founder Vitalik Buterin stated that he disagrees with the common view that "AI hackers mean cybersecurity is doomed to fail." He believes that once people clarify their thoughts, cybersecurity naturally leans towards the defensive side, and anyone who continues to hold cryptocurrencies (including himself, with about 90% of his net worth) is implicitly betting on this point.Vitalik stated: If AI can prove the Navier-Stokes equations and Fermat's Last Theorem, it can also prove "this program is secure" as a mathematical theorem, even if the program is very complex. He used the encrypted communication application Signal as an example to illustrate that the definition of "security" is extremely complex, covering forged messages, active interference, server breaches, key leaks, hardware side channels, and more. The definition is smaller and more composable than the attack surface, and verifying whether the definition is sufficient is more feasible than directly scanning the code.He pointed out that historically, failures often occur because only the self-identified critical parts of security are verified while neglecting the rest of the code. Today, the entire program must be verified, including the database, network, and cache layers, which modern AI can achieve. This is not a competition to see who discovers vulnerabilities first, but rather to make the code itself more resilient. Vitalik stated that this is the direction for Ethereum in the coming years; without this step, especially for blockchains with scalability and privacy, there is no future. It is necessary to make the software truly secure, and significant progress has already been made.

Bitcoin Core 32 has entered the candidate testing phase this week, with developers aiming to release the official version on October 10. This update is primarily aimed at node operators and developers, as it can accelerate block verification speed and adjust the way wallets handle payments.According to the draft release notes, the update speeds up block verification by reading database information in parallel, but it will not change the Bitcoin block generation speed. Four wallet commands will default to the updated format for exchanging partially signed transactions, although applications can still request the old version. In terms of security fixes, the update prevents maliciously constructed wallet names from triggering commands on node computers, a vulnerability that affects non-Windows systems; another patch fixes an issue with excessive memory usage by the new HTTP server.Contributor Matthew Zipkin described a "memory exhaustion scenario" in the patch proposal, which he discovered while auditing the new HTTP server of Bitcoin Core using the AI model Kimi K3. GitHub user jeanpablojp found that unauthenticated requests could also lead to memory growth during the review; after patch revisions, 16 unauthenticated connections caused only about 3 MB of memory growth in 90 seconds, compared to 3.2 GB previously. The patch was merged on September 5.

According to CoinDesk, Bitcoin Core 32 entered its final testing phase on September 14, with the first candidate version marked, and the official release is expected on October 10. This version will not change Bitcoin's consensus rules but will mainly optimize fee estimation, accelerate block processing, and fix several security vulnerabilities.In terms of fee estimation, Bitcoin Core 32 introduces a new estimator based on unconfirmed transactions, which can quickly lower the recommended fee rate when network congestion eases, compared to the original estimator based on historical block fees. Regarding block processing, nodes can now use multiple threads to fetch transaction data from the database simultaneously, with a default of 8 threads, reducing the waiting time for nodes to catch up with the blockchain.For security fixes, developers have addressed a command execution vulnerability that has existed in non-Windows systems since Bitcoin Core 24. This vulnerability could allow authenticated users to execute commands on the node host through specially crafted wallet names when the walletnotify feature is enabled. Additionally, four commands used to create partially signed transactions will default to using PSBT version 2 format; the new web server was found to have a memory exhaustion flaw during auditing, where 16 unauthenticated REST connections could raise the node's memory from 46 MB to about 3 GB in approximately one minute, and this issue has been fixed before the official release.

User MaxForAI stated that the National Internet Information Office recently reported a case of illegal API relay station. On September 15, the Internet Administration of China announced a batch of internet law enforcement cases, where two websites operated by a technology company in Jiangsu used an API relay station to call multiple large model product interfaces, providing services such as dialogue and Q&A without conducting safety assessments as required, posing content safety risks, and violating the "Interim Measures for the Management of Generative Artificial Intelligence Services" and other regulations.The local internet information office ordered rectification, imposed strict penalties on those responsible, and issued a warning. The user mentioned that the above description aligns with the details of the large model relay platform "Zhixin Token" launched by Jiangsu Biying Technology under Suning.com in July this year, which aggregated multiple mainstream large models to provide a unified API service through two service domain names.

