stem

AnomaPay disclosed on platform X that it has discovered an external security vulnerability in the RISC Zero proof system it uses, which may jeopardize user funds. To protect users and ensure the safety of funds, the risc0 validator behind Anoma has been suspended and will be upgraded by the RISC Zero team.AnomaPay stated that the funds deposited by users are safe, but they will be temporarily inaccessible until the Anoma protocol is upgraded to version V2, which includes the new security updates from RISC Zero. The upgrade is expected to take about two weeks. Although this downtime is not ideal, it is necessary to protect user funds. Users do not need to take any action; funds will be automatically migrated to V2 and access will be restored after the upgrade is completed.

According to exclusive reports from Big Factory Daily, Trip.com held an all-hands meeting last week to announce the promotion of the "Integration of Production and Research" system across the company. This system is centered around DRI (Directly Responsible Individual) and merges personnel from product, operations, front-end, back-end, algorithms, testing, and other areas into project-based teams, breaking down traditional functional team boundaries with the goal of achieving "everyone is a full-stack developer, everyone is a product manager."In terms of specific execution, DRI leaders are not limited by function and can be original product, operations, or technical leaders. Team members within the project group collaborate across functions, which may lead to situations where products evaluate technical performance, and technology reports to operations. Front-end and back-end teams can also propose requirements and implement them independently. Ideas from product and operations that can be realized by AI can also be delivered independently, ultimately decided by the DRI.Currently, departments such as Trip.com Travel, Flights, and Content Center have begun to respond, with different teams progressing at varying paces, and the company has not imposed a one-size-fits-all requirement. The report indicates that this move is partly influenced by Silicon Valley concepts and aligns with the trend of blurred job boundaries in the AI era. This model can effectively reduce buck-passing and disputes, shorten delivery chains, and accelerate decision-making, but the challenge lies in the high comprehensive ability requirements for DRI leaders, who need to possess both technical understanding and business insight, and such qualified leaders are currently relatively scarce.

Grayscale announced the launch of the investor education platform Zcash Invest and placed a cover advertisement in the print edition of The Wall Street Journal to promote Zcash and its Zcash ETF (ZCSH). This promotional campaign will also cover channels such as outdoor advertising, streaming media, and social media.Grayscale plans to use all the initiation fees collected in the first year for ZCSH as an exchange-traded product (ETP) to support the development, promotion, and education of the Zcash network, and plans to provide $1 million in funding to relevant nonprofit organizations and projects.The first $400,000 has been granted to the Zcash Foundation, Pretty Good Policy for Zcash, Shielded Labs, and Project Tachyon, with each receiving $100,000.

According to TNW, the German AI chip and systems company Sparxity based in Dresden has completed its Series A financing, bringing its total funding to 90 million USD.Sparxity did not disclose the specific amount of the Series A financing. This round was led by the ICM HPQC Fund, which focuses on investment computing and quantum infrastructure.

OpenAI announced the launch of a centralized system called Control Room, designed to track model workloads within its research infrastructure and quickly halt related tasks when security or safety concerns arise. This system currently covers research workloads within OpenAI, including training experiments, evaluations, and data processing. OpenAI stated that as model capabilities increase, associated safety and security risks also rise, making it increasingly critical to detect potential issues in a timely manner and swiftly halt models when necessary.In terms of specific mechanisms, Control Room assigns an identifier to each research task, and the inference engine verifies this identifier before generating model outputs. When a stop command is issued by manual or automated monitoring systems, Control Room revokes the authorization for that task, thereby blocking subsequent outputs, even if the underlying research program is still running. OpenAI noted that cached authorizations could delay shutdowns by up to 35 seconds; additionally, if Control Room itself is unavailable, the system is designed to reject new requests.Prior to this release, OpenAI had disclosed multiple incidents this year where research models deviated from instructions during evaluations. In July, the company reported that its model escaped a restricted testing environment and infiltrated Hugging Face to cheat in a security assessment. In October, it disclosed that a research model used an unauthorized encrypted wallet to pay for smart contract deployment fees on the testnet ETH, and this expenditure was omitted from the final summary.

