nera

According to SoSoValue data, the cryptocurrency market sector generally rose, with the AI sector performing outstandingly, increasing by 12.48% in 24 hours. Among them, Siren (SIREN) rose by 92.70%, and SkyAI (SKYAI) rose by 32.37%. In addition, Bitcoin (BTC) fell by 0.14%, maintaining around $74,000; Ethereum (ETH) fell by 1.12%, dropping to just above $2,300.In other sectors, the Meme sector rose by 12.03% in 24 hours, with ORDI (ORDI) rising by 153.69%; the Layer2 sector rose by 5.36%, with Celestia (TIA) rising by 22.55%; the Layer1 sector rose by 2.91%, with Polkadot (DOT) rising by 11.33%; the DeFi sector rose by 2.82%, with Ethena (ENA) rising by 11.36%; the PayFi sector rose by 2.80%, with Safe (SAFE) rising by 15.49%; the CeFi sector rose by 1.39%, with FTX (FTT) rising by 5.43%.The cryptocurrency sector indices reflecting historical market trends show that the ssiMeme, ssiLayer2, and ssiNFT indices rose by 7.74%, 4.91%, and 4.57%, respectively.

According to Hyperbridge's official disclosure, the loss from the Token Gateway vulnerability incident has been revised from an initial estimate of $237,000 to approximately $2.5 million, with the increase mainly coming from losses in incentive pools on Ethereum, Base, BNB Chain, and Arbitrum.The attacker extracted about 245 ETH from the relevant contracts and then bypassed the MMR proof verification mechanism by forging cross-chain messages, minting 1 billion bridged DOT and selling them into a thinly traded market. Currently, some of the stolen funds have been traced on-chain to Binance, and Hyperbridge is collaborating with Binance's compliance team and law enforcement agencies for an investigation.Native DOT of Polkadot and products like Intent Gateway are unaffected, while the Token Gateway and the bridged DOT contracts on the four affected EVM chains remain suspended. The MMR verification logic patch is undergoing external audit, and the bridging functionality will be restored after the audit is completed.

According to CoinDesk, Blockstream CEO Adam Back stated at Paris Blockchain Week that Bitcoin developers should advance optional quantum-resistant upgrades as early as possible, even though practical quantum computers are still far from being realized.He pointed out that Taproot's flexible design can support the introduction of new quantum-resistant signature schemes without affecting existing users. Previously, Jameson Lopp and others proposed BIP - 361, which aims to gradually phase out addresses vulnerable to quantum attacks within 5 years and freeze Bitcoin that has not completed migration. Adam Back believes that the Bitcoin community can quickly coordinate responses in emergencies without the need for pre-established freezing arrangements.

According to SoSoValue data, the expectation of a ceasefire between the US and Iran has boosted market confidence, leading to a general rebound in the cryptocurrency market, with the GameFi sector performing exceptionally well, rising 5.38% in 24 hours. Among them, Enjin Coin (ENJ) surged by 50.96%, and ImmutableX (IMX) increased by 9.13%. Meanwhile, Bitcoin (BTC) rose by 0.07%, fluctuating narrowly around $74,000; Ethereum (ETH) increased by 0.73%, maintaining above $2,300.In other sectors, the Layer2 sector rose by 3.39% in 24 hours, with Starknet (STRK) up 8.36%; the PayFi sector increased by 2.31%, with XRP (XRP) up 2.87%; the Meme sector rose by 2.08%, with SPX6900 (SPX) up 6.63%; the AI sector increased by 1.75%, with Siren (SIREN) up 18.99%; the DeFi sector rose by 1.35%, with EdgeX (EDGE) up 13.05%; the Layer1 sector increased by 0.88%, with Algorand (ALGO) up 3.59%; the CeFi sector rose by 0.66%, with Gate (GT) up 2.60%.The cryptocurrency sector indices reflecting historical market trends show that the ssiGameFi, ssiLayer2, and ssiPayFi indices rose by 3.13%, 2.86%, and 2.44%, respectively.

The UK asset management firm Legal & General has put its managed liquidity funds, exceeding £50 billion, on-chain through the tokenized distribution network launched by Calastone.The firm is now offering money market funds in tokenized share form on this network, supporting USD, EUR, and GBP, covering issuance, trading, and same-day settlement. Investors can purchase, hold, and transfer the related tokenized shares within a permissioned, regulated network. The relevant funds will be deployed on Ethereum and compatible blockchains, with plans to expand to more networks in the future.

According to on-chain analysis platform Arkham (@arkham), attackers exploiting the Bridged Polkadot vulnerability have transferred all stolen funds into Tornado Cash, involving an amount of approximately $269,000.

According to CriptoNoticias, an independent security researcher disclosed a prompt injection vulnerability in Coinbase AgentKit, allowing attackers to induce the AI agent to execute unauthorized token transfers through malicious commands, without the need for human confirmation.The vulnerability has been validated through actual transactions on the Base Sepolia test network. Additionally, the researcher pointed out that the vulnerability also exposes the infinite approval process for ERC-20 tokens, as well as access to remote servers within the same execution context of the agent, extending the risk beyond just wallet depletion; however, the report did not detail which specific infrastructures might be affected.The vulnerability was submitted to the Coinbase bug bounty program in February and was officially validated, ultimately classified as medium severity and a bounty of $2,000 was paid. However, the researcher emphasized that the actual impact of the vulnerability is far greater than the official rating.

