Polkadot warns users of the third-party Fearless Wallet browser extension that private keys were leaked to attackers. Eight users reported 17,286 DOT in unauthorized transactions.
Polkadot has issued a security alert over the Fearless Wallet browser extension, telling users to move their funds after finding that the third-party wallet had been leaking private keys. Users who relied on the extension are being urged to treat their accounts as compromised and to shift assets, including $DOT, to new wallets.
What the alert says
The Polkadot Community Foundation has warned that versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the Fearless browser extension contain malicious code, and that users' private keys may be sent to an attacker's server when they unlock their wallets.
The code was introduced into the extension's public source code on February 19, 2025, as part of a major update titled "TON ecosystem," and was activated intermittently until October 10, 2026.
That puts the potential exposure at around twenty months for anyone who used the affected builds.
Because a leaked key can sit unused until an attacker decides to strike, the number of exposed accounts could exceed the number of drained ones.
Losses have already been reported.
Eight users have reported unauthorized transactions possibly related to the vulnerability, involving 17,286 DOT.
Chrome still listed an affected extension version with 6,000 users as the foundation urged holders to create fresh keys.
It is also worth noting that
Fearless Wallet is developed by an independent team and is not an official Polkadot wallet.
What users should do
The foundation advises users who have used the affected plugin since February 2025 to immediately generate new keys and transfer their assets. Merely changing passwords or reinstalling the plugin will not suffice.
Keys should be created in a different wallet, and assets moved across.
Mobile users are in a better position, but not entirely clear.
The code has not been detected on mobile platforms, though users who previously imported the same private key into the browser plugin should also be considered compromised.
Users with assets in staking, nomination pools or governance locks face an extra step. According to a report by KuCoin News,
The incident is a reminder that browser-based wallets hold private keys in an environment that depends on every code update being trustworthy. Holders of $DOT who use any browser extension should review which wallets they have installed and which keys have been imported into them.
SourcesCrypto Briefing: Polkadot warns Fearless Wallet users to move funds after key leak
The Defiant: Polkadot warns Fearless Wallet users to move funds after private-key leak
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Dataline, a startup building a decentralized data network for AI agents, has raised $10.6 million. The round was disclosed on October 21, 2026.
The company also plans a public token sale through Uniswap’s auction platform. Details are expected next week.
What Dataline actually does Dataline operates as a two-sided network. On one side are data providers, which contribute data feeds and fulfill custom requests from agents. On the other are AI agents that receive outputs that are schema-normalized and come with confidence scores attached.
The company says its network has processed 19.4 million on-chain transactions so far. It also reports a 96.4% success rate for agent tasks.
Dataline says the new capital will mainly go toward expanding its infrastructure. That infrastructure already supports a range of trading venues and blockchains.
On the chain side, the platform runs on BNB Chain, Sui and TON. On the venue side, it integrates with Hyperliquid, the perpetual futures exchange, and Polymarket, the prediction market platform.
From Tearline to Dataline, and the DLINE token The company was not always called Dataline. It operated as Tearline until May 12, 2026, when it rebranded.
Dataline counts Google for Startups Cloud and BNB Chain among its backers.
Central to the plan is a proposed token called DLINE. It is not yet live on the market.
According to the company, DLINE will serve as the economic engine of the network. It will be used for access, staking, rewards and slashing.
The token will have a total supply of 1 billion. The proposed allocation breaks down as follows:
33% for community rewards 30% for the ecosystem and foundation 13% for the launchpad and liquidity 12% for the team 12% for investors What this means for the AI agent data race The most immediate thing to watch is the token sale itself. Running it through Uniswap’s auction platform puts the launch on one of the best-known decentralized exchange brands in crypto.
Pricing mechanics, any vesting for the team and investor allocations, and how much supply actually hits the market at launch will shape how the token trades. None of that has been published yet, and the company says details are coming next week.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.
A series of security vulnerabilities have been disclosed in internet infrastructure software within a single day, affecting PHP, Node.js, and Go.
Multiple internet infrastructure software projects rolled out security updates in a single day, addressing vulnerabilities including remote code execution, TLS certificate validation bypass, and certificate trust risks. PHP fixed two critical flaws: CVE-2026-109618 and CVE-2026-109619, both enabling unauthenticated remote code execution that impacts PHP environments processing web requests. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node.js’ advisory details 10 vulnerabilities, four of which are high-severity: these include remote code execution via out-of-bounds write in the Brotli decoder, DNS name truncation, and two TLS certificate hostname validation bypass issues. Fixed versions are 26.12.1, 24.22.1, and 22.23.4. Additionally, Go’s crypto/x509-related risk is tracked as CVE-2026-111943, rated "Important" by Red Hat with a CVSS 3.1 score of 6.8. Attackers with specific network access and valid certificates could impersonate legitimate servers to intercept or alter communications. Go 1.26.10 and 1.27.3 have been added to a deny list, blocking trust for compromised intermediate certificates.
24 minutes ago
Trump plans to leverage White House cyber crime efforts to showcase achievements in combating cross-border crypto fraud.
White House officials said on October 21 that Trump planned to focus on the U.S. government’s actions to crack down on overseas crypto fraud rings during the White House’s cybersecurity event that day, including recovering funds and shutting down fraudulent operations. These transnational criminal groups steal funds from U.S. citizens via romance scams, phishing, ransomware and other methods. The U.S. government noted that law enforcement agencies have seized approximately $833 million in crypto assets linked to overseas fraud, and shut down 503 fraudulent crypto websites under the supervision of the Homeland Security Task Force. Relevant authorities have also notified nearly 9,000 U.S. citizens to alert them they are being targeted by fraud. The U.S. Treasury Department previously announced the establishment of an inter-agency "Fraud Strike Task Force" to target "pig butchering" scams run by organized criminal groups in Myanmar, Cambodia, Laos and the Philippines. Since last year, the U.S. has also imposed multiple sanctions aimed at cutting off support for related fraud websites and their infrastructure.
24 minutes ago
American Bankers Association voices dissatisfaction with OCC’s final GENIUS Act rule, which abandons proposed restrictions on stablecoin yields.
Crypto journalist Eleanor Terrett reported that the American Bankers Association (ABA) has voiced dissatisfaction with the final rules implemented by the U.S. Office of the Comptroller of the Currency (OCC) under the GENIUS Act. The OCC abandoned the previously proposed restrictions on stablecoin yields, a move the ABA argues will "maintain the status quo for crypto platforms." The ABA’s CEO stated: "It is a mistake to wait until deposit outflows and economic harm have already occurred before attempting to address these issues."
24 minutes ago
Beyond PHP, three Node.js version branches are also affected by high-severity vulnerabilities, and users need to update their runtime environments promptly.
Node.js rolled out a security update on October 21, covering its 26.x, 24.x, and 22.x version branches, with corresponding patched releases: 26.12.1, 24.22.1, and 22.23.4. The advisory details 10 total vulnerabilities, categorized as 4 critical-severity, 3 medium-severity, and 3 low-severity, with varying impact scopes across the three version lines. The critical CVE-2026-111497 is an out-of-bounds write flaw in the Brotli decoder that could enable remote code execution (RCE), affecting all three branches. Other critical issues include improper null character handling in DNS resolution and a TLS certificate hostname validation bypass. The update also resolves problems with persistent connection response processing, random number cache duplication, and permission models, while updating dependencies including c-ares, OpenSSL, and Undici. The official note warns that end-of-life (EOL) versions may still be vulnerable, advising users to use the latest supported releases. Separately, prior reports noted PHP has fixed two critical unauthenticated RCE vulnerabilities, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP users are urged to upgrade immediately.
24 minutes ago
Bonk Guy: This round is the "privacy cycle", privacy protocol MASK is undervalued.
Renowned trader Bonk Guy posted that the current crypto market is showing characteristics of a "privacy cycle". He noted that since yesterday, Bitcoin has risen approximately 3%, ZEC is up 16%, adding over $3 billion in market capitalization. MASK currently has a market cap of roughly $26 million, with its protocol trading volume and fees hitting consecutive all-time highs, he added. Citing data from DefiLlama, he stated that MASK ranks first among privacy protocols by revenue, outearning the next 10 privacy protocols combined. By comparison, ZEC’s market cap gain over the past 24 hours is roughly 115 times MASK’s entire market cap. Bonk Guy also said that MASK’s upcoming deployment on Solana is set to launch in the coming days, which he expects will further drive growth in usage, trading volume, and fees. He went on to call MASK the most undervalued privacy protocol in the crypto market.
24 minutes ago
Putin in principle has agreed to resume the trilateral peace talks between Russia, the United States and Ukraine, with Abu Dhabi a possible venue.
According to reports from Reuters and Axios, the Kremlin stated that Russian President Vladimir Putin told U.S. envoy Steve Witkoff on Wednesday he "agrees in principle" to resume trilateral peace talks between Russia, Ukraine and the U.S. around November 10 to end the Russia-Ukraine conflict, with the venue potentially in Abu Dhabi.
Witkoff held a three-hour meeting with Putin in St. Petersburg the same day, presenting the latest plan to end the Russia-Ukraine conflict. Trump envoy Jared Kushner joined the session via video.
Witkoff informed Putin that progress had been made in the Oslo talks, and expressed hope that both sides would consider restarting the Russia-U.S.-Ukraine trilateral negotiations and allow technical experts to participate in discussions on specific issues. He also submitted multiple documents on the peaceful resolution of the Russia-Ukraine conflict to Putin.
Separately, Putin raised with Witkoff the possibility of Russia acting as a mediator between the U.S. and Iran. Putin noted that Russia has decades of special trust relations with Iran and is willing to contribute to resolving the current crisis.
Internet Computer’s ICP price prediction is attracting attention as network activity rises and the chart outlines a possible route toward $15. The catch? ICP is still trading around $2.911 in the supplied chart, and its broader weekly structure remains bearish. Stronger network metrics are encouraging, but price still has a resistance ladder to climb.
ICP Price Prediction Starts With Network GrowthThe Internet Computer network’s finalization rate stands at 159.80 blocks per second, according to the data. Transactions have also climbed to 6,495 per second, up from below 4,500 last month. The project reports a presence across 33 countries, supported by 101 data centers.
Those figures point to growing network activity. Still, increased transactions and infrastructure don’t automatically guarantee stronger token demand or higher prices. Markets tend to demand more than promising statistics.
Reclaiming $4 Could Strengthen ICP’s RecoveryThe chart places ICP’s tentative base around $2.20–$2.60, with the current setup still awaiting confirmation. Reclaiming $3.50–$4 and holding the retest would strengthen the recovery case, putting the $5–$6 supply zone next in focus.
Beyond that, $7–$8 becomes the next major structural test. Buyers would then face resistance around $10–$12. Each level matters; skipping ahead to $15 ignores the hurdles directly overhead.
⚡ $ICP: THE $15 ESCAPE ROUTE 👀
ICP is testing a tentative base around $2.20–$2.60, while the broader weekly structure remains bearish.
Reclaiming $3.50–$4 and holding the retest would strengthen the recovery toward $5–$6 supply.
Above that, $7–$8 becomes the next structure… pic.twitter.com/pOUq6S09j9
— Giannis Andreou (@gandreou007) October 21, 2026 $15 Target Faces Historical SupplyThe longer-term bullish objective sits at $14–$16, a historical supply zone that includes the $15 target. From the displayed price of $2.911, reaching $15 would represent approximately 415% upside.
That’s substantial, but the previous trading range’s breakout doesn’t confirm another one is coming. The current base still needs to hold, and resistance must be reclaimed in sequence.
ICP Price Prediction Depends on Holding SupportA weekly close below $2.20 followed by a failed reclaim would invalidate the outlined setup and raise the risk of fresh lows. For now, the ICP price prediction rests on network growth translating into sustained market interest and price reclaiming successive resistance levels. The $15 objective remains a bullish scenario, not a confirmed destination.
Story Ends Here
Trust with CoinPedia:CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:All opinions and insights shared represent the author's own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Decentralized exchange PancakeSwap’s total value locked (TVL) grew nearly 19% over the past week, adding about $380 million as the protocol moves toward a major overhaul of how it distributes trading fees to liquidity providers.
According to DefiLlama, PancakeSwap’s TVL climbed to $2.4 billion on Wednesday, up from about $2.02 billion on Oct. 14. The increase was concentrated in its V3 liquidity pools, where TVL more than doubled to about $739 million from $336 million over the same period.
The growth coincided with PancakeSwap opening a governance vote on a proposal called “The Flip,” which would increase liquidity providers’ share of swap fees on V3 and Infinity pools to 88%, up from 66%-68% on most pools.
The proposal would also gradually reduce daily CAKE token emissions by approximately 69%, from 22,500 to 7,000 tokens. Voting opened on Wednesday, Oct. 21, and will run until Oct. 24, with implementation expected to begin in November if approved.
PancakeSwap leads BNB Chain trading as tokenized stocks expandPancakeSwap accounted for approximately $4.67 billion in decentralized exchange trading volume on BNB Chain over the past seven days, representing about 71% of the network’s total, according to DeFiLlama. The network also hosts most of PancakeSwap’s liquidity, accounting for roughly $2.33 billion of its $2.40 billion in TVL.
The activity comes amid broader growth across BNB Chain’s DeFi ecosystem. That network’s TVL climbed approximately 8.3% over the past seven days to $5.84 billion, according to DeFiLlama. Decentralized exchange trading volume also surged 40.2% to $6.54 billion over the same period, even as its stablecoin market capitalization declined 0.6% to $13.1 billion.
Beyond crypto, BNB Chain has also seen an expansion in tokenized equities, a market in which PancakeSwap has an established presence. The decentralized exchange began supporting Binance’s bStocks in June, allowing users to trade tokenized US stocks onchain.
On Oct. 15, Binance announced that bStocks surpassed $1 billion in assets under management, approximately four months after launching. The company reported more than $40 billion in cumulative trading volume and said 11.2% of bStocks’ value was deployed in DeFi in early October.
Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time
Solana’s first major consensus upgrade, Alpenglow, went live on mainnet around 1:54 pm UTC on Wednesday, according to the Solana Foundation’s Alpenglow dashboard.
