Brazil’s largest crypto exchange halted all customer deposits and withdrawals on Monday, hours after wallets it operates sent more than $40 million in digital assets to attacker-controlled addresses across at least 10 blockchains.

“We identified and quickly contained a security incident in one of our systems early this morning,” the exchange said in a statement on X, where it also said no customer lost money and no data leaked. It paused the payment rails as a precaution while it investigates, follows the stolen assets and works with law enforcement.

The tell is in the transaction format

The technical detail that matters most here is what kind of transfers the attacker used. A report relayed by Pablo Sabbatella, founder of crypto security firm Opsek, says the stolen funds moved as plain transactions, not through a smart contract exploit. A plain transaction is an ordinary wallet-to-wallet transfer: it needs nothing but the sender’s private key. A contract exploit, by contrast, abuses a bug in on-chain code, and typically shows a single clever call to one contract rather than hundreds of routine sends.

That difference points to a specific failure mode. If wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC and Stellar all started sending funds to fresh addresses, the attacker most likely obtained the signing keys for the exchange’s hot wallets, the internet-connected wallets exchanges use to process withdrawals at speed. Cold storage and multi-party signing exist precisely to keep those keys offline and split them up; a drain this broad suggests the operational keys were exposed in bulk. The report puts the biggest outflow window between 06:19 and 06:53 UTC, roughly half an hour in which wallets on nearly a dozen chains emptied at once. Its tally of the attacker’s current holdings reads about 2,852 ETH, 106 BTC, 10,700 SOL, 77,000 AVAX and 6.7 million XLM, with smaller positions spread across some 200 additional tokens, though those figures come from a single on-chain analysis.

The exchange has not confirmed the $40 million estimate from security firms including Hypernative, and it has not disclosed how the attacker got in. In a follow-up post it published the destination addresses it identified on five networks, EVM chains, Bitcoin, Solana, Stellar and Tron, so other services can track the funds.

What a freeze can and cannot fix

The first concrete recovery step came from Tether. “Tether froze more than 4.5M USDT related to this security incident,” CEO Paolo Ardoino said on X. Tether can blacklist addresses holding its dollar-pegged stablecoin so the tokens cannot move, but a freeze does not by itself return funds to their owner. It also covers only a slice of the loss: most of the attacker’s holdings sit in ETH, BTC, SOL, XLM and AVAX, assets no issuer can freeze.

The incident lands four days after hackers drained more than $6 billion from Binance on October 29, a theft the FBI attributed to North Korea’s TraderTraitor group. Binance has since reopened withdrawals and said it replenished about 95% of the affected assets. That attack, like this one, reportedly came through compromised operational access rather than chain-level code, a pattern covered in the Binance breach that came through a laptop, not a smart contract. No attribution has been made in the Mercado Bitcoin case, and there is no public evidence linking the two incidents.

Deposits and withdrawals at Mercado Bitcoin remain suspended, and the exchange has not given a date for resuming them.

The post Mercado Bitcoin drain moved $40 million in plain transactions, pointing to stolen signing keys appeared first on Techreport.

Oracle provider Chainlink launched a service on October 29, 2026 that keeps pricing tokenized stocks, commodities and other traditional assets through weekends and market holidays, with decentralized lender Aave signed on as the launch partner.

What Chainlink 24/7 does

The service, Chainlink 24/7, was announced at the company’s Link:NYC event and detailed in a Chainlink blog post. The post says Chainlink 24/7 “delivers continuous market data for equities, commodities, and other real-world assets across trading sessions, weekends, and market holidays.”

During the week, the service combines prices from regular and extended trading sessions. When traditional markets shut, it switches to aggregated quotes from perpetual futures venues, the round-the-clock derivatives markets on crypto exchanges. Chainlink said the off-hours aggregation filters stale inputs and limits the influence of outliers across venues.

Until now, applications that track traditional assets had to pause markets, fall back on the last available price, or build their own systems whenever exchanges closed, Chainlink said. The gap matters because blockchains run continuously while exchanges do not, so a lending protocol holding tokenized stock as collateral had no reliable price on a Saturday. The push started in January 2026, when Chainlink introduced 24/5 US stock and ETF pricing covering pre-market, regular, post-market and overnight sessions.

Aave brings the feeds to Horizon

Aave, the decentralized lending protocol, plans to use Chainlink 24/7 Data Feeds on Horizon, its institutional lending platform that lets qualified investors borrow against tokenized assets. The goal is continuous valuation of tokenized real-world asset collateral, beginning with high-volume US equities. Aave had already adopted parts of Chainlink’s infrastructure, including its 24/5 streams.

Data arrives two ways: prices published directly on blockchains through Data Feeds, which suit lending protocols, and faster updates through Data Streams, which also identify the current market session so trading platforms and prediction markets can adjust their risk settings.

What the feeds do not promise

One caveat sits in how the off-hours price is built. It is a reference derived from derivatives trading, not a cash-market transaction, so a weekend figure can diverge from the next opening auction when trading resumes. Chainlink says the aggregation controls limit that risk, but an oracle feed does not guarantee a redeemable cash-market price.

Chainlink said its weekday pricing infrastructure now covers more than $1.6 billion in tokenized stocks across six blockchain networks, a company-claimed figure. Ondo, xStocks, Robinhood and Coinbase are among the firms working with Chainlink on tokenized stock pricing, part of a broader shift that recently put DeFi tokens on traditional venues, including UNI’s listing on CME futures.

No launch date for live service beyond the announcement has been disclosed.

The post Chainlink Launches 24/7 Pricing for Tokenized Assets, With Aave as Launch Partner appeared first on Techreport.

Stablecoin issuers froze more than $2 billion of the roughly $6.4 billion stolen from Binance within hours of the October 30 breach.

How an issuer freezes stolen coins

The mechanism is simple to state. USDC and USDT are tokens whose issuers control a blacklist at the contract level: when an address is added to it, any transfer to or from that address is blocked on every wallet and exchange that honors the token. A thief who steals USDC does not hold money in the ordinary sense; they hold a claim that Circle can switch off. That is what happened here. Circle froze approximately $823 million in USDC connected to the attack, and Tether CEO Paolo Ardoino said Tether froze more than 1.567 billion USDT related to what he called a potential Binance exchange hack, though some reports put the Tether figure at $975.1 million, a discrepancy the two accounts have not resolved.

Together with freezes by other blockchain partners, the issuers immobilized about $2.4 billion of the stolen funds. That is not the same measure as the roughly $3 billion Binance says is frozen on-chain, which includes assets beyond the two big stablecoins. The distinction matters for the recovery math: quick freezing brought the estimated unrecovered losses into the $3 billion to $4 billion range, and security researchers note that without it the majority of funds stolen by state-sponsored groups is never recovered.

The speed is the point. Ardoino’s post went up late on October 29, before Binance had published its own detailed account, meaning issuers were blacklisting addresses while the exchange was still confirming what had happened.

The federal probe behind the freezes

The freezing ran alongside a law enforcement response. Binance said in its statement on X that it had engaged law enforcement and blockchain intelligence partners to trace and recover funds, and the FBI and US Secret Service have reportedly joined the investigation. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the exchange said, adding that it found no evidence of any wallet private key leak. Binance’s account places the failure in its infrastructure rather than in a smart contract, and we traced how the breach came through a laptop, not a smart contract. The FBI said it is aware of the incident and is working with public and private partners to coordinate investigative steps; the Secret Service has not commented on its role.

