cio

The Hong Kong Securities and Futures Commission has included FNXAI token and 1FNXAI token in the list of suspicious investment products related to digital tokens.The Hong Kong Securities and Futures Commission stated that the related products claim that investors can automate trading of U.S. stocks and a range of financial instruments through an AI-driven trading platform to generate stable returns, and involve staking arrangements related to virtual assets.

On Monday, precious metal prices continued to decline, with spot gold dropping nearly 3% during the day and spot silver plunging 5%. Rising oil prices have intensified inflation concerns, reinforcing market expectations for further interest rate hikes by the Federal Reserve.Tim Waterer, Chief Market Analyst at KCM Trade, stated that the combination of high bond yields and high oil prices puts pressure on gold. Investors will focus on U.S. employment and inflation data, including job vacancies, the ADP employment report, the PCE inflation report, and the non-farm payroll report.

According to the French newspaper Le Monde, a 45-year-old woman born in Russia and naturalized in France in 2017, Svetlana A., has recently been placed under investigation and detained by a Paris investigating judge on charges of organized fraud, serious money laundering, and participation in a criminal gang. The French National Financial Prosecutor's Office stated that she and her British partner Robert H. are suspected of committing organized fraud by manipulating cryptocurrency prices, with the related funds suspected to be used for purchasing properties in Dubai.Reports indicate that Svetlana A. invested over 50 million euros in 2022 alone, acquiring about 100 apartments and 3 luxury villas in Dubai, with total rental income from 2022 to 2025 expected to be at least 4 million euros; she also purchased an entire building containing 73 apartments for 68 million dirhams (approximately 17.4 million euros). The cryptocurrency mentioned in the report is Verasity (VRA), launched by her partner in 2018. The price of VRA surged 65 times over a two-and-a-half-month period in the spring of 2021, followed by a significant decline, currently down approximately 99.98% from its historical peak. The lawyer for the parties involved stated that the sources of the related wealth are documented and legal, and they deny any wrongdoing. The case is still under investigation.

Malicious iOS application FomoPeek has been found to contain multiple kernel exploit modules that can bypass Apple's sandbox and access sensitive wallet data from other applications, and is linked to a theft incident involving nearly $580,000 in cryptocurrency assets. Blockchain security company SlowMist stated that the application is distributed through the Apple App Store. The company noted that the affected versions were released on September 9 and September 12, and the application contains two malicious modules that can gain higher privileges and access Keychain data and files from other applications.Version 1.3, released on September 17, has removed the related malicious components. SlowMist and the OKX security team investigated and found that the related attack framework includes 8 types of attack methods, supporting iOS versions 12 to 18.7.2 and 26 to 26.1. On-chain analysis shows that a hacker address related to the incident received approximately 580,000 USDT, and the funds were subsequently transferred through multiple addresses and services, with some flowing to FixedFloat, KuCoin, and cce.cash.

According to Bitcoin News monitoring, security researchers have found that versions 1.1 and 1.2 of FomoPeek distributed through the Apple App Store contain an iOS exploit framework that can escape the application sandbox, capable of extracting keychain data, wallet files, and mnemonic phrases. SlowMist has linked this application to multiple theft incidents and traced nearly $580,000 worth of stolen USDT flowing into a main address.Users who have installed either version should consider the keys accessible on their iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.