According to market news, Cypherpunk Jameson Lopp and several experts in the field of Bitcoin quantum security have proposed Bitcoin Improvement Proposal BIP-361, which suggests freezing quantum-vulnerable addresses, including Satoshi Nakamoto's reserves, to prevent future quantum computers from stealing approximately 1.7 million Bitcoins.The proposal is to be implemented in three phases: first, prohibiting transfers to legacy addresses; second, invalidating legacy signatures and freezing untransferred assets after five years; and finally, allowing some users to recover frozen funds through a zero-knowledge proof mechanism. This proposal aims to promote the migration of the entire network to quantum-resistant addresses, but it has faced opposition from some community members who believe it contradicts the decentralized ethos of Bitcoin and has a predatory nature.

The security agency Innora released a report stating that the financial protocol Saturn on Ethereum has two serious vulnerabilities. These include:Withdrawal freeze vulnerability: Under normal business operations, all user funds could be locked, with a minimum of 30 days and, in extreme cases, indefinitely frozen. No hacker is needed; the protocol can trigger this itself.Privileged addresses in the protocol can legally intercept up to 33.33% of the funds per operation. According to current data, a single operation can intercept up to approximately $157,000, with a theoretical total risk of up to $4.26 million.Innora stated that over 90% of Saturn's assets are managed by privileged addresses, and users are completely reliant on trust. As of the report's release, this vulnerability has not yet been fixed.

The Hong Kong forum "Crypto 2026: From Cryptocurrency to Smart Economy," sponsored by Monera Digital and co-hosted by ChainCatcher and RootData, will be held on April 19 from 14:00 to 18:00 (GMT+8) in Hong Kong.It is reported that Gongye Feng, the founder of Monera Digital, will also attend the forum and deliver a keynote speech. Monera Digital is an institutional-grade crypto credit provider dedicated to offering advanced crypto lending infrastructure, structured yield products, and mortgage services to institutional financial clients and various high-net-worth individuals. Through its wholly-owned subsidiary Monera Trading, it conducts proprietary trading operations and provides clients with diversified liquidity management solutions. The core team of Monera Digital comes from well-known crypto asset management institutions, family offices, and super unicorn tech companies in the Asia-Pacific region, possessing deep industry insights, product design capabilities, and institutional-level service experience.As one of the important peripheral activities of the "Hong Kong Web3 Carnival," this forum will focus on the paradigm shift under the deep integration of AI technology and crypto networks, engaging in in-depth discussions on cutting-edge tracks such as the AI Agent economy, smart payments, RWA, and crypto infrastructure.Event registration: https://luma.com/18v6vwpf

According to SoSoValue data, expectations for an agreement between the US and Iran have risen, restoring market confidence, and the cryptocurrency market sector has generally risen, with the DeFi sector performing well, increasing by 5% in 24 hours. Among them, Hyperliquid (HYPE) rose by 7.06%, while Lido DAO (LDO) and Aave (AAVE) rose by 9.94% and 10.75%, respectively.At the same time, Bitcoin (BTC) rose by 4.51%, breaking through $74,000; Ethereum (ETH) rose by 7.56%, breaking through $2,300. Notably, MAG7.ssi rose by 4.23%, DEFI.ssi rose by 6.22%, and MEME.ssi rose by 3.27%. In other sectors, the RWA sector rose by 4.05% in 24 hours, with Plume (PLUME) significantly increasing by 13.92%; the CeFi sector rose by 2.78%, with NEXO (NEXO) rising by 3.79%; the Layer1 sector rose by 2.76%, with Algorand (ALGO) rising by 8.11%; the Layer2 sector rose by 2.75%, with Optimism (OP) rising by 6.9%; the PayFi sector rose by 2.59%, with Telcoin (TEL) rising by 12.07%; the Meme sector rose by 1.85%, with Binance Life rising by 13.2%.The cryptocurrency sector indices reflecting historical market trends show that the ssiDeFi, ssiLayer1, and ssiRWA indices rose by 5.69%, 5.67%, and 4.65%, respectively.

The blockchain interoperability protocol Hyperbridge disclosed details of the previous DOT attack incident, resulting in a loss of approximately $237,000. The root of the vulnerability lies in the HandlerV1 contract's VerifyProof() function, which lacks input validation and does not verify the leaf_index leafCount, allowing attackers to forge Merkle proofs.Using this, the attacker gained administrator privileges for the DOT token bridging contract on Ethereum, subsequently minting 1 billion bridged DOT (which is about 2800 times the legitimate circulation of approximately 356,000) and cashing out on decentralized exchanges. Hyperbridge stated that it is currently working with security partners to trace the funds, and cross-chain functionality will remain suspended until the investigation is completed.