Blockchain analytics firms TRM Labs, Elliptic and Chainalysis have all attributed the attack to TraderTraitor, a North Korean hacking group previously linked to the $1.5 billion Bybit theft. Neither Binance nor law enforcement has publicly attributed the hack, and the attribution remains theirs alone. Security researchers have also examined how the drain may have happened through delegated wallet permissions.

Binance said it will cover all losses from its SAFU fund and company funds, and that user funds are safe. Deposits and withdrawals remain suspended while security checks continue, with Binance targeting a resumption of withdrawals by Sunday, November 1.

The post How Circle and Tether Froze Billions From the Binance Hack appeared first on Techreport.

Binance says an attacker who reached its withdrawal systems through a compromised DevOps engineer’s laptop submitted unauthorized withdrawals with an estimated total impact of about $6.3 billion, in what the exchange describes as a security incident rather than a cryptography failure.

The exchange said in a post on X that its initial investigation points to the employee endpoint as the entry point. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak,” the statement reads.

An endpoint failure, not a key failure

The vector matters for how the industry reads the breach. Binance says wallet private keys were not leaked. Instead, the attacker reportedly took over an engineer’s machine, rode that access into a service container, an isolated runtime environment inside the exchange’s infrastructure, and used it to submit withdrawal transactions that the system treated as legitimate. The exchange has since revoked the affected address authorization, and a full technical post-mortem is promised once the investigation is complete. As of Binance’s October 30 update, the laptop finding is described as an initial one: the word “may” is doing real work in the company’s own sentence.

Security teams at other exchanges will read it the same way. A compromised developer machine with reach into production withdrawal infrastructure is an insider and endpoint risk, the kind of failure that two-factor prompts and signing ceremonies never see, because the withdrawal request came from inside the trusted perimeter. That is a different class of problem from the smart-contract exploits and leaked keys that have defined most exchange losses, and it puts the spotlight on how tightly DevOps access is scoped at crypto firms.

What moved, and what is back

Roughly $6 billion left Binance wallets across Ethereum and other EVM chains, Bitcoin, TRON, XRP and Solana within hours, according to the on-chain analytics firm Nansen, which called it the biggest exchange hack on record. On the Bitcoin side, Nansen tracked 18,270 BTC, about $1.48 billion, split across 19 addresses. Binance says it has worked with blockchain partners to freeze affected assets, with about $3 billion frozen on-chain as of October 30, a figure that has been climbing all day. Issuers did much of that freezing: Tether said it had frozen nearly $1.57 billion by October 30, up from about $971 million when Binance founder Changpeng Zhao first thanked the issuers, while Ripple reported roughly $200 million frozen.

Binance has suspended all deposits and withdrawals while security checks and asset tracing proceed, and says user funds are safe. “Users will not bear the financial impact of this incident. Binance will cover all losses,” a spokesperson said, pledging coverage through the Secure Asset Fund for Users (SAFU) and corporate funds, with an updated Proof of Reserves to follow remediation. Zhao, who no longer manages the exchange, wrote that “It does look like a hack on Binance,” though the company itself has not adopted that word. The company has not said when deposits and withdrawals will resume.

The post The Binance breach came through a laptop, not a smart contract appeared first on Techreport.

An address funded through Tornado Cash submitted an EIP-7702 delegation for a Binance hot wallet roughly three minutes before the exchange’s wallets began draining on October 29, 2026, on-chain analysis of the suspected hack shows.

The first Ethereum transaction went out at 20:24 UTC that evening: 167,464 ETH plus 63 token transfers, including 1.615 billion USDT, to a brand-new address. Outflows later appeared on Bitcoin and Tron, pushing third-party loss estimates into the billions. On-chain breakdowns of the drain put the total at $5.57 billion and climbing, with the blockchain analysis firm Chainalysis estimating $5.912 billion on October 30.

it does look like a hack on Binance.

Changpeng Zhao, Binance co-founder

What EIP-7702 delegation does

EIP-7702 is an Ethereum feature that lets an ordinary wallet run smart-contract code through a delegation. Once a wallet is delegated, that code can authorize later transfers without another signature from the wallet. That is the property on-chain analysis has focused on: one transaction in the drain carried fifty EIP-7702 authorizations signed by the Binance 14 hot wallet for consecutive nonces, an analysis shared in the security community claims. Binance has not confirmed the hack or that detail, which rests on a single researcher’s reading of the chain.

Key misuse, not a stolen key

The pattern points away from a leaked private key and toward what security researchers call key misuse: a signing system that was tricked or compromised into authorizing malicious transactions. Ido Ben-Natan, co-founder and CEO of the security firm Blockaid, said the preliminary assessment points that way: “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked.”

The distinction matters for every exchange. Stolen keys can be rotated and the damage ends; a compromised signing pipeline signs whatever it is told, as many transactions as the attacker queues. The Bybit breach of February 2025, previously the record heist at roughly $1.5 billion, followed a similar shape, and the same question now applies across the industry’s signing systems. It is the same weak point Google flagged when arguing banks need key-splitting custody: 40% of hack losses start with keys.

How the attacker obtained the signature, whether through key access, compromised infrastructure or insider action, remains unknown. Binance suspended all deposits and withdrawals as a precaution and said it will cover all losses, while issuers froze billions in stolen stablecoins within hours.

Binance’s verified frozen total stood at around $3 billion as of October 30.

The post EIP-7702 and a Tornado Cash wallet: how the Binance drain may have happened appeared first on Techreport.

Google unveiled Multi-Party Compute, a key-splitting custody system for institutional crypto holdings, at its first digital assets symposium in New York on October 28, 2026.

How the key-splitting system works

With Multi-Party Compute, the private keys that control crypto wallets are never held in full by a single party. A bank could hold one key share on its own hardware, a second in Google Cloud and a third with a rival cloud provider. A transaction is only signed when a defined threshold of shares comes together, with setups such as two-of-three or five-of-seven, reportedly. Google says it has no access to the keys; the company presents this as its own assurance rather than an independently audited claim.

Why banks lose money to key theft

The security rationale is the starting point of the pitch: in a large share of hacking incidents, losses begin with stolen or mismanaged private keys rather than with attacks on the blockchain itself. Key theft has hit exchanges, custodians and corporate treasuries, and it echoes other credential-focused attacks on crypto infrastructure, such as the USB cryptomining attack. Blockchain analytics firm Chainalysis tracks such thefts, and DeFiLlama data reportedly shows the scale of losses across decentralized platforms.

For banks weighing digital asset services, the announcement matters because regulated institutions need custody arrangements that survive the compromise of any single location. Splitting keys across independent operators, with the operator of the cloud infrastructure excluded from access, addresses the single point of failure that has driven past losses.

Launch planned for early 2027

Google plans a commercial launch of the custody system for early 2027. Pricing and the list of launch partners have not yet been announced.

The post Google Previews Multi-Party Compute, a Key-Splitting Crypto Custody System for Banks appeared first on Techreport.

