discover

According to The Block, the Solana ecosystem decentralized exchange Stabble issued an emergency notice urging liquidity providers to withdraw their funds immediately, due to a North Korean employee who previously worked on the project. This warning appears to have been triggered by information from on-chain detective ZachXBT, who disclosed that a North Korean developer had worked for many years on the Solana DeFi infrastructure project Elemental.U.S. authorities had previously issued warnings that North Korean technicians were infiltrating crypto companies using false identities. Over the weekend, Drift Protocol stated that its $280 million attack incident was likely carried out by the same North Korean hackers responsible for the October 2024 Radiant Capital attack. Stabble responded that the North Korean employee seemed to have joined a year ago, and a new team took over the project four weeks ago, emphasizing that no attacks have occurred so far and that the warning was merely a precaution. Stabble stated that it would conduct a new audit to ensure LP safety.

The 360 vulnerability mining agent recently discovered and reported 1 high-risk and 2 medium-risk high-value vulnerabilities related to OpenClaw, totaling 3 vulnerabilities. Currently, all newly discovered vulnerabilities have been officially patched and publicly disclosed.It is understood that the three newly discovered vulnerabilities directly target the core operating mechanism of AI agents, directly affecting the core security of user devices, data, and accounts.

The China Academy of Information and Communications Technology, in collaboration with Shanghai Jiao Tong University and Nanjing University, discovered a high-risk vulnerability driven by LLM command injection in the bash-tools module of the open-source autonomous intelligent agent framework OpenClaw during a security audit.This vulnerability arises from the system's failure to strictly escape command line parameters generated by LLM, allowing attackers to bypass regex defenses through inducive prompts, achieving remote code execution on the host machine and stealing sensitive data.The research team has completed attack verification in various mainstream model environments, initiated a responsible vulnerability disclosure process, and submitted repair suggestions to the NVDB Artificial Intelligence Product Security Vulnerability Professional Database (CAIVD) and the GitHub community.

White hat hacker f4lc0n posted on the X platform revealing that he discovered a "critical" vulnerability in the Injective protocol that could lead to over $500 million in assets being directly withdrawn from the blockchain. However, the project team only offered him a $50,000 bounty, far below the planned maximum limit of $500,000 for this level of severity.f4lc0n stated that the vulnerability allows any user to empty any account on the blockchain without special permissions. After submitting a report through Immunefi, the Injective team initiated a mainnet upgrade vote the next day to fix the vulnerability, but they were "unreachable" for the following three months.Currently, f4lc0n has disputed the amount of the bounty and stated that the $50,000 bounty has not yet been paid. He announced that he will allocate 10% of future bug bounty earnings to continue publicizing this matter until Injective pays the compensation as per the standard.

According to The Block, Ledger's security research team Donjon has discovered a vulnerability in the secure boot chain of MediaTek processors, allowing attackers to extract encryption keys via USB connection before the operating system loads, provided they have physical access to the phone. This could enable them to decrypt device storage and obtain the device PIN code and encrypted wallet mnemonic within approximately 45 seconds.In proof-of-concept tests, the vulnerability successfully extracted sensitive data from wallet applications such as Trust Wallet, Kraken Wallet, and Phantom. Researchers indicate that this vulnerability may affect about 25% of Android phones, involving models that use MediaTek chips and Trustonic's Trusted Execution Environment. Ledger's Chief Technology Officer Charles Guillemet stated that smartphones were never designed to be vaults. Although the vulnerability can be patched, it highlights the inherent risks of storing keys on non-secure devices, and users are advised to update security patches as soon as possible.According to data from TRM Labs, over 80% of the $2.1 billion in stolen crypto assets in the first half of 2025 stemmed from infrastructure attacks such as private key theft, mnemonic theft, and front-end hijacking. Chainalysis data shows that losses from crypto asset theft exceeded $3.41 billion in 2024, with the proportion of stolen personal wallets rising from 7.3% in 2022 to 44% in 2024.

Cosmos Labs posted on the X platform, stating that a vulnerability has recently been discovered, affecting certain blockchains built on the Cosmos EVM Stack. This vulnerability has impacted the Layer 1 blockchain Saga in the production environment.Cosmos Labs stated that its team has been investigating the issue in collaboration with Saga and ecosystem partners, and has coordinated the implementation of mitigation measures. A security patch has now been released to the affected blockchains.