Alpenglow seeks to reduce transaction finality by 99%, to roughly 150 milliseconds from about 12.8 seconds, according to the Solana Foundation’s July announcement.
The upgrade’s first phase, Votor, replaces the existing voting and finalization mechanism with direct validator voting and a certificate-based system designed to cut transaction finality to roughly 150 milliseconds. A later phase will introduce Rotor, a new block data-distribution protocol intended to replace Turbine.
Alpenglow is Solana’s first major consensus upgrade, replacing its current consensus model, TowerBFT. The upgrade’s 150-millisecond finality target seeks to introduce near-immediate transaction finality for users, which could mean faster payments, trade settlements and more responsive applications.
Cointelegraph has approached the Solana Foundation for comment on Alpenglow’s finality measurements in testnet environments and its expected performance in real-world applications.
At press time, the Solana mainnet showed a 6.6-second transaction finality and a throughput of 4,721 transactions per second, according to the Alpenglow dashboard.
Alpenglow marks “biggest change” for Solana’s core protocol: AnzaAlpenglow will introduce the “biggest change to Solana’s core protocol” since genesis, Anza researchers wrote in a May blog post.
A 150-millisecond latency, “Solana can compete with Web2 infrastructure in terms of responsiveness, potentially making blockchain technology viable for entirely new categories of applications,” wrote Anza researchers Quentin Kniep, Kobi Sliwinski and Roger Wattenhofer on May 19.
In August, Solana reduced its slot time for the first time since genesis, as part of the Solana Foundation’s plans to halve slot times to 200ms, arguing that it would improve latency and accelerate confirmations on the blockchain network. It completed the fourth stage of the slot reduction plan in October.
Following Alpenglow, Solana validators are expected to continue working on Agave 4.5, an upgrade that proposes increasing the number of accounts supported by a versioned transaction from 64 to 96. The increase could create better swap routes and execution prices, according to the Solana Foundation. The upgrade is currently in development and planned for December 2026.
SOL/USD, 1-year chart. Source: CoinMarketCap
The Solana (SOL) token’s price rose nearly 3% in the 24 hours leading up to the upgrade, reversing part of its 42% decline seen during the past year, according to CoinMarketCap.
Magazine: Solana’s fee overhaul increases burn and makes resource hogs pay
Solana’s first major consensus upgrade, Alpenglow, went live on mainnet around 1:54 pm UTC on Wednesday, according to the Solana Foundation’s Alpenglow dashboard.
Alpenglow seeks to reduce transaction finality by 99%, to roughly 150 milliseconds from about 12.8 seconds, according to the Solana Foundation’s July announcement.
The upgrade’s first phase, Votor, replaces the existing voting and finalization mechanism with direct validator voting and a certificate-based system designed to cut transaction finality to roughly 150 milliseconds. A later phase will introduce Rotor, a new block data-distribution protocol intended to replace Turbine.
Alpenglow is Solana’s first major consensus upgrade, replacing its current consensus model, TowerBFT. The upgrade’s 150-millisecond finality target seeks to introduce near-immediate transaction finality for users, which could mean faster payments, trade settlements and more responsive applications.
Cointelegraph has approached the Solana Foundation for comment on Alpenglow’s finality measurements in testnet environments and its expected performance in real-world applications.
At press time, the Solana mainnet showed a 6.6-second transaction finality and a throughput of 4,721 transactions per second, according to the Alpenglow dashboard.
Alpenglow marks “biggest change” for Solana’s core protocol: AnzaAlpenglow will introduce the “biggest change to Solana’s core protocol” since genesis, Anza researchers wrote in a May blog post.
A 150-millisecond latency, “Solana can compete with Web2 infrastructure in terms of responsiveness, potentially making blockchain technology viable for entirely new categories of applications,” wrote Anza researchers Quentin Kniep, Kobi Sliwinski and Roger Wattenhofer on May 19.
In August, Solana reduced its slot time for the first time since genesis, as part of the Solana Foundation’s plans to halve slot times to 200ms, arguing that it would improve latency and accelerate confirmations on the blockchain network. It completed the fourth stage of the slot reduction plan in October.
Following Alpenglow, Solana validators are expected to continue working on Agave 4.5, an upgrade that proposes increasing the number of accounts supported by a versioned transaction from 64 to 96. The increase could create better swap routes and execution prices, according to the Solana Foundation. The upgrade is currently in development and planned for December 2026.
SOL/USD, 1-year chart. Source: CoinMarketCap
The Solana (SOL) token’s price rose nearly 3% in the 24 hours leading up to the upgrade, reversing part of its 42% decline seen during the past year, according to CoinMarketCap.
Magazine: Solana’s fee overhaul increases burn and makes resource hogs pay
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Solana's largest consensus upgrade since the network launched in 2020 brings sub-second, deterministic finality
, /PRNewswire/ -- Anza, the leading core engineering team behind Solana, today announced that Alpenglow, Solana's new consensus protocol that brings finality down to sub-second speed, is live on Solana mainnet-beta. As Solana powers internet capital markets and increasingly becomes the infrastructure for financial applications, Alpenglow delivers the deterministic settlement speed that traditional finance requires. Transactions now become irreversible in about 150 milliseconds, down from 12.8 seconds.
At slot 459,653,000 on Wednesday October 21st at ~14:00 UTC, Solana's validators retired TowerBFT, the consensus protocol the network has run since its launch in March 2020. Migration was completed on the live Solana network.
The change is to finality, the point at which a transaction can no longer be reversed. It is what an exchange, a bank, or a merchant waits for before treating an asset as moved. For most of Solana's history, that finality took about 12.8 seconds whereas a conditional confirmation was provided within seconds. Alpenglow is designed to deliver the previous two step path condensed to one in roughly 150 milliseconds, about the length of a blink. Bringing finality assurance from seconds to a fraction of a second makes payment and trading applications even more responsive. For merchants accepting payments or exchanges crediting deposits, it means an even better user experience.
"This is the largest, most ambitious blockchain upgrade since 'The Merge' and Anza took it from a white paper to running on mainnet in under 18 months," said Brennan Watt, CEO, Anza. "This aggressive timeline was only possible because of the caliber of our development team and the incredible cast of ecosystem teams and validator operators that helped harden the protocol over the last several months."
The engineering achievement extends beyond speed. Validators replaced the consensus system at the heart of a running blockchain while carrying its existing ledger forward. Independent operators coordinated a shared handoff point from the previous protocol, TowerBFT, to Alpenglow, while maintaining availability.
Before reaching mainnet, Alpenglow underwent public testing – including red teaming and penetration testing, repeated migration rehearsals, and security competition. It was then launched on Solana's testnet and devnet. Anza developed the protocol and implemented it in Agave, the validator software it maintains; while independent validator operators adopted and activated the upgrade.
The Solana blockchain has no single operator. Anza is one of several independent teams that build software for the network. Its research team, led by ETH Zurich professor Roger Wattenhofer with Quentin Kniep and Kobi Sliwinski, published the Alpenglow design in May 2025.
Looking forward, there are additional Alpenglow related improvements to come. Rotor changes how block data spreads across the network. Geographically aware leader rotations help reduce the handoff latency between leaders. Quantumglow levels up Alpenglow for post-quantum security. It's a research design from Anza that swaps Alpenglow's elliptic-curve cryptography for hash-based signatures while keeping the same finality speed. These are planned for later releases and have no committed date yet. Status and technical details are at anza.xyz/alpenglow.
About Anza
Anza engineers Solana, shipping the software that pushes the boundaries of blockchain performance and scale. Founded by core Solana Labs engineers, Anza builds and maintains the software that validators run, researches the next generation of the protocol, and works with the ecosystem to roll out upgrades on a live network. Learn more at www.anza.xyz.
Anza is also working on further protocol changes, including Rotor, which would improve block propagation.
Solana Solana (SOL) validators replaced the network’s original consensus protocol on Wednesday, cutting transaction finality to milliseconds in a live-network upgrade.
In a statement shared with The Block, Solana core engineering firm Anza said its Alpenglow consensus protocol reached mainnet-beta at slot 459,653,000 at approximately 14:00 UTC. The deployment retires TowerBFT, the consensus protocol Solana had operated since its March 2020 launch.
The protocol shift condenses Solana's previous two-step transaction confirmation process into a single step, bringing finality down from 12.8 seconds to about 150 milliseconds for exchanges crediting deposits and merchants processing payments, according to Anza.
"This is the largest, most ambitious blockchain upgrade since 'The Merge,' and Anza took it from a white paper to running on mainnet in under 18 months," Anza CEO Brennan Watt said.
Anza first published the Alpenglow design in May 2025. It said the upgrade underwent public testing, which included red teaming, penetration testing, repeated migration rehearsals, and a security competition before the mainnet deployment.
Notably, the team outlined several further changes, though none have a confirmed release date. Rotor would change how block data moves across the network, while geographically aware leader rotations are intended to reduce delays between block producers, Anza said.
A separate research design, Quantumglow, would replace Alpenglow’s elliptic-curve cryptography with hash-based signatures to address post-quantum security while preserving its finality speed, according to the statement.
Jump Crypto’s Firedancer team proposed removing Solana’s 60 million compute-unit block limit in September 2025, after the planned Alpenglow upgrade. Proposal SIMD-0370 would let block capacity scale with validator hardware, rather than remain capped at a fixed limit.
A series of security vulnerabilities have been disclosed in internet infrastructure software within a single day, affecting PHP, Node.js, and Go.
Multiple internet infrastructure software projects rolled out security updates in a single day, addressing vulnerabilities including remote code execution, TLS certificate validation bypass, and certificate trust risks. PHP fixed two critical flaws: CVE-2026-109618 and CVE-2026-109619, both enabling unauthenticated remote code execution that impacts PHP environments processing web requests. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node.js’ advisory details 10 vulnerabilities, four of which are high-severity: these include remote code execution via out-of-bounds write in the Brotli decoder, DNS name truncation, and two TLS certificate hostname validation bypass issues. Fixed versions are 26.12.1, 24.22.1, and 22.23.4. Additionally, Go’s crypto/x509-related risk is tracked as CVE-2026-111943, rated "Important" by Red Hat with a CVSS 3.1 score of 6.8. Attackers with specific network access and valid certificates could impersonate legitimate servers to intercept or alter communications. Go 1.26.10 and 1.27.3 have been added to a deny list, blocking trust for compromised intermediate certificates.
19 minutes ago
Dataline completes $10.6 million seed round funding, and plans to conduct an ICO.
Decentralized data network for AI agents Dataline has closed a $10.6 million seed round, co-led by Lattice and Samsung-backed Dispersion Capital, with participation from Symbolic Capital, Coinbase Ventures, Anagram, and Robinhood co-founder & CEO Vlad Tenev, among others. The round, completed in April, utilized a SAFE agreement with token warrants; valuation was not disclosed. Dataline is now live, covering approximately 50 data sources to deliver on-chain and off-chain data, and scores data reliability, timeliness, and consistency using AI. Proceeds will be allocated to expanding data sources, enhancing data validation, and expanding into robotics, AI training data, and other sectors. Dataline plans to launch a token by the end of 2026 for network payments and data access, and intends to conduct a public token sale on Base via Uniswap’s Continuous Clearing Auction (CCA) system, with details set to be revealed next week. The public sale’s target fundraising amount, token quantity, and other terms remain undisclosed.
19 minutes ago
Trump plans to leverage White House cyber crime efforts to showcase achievements in combating cross-border crypto fraud.
White House officials said on October 21 that Trump planned to focus on the U.S. government’s actions to crack down on overseas crypto fraud rings during the White House’s cybersecurity event that day, including recovering funds and shutting down fraudulent operations. These transnational criminal groups steal funds from U.S. citizens via romance scams, phishing, ransomware and other methods. The U.S. government noted that law enforcement agencies have seized approximately $833 million in crypto assets linked to overseas fraud, and shut down 503 fraudulent crypto websites under the supervision of the Homeland Security Task Force. Relevant authorities have also notified nearly 9,000 U.S. citizens to alert them they are being targeted by fraud. The U.S. Treasury Department previously announced the establishment of an inter-agency "Fraud Strike Task Force" to target "pig butchering" scams run by organized criminal groups in Myanmar, Cambodia, Laos and the Philippines. Since last year, the U.S. has also imposed multiple sanctions aimed at cutting off support for related fraud websites and their infrastructure.
19 minutes ago
American Bankers Association voices dissatisfaction with OCC’s final GENIUS Act rule, which abandons proposed restrictions on stablecoin yields.
Crypto journalist Eleanor Terrett reported that the American Bankers Association (ABA) has voiced dissatisfaction with the final rules implemented by the U.S. Office of the Comptroller of the Currency (OCC) under the GENIUS Act. The OCC abandoned the previously proposed restrictions on stablecoin yields, a move the ABA argues will "maintain the status quo for crypto platforms." The ABA’s CEO stated: "It is a mistake to wait until deposit outflows and economic harm have already occurred before attempting to address these issues."
19 minutes ago
Beyond PHP, three Node.js version branches are also affected by high-severity vulnerabilities, and users need to update their runtime environments promptly.
Node.js rolled out a security update on October 21, covering its 26.x, 24.x, and 22.x version branches, with corresponding patched releases: 26.12.1, 24.22.1, and 22.23.4. The advisory details 10 total vulnerabilities, categorized as 4 critical-severity, 3 medium-severity, and 3 low-severity, with varying impact scopes across the three version lines. The critical CVE-2026-111497 is an out-of-bounds write flaw in the Brotli decoder that could enable remote code execution (RCE), affecting all three branches. Other critical issues include improper null character handling in DNS resolution and a TLS certificate hostname validation bypass. The update also resolves problems with persistent connection response processing, random number cache duplication, and permission models, while updating dependencies including c-ares, OpenSSL, and Undici. The official note warns that end-of-life (EOL) versions may still be vulnerable, advising users to use the latest supported releases. Separately, prior reports noted PHP has fixed two critical unauthenticated RCE vulnerabilities, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP users are urged to upgrade immediately.