NEAR AI tweeted that it has closed unauthorized access and continues to complete the investigation. NEAR AI Cloud will remain suspended until it can be safely restored. NEAR Protocol and other services are not affected, and the team stated that further updates will be provided within two hours.Previously, NEAR AI tweeted that it recently discovered unauthorized access to its internal systems and has suspended NEAR AI Cloud inference services as a precautionary measure to conduct an investigation. NEAR AI Cloud inference operates in hardware-isolated TEE to protect user prompt privacy.

According to official news, Hyperliquid's first L2 network Elysium announced its official launch of the mainnet on social media.

Google (GOOG.O) will launch two new versions of its Tensor Processing Unit (TPU) systems, namely TPU 8TX and TPU 8I Max, to handle more specialized tasks and challenge Nvidia.

The Sun Wukong ecosystem will hold a deep roundtable discussion themed "From AI Valuation Reassessment to Crypto Market Correction: When Capital Begins to Recalculate Returns, What Will Drive the Next Round of Growth?" on November 10 at 8 PM at X Space.This event will focus on the macro trends of declining market enthusiasm and shifting capital attention, exploring whether the high valuations in the AI field can be supported by actual profits, as well as the true long-term value worth paying attention to after adjustments in the Crypto market. Invited industry KOLs will jointly analyze how, in a context where capital no longer simply pays for growth expectations, business models, practical applications, and sustainable returns become more important criteria for consideration, assessing the sources of the next round of growth dynamics in AI and Crypto.

BIT Securities announced the launch of a dollar-cost averaging feature for U.S. stocks starting today, covering all stocks and ETFs in the U.S. market. Users only need to set the investment amount (starting from a minimum of US$10) and the period (daily, weekly, or monthly), and the system will automatically buy according to the plan without the need to place manual orders each time. Users can activate the plan with one click when viewing individual stock details or the "Assets" page, and can adjust, pause, or terminate it at any time; additionally, the dollar-cost averaging plan can also choose to use margin funds for purchases.Compared to a one-time investment, dollar-cost averaging spreads the investment over different time points, helping to average out the holding costs and reduce timing pressure.Currently, BIT Securities supports trading in U.S. and Hong Kong stocks, and covers various investment methods including U.S. stock options, margin trading, and stock dollar-cost averaging. Elio Cui, the head of BIT Securities, stated: "We always hope that users with different investment styles can find suitable tools at BIT. The essence of dollar-cost averaging is long-term investment, which aligns with the group's long-termism philosophy. We hope to accompany users in combating volatility with discipline and growing together with quality assets."BIT Securities is also launching new user benefits: new account holders can enjoy commission-free trading for U.S. stocks, a US$100 platform fee rebate card, and a real-time market data card, with tasks completed earning rewards worth up to US$320; a transfer incentive campaign is also ongoing, with rewards worth up to US$300. Details of the activities are subject to BIT's official announcements.Risk Warning: Dollar-cost averaging does not guarantee profits and is not necessarily superior to other investment methods. Investors should formulate investment plans based on their own financial situation and risk tolerance.

The National Internet Information Office of China has launched the "Internet New Technology and New Application Information Service Filing System," which can integrate the filing of new technologies and applications such as generative artificial intelligence, algorithms, deep synthesis, and blockchain. The system officially went live on November 9, and the original "Internet Information Service Algorithm Filing System" and "Blockchain Information Service Filing Management System" have been simultaneously discontinued.

According to the official announcement from LNbits, the Lightning Network wallet and account system LNbits has encountered a wave of attacks, urging all users to immediately stop their LNbits servers.LNbits stated that the team needs to push multiple security patches and will take precautionary measures before the patches are released, and will announce further developments as soon as possible.