Bitcoin wallet Electrum shipped version 4.8.3 on October 24 to patch a flaw that let a malicious server replace a user’s payment with a fake one that pays the attacker.

The wallet’s developers explained the mechanism in a security advisory: Electrum is a lightweight wallet that does not run a full node, so it depends on a network of servers that anyone can operate. Those servers feed the wallet its view of unconfirmed transactions, and before 4.8.3 Electrum never checked the cryptographic signatures on what a server delivered.

How a stuck payment becomes the attacker’s payment

When a user broadcasts a payment through a compromised server, the advisory describes how the server can hold the real transaction back and inject a conflicting fake one instead. The fake transaction carries an output address belonging to the attacker and a zero fee, which makes the payment look stuck. The wallet’s history shows the spoofed transaction as legitimate, because nothing verifies that it came from the user.

The trap closes with fee-bumping. Electrum users who see a payment sitting unconfirmed often use replace-by-fee, signing and broadcasting a replacement transaction with a higher fee to push it through. In this attack, the replacement the user signs actually pays the attacker’s address.

Electrum developer SomberNight, who wrote the advisory, also warned that an attacker can repeat the address-generation process over and over until the fake output ends in the same four characters the user’s real destination does. That makes a quick glance at the address tail worthless, so checking the first characters is no safer.

Confirmed in the wild

The advisory states that “some servers are performing this attack in the wild” , backed by two user reports. A user named dannydeezy flagged the behavior on October 11; in that case the fake payment stayed inside the compromised server and never reached the wider network, so nothing was stolen. Another user, Raju-K12, confirmed a loss on October 18 after fee-bumping a manipulated transaction.

The 4.8.3 patch verifies cryptographic signatures on wallet-owned inputs before adding any unconfirmed transaction to the wallet’s history, which blocks server-injected fakes that touch the user’s own addresses. SomberNight acknowledged in the advisory that the fix does not cover payments from outside parties, since such transactions carry no inputs belonging to the user and would still slip through without signature checks; adding that protection would take more work. Users who connect only to a server they run themselves are not affected.

The flaw is the latest turn for Electrum’s open server model, which its developers have patched before: a rogue-server campaign starting in 2018 pushed fake update notifications and reportedly drained an estimated $25 million from users by 2020. That history is part of why a thin-client architecture that trusts strangers’ servers keeps drawing scrutiny, as security fixes for Bitcoin software become a standing concern for wallet users.

The post How Fake ‘Stuck’ Bitcoin Transactions Pay the Attacker: Inside the Electrum 4.8.3 Patch appeared first on Techreport.

AI agents found ways into Anthropic’s internal systems in under 12 hours, security startup says

Security startup Cathedral says autonomous AI agents found access paths into Anthropic’s internal business systems in under 12 hours via sales, HR and IT software rather than the Claude model itself.

The test was conducted under Anthropic’s authorized vulnerability disclosure program, an arrangement that lets outside researchers test a company’s systems and report what they find. Cathedral, a cybersecurity startup founded months ago by four former staffers of the Department of Government Efficiency, carried out the exercise and disclosed it on October 26, 2026.

The way in: ordinary business software

The entry point was not Anthropic’s model. Cathedral says the agents exploited unglamorous third-party software every company runs in the background: tools for administration, sales, HR and IT. Once inside, the agents reached employee compensation details, internal communications, meeting transcripts, salary and job-offer information, and Slack messages discussing Anthropic’s advanced models, according to Cathedral’s draft report.

That detail is the point for enterprise security teams: the agents did not beat the AI, they beat the procurement stack around it. Every company that buys software from vendors now has the same exposed surface, whether or not it builds models. Anthropic itself has reported similar offensive capability before, saying in November 2025 that Chinese state-sponsored hackers used its Claude Code coding tool to attack roughly 30 organizations, and disclosing in July that Claude models hacked real organizations in three incidents during its own tests.

Anthropic disputes the severity

Anthropic confirmed that a limited set of sales, HR and IT systems was accessed, but says customer conversations, Claude responses, source code and model weights were never reached. Model weights, the trained parameters of an AI model, are considered a company’s most sensitive AI asset.

“Our monitoring flagged some of Cathedral’s activity before they reported it to us, we shut off their access the same day,” an Anthropic representative said.

The two sides disagree on more than the timeline. Anthropic says Cathedral overstated the national security implications of the findings and did not disclose all of its testing. Cathedral says data access was kept to the absolute minimum in line with security research best practices. Neither account is independently settled, and Cathedral’s report is still a draft.

Which vendors supplied the affected software, and which specific vulnerabilities the agents exploited, have not been named.

The post AI Agents Reached Anthropic’s Business Systems in Under 12 Hours appeared first on Techreport.

Bitcoin Core changed its security policy on October 22, 2026, so that fixes for easily rediscovered vulnerabilities can be shipped to older release lines within days instead of waiting out a year-long embargo, and the change comes as data from the Karlsruhe Institute of Technology shows 43.6% of sampled Bitcoin Core peers running software that no longer receives patches.

The amendment, merged into the project’s site repository as pull request #1281 by developer Antoine Poinsot, ends the practice of holding medium- and high-severity bug details secret until two weeks past the end of life of the last affected release. Under the new policy, a developer can flag a flaw that takes little effort to rediscover, a judgment made during triage and one that explicitly accounts for tools like large language models turning up old bugs again. Once flagged, the fix gets backported to every maintained release line and published with an advisory. Bitcoin Core currently maintains its three newest major lines: 29.x, 30.x and 31.x.

Why AI ended the embargo

The old policy assumed a latent bug could stay hidden for a year. Large language models undermine that assumption: a flaw that one researcher found in 2024 is a prompt away from being rediscovered by anyone in 2026, so the secrecy window increasingly protects nothing. Poinsot, the policy’s author, wrote on the bitcoindev mailing list that the change trades some caution for speed. “The embargo period achieves little but it delays the availability of a fixed release,” he wrote, adding that under the new policy mitigations “won’t have as much ‘bake time'” in development branches.

The case that shaped the policy: CVE-2024-52911, a high-severity use-after-free in block validation, was reported to Bitcoin Core developers in November 2024, fixed in version 29.0 in April 2025, and disclosed on May 5, 2026, about 388 days after the fix. The flaw affected versions from 0.14.0 to before 29.0, and a crafted invalid block could crash a node. The new category has not yet been publicly used for a specific bug as of October 23.

Half the sampled network is outside the safety net

The timing matters because of who is running what. A KIT network monitor snapshot from October 18 counted 3,671 of 8,422 self-reported Bitcoin Core peers on end-of-life release lines, 43.6% of the sample. The snapshot counted 3,243 peers on 31.x, 712 on 30.x and 635 on 29.x. It covers only public IPv4 and IPv6 peers, so Tor-only and non-listening nodes, plus private infrastructure run by exchanges, custodians and miners, fall outside it.

The sample is about to tip. Bitcoin Core maintains three lines, so when version 32.0 ships, 29.x leaves the maintenance window; a frozen sample would push the share of peers outside the safety net past half: 4,306 of 8,422, or 51.1%. As of October 24, the download directory still listed only release candidates and the project’s lifecycle page listed the 32.0 release date as TBA. The release notes also state that details of three medium- or high-severity flaws fixed in version 30.0 will go public two weeks after the new release, the old embargo rule still applying.

