security

HumidiFi posted on platform X that the team discovered a security incident affecting certain internal network systems, with the impact limited to proprietary funds; customer and third-party assets were not affected.The team is actively investigating the incident, has suspended trading, and will provide further updates after the review is completed.

The Central Cybersecurity and Informatization Commission issued the "Action Plan for Promoting High-Quality Development of Internet and Information Enterprises (2026-2030)."It mentions strengthening the construction of cyber rule of law. Actively carry out forward-looking research on legislation in the field of internet and information. Accelerate the legislative process in emerging areas such as artificial intelligence, anti-cyber violence, digital economy, online platforms, and blockchain.Promote the revision of the "Internet Information Service Management Measures," improve the legal system for internet information service management, "self-media" management, and algorithm governance. Advance the formulation of the Telecommunications Law, Cybercrime Prevention Law, and Cybersecurity Level Protection Regulations, and improve the supporting regulations for the "Regulations on the Protection of Minors Online" and "Regulations on the Management of Cyber Data Security."Standardize administrative inspections involving internet and information enterprises, minimizing interference with the normal production and operational activities of internet and information enterprises. Improve supervision and law enforcement measures that adapt to the new characteristics of internet development governance, and severely crack down on illegal and irregular activities online.

HTX global advisor Sun Yuchen stated that HTX has officially upgraded its security architecture in response to the community's demand for stronger security guarantees, claiming to keep user assets 100% SAFU. The upgrade includes enabling a multi-address withdrawal system, with hot wallet assets distributed across multiple addresses; withdrawal addresses are automatically rotated regularly, with old addresses immediately deactivated and no longer controlled after new addresses are activated; single address risk exposure has been minimized.Sun Yuchen mentioned that even in the event of extreme security incidents, the potential loss limit is below $1 million, fully covered by an insurance fund, and users will not lose any funds. He also reminded that withdrawal addresses will be changed regularly as part of normal security mechanisms, and users must verify the actual on-chain receipt situation. HTX stated that it will take every user feedback and every bit of user assets seriously.

According to crypto journalist Kate Irwin, an abnormal asset outflow event occurred on GalaChain this Tuesday, with 1.99 billion GALA (approximately $2.9 million) and other tokens transferred from five main addresses to a new wallet, and GALA was cross-chain exchanged for ETH within about an hour. Approximately 82% (1.639 billion GALA) came from a wallet associated with Gala CEO and co-founder Eric Schiermeyer, which also saw an outflow of about $500,000 in other tokens.Hours after the incident, Gala developers submitted a fix on GitHub, characterizing it as a GalaChain EIP-712 unsigned field injection vulnerability. Currently, Gala has suspended the Ethereum and Solana cross-chain bridge, with officials stating "under maintenance," and GalaChain and its CEO have not yet responded to requests for comment.

The open automated research challenge better.codes, created by the Ethereum Foundation's formal verification team in collaboration with Yukon and zkSecurity, is now live. This platform formalizes the self-contained problems from the Proximity Prize in Lean and places the machine-checked reliability bounds of koalaIRS12 on a public leaderboard, allowing anyone to contribute to improvements, advancing hash-based SNARK and post-quantum Ethereum-related security benchmarks.Solvers can bring their own AI agents to prove higher lower bounds of reliability for this Reed-Solomon proximity problem, moving towards a fixed target of 128 bits. The Lean kernel verifies each submission, and the promoted proofs will enhance the public bounds, with new lemmas, proof techniques, and impossibility results being synchronized upstream for reuse by all participants. Most hash SNARKs in production environments rely on related proximity gaps and related conclusion agreements, while the currently provable results remain below the benchmarks trusted by researchers; this challenge aims to narrow this gap in an open, incremental, and verifiable manner.koalaIRS12 originates from related papers and is end-to-end formalized in ArkLib. Participants can log in via GitHub and clone the challenge repository, submitting under fixed theorem statements and verification frameworks; results confirmed by the comparator and Lean kernel are recorded in a public repository, noting the solver and the model used. Today's launch features the reliability challenge that raises the proven lower bound of koalaIRS12 to 128 bits, with more problems potentially added later, subject to project terms.