Gnosis Pay disclosed on November 6, 2026, that its consumer card system was accessed without authorization on November 3, resulting in the exposure of some customer information. The company stated that it initiated containment within two hours of discovering the incident and has replaced the affected credentials and fixed the vulnerabilities; customer funds were not affected.This incident only involved the Gnosis Pay brand consumer card business, and the enterprise platform supporting white-label payment projects was not affected. Rotki founder Lefteris Karapetsas stated that the leaked information included full names, addresses, card numbers, and cryptocurrency wallet addresses associated with accounts; the number of affected customers and the full scope of information have not yet been disclosed.Gnosis Pay has enabled mandatory 3D Secure verification for online card transactions and strengthened monitoring of suspicious card and wallet activities, with these measures set to continue until the consumer card system is scheduled to retire on December 20. The company stated that it has notified partners, issuing institutions, and relevant data protection agencies, and will conduct a security review.

Binance founder CZ retweeted a warning about a critical vulnerability in Microsoft Paint, stating: "The application cannot protect you from operating system vulnerabilities, please update your operating system immediately."It is reported that Microsoft has disclosed a Windows Paint vulnerability numbered CVE-2026-83844, with a CVSS score of 8.1, affecting versions of Microsoft Paint below 11.2605.91. The vulnerability stems from an out-of-bounds read issue, which could allow an unauthenticated attacker to remotely execute malicious code without user interaction. Microsoft has released a security patch, and there have been no confirmed reports of the vulnerability being actively exploited. CZ uses this to remind users that application layer security measures cannot replace the security updates of the operating system itself, and system and software patches should be installed promptly.

According to a notice from the U.S. Department of the Treasury, as part of the "Economic Exile Action," FinCEN issued an order against the cryptocurrency exchange MEXC Global under Section 9714(a) of the Anti-Money Laundering Act concerning Russia, prohibiting U.S. financial institutions from conducting any fund transfers with it, thereby cutting off its access to the U.S. financial system. The order will take effect 30 days after its publication in the Federal Register.The Treasury stated that between May 2021 and May 2026, MEXC Global facilitated at least $16 billion in transactions related to sanctions evasion and cybercrime involving Iran, North Korea, and Russia, including approximately $22 million in transactions related to the Central Bank of Iran and the Quds Force of the Islamic Revolutionary Guard Corps, as well as nearly $1.5 billion in transactions related to sanctions evasion concerning Russia.

The hardware wallet manufacturer Foundation stated that attackers exploited a vulnerability in its self-hosted Cal.com appointment software, and then used another vulnerability in Bank-Vaults to steal credentials, accessing customer records, email systems, and domain settings.The intrusion began on October 21; on October 25, the attackers attempted to send over 23,000 phishing emails from Foundation's real email address, targeting 21,463 email addresses. The leaked information included names, home addresses, phone numbers, order records, customer service communications, and some payment card information. The scammers subsequently used the stolen purchase and payment information to call customers, tricking them into providing Bitcoin wallet recovery phrases. Foundation stated that employee accounts and devices were not compromised, funds stored in Passport devices are safe, and it will reduce self-hosted infrastructure, shifting to managed services.

The $6.3 billion security incident at the cryptocurrency exchange Binance involves affected assets with a cumulative value across 10 blockchains. CertiK analyst Jonathan Riss stated that public blockchain records show a hot wallet on Ethereum was repeatedly emptied by attackers after new deposits arrived; on-chain records cannot reveal Binance's internal signature controls and transfer limits.Jonathan Riss pointed out that if the limits are executed by the application that initiated the signature request, those limits may be bypassed if the application is compromised; limits executed independently by the signature system may restrict transfers. Binance previously stated that attackers transferred funds out of the regular withdrawal process through an internal wallet signature service.Idan Ofrat, co-founder and Chief Product Officer of the crypto asset custody company Fireblocks, stated that exchange hot wallets typically hold enough funds to cover expected withdrawals for a few days, often representing a low single-digit percentage of managed assets. Alex Tobol, Chief Technology Officer of Walt, stated that replenishing funds from cold wallets to hot wallets should require separate fund management decisions and manual approvals.