Author: 行政

An integer overflow in the XRP Ledger’s payment engine could have let an attacker create spendable XRP, according to a disclosure report published on 9 October. The fix shipped in xrpld 3.4.1 on 25 September without a validator vote, a first since amendments began more than ten years ago. Veria Labs, which reported the flaw, says a single transaction could have created 18 trillion XRP and that it received the maximum US$250,000 bounty. XRP Ledger developers disclosed on 9 October a flaw in the network’s payment engine, dating to 2015, that could have let an attacker mint XRP from nothing.…

US spot Bitcoin ETFs recorded US$678.9 million in weekly net outflows, while Bitcoin itself fell 3.3% over the week. Ethereum ETFs extended their outflow streak to nine days, shedding US$697.4 million, with BlackRock’s ETHA accounting for US$450 million. Solana and Zcash ETFs also remained under pressure, with continued net outflows across both products. XRP ETFs bucked the broader sell-off with US$11.3 million in weekly net inflows, extending their positive streak to 13 weeks. It wasn’t a great week for US spot crypto exchange-traded funds (ETFs). Most funds bled heavily, including those tracking major coins, such as Bitcoin (BTC), Ethereum (ETH)…

Ledger has confirmed an unauthorized hardware implant in one affected customer’s wallet as independent investigators estimate $93.2 million in suspected cryptocurrency thefts.In an Oct. 10 statement, the hardware wallet manufacturer said the discovery involved a device belonging to one of the affected users. It added that CryptoBilis, an authorized reseller operating in Southeast Asia, had suspended sales of all hardware wallet inventory pending the investigation’s conclusion.The investigation began after customers reported losing cryptocurrency after buying Ledger devices from the reseller. Ledger has not said how many devices were modified or established that the implant caused all the reported losses.Ledger said…

Aave’s proposed USDG rollover would let borrowers carry their stablecoin debt into a new fixed-yield USDG position, but the replacement collateral currently yields less than three quoted borrowing rates. That leaves leverage and separately administered rewards central to whether extending the trade makes financial sense.The proposal concerns Pendle principal tokens, or PTs, on the X Layer network: holders of the token maturing Oct. 29 would move into a replacement maturing Feb. 25, 2027. In its Oct. 8 assessment, risk provider LlamaRisk said the February token’s on-chain yield alone fell short of USDT0, USDC and USDG borrowing costs. GHO was the…

Starknet’s STRK token more than doubled over seven days while developers considered leaving Ethereum to build an independent Layer 1 blockchain.A CoinGlass snapshot checked at 20:28 UTC on Oct. 11 showed STRK at $0.1190, up 17.7% over 24 hours and 116.7% over seven days.On Oct. 8, Starknet said it was actively considering becoming an L1, with 2027 as its target for what it described as the first fully quantum-resistant network. The proposed move would replace its dependence on Ethereum’s underlying security infrastructure.Starknet considers Ethereum independence to accelerate quantum protectionStarkWare CEO Eli Ben-Sasson has framed the potential transition as a response…

Optimism is expanding its role as the operator of Ethereum-based chains for other brands. Unichain, Uniswap Labs’ Ethereum layer-2 chain, plans to transfer its production sequencing, public node access, monitoring and incident response to Optimism under its October 9 migration announcement.The planned testnet move on Oct. 13 and mainnet move on Oct. 29 extend the operating strategy set out by Jing Wang in Optimism’s Ink announcement: product teams build their applications and ecosystems while Optimism runs the infrastructure beneath them. Soneium’s September agreement follows the same division of labor as Ink’s earlier June plan; both chains use the OP Stack.For…

Researchers found a new iPhone spyware variant that can remotely extract cryptocurrency wallet data and sensitive credentials from compromised devices.Security firm iVerify disclosed the malware, designated P7 DarkSword, on Oct. 8 after investigating an infection detected in August. The variant includes commands that specifically target cryptocurrency wallet apps and can collect passwords, photos, and personal information.The discovery highlights an emerging risk for crypto holders who rely on mobile wallets: attackers who gain access to the underlying device could obtain sensitive information without exploiting a vulnerability in the wallet app itself.How the spyware targets cryptocurrency walletsAccording to iVerify’s technical investigation, P7 includes two…

Some Aave loans backed by yield-bearing collateral had narrow liquidation buffers in LlamaRisk’s Oct. 9 snapshots. Every top PT-AUSD supplier on Monad carried debt, while two syrupUSDC positions accounted for about 97% of supplied syrupUSDC on Arc. Cashing out the collateral involves a market sale or, for Arc holders choosing Ethereum redemption, a withdrawal queue that can take hours.The two markets present separate versions of the same cash-flow problem. If a borrower becomes eligible for liquidation, a liquidator supplies the borrowed stablecoin, receives collateral and then recovers cash from it. December PT-AUSD requires a sale before maturity. Arc syrupUSDC offers…

Evernorth is preparing to begin trading on Nasdaq on Monday, bringing approximately 473 million XRP into a publicly traded treasury company.The company completed its merger with Armada Acquisition Corp. II on Oct. 9 and expects its shares to trade under the ticker XRPN on Oct. 12. It also reported approximately $300 million in gross cash proceeds before transaction expenses, backed by investors including Ripple, SBI Group, Pantera Capital, Kraken, and GSR.The listing gives stock-market investors access to one of the largest corporate XRP treasuries while establishing a new source of capital for the XRP Ledger’s expanding financial ecosystem. Related ReadingXRP…

Lightning Development Kit (LDK), a library for building Bitcoin Lightning wallets and payment applications, has patched a flaw that could let a malicious channel peer steal the value of a forwarded payment by lying after reconnecting. Affected application developers need to incorporate the fix into the software they deploy.The October 1-dated v0.2.7 and v0.1.13 security releases address the LDK reconnect vulnerability on the 0.2 and 0.1 branches, respectively. Bitcoin Optech described the fixes in its Oct. 9 newsletter.How the LDK reconnect flaw could cost BitcoinThe attack starts with a channel peer acknowledging an update, then reconnecting and pretending it never…