fix

The privacy public chain Zano team stated that a hotfix has been deployed in response to the inflation vulnerability that occurred last Friday, and the network is currently running stably on the updated chain. The chain previously rolled back the block height to 3,833,000, erasing the confirmed transaction records from the past 30 days.The Zano team indicated that third-party wallets, exchanges, and payment service providers must first update their nodes to the updated chain in order to safely resume transfers of ZANO and Zano issued assets. Service providers will announce recovery progress through official channels, and the recovery process for affected users is being prepared. The native asset ZANO saw a price drop of 32% this week and a decline of 40.6% since 2026. The official Zano X account stated that users can update their iOS, Android, and desktop wallets, and the team will soon announce more details on the recovery process.

Bitget stated that the vulnerabilities related to the security incident discovered on September 24 have been confirmed and fixed. The platform will gradually resume withdrawals after completing further security checks. Mandiant, a cybersecurity company under Google, and Slow Mist Technology are assisting in the investigation.The resumption schedule is as follows (UTC):September 28, 8:00: Bitcoin network BTCSeptember 29, 8:00: Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism network ETHSeptember 30, 8:00: Ethereum, BNB Smart Chain, Solana, Tron network USDTOctober 2, 8:00: Other tokens, fiat currencies, and peer-to-peer transactionsBitget mentioned that the suspension of withdrawals is a temporary security measure and is unrelated to the availability of user assets; account balances have not been affected, and the protection fund will cover the financial impact caused by this platform-level incident. The situation is currently under control, and unauthorized transfers will not occur again. Trading and deposit services are still operating normally. Users do not need to take any action in advance; the specific reopening situation will be subject to notifications from the platform and official channels.

Coinbase launches Bitcoin-collateralized fixed-rate, fixed-term USDC loans through Morpho Midnight, allowing borrowers to obtain USDC without selling their Bitcoin. The interest rate and repayment date for the product are determined at the start of the loan; if borrowers do not repay the USDC and interest before the due date, the collateralized Bitcoin may be reclaimed.The existing active or outstanding loan volume of Bitcoin-collateralized loans with floating rates supported by Morpho at Coinbase has exceeded 1.4 billion dollars, with collateral valued at approximately 3 billion dollars.

Coinbase has launched fixed-rate loans supported by the decentralized lending protocol Morpho, allowing users to collateralize Bitcoin to borrow USDC, locking in the interest rate and repayment date at the start of the loan. This product marks the first enterprise-level deployment of Morpho Midnight, with Coinbase responsible for the application experience, Morpho providing the credit infrastructure, and the Base network handling settlement.The existing active scale of Coinbase's Morpho floating-rate loans has exceeded 1.4 billion dollars, corresponding to collateral of about 3 billion dollars. This business will launch Bitcoin collateralized lending in early 2025, with plans to expand collateral to assets such as XRP and Dogecoin.

According to The Block, Coinbase announced the launch of fixed-rate Bitcoin collateralized loans through Morpho Midnight, allowing users to borrow USDC and determine the interest rate and repayment date at the time of borrowing. This new option is alongside Coinbase's existing floating-rate loans (based on Morpho Blue), which have outstanding loans exceeding $1.4 billion, corresponding to collateral of approximately $3 billion.Morpho launched Midnight on Base in July, introducing fixed rates and clear loan terms for on-chain lending. A Morpho spokesperson stated that Coinbase is the first mainstream consumer platform to offer Midnight loans on a large scale; since Midnight's launch, deposits have reached approximately $30 million. The outstanding loans for Morpho Blue across all integrations amount to $5.2 billion, with deposits reaching $16 billion.A Coinbase spokesperson did not disclose specific interest rates, stating that rates are determined by the supply and demand of both parties on the on-chain order book. Currently, Coinbase offers loans that mature at the end of the month or the end of the following month, and borrowers must repay before the due date; otherwise, lenders have the right to liquidate their collateral. Jacob Frantz, Coinbase's head of revenue and investment products, stated that Coinbase Borrow allows users to obtain liquidity without selling assets, and fixed-rate borrowing gives users greater choice in credit management. Morpho indicated that Midnight could also be used in the future to build structured credit products and loans collateralized by tokenized real-world assets, with more integrations in progress.

According to the official API data released by Kalshi, most of the dollar trading volume in the Ethereum perpetual contract trading on this exchange comes from a single recurring fixed-size order.In response, Kalshi stated that its related incentive program has been publicly filed. This data was compiled by The Defiant based on Kalshi's public API data.

Liquid Capital founder Jack Yi posted on the X platform, stating that he has repeatedly mentioned that July and August are the last times to buy the dip. The core idea is that the third wave of decline since 1011 is the final drop, and no one can determine where it will fall, influenced by factors like black swan events, similar to how the FTX incident caused BTC to drop excessively.However, the cycle time and volatility patterns will not be wrong; when the time comes, it is time to buy the dip. One should never expect to buy at the lowest price. As for why sometimes the statements are vague, after all, no one can be 100% accurate. Just like if you get it right ten times, no one remembers, but if you get it wrong once, it will always be on the chain. Also, outrageous rumors can ignite more enthusiasm than facts.

