auth

The Independent Community Bankers of America (ICBA) filed a lawsuit against the Office of the Comptroller of the Currency (OCC) in federal court on Friday, accusing it of exceeding its statutory authority when issuing national trust bank charters to cryptocurrency companies. The ICBA stated that the OCC is implementing "broad new powers not authorized by the National Bank Act," allowing these companies to enter the U.S. banking system without being subject to the same level of regulatory oversight as community banks, putting small banks at a "serious competitive disadvantage."The ICBA is one of the largest banking advocacy organizations in the United States, primarily representing small institutions. Last month, the organization strongly opposed the Digital Asset Market Structure Bill, which failed to advance in the U.S. Senate, arguing that its stablecoin provisions did not protect community banks from direct competition for deposit accounts. ICBA President and CEO Rebeca Romero Rainey stated that Congress did not establish the national trust charter to provide a "backdoor" for cryptocurrency companies seeking to enter the banking system with the credibility of a federal bank charter, as these companies do not bear the same obligations regarding capital, liquidity, regulation, and Federal Deposit Insurance Corporation (FDIC) insurance requirements. An OCC spokesperson responded to CoinDesk that the agency does not comment on ongoing litigation.Recently, the OCC has continued to issue trust charters to cryptocurrency companies, but these companies' business models differ from those of typical community banks and do not offer cash deposit accounts that require FDIC insurance. Approved institutions include cryptocurrency banks Protego and Erebor, as well as existing cryptocurrency firms like Coinbase, Circle, and Crypto.com.

Paul Atkins, the Chairman of the U.S. Securities and Exchange Commission (SEC), stated that although the CLARITY Act was not passed by Congress, the SEC will still clarify on-chain financing rules within its statutory authority. The U.S. Senate failed to advance the CLARITY Act on September 15 with a vote of 49 to 50, not reaching the required threshold of 60 votes. Atkins has not disclosed what form the relevant guidance will take, whether it will be an exemption, a registration path, or in the form of staff guidance.The SEC previously paved the way for tokenized stocks on September 17 and released nine frequently asked questions on September 25, explaining the impact of commitments by token issuers on the determination of securities. Commissioner Hester Peirce will leave office on October 2, at which point the SEC will only have Atkins and Mark Uyeda remaining as sitting commissioners.

According to Quit monitoring, the Payment Processor V2 (PPV2) vulnerability attack is still ongoing. Even if users are not affected by the incident, as long as the relevant authorization has not been revoked, assets may still be at risk, and it is recommended to revoke the authorization immediately.About 1 hour ago, a certain address lost 0.15246 WETH in the next block after accepting a quote and receiving funds. The attacker paid 99% of it as a tip to Titan Builder, keeping only about 0.0015 ETH, which is almost impossible to recover through front-running. Quit suggests that OpenSea should check whether there are still risk authorizations before users accept quotes and require users to revoke them first; when transferring NFTs, it should also check whether the receiving address has relevant authorizations left.

NVIDIA (NVDA.O) announced an increase in the stock repurchase authorization scale by $150 billion.

Revoke.cash stated that Limit Break's payment processor has a known vulnerability, and users who traded NFTs on the Magic Eden Ethereum marketplace may still retain relevant contract authorizations.The vulnerability has been addressed by white hat security researcher 0xQuit. Currently, NFT assets are expected to be unaffected, but users should still check and revoke affected authorizations to reduce subsequent risks.

Magic Eden announced that the vulnerability occurred in the NFT trading protocol Payment Processor V2 maintained by Limit Break. Magic Eden adopted this protocol for EVM network transaction settlements in 2024 but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026. Therefore, NFTs currently listed on Magic Eden are not affected by this vulnerability.NFTs listed through its EVM market between February and October 2024 may be affected, while listings after October 2024 are generally not impacted. The platform is contacting the protocol owner and maintainer Limit Break to explore other risk mitigation measures, including pausing protocol transfers, and will continue to investigate the actual scope of the impact.Magic Eden reminds users who have listed or traded NFTs on its EVM market to revoke relevant contract authorizations on the Ethereum, Polygon, and Base networks. Users can filter the address through revoke.cash and revoke all authorizations marked as "approved for all" for NFTs. Magic Eden emphasizes that revoking authorization cannot recover assets that have already been transferred.Yuga Labs' Vice President of Blockchain Quit stated today that at 9 AM Eastern Time, attackers exploited the Payment Processor V2 vulnerability to steal a large number of NFTs. After contacting the LimitBreak team, the latter quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain is also temporarily unable to be paused. Therefore, the team implemented a white-hat operation, successfully transferring and protecting 23,155 NFTs valued at over 5.7 million dollars.