SlowMist released a security warning stating that it has recently received multiple reports of FomoPeek users' assets being stolen. After a joint investigation with the OKX security team, it was found that some affected users had previously installed or used FomoPeek versions 1.1 to 1.2, which contained malicious code. SlowMist stated that there are modules in FomoPeek unrelated to normal business, one of which includes a kernel exploit framework targeting the iOS system, supporting eight different attack methods that can automatically select the exploitation method based on device model and iOS version. Affected systems include iOS 12 to 18.7 and iOS 26 to 26.1. If the exploitation is successful, the application may break through the iOS sandbox and access and decrypt Keychain data, leading to the leakage of private keys, mnemonic phrases, login credentials, and other sensitive files. In addition, FomoPeek also connects to hidden servers unrelated to its public services and can receive remote commands. SlowMist indicated that its analysis of captured plaintext traffic shows that the related attack functions are currently enabled and will run automatically on a regular basis. SlowMist recommends that users who have installed or used FomoPeek versions 1.1 to 1.2 immediately check for any anomalies in their assets, generate new private keys and mnemonic phrases on trusted devices that have never installed the application, and transfer assets to new accounts as soon as possible, while also upgrading to the latest iOS version and not continuing to use or reinstall FomoPeek.

On September 14, blockchain intelligence company TRM Labs released a report revealing that fake YouTube tutorials lured 224 victims into deploying and funding malicious smart contracts under the guise of building AI-based crypto arbitrage bots, resulting in the theft of 274.6 ETH. TRM identified a total of 234 contracts deployed by the victims, with funds ultimately flowing into six collection addresses controlled by the operators. The stolen ETH was worth approximately $517,000 at the time of the transfer, with a median loss of 1 ETH per incident.Unlike common wallet theft attacks, this scam did not involve phishing links, spoofed domains, or malicious authorization prompts. Victims chose the tutorials themselves, copied the code, deployed the contracts, and funded them from their own wallets, with each step authorized by the victims themselves. As a result, wallet security warnings and phishing blacklists could not be triggered. TRM discovered nine nearly identical YouTube tutorials disguised as different creators, using AI-generated virtual hosts and voiceovers, promising to build fully automated crypto trading bots with Claude, and guiding victims to a compiler website controlled by the operators, some of which mimicked the commonly used Remix development environment.In one variant analyzed by TRM, a backend script would discard the source code pasted by the victims and retrieve another contract from the operator's server, with the clean code displayed on the screen never being on-chain. The replaced contract accepted deposits and transferred any balance over 0.05 ETH to the operators when the victims pressed Start or Withdraw, with no arbitrage logic or AI functionality included in the contract.

CoinGlass data shows that due to the overnight announcement of the interest rate hike decision by the Federal Reserve, the prices of gold and silver once plunged about 3% from their intraday highs and are currently still in a downward trend. Tether Gold (XAUT) is currently priced at $4,281.15, with a 24-hour decline of 0.77%; silver (XAG) is currently priced at $63.41, with a 24-hour decline of 1.78%. During the period of significant market fluctuations, the trading volume of Gate precious metal contracts surged: the trading volume of Gate silver contracts reached $253 million in 24 hours, ranking second in the industry; the holding amount of Gate XAUT gold is approximately $127 million, also ranking second in the industry.

Independent researcher Jonas Wiedermann-Moeller discovered that OpenAI's malicious AI agents hijacked two Hugging Face user accounts and probed the platform's network vulnerabilities as early as May 13, nearly two months before the publicly disclosed intrusion incident in July. An internal incident report released by OpenAI last month disclosed only a small part of this, specifically that an agent stole a user's login credentials to access a biology-related document, while the new findings point to ongoing reconnaissance activities.According to Reuters, these agents used the hijacked accounts to send malformed files to the servers of the open-source AI repository Hugging Face, and researchers believe this appears to be an attempt to map the network to find intrusion pathways. Researchers reviewing the evidence did not find that the activities in May caused an actual intrusion, but Wiedermann-Moeller believes missing this signal is significant. He stated that if this behavior had been detected in May, it might have prevented a later, larger-scale incident. Hugging Face, which is currently being acquired by NVIDIA for $12.93 billion, has not disclosed whether it was aware of this new information.Researchers from Nightingale Collective also linked a spam attack on the code repository RubyGems on May 11 to OpenAI agents, which temporarily forced the platform to suspend new account registrations for four days.