According to Slow Fog monitoring, GitLab CE/EE has a serious path traversal vulnerability CVE-2026-85706, with a CVSS score of 10. An unauthenticated attacker can read any file on the affected GitLab server through the Repository Commits API. GitLab has released a security patch.Affected versions include those from 18.7 up to but not including 19.1.8, from 19.2 up to but not including 19.2.6, and from 19.3 up to but not including 19.3.2. Self-managed GitLab users should upgrade immediately to 19.1.8, 19.2.6, or 19.3.2, and check logs and potentially exposed credentials after patching.

Electrum has released version 4.8.2, which includes multiple security fixes and enhances the security of the Bitcoin wallet codebase. The related fixes are based on reports from researchers such as Bitcoin Red Team, Calle, l0rinc, haoxucu, and m0wer.This version addresses a critical backup issue affecting some Lightning wallets that use non-deterministic keys and anchored channels. Previously, the channel backups and full wallet backups of affected wallets may have lacked the keys necessary to transfer funds on-chain after a remote force close request; affected users will receive a warning when starting Electrum and should export a new backup, as the old backup cannot correctly restore funds in this scenario.This version also strengthens Lightning HTLC verification, rejects previously acceptable format errors in xpub/xprv keys, expands the scope of codebase security enhancements, and prevents the Android QR code scanner from reading screenshots. This is the third security-focused version release of Electrum since July, following versions 4.8.0 and 4.8.1.

According to a report by Decrypt, a new report released by the Bank for International Settlements shows that advanced AI technology has shortened the time window for banks to fix vulnerabilities before attackers exploit software flaws. It warns that periodic security assessments and scheduled patch updates have increasingly become insufficient to meet the challenges, with the time window from vulnerability discovery to exploitation reduced from weeks to minutes.The report focuses on the banks' response capabilities, arguing that financial institutions must accelerate the speed of software fixes and expedite the related authorization decision-making processes.

Liquid Network has released the latest update stating that the emergency version Elements v23.3.4 is now online. Functionary nodes have immediately begun upgrading and all Liquid node operators are advised to synchronize updates. This version addresses the previously discovered Proof verification cache vulnerability and strengthens the cache keys used for Range Proof.Regarding network recovery, Blockstream states that it is still formulating a recovery plan, which is expected to proceed in three phases: restoring block production while continuing to suspend Peg operations; replaying verified valid transactions; and restoring Peg operations after the network status is fully restored and funds are confirmed to be returned. Currently, the first two phases are being tested in parallel, and any phase will only advance once safety is confirmed. Liquid Network indicates that Elements v23.3.4 has completed multiple rounds of internal and external reviews, with participants including the Bitcoin Red Team, Alpen Labs, and other teams.At the same time, Liquid Network reminds users to be vigilant against fraudulent upgrade websites exploiting this incident. Information should only be obtained through official Liquid Network and Blockstream channels, and users should never send funds to strangers or disclose private keys or recovery phrases.

According to The Defiant, the decentralized lending protocol Morpho deployed its fixed-term, fixed-rate lending agreement Midnight to Ethereum on September 8, expanding the product from the Base network to Ethereum, allowing Ethereum users to access USDC loans collateralized by WBTC or cbBTC. Morpho co-founder Merlin Egalite stated that the Ethereum launch will start with the "USDC | cbBTC and USDC | WBTC markets" and will gradually expand.The core difference between Midnight and Morpho Blue lies in interest rate certainty. Blue uses open loans where interest rates fluctuate according to a formula; Midnight, on the other hand, trades credit units at market-priced rates with fixed terms, allowing borrowers to determine financing costs in advance, and lenders can lock in returns instead of bearing interest rate changes with each block. Midnight lenders purchase credit units at prices below the one-to-one redemption value at maturity.However, the largest potential source of funds for Midnight remains constrained. The Morpho Vaults, holding approximately $5 billion in deposits, can only allocate to the Morpho Blue market until the DAO enables the Midnight configuration. Morpho co-founder and CEO Paul Frambot stated that enabling the Vault configuration requires just one DAO transaction, but Vault activation is expected to be achieved in the fourth quarter. At launch, the total deposits in the Ethereum Midnight market were approximately $7.41 million, with outstanding loans of about $2.63 million.

According to Bitcoin News, Blockstream has notified "white hat" hackers that the vulnerability has been fixed, and 4,000 BTC can be safely returned. The hacker, who previously extracted about 4,000 BTC from the Liquid network, expressed willingness to return the funds but needed to wait for the vulnerability to be fixed. The entire negotiation process was conducted publicly through Bitcoin OP_RETURN messages.The hacker initially proposed to return "most" of the BTC but later changed their stance, requesting that the vulnerability be fixed first: "Please fix the vulnerability first. The latest submitted code puts the chain at risk. Ensure that every node has been patched, and then we will confirm the fix and safely return the funds."The hacker also sent encrypted details of the vulnerability to Blockstream. About two hours ago, Blockstream responded with a PGP-signed OP_RETURN message: "The cross-chain bridge nodes have been patched and can safely return the funds." Currently, 3,998.5 BTC remains under the hacker's control.