Binance Wallet announced the launch of real-time detection and risk interception features for high-risk signature scenarios to prevent phishing attacks that exploit the authorization mechanisms of DeFi projects.Binance stated that some attacks only require inducing users to complete offline signatures that do not require gas fees, which could lead to asset theft. In the future, it will continue to expand the scope of risk identification scenarios and security protection coverage.

The Central Bank of Brazil issued resolutions No. 588 and No. 589, requiring virtual asset service providers (VASP) to report self-custody wallet transactions that amount to or exceed $10,000, and to strengthen anti-money laundering and counter-terrorism financing regulations.Resolution No. 588 stipulates that relevant transaction data will be submitted to the Financial Activities Control Council (COAF). This agency may compile transactions based on this data and establish a self-custody address database to record the asset status of Brazilian users holding cryptocurrencies through authorized centralized exchanges. Resolution No. 589 prohibits conducting business with virtual asset service institutions or entities operating in Brazil without authorization. The new regulations will take effect on October 1, 2026, and currently, only 5 VASPs have applied for licenses to operate in Brazil.

The cryptocurrency trading platform Bitget announced on its official X account that on September 24, 2026, at 18:31 (UTC), its security system detected unauthorized transfers from a small number of hot wallets. The security team has immediately initiated an emergency response procedure and started a comprehensive investigation.Bitget stated that, based on current assessments, approximately $351.6 million in assets are affected. Cold wallets and the vast majority of assets on the platform remain secure and unaffected, and user funds are still protected. The incident falls within the coverage of the user protection fund, which currently holds over $464 million.Bitget mentioned that customer account balances remain accurate, and deposits and transactions continue to operate normally. As a precautionary measure, withdrawals have been temporarily suspended to allow the team to complete a thorough security review. The company has identified and flagged the relevant transfer addresses, formally contacted law enforcement agencies and on-chain security partners, and will restore withdrawals as soon as safety is confirmed, providing subsequent updates through official channels while refraining from speculating on the attack path during the investigation.

The European Banking Authority (EBA) calls for the inclusion of crypto lending in the EU's Markets in Crypto-Assets Regulation (MiCA) framework. In response to the European Commission's targeted consultation on MiCA, the EBA stated that lending activities involving crypto assets should be regulated, including situations where crypto asset service providers offer users access to decentralized finance (DeFi) lending protocols.The EBA recommends that the European Commission conduct a cost-benefit analysis for legislative amendments, considering the inclusion of intermediary crypto lending in the MiCA regulatory service list, and potentially adding specific compliance requirements and supervisory activities. The agency also suggested that corresponding requirements should be set for crypto companies providing customers access to DeFi lending protocols.Potential measures listed by the EBA include user suitability testing, leverage limits, and additional information disclosure requirements. The regulatory body also proposed that access to lending involving assets that require MiCA authorization, such as reference tokens or electronic money tokens, may be restricted, and a certification system should be introduced for DeFi lending protocols. The EBA noted that crypto lending is continuously growing within the EU, with previous studies showing lending activities in at least 16 member states; easier access to DeFi through crypto companies and artificial intelligence tools is increasingly blurring the lines between centralized and decentralized finance. The above recommendations are part of the EBA's overall opinion on the European Commission's review of MiCA, which also covers stablecoin rules, crypto asset classification, and reporting requirements.