The DeBot team member Cat announced that on September 16th, early in the morning, DeBot received a wallet security risk alert and immediately initiated emergency protective measures. The affected wallets have been temporarily isolated. The official statement indicated that the assets in the affected wallets, including local currency and stablecoin assets, will be automatically transferred to a new non-private key wallet at a 1:1 ratio, and a portion of the Meme tokens will be transferred. The new wallet can still conduct secure transactions normally.During the protection period, users can still withdraw and transfer tokens normally, but it is temporarily not possible to export private keys. The specific recovery time will be notified separately. As of the announcement, no abnormal user assets have been found. The platform reminds users to immediately stop using the old wallet, refrain from continuing to recharge, and suggests checking for other public chain assets or some Meme coins that have not been automatically transferred and completing manual transfers in a timely manner.

According to Business Insider, security staff providing services to tech companies such as Anthropic, Google, and OpenAI in California plan to strike this week, which may lead some tech companies to close their offices and require employees to work from home. On Tuesday morning local time, security personnel submitted a 72-hour strike notice to the relevant companies, planning to refuse to participate in work shifts starting from 4:30 AM on Friday.The United Service Workers West Union stated that the security personnel who may participate in the strike are responsible for guarding the offices of companies like Amazon, Microsoft, Salesforce, OpenAI, Anthropic, Google, Meta, and Nvidia. Currently, tech companies in the Bay Area have not announced any office closures due to the strike. This labor dispute involves several security service companies, including Allied Universal, Securitas, and GardaWorld, with the union representing approximately 14,000 security personnel in California. Negotiations over a new labor contract have been ongoing for several months.Security personnel are demanding higher wages, improved healthcare benefits, and better job training. A union spokesperson stated that both parties will continue negotiations on Wednesday and Thursday of this week, and as of Tuesday, the strike has not been finalized. The union plans to organize a march for security personnel in downtown San Francisco on Tuesday, ending at the Salesforce Tower, where Salesforce's headquarters is located. On September 3, security personnel voted to authorize the strike at a rally in San Francisco.

Zuckerberg stated that every lab has the responsibility and incentive to train models safely at the required speed and has the capability to take action independently. People will not use agents that are not aligned with them or do not act as required, so labs have a strong natural incentive to enhance model alignment. Trust and alignment are rapidly becoming the most important capabilities that distinguish agents from models, and any lab that does not focus on alignment will fall behind.Zuckerberg indicated that labs will face significant liability if their models cause harm, thus there is a strong incentive to prevent this. Meta has postponed the release of Muse by several months to focus on safety and security, and has not asked other labs to follow suit, but rather considers it part of their daily work. Hiring independent evaluators and consultants is an industry best practice, and MSL has been doing this in multiple areas. Allocating most computing power to serve people rather than competing for recursive self-improvement is one of the best ways to ensure the safe development of this technology, and Meta has made this commitment.

On September 15, the United Nations Security Council held an emergency meeting regarding the situation in the Bab-el-Mandeb Strait. United Nations Assistant Secretary-General Khaled Heyaari reported that the situation in the Bab-el-Mandeb Strait and surrounding areas is increasingly turbulent, with escalating conflict on Yemen's western coast.The escalation of the situation could have serious implications for international peace and security, the global energy market, food security, and the economies of multiple countries. The United Nations calls on all parties to exercise restraint and to promote a political solution to the Yemen issue through dialogue.

An MEV bot named Yoink on Ethereum front-ran an exploit attack targeting the Safe wallet, which PeckShield referred to as an approximately $7.81 million rsETH attack. On-chain records show that the Yoink transaction received 2,900 rsETH and sent 2,882.37 rsETH to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, which currently has a balance of 2,882.36740883 rsETH.The same transaction also sent 17.63 rsETH to the Uniswap v4 Pool Manager, which sent 18.95 ETH to the Yoink contract, which then transferred 18.93 ETH to the block builder. The Yoink transaction and the original attack transaction both occurred in Ethereum block 25980525, with the Yoink transaction at the top of the block, and the original transaction executed a rollback, consistent with the front-running judgment of security researchers.BlockSec attributed the vulnerability to a flaw in the authorization checks of the executor contract associated with the enabled Safe module, allowing calls controlled by the attacker to be executed through a trusted executor. Blockaid stated that the attacker exploited a public keeper multi-call to direct a custom Uniswap v4 liquidity module to a hook pool created by the attacker, which subsequently unpacked aEthrsETH into rsETH.

Bitwise Chief Investment Officer Matt Hougan published a statement discussing U.S. cryptocurrency policy, stating that the U.S. originally had the opportunity to make the cryptocurrency industry safer, promote investment, and ensure it continues to lead the global financial markets for the next 50 years, but is currently sacrificing this opportunity for short-term political gains.