Version 32.0 brings its own upgrade hazard: it switches the default partially signed Bitcoin transaction format from version 0 to version 2. A user reported on October 14 that wallet files from the new graphical interface failed to import in older Core co-signers in a multisignature setup, and a fix was deferred toward version 32.1; RPC users can request the older format. Operators running older nodes, the same population that already misses patches after end of life on other platforms, face the choice between upgrading and leaving their software exposed.

Bitcoin has no central authority to force an upgrade, so the network’s security rests on operators acting on their own. The policy change is written in that spirit: it acknowledges that obscurity no longer protects anyone, and that speed is the trade-off worth making.

The post Bitcoin Core Speeds Up Security Fixes as AI Makes Old Bugs Easy to Find appeared first on Techreport.

Ethereum core developers postponed the Glamsterdam upgrade on the Hoodi testnet on October 22, pulling the October 26 activation, and its planned gas-limit raise to 200M, off the calendar.

The decision came at ACDE #248, the recurring call where Ethereum’s execution-layer client developers make protocol calls, and it was announced on the Ethereum Foundation blog the same day. The stated reason is EIP-8037: developers want more time to investigate how the proposal, one of the components of Glamsterdam, interacts with smart contracts already deployed on Ethereum mainnet. The blog post said the update “supersedes the schedule and activation instructions in the Hoodi testnet announcement.”

The 200M gas test is gone for now

The postponement removes three things at once: the Amsterdam activation on the execution layer, the Gloas activation on the consensus layer, and the gas-limit schedule that would have lifted Hoodi’s limit to 200M at the same epoch. That last piece was the point of the exercise. Hoodi, a testnet used to rehearse network upgrades before they reach mainnet, was set to run a gas-limit test of roughly 3.3 times the current limit ahead of Glamsterdam. With the activation postponed, the protocol’s scaling validation slips with it, and the 200M target now has no date attached.

The mechanics of the rollback are narrow. The change rolls back Hoodi’s configuration for a future upgrade; it does not revert the testnet’s chain history. Client releases tagged for the old schedule, including Lodestar v1.50.1, Besu 26.10.1, Ethrex v30.0.1-rc.2 and Nethermind 2.2.1, remain as release tags for a plan that no longer stands.

What it means for the mainnet timeline

The announcement concerns Hoodi only. The Ethereum Foundation said it “does not set a Glamsterdam mainnet activation date, and no action is required from Ethereum mainnet users or ETH holders as a result of this update.” A mainnet fork at 200M gas was never scheduled, so nothing mainnet has moved; what has moved is the rehearsal that would have de-risked it. The earlier preview of the Glamsterdam upgrade on Hoodi ran through the ePBS design and the node upgrades the original October 26 date required.

The delay also lands amid an unresolved technical question. Two days before the postponement, a Lido engineer warned publicly of a staking deposit hijack risk at Glamsterdam, but the blog post cites only the EIP-8037 investigation, and no official statement connects the two events.

No new activation date for Glamsterdam on Hoodi has been set.

The post Ethereum Postpones Glamsterdam on Hoodi, Stalling Its 200M Gas-Limit Test appeared first on Techreport.

Qubic restarted its network on October 19 and announced the open claims platform on October 20 after predictable wallet seeds let an attacker drain roughly $1.4 million in QU tokens from 1,404 accounts.

The project announced on X that its validator quorum, the Computors, approved the recovery plan, the reclaim platform is open, and the first funds have already gone back to verified owners.

The root cause sits in the wallet software, not in the chain itself. Qubic said the flaw affected seed phrases generated with its Qubic web wallet on certain Apple devices and browsers: the insecure random-number generator used there could produce predictable seeds, which in turn left the corresponding wallets open to unauthorized token movement. A wallet seed is the secret from which all of a wallet’s keys are derived, so anyone who guesses it effectively owns the account. An attack that guesses seeds does not touch Qubic’s consensus rules, which is why the project rejects describing this as a hack of the protocol.

What the network did about it

Qubic halted the mainnet on Sunday, October 18, to stop further movement of stolen funds. Its blockchain explorer shows processing resumed at 8:00 pm on October 19, advancing past tick 85,371,949, the point where the network had paused. Qubic released web wallet version 4.26.4 the same day, fixing the seed-generation flaw.

Affected users submit a claim through weak-seed-reclaim.qubic.org, with a deadline of May 1, 2027. Recovery rules reported October 22 require ownership checks even on unstolen funds held in vulnerable wallets, a measure some users may contest.

What wallet holders should do now

Qubic warned that any wallet created with the Qubic web wallet before version 4.26.4 should be treated as insecure, even if no funds ever left it. The team urged users to update to 4.26.4 or later, create a new wallet, move their funds across as soon as possible, and never use the old wallet again.

Previous coverage of the mainnet halt reported 87.1% of stolen funds frozen within hours of the exploit. The attack itself echoes a recurring pattern in crypto security, where audits of a protocol offer no protection when the weakness sits in client-side software.

The post Qubic restarts chain, opens claims after $1.4M weak-seed hack appeared first on Techreport.

Webull will roll out Bitcoin perpetual futures to its US clients starting in November, the Nasdaq-listed brokerage said on October 20 in an announcement that puts a date on a product most American retail platforms do not offer.

The launch brings perpetual futures to a mass US retail audience. The derivative, which crypto exchanges pioneered, lets traders hold leveraged long or short positions indefinitely, and with about 6 million clients in the United States, Webull is moving a product once confined to offshore venues onto regulated rails.

How the product works

A perpetual future tracks Bitcoin’s price but never expires, unlike a conventional quarterly futures contract. Traders post margin and can take leveraged positions in either direction. The mechanism that keeps the contract price near spot is the funding rate: periodically, whichever side of the market is overleveraged pays the other. On regulated US venues, the CFTC oversees that clearing and settlement, which is the main difference from offshore exchanges where retail traders currently get most of their perps exposure.

Why the date matters

US retail access to crypto derivatives has been widening all year. The CFTC approved the first perpetual futures contracts earlier in 2026, with Coinbase and Kalshi among the initial approvals. A Nasdaq-listed retail broker now building its own offering on those same regulated rails is a signal of how quickly the line between fintech and crypto infrastructure is dissolving.

What Webull said

The company said the November start covers US clients, and that details on the rollout schedule and trading terms are in its announcement. Specific funding rates, margin requirements, and per-contract specs were not itemized in the release.

The post Webull Puts a Date on Bitcoin Perpetual Futures: US Rollout Begins in November appeared first on Techreport.

Uniswap’s UNI becomes the first DeFi protocol token with futures on CME Group

CME Group marked the first trades in its new Uniswap and Bitcoin Cash futures on October 20, 2026, in the announcement of the first trade on its press room.

Uniswap called UNI the first DeFi protocol token with futures on the exchange, saying in a post on X: “UNI is now the first DeFi protocol token with futures on @CMEGroup.” The claim is specific to CME: DeFi tokens have long traded as perpetual futures on offshore venues, but none had carried a contract on the US derivatives exchange before. The listing gives institutional traders a regulated, cleared way to hedge or take exposure to UNI without touching a decentralized exchange directly.

