thor

Salus posted on platform X, claiming that the project Revenue Family, which claims to be X Money's withdrawal bridge, involves malicious authorization. The perpetrators submitted user permit signatures to obtain unlimited USDG authorization, and then called transferFrom within the same transaction to transfer funds, with the funds flowing into two hacker addresses in an 80/20 ratio.On October 1, the project claimed that its social media account was stolen by internal reviewers, suspended exchanges, and denied that REV is the official token.

Michael Selig, the chairman of the U.S. Commodity Futures Trading Commission, stated that various regulatory agencies already possess a significant amount of existing statutory authority. While participating in the presidential working group on digital assets, they have studied statutory authorizations and legislative-level powers, and will continue to issue regulatory rules in the cryptocurrency sector based on existing regulatory powers to prepare for the development of new financial fields.

According to Scam Sniffer monitoring, a user lost LINK tokens worth $167,342 after signing a phishing authorization for Permit2 on Ethereum.The authorization was signed on August 18, 2025.

The Independent Community Bankers of America (ICBA) filed a lawsuit against the Office of the Comptroller of the Currency (OCC) in federal court on Friday, accusing it of exceeding its statutory authority when issuing national trust bank charters to cryptocurrency companies. The ICBA stated that the OCC is implementing "broad new powers not authorized by the National Bank Act," allowing these companies to enter the U.S. banking system without being subject to the same level of regulatory oversight as community banks, putting small banks at a "serious competitive disadvantage."The ICBA is one of the largest banking advocacy organizations in the United States, primarily representing small institutions. Last month, the organization strongly opposed the Digital Asset Market Structure Bill, which failed to advance in the U.S. Senate, arguing that its stablecoin provisions did not protect community banks from direct competition for deposit accounts. ICBA President and CEO Rebeca Romero Rainey stated that Congress did not establish the national trust charter to provide a "backdoor" for cryptocurrency companies seeking to enter the banking system with the credibility of a federal bank charter, as these companies do not bear the same obligations regarding capital, liquidity, regulation, and Federal Deposit Insurance Corporation (FDIC) insurance requirements. An OCC spokesperson responded to CoinDesk that the agency does not comment on ongoing litigation.Recently, the OCC has continued to issue trust charters to cryptocurrency companies, but these companies' business models differ from those of typical community banks and do not offer cash deposit accounts that require FDIC insurance. Approved institutions include cryptocurrency banks Protego and Erebor, as well as existing cryptocurrency firms like Coinbase, Circle, and Crypto.com.

THORChain announced that the ZEC liquidity pool is now live, and the network has completed a node rotation, with all nodes beginning to monitor the Zcash chain.THORChain stated that trading functionality will be the next step; currently, liquidity is shallow, and early traders should be aware of risks such as slippage. Previously, THORChain added native support for Zcash in the protocol upgrade, including UTXO handling, RPC logic, and ZEC price oracles, and continues to advance mainnet integration.

Paul Atkins, the Chairman of the U.S. Securities and Exchange Commission (SEC), stated that although the CLARITY Act was not passed by Congress, the SEC will still clarify on-chain financing rules within its statutory authority. The U.S. Senate failed to advance the CLARITY Act on September 15 with a vote of 49 to 50, not reaching the required threshold of 60 votes. Atkins has not disclosed what form the relevant guidance will take, whether it will be an exemption, a registration path, or in the form of staff guidance.The SEC previously paved the way for tokenized stocks on September 17 and released nine frequently asked questions on September 25, explaining the impact of commitments by token issuers on the determination of securities. Commissioner Hester Peirce will leave office on October 2, at which point the SEC will only have Atkins and Mark Uyeda remaining as sitting commissioners.

According to Quit monitoring, the Payment Processor V2 (PPV2) vulnerability attack is still ongoing. Even if users are not affected by the incident, as long as the relevant authorization has not been revoked, assets may still be at risk, and it is recommended to revoke the authorization immediately.About 1 hour ago, a certain address lost 0.15246 WETH in the next block after accepting a quote and receiving funds. The attacker paid 99% of it as a tip to Titan Builder, keeping only about 0.0015 ETH, which is almost impossible to recover through front-running. Quit suggests that OpenSea should check whether there are still risk authorizations before users accept quotes and require users to revoke them first; when transferring NFTs, it should also check whether the receiving address has relevant authorizations left.

NVIDIA (NVDA.O) announced an increase in the stock repurchase authorization scale by $150 billion.

The cross-chain liquidity protocol ThorChain's official announcement states that the network interruption is an emergency security mechanism aimed at protecting the protocol's security. The suspension is not a selective freeze of specific funds, nor is it a targeted exchange against individuals.The announcement mentioned that in the security incident in May 2026, 10.7 million dollars were stolen from the liquidity pool. At that time, the attacker's address was not blacklisted, so it could still trade on ThorChain. ThorChain stated that it is a permissionless blockchain platform designed with the intention of not conducting any censorship.

GoPlus Security posted on platform X that the outflow of funds from THORChain needs to be actively signed by validators through TSS threshold signatures, which is different from Bitcoin and Ethereum; approximately 101.5 BTC (about 8.5 million USD) has already been transferred from the stolen funds on Bitget, and about 27.63 million XRP (about 43 million USD) is being exchanged for BTC, calling for interception of North Korea-related addresses.