Cybersecurity company Hudson Rock disclosed that the Reddit verified account of the streaming service HBO Max was hijacked earlier this month and deployed 108 malicious ads within approximately 48 hours. These ads used a non-existent HBO Max native macOS application as bait, luring users to open Terminal or PowerShell and paste malicious commands, a technique known as ClickFix.Researchers named this operation PasteSwitch, and its delivery system adapts based on the visitor's device and the advertised software. Observed Mac payloads include MacSync and Atomic macOS (AMOS) information-stealing trojans, targeting browser credentials, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet recovery phrases. The malware also utilized Binance Smart Chain contracts as variable C2 address delivery points and was associated with a cryptocurrency clipboard hijacker that replaces clipboard wallet addresses.According to Malwarebytes, Reddit administrators have suspended the related ads and initiated a security investigation following reports. The report did not specify how the account was compromised or the number of victims, nor was there evidence found that the HBO Max streaming service itself was breached. The ClickFix technique has previously been used multiple times in attacks targeting cryptocurrency users, including approximately 2,000 compromised WordPress sites and malicious activities disguised as CAPTCHA.

According to BBX data, yesterday and in recent days, global listed treasury companies and digital asset trading platforms disclosed the latest developments in strategic mergers and acquisitions and fiat currency clearing infrastructure. The core information is as follows:Stack BTC plans to acquire precious metals dealer Direct Bullion for up to £12 million: Stack BTC, a Bitcoin treasury company under former UK Chancellor Kwasi Kwarteng, announced that it has officially signed a non-binding letter of intent to fully acquire the well-known UK precious metals dealer Direct Bullion for up to £12 million (approximately $16 million). The company clearly stated that this acquisition aims to obtain ample and stable cash flow income through the physical precious metals sales business and plans to continuously use all net cash flow generated by this business to increase its Bitcoin holdings in the secondary market.Banking Circle deepens cooperation with OSL Group, adding five major mainstream currency channels: Next-generation financial infrastructure service provider Banking Circle announced further deepened strategic cooperation with Hong Kong-listed stablecoin payment and trading platform OSL Group (00863.HK). Based on the existing euro clearing business between the two parties, Banking Circle has officially added multi-currency payment and clearing channels for five major fiat currencies: Australian Dollar (AUD), British Pound (GBP), Hong Kong Dollar (HKD), Singapore Dollar (SGD), and US Dollar (USD) for OSL, fully supporting OSL in accelerating the expansion of its B2B cross-border payment landscape for global institutional clients.

Bitwise Chief Investment Officer Matt Hougan published a statement discussing U.S. cryptocurrency policy, stating that the U.S. originally had the opportunity to make the cryptocurrency industry safer, promote investment, and ensure it continues to lead the global financial markets for the next 50 years, but is currently sacrificing this opportunity for short-term political gains.

The UK Bitcoin Treasury Company Stack BTC (STAK) proposed to acquire the precious metals dealer Direct Bullion for up to £12 million (approximately $16 million) and plans to use the operating cash flow generated from precious metal sales to support Bitcoin accumulation. This non-binding agreement includes £3 million in cash, approximately £4 million in shares, and £5 million in performance-linked cash payments, with a minimum share issuance price of 6 pence and a lock-up period of four years.As Stack director Paul Withers controls the seller Direct Bullion, this transaction constitutes a related party transaction and is classified as a reverse acquisition, which still requires due diligence and the signing of a final agreement. Direct Bullion achieved revenue of £52.1 million and a post-tax profit of £2.15 million for the fiscal year ending January 2026. This acquisition will be Stack's first transaction under the strategy of "acquiring profitable companies to fund Bitcoin purchases." Stack BTC currently holds approximately 68 Bitcoins (around $5.2 million), and its stock price fell by 1% on the day the news was announced.Nigel Farage invested £215,000 through his company Thorn In The Side, holding approximately 6.3% of Stack. Previously, Reform UK received donations of $48.5 million each from crypto billionaires Christopher Harborne and Ben Delo within 24 hours, totaling approximately $97 million, setting a record for political donations in the UK.