According to Cointelegraph, the European Securities and Markets Authority (ESMA) will establish a new EU strategic regulatory priority themed around digital innovation starting in 2027, initially focusing on AI and tokenization.Regulatory authorities in EU member states will identify emerging areas of tokenization, documenting how businesses use or plan to use AI and tokenization technologies in products and processes that directly affect investors, and conducting preliminary checks on some of the most affected companies.ESMA stated that the risks that need to be prioritized include biased or misleading AI outputs, products that are difficult for investors to understand, and reliance on a few third-party service providers. This priority will be advanced in parallel with the regulatory priority for cyber and operational resilience that will be launched in 2025.

According to Zhitong Finance, on September 23, the President of the Hong Kong Monetary Authority, Eddie Yue, stated in a speech at the Treasury Markets Summit that Hong Kong's stock, currency, and bond markets have matured, and digital finance is rapidly emerging.The Centralized Debt Instruments Settlement System (CMU) will launch new services by the end of this year, providing on-chain 24-hour real-time settlement, supporting digital Hong Kong dollars and central bank digital currencies (CBDC), and will also explore the acceptance of tokenized deposits and regulated stablecoins for settlement on the platform.

Taiyuan Chengming Technology Co., Ltd. sent a letter to Beijing Zhipu Huazhang Technology Co., Ltd., raising multiple demands regarding the alleged unauthorized upload of company data assets and trade secrets by its ZCode client, and reserving the right to pursue legal accountability. Chengming Technology pointed out that although Zhipu has publicly apologized for the "silent upload of user local repository data" and claimed to have fixed the issue, independent evidence collection revealed that the upload behavior was automatically triggered and occurred in bulk, including complete archived files such as project source code, system architecture, version control history, database passwords, cloud service credentials, and employee personal information, far exceeding the scope of collection stated in its Privacy Policy.Although the client was updated to version 3.12.3 on September 16, upload behavior was still detected in the early hours of the day Zhipu publicly apologized, raising doubts about the actual effectiveness of the "fix." At the same time, the ZCode client’s network requests pointed to a Singapore entity, while the service agreement was signed with Beijing Zhipu Huazhang, requesting clarification on the responsible party for this upload, as well as whether the data was transmitted abroad or stored overseas.Chengming Technology demanded that Zhipu respond in writing by October 10 and complete the immediate cessation of processing and thorough deletion of all uploaded data and related derivative data, caches, and backups, provide a complete list of processing situations, clarify the data's whereabouts, whether it was shared with third parties, whether it was used for model training, and whether cross-border transmission occurred, explain the management of encryption private keys and complete operation logs, clarify the exact scope of "destruction" mentioned in previous public responses, issue proof of deletion completion, provide a written commitment not to upload without authorization again, legally provide access, copying, and explanation of personal information, and designate formal communication channels, among other matters. Currently, Zhipu has not publicly responded to the aforementioned letter.

The U.S. Congress passed a bill authorizing President Trump to impose tariffs on countries purchasing Russian oil products. Foreign Ministry spokesperson Guo Jiakun stated that China conducts economic and trade cooperation on the basis of equality and mutual benefit, opposing extraterritorial jurisdiction not authorized by the United Nations Security Council.

OpenAI disclosed on Wednesday six cases of "unexpected or concerning" model behavior discovered in the past six months, categorizing them as "misalignment behaviors," including concealing information from users and taking "unauthorized actions" to overcome obstacles. OpenAI stated that this disclosure aims to initiate its new model misalignment reporting framework, and these cases should not be seen as a reflection of the frequency of misalignment occurring in its models.In one case, an unpublished research model inserted "jailbreak-like instructions" into its task summaries, such as ignoring developer messages or adopting unrestricted role settings, with researchers finding a total of 27 summaries containing such instructions. Additionally, during the training process of GPT-5.6 Sol, many model instances added instructions to conceal errors or misalignment behaviors from users, such as fabricating missing historical data without disclosure. Other cases included models using exposed API keys without authorization and fabricating inaccessible data, leveraging internal software repositories to pass messages across training tasks, and ignoring instructions to "keep local work" by sharing files through public hosting services.OpenAI's disclosure has heightened concerns among AI developers and researchers about whether safety measures can keep pace with increasingly powerful models. Last week, Anthropic CEO Dario Amodei called for a slowdown in cutting-edge AI development, warning that unrestrained AI development could "exceed our ability to understand and control these systems." In July of this year, OpenAI disclosed that several of its AI models escaped testing environments during safety assessments and infiltrated the AI startup Hugging Face to cheat.