CME Group confirmed on X that both contracts are officially live, with the inaugural block trade executed between crypto market makers FalconX and GSR.

A year of steady expansion

The UNI and Bitcoin Cash listings cap a busy year for CME’s crypto derivatives desk. The exchange has been building out its crypto derivatives suite all year, reportedly adding contracts on Cardano, Chainlink and Stellar in January, and the new listings push the lineup further past its original Bitcoin and Ether core. Chief executive Terry Duffy has also flagged perpetual futures, prediction markets and around-the-clock trading as areas of exchange focus.

A block trade, the format CME used to mark the launch, is a privately negotiated derivatives deal executed away from the open market but cleared through the exchange, a common way to open a new contract with a large, known counterparty. That two established crypto market makers, FalconX and GSR, took the first trade points to early institutional liquidity in the contracts.

DeFi infrastructure itself has a mixed security record: a study of flash loan attacks found logic exploits drained $1.2 billion from decentralized finance over four years, a reminder that regulated exposure to a protocol token does not remove the protocol’s own risks.

A smaller contract for smaller traders

Beyond the standard UNI contract, CME Group also lists a Micro UNI futures product, a smaller-sized contract aimed at retail and smaller traders, on its product page.

The post CME Group’s 2026 Crypto Expansion Reaches Uniswap’s UNI appeared first on Techreport.

Cysic froze an address that received an unauthorized mint of 10 million CYS tokens on BNB Smart Chain 76 minutes after the mint, but only about 2.8 million of those tokens were still there, the Cysic Foundation said in an incident report.

The mint hit the bridge at 12:31 UTC on Oct. 17, 2026, the Cysic Foundation said in its incident report. The Cysic Foundation added the recipient address to the token contract’s blacklist at 13:47 UTC. At that moment about 2.8 million CYS sat at the address with transfers restricted. The other 7.2 million were no longer at the address, and the foundation said it is tracking where they go.

A fast response with partial results

Seventy-six minutes was not quick enough to catch most of the tokens. Blacklisting restricts transfers from one address; once tokens move to other addresses, the freeze no longer applies to them. That is the gap the response ran into: the mint, the movement and the blacklist were three separate events, and the attacker used the time in between.

The Cysic Foundation said preliminary findings point to unauthorized access to a database supporting the bridge combined with weaknesses in the bridge’s processing logic. It has not confirmed the full attack vector or the root cause, and both are still under evaluation. The company has hired a third-party security firm, which it has not named, and plans a follow-up report after the current investigation phase.

What the freeze does not cover

The foundation said the incident was limited to bridge message processing and minting, that the mainnet and other operational systems were unaffected, and that no CYS or other assets held in user wallets were stolen or transferred without authorization. The dollar loss is not established: the foundation itself said the number of tokens minted does not determine it, since transfers, swaps and actual losses remain under review.

The bridge is offline indefinitely, with no timeline given for its return. The supply math gives the unfrozen tokens their weight: CYS has a maximum supply of 1 billion tokens and roughly 160.8 million were circulating as of Oct. 18, per CoinMarketCap’s token data. If the 7.2 million loose CYS re-enter circulation, they would add about 4.5% to the circulating supply, on top of the 2.8 million already frozen.

The incident follows a similar bridge mint exploit at Syscoin in June 2026 and, reportedly, the first notable operational security problem tied to Cysic’s bridge infrastructure. Cysic launched its mainnet and held its CYS token generation event in December 2025.

The post 76 minutes to blacklist: how Cysic’s response speed still left 7.2M tokens loose appeared first on Techreport.

An attacker drained 1,404 Qubic user wallets of roughly 2.94 trillion QU tokens, worth about $1.3 million at the time, prompting the network to pause its mainnet on October 18, 2026.

A flaw in the wallets, not the chain

Qubic’s developers traced the exploit to weak, predictable wallet recovery seeds created on legacy Apple devices, Safari browsers and early iOS applications. A seed is the secret string from which a wallet’s keys are generated; where the generator draws too little randomness, attackers can reproduce the same seeds and the wallets they unlock. The team said the flaw sat outside the network’s code, and it released client version 4.26.4 to fix seed generation. Developers also said they secured additional funds exposed to the same weakness before they could be taken, and that QEARN, the network’s staking feature, was untouched.

The attack ran from 23:42 UTC on October 17 to 01:26 UTC on October 18, a window of about one hour and 44 minutes.

Validators stopped the chain

Qubic’s validators halted the chain at tick 85,371,949 to freeze the stolen tokens. About 87.1% of the drained QU never left the network and is immobilized on-chain, while the remaining 12.9% reached the MEXC exchange, which froze the receiving account within an hour on suspicion it was tied to the attack. The 87.1% figure comes from the most detailed account of the drain; another outlet covering the story said only that most funds were frozen. MEXC and Bitget both suspended QUBIC deposits and withdrawals on October 18: MEXC said its suspension was requested by the Qubic project team, and Bitget cited wallet maintenance.

Whether the 1,404 affected users are reimbursed now rests with Qubic’s validator cluster, and affected users are being told to file police reports. The mainnet restart date on the patched client has not been announced.

The incident is the second this year to hit Qubic through a component adjacent to its core, after the Vottun Bridge was exploited in August 2026, and it underlines a risk that reaches past this one network: wallet software that generated weak seeds on older Apple devices and browsers leaves those funds exposed regardless of how sound the chain itself is.

The post Qubic halts mainnet after seed exploit drains 1,404 wallets appeared first on Techreport.

Ethereum’s Glamsterdam upgrade will bring proposer-builder separation into the protocol itself when it activates on the Hoodi testnet at epoch 132,352 on October 26, 2026, the Ethereum Foundation announced on October 16.

What EIP-7732 changes

EIP-7732, the upgrade’s headline inclusion, writes the split between block proposers and block builders directly into Ethereum’s consensus rules. Today that separation exists only as an out-of-protocol market: a validator proposes a block, specialized builders compete to fill it, and the handoff between the two runs on trusted intermediaries and side agreements that Ethereum itself does not guarantee.

Under the enshrined design, the protocol takes over that handoff. A payload timeliness committee attests to whether a builder revealed its block payload and blob data on time, so the network itself verifies that the promised block actually arrived, and when.

Glamsterdam is the combined name for two upgrades landing at the same fork: Amsterdam, the execution layer change named after the Devconnect 2022 host city, and Gloas, the consensus layer change named under the protocol’s star-naming convention. EIP-7732 sits on the consensus side.

The wider package

Proposer-builder separation is the largest of 19 EIPs scheduled for inclusion, tracked by EIP-7773, along with 7 supporting networking and informational EIPs. EIP-7928 adds enforced block-level access lists, a per-block record of the accounts and storage locations a block touched, together with the resulting state changes. That per-block record of every account and storage slot touched is what lets the protocol price state access explicitly.

The package also carries smaller quality-of-life changes: logs for ETH transfers, an opcode that returns the current slot, a raised cap on contract size, a factory contract whose address is predictable, and extra instructions for stack manipulation.

What it means for validators and builders

For validators, enshrined PBS replaces the current trust-based arrangement with a protocol commitment: the committee’s attestation becomes the check on whether a builder delivered. For builders, the rules of engagement move from off-chain deals to consensus-level requirements. For users, the change strengthens censorship resistance, because the network no longer depends on intermediaries outside the protocol to connect those who order transactions with those who build blocks.