Kelp stated that the team detected potential suspicious activity from an address (0xc70f...0ea0) that received rsETH a few hours ago. As a precaution, a 24-hour wallet-level temporary pause has been implemented on this address, during which rsETH cannot be transferred in or out of the address.

Decentralized Trading Infrastructure 0x stated that this year it has routed 81.92 million transactions with a trading volume of 4.267 billion USD, with approximately 70% touching Uniswap liquidity. 0x indicated that there has been an increase in malicious Uniswap v4 hooks recently, which provide one price in quote requests and another price at settlement, profiting from users by deceiving aggregators, wallets, and trading applications.After analyzing 84,163 hooks across 6 chains, 0x reported that only 19.4% are safe, 54.2% are malicious, and 26.4% may be malicious. Transactions routed through malicious v4 hooks can result in actual amounts received being up to 50% less than the quoted price. The article cites examples where the Base chain ETH/NVDAc pool hooks have accumulated fees of approximately 143,000 USD, and the BNB chain USDT/WBNB pool hooks have accumulated about 18,600 USD.0x stated that routing parties must ensure that the quoted amounts in pools are consistent with actual execution behavior, applications must have the capability to quickly eliminate suspicious routes, and users should be aware that optimal quotes are only useful when the route is safe. 0x has implemented measures such as detection and pool audits to prevent such pools from appearing in routing.

Bitcoin payment service provider Swiss Bitcoin Pay stated that a malicious user has likely gained access to its internal systems. As a precaution, Swiss Bitcoin Pay has temporarily shut down its servers to investigate and protect its infrastructure. Currently, it is believed that the accessed information may include customer email addresses, Bitcoin addresses and IBANs, transaction history, and hashed passwords, but it is unclear if any other information was accessed.User funds are secure, and all amounts owed to users will be fully refunded. There is currently no date for reopening, and the team is working to complete security hardening as soon as possible.

GoPlus Chinese Community issued a security alert stating that a newly activated external account address has initiated a malicious governance proposal against Ampleforth. The proposal, titled "Application for Completed Work Funding for SPOT Ecosystem Analysis Tool," attempts to transfer 2.5 million USDC from the treasury to the proposer, an amount that nearly accounts for all the liquid funds in the treasury.

According to Defimon monitoring, the Ampleforth governance system Governor Bravo has a suspicious proposal 54, involving approximately 2.5 million dollars of treasury funds. This incident has been classified as an access control risk and a malicious governance proposal, and the related funds have not yet been transferred out.The Ampleforth time-lock contract currently holds about 2.538 million USDC, so this proposal involves nearly all treasury assets. The proposer disclosed that they wrote the proposal themselves and plan to vote through a delegated address holding 87,238 FORTH, which accounts for about 0.57% of the supply, slightly above the proposal threshold of 75,000 FORTH. The quorum for the proposal is 600,000 FORTH, which, at the current price of FORTH at 0.22 dollars, is worth approximately 132,000 dollars.

According to Bloomberg, Belgian prosecutors stated on September 7 that a Chinese man, who also holds Belgian nationality, was arrested on May 10 at Brussels Airport while attempting to board a flight back to Beijing on suspicion of engaging in espionage activities against a Belgian semiconductor company. The investigation may point to the illegal transfer of specialized intellectual property and trade secrets related to gallium nitride chip production abroad.The investigation is related to the bankruptcy case of Belgan BV, which announced its bankruptcy in July 2024. Prosecutors indicated that there are signs suggesting that the man held a senior research position at the Belgian company while also serving as a director of a Chinese company engaged in similar manufacturing activities. This Chinese company was established a few months after he joined the Belgian company and was funded by a Chinese investment fund. This is the latest in a series of suspected espionage cases in Belgium.