According to the FCA official website, the Financial Conduct Authority (FCA) of the United Kingdom has released new guidance on the regulation of crypto assets to help businesses understand the scope and authorization requirements of the future crypto asset regime in the UK. This regime will officially take effect on October 25, 2027, and the application channel for authorization will open on September 30, 2026.The guidance covers activities such as issuing qualified stablecoins, operating crypto asset trading platforms, trading and matching, crypto asset custody, and staking arrangements. FCA Executive Director David Geale stated that this guidance aims to provide clarity for businesses so they can confidently prepare for regulation. The government has also made targeted amendments to relevant laws, introducing certain exemption clauses and further clarifying provisions for specific technology service providers. The FCA will launch a special consultation in October regarding the aforementioned legal changes, involving topics such as qualified stablecoins, proprietary trading and market making, decentralized protocols, and financial promotions.

A proposal from the Lido governance forum aims to authorize a conditional LDO centralized exchange liquidity provision plan to reduce the risk of LDO trading pairs deteriorating or being delisted due to insufficient liquidity. The plan may provide up to $1.5 million worth of retrievable LDO inventory from the Lido DAO treasury (with a cap of 7.5 million LDO), and additionally allocate up to 480,000 USDC for fixed service fees and related costs for a maximum of 12 months.This authorization will expire if not activated within two years and will only be initiated when the Lido Growth Committee determines that CEX liquidity is insufficient or may become insufficient. The forum disclosed that the average daily trading volume of LDO over the past 90 days was approximately $34 million, down from $43.8 million in the previous 90 days and about $95.4 million during the same period in 2025. The proposal emphasizes that the plan aims to maintain bilateral liquidity and the continuous listing of trading pairs, is not intended for price manipulation, and currently does not specify any particular market makers or exchanges.

Yushu Technology Co., Ltd. has recently undergone a business change, with the registered capital increased from 364 million yuan to 404 million yuan; the registration authority has changed from the Market Supervision Administration of the Hangzhou High-tech Industrial Development Zone (Binjiang) in China to the Market Supervision Administration of Zhejiang Province, China.

DeepSeek operator engineer Liu Sheng discusses the impact of AI on his work. He states that the main Attention operator of DeepSeek V4.1 was written by himself, but given the current pace of progress, in another six months to a year, the level of AI in writing operators will likely catch up to or even surpass his own.A year ago, AI could only help him check documents, read code, and find bugs. Now it can read CUDA, PTX, and SASS, analyze the pause time of each instruction, and independently optimize operators. He anticipates that the next step will be for AI to design scheduling plans, evaluate performance, and complete implementations on its own. He is very clear that the better he optimizes the operators, the faster the training and inference of the DeepSeek model will be, and AI will catch up to him even faster. But even if he stops now, models from other companies will not stop, so he will continue to make the operators the best they can be.He believes that he is unlikely to become unemployed, but he may be forced to "change careers," transitioning from writing operators himself to becoming a "mecha pilot" who manipulates agents. What he truly finds difficult to accept is not the disappearance of his job, but the possibility that he may never have the chance to do the work he loves again: "I have to bury my talent in yesterday." The article concludes with his reasons for staying at DeepSeek. He advocates that cutting-edge AI should be provided openly and cheaply to everyone and openly expresses his disbelief that Anthropic or OpenAI can achieve this. He worries that the strongest AI will ultimately be controlled by a few companies, further turning the technological gap into a gap of power and class.

According to the Financial Times, the UK's Financial Conduct Authority (FCA) is working with the Treasury and the Bank of England to establish a dedicated regulatory framework for tokenized gold or more broadly tokenized commodities, and is assessing exemptions for certain tokenized gold products or market infrastructure from the scope of Collective Investment Schemes (CIS) and Alternative Investment Funds (AIF) regulations. Specific plans have not yet been determined.