Hoodi’s gas limit will also rise to 200M at the activation epoch, and every client on both the execution and consensus sides needs an update before the fork. The Ethereum Bug Bounty Program remains active for the Glamsterdam specifications and EIPs.

Glamsterdam already activated on Sepolia on October 6. No date for the mainnet fork has been chosen yet.

The post Ethereum’s Glamsterdam Upgrade Enshrines Proposer-Builder Separation on Hoodi Testnet October 26 appeared first on Techreport.

Ledger announced Atom on October 15, a touchscreen Android device the company bills as a signer rather than a hardware wallet, with Solana Mobile integration and controls for AI agents, at its Op3n event in Paris. The company said in a post on X that Atom combines hardware security, everyday apps and control over AI tools in one device.

One device, two operating systems

Atom runs Android Open Source Project software alongside Ledger OS on a secure element rated EAL6+. An FPGA chip separates the Android environment from Secure Mode, the isolated space where transactions are signed. A physical switch cuts power to the camera and microphone, and both shut off automatically whenever the device enters Secure Mode. The hardware carries a 6.77-inch OLED display, a rear camera, a 4,000mAh battery and a Qualcomm Dragonwing chip with a data-only eSIM.

Solana Mobile named Ledger its first hardware expansion partner, and the Seeker app plus the Solana dApp Store, which lists more than 1,500 dApps, will ship preinstalled on Atom, with signing handled by Secure Mode. Solana Mobile said it has sold over 200,000 devices and processed more than $13 billion in transaction volume across 154 million transactions.

Pricing and delivery

The limited Founder’s Edition costs $849 with a $100 fully refundable deposit to reserve one. Regular orders will cost $899 after launch, Ledger said, and the device will be sold only through Ledger’s website. Deliveries are expected to begin in summer 2027, pending certification. That sits far above the company’s current wallet lineup, which spans $69 to $399.

Atom’s encryption will incorporate post-quantum cryptography compatible with standards from the U.S. National Institute of Standards and Technology, the company says on its announcement page. Kraken is exploring support for Atom and whether customers could use Secure Mode to approve actions on the exchange, building on a September collaboration between Payward, Kraken’s parent, and Ledger.

Launched mid-investigation

The announcement lands days into Ledger’s probe of unauthorized implants in wallets sold through the Southeast Asian reseller CryptoBilis. Ledger’s security team said the implant can capture recovery phrases shown on screen during setup and transmit them over a mobile network. Onchain researchers have tied the incident to suspected losses of more than $86 million, a figure Ledger has not confirmed and which varies between estimates. Ledger asked resellers in six Southeast Asian countries and Hong Kong to pull devices from shelves on October 13, and said on October 14 that inspections across Germany found no tampering, with no implant-related losses reported in Europe.

Ledger says Atom’s tamper sensors sit on a separate battery and work while the device is off, and that the Core Protection feature will block the screen-reader implants from the recent incident. “The Core Protection feature will explicitly block the screen reader implants from this weekend’s incident,” a Ledger spokesperson said. The claim has not been independently tested. Ledger declined to disclose sales targets.

The post Ledger unveils Atom, an $899 Android signer with Solana Mobile integration appeared first on Techreport.

MediaMarkt Saturn pulls Ledger devices from European shelves

MediaMarkt Saturn stopped selling Ledger hardware wallets in its stores and online across Europe on October 13 after a German customer reported finding an implant inside a device, with no loss of funds reported in that case. Ledger confirmed the suspension and said the retailer removed all of the manufacturer’s affected products while the two companies stay in contact.

The move extends a supply-chain scare that began in Southeast Asia. Ledger confirmed on October 10 that signers sold by the regional reseller CryptoBilis contained an unauthorized hardware component, and its security team, the Donjon, published a full analysis of how the implant works on October 13, saying in a post on X that it reads the 24-word recovery phrase straight off the device screen.

For a product whose core promise is that the keys to a wallet never leave a sealed, tamper-resistant chip, an implant that copies the recovery phrase during setup defeats the reason buyers pay a premium for hardware in the first place.

How the implant steals the phrase

The mechanism, as Ledger’s Donjon team describes it, is straightforward and does not touch the device’s cryptography. A separate circuit board hidden inside the enclosure watches what the screen displays. During setup, the signer shows the user its 24-word recovery phrase, the only sequence that controls the wallet’s funds. When the implant detects those screens, a microcontroller decodes the words and transmits them over a cellular network using a provisioned eSIM, a SIM chip embedded in the board itself.

That design means the attacker never has to break the Secure Element, the tamper-resistant chip that stores private keys. Ledger said the implant does not modify the Secure Element or the Ledger operating system and does not alter transactions or signatures. It simply copies the one secret a user is supposed to write down and keep offline, then phones it home.

All confirmed fund losses disclosed on October 9 involve signers sold through CryptoBilis, and Ledger said it has not verified a drain linked to a signer bought elsewhere. Third-party onchain estimates put losses above $86 million across Bitcoin, Ethereum and Tron, but Ledger said figures circulating online come from third parties and it has not fully verified them.

Spread beyond one reseller, and what buyers should do

The geographic reach is now the open concern. A user posting on X under the name Johannes said he bought two Ledger devices at separate MediaMarkt stores in Germany and found unauthorized cables and cellular modules inside both, adding that store records pointed to distributor Aqipa GmbH. Those claims are not independently verified, and Ledger has not confirmed any link between the German devices and the CryptoBilis case. Former Mt. Gox chief Mark Karpelès also reported that a Ledger Flex bought at Singapore’s airport contained a spy implant; Ledger has not tied that device to the same incident.

Ledger’s guidance to buyers is unchanged: anyone who purchased a signer from CryptoBilis and has not set it up should not set it up and should contact Ledger Support instead. Those who already set one up should move their assets promptly to a new signer with a new recovery phrase. The company added that anyone who lost funds should coordinate with law enforcement before opening the device.

Competitors are moving too. OneKey revoked CryptoBilis’s reseller authorization and is offering free replacements for devices bought through the reseller between March 1 and October 13, while Trezor dropped the reseller as a precaution and is trimming its reseller network, with notified resellers losing authorization on January 1, 2027.

The post Ledger halts reseller sales in Europe as confirmed seed-phrase implant surfaces at MediaMarkt appeared first on Techreport.

Autheo’s THEO token had passed security reviews by Halborn, CertiK and Avelar Labs before a suspected bridge exploit let 19 million unauthorized tokens onto Base on October 13, 2026, and the price fell 92% within a day.

The audits on record

Three separate firms signed off on the project before the incident, and the exploit happened anyway. The minted tokens were swapped for roughly 700.8 ETH, about $1.76 million, a figure one news outlet has put out that has not been confirmed on-chain elsewhere, and THEO slid from about $0.08 to around $0.006 in 24 hours. Autheo has urged users not to buy, sell or bridge THEO while its investigation continues.

The case is a reminder of what an audit attests and what it does not. A review checks the code of the contracts it is hired to examine, at a point in time, against the attack patterns its auditors know. It cannot certify every contract a project runs, every configuration change made after the review, or the full combinatorics of a message-passing system under load.

