permi

Bitcoin News posted on platform X stating that the Congressional Research Service pointed out in a new report that since 2017, with changes in presidential administrations, federal regulators have repeatedly changed their stance on whether banks can engage in cryptocurrency activities.The report states that Congress could clarify through legislation to explicitly allow or restrict specific activities to reduce the frequent adjustments in regulatory positions. The report mentions the CLARITY Act: the version passed by the House of Representatives would allow banks to use digital assets or blockchain for activities already permitted by current law; the version reported by the Senate committee would explicitly allow 11 types of cryptocurrency activities, including allowing banks to underwrite and trade digital assets more broadly.

The token standard on Solana and the NFT infrastructure Metaplex announced the launch of MPL-3643, positioned as a new standard for permissioned real-world assets (RWA) and tokenized securities, aimed at supporting the compliance infrastructure required for issuer-led tokenization.Metaplex stated that bringing new markets on-chain requires compliance infrastructure that can support issuer-led tokenization. MPL-3643 will be deployed on Solana, targeting real-world asset and tokenized securities scenarios that require permission control.

NVIDIA CEO Jensen Huang stated that the top priority is to strip AI entities of their privileges.

MistTrack disclosed that following the $1.46 billion hacking incident at Bybit last year, where nearly $1.2 billion in stolen funds were transferred via THORChain, Bitget has recently experienced another significant security incident, with stolen funds suspected to have once again flowed through THORChain.In response, THORChain officials stated that their protocol, like Bitcoin, Ethereum, and BNB Chain, belongs to a decentralized and permissionless network.

Supermicro has now begun shipping rack systems equipped with NVIDIA Vera Rubin NVL72.

The PermissionDelegationV1_1 upgrade of the XRP Ledger entered a 14-day activation countdown on September 21, having received support from 29 of the 35 trusted validator nodes. If the support rate remains above 80% during this period, the upgrade could officially activate as early as October 5 at 11:18 UTC; at least 28 validator nodes must continue to support it, or the countdown will reset.This feature allows accounts to split permissions by role. For example, a stablecoin issuer can allow a connected compliance system to approve customer accounts holding its tokens while keeping the keys with full control offline; operational accounts can gain payment permissions but cannot change keys or delegate authority to others. Each trustee can have up to 10 permissions, and the main account can modify or revoke them at any time.This is the network's second attempt to introduce this feature. The original version had vulnerabilities that attackers could exploit to make others pay transaction fees with improperly signed transactions, and by repeatedly submitting high-fee transactions, they could deplete the victim's XRP balance. This vulnerability was reported by community testers on September 15, 2025, and validator nodes were advised to reject the amendment, so it was never activated. The fixed version was released with xrpld 3.3.0, changing the way unauthorized transactions are rejected, ensuring that fees are not deducted before signature verification.

Sandeep Nailwal, CEO of the Polygon Foundation, stated that Polygon is preparing to deploy a permissionless burn contract that allows anyone to permanently burn 100 million POL, which accounts for approximately 83% of the 121 million tokens held by the Polygon base fee collector. The contract is currently live on the testnet and will be deployed to the mainnet after the security committee completes the final signature.The first round of burns will permanently destroy 100 million POL, after which community members can trigger burns every quarter. Polygon's documentation indicates that the base fee is determined by the network and will be burned, with Nailwal stating that each base fee will inject POL into the collector. Based on the above data, approximately 21 million POL will remain in the collector after the initial burn.This burn represents about 1% of the initial supply of 10 billion POL, and based on a total supply of approximately 10.716 billion as shown by Blockscout, it accounts for about 0.93%. The burn will not set a hard cap on POL, which will continue to be issued, with an annual issuance rate of about 2% after June 2025. Nailwal also mentioned that POL has entered deflation starting January 2026, citing data from his "ChatGPT Analyst" that Polygon's revenue in 2026 will be $24.5 million, higher than Arbitrum's $8.41 million and Near's $5.6 million.