Coldcard has released the latest firmware 5.6.1 (Mk4/Mk5) and 1.5.1Q (Q). This update is based on a three-week security review following an emergency fix, focusing on addressing the security risks posed by previous mnemonic phrase generation attacks. Each newly generated mnemonic phrase must include at least one user entropy source, such as irregular key presses at least 65 times, physical dice rolls 50 times, or physical coin tosses 128 times, combined with fresh entropy provided by STM32 TRNG, SE1, and SE2.The new firmware also adds pre-signing phased PSBT verification, strengthens USB connection and firmware update boundaries, improves Delta Mode isolation mechanisms, fixes active wallet backup issues, enhances random number generator initialization and fault checking, adjusts SIGHASH default settings, and includes multiple security and correctness improvements. Coldcard states that this update aims to further reduce the risk of the device being attacked.The official reminder is that updating the firmware cannot fix existing mnemonic phrases generated by previously affected firmware. If a user's mnemonic phrase falls within the scope of this security announcement, they should first update the device, then generate and verify a brand new mnemonic phrase, and migrate funds to the new wallet. Coldcard recommends that all Mk4, Mk5, and Q users update their devices promptly and verify the signatures of the downloaded firmware.

According to Cointelegraph, cybersecurity company Rapid7 has disclosed a phishing operation named Operation Asterix, targeting approximately 885,000 phone numbers across multiple countries and directing victims to fake wallet service websites. A total of 5,576 phone numbers have been matched with Binance user accounts and are included in the attack queue.The attackers steal mnemonic phrases by impersonating fake applications of Ledger, Trezor, and Exodus, while also using forged customer service emails and phone calls to contact victims. Rapid7 also found that out of over 316,000 phone numbers in Germany, 43,066 matched with cryptocurrency trading accounts, resulting in a hit rate of approximately 13.6%. Related attacks also include a bulk phone number verification tool targeting Kraken accounts, with investigations revealing that AI tools have been heavily used in the phishing operations.Data from blockchain security company Hacken shows that phishing attacks and social engineering scams caused losses of $306 million in the first quarter of this year, accounting for the majority of the total losses of $482 million in the cryptocurrency industry.

Decred announced that the mandatory patch version v2.1.6 has been released, which includes a fix for a critical security issue related to consensus, preventing potential periodic de-anonymization mixing attacks.In addition, this patch also addresses several possible network-related denial of service (DoS) attack issues and improves the expiration duration of mixing sessions. The official urges users to upgrade as soon as possible, while noting that the Windows version of Decrediton has not yet been released and is expected to be launched the following day.

The blockchain security audit platform Sherlock today announced the launch of the Sherlock Audit Engine. This engine integrates the most powerful AI security methods into a collaborative review process, aiming to usher in a new era of AI-native security audits.Sherlock stated that the team has spent months building this engine in a private environment and has tested it on high-risk code. The Audit Engine is now officially live and can conduct coordinated AI security reviews on code such as smart contracts.

The Binance security team recently independently discovered a malicious governance proposal targeting a certain project's decentralized autonomous organization, which could put approximately $1.2 million in treasury tokens at risk.Binance notified the project team to vote against the proposal less than 48 hours before its execution and coordinated with relevant centralized exchanges to suspend deposits of the affected tokens to reduce the potential risk of fund transfer. Ultimately, the malicious proposal was rejected, the attack was not executed, and no funds were lost.

Decred official X account (@decredproject) released a security notice, stating that a security vulnerability has been discovered in the Decred (DCR) network, and a patch will be released on August 18 at 10 AM Eastern Time.For security reasons, the official recommends that users suspend voting and mining operations until the upgrade is completed. An announcement will be synchronized on the official X account as soon as the patch is released.

According to official news, GoPlus announced a comprehensive upgrade of DeepScan, launching an AI-based smart contract security solution. GoPlus stated that as hackers begin to leverage AI to dig deeper into contract vulnerabilities, the traditional "one-time audit, go live and it's done" security model is struggling to cope with the continuously evolving attack risks.DeepScan constructs a complete security closed loop around the entire lifecycle of smart contracts, consisting of AI contract auditing, continuous security monitoring, and Token security self-checks, providing ongoing security assurance for developers, project parties, and trading platforms. Among them, AI contract auditing can analyze contract source code, permission management, and business logic based on AI deep analysis, identifying security risks such as syntax vulnerabilities and business logic vulnerabilities, and outputting a structured audit report that includes security scores, key findings, problem details, and remediation suggestions. Continuous security monitoring targets contracts that are already live and have completed audits, tracking newly disclosed vulnerabilities, on-chain attack events, and changes in external dependencies such as oracles and cross-chain bridges in real-time, and using AI to determine whether the project is affected, conducting timely reviews and alerts. Token security self-checks are aimed at projects that are about to be launched or applying for listing, quickly detecting risks such as P2P pools/honeypots, malicious issuance permissions, blacklist mechanisms, abnormal transaction taxes, Owner permissions, and transaction restrictions.In addition, the GoPlus DeepScan team also released an open-source Benchmark dataset built on real smart contract attack events, used to assess AI's actual capabilities in vulnerability identification, attack path understanding, contextual reasoning, and audit stability. Currently, it has included nearly a hundred typical attack events since May 2025 and continues to be updated. GoPlus stated that DeepScan can be used for low-cost security scanning by developers, security reviews before project launches, and continuous monitoring during operations, while also serving as a supplement to security assessments before listing on trading platforms, helping all parties to more promptly identify new vulnerabilities and attack risks.

