BTC $83,488.08 +2.35%
ETH $2,466.73 +2.98%
BNB $745.60 +2.09%
XRP $1.36 +4.28%
SOL $106.89 +2.26%
TRX $0.3313 -0.02%
DOGE $0.0819 +3.13%
ADA $0.2251 +3.67%
BCH $285.51 +4.36%
LINK $12.38 +3.04%
HYPE $81.31 +3.50%
AAVE $155.31 +3.87%
SUI $1.03 +3.73%
XLM $0.1842 +4.42%
ZEC $1,289.90 +11.75%
AAPL $338.88 -0.24%
AMZN $263.14 -0.17%
GOOGL $336.90 -1.97%
MSFT $531.02 -0.95%
META $692.82 -1.15%
NVDA $220.33 +1.87%
TSLA $378.95 +2.67%
SNDK $1,407.86 +5.23%
INTC $93.25 +2.85%
SPCX $160.27 +9.06%
MU $921.96 +3.95%
AMD $544.09 +2.31%
BTC $83,488.08 +2.35%
ETH $2,466.73 +2.98%
BNB $745.60 +2.09%
XRP $1.36 +4.28%
SOL $106.89 +2.26%
TRX $0.3313 -0.02%
DOGE $0.0819 +3.13%
ADA $0.2251 +3.67%
BCH $285.51 +4.36%
LINK $12.38 +3.04%
HYPE $81.31 +3.50%
AAVE $155.31 +3.87%
SUI $1.03 +3.73%
XLM $0.1842 +4.42%
ZEC $1,289.90 +11.75%
AAPL $338.88 -0.24%
AMZN $263.14 -0.17%
GOOGL $336.90 -1.97%
MSFT $531.02 -0.95%
META $692.82 -1.15%
NVDA $220.33 +1.87%
TSLA $378.95 +2.67%
SNDK $1,407.86 +5.23%
INTC $93.25 +2.85%
SPCX $160.27 +9.06%
MU $921.96 +3.95%
AMD $544.09 +2.31%

xing

All
Article
Flash

first_img THORChain plans to execute the v3.21 upgrade on October 23, fixing vulnerabilities to promote the restart of Rujira

According to The Defiant, THORChain announced that its v3.21 upgrade will fix the FIN contract vulnerability on Rujira and allow the previously paused application layer to restart. The network has set the upgrade target at block height 28,366,100, with an expected time around October 23. After the restart, trading, lending, borrowing, and automated trading on Rujira will resume. Rujira's products run through smart contracts within THORChain, rather than on an independent blockchain, and the application layer can pause these contracts without affecting the underlying layer of THORChain.According to Rujira, the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding a position. The team paused the application layer with the support of node operators, and only one position from the Rujira team itself was affected, with no loss of user funds. Rujira attributed the vulnerability to a flaw in the position transfer function, rather than the trading logic of the liquidity strategy. On September 27, Rujira stated that the fix is located at the underlying layer and has been scheduled for the v3.21 upgrade.Regarding the restart window, Rujira proposed a conditional grace period in its plan on October 15: if the application layer is ready to resume, any credit account position with a loan-to-value ratio above 100% and meeting liquidation conditions will request node operators to pause the credit account contract for an additional 24 hours, allowing borrowers to replenish collateral before liquidation resumes. Borrowers can replenish collateral through Rujira Borrow or by directly transferring assets to the credit account address. Rujira indicated on October 10 that positions still deemed unsafe after the grace period may be liquidated when the liquidator triggers the process.

Polygon Labs: Bor v2.1.3 released, fixing two DoS security vulnerabilities

Polygon Labs official announcement, Bor v2.1.3 is officially released to the public, previously distributed in private version form to validators and major infrastructure providers. This update fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution, both submitted by security researchers through the Immunefi bug bounty program.Unbounded keccak256 cache issue: Attackers can fill hundreds of MiB of cache during the speculative execution phase by constructing specific transactions, leading to node memory exhaustion and delayed block production. The fix is to set a capacity limit on the shared cache. Repeated code hash calculation issue in parallel execution: A single transaction can cause the parallel processor to take about 11 seconds, severely affecting node activity. The fix is to cache code hash results on a per-transaction basis.In addition, this update also includes several internal hardening measures: the transaction pool address filtering adds interception for EIP-7702 SetCode authorization, RPC batch execution pool concurrency limit fixes, consistency fixes for reading balances across self-destruct boundaries in parallel execution, and an automatic cleanup mechanism for pending transactions (default 3 hours). The affected versions are Bor v2.1.1 and v2.1.2. v2.1.3 is a non-hard fork, and nodes can upgrade individually without coordination. No exploitation records of the two vulnerabilities have been found on the mainnet and testnet Amoy.

first_img Liu Xing, the head of Doubao Public Relations: The layoff news is false