Bridge infrastructure sits outside the usual scope

Autheo uses a bridge built on Hyperlane to move tokens between its own mainnet, Base and Robinhood Chain, and the unauthorized mint appeared on the Base side, where the official bridged THEO contract is 0xebE516a20238F79DC20b07eaD6768e08891Ed309. A bridge is different from an ordinary token contract in one plain way: its correctness depends on what happens on more than one chain, and on how messages between those chains are verified. An error in that machinery can mint tokens on one network out of a state change on another.

The exact root cause is not confirmed, so whether the flaw lives in Autheo’s own deployment of the bridging stack or deeper in shared infrastructure is an open question. That distinction matters for other projects using the same software, and it is also the kind of boundary an audit file rarely maps. Reviews are scoped to a codebase; a bridge deployment spans a codebase, its configuration, its off-chain relayers and its counterparties.

What the incident changes for builders

For teams shipping on young networks, the THEO case reads as a scope problem rather than an assurance gap. The practical takeaway is that an audit badge covers what was audited, and cross-chain infrastructure, which changed state across three networks here, is the part most often examined least. As general context, the industry has no standing mechanism to unwind a theft once funds have moved, which raises the cost of that coverage gap for holders.

Autheo launched its mainnet on May 14, 2026, and THEO began trading in August, so the project went from launch to exploited bridged asset in about five months. Its warning to users stands while the investigation runs, and no remediation plan has been announced.

The post Audited three times, exploited anyway: what the THEO hack says about security audits appeared first on Techreport.

How the wrap-around worked

The ledger tracks XRP balances as 64-bit whole numbers capped at a set ceiling. Per the disclosure, once a running total pushed past that ceiling the arithmetic rolled over to a much smaller value rather than stopping the payment. A payment that filled hundreds of order book offers had no check on its total, so a huge sum could quietly become a tiny one: sellers were paid in full while the buyer was charged almost nothing, leaving new spendable XRP behind.

The attack was cheap to set up and impossible to trigger by accident. The report states: “The attack could not be triggered by accident. It required hundreds of offers priced in a way no real trader would use, followed by a payment built specifically to consume them all at once.” Opening the accounts needed only a few hundred XRP, most of it recoverable, plus transaction fees.

Why two safety nets missed it

The ledger already runs a check after every transaction to make sure no new XRP has appeared. That check relied on the miscounted total, the disclosure explains, so it would have passed anyway. A separate limit on how much XRP a single account can receive would not have triggered either, because the attack spread the new tokens across hundreds of accounts.

Engineers at RippleX reproduced the attack on a standalone server and confirmed the newly created XRP could be spent in a later transaction. About 99.986 billion XRP exist today, all of it created at the ledger’s 2012 launch, with fees burned along the way, so the supply is deflationary.

The post How the XRP Ledger overflow bug could have minted 18 trillion XRP appeared first on Techreport.

Sui Foundation announced on October 12, 2026 that it is investing $30 million in DATA Network, the AI training data protocol formerly Story Protocol, which will retire its Layer 1 and run natively on Sui.

A single-use chain that no longer paid its way

The project launched in February 2025 as Story Protocol, an EVM-compatible Layer 1 built for programmable intellectual property and automated licensing. In June 2026 it rebranded as the DATA Foundation and pivoted to what it called a full stack for AI training data; holders of the original IP token were swapped 1:1 into the new DATA token. That month it also launched Trace, a registry that logs the origin, consent and licensing rights of training data.

The pivot is what made the dedicated chain a liability. A DATA Foundation spokesperson said running a blockchain for a single use case meant carrying the costs of validators, network security and infrastructure. Trace has grown quickly since June: a DATA Foundation representative put its registrations at more than 270 million in about four months, while a count published in October put the figure at over 250 million.

What Sui gets, and what DATA gets

Under the deal, Walrus, the decentralized storage platform built alongside Sui, becomes the default storage layer for applications operated by the DATA Foundation, and Trace joins Sui. “Building storage and access control at that scale ourselves would have meant rebuilding what Sui already has in Walrus and Seal,” a DATA Foundation spokesperson said, referring to Sui’s access-control technology.

The deal reads as a bet on where AI data infrastructure is heading. Trace answers the question AI developers face as demand for verifiable, consent-gathered datasets rises: who owns a given training dataset and who may license it. By hosting the registry and storing the datasets on its own stack, Sui positions itself to capture a workload that could just as easily have landed on any chain. Training data is becoming a chain-agnostic commodity, and the chain that hosts it wins the surrounding activity. Kled, the protocol’s flagship integration, has already recorded more than 1.5 billion user-contributed data records, and other apps including Numo sit on the same stack.

Whether the money shaped the decision is a fair question. Asked how much the investment influenced the move, a DATA Foundation representative said the $30 million was a separate part of the partnership. No structure, token details or vesting terms for the investment have been disclosed, and the claim that the payment did not drive the migration is the representative’s own.

What happens to the old chain

DATA Network will keep operating until the upgrade completes, and the partners have said a detailed timeline and a holder transition plan will be published before the upgrade. No migration date has been set.

The post Sui Foundation backs DATA Network’s move off its own chain with $30 million appeared first on Techreport.

HSBC and Ant Digital Technologies said on October 9, 2026 that they completed a technical test in which AI software agents found digital services and paid for them on their own, using tokenized bank deposits and settling payments typically under $2 in real time.

How the payment actually worked

The companies’ joint announcement describes a pairing of two systems: HSBC’s Tokenised Deposit Service, which represents corporate deposits on a 1:1 basis as on-chain digital records, and Ant Digital’s Anvita Flow network, which lets AI agents discover, invoke and pay for digital services. Transactions ran on the Jovay Testnet, a Layer 2 blockchain testing environment, so the trial involved no live customers, no commercial applications and no confirmed transaction values beyond the test setup.

The mechanics matter more than the amount. An agent located a service, called it, and executed a micropayment for what it used, with settlement completing in real time. HSBC kept risk checks on its own side of the connection through a bank-side interface, so the bank retained control over spending even though the agents acted autonomously. For a bank, tokenized deposits are a way to offer programmable money on a 24/7 basis without issuing a new public token, and the companies present that regulatory-friendly route as the point of the pairing.

Why sub-$2 payments are the point

Micropayments, typically defined as transactions under $2, are the gap the test was built to probe: paying per service invocation rather than per subscription or invoice. Investment research firm Citrini argued in an October 8 report titled “Breaking The Wall” that autonomous AI agents could increase demand for programmable financial infrastructure, writing that “AI agents move programmatically, 24/7, across applications, and it’s only logical that money and financial assets eventually will, too.”

Real-time settlement on a testnet is the second half of that equation. Settlement speed is what a machine-to-machine payment model would need to nail down, and in the trial HSBC’s deposit tokens moved funds around the clock rather than on banking-day schedules. That combination, small amounts plus instant settlement plus bank-held risk controls, is the model the trial was built to verify.