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

Term Labs released a technical report on the security incident, confirming that all fixed-rate loan positions in the affected vault have been restored as of August 25. The incident was limited to the liquid balance within the Term vault, and Term V1 and V2 contracts were not compromised, with the direct lending market remaining open.Attack process: From August 17 to 18, the attacker funded an operational wallet through Tornado Cash and submitted a malicious proposal disguised as a governance proposal, setting the governance delay parameter to zero and removing the window for LP blocking changes. On August 23, the attacker executed two batches of attacks, extracting assets from the ETH and USDC strategies and transferring them to the attacker's wallet. Term Labs stated that it has cooperated with law enforcement, the affected vault and strategies have been closed, and the contracts have been upgraded and migrated before expiration.

Nomura Securities' digital asset subsidiary Laser Digital announced a partnership with Keyring Network to serve as the risk governance entity for the institutional lending market, with the first market set to launch on Euler Finance. The parties did not disclose committed capital, fee terms, or launch dates.According to the cooperation framework, Keyring provides infrastructure and tools, including access verification, quantitative risk parameter setting, and clearing framework design; Laser Digital's asset management department contributes governance standards, portfolio structure, and market practices. Both parties pointed out that institutional participation in DeFi lending faces four major obstacles: licensing, vulnerability risks, governance, and settlement. The solution combines zero-knowledge licensing, quantitative risk modeling, network insurance, and Keyring's settlement technology.According to DefiLlama data, Euler has a total value locked of $368.8 million across 17 chains, with outstanding loans of $555.4 million. Laser Digital previously supported ZIGChain's emerging market private credit in August, while Keyring introduced a zero-knowledge identity layer for the DeFi vault on Avalanche in August 2025. Nomura established Laser Digital in 2022, with operational headquarters in Dubai and Switzerland.

According to CoinDesk, U.S. Treasury Secretary Yellen has reportedly urged Japan to raise interest rates to curb the continuous depreciation of the yen, highlighting how traditional monetary policy is susceptible to government and external factors.In contrast, Bitcoin's monetary policy is pre-set by code, with new coin issuance following a fixed rhythm and halving approximately every four years, providing higher predictability. However, Bitcoin still struggles to escape the impacts of traditional financial markets in the short term.If Japan's interest rate hike leads to a rapid appreciation of the yen, long-accumulated low-interest yen financing trades may be closed out, potentially triggering sell-offs in stocks, bonds, and crypto assets. In August 2024, the Bank of Japan's interest rate hike strengthened the yen and put pressure on risk assets, including Bitcoin.From a technical perspective, the BTC 50-day moving average is currently trending upward and is close to crossing above the 200-day moving average, which may form a "golden cross." However, analysts believe that moving averages have a lagging nature, and the historical predictive effectiveness of the golden cross as an independent indicator is not stable.

Polygon Labs disclosed that it has fixed a batch of security vulnerabilities in its proof-of-stake network through two hard forks, with the related fixes privately deployed before public disclosure. According to a forum post released on Wednesday, the team packaged the fixes into the Austin hard fork of the Bor client and the Kyoto hard fork of the Heimdall client, both of which followed the standard process for fixing issues that affect consensus: first validated on the Amoy testnet, and then publicly disclosed once the mainnet was activated and the network was secure.The Austin fork fixed two denial-of-service paths in block processing, including a vulnerability where malicious block producers could crash peer nodes by filling them with oversized field data. The Kyoto fork addressed a broader range of consensus hardening issues, with the most severe vulnerability allowing an attacker to force the entire validator set to perform costly and coordinated work with just one crafted transaction—the cost of constructing the transaction is low, but the network processing cost is high. Polygon emphasized that none of the vulnerabilities were observed to be exploited on the mainnet and have been proactively addressed. The two upgrades are now mandatory for node operators and have taken effect without the need for state migration or resynchronization.This disclosure comes at a critical transformation period for Polygon, which has completed the migration of the traditional MATIC token to POL as part of a comprehensive overhaul of its network architecture. The news did not boost the price of POL; according to CoinGecko data, POL traded at approximately $0.09983 on Sunday, down 2.3% in 24 hours, down about 6.8% over the past week, and down about 60.8% over the past year, with a market capitalization of approximately $1.07 billion.

Polygon disclosed multiple previously undisclosed security vulnerabilities recently fixed through two hard forks, Austin and Kyoto, which could affect its proof-of-stake network. The vulnerabilities involve Polygon's Bor and Heimdall clients, including denial-of-service risks, validator resource exhaustion, and defects affecting checkpoint and milestone processing.Polygon stated that the fixes were privately tested before being deployed to the mainnet and publicly disclosed. The most severe issue involved Heimdall, where carefully crafted transactions could force validators to perform excessive processing work, disrupting the network. The Austin hard fork also fixed two denial-of-service risks in Bor that could slow down block processing or cause node crashes. Polygon indicated that these vulnerabilities were not exploited on the mainnet, and the fixes were proactively completed before the details of the vulnerabilities were made public.