According to The Block, ZKsync developer Matter Labs has open-sourced the permission engine of its distributed ledger platform Prividium for financial institutions, allowing organizations to run, inspect, and modify core code in their own environments. The German central bank has become the first institution to test and deploy Prividium.Matter Labs CEO Alex Gluchowski stated that feedback from regulators regarding commercial core means reliance on a single vendor, and that open-sourcing the core "structurally eliminates adoption barriers."Other components of Prividium, such as the ZKsync OS core and Atlas sequencer, have previously been open-sourced. The permission engine is planned to operate as an independent component, allowing institutions to deploy it without a commercial agreement, but management tools and integration with existing systems remain commercial products. Gluchowski said, "The central bank running public code is the clearest signal in this direction."

DeFi protocol Term Labs updates on the progress of the attack incident, disclosing that the affected entity is the Term Vault governance mechanism, rather than the underlying Term protocol and its direct lending market. All Meta Vaults have now been closed and DAO governance permissions revoked to prevent further inflow of funds. This closure operation is irreversible and will permanently block new deposits.Currently, the withdrawal function remains open, and they are working with external security teams to conduct repairs and recovery. If a funding gap is ultimately confirmed, corresponding solutions will be explored. Term Labs reminds users to pay attention only to information released by official accounts and to be wary of impersonators and fraud. Previously, it was reported that Term Labs suffered a governance attack resulting in losses of approximately $8.5 million.

The Supreme Joint Military Command of Iran stated that any vessel passing through the Strait of Hormuz must obtain permission from Iran.

BIP-110 soft fork has stalled due to support rates far below standard, with thousands of nodes isolated. Just two days after the incident, the Bitcoin BIP editing team removed the editing privileges of the proposal leader Luke Dashjr on Monday. Editor Mark Erhardt proposed a motion for dismissal, citing reasons including conflicts of interest, minimal contributions, leading a controversial fork, and coordination breakdown.Supporters pointed out that Dashjr used his editing privileges to favor the BIP-110 proposal, assigning numbers and quickly merging PRs before discussions on the mailing list, and has contributed less than 1% since April 2024. The peak signal support for BIP-110 was only 2.53%, far from the 55% threshold, and the forced chain has stalled at a height of 961,633. Ocean was the only mining pool signaling before the fork, and has now resumed non-BIP-110 work. Dashjr announced the suspension of his roles as Chairman and CTO of Ocean four minutes before the dismissal confirmation, shifting to Bitcoin open-source projects, but still serves as the chief maintainer of Bitcoin Knots. The price of Bitcoin was unaffected by the incident.

According to the official report from Ostium, the core of this attack lies in the intrusion of the off-chain price reporting system's permissions, unrelated to smart contract vulnerabilities. After gaining off-chain authorization, the attacker submitted forged prices (5,000 USD and 60,000 USD) to the BTC-USD market using the legally registered forwarding paths of the protocol, completing an atomic open-close arbitrage cycle within the same transaction, and starting with a rolling scale of 100 USDC. Through 8 transactions, they extracted 23.75 million USDC from the OLP treasury within 5 minutes, until the treasury's circuit breaker mechanism was triggered.The root cause is the lack of a multi-party approval mechanism at the same level as on-chain multi-signature in the off-chain infrastructure, creating a single point of permission vulnerability. The stolen funds have been converted to ETH and mixed through Tornado Cash, and tracking efforts are still ongoing.

According to official news, Uniswap has launched Permissioned Pools, a new hook standard in Uniswap v4 that supports permissioned asset trading through automated market makers (AMM), with compliance enforced directly on-chain. Permissioned asset pools are collaboratively built by on-chain asset management teams. The first batch of partners includes Superstate, Securitize, and Dowgo.

GoPlus Security issued a security alert stating that a user signed a malicious Permit transaction 183 days ago, resulting in approximately $1,625 of USDC being transferred by a phishing attacker.Since the user did not revoke the relevant authorization afterwards, the attacker again used that authorization to transfer approximately $75,780 of USDC.