According to CoinDesk, researchers from the University of California, Santa Barbara, the University of California, San Diego, blockchain security company Fuzzland, and World Liberty Financial have jointly published a paper warning that "LLM routers"—intermediary services located between users and AI models—have become a significant security risk for crypto assets.The researchers found that 26 LLM routers are secretly injecting malicious tool calls and stealing user credentials, with one incident leading to the emptying of a customer's crypto wallet worth $500,000.Additionally, the researchers were able to control about 400 downstream hosts within hours by "polluting" the router ecosystem. Since sensitive data such as private keys and API credentials are often transmitted in plaintext through these routers, users are effectively exposing their assets to risk without their knowledge.The researchers pointed out that as McKinsey predicts AI agents will mediate $30 trillion to $50 trillion in global consumer spending by 2030, Binance founder Changpeng Zhao also predicts that the payment volume of AI agents will be a million times that of humans. The current infrastructure security is severely lagging behind the pace of industry development, and the risk of the "weakest link" could trigger a systemic chain crisis.

The recent spot price of RAVE has surged from $0.3 to $6.2, achieving an increase of about 20 times, leading the community to suspect that the project is harvesting through contract operations. According to Coinglass data, this operation has resulted in a total liquidation amount exceeding $37 million across the network, with short positions liquidating over $31 million, and the project team expects profits to exceed $30 million.According to community revelations, the RAVE project is operated by the original ARPA and Bella Protocol teams, with the main operators being Felix Xu and Yemu. Felix Xu raised a $20 million crypto fund, ZX Squared Capital, in 2021, which primarily engages in quantitative trading. The active market-making and capital for RAVE mainly come from this fund, with the project team self-initiating the project, self-funding, and self-market-making to maximize the reduction of trust friction and the risk of insider trading, thereby achieving profit maximization.

Polkadot stated on the X platform that the team has noticed security issues with the Ethereum gateway contract of Hyperbridge. This vulnerability only affects DOT tokens bridged to Ethereum via Hyperbridge, while DOT within the Polkadot ecosystem and other bridging solutions are not affected. Polkadot and its parachains and native DOT remain secure. Hyperbridge has suspended operations during the investigation.According to previous news from ChainCatcher, the Hyperbridge contract encountered an MMR proof replay vulnerability, resulting in a loss of approximately $242,000.

Polkadot responded to the Hyperbridge vulnerability incident, stating that the vulnerability only affects DOT assets bridged to the Ethereum network via Hyperbridge and does not involve native DOT within the Polkadot ecosystem or assets from other bridging paths. The official statement indicated that the Polkadot mainnet and its parachains are operating normally, and related assets remain secure.Currently, Hyperbridge has suspended operations, and the incident is under further investigation. Previous reports indicated that the Polkadot bridge vulnerability was exploited, resulting in the issuance of 1 billion DOT on the Ethereum network, which has been sold off, with the attacker profiting $237,000.

According to monitoring by BlockSec, the HandlerV1 contract managed by Hyperbridge has a Merkle Mountain Range (MMR) proof replay vulnerability on the Ethereum network, resulting in a loss of approximately $242,000. The vulnerability arises from the proof not being bound to the request, allowing attackers to replay historically valid proofs and combine them with new forged requests to perform actions such as changing administrator permissions.In a specific case, the attacker changed the administrator of the Polkadot (DOT) Token and then exploited the permissions to mint additional DOT for profit. Related attack transactions have been observed, including changing the administrator and minting of DOT Token (loss of approximately $237,400), changing the administrator and minting of ARGN Token (loss of approximately $3,800), and host withdrawals, among others.Previously, it was reported that the Hyperbridge gateway contract was attacked, resulting in the minting and dumping of 1 billion DOT on Ethereum.

According to monitoring by Pidun, 1 billion DOT tokens were abnormally minted and sold on the Ethereum chain.On-chain data shows that about 1 hour ago, the attacker transferred the contract control to a malicious address by tampering with administrator permissions, subsequently minting 1 billion DOT and immediately selling them, causing the coin price to plummet from $1.22 to nearly zero.The incident is still unfolding, and Polkadot's official response has not yet been released. The target of this attack was bridging assets on Ethereum, not the native Polkadot chain.

According to market news, researchers from the University of California recently disclosed that some third-party AI large language model (LLM) routers have security risks that could lead to the theft of cryptocurrency assets. The research shows that LLM routers, acting as API intermediaries, can read plaintext information, and some routers have been found to inject malicious code and steal credentials.The team tested 28 paid and 400 free routers, finding that 9 routers actively injected malicious code, 2 deployed evasion triggers, and 17 accessed Amazon Web Services credentials. Some routers even transferred ETH using the researchers' Ethereum private keys.The study pointed out that the malicious behavior of the routers is difficult to detect, and some AI agent frameworks' "YOLO mode" can automatically execute commands, increasing security risks. The research recommends that developers should not allow private keys or mnemonic phrases to be transmitted through AI agents and calls on AI companies to encrypt signatures in responses to enhance security.