19 minutes ago
Bonk Guy: This round is the "privacy cycle", privacy protocol MASK is undervalued.
Renowned trader Bonk Guy posted that the current crypto market is showing characteristics of a "privacy cycle". He noted that since yesterday, Bitcoin has risen approximately 3%, ZEC is up 16%, adding over $3 billion in market capitalization. MASK currently has a market cap of roughly $26 million, with its protocol trading volume and fees hitting consecutive all-time highs, he added. Citing data from DefiLlama, he stated that MASK ranks first among privacy protocols by revenue, outearning the next 10 privacy protocols combined. By comparison, ZEC’s market cap gain over the past 24 hours is roughly 115 times MASK’s entire market cap. Bonk Guy also said that MASK’s upcoming deployment on Solana is set to launch in the coming days, which he expects will further drive growth in usage, trading volume, and fees. He went on to call MASK the most undervalued privacy protocol in the crypto market.
In brief Solana's new Alpenglow consensus protocol has gone live on mainnet-beta, replacing TowerBFT at slot 459,653,000, core developer Anza said. Transactions now become irreversible in about 150 milliseconds, down from 12.8 seconds, which Anza says matters for exchanges, banks and merchants. Further upgrades, including a post-quantum version called Quantumglow, are planned but have no committed dates. Solana's largest consensus upgrade since the network launched in 2020 went live on Wednesday, cutting the time it takes for a transaction to become irreversible from about 12.8 seconds to roughly 150 milliseconds, core engineering team Anza said.
Validators retired TowerBFT, the consensus protocol Solana had used since March 2020, at slot 459,653,000 at around 14:00 UTC. They switched systems on the running network while carrying its existing ledger forward, with independent operators coordinating a shared handoff point.
The change is to finality, the point at which a transaction can no longer be reversed and the moment an exchange, bank or merchant waits for before treating an asset as moved. Under TowerBFT, Solana gave a conditional confirmation within seconds but took about 12.8 seconds to reach full finality. Alpenglow condenses those two steps into one.
"This is the largest, most ambitious blockchain upgrade since 'The Merge' and Anza took it from a white paper to running on mainnet in under 18 months," said Anza CEO Brennan Watt, referring to Ethereum's 2022 switch to proof of stake.
Before reaching mainnet, Alpenglow went through public testing, including red teaming, penetration testing, repeated migration rehearsals and a security competition, followed by launches on Solana's testnet and devnet. Anza implemented the protocol in Agave, the validator software it maintains, and independent validators activated it.
Anza's research team, led by ETH Zurich professor Roger Wattenhofer with Quentin Kniep and Kobi Sliwinski, published the Alpenglow design in May 2025.
Under Alpenglow, validators send their votes directly to each other instead of writing them into later blocks, and votes are weighted by stake. "If you have 80% of the votes say yes, then it's immediately done," Wattenhofer, Anza's head of research, said in an interview with Solana Foundation technology vice president Jacob Creech published last month. "You immediately know that the block is final."
A second route, two rounds of voting that each need 60% of stake, can be even quicker for validators clustered close together, such as in Europe, he explained. The protocol is designed to keep working with less than 20% of stake acting maliciously and a further 20% offline. If the network goes 10 seconds without finalizing a block, validators gradually lengthen block times until messages get through. "Eventually, even a bad internet will give us a block again," Wattenhofer said.
More upgrades are planned. Rotor will change how block data spreads across the network, and geographically aware leader rotation aims to cut delays as block production passes between validators. Quantumglow, a research design, would swap Alpenglow's elliptic-curve cryptography for hash-based signatures to make it secure against quantum computers while keeping the same finality speed. None has a committed date.
Myriad: Where does Solana go next? Click to make your prediction.Alpenglow's road to mainnetValidators approved the upgrade in September 2025, voting 98% in favor of SIMD-0236, the proposal that implements it. "The biggest difference users will feel right away will be a reduction in confirmation latency to approximately 150-200ms," Anza lead economist Max Resnick told Decrypt at the time.
Alpenglow went live on Solana's community test cluster in May 2026, when Resnick said the team was targeting a mainnet activation in late Q3 or early Q4. On October 13, Anza confirmed the October 21 date.
The upgrade also opens the door to other changes. Developers at Jump Crypto's Firedancer team have proposed scrapping Solana's cap of 60 million compute units per block once Alpenglow is live, letting blocks grow as large as the fastest validators can handle while slower ones use its "skip vote" feature to abstain. Critics warned the change could favor well-funded operators and increase centralization.
Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers
Create an account to save your articles.
Add on Google
Add Decrypt as your preferred source to see more of our stories on Google.
Onchain data puts the handover at about 13:54 UTC on Wednesday, and the Solana and Anza accounts say finality now takes roughly 150 milliseconds.
Solana switches its mainnet to the Alpenglow consensus protocol
Posted October 21, 2026 at 11:40 am ET.
Solana moved its mainnet onto the Alpenglow consensus protocol on Wednesday, retiring TowerBFT, the voting system the network had used since 2020. “Alpenglow is now live on Solana mainnet,” the official Solana account posted at 13:59 UTC. Anza, the developer that built the protocol, had declared it live five minutes earlier.
The chain itself records the switch. Unchained’s queries of Solana’s public mainnet RPC show the final TowerBFT-era block, slot 459,652,999, stamped at about 13:54:00 UTC, and the network’s Alpenglow genesis certificate points to that block. Eight slots then passed with no block before slot 459,653,008 arrived at 13:54:03 UTC. Block heights continued in sequence, with no sign of a rollback.
That timing beat Anza’s own estimates. The team first set the switch for about 14:50 UTC, the date Unchained reported on Oct. 14, and, according to Solana Compass, later pulled its projection forward to around 14:00 UTC.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
The 150 Millisecond Claim
Both announcements put a number on the change. Anza wrote that finality was “reduced from 12.8 seconds to 150 milliseconds,” and the Solana account said the same.
The 12.8-second figure reflects Solana’s earlier 400 millisecond slots, and the Solana Foundation says slot times have since been cut to 200 milliseconds. Galaxy, which runs Solana validators, wrote in a pre-launch explainer that finality had come down to roughly 6 seconds under the shorter slots.
What Changes for Validators
Under Alpenglow, validators no longer submit votes as transactions. Votes now travel between nodes as BLS-signed messages that are aggregated into certificates, freeing blockspace for users. A block can be finalized in one round if 80% of stake votes for it, or in two rounds at 60%.
The design is meant to keep working with up to 20% of stake acting maliciously and another 20% offline. In place of per-vote fees, each voting validator now pays a flat 0.8 SOL per epoch. Galaxy has noted that vote transactions made up roughly three quarters of Solana’s traffic, and the Solana Foundation expects reported transaction counts and TPS to drop sharply.
Wednesday’s switch covers Votor, the voting half of the design. Rotor, which would replace Turbine’s block propagation, is slated for a later phase with no date set.
Related Listen: How Mike Dudas Ranks ETH, SOL, and Hyperliquid in a Down Market
AI-assisted content: This article was produced with the assistance of AI tools and was reviewed, edited, and fact-checked by a member of the Unchained editorial team before publication.
Crypto asset manager Grayscale continues to take innovative steps regarding cryptocurrencies. In its latest announcement, Grayscale stated that it will allow investors to invest in spot cryptocurrencies like Bitcoin directly in exchange for shares in its ETFs and other investment products.
Accordingly, Grayscale has implemented an in-kind subscription model in 10 of its products, allowing investors to exchange eligible digital assets for direct investment product shares. The new model aims to facilitate the integration of crypto assets into traditional portfolio management.
The Need for Cash Conversion is Decreasing!
Grayscale has announced a new investment method for some of its investment products. This system allows investors to directly exchange their crypto assets for shares in Grayscale’s investment products without first having to convert them to cash.
The company stated that this method could reduce operational burdens stemming from custody and security processes, lower transaction costs in crypto markets, and facilitate the inclusion of digital assets in traditional investment portfolios.
10 Cryptocurrencies, Including Bitcoin and Ethereum, on the List!
According to Grayscale, the subscription service includes 10 investment products, including Bitcoin and Ethereum: “Bitcoin, Ethereum, Avalanche, Chainlink, Dogecoin, Hyperliquid, Solana, XRP, Sui, Zcash”
“Grayscale Bitcoin Mini Trust ETF (BTC)
Grayscale Ethereum Staking Mini ETF (ETH)
Grayscale Avalanche Staking ETF (GAVA)
Grayscale Chainlink Trust ETF (GLNK)
Grayscale Dogecoin Trust ETF (GDOG)
Grayscale Hyperliquid Staking ETF (HYPG)
Grayscale Solana Staking ETF (GSOL)
Grayscale Sui Staking ETF (GSUI)
Grayscale XRP Trust ETF (GXRP)
The Zcash ETF (ZCSH)”
Finally, according to Grayscale’s statement, the service is available to eligible investors. Clients wishing to trade on the primary market must work with authorized participants or the institutions that act as intermediaries for these participants.
*This is not investment advice.
Follow our Telegram and X account now for exclusive news, analytics and on-chain data!
Collector Crypt, a Solana platform for tokenized Pokémon and other trading cards, has recorded 106,023 daily pack openings and more than $22 million in gross revenue, according to Moonrock Capital founder Simon Dedic.
Summary
Collector Crypt logged 106,023 daily pack openings and over $22 million in gross revenue, Dedic said. Wallets holding at least one tokenized collectible passed 20,000, according to Blockworks charts. Dedic credited Pump.fun distribution with lifting daily activity above 6,200, alongside 49 API partners. Physical card redemption requires holders to burn the corresponding NFT and pay shipping costs. Simon Dedic said the daily total was twice the platform’s previous record, accompanying his post with Blockworks charts tracking pack openings, partner spending, collectible holders and active addresses.
The Solana collectibles platform passed 20,000 unique wallets holding at least one tokenized collectible, according to his post. Daily activity reached more than 6,200, compared with the roughly 1,000 daily users he said the platform had averaged for months.
Collector Crypt pack openings reach a daily record In his post, Dedic described the 106,023 openings as “2x their previous record” and attributed more than $22 million in gross revenue to the day’s activity.
The Blockworks pack-opening chart shows the latest daily bar standing well above earlier peaks. Its breakdown covers Pokémon packs across multiple price levels, alongside One Piece packs and other categories. Pokémon prices listed in the chart range from $25 to $5,000.
The reported opening count therefore covers the platform’s pack activity, rather than a verified total of Pokémon-only purchases. Dedic’s revenue figure is described as gross revenue, with no accompanying calculation of profit or revenue remaining after card buybacks and other costs.
Dedic credited Pump.fun with driving more activity and said revenue from partner integrations hit a record.
His post put the number of partners building on Collector Crypt’s application programming interface at 49. The Blockworks partner chart tracks spending through services including Pump.fun, Jupiter, Magic Eden, Solflare and Slabz, with its latest daily bar reaching roughly $7.5 million.
Collector Crypt’s developer guide says other apps can use its API to sell mystery packs, send NFTs to buyers and buy back eligible cards for USDC. The documented flow includes a standard $50 pack, although the company supports other pack types.
Holder wallets pass 20,000 as activity climbs Blockworks’ holder chart shows more than 20,000 wallets with at least one tokenized collectible. Its methodology note excludes Gachapon wallets.
A separate line tracks wallets holding more than one collectible and ends below 10,000. Both lines rose through 2026, with the chart showing faster growth in the second half of the year.
The active-address chart places the latest daily reading around 6,200, above an earlier peak near 2,000. Its colored segments group addresses by lifetime spending, from $50 or less to more than $1 million.
Dedic linked the jump to Pump.fun’s distribution, describing activity as six times the level that had persisted for months. The figures count wallet activity, however, and do not establish how many separate people used the platform.
His post paired those operating figures with a claim that CARDS, the platform’s token, remained below its Sept. 14, 2025, all-time high. He characterized the platform’s fundamentals as having grown twentyfold since then, without identifying a single measure behind that comparison.
Raydium said Collector Crypt had recorded more than $70 million in Pokémon pack sales by September 2025.
Physical cards remain vaulted until redemption Collector Crypt’s deposit instructions say users must submit graded cards, with sealed submissions excluded. After the company receives, inspects, and vaults a card, it issues an NFT representing that item. The instructions list no deposit charge.
The company’s withdrawal guide describes the reverse process. A holder starts a withdrawal, pays shipping costs, and burns the corresponding NFT before the physical card is shipped.
Shipping can be paid by credit card, crypto, or USDC, according to the guide. Cards held in partner vaults can take longer to ship.
Selling a card back through the pack system follows a different process. Collector Crypt’s API documentation says an eligible NFT can be returned for a percentage of its insured value in USDC, provided it was distributed by the gacha system within the previous 72 hours and has not already received a confirmed buyback.
The same documentation describes a turbo setting that automatically sells common-tier prizes back for USDC. Individual machines have their own prize odds, which developers are instructed to retrieve from the live machine data.
Coinbase and OpenSea expand collectible access Coinbase previewed physical Pokémon card packs in September, telling users they would be able to open packs on their phones and choose whether to vault or ship the cards.
“Every pull backed by a real, physical card,” the company said in its Sept. 28 teaser. At that announcement, Coinbase gave no firm launch date, pricing, storage location, or list of eligible markets.
OpenSea included Collector Crypt in its Solana NFT trading rollout announced Aug. 31. The release let users browse, buy, sell and bid on supported Solana collections through OS2.
Mad Lads, Claynosaurz and Phygitals were among the other collections named in that launch, which followed OS2’s existing support for fungible Solana tokens.
A series of security vulnerabilities have been disclosed in internet infrastructure software within a single day, affecting PHP, Node.js, and Go.