GMX DAO recently approved a strategic plan to address the limited effects of ongoing buybacks and the pressure on prices caused by excess supply from CEX.According to the new plan, starting this week, staking rewards will be directed to the protocol treasury, and the protocol's liquidity will be concentrated in GMX's own infrastructure. This move is reportedly aimed at optimizing the price discovery mechanism, reducing the impact of excess supply from exchanges on the market, and strengthening the intrinsic value support of the protocol.

According to Cointelegraph, former Credit Suisse Chief Investment Officer Iggy Ioppe stated that during the period when CME Group's gold futures closed on Friday at 5:00 PM (Eastern Time) and reopened on Sunday at 6:00 PM, nearly all publicly visible gold price formation occurred in the on-chain market.He pointed out that during this time window, the regulated futures market was paused, and while there was some activity in the over-the-counter (OTC) market in Asia, it was not publicly transparent. Therefore, tokenized gold assets such as PAX Gold (PAXG) and Tether Gold (XAUt) became the only continuously tradable public market."From the perspective of publicly visible price formation, the on-chain market accounted for almost 100% of weekend price discovery." When CME resumes trading, futures prices typically align with the fluctuations that have occurred in the on-chain market.Data shows that the market capitalization of tokenized gold has risen to $4.4 billion, with approximately $2.8 billion added in the past year, an increase of 177%, far exceeding the performance of most spot gold ETFs. The total trading volume for 2025 is about $178 billion, with a peak of over $126 billion in the fourth quarter alone, making it second only to SPDR Gold Shares in terms of trading volume.On Saturday, amid airstrikes by the U.S. against Iran and escalating geopolitical tensions, tokenized gold briefly rose, with XAUt surpassing $5,450 and PAXG nearing $5,536, while Bitcoin and Ethereum fell in tandem.Current major participants include market makers, cross-market liquidity providers, and crypto-native macro traders who use tokenized gold for arbitrage, collateral, hedging, and yield strategies. Some institutions also monitor weekend on-chain gold trends to assess the "gap risk" before CME opens, but they often regard it as a reference signal rather than a direct basis for building positions.

The speculation about market manipulation by Jane Street has sparked ongoing discussions about the mechanism of Bitcoin ETFs. Bitwise advisor Jeff Park stated that the question of whether Bitcoin prices are being suppressed by Jane Street is not directed at a single institution, but rather determined by the structural characteristics inherent in the Bitcoin ETF framework.Each authorized participant (AP), including Jane Street Capital, JPMorgan, Goldman Sachs, and others, has the exemption to create and redeem ETF shares, which allows them to operate flexibly in the market, including using futures or derivatives for hedging, without having to purchase physical Bitcoin, potentially affecting the price discovery mechanism.This gray area arises from regulatory exemptions and the SEC's approval of physical delivery. Although there is no evidence that any AP explicitly suppresses Bitcoin prices, the existing structure may alter the natural mechanisms of price formation, warranting attention from regulators and investors.Bloomberg ETF analyst Eric Balchunas responded that this mechanism is indeed difficult to understand, and he is curious about who or what force is behind the "patterned sell-offs" that appear daily and then suddenly disappear. Samson Mow, CEO of Bitcoin technology company Jan3, stated that becoming an AP is not the only factor in a price suppression strategy; the key lies in how "extensive" their undisclosed trading and hedging activities are. This is a channel that brings capital costs close to zero.

The machine economy trust layer ZeruAI states that the AI agent discovery page AgentScan is now live on the Base chain, where agents can register, generate behavior-based zScores, and be publicly discovered.AgentScan is built on ERC-8004, utilizing ZeruAI's behavioral intelligence technology and integrating data from various registries. Agents can also install the AgentScan skill via npm.

The founder of Slow Fog, Yu Xian, reposted a security reminder. Currently, the ClawHub market of OpenClaw has discovered 1,184 malicious skills that can steal SSH keys, encrypted wallets, browser passwords, and open reverse shells. A single attacker has uploaded 677 packages. The top-ranked skill has 9 vulnerabilities and has been downloaded thousands of times.Yu Xian reminds users that text is no longer just text, but instructions. It is recommended to use AI tools in isolated environments, as many OpenClaw skills pose potential risks. Furthermore, Web3 security smart contracts are only part of the issue; the real causes of incidents are far beyond just contracts. A few days ago, Moonwell was hacked for $1.78 million, with the faulty code coming from Co-Authored-By: Claude Opus 4.6.

Musk stated that a vulnerability was discovered that needs to be fixed, so the release of the new version of "X" will likely be delayed until this weekend.Previously, Musk announced that the app could be updated to use the "For You" recommendation feature.