On September 24, the trending topic "Doubao employees lament that Doubao has become a marginal product" topped Weibo's hot search. Previously, media reported that the Doubao General Session team had undergone personnel reductions. Following the dissemination of related content, statements such as "Doubao layoffs" and "half of the dialogue team cut" appeared online, with some claiming that internal employees lamented that Doubao was being marginalized.In response to the above statements, Doubao's public relations head Liu Xing posted a response stating: Some media reported that the Doubao Session team underwent organizational adjustments, and some self-media interpreted it as Doubao layoffs and cutting half of the Doubao dialogue team, which is inaccurate information; in fact, it is merely an organizational adjustment of responsibilities.According to Liu Xing, part of the functions of the Doubao General Session team has been split into the Doubao trading and Doubao work teams, with relevant personnel being transferred accordingly. Many employees are still engaged in dialogue experience-related work, such as optimizing the trading dialogue experience on the trading side. The team has fewer than 50 people, and the adjustment of responsibilities involves 11 individuals, of which 3 have left. He emphasized that statements in some self-media reports, such as "Doubao layoffs affecting 200 million users" and "half of the dialogue team cut," are inaccurate.

Galaxy Research: Coldcard attackers continue to transfer funds, approximately 45% of the stolen assets have entered mixing or cross-chain pathways

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

Harmony plans to shut down the mainnet and migrate ONE to Ethereum, shifting towards AI video remixing business

Harmony has released two proposals to comprehensively shut down the mainnet launched in 2019, migrate the native token ONE to Ethereum, and shift towards an AI video "mashup economy" business. The team stated that the threats posed by national-level attackers and AI entities are the reasons for proposing the network shutdown plan.The migration plan proposes to take a snapshot of user wallets, staking delegations, validator rewards, smart contracts, and tokens within centralized exchanges at the last block of the network, airdropping new ONE to the same wallet addresses on Ethereum, with holders not needing to actively claim; delegated stakes and unclaimed rewards will be airdropped to their respective governance vaults. The total supply of ONE and the issuance rate will remain unchanged, with newly issued tokens intended for the new business and feedback from governors being considered.Multi-signature wallets, liquidity pools, and on-chain applications cannot be migrated. The team urges users to exit all smart contracts by September 10, 2026, and plans to publicly disclose token contracts, snapshot calculations, and airdrop scripts for auditing. Validators can stop running nodes starting from September 10 at 22:00 Beijing time. The team plans to compensate for the difference in issuance rewards between node shutdown and the final block of the network, establishing a one-time compensation pool of $1.372 million, to be paid in four quarters to validators and their delegators who timely shut down, sign agreements, retain stakes, and serve as governors of the new project.The new business will open up prompts and materials for users to create secondary content, with AI entities expanding video stories, and will recruit operators responsible for video generation, distribution, and content review. Harmony plans to subsidize GPU hardware in the first year and promote demand for video generation, with operators required to stake tokens to earn rewards based on service online time. The team plans to help operators generate up to $1 million in total revenue in the first year, provided they meet staking and online rate requirements; promoters can initially earn a 30% ongoing commission from each $10 monthly subscription they recommend. Both proposals are non-binding and the plans may still be adjusted.

Vitalik releases research on "local mixing" cryptography: exploring next-generation obfuscation techniques, which may become a new foundational primitive in cryptography

Ethereum co-founder Vitalik Buterin published a new article titled "Obfuscation (Part 3): Local Mixing," which delves into a cryptographic obfuscation technique being explored—"Local Mixing." He claims it may become a new foundational cryptographic tool following elliptic curves, RSA, and lattice-based cryptography.Vitalik states that current mainstream obfuscation techniques mainly rely on complex mathematical assumptions, often resulting in extremely high computational overhead. In contrast, Local Mixing adopts a completely different approach, not relying on elliptic curves, large integer factorization, or lattice cryptography. Instead, it draws on experiences from symmetric cryptography and hash function design, continuously shuffling, reconstructing, and hiding circuit structures to eliminate information leakage while maintaining functionality.The Local Mixing technique primarily includes steps such as reversibility, hardening, mixing, splitting, crossing walk, and "gadgetization." By introducing random structures into the circuit, rearranging logic gates, and employing nonlinear hiding mechanisms, it makes it difficult for attackers to recover the original computational logic.Vitalik points out that this technology is still in its early stages, with security not yet validated over the long term and facing challenges such as random attacks and linear analysis. However, he believes that Local Mixing represents a completely new path for cryptographic exploration, aiming to construct more efficient indistinguishable obfuscation (iO) schemes.If breakthroughs in Local Mixing technology are achieved, it could lead to new quantum-resistant public key encryption schemes and promote the development of general obfuscation techniques. The field still requires years of cryptanalysis and optimization validation, but AI-assisted research may significantly accelerate this maturation process. Vitalik states that obfuscation technology is seen as the "final frontier" of cryptography because, theoretically, other cryptographic primitives can be constructed based on obfuscation and one-way functions. Local Mixing may not only reduce the costs of traditional obfuscation schemes but could also become an important direction for future cryptographic infrastructure.
app_icon
ChainCatcher Building the Web3 world with innovations.