According to The Block, Hyperliquid announced that it will introduce a permissionless deployment mechanism for the HIP-4 outcome markets in future upgrades. According to the disclosure plan, validators will vote on outcome templates to ensure market quality and clarity of expression.In addition, HIP-4 market deployers are required to stake 500,000 HYPE and can receive up to 50% of the fee share from the markets they create.

Founder of Strategy Michael Saylor published a post opposing the BIP 110 proposal that restricts the use of inscriptions and other data storage purposes. Bitcoin should adhere to neutrality, open markets, and permissionless innovation, and should not target specific uses through consensus rules.Saylor listed 110 reasons for opposition, emphasizing that Bitcoin should remain conservative at its core. Bitcoin does not need guardians of purity; it needs guardians of neutrality.

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.

Members of the management team of the Ethereum Foundation (EF) and CSA Operator Aerugo published a systematic explanation of EF's mission. Aerugo stated that EF's core mission is to ensure that Ethereum becomes and continues to be a truly permissionless sovereign infrastructure: censorship-resistant, capture-resistant, open-source, private, and secure, capable of supporting large-scale trustless coordination.He emphasized that EF's focus is on eliminating extraction and capture risks that may arise at the protocol layer of Ethereum, particularly the two core challenges of MEV (Maximum Extractable Value) issues and the lack of default privacy. Aerugo described MEV as "the main battleground of the next cypherpunk war," and pointed out that "a public ledger without serious default privacy is a monitoring infrastructure with settlement guarantees."In addition, EF will move some of its work out of the foundation through spin-offs in the future, but will maintain strict standards for external funding. The recent departure of some personnel is part of normal organizational adjustments, and EF will handle it in a dignified manner without making personnel issues public.

According to Fortune, Mastercard has announced a new protocol called Agent Pay for AI, allowing AI agents to make payments and conduct small transfers among themselves— for example, automatically paying when an AI agent retrieves data from a website in segments. The protocol stores the permissions granted to AI agents by humans on the blockchain, initially using the Polygon network to ensure transparency and verifiability, allowing multiple parties to verify whether the agents are acting as instructed.Companies like Adyen, Coinbase, and Cloudflare are collaborating with Mastercard to develop this protocol. Mastercard's Chief Product Officer Jorn Lambert stated that this protocol will not become a major source of revenue in the short term, but it is expected to develop into a significant new market over the next five years.Giants like Visa, Stripe, Coinbase, and Google are actively laying out AI payment protocols, jointly promoting the future of "machine-to-machine payments" and AI chatbots dominating e-commerce transactions; however, the current volume of agent-based payments remains relatively small.

Aleo released the privacy stablecoin white paper "Stablecoin Privacy," stating that the privacy layer is the key infrastructure missing for blockchain payment rails to be adopted by mainstream institutions. Aleo indicated that as the GENIUS Act provides opportunities for the widespread adoption of stablecoins, the issue of permanently public transaction information on public blockchains may still hinder institutions from using stablecoins in scenarios such as payroll, fund management, and vendor payments.Aleo claims that existing solutions do not adequately meet the needs of institutions in terms of privacy protection and risk management. The white paper proposes a permissionless private stablecoin architecture based on Aleo, which introduces programmable risk mitigation mechanisms while protecting transaction privacy through zero-knowledge technology and programmable smart contracts, allowing institutions to conduct private transactions without sacrificing compliance and risk control.It is reported that the team members behind this white paper have long been dedicated to research at the intersection of cryptography, policy, and financial systems. Aleo's Global Policy Director Yaya J. Fanusie, member of the Crypto Innovation Council and former Global Financial Crimes Compliance Officer at Coinbase Valerie-Leila Jaber, and cryptographer and Johns Hopkins University Computer Science Professor Matthew Green possess rare practical experience in private payments, financial regulation, and zero-knowledge cryptography.