Multiple internet infrastructure software projects rolled out security updates in a single day, addressing vulnerabilities including remote code execution, TLS certificate validation bypass, and certificate trust risks. PHP fixed two critical flaws: CVE-2026-109618 and CVE-2026-109619, both enabling unauthenticated remote code execution that impacts PHP environments processing web requests. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node.js’ advisory details 10 vulnerabilities, four of which are high-severity: these include remote code execution via out-of-bounds write in the Brotli decoder, DNS name truncation, and two TLS certificate hostname validation bypass issues. Fixed versions are 26.12.1, 24.22.1, and 22.23.4. Additionally, Go’s crypto/x509-related risk is tracked as CVE-2026-111943, rated "Important" by Red Hat with a CVSS 3.1 score of 6.8. Attackers with specific network access and valid certificates could impersonate legitimate servers to intercept or alter communications. Go 1.26.10 and 1.27.3 have been added to a deny list, blocking trust for compromised intermediate certificates.
19 minutes ago
Dataline completes $10.6 million seed round funding, and plans to conduct an ICO.
Decentralized data network for AI agents Dataline has closed a $10.6 million seed round, co-led by Lattice and Samsung-backed Dispersion Capital, with participation from Symbolic Capital, Coinbase Ventures, Anagram, and Robinhood co-founder & CEO Vlad Tenev, among others. The round, completed in April, utilized a SAFE agreement with token warrants; valuation was not disclosed. Dataline is now live, covering approximately 50 data sources to deliver on-chain and off-chain data, and scores data reliability, timeliness, and consistency using AI. Proceeds will be allocated to expanding data sources, enhancing data validation, and expanding into robotics, AI training data, and other sectors. Dataline plans to launch a token by the end of 2026 for network payments and data access, and intends to conduct a public token sale on Base via Uniswap’s Continuous Clearing Auction (CCA) system, with details set to be revealed next week. The public sale’s target fundraising amount, token quantity, and other terms remain undisclosed.
19 minutes ago
Trump plans to leverage White House cyber crime efforts to showcase achievements in combating cross-border crypto fraud.
White House officials said on October 21 that Trump planned to focus on the U.S. government’s actions to crack down on overseas crypto fraud rings during the White House’s cybersecurity event that day, including recovering funds and shutting down fraudulent operations. These transnational criminal groups steal funds from U.S. citizens via romance scams, phishing, ransomware and other methods. The U.S. government noted that law enforcement agencies have seized approximately $833 million in crypto assets linked to overseas fraud, and shut down 503 fraudulent crypto websites under the supervision of the Homeland Security Task Force. Relevant authorities have also notified nearly 9,000 U.S. citizens to alert them they are being targeted by fraud. The U.S. Treasury Department previously announced the establishment of an inter-agency "Fraud Strike Task Force" to target "pig butchering" scams run by organized criminal groups in Myanmar, Cambodia, Laos and the Philippines. Since last year, the U.S. has also imposed multiple sanctions aimed at cutting off support for related fraud websites and their infrastructure.
19 minutes ago
American Bankers Association voices dissatisfaction with OCC’s final GENIUS Act rule, which abandons proposed restrictions on stablecoin yields.
Crypto journalist Eleanor Terrett reported that the American Bankers Association (ABA) has voiced dissatisfaction with the final rules implemented by the U.S. Office of the Comptroller of the Currency (OCC) under the GENIUS Act. The OCC abandoned the previously proposed restrictions on stablecoin yields, a move the ABA argues will "maintain the status quo for crypto platforms." The ABA’s CEO stated: "It is a mistake to wait until deposit outflows and economic harm have already occurred before attempting to address these issues."
19 minutes ago
Beyond PHP, three Node.js version branches are also affected by high-severity vulnerabilities, and users need to update their runtime environments promptly.
Node.js rolled out a security update on October 21, covering its 26.x, 24.x, and 22.x version branches, with corresponding patched releases: 26.12.1, 24.22.1, and 22.23.4. The advisory details 10 total vulnerabilities, categorized as 4 critical-severity, 3 medium-severity, and 3 low-severity, with varying impact scopes across the three version lines. The critical CVE-2026-111497 is an out-of-bounds write flaw in the Brotli decoder that could enable remote code execution (RCE), affecting all three branches. Other critical issues include improper null character handling in DNS resolution and a TLS certificate hostname validation bypass. The update also resolves problems with persistent connection response processing, random number cache duplication, and permission models, while updating dependencies including c-ares, OpenSSL, and Undici. The official note warns that end-of-life (EOL) versions may still be vulnerable, advising users to use the latest supported releases. Separately, prior reports noted PHP has fixed two critical unauthenticated RCE vulnerabilities, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP users are urged to upgrade immediately.
19 minutes ago
Putin in principle has agreed to resume the trilateral peace talks between Russia, the United States and Ukraine, with Abu Dhabi a possible venue.
According to reports from Reuters and Axios, the Kremlin stated that Russian President Vladimir Putin told U.S. envoy Steve Witkoff on Wednesday he "agrees in principle" to resume trilateral peace talks between Russia, Ukraine and the U.S. around November 10 to end the Russia-Ukraine conflict, with the venue potentially in Abu Dhabi.
Witkoff held a three-hour meeting with Putin in St. Petersburg the same day, presenting the latest plan to end the Russia-Ukraine conflict. Trump envoy Jared Kushner joined the session via video.
Witkoff informed Putin that progress had been made in the Oslo talks, and expressed hope that both sides would consider restarting the Russia-U.S.-Ukraine trilateral negotiations and allow technical experts to participate in discussions on specific issues. He also submitted multiple documents on the peaceful resolution of the Russia-Ukraine conflict to Putin.
Separately, Putin raised with Witkoff the possibility of Russia acting as a mediator between the U.S. and Iran. Putin noted that Russia has decades of special trust relations with Iran and is willing to contribute to resolving the current crisis.
Introducing Seeker Connect: a dApp-side SDK that gives your users a named, branded, one-tap connection to the Seeker wallet from mobile web, PWA’s and native apps. It ships today with full documentation, agent skills, a video integration guide, and working example apps.
Here’s everything you need to start building:
What Is Seeker Connect?Seeker Connect is a developer SDK for connecting Solana mobile web apps to the Seeker wallet in a single tap. It is built on top of the latest Mobile Wallet Adapter (MWA) libraries, and it ships two connection methods:
Standard wallet listing that appears in the wallet picker you already have
Branded "Connect with Seeker" button that skips the picker entirely
The Problem It SolvesConnecting through Mobile Wallet Adapter today means your user taps a generic "Mobile Wallet Adapter" option, then picks their wallet from a second screen. This requires two taps from users, and places a protocol name where a wallet name should be.
Seeker Connect collapses that into one tap on a button the user recognizes, without giving up compatibility with any other wallet.
Seeker Connect runs on Mobile Wallet Adapter’s brand new transport over Nostr relays. Your dApp and the wallet meet on a Nostr relay that Solana Mobile operates, instead of connecting over a local websocket connection directly to the wallet. In standard MWA, Chromium browsers like Chrome, Brave, and Edge ask the user for permission to access local devices before the dApp can reach the wallet. If the user denies that prompt, the connection fails, and getting it back means finding the right setting in the browser's site permissions. With Seeker Connect, the user taps connect, approves in their wallet, and lands back in the dApp with no browser prompt in between. This works on all chromium based browsers while avoiding the UX problems presented by the local websocket connections normally used by MWA.
How Seeker Connect WorksSeeker Connect sits on top of the official MWA libraries and uses the MWA specification's existing endpoint-specific URI mechanism to target the device's own wallet directly and improve UX.
Other wallets keep working exactly as they do now so your existing MWA integration does not break. Session traffic use Nostr relays that Solana Mobile operates, which means there is no infrastructure to stand up and nothing for you to host.
Option 1: The Branded Connect ButtonDrop in the "Connect with Seeker" button and skip the picker entirely. This is the opinionated, one-tap path, and it is the one that converts. There is a sign-in variant for Sign-In With Solana flows, it themes itself to light or dark pages automatically, and it renders isolated from your page styles so it looks the same in every app that ships it.
Option 2: The Standard Wallet ListingRegister Seeker Connect and it appears in your existing wallet picker with its own name and icon. If your app uses Wallet Standard — which covers most of the React and web stack — this is a single function call at startup and nothing else in your app changes. It is the lowest-lift way to adopt.
What the SDK Handles For YouSeeker Connect takes care of the parts of mobile wallet integration that are easy to get wrong.
Sessions persist across reloads without launching the wallet. MWA sessions are per-interaction by design, so continuity comes from the auth token issued at authorization. The SDK caches that token, which means a returning user lands in your app already connected and the wallet never flashes on screen. Disconnect works in reverse and forgets the token locally rather than launching the wallet just to say goodbye.
The connection UI is owned end-to-end. The progress overlay and error dialogs shown during a connection ship with the SDK, so the interaction looks and feels like one deliberate flow to users.
Failures come back typed. There are distinct cases for a user declining in the wallet, a user dismissing the sheet, and a relay or association problem, so you can retry the ones worth retrying and stop showing error states for choices the user made deliberately.
The full signing surface is supported. Sign message, sign transaction, sign and send, and SIWS all work, with transaction capabilities reported by the connected wallet rather than assumed.
What's in the DocumentationThe new Seeker Connect docs section at https://docs.solanamobile.com/solana-mobile-stack/seeker-connect covers:
Integrating the standard wallet listing
Embedding and configuring the branded connect button
Relay configuration
Session persistence and reconnection
Error handling reference
Migration guidance for apps already on Mobile Wallet Adapter
If you would rather watch someone do it first, check out Beeman’s developer video walkthrough here.
Frequently Asked QuestionsDoes Seeker Connect replace Mobile Wallet Adapter? No. It is an opinionated layer on top of the official MWA libraries and uses the MWA spec's existing mechanisms. MWA remains the protocol, and Seeker Connect is a UX layer over it. Seeker Connect is built on our new relay architecture, which was recently added to MWA. From a user perspective, Seeker Connect replaces MWA references in the UI.
Will my app still work with other Solana wallets? Yes. Adopting Seeker Connect does not remove or degrade support for any other wallet. Most apps will run the branded button alongside their existing picker.
Do I need to run any infrastructure? No. Solana Mobile operates the Nostr relays that handle session traffic. But you can if you want! MWA (and by extension Seeker Connect) is designed to be decentralized — it does not rely on any one centralized party to operate.
Which platforms are supported today? Native Android, React Native, and Mobile Web.
How long does integration take? If your app already uses Wallet Standard, adding the wallet listing is a single registration call at startup and requires no other changes to your app. The step-by-step integration guide is in the docs here.
Does it work with WalletConnect or Privy? Integration samples for both are on the roadmap but are not yet implemented. Apps using a standard wallet picker will see Seeker Connect listed today.
Start BuildingRead the docs on the Solana Mobile Docs site, watch the developer guide on youtube, and grab the SDK and example dApp on github. Questions and integration help are in the Solana Mobile Discord and Telegram.
If you are already shipping on Seeker, the wallet listing is one of the smallest changes on your backlog with a direct effect on your connection funnel.
New to building on Solana Mobile? Start with the developer documentation at docs.solanamobile.com, or apply for Solana Mobile Builder Grants to get funded, get users, and get your app in front of 100,000+ active Seeker device owners.
Grayscale, recognized as the largest digital asset investment platform by assets under management as of September 2026, has introduced a feature named in-kind transfers. This new service allows eligible investors to directly exchange digital assets they already hold for shares in 10 different Grayscale exchange-traded products (ETPs), without the need to liquidate their cryptocurrencies for cash beforehand.
In-kind transfers bring operational efficienciesThe in-kind transfer process is designed to streamline how clients allocate their existing cryptocurrency holdings into traditional investment vehicles. Grayscale stated that investors may benefit by reducing the administrative workload involved with self-custody, saving on trading fees, and more easily integrating digital assets into broader portfolio management strategies.
Data indicates that the usage of in-kind transactions has increased significantly in the United States Bitcoin ETP market. The proportion of Bitcoin ETP activity conducted through these direct transfers grew from 28% in March to 62% in June, reflecting growing adoption of the approach among large-scale crypto investors.
Grayscale described in-kind investing as a way to contribute eligible digital assets directly in exchange for shares of a Grayscale product. The firm highlighted reduced self-custody requirements, potentially lower execution costs, and more streamlined portfolio management as key benefits for investors.
Mini dictionary: In-kind transfer, an investment process where assets (such as cryptocurrencies) are contributed directly to an investment fund in their original form, rather than converting them to cash first. This method is commonly used in traditional finance to minimize tax liabilities and transaction costs.
Ten Grayscale ETPs now support in-kind transfersThe 10 eligible Grayscale ETPs for in-kind transfer include funds linked to a variety of cryptocurrencies such as Bitcoin, Ethereum, Solana, XRP, Dogecoin, Avalanche, Chainlink, Hyperliquid, Sui, and Zcash. Investors may now convert their existing coins in these assets directly into corresponding fund shares.
According to recent figures, the Grayscale Solana Staking ETF (GSOL) accepts in-kind contributions starting at approximately $80,300, making it the entry-level among Grayscale’s eligible ETPs. In contrast, the Grayscale Bitcoin Mini Trust ETF (BTC) has the highest minimum estimated at about $364,800. These minimums are subject to change as crypto prices fluctuate.
Grayscale ETPApproximate Minimum InvestmentBitcoin Mini Trust ETF (BTC)$364,800Solana Staking ETF (GSOL)$80,300Additional eligible products include the Ethereum Staking Mini ETF (ETH), Dogecoin Trust ETF (GDOG), Chainlink Trust ETF (GLNK), Zcash ETF (ZCSH), Avalanche Staking ETF (GAVA), Hyperliquid Staking ETF (HYPG), Sui Staking ETF (GSUI), and XRP Trust ETF (GXRP).
In-kind investment is now available for 10 Grayscale products, including prominent funds linked to assets such as Solana, Bitcoin, Chainlink, and XRP, opening up new options for digital asset portfolio management.
Grayscale’s move reflects broader momentum in the adoption of direct asset transfers within the crypto ETP sector, as investors increasingly seek efficient, cost-effective ways to allocate digital assets into managed investment vehicles.