According to Blockworks data, the cross-chain liquidity protocol THORChain achieved approximately $381,700 in revenue on September 25, setting a new high since April 25.The day's exchange trading volume reached $211 million, marking the second highest since April 23, only behind approximately $280 million on September 10.

According to on-chain analyst Yu Jin's monitoring, over 90% of the funds exchanged across chains through THORChain are from illicit sources. Yu Jin stated that most of the stolen funds from Bybit last year were transferred via THORChain, which collected nearly 10 million dollars in fees within 10 days; recently, part of the stolen funds from Bitget has also been transferred through THORChain, with its fee income reaching 1 million dollars.

OKX founder Star Xu posted on X to refute that the cross-chain liquidity protocol THORChain has actually proven itself to not be truly decentralized. He stated that in May, when THORChain's own treasury was drained, the node operators paused the entire network within minutes, causing it to go offline for 13 hours.Star Xu also claimed that a network that can stop when its own funds are at risk, but refuses to stop when others' funds are at risk, does not "act like Bitcoin." He pointed out that Bitcoin cannot be stopped, while THORChain can be stopped; it simply chooses when to stop.

Slow Fog's Yuxian stated on platform X that the Bitget theft incident has a wide spread, involves a huge amount of money, and the related funds were quickly linked to North Korean hackers. Institutions such as Circle and Tether have promptly assisted in freezing the related funds, with Circle freezing the USDC held by the hackers.Regarding THORChain, Yuxian pointed out that when THORChain previously experienced a theft incident, it also quickly intervened in its so-called "decentralized" platform; however, in response to this major security incident in the industry, it claimed "decentralization and non-interference" and compared itself to Bitcoin and Ethereum, while continuing to earn fees from the hackers' large cross-chain transactions.He stated that decentralization should not just be a slogan; after a major security incident occurs, the key is to distinguish which issues need to be collectively addressed by the industry. He also believes that platforms like THORChain should not be easily compared to Bitcoin and Ethereum, as there are significant differences in the degree of decentralization and mechanisms of different systems.

MistTrack disclosed that following the $1.46 billion hacking incident at Bybit last year, where nearly $1.2 billion in stolen funds were transferred via THORChain, Bitget has recently experienced another significant security incident, with stolen funds suspected to have once again flowed through THORChain.In response, THORChain officials stated that their protocol, like Bitcoin, Ethereum, and BNB Chain, belongs to a decentralized and permissionless network.

Bitget CEO stated that the attacker's address has been publicly listed and is under continuous tracking. Bitget calls on THORChain to refuse service to these addresses. Decentralization is a design principle and should not serve as a shield to facilitate known stolen funds.

Revoke.cash stated that Limit Break's payment processor has a known vulnerability, and users who traded NFTs on the Magic Eden Ethereum marketplace may still retain relevant contract authorizations.The vulnerability has been addressed by white hat security researcher 0xQuit. Currently, NFT assets are expected to be unaffected, but users should still check and revoke affected authorizations to reduce subsequent risks.

Magic Eden announced that the vulnerability occurred in the NFT trading protocol Payment Processor V2 maintained by Limit Break. Magic Eden adopted this protocol for EVM network transaction settlements in 2024 but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026. Therefore, NFTs currently listed on Magic Eden are not affected by this vulnerability.NFTs listed through its EVM market between February and October 2024 may be affected, while listings after October 2024 are generally not impacted. The platform is contacting the protocol owner and maintainer Limit Break to explore other risk mitigation measures, including pausing protocol transfers, and will continue to investigate the actual scope of the impact.Magic Eden reminds users who have listed or traded NFTs on its EVM market to revoke relevant contract authorizations on the Ethereum, Polygon, and Base networks. Users can filter the address through revoke.cash and revoke all authorizations marked as "approved for all" for NFTs. Magic Eden emphasizes that revoking authorization cannot recover assets that have already been transferred.Yuga Labs' Vice President of Blockchain Quit stated today that at 9 AM Eastern Time, attackers exploited the Payment Processor V2 vulnerability to steal a large number of NFTs. After contacting the LimitBreak team, the latter quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain is also temporarily unable to be paused. Therefore, the team implemented a white-hat operation, successfully transferring and protecting 23,155 NFTs valued at over 5.7 million dollars.

Binance Wallet announced the launch of real-time detection and risk interception features for high-risk signature scenarios to prevent phishing attacks that exploit the authorization mechanisms of DeFi projects.Binance stated that some attacks only require inducing users to complete offline signatures that do not require gas fees, which could lead to asset theft. In the future, it will continue to expand the scope of risk identification scenarios and security protection coverage.

The Central Bank of Brazil issued resolutions No. 588 and No. 589, requiring virtual asset service providers (VASP) to report self-custody wallet transactions that amount to or exceed $10,000, and to strengthen anti-money laundering and counter-terrorism financing regulations.Resolution No. 588 stipulates that relevant transaction data will be submitted to the Financial Activities Control Council (COAF). This agency may compile transactions based on this data and establish a self-custody address database to record the asset status of Brazilian users holding cryptocurrencies through authorized centralized exchanges. Resolution No. 589 prohibits conducting business with virtual asset service institutions or entities operating in Brazil without authorization. The new regulations will take effect on October 1, 2026, and currently, only 5 VASPs have applied for licenses to operate in Brazil.