Part of a wider 2026 test wave

The trial extends a series of agentic-payment experiments by regulated banks this year. In March 2026, Santander completed an AI-agent-initiated payment using Mastercard’s Agent Pay infrastructure in a controlled test. In May, Sygnum ran AI-agent-driven transactions on a blockchain mainnet, requiring customers to approve and sign each transaction, and CaixaBank completed an AI-agent-initiated card transaction with Visa’s commerce tooling. HSBC and Ant Digital have collaborated on blockchain-enabled payments since at least 2023, and HSBC’s Tokenised Deposit Service reportedly launched in Hong Kong in 2025 for corporate clients.

Days before the AI test, around October 6 and 7, HSBC reportedly announced Middle East pilot programs covering intra-UAE dirham transactions and USD cross-border payments, indicating the bank is pushing the same tokenized-deposit rails in several directions at once.

The post HSBC and Ant Digital’s AI agents paid for services with tokenized deposits, under $2 at a time appeared first on Techreport.

Ledger said on October 9 that it is investigating reports of stolen funds from users in Southeast Asia who bought their devices through the reseller CryptoBilis, and has asked the reseller to halt all sales and shipments of Ledger products while the investigation runs.

“Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis,” the company’s support account said in a post on X, adding: “As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.”

What buyers are being told to do

Ledger advised customers who bought from the reseller within the past 90 days not to set up their devices. Those who already have should move their assets to a new Ledger device with a newly generated recovery phrase, the company said. The guidance is tied to where the device was bought, not where the buyer lives: CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines, and is based in Kuala Lumpur.

On-chain researchers began mapping the suspected thefts the same day. A pseudonymous researcher who posts as Specter traced inflows from hundreds of victim wallets across Ethereum, Tron and Bitcoin to a set of suspected theft addresses, putting total losses above $86 million. A second researcher, posting as tanuki42, listed eight of those addresses and put the figure above $72 million and rising. The two estimates may not cover the same addresses or transactions, and Ledger has confirmed no loss amount, no affected-customer count and no cause.

“Based on information so far, it seems to be localized to a supply chain attack with one vendor,” Binance co-founder Changpeng Zhao wrote on X. “A small number of people probably bought fake (or tampered) Ledgers.”

Ledger says its own systems were not hit

Ledger said its infrastructure, systems and services were not compromised, and that it has received no reports involving devices purchased directly from the company. The company describes the incident as isolated to the reseller and its market. Former Mt. Gox chief Mark Karpelès separately said the reports may match a tampered-device case he was already investigating, after he says he received a tampered device from Malaysia, and asked affected users to send him photos of their circuit boards.

The suspicion, unconfirmed as it is, lands on a channel the industry sells as the safe path. A hardware wallet only protects a user’s keys if the device that arrives is the device the factory built: a tampered unit with a pre-generated recovery phrase hands the keys to whoever set it up. Ledger says it has sold more than 7 million devices worldwide, and CryptoBilis did not respond to press questions about the incident. The Security Alliance has asked anyone whose funds were drained to the suspected addresses to contact its SEAL 911 incident-response team.

The post Ledger pauses reseller sales amid suspected $72M-$87M wallet drains appeared first on Techreport.

Abstract, the consumer-crypto Ethereum layer-2 built by Pudgy Penguins parent Igloo Inc., said in its announcement that it will shut down on Dec. 15, 2026, leaving the more than 144 apps deployed on the network about two months to find a new home. Funds not bridged off before the deadline will become inaccessible.

The apps left standing on a dead chain

More than 144 apps were deployed on Abstract, a chain whose mainnet launched in January 2025. For the teams behind them, the announcement is an eviction notice with a short fuse: whatever their code does on Abstract stops mattering when the network goes dark. Abstract’s engineers and ecosystem staff said it will help projects built on the network migrate to other chains, though the announcement does not name destination chains.

Users holding assets face the tighter constraint. The announcement directs them to move funds through Abstract’s Migration Hub or its Native Bridge, and the bridge carries a three-hour delay. Abstract also urged users to watch out for impersonators, fake migration sites and direct messages claiming to represent the project, a warning that matters more than usual in a forced-migration window.

Exit terms draw criticism

The wind-down period was criticized as too short. “2 months seems like too short a window before making everyone’s funds inaccessible,” crypto commentator 0xQuit wrote on X.

Other users flagged a class-action waiver that must be agreed to before funds can be migrated. IamShugyo, a pseudonymous X user, said the terms prevent users from joining a class-action lawsuit and that a 30-day email opt-out was buried in the announcement. Those terms are user criticism relayed by one outlet, not confirmed details of the agreement itself.

Why the chain is closing

Igloo Inc. funded Abstract for the last 18 months out of the Pudgy Penguins business, and CEO Luca Netz said in his statement that the company lost tens of millions of dollars over two years without finding product-market fit. Abstract said growth stalled because of a limited DeFi ecosystem, thin on-chain liquidity, little institutional crossover and high operating costs.

“Operating a chain focused exclusively on consumer crypto has ultimately proven to be unsustainable as a standalone model,” the team wrote.

By the team’s own count, Abstract processed more than 325 million transactions, logged over $6 billion in DEX volume and generated more than $40 million in ecosystem revenue. Those figures are self-reported in the wind-down announcement, and they did not add up to a viable chain. Netz said Igloo’s focus now goes to Pudgy Penguins and $PENGU, and the deadline for every app and asset on the network is Dec. 15.

The post Abstract’s shutdown gives 144 apps two months to find a new chain appeared first on Techreport.

Ripple Custody version 1.43 adds support for the Canton Network, confirmed by Canton Network on X on October 7, 2026, letting banks and funds hold and transfer Canton assets inside the custody platform they already run. The update shipped October 5, 2026, according to coverage of the release documentation.

Bring your own validator

The integration follows a bring-your-own-validator model: clients connect the custody platform to validators they or their node providers already operate. The design point that matters to a bank procurement desk is what Ripple does not touch. Signing keys remain in the customer’s own vault, whether that is a hardware security module (HSM) or a key management service (KMS), so Ripple never holds the keys that authorize a Canton transaction.

Existing custody policies and approval workflows carry over to every Canton transaction on the platform. The release adds pre-approvals for incoming assets and two-step transfer offers, and prepared transactions come with a 24-hour signing window before they go stale, giving approvers a full day to review and sign.

What banks can custody today

Institutions can hold and transfer Canton Coin (CC), also known as Amulet, along with any CIP-56 tokens issued through the Digital Asset Registry. CIP-56 is the token standard used for assets created on Canton, and it supports atomic delivery-versus-payment settlement without cross-chain bridges.

Canton itself is a public Layer 1 blockchain developed by Digital Asset, offering sub-transaction privacy, in which each participant sees only its own data, on a structure the network describes as a “network of networks.” Goldman Sachs, BNP Paribas and BNY Mellon reportedly use Canton infrastructure, while Broadridge reportedly processes multibillion-dollar repo transactions on it daily and DTCC tokenizes U.S. Treasuries on its rails.

An early, API-only first step

The support is deliberately narrow for now. Canton access works only through the API, with no direct support for arbitrary Canton application commands or delivery-versus-payment (DvP) workflows, so institutions running the full settlement pattern on Canton still need separate plumbing. On deployment, the integration works with both on-premises installations and hybrid SaaS environments.

Ripple did not include pricing for the update in the release material, and neither Ripple nor Digital Asset offered a public comment.

The post Ripple Custody v1.43 adds Canton Network support for institutional clients appeared first on Techreport.