Birdeye launches Peak, a $799/month institutional crypto terminal offering trading data, liquidity analysis and market intelligence.Bots dominate crypto trading, accounting for roughly two-thirds of trades and up to 80% of Solana volume, according to Birdeye's internal research.Birdeye targets institutional investors as demand for reliable crypto data grows amid industry consolidation and rising AI adoption.Every day, billions of dollars move through crypto markets. Investors watch trading volumes to understand where money is flowing and which assets are attracting attention. But how much of that activity comes from actual people?
According to data from Birdeye, roughly two-thirds of crypto trades are driven by bots. On Solana, automated activity may account for as much as 80% of trading volume. Yet only a tiny fraction of wallets appear to be responsible.
The Singapore-based company unveiled Peak on Wednesday, targeting investment funds, family offices and professional traders. Subscriptions start at $799 a month, with custom packages for larger institutions.
Birdeye already supplies data to major crypto platforms. Its infrastructure tracks more than 400 exchanges across 20 blockchains. Peak brings that information directly to institutional investors.
Introducing Birdeye Peak
The unified digital asset terminal for financial institutions and professionals, built to navigate Internet Capital Markets from a single platform. pic.twitter.com/G6G1rKuvzb
— Birdeye Data (@birdeye_data) October 21, 2026 What Does Birdeye Peak Actually Do? Imagine a fund preparing to buy $10 million worth of Bitcoin. Seeing a large daily trading-volume figure tells it little about where that activity happens or whether a large order could move the price.
Birdeye Peak aims to answer those questions.
Typing TDA BTC brings up Bitcoin’s spot trading volume across individual exchanges, including each venue’s market share. Users can examine liquidity depth, holder concentration, ETF flows, regulatory filings and fundraising history in one workspace.
The terminal also covers token unlock schedules, wallet activity and risk measures. It offers AI-assisted research, watchlists and spreadsheet exports.
For institutions, these details can influence how much they invest, where they execute trades and how they assess risk.
“The token screener, what most people know as Birdeye Terminal, was simply our first major product, and it now serves millions of retail users,” co-founder and CEO Kha Nguyen told BeInCrypto. “When millions of people depend on your numbers, you have to get accuracy and latency right at the same time, every day. That pressure forced us to develop deep expertise in data indexing and analysis.”
Coinbase uses Birdeye Data’s Exit Liquidity API to evaluate onchain pools on Base.
The API estimates how much value can actually leave a pool before significant slippage, not simply how much liquidity the pool reports.
If you’ve used that signal to assess a @base market, you’ve… pic.twitter.com/XRda1JQdH7
— Birdeye Data (@birdeye_data) October 12, 2026 Crypto Trading Is Dominated by Bots, Birdeye’s Data Suggests The company’s research points to something investors rarely see in ordinary trading dashboards.
Birdeye estimates that roughly one-third of trades come from humans and two-thirds from bots. On Solana, as much as 80% of trading volume is identified as automated activity.
Yet just 1% to 3% of wallets behave like bots, according to its September analysis.
“If a trade happened onchain, its volume is real, it moved the market,” Nguyen said. “The more interesting question is how much of that volume comes from humans trading manually versus bots, and the answer is striking. A very small number of bots is responsible for the majority of crypto trading volume,” he said. “That is exactly the kind of signal institutions need to see clearly, and it is what Peak is built to surface.”
The implications extend beyond professional trading desks.
A token recording millions in daily volume might appear to attract enormous investor interest. Some of that activity could instead come from automated market-making, arbitrage or bots repeatedly buying and selling.
This matters when investors use volume to judge market interest or liquidity.
Birdeye identifies bots through rule-based analysis of trading behaviour.
“Generally we’ll categorise them as a bot when they do something a human technically cannot,” Nguyen explained.
That includes several trades per second, complex contract interactions and purchases within seconds of a token listing.
Source: Birdeye internal research. Approximate trade-count shares, not shares of total trading volume. Full methodology is scheduled for December 2026. However, the findings remain preliminary. Birdeye has yet to publish its full methodology, which it plans to release in December alongside a Solana year-end report.
Note: The figures have not been independently verified, and automated trading does not necessarily indicate manipulation.
Crypto’s Data Companies Are Fighting for Wall Street Peak arrives during a major shake-up in crypto analytics.
Kaiko acquired Amberdata in June. Blockworks bought Messari the same month for a reported sum exceeding $10 million, far below Messari’s $300 million valuation in 2022. Allium raised $40 million, while Dune cut 25% of its workforce as it refocused on institutional customers and AI. Reliable data has become increasingly important as AI assistants enter financial research.
When Blockworks opened its datasets to AI tools, co-founder Jason Yanowitz warned that “the agent has no way to check a number, so the data has to be standardized and sourced before it ever gets there.”
Birdeye believes owning its data infrastructure gives it an advantage. Unlike several competitors, the company has taken no outside funding.
“Every financial decision should come from real business demand and what helps the company grow healthily, not from following a trend,” Nguyen said. “Having capital and knowing how to deploy it well are two different things. I want to be sure that if we take on external money, we know exactly what we are doing with it.”
He has left the door open to investment.
“As demand increases, if the timing is right, we would be happy to welcome new investors.”
For investors, Peak’s biggest test will be whether its data helps distinguish genuine market demand from the enormous volume generated by machines.
Disclaimer
BeInCrypto independently reports and controls this Feature. Quoted views belong to their speakers. This content is general and non-personalized; it does not consider your circumstances and is not investment research, financial, investment, legal or tax advice, or an offer, endorsement or recommendation to transact in any crypto-asset, product or service. Verify material information before acting. Crypto-assets are volatile and may result in total loss. BeInCrypto gives no warranty as to completeness, accuracy or timeliness, except where required by law.
Solana has overtaken Robinhood Chain to become the second-largest blockchain for tokenized-stock holders, according to Token Terminal data on Oct. 21.
About 1.5 million addresses on Solana hold tokenized stocks, 28.3% of the 5.3 million total across 18 chains. Robinhood Chain, the Arbitrum-based network Robinhood launched on mainnet on July 1, has roughly the same rounded figure but a 27.9% share.
BNB Chain, home to Binance’s bStocks, leads with about 2.0 million holders, or 37.1%.
The lead changed in under a month. As of late September, Token Terminal counted about 997,000 holders on Solana and 1.3 million on Robinhood Chain, The Defiant reported at the time.
Token Terminal counts token balances, not distinct investors, so one person holding several tokenized stocks can appear more than once.
Robinhood Chain’s holder count far outstrips its asset base
Holder counts and value tell different stories. Tokenized stocks on Solana are worth $1.1 billion, about 24% of the $4.4 billion market. Robinhood Chain hosts $148.6 million, or 3.4%. That works out to roughly $730 per holder on Solana and about $100 on Robinhood Chain.
Solana’s tokenized stocks come mainly from xStocks, Ondo and Superstate’s Opening Bell. Robinhood Chain carries Robinhood’s own tokens, while BNB Chain is dominated by Binance’s bStocks.
Base ranks fourth by holders with about 160,200, ahead of X Layer at 97,400 and Ethereum at 78,800. By value, Ethereum ranks third, with $841.3 million in tokenized stocks.
Disclosure: This article was edited by Vivian Nguyen. For more information on how we create and review content, see our Editorial Policy.
A series of security vulnerabilities have been disclosed in internet infrastructure software within a single day, affecting PHP, Node.js, and Go.
Multiple internet infrastructure software projects rolled out security updates in a single day, addressing vulnerabilities including remote code execution, TLS certificate validation bypass, and certificate trust risks. PHP fixed two critical flaws: CVE-2026-109618 and CVE-2026-109619, both enabling unauthenticated remote code execution that impacts PHP environments processing web requests. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Node.js’ advisory details 10 vulnerabilities, four of which are high-severity: these include remote code execution via out-of-bounds write in the Brotli decoder, DNS name truncation, and two TLS certificate hostname validation bypass issues. Fixed versions are 26.12.1, 24.22.1, and 22.23.4. Additionally, Go’s crypto/x509-related risk is tracked as CVE-2026-111943, rated "Important" by Red Hat with a CVSS 3.1 score of 6.8. Attackers with specific network access and valid certificates could impersonate legitimate servers to intercept or alter communications. Go 1.26.10 and 1.27.3 have been added to a deny list, blocking trust for compromised intermediate certificates.
8 minutes ago
Dataline completes $10.6 million seed round funding, and plans to conduct an ICO.
Decentralized data network for AI agents Dataline has closed a $10.6 million seed round, co-led by Lattice and Samsung-backed Dispersion Capital, with participation from Symbolic Capital, Coinbase Ventures, Anagram, and Robinhood co-founder & CEO Vlad Tenev, among others. The round, completed in April, utilized a SAFE agreement with token warrants; valuation was not disclosed. Dataline is now live, covering approximately 50 data sources to deliver on-chain and off-chain data, and scores data reliability, timeliness, and consistency using AI. Proceeds will be allocated to expanding data sources, enhancing data validation, and expanding into robotics, AI training data, and other sectors. Dataline plans to launch a token by the end of 2026 for network payments and data access, and intends to conduct a public token sale on Base via Uniswap’s Continuous Clearing Auction (CCA) system, with details set to be revealed next week. The public sale’s target fundraising amount, token quantity, and other terms remain undisclosed.
8 minutes ago
Trump plans to leverage White House cyber crime efforts to showcase achievements in combating cross-border crypto fraud.
White House officials said on October 21 that Trump planned to focus on the U.S. government’s actions to crack down on overseas crypto fraud rings during the White House’s cybersecurity event that day, including recovering funds and shutting down fraudulent operations. These transnational criminal groups steal funds from U.S. citizens via romance scams, phishing, ransomware and other methods. The U.S. government noted that law enforcement agencies have seized approximately $833 million in crypto assets linked to overseas fraud, and shut down 503 fraudulent crypto websites under the supervision of the Homeland Security Task Force. Relevant authorities have also notified nearly 9,000 U.S. citizens to alert them they are being targeted by fraud. The U.S. Treasury Department previously announced the establishment of an inter-agency "Fraud Strike Task Force" to target "pig butchering" scams run by organized criminal groups in Myanmar, Cambodia, Laos and the Philippines. Since last year, the U.S. has also imposed multiple sanctions aimed at cutting off support for related fraud websites and their infrastructure.
8 minutes ago
American Bankers Association voices dissatisfaction with OCC’s final GENIUS Act rule, which abandons proposed restrictions on stablecoin yields.
Crypto journalist Eleanor Terrett reported that the American Bankers Association (ABA) has voiced dissatisfaction with the final rules implemented by the U.S. Office of the Comptroller of the Currency (OCC) under the GENIUS Act. The OCC abandoned the previously proposed restrictions on stablecoin yields, a move the ABA argues will "maintain the status quo for crypto platforms." The ABA’s CEO stated: "It is a mistake to wait until deposit outflows and economic harm have already occurred before attempting to address these issues."
8 minutes ago
Beyond PHP, three Node.js version branches are also affected by high-severity vulnerabilities, and users need to update their runtime environments promptly.
Node.js rolled out a security update on October 21, covering its 26.x, 24.x, and 22.x version branches, with corresponding patched releases: 26.12.1, 24.22.1, and 22.23.4. The advisory details 10 total vulnerabilities, categorized as 4 critical-severity, 3 medium-severity, and 3 low-severity, with varying impact scopes across the three version lines. The critical CVE-2026-111497 is an out-of-bounds write flaw in the Brotli decoder that could enable remote code execution (RCE), affecting all three branches. Other critical issues include improper null character handling in DNS resolution and a TLS certificate hostname validation bypass. The update also resolves problems with persistent connection response processing, random number cache duplication, and permission models, while updating dependencies including c-ares, OpenSSL, and Undici. The official note warns that end-of-life (EOL) versions may still be vulnerable, advising users to use the latest supported releases. Separately, prior reports noted PHP has fixed two critical unauthenticated RCE vulnerabilities, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP users are urged to upgrade immediately.
8 minutes ago
Bonk Guy: This round is the "privacy cycle", privacy protocol MASK is undervalued.
Renowned trader Bonk Guy posted that the current crypto market is showing characteristics of a "privacy cycle". He noted that since yesterday, Bitcoin has risen approximately 3%, ZEC is up 16%, adding over $3 billion in market capitalization. MASK currently has a market cap of roughly $26 million, with its protocol trading volume and fees hitting consecutive all-time highs, he added. Citing data from DefiLlama, he stated that MASK ranks first among privacy protocols by revenue, outearning the next 10 privacy protocols combined. By comparison, ZEC’s market cap gain over the past 24 hours is roughly 115 times MASK’s entire market cap. Bonk Guy also said that MASK’s upcoming deployment on Solana is set to launch in the coming days, which he expects will further drive growth in usage, trading volume, and fees. He went on to call MASK the most undervalued privacy protocol in the crypto market.
Cover image via depositphotos.com Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
Shiba Inu is trading near $0.00000516, and exchange data is beginning to move in a way that matters. The total SHIB held on exchanges has reached approximately 87.16 trillion tokens. That is a rise of 0.08% in the last day, and the 7-day line shows a sharp bounce at the end. Coins on exchanges are the coins ready to be sold, so this metric deserves attention.
More SHIB comes inThe inflow and outflow numbers add to the picture. Total inflow stands at 344.17 billion SHIB, up 2.36%. Total outflow is 268.47 billion SHIB, up 1.78%. Inflow is larger than outflow, so more coins are entering exchanges than leaving them. Netflow is about 72.56 billion SHIB, which confirms that coins are building up on trading platforms. The average inflow per transaction also spiked, which points to large holders moving coins, not just small traders.
SHIB/USDT Chart by TradingViewIn dollar terms, the exchange reserve is about $449.76 million, up 4.12% in a day. Part of that rise comes from the small price bounce, but it also shows that the pile of coins sitting on exchanges is not shrinking.
HOT Stories
The chart shows why this matters. SHIB fell from the $0.00000620 region in September to a low near $0.00000480 in October. Price now sits just beneath the 50-day and 100-day EMAs, around $0.00000525 to $0.00000535. The 200-day EMA is higher, near $0.00000560, and has been a ceiling for months. RSI is near 45, which suggests weak momentum with a small turn upward. Volume is low, so the current bounce does not have strong support yet.