Payward (the parent company of Kraken) stated that in the coming weeks, it will use Claude Mythos 5 to scan for vulnerabilities in all Payward environments, and the findings will be directly incorporated into its existing security program.

Zach Pandl, the head of research at Grayscale, posted on the X platform comparing Ethereum to a "small country" and discussed the ETH issuance mechanism. He believes that Ethereum has only one core "government function": to protect property rights and value exchange within the system. Unlike traditional countries that provide public services through taxation, Ethereum primarily funds network security through "seigniorage," which is the issuance of new ETH.In this framework, the stakers responsible for maintaining network security are akin to a group providing public services, as they receive rewards through newly issued ETH. Therefore, Ethereum's staking mechanism and ETH issuance policy essentially constitute the network's fiscal and monetary policy. Zach Pandl pointed out that the Ethereum community needs to decide how much "new currency" should be used to cover network security costs. More security typically means stronger protection of property rights, but at the cost of a higher ETH issuance rate and potential other risks.For example, if network security increasingly relies on a few large staking service providers, there remains room for discussion about whether these providers can maintain the asset rights of all users completely neutrally. Pandl believes that, just as in traditional economies, no one knows the "optimal level" of government spending and currency issuance; the same applies to Ethereum. However, Ethereum has several key security thresholds, including: 1/3: an attacker reaching this ratio may affect finality; 1/2: affects blockchain fork choice; 2/3: can control the finality process. Some community members believe that the design of Ethereum's monetary and fiscal policy should consider the security trade-offs brought by these key ratios, while the current mechanism has not adequately incorporated these factors. However, the above analogy is not entirely accurate, as it does not yet involve other important factors such as the ETH burn mechanism, MEV, governance, etc.

Venture capital fund Team8 announced the completion of a new fundraise of $365 million. This round of fundraising includes $265 million for Team8 Capital's third fund, as well as over $100 million for follow-on investments in existing portfolio companies.The new fund will focus on investing in seed and Series A stage AI-native companies, covering areas such as cybersecurity, AI infrastructure, and fintech, with a particular emphasis on infrastructure projects that help businesses deploy AI while ensuring security, governance, and control capabilities. Team8 currently manages assets close to $2 billion.Previously, Team8 has co-invested in several cryptocurrency and AI companies, including cryptocurrency institutional wallet developer Curv, AI compliance platform IVIX, and AI data leak prevention company Jazz.

Bitcoin News posted on the X platform stating that Trezor claims its customer data was exposed due to a security breach at the logistics provider ShipMonk. Customers who placed orders in the past 90 days in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal may be affected. The exposed data includes full names, shipping addresses, phone numbers, email addresses, and order numbers.Trezor stated that its systems were not compromised, and the devices remain secure, but it warns affected customers to be vigilant against carefully designed phishing attacks that exploit the leaked information.

AI security startup Mindgard announced the completion of a $30 million Series A funding round, led by Album VC, with participation from Karma Ventures, .406 Ventures, Atlantic Bridge, IQ Capital, and Lakestar.Mindgard was founded by Dr. Peter Garraghan in 2022 and incubated at Lancaster University in the UK, with headquarters in Boston and London. The company's platform offers Shadow AI discovery, AI red team testing, and runtime AI protection capabilities, having helped disclose over 150 high-impact AI security vulnerabilities, including issues such as the Cursor IDE zero-day code execution vulnerability, Google Antigravity trusted workspace defects, and ChatGPT image generation protection failures.

The Bitcoin wallet Electrum has released version 4.8.1, with the official statement claiming that this update includes "important security fixes" and urging users to upgrade as soon as possible.Developers involved in reproducible builds have provided independent signatures for the binary packages on the download page to verify the consistency between the release package and the source code.

According to a report by Fortune, the cybersecurity startup Corma, established in 2025, announced the completion of a $60 million seed round financing, with investors including Sequoia Capital, Khosla Ventures, and Coatue.Corma is headquartered in Tel Aviv and San Francisco, and six weeks ago, it deployed its first AI model to several Fortune 100 and 500 companies across various industries (covering healthcare, financial services, energy, critical infrastructure, and retail).Unlike current cybersecurity models primarily trained by OpenAI, Anthropic, Google, etc., for "offensive" purposes, Corma's trained model focuses on "defensive" strategies, concentrating on log and audit data analysis, identifying threats among massive events, and maintaining consistent strategies across thousands of operations. According to the company, its model has helped clients reduce threat response times by 94%.