Binance co-founder He Yi responded on platform X to the news that "Binance employees were fired for discovering transactions related to Iran," stating that compliance staff need to handle various types of cases in their actual work. In recent years, Binance has proactively initiated multiple investigations related to potential crimes and has handed over the results to law enforcement agencies, while also assisting users in avoiding potential fraud and financial losses through risk control and compliance measures.In the face of a constantly changing regulatory environment and new types of financial crime, the company's compliance system still needs to be continuously upgraded and optimized. He also expressed gratitude to former employees who participated in the company's compliance efforts and emphasized that as the company continues to promote higher standards of compliance, it may not be possible to satisfy everyone during the execution process. However, Binance will continue to invest resources and bring in more compliance professionals with specialized backgrounds and law enforcement collaboration experience to enhance overall risk identification, investigation, and resolution capabilities.

Wintermute stated that Bitcoin briefly fell to $60,000 last Monday, erasing all gains since Trump's election. Spot fund flows show significant structural pressure. The Coinbase premium has consistently been in a discount state throughout the market process, persisting since last December, indicating ongoing selling pressure from the U.S.Internal OTC fund flow data also confirms that U.S. counterparties were the main sellers throughout the week, and this trend has been further amplified by continuous ETF fund redemptions. Over the past few months, AI-related assets have been continuously absorbing available market funds, crowding out the allocation space for other asset classes. The phenomenon where crypto assets underperform when AI-related companies rise and experience amplified declines when they fall can almost entirely be explained by the rotation of funds towards the AI sector.For crypto assets to outperform again, AI trading needs to cool down first. Microsoft's weak earnings report has initiated this process, but it is still far from enough. Last week's market was like a "surrender-style" clearing, with volatility soaring and buying support emerging at $60,000. In an environment where spot trading remains relatively low, leverage has become the dominant factor in price fluctuations.If open interest cannot significantly rebound, it will be difficult for the market to form sustained follow-through on either the long or short side. A true structural recovery requires a return of spot demand, but there is currently almost no evidence of this. We are likely entering a phase of high volatility and choppy price discovery. It will be hard to see sustained upward potential until the Coinbase premium turns positive, ETF fund flows reverse, and basis rates stabilize. Meanwhile, retail attention is being diverted to other asset classes, and market direction seems increasingly dominated by institutional fund flows from ETFs and derivatives channels.

According to official news from SlowMist, the agency has discovered potential serious security vulnerabilities at the HitBTC exchange. SlowMist stated that it has disclosed relevant information to HitBTC in advance via private message, but has not yet received a response.

Glassnode co-founder Negentropic published an article stating that the current price structure of Bitcoin is showing positive changes. Recent pullbacks continue to receive buying support, and previous lows remain intact, indicating that the market is overall exhibiting a constructive trend. A key structural change is that the "short squeeze" effect in derivatives has essentially been cleared. With the largest Bitcoin options expiration event in history taking place, with a nominal size of approximately $23.6 billion, the price suppression state dominated by hedging behavior in the previous weeks is coming to an end.Negentropic noted that before the options expiration, market rallies are often suppressed by mechanical hedging rather than real supply and demand. As related funds exit the market, BTC is no longer "pinned down," and the price structure is expected to be re-led by the market itself, with the price discovery mechanism returning and upward bias gradually strengthening. From a macro perspective, he emphasized that the liquidity environment is still improving. The U.S. M2 money supply has increased by 4.3% year-on-year, rising to a historical high of $22.3 trillion in November, expanding for 21 consecutive months, and is about $400 billion higher than the peak in 2022. Even after adjusting for inflation, the real M2 still shows a year-on-year increase of 1.5%, rising for 15 consecutive months. The long-term trend remains clear—fiat currency dilution has not stopped, and macro and structural factors are building a new tailwind environment for Bitcoin.

Wintermute posted on the X platform, stating that as the holidays approach, the market structure continues to narrow, and Bitcoin's dominance is rising. Due to oversupply and intensive token unlock schedules, altcoins continue to perform poorly. Internal flow data shows that there is buying pressure on mainstream coins, with institutional funds being a consistent source of buying since the summer, while retail investors are rotating from altcoins back to mainstream coins.Although spot buyers provide a stable foundation for the market, price discovery still occurs through derivatives, leading to a coexistence of net buying of mainstream coins and intraday sharp declines triggered by leveraged liquidations. Additionally, traditional financial institutions are steadily entering the crypto space, which is expected to provide support for mid-term prices. In the short term, the market will continue to fluctuate under thin liquidity, with BTC and ETH continuing to act as the main risk absorbers.