Holders to decideWhat happens next depends on what holders do. If the coins on exchanges are sold, SHIB could lose $0.00000500 and fall back to the $0.00000480 low. A break beneath that level might open the way toward $0.00000450.
You Might Also Like
If the coins are only parked and buyers step in, SHIB has room to move up. A daily close above $0.00000535 might put price back over the short-term averages. The next test would be $0.00000560, where the 200-day EMA sits. Only a clean move above that line could change the long-term trend.
For now, the signals lean cautious. Rising exchange reserves, larger inflows, and weak volume show that sellers still have the upper hand. Traders should watch the daily close around $0.00000500 on the downside and $0.00000535 on the upside.
Beyond PHP, three Node.js version branches are also affected by high-severity vulnerabilities, and users need to update their runtime environments promptly.
Node.js rolled out a security update on October 21, covering its 26.x, 24.x, and 22.x version branches, with corresponding patched releases: 26.12.1, 24.22.1, and 22.23.4. The advisory details 10 total vulnerabilities, categorized as 4 critical-severity, 3 medium-severity, and 3 low-severity, with varying impact scopes across the three version lines. The critical CVE-2026-111497 is an out-of-bounds write flaw in the Brotli decoder that could enable remote code execution (RCE), affecting all three branches. Other critical issues include improper null character handling in DNS resolution and a TLS certificate hostname validation bypass. The update also resolves problems with persistent connection response processing, random number cache duplication, and permission models, while updating dependencies including c-ares, OpenSSL, and Undici. The official note warns that end-of-life (EOL) versions may still be vulnerable, advising users to use the latest supported releases. Separately, prior reports noted PHP has fixed two critical unauthenticated RCE vulnerabilities, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP users are urged to upgrade immediately.
6 minutes ago
Bonk Guy: This round is the "privacy cycle", privacy protocol MASK is undervalued.
Renowned trader Bonk Guy posted that the current crypto market is showing characteristics of a "privacy cycle". He noted that since yesterday, Bitcoin has risen approximately 3%, ZEC is up 16%, adding over $3 billion in market capitalization. MASK currently has a market cap of roughly $26 million, with its protocol trading volume and fees hitting consecutive all-time highs, he added. Citing data from DefiLlama, he stated that MASK ranks first among privacy protocols by revenue, outearning the next 10 privacy protocols combined. By comparison, ZEC’s market cap gain over the past 24 hours is roughly 115 times MASK’s entire market cap. Bonk Guy also said that MASK’s upcoming deployment on Solana is set to launch in the coming days, which he expects will further drive growth in usage, trading volume, and fees. He went on to call MASK the most undervalued privacy protocol in the crypto market.
6 minutes ago
Putin in principle has agreed to resume the trilateral peace talks between Russia, the United States and Ukraine, with Abu Dhabi a possible venue.
According to reports from Reuters and Axios, the Kremlin stated that Russian President Vladimir Putin told U.S. envoy Steve Witkoff on Wednesday he "agrees in principle" to resume trilateral peace talks between Russia, Ukraine and the U.S. around November 10 to end the Russia-Ukraine conflict, with the venue potentially in Abu Dhabi.
Witkoff held a three-hour meeting with Putin in St. Petersburg the same day, presenting the latest plan to end the Russia-Ukraine conflict. Trump envoy Jared Kushner joined the session via video.
Witkoff informed Putin that progress had been made in the Oslo talks, and expressed hope that both sides would consider restarting the Russia-U.S.-Ukraine trilateral negotiations and allow technical experts to participate in discussions on specific issues. He also submitted multiple documents on the peaceful resolution of the Russia-Ukraine conflict to Putin.
Separately, Putin raised with Witkoff the possibility of Russia acting as a mediator between the U.S. and Iran. Putin noted that Russia has decades of special trust relations with Iran and is willing to contribute to resolving the current crisis.
6 minutes ago
The White House: It was made aware of the PHP vulnerability on October 16, and is coordinating to accelerate the release of a fix patch.
The White House stated that the U.S. government was alerted to the PHP security vulnerability on October 16. It is closely monitoring the issue and coordinating with federal agencies and leading systems integration labs to accelerate the rollout of fix patches. The White House noted that federal agencies are evaluating the vulnerability’s potential impact on government systems and critical infrastructure, and are working with network operators to prioritize mitigation measures.
6 minutes ago
LiteLLM hit by second supply chain poisoning attack this year: Steals API keys even without being called
Beating AI Express: Security firm JFrog has discovered that popular open-source AI model gateway LiteLLM has fallen victim to another supply chain attack. Its latest v1.107.0 version was implanted with malware, and official Docker images were also compromised.
LiteLLM enables unified access to models from providers like OpenAI and Anthropic, and centralizes API key management. It was previously targeted by a supply chain poisoning attack back in March this year. This latest attack is far more stealthy: hackers hid three extra files in Python packages. After installation, whenever users launch the associated Python environment—even without invoking LiteLLM—the malicious code runs automatically. It steals browser passwords, SSH private keys, AWS and other cloud platform credentials, plus authentication data for development tools including Claude, Codex, and Cursor. The malware also attempts to exfiltrate model API keys stored in LiteLLM’s database to servers masquerading as official domains. Attackers also embedded a persistent backdoor that checks for remote commands hourly, downloading and executing new code as needed.
Notably, the official source code on GitHub contained no malicious files, but all seven platform-specific packages released to PyPI were infected with trojans. The community traced the issue via Docker build logs: the release system used a source address pointing to a fake repository that differed from the official one by only one hyphen. How the fake repo slipped into the release pipeline remains unconfirmed.
PyPI has since removed the malicious versions, and Docker Hub has taken down affected images. JFrog warns users who installed or ran v1.107.0 to treat all related credentials as potentially compromised, isolate and rebuild their environments, and rotate sensitive data like API keys—rather than simply uninstalling the software. The confirmed safe rollback version is v1.106.2.
6 minutes ago
Tencent Cloud issues a warning on the PHP 'php2shell' remote code execution vulnerability, recommends timely self-inspection and remediation.
Tencent Cloud Security Center has detected a remote code execution vulnerability in PHP, with CVE identifiers CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". The flaw allows unauthenticated remote attackers to send specially crafted multipart POST requests to trigger memory corruption, leading to remote code execution that can result in full server compromise and other harms. Tencent Cloud Security recommends conducting timely security self-inspection; if your system is affected, update and patch immediately to prevent intrusion by external attackers.
What was announcedMeritz Securities has signed a memorandum of understanding (MoU) with The Optimism Foundation ("Optimism") to cooperate on the tokenized financial asset business.
The two sides will examine structures for the issuance, settlement and distribution of tokenized financial assets using OP Stack-based networks, including OP Mainnet. The subject of this cooperation is a business model that uses the public Layer 2 as the distribution and settlement infrastructure for tokenized financial assets.
“The significance of this agreement is that it examines the role a securities firm can play as tokenized financial assets are distributed and settled on a public Layer 2. We will review ways to cooperate with Optimism, putting investor protection and consistency with the regulatory framework first.”Meritz Securities representativeWhat Meritz is focused onWithin the scope of applicable laws and its securities business license, Meritz Securities will examine ways it could take part in the supply and distribution of tokenized financial products backed by domestic assets. Meritz Securities plans to review the detailed scope of cooperation under the agreement, taking into account the ongoing development of Korea's security token regulatory framework and current market conditions.
“We're excited about the ongoing growth of our work in Korea, and glad to welcome Meritz Securities to the OP Stack as they begin exploring tokenization. What makes it interesting is what happens when issuance and settlement sit on the same open network instead of in separate systems. Meritz is starting with a practical question, which is what role a securities firm plays in that, and we look forward to exploring it with them.”Jing WangCEO and Co-Founder, OP LabsAbout OP MainnetOP Mainnet is built on the OP Stack, the open-source, MIT-licensed technology stewarded by The Optimism Foundation. More than 50 production chains run on the OP Stack, and they averaged more than 900 million transactions a month from January through September 2026.
Meritz Securities is a leading Korean comprehensive financial investment company with standalone shareholders' equity of KRW 8.35 trillion as of June 2026, with strengths in investment banking and expanding wealth management and digital financial services. Meritz Securities is currently exploring a range of digital asset-related business opportunities in preparation for the integration of digital assets into the regulated financial system, including spot ETFs, fractional investment and security tokens, trading platforms, and KRW-denominated stablecoins.
About OptimismThe Optimism Foundation is building toward a world of a million chains, all settling to Ethereum. The OP Stack is the open-source, MIT-licensed foundation that gets us there: the shared infrastructure beneath more than 50 production chains, the home of OP Mainnet, and the technology behind OP Enterprise. Exchanges and institutions are already building on it, from xStocks' tokenized equities on OP Mainnet to Korean securities firms exploring tokenization on the OP Stack, including KB Securities, DB Securities, and Meritz Securities, to the DeFi and consumer applications spanning the broader ecosystem. In the first nine months of 2026 alone, OP Stack chains settled $35 trillion in stablecoin transfer volume. OP Labs is the core service provider for The Optimism Foundation.
Injective has signed a memorandum of understanding (MOU) with South Korean digital asset custodian BDACS.
Under the deal, Injective KRW1 will serve as the exclusive Korean won settlement asset for tokenized real-world assets (RWAs) on the Injective network.
KRW1 and the $10.4 Billion Korean Stablecoin Gap
KRW1 is issued by BDACS and fully backed 1:1 by Korean won held in reserve at a major South Korean bank.
Minting and redemption are initially limited to approved institutional partners and remain subject to regulatory approval.
The timing of this deal is deliberate. Korea’s five major crypto exchanges have recorded 18 consecutive months of net stablecoin outflows, roughly 14.9 trillion won (~$10.4 billion), to offshore platforms since January 2025.
By bringing a won-denominated settlement layer on-chain, the Injective–BDACS partnership aims to retain that capital domestically.
South Korea’s push to tokenize stocks, bonds, and funds under an STO law expected in February 2027 gives the infrastructure even more urgency.
The partnership addresses a friction point that has long slowed Korean institutional participation in on-chain markets. Most tokenized assets settle in USD stablecoins.
Injective has already built significant RWA momentum. The network has processed more than $7.5 billion in RWA volume and hosts over $1 billion in tokenized assets.
That traction drew early institutional confidence, in July 2026, POSCO International and LG CNS selected Injective to issue, transfer, administer, and settle live trade receivables from international commerce.
The Bank of Korea has separately advocated for domestic banks to anchor that market. South Korea’s finalized Digital Asset Bill draft already signals regulators’ intent to move quickly.
Eric Chen, Co-founder of Injective, said: “Bringing a Korean won settlement layer onchain is an important step for tokenized finance in Korea. Together with BDACS, we are building the foundation for Korean won markets onchain, from tokenized RWAs to institutional settlement.”
Harry Ryoo, CEO of BDACS, added: “Without onchain won infrastructure, demand in tokenized markets will remain anchored to dollar stablecoins. Through our partnership with Injective, we will explore how KRW1 can serve as a won settlement asset for tokenized markets, and we will expand our collaboration step by step as Korea’s regulatory framework develops.”
INJ’s Regulatory and Institutional Backdrop
Injective’s credibility with institutional partners received a major boost earlier this year. INJ rallied 9% after Injective secured a Transfer Agent registration from the US SEC, a milestone that directly enables compliant RWA issuance.
That regulatory win, combined with the POSCO and LG CNS integrations, underpins why BDACS chose Injective as its settlement partner.
Investor attention is also growing. Canary Capital’s amended staked Injective ETF filing with the SEC signals that institutional exposure to INJ is expanding beyond spot custody.
Meanwhile, Injective’s CypherOS native privacy upgrade after mainnet went live adds a compliance-friendly privacy layer that institutional partners increasingly require.
BDACS itself is no stranger to institutional crypto infrastructure. The custodian previously partnered with Ripple on XRP custody services, a move that cemented its standing in Korea’s regulated digital asset space.
Ripple’s major win as the South Korean giant launched XRP custody via BDACS highlighted BDACS’s appetite for cross-chain institutional integrations.
This is still an early-stage MOU. Implementation depends on regulatory clearance, institutional onboarding, and measurable KRW1-settled volumes.
But for Injective, the strategic logic is clear, local-currency settlement rails reduce friction, keep Korean capital onshore, and expand the addressable market for tokenized assets.
For a deeper look at the platforms competing in this space, the 11 best RWA tokenization platforms in 2026 shows just how crowded, and lucrative, this race has become.
Injective [INJ] announced a partnership with BDACS on the 20th of October to bring KRW1 to its ecosystem.
Source: X The companies signed a memorandum of understanding (MOU) to develop won-denominated settlement for real-world assets (RWAs) and tokenization. Issued by BDACS, KRW1 is backed 1:1 by Korean won cash reserves held at a major Korean bank.
The initiative could give Korean investors a local-currency route into tokenized markets. Institutional minting and redemption remain subject to regulatory approval.
Why is Injective targeting Korean won settlement? The partnership expands Injective’s RWA ambitions in one of the most active digital asset markets. It also builds on the network’s work with POSCO International and LG CNS, alongside South Korea’s push for won-denominated stablecoins.
On top of that, stablecoins have become a major settlement channel for on-chain finance. According to Allium, Total Stablecoin Supply reached $336 billion, with Adjusted Supply at $311 billion.
Source: Allium In Korea, dollar-backed stablecoins have dominated activity. Injective cited roughly $10 billion in net stablecoin outflows from Korean exchanges over 18 consecutive months.
That created an opening for won-denominated settlement, allowing tokenized assets to trade without first routing through dollar stablecoins.
KRW1 could help fill that gap. Whether it reduces offshore outflows would depend on adoption and the markets available.
Is Injective attracting more onchain capital? The Korean initiative followed Injective’s expansion into other tokenized asset markets. Days earlier, Pineapple Financial announced plans to tokenize its $10 billion mortgage portfolio.
Meanwhile, on-chain capital also increased. AMBCrypto previously reported that Injective’s Total Value Locked (TVL) rebounded by over $2 million in less than two weeks.
Source: DeFiLlama At the same time, Stablecoin Market Cap rose from $12 million to $17 million. These increases pointed to more capital on the network. Sustained transaction activity would offer stronger evidence of growing utility.
Could Injective’s expansion support INJ toward $10? The ecosystem’s expansion could strengthen the investment case for IInjective [INJ], particularly if new settlement markets attract sustained usage.
Still, the partnership’s announcement and its eventual contribution to token demand are separate milestones.
If adoption strengthens and buyers maintain momentum, INJ could target $10 in the short term. That remains a conditional outlook. The partnership alone does not establish a price target.
Final Summary Injective and BDACS signed an MOU to develop KRW1 settlement for tokenized assets. Injective’s rising TVL and Stablecoin Market Cap supported its expansion narrative, while the $10 INJ outlook remained conditional.
Injective has now burned more than 7.2 million INJ, permanently removing those tokens from circulation. The milestone comes through a mix of its monthly Community BuyBack program and an earlier burn auction.
How the Injective buyback machine works Participants commit INJ to a monthly Community BuyBack event. In return, they receive a portion of revenue generated across the Injective ecosystem. Once that revenue is distributed, the committed INJ is burned for good. Each round accepts commitments only within set limits, so participation is capped per event.
The revenue pool itself is funded by a percentage of income from decentralized applications and other activity on the network.
The numbers behind the burn The headline figure is over 7.2 million INJ burned to date. That cumulative total reflects both the current buyback system and a previous burn auction mechanism.
Across its first four rounds, the improved monthly program burned 178,338 INJ and distributed $776,344 in revenue shares to participants.
Average yield in the early rounds of the program reached approximately 23.9%. Historically, the buyback has offered average yields of approximately 20-25% per round.
The program has also added bonuses to encourage participation.
Background: from burn auctions to a monthly buyback Injective’s earlier burn auction served a similar purpose of reducing supply, and it contributed to the cumulative total. The shift to a monthly Community BuyBack turned burning into a recurring event with a revenue-sharing hook.
Issuance of new INJ has been curtailed, and governance changes have been aimed at supporting long-term value retention for holders. The community has continued to back tighter supply parameters.
Injective’s approach of routing nearly all protocol revenue back through the buyback system appears to have helped place it among the higher-revenue Layer-1 networks. Layer-1 refers to base blockchains like Ethereum or Solana, as opposed to networks built on top of them.
What this means for INJ holders and the broader market Every burned token is one that can never be sold, staked or traded again. The buyback model ties burn volume directly to ecosystem revenue, which depends on actual usage.
Participants are committing tokens that get burned, so the yield is essentially compensation for giving up those INJ permanently rather than a passive return on a held position.
Caps on commitments per round limit how much any single participant can deploy, keeping the program from being dominated by a handful of large holders.
Many networks direct revenue to treasuries, validators or development funds, while Injective routes nearly all protocol revenue to buybacks.
The key metrics to track each month are the size of each round’s revenue pool, the number of INJ burned per event, participant yields, and whether the bonuses succeed in sustaining participation.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
TLDR A wallet tied to the April Drift hack sent 25,710 ETH, worth about $63.1 million, into Tornado Cash on Oct. 20. The wallet made 258 deposits over two hours and 13 minutes, leaving about 3.98 ETH behind. Drift estimated about $280 million was taken in the April 1 attack, which Mandiant linked to North Korean group UNC6862. Drift opened DFX token claims on Oct. 1, giving users one DFX for each USDT of verified loss. As of Oct. 4, the redemption quote was about 0.0104 USDT per DFX, close to one cent per USDT lost. A wallet tied to the April hack of crypto trading protocol Drift sent 25,710 ETH into the Tornado Cash mixer on Oct. 20. The transfers were worth about $63.1 million.
The address is labeled “Drift Exploiter 5” on the blockchain explorer Etherscan. The deposits were the wallet’s first outgoing Ethereum transactions, and they left it nearly empty.
How the Transfers Happened The wallet made 258 deposits to the Tornado Cash router. It sent 257 deposits of 100 ETH each, followed by one final deposit of 10 ETH.
The first deposit was confirmed at 07:08:35 UTC in block 26,232,203. The last came at 09:21:35 UTC in block 26,232,865. The full sequence took two hours and 13 minutes.
After the transfers, the address held about 3.98 ETH. The dollar value of the deposits is based on an average Ethereum price of $2,450 on Oct. 20.
On-chain analysis account Lookonchain separately reported that the exploiter wallets it tracks hold a combined 81,864 ETH.
Drift was attacked on April 1, more than six months before these transfers. In an April 2 disclosure, the protocol estimated that about $280 million had been withdrawn.
Drift said the attacker took over the administrative powers of its Security Council. The attacker used durable nonce accounts to pre-sign transactions and delay when they were carried out.
According to Drift, this allowed the attacker to get unauthorized or misrepresented transaction approvals in advance. At the time, the protocol said it had not found a bug in its programs or smart contracts.
In a June 4 update, Drift said the investigation it hired Mandiant to carry out linked the attack to UNC6862. That is a North Korean threat group.
How Drift Plans to Repay Users Drift has set up a Recovery Pool to return funds to affected users. Money recovered through freezes, a bounty, or law enforcement goes into the pool. A share of the platform’s net protocol revenue is also added.
The protocol opened claims and redemptions for its DFX token on Oct. 1. Users receive one DFX for each USDT of verified loss.
Holders can trade their DFX for USDT at the quoted redemption amount. The tokens they submit are burned in the same transaction.
Users who redeem give up their share of future pool deposits for those tokens. Those who redeem only part of their holdings keep that share for the DFX they hold onto.
As of Oct. 4, the quote was about 0.0104 USDT per DFX. That is close to one cent per USDT lost.
In an April 16 update, Drift proposed up to $127.5 million from Tether and $20 million from other partners. The plan included a revenue-linked credit facility, an ecosystem grant, and market-maker loans.
The Oct. 20 deposits show where this wallet’s ETH went. How much of the stolen money will return to the Recovery Pool is still unknown. Ethereum was last trading at $2,462.20, up 3.55% over the past 24 hours.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
Wallets linked to the $295 million April hack still held $138 million in Ether after sending another $46 million to the mixer Wednesday.
A Drift exploiter-linked wallet transferred 18,800 Ether, worth about $46 million, to Tornado Cash on Wednesday.
The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million, as blockchain data tracker Onchain Lens said on X.
The transfers to Tornado Cash make the funds harder to trace and represent nearly 37% of the $295 million stolen from decentralized exchange (DEX) Drift in April. The attack ranks as this year’s third-largest crypto hack, according to DefiLlama.
The Drift exploiter-labelled wallets still held 56,569 Ether, worth roughly $138 million after Wednesday’s flurry of transfers, Arkham data shows.
The Solana-based DEX reported about $295 million in losses from the April 1 hack, which its security consultant Mandiant attributed to a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, giving affected users a claim on a pool that launched with about $3.1 million and receives exchange revenue and recovered funds.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Wallets linked to the $295 million April hack still held $138 million in Ether after sending another $46 million to the mixer Wednesday.
A Drift exploiter-linked wallet transferred 18,800 Ether, worth about $46 million, to Tornado Cash on Wednesday.
The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million, as blockchain data tracker Onchain Lens said on X.
The transfers to Tornado Cash make the funds harder to trace and represent nearly 37% of the $295 million stolen from decentralized exchange (DEX) Drift in April. The attack ranks as this year’s third-largest crypto hack, according to DefiLlama.
The Drift exploiter-labelled wallets still held 56,569 Ether, worth roughly $138 million after Wednesday’s flurry of transfers, Arkham data shows.
The Solana-based DEX reported about $295 million in losses from the April 1 hack, which its security consultant Mandiant attributed to a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, giving affected users a claim on a pool that launched with about $3.1 million and receives exchange revenue and recovered funds.
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Putin in principle has agreed to resume the trilateral peace talks between Russia, the United States and Ukraine, with Abu Dhabi a possible venue.
According to reports from Reuters and Axios, the Kremlin stated that Russian President Vladimir Putin told U.S. envoy Steve Witkoff on Wednesday he "agrees in principle" to resume trilateral peace talks between Russia, Ukraine and the U.S. around November 10 to end the Russia-Ukraine conflict, with the venue potentially in Abu Dhabi.
Witkoff held a three-hour meeting with Putin in St. Petersburg the same day, presenting the latest plan to end the Russia-Ukraine conflict. Trump envoy Jared Kushner joined the session via video.
Witkoff informed Putin that progress had been made in the Oslo talks, and expressed hope that both sides would consider restarting the Russia-U.S.-Ukraine trilateral negotiations and allow technical experts to participate in discussions on specific issues. He also submitted multiple documents on the peaceful resolution of the Russia-Ukraine conflict to Putin.
Separately, Putin raised with Witkoff the possibility of Russia acting as a mediator between the U.S. and Iran. Putin noted that Russia has decades of special trust relations with Iran and is willing to contribute to resolving the current crisis.
1 minutes ago
The White House: It was made aware of the PHP vulnerability on October 16, and is coordinating to accelerate the release of a fix patch.
The White House stated that the U.S. government was alerted to the PHP security vulnerability on October 16. It is closely monitoring the issue and coordinating with federal agencies and leading systems integration labs to accelerate the rollout of fix patches. The White House noted that federal agencies are evaluating the vulnerability’s potential impact on government systems and critical infrastructure, and are working with network operators to prioritize mitigation measures.
1 minutes ago
LiteLLM hit by second supply chain poisoning attack this year: Steals API keys even without being called
Beating AI Express: Security firm JFrog has discovered that popular open-source AI model gateway LiteLLM has fallen victim to another supply chain attack. Its latest v1.107.0 version was implanted with malware, and official Docker images were also compromised.
LiteLLM enables unified access to models from providers like OpenAI and Anthropic, and centralizes API key management. It was previously targeted by a supply chain poisoning attack back in March this year. This latest attack is far more stealthy: hackers hid three extra files in Python packages. After installation, whenever users launch the associated Python environment—even without invoking LiteLLM—the malicious code runs automatically. It steals browser passwords, SSH private keys, AWS and other cloud platform credentials, plus authentication data for development tools including Claude, Codex, and Cursor. The malware also attempts to exfiltrate model API keys stored in LiteLLM’s database to servers masquerading as official domains. Attackers also embedded a persistent backdoor that checks for remote commands hourly, downloading and executing new code as needed.
Notably, the official source code on GitHub contained no malicious files, but all seven platform-specific packages released to PyPI were infected with trojans. The community traced the issue via Docker build logs: the release system used a source address pointing to a fake repository that differed from the official one by only one hyphen. How the fake repo slipped into the release pipeline remains unconfirmed.
PyPI has since removed the malicious versions, and Docker Hub has taken down affected images. JFrog warns users who installed or ran v1.107.0 to treat all related credentials as potentially compromised, isolate and rebuild their environments, and rotate sensitive data like API keys—rather than simply uninstalling the software. The confirmed safe rollback version is v1.106.2.
1 minutes ago
Tencent Cloud issues a warning on the PHP 'php2shell' remote code execution vulnerability, recommends timely self-inspection and remediation.
Tencent Cloud Security Center has detected a remote code execution vulnerability in PHP, with CVE identifiers CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". The flaw allows unauthenticated remote attackers to send specially crafted multipart POST requests to trigger memory corruption, leading to remote code execution that can result in full server compromise and other harms. Tencent Cloud Security recommends conducting timely security self-inspection; if your system is affected, update and patch immediately to prevent intrusion by external attackers.
1 minutes ago
Bybit plans to seek partnerships with large brokerage firms to challenge Robinhood in the U.S. market.
Bybit CEO Ben Zhou said that Bybit plans to partner with established local firms when entering the U.S. market to compete with platforms like Robinhood. Citing Interactive Brokers as an example, he noted that it is more suitable at this stage to seek partners that already have a U.S. customer base and are looking to expand into crypto business.
Ben Zhou added that applying for money transmission licenses state-by-state could take two to three years, so he prefers to wait for progress on the CLARITY Act and further clarity on the new regulatory framework before entering the U.S. at an opportune time rather than acting hastily. He believes the U.S. market, while large, is highly competitive and already saturated.
Additionally, Bybit is exploring the U.K. market, but Ben Zhou said entry costs there are high, and the location of its London office has not yet been finalized. The company also plans to launch a comprehensive application in Europe as early as the first quarter of 2027, covering derivatives and tokenized stocks.
1 minutes ago
Elon Musk’s net worth returns to $1 trillion, surging by $88 billion in a single day.
According to Forbes, driven by gains in SpaceX and Tesla’s share prices, Elon Musk reclaimed his spot as a trillionaire on October 21. His net worth increased by approximately $88 billion that day, hitting $1.013 trillion. SpaceX’s share price surged over 10% following the release of its better-than-expected third-quarter results, while Tesla’s rose more than 3%; Tesla was set to announce its earnings after U.S. markets closed the same day. Musk confirmed during SpaceX’s Tuesday evening earnings call that the two companies are exploring a merger. Musk became the world’s first trillionaire on June 12 when SpaceX went public, and has since fallen below and reclaimed the threshold multiple times; he most recently lost the status last week amid a decline in SpaceX’s share price.
Wallets linked to the April theft from Solana trading platform Drift Protocol have sent an estimated $109 million in Ether to Tornado Cash over two days, renewing scrutiny of funds still controlled by the attacker.
Summary
Wallets linked to the April Drift exploit reportedly transferred 44,510 ETH, worth $109 million, to Tornado Cash on October 20–21. Wednesday’s activity involved approximately 18,800 ETH worth $46 million, following an estimated $61 million in transfers on Tuesday. Arkham-labeled exploiter wallets reportedly retained 56,569 ETH, valued at $138 million, after the latest deposits. Drift attributed its April attack to a North Korean threat group following an investigation by Mandiant. The exchange opened DFX recovery claims on October 1, initially backed by a pool holding approximately 3.1 million USDT. According to blockchain tracker Onchain Lens, the wallets deposited 44,510 ETH into the mixing service on October 20 and 21, including approximately 18,800 ETH valued at $46 million on Wednesday.
DRIFT EXPLOITER MOVES $109M $ETH TO TORNADO CASH
The Drift Protocol exploiter transferred 44.51K $ETH (~$109.15M) to Tornado Cash over the past two days.
· October 20: 25.71K $ETH (~$63.04M)
· October 21: 18.8K $ETH (~$46.11M)
Addresses:… pic.twitter.com/udDVTmEBje
— Onchain Lens (@OnchainLens) October 21, 2026 The October 21 transfers followed roughly 25,710 ETH sent on Tuesday, when blockchain monitors recorded deposits worth approximately $61 million. Combined, the two batches represent more than one-third of the $295 million lost in Drift’s April 1 exploit, based on their estimated dollar values when transferred.
Attribution of the transactions rests on addresses identified as belonging to the attacker. Tornado Cash accepts cryptocurrency deposits into privacy pools, making it harder to follow funds once they are withdrawn to new addresses. A mixer deposit does not, by itself, establish that the stolen assets have been exchanged for cash or recovered by authorities.
The movement comes after a period of relative inactivity. On October 20, Lookonchain reported approximately 25,700 ETH deposited within two hours, while different monitoring accounts published lower interim totals as the transactions were still taking place.
The latest two-day figure covers the complete period cited by Onchain Lens, not the amount observed by each tracker at the same point in time. The reported 44,510 ETH figure and the quoted $109 million are estimates based on the transfer activity and Ether prices around the deposits.
Exploiter wallets retain $138 million after latest transfers Following Wednesday’s transfers, addresses labeled as the Drift exploiter held approximately 56,569 ETH, valued at $138 million, according to Arkham Intelligence data cited in the October 21 reporting. The figure describes the tracked wallets at that snapshot, not every asset necessarily controlled by the perpetrators.
On Tuesday, the corresponding holdings estimate had been roughly 81,454 ETH, worth $194 million. Those balances changed as funds moved and as Ether’s market price fluctuated.
Past transactions complicate the picture. In August, wallets connected to the same incident had already transferred around $44 million worth of ETH through Tornado Cash, prompting renewed questions about how much could ultimately be frozen or returned to victims.
As crypto.news previously reported, investigators faced difficulties tracking the stolen assets through cryptocurrency mixers.
The April incident was one of the year’s largest decentralized finance thefts. Drift initially faced differing loss estimates because investigators valued affected tokens at different points, while the platform’s later accounting put stolen assets at approximately $295.7 million.
North Korean hackers linked to April Drift exploit Drift said in its June 3 recovery update that cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group. Mandiant’s assessment cited operational evidence and similarities with other attacks linked to North Korean operators.
The attackers had spent months developing relationships with Drift contributors before acquiring the approvals needed to move assets, according to accounts published after the exploit. Investigators described a compromise of operational access and transaction authorization, not simply an error in a trading smart contract.
Drift subsequently reorganized its recovery effort around a planned return to trading. In its June update, the platform said it had hired former Helium engineering executive Noah Prince to oversee protocol development and engaged former Gauntlet team members to review risk controls and liquidation infrastructure.
That work formed part of preparations for a relaunched trading platform intended to contribute revenue toward user compensation.
Drift opens DFX recovery claims with initial pool of $3.1 million On October 1, Drift opened claims and redemptions for DFX, a Solana token allocated to affected users according to their verified losses. The recovery framework assigns one DFX for each USDT of recognized loss and fixes total supply at 299,500,810.998 tokens.
At launch, the recovery pool contained around 3.1 million USDT. The stated initial redemption rate was approximately 0.0104 USDT per DFX, equivalent to roughly one cent for each dollar of eligible losses. Claiming a token is separate from receiving its full face amount in cash.
Under Drift’s published recovery rules, a holder can redeem DFX for an available share of the pool, sell the token on a secondary market or retain it as additional funding accumulates. Tokens redeemed against the pool are burned, reducing the outstanding supply.
A portion of the relaunched platform’s net protocol revenue is directed to the pool each day. Drift lists contributions of 60% on the first 30,000 USDT of daily net revenue, 70% on the next band through 100,000 USDT and 90% above that threshold.
Drift says any assets recovered through freezes, law enforcement or other recovery measures will be deposited in the pool. Tether has committed up to 127.5 million USDT in support, while other partners have committed up to 20 million USDT; those commitments should not be confused with money already available for immediate redemption.
Eligible users must submit their DFX claims before 00:00 UTC on January 1, 2028. Under the recovery terms, any tokens still unclaimed at that deadline will be permanently burned.
The wallet cluster linked to the April 1 exploit of Solana-based perpetuals protocol Drift resumed activity on October 20 after roughly two months of silence, depositing 25,700 ETH — about $61.56 million — into the privacy mixer Tornado Cash over a two-hour window, according to on-chain analyst Lookonchain.
The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity. Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).
— Lookonchain (@lookonchain) October 20, 2026
The deposits are the latest chapter in a recovery that has barely begun. Drift’s own records put the April theft at $295,706,374.93 across 19 assets, while the recovery pool meant to repay victims held about $3.1 million in USDT when claims opened on October 1 — roughly one cent for every dollar lost.
A Two-Hour Burst After Two Months of Silence Lookonchain flagged the movement at about 09:25 UTC on October 20. “The Drift Protocol exploiter, who stole over $270M, is moving ETH to Tornado Cash after 2 months of inactivity,” the account wrote. “Over the past 2 hours, the exploiter has deposited 25,700 ETH ($61.56M) into Tornado Cash and still holds 81,864 ETH ($195M).”
A second tracker, Onchain Lens, published the fuller two-day tally on October 21. “DRIFT EXPLOITER MOVES $109M ETH TO TORNADO CASH,” the account wrote, counting 44,510 ETH — about $109.15 million — moved across October 20 and 21, split into 25,710 ETH on the first day and 18,800 ETH on the second. The post lists two addresses, 0xAa843eD65C1f061F111B5289169731351c5e57C1 and 0xD3FEEd5DA83D8e8c449d6CB96ff1eb06ED1cF6C7.
The two trackers differ on the dollar figures because each snapshotted ETH at a different price, with ETH trading near $2,481 at the time. The token amounts are the stable unit. What is not in dispute is the pattern: a cluster that had gone quiet since August moved tens of thousands of ETH through the mixer in concentrated bursts, the same method it used in two earlier rounds of Tornado Cash activity over the summer.
The Ledger of the April 1 Theft Drift’s April 16 incident report breaks the loss into 19 assets. Jupiter’s JLP liquidity token was the largest single line at $159,329,898.68, followed by $71,415,648.65 in USDC, $11,321,165.24 in Coinbase-wrapped bitcoin and $10,426,959.98 in SOL. The remaining 15 assets — USDT, USDS, WETH, dSOL, WBTC, Fartcoin, jitoSOL, syrupUSDC, INF, mSOL, bSOL, EURC, zBTC, USDY and JUP — bring the total to $295,706,374.93.
Drift has said its forensic investigation attributed the attack to a North Korea-linked group, and the protocol disclosed in the same report that it is “actively working with law enforcement and blockchain forensics partners to track and recover stolen assets.” Any funds recovered are directed to the recovery pool. Chainalysis separately estimated the loss at about $285 million.
For the relaunch, Drift is moving its settlement layer from USDC to USDT. Tether is proposing up to $127.5 million and other partners up to $20 million to support user recovery, alongside two independent audits from Ottersec and Asymmetric. A new community-governed multisig will manage core protocol assets, with signers on dedicated signing devices and timelocks on critical administrative actions.
A Recovery Pool Still a Fraction of the Loss The recovery mechanism Drift opened on October 1 is a fixed-supply token called DFX. One DFX was issued for every USDT of verified loss, capping the supply at 299,500,810.998 tokens, and the token redeems against a pool that held about $3.1 million when claims opened. Drift’s own documentation puts an early redemption at “about 0.0104 USDT per DFX.”
The arithmetic is blunt. A pool of $3.1 million against a loss of $295.7 million is a recovery of about 1.05 percent. Viewed from the other side it is harsher: the $109.15 million the exploiter moved through Tornado Cash in two days is roughly 35 times the entire recovery pool. On October 20 alone, the $61.56 million deposited equaled about 21 percent of the full haul.
Drift’s earlier DFX launch coverage walks through the claim mechanics, and the April theft itself was documented as one of the month’s largest DeFi exploits. The pool is funded once a day at 00:00 UTC from a share of Velocity’s net protocol revenue — 60 percent of the first $30,000, 70 percent of the next $70,000 and 90 percent above $100,000 — until verified losses are repaid. Claims close at 00:00 UTC on January 1, 2028, after which unclaimed DFX is burned.
The mechanics leave victims with a three-way choice that Drift’s documentation states plainly: redeem DFX for USDT at the current redemption amount, sell it on a secondary market such as Raydium, or hold it and let the pool grow as deposits arrive and supply shrinks. Because a redemption burns DFX and removes USDT in the same proportion, the redemption amount itself does not fall when holders exit — each future deposit is simply shared among fewer remaining tokens. The trade-off is time against certainty, and Drift has not tied pool growth to a fixed repayment schedule.
What the Deposits Do Not Prove A Tornado Cash deposit does not establish what happened to the funds next. The mixer pools deposits so they can be withdrawn from fresh addresses, and moving ETH into it is not proof that the tokens were sold, converted to cash or moved to an exchange. Lookonchain’s framing — “moving ETH to Tornado Cash” — stops at the observable transfer, and the trackers themselves disagree on the remaining balance, with Lookonchain citing 81,864 ETH after the October 20 deposits and Arkham’s entity page later showing about 56,569 ETH.
Freezing or recovering any of the stash would require an exchange or custodian willing to act on the labels, since Ethereum addresses cannot be blocked at the protocol level. That is why Drift’s recovery path runs through a bounty program and law enforcement rather than through the mixer itself.
What is not yet known is whether any of the laundered funds can be clawed back, or whether law enforcement will tie the movement to the actors Drift has named. Until a court or a recovery action produces a result, the North Korea attribution remains an allegation and the $109.15 million figure remains an on-chain estimate rather than a completed liquidation.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
In brief The Grand Theft Auto 6 trailer mentioned a Dacity Coin, and a previous leak of the game showed a mission requiring the protagonist to perform a stunt to pump the coin. Meme coin traders have now created a real-world, unofficial token and are pumping it as they hope Dacity Coin will be a big part of the upcoming game. Some believe that it'll just be a feature of some side missions, while others think it'll be a tradable in-game asset. The recent Grand Theft Auto 6 launch trailer briefly mentioned a "Dacity Coin," and crypto traders are speculating on how involved the apparent meme coin will be in-game. Some believe it'll feature in a few side missions, while others believe it'll be a fully tradeable in-game asset.
In response, crypto degens have created an unofficial Solana meme coin of the same name and pumped it to a peak market capitalization of $15 million. Traders say they are essentially gambling on the prominence of Dacity Coin in GTA 6, believing that if it is deeply integrated, it'll lead to bigger gains—despite the Solana token having no official ties to the game.
"I think there will be some missions related to Dacity Coin where [GTA 6 protagonist] Lucia will need to promote it to earn money," pseudonymous meme coin trader Nicstho told Decrypt. "This is the classic thesis."
This theory is corroborated by leaked gameplay of an apparent mission, released more than a week ago by notorious Rockstar hacker "Cyberleek." According to the GTA wiki, Lucia is asked to parachute as a stunt to attract investment to the Dacity Coin.
"Give them a show. They'll buy Dacity Coin before they even know what it is," someone tells Lucia on the phone during the mission, according to a leaked screenshot.
In the official launch trailer, a wing walker sets off a smoke bomb atop a plane plastered in Dacity Coin branding. This has led some traders to believe that the Dacity Coin could be featured in multiple missions, with the player tasked with performing crazy stunts to pump the token—just like real-world meme coin traders have done in the past.
Dacity Coin also appears to be connected to an in-game brand called AudaCity, with AudaCity featuring in both the leak and trailer alongside the coin. It appears that AudaCity is the company behind the Dacity Coin, per the GTA wiki.
Some traders believe that the meme coin will feature more heavily than just a couple of side missions. Nicstho said that the bull thesis is that Dacity Coin is an in-game currency that can be spent both in single-player and multiplayer, adding that would be "huge" for the real-world Solana token—despite there being no official link between the two.
"I guess you’ll be able to trade it like you trade stocks on GTA V," pseudonymous meme coin trader Corey Ape told Decrypt. "Just think the last GTA you could buy any of the stocks from the mission on the game, you can probably do the same here."
Myriad: Where does the CS2 knife index go next? Click to make your prediction.Corey Ape said that this is purely gut instinct, but it makes sense. In GTA V's single-player story mode, gamers could invest in stocks in an attempt to get rich quick—entire investment guides were created around this feature. Corey Ape believes it is only natural for an in-game meme coin to be tradable by gamers, after Rockstar set this precedent in the last game.
"Obviously the [real-world] coin hasn't been launched by Rockstar," Nicstho said. "They just want to mog memecoin traders."
As rumours and speculation continue to swirl, the real-world Solana token has soared. One trader has unrealized profits of $285,000 from just a $20,000 investment, according to trading platform Pump.fun. Though it's important to stress none of this is realized and it could sharply fall at any moment, as is the nature of meme coins.
A section of crypto traders are now eagerly awaiting GTA 6's November release, hoping it'll pump their bags.
Rockstar did not respond to Decrypt's request for comment.
Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers
Create an account to save your articles.
Add on Google
Add Decrypt as your preferred source to see more of our stories on Google.
Not financial or tax advice. PANews content is strictly educational and informational and is not investment advice, financial advice, tax advice, legal advice, or a solicitation to buy or sell any digital asset, security, or financial product. Do your own research and consult qualified advisers.
Disclosure. PANews may publish sponsored content, partner content, advertisements, affiliate links, event promotions, and market commentary involving Web3 projects, service providers, or financial products. PANews personnel, contributors, or affiliates may hold digital assets or other interests related to covered topics. See our Terms of Service.
