discove

SlowMist announced that a new recruitment scam targeting Web3 practitioners has recently been discovered. Attackers impersonate recruiters, luring victims to install an AI meeting software called "Relay," which is actually an information-stealing malware.This malware targets both macOS and Windows users and can steal sensitive information such as browser credentials, cryptocurrency wallet-related data, Keychain data, Telegram sessions, and more. SlowMist has completed sample analysis and disclosed how this attack chain operates. SlowMist reminds that when participating in online interviews or recruitment processes, one should be cautious about installing unfamiliar software, avoid running unverified applications, and pay attention to unusual installation requests or system password prompts.

Anthropic announced that the Claude Mythos Preview model has made breakthroughs in cryptographic research, discovering improved attack methods against the post-quantum digital signature candidate HAWK. HAWK is a post-quantum signature candidate solicited by NIST to combat quantum computer attacks, which has already passed two rounds of expert review. However, Claude reduced the effective key strength of HAWK-256 from 2^64 to 2^38 in just 60 hours, significantly lowering the theoretical cost of cracking. HAWK has not yet been deployed in practice, and this attack currently does not affect any production systems.Claude also discovered an improved attack against 7-round AES, achieving a speed increase of 200 to 800 times. During the research process, Claude independently completed literature reviews, mathematical reasoning, and experimental validation with limited guidance from cryptographers. The HAWK attack took about 60 hours and had an API cost of approximately $100,000; the AES attack was completed independently by Claude, which generated about 1 billion tokens before proposing core innovative ideas. Anthropic researchers then spent hundreds of hours validating the results. Anthropic stated that AI models can now help identify significant flaws in cryptographic algorithms, and the cryptography community may face bottlenecks similar to those in the software vulnerability field—AI-generated research results far exceed human verification capabilities. Anthropic has collaborated with academic institutions to launch the CryptanalysisBench benchmark and coordinated disclosures with NIST authors and government partners. The research team has achieved preliminary results on algorithms such as LEA and Serpent-128. Anthropic warns that as AI capabilities improve, actual attacks against deployed systems may be discovered in the future, necessitating the establishment of response mechanisms in advance.

Cryptocurrency payment infrastructure company Moonpay has supported payments from the U.S. card network Discover, allowing Discover Network cardholders to buy and sell cryptocurrencies through the Moonpay platform. Discover Network becomes the third major card brand supported by Moonpay in the U.S., alongside Visa and Mastercard. Moonpay stated that this support covers over 500 of its business partners, including wallets, exchanges, and applications. Moonpay also supports Apple Pay, Google Pay, PayPal, Venmo, bank transfers, and regional payment channels. Founded in 2019, Moonpay serves over 30 million customers across 180 countries and holds a BitLicense from New York, a limited purpose trust license from New York, multi-state money transmission licenses in the U.S., and MiCA authorization in the European Union.

According to IT Home, ByteDance announced today the official launch of the Seed STEM Scientist Program, inviting 100 outstanding scholars from the forefront of scientific fields to collaborate on real research problems and promote AI-accelerated scientific discovery.This program is initiated by the Seed Edge research team, providing ample computing resources and competitive salaries. Participation is divided into two categories: scientific advisors and doctoral interns. The first phase of the program is expected to last about 6 months, with the work location in Haidian District, Beijing. The application deadline is September 30, 2026.

According to CoinDesk, the Ethereum Foundation recently disclosed that its security team used AI agents to test the software running on Ethereum validator nodes and successfully discovered a remotely triggerable vulnerability that could cause node crashes. However, researchers emphasized that human review remains a key step in distinguishing real vulnerabilities from false positives among the large number of security reports generated by AI.It is reported that the discovered vulnerability exists in the Ethereum network message propagation protocol gossipsub, where an attacker can remotely trigger the node software to enter an abnormal computation state, causing the program to crash and shut down, making the validator node go offline until the operator manually restarts it. This vulnerability has been fixed and registered under the identifier "CVE-2026-34219."Nikos Baxevanis, a member of the Ethereum Foundation's protocol security team, stated that what was truly surprising about this incident was not the AI's ability to discover vulnerabilities, but rather the amount of time the team spent discerning which vulnerabilities were real and which were merely seemingly credible "illusions."

According to Decrypt, researchers from Tel Aviv University, the Technion - Israel Institute of Technology, and Intuit have discovered a new type of attack method called "adversarial illusion injection." This technique exploits the illusion phenomenon of AI models to trick AI agents into downloading malicious code and potentially forming a botnet.Attackers predict the false resource links that AI models might generate and register them in advance, embedding malicious instructions within. When the AI agent retrieves the resource, it treats it as legitimate content and executes it. Tests show that the illusion occurrence rate in code repository cloning scenarios reaches 85%, and in skill installation scenarios, it reaches 100%. AI coding assistants such as Cursor, GitHub Copilot, Gemini CLI, and OpenClaw are all affected. This attack is similar to "typo-squatting" in traditional cyberattacks, but it targets the errors of AI models rather than human input errors. Previous research has shown that malicious websites can inject prompts to hijack AI agents, and OpenClaw users have reported over 6,000 attempts to trick AI agents into leaking sensitive information.

The Ethereum Foundation Protocol Security team researchers stated in a blog post on Thursday that a series of AI agents have been deployed to test the software relied upon by Ethereum, searching for vulnerabilities in the cryptographic systems, protocol code, and smart contracts. The vulnerabilities discovered by the AI agents include a remotely triggerable panic issue in the peer-to-peer layer libp2p gossipsub used by the Ethereum consensus client, which has been fixed and disclosed on GitHub as CVE-2026-34219.The researchers noted that the AI agents are organized into specialized roles such as reconnaissance, searching, patching, and verification, aimed at identifying potential attack paths, reproducing failures, and verifying their applicability to production code. The Ethereum Foundation stated that AI has not replaced security researchers but has changed the way they work, allowing the team to cover a much broader scope than manual reviews, although researchers need to exercise more careful judgment over a large number of seemingly credible conclusions.

The Japanese cryptocurrency exchange Bitbank today issued a risk warning to users regarding the use of prediction market services such as Polymarket.The announcement pointed out that prediction platforms that trade on future events, elections, or sports results using cryptocurrency assets are mostly operated by overseas institutions. If users access these platforms from within Japan and participate in trading for the purpose of making financial gains, they may be suspected of violating Japan's relevant gambling regulations.Bitbank emphasized that if the platform detects withdrawal and deposit records related to prediction markets or suspected related services in a user's account, it may implement suspension measures on that account. Once an account is suspended, the user will be unable to log in, trade, or withdraw and deposit cryptocurrency assets and yen, and the platform will not be responsible for any losses incurred as a result.

OKX founder Star commented on OKX Boost while retweeting a post from RootData, stating that it is not just an incentive but also an early discovery and price discovery mechanism for new projects.In the tweet, RootData, in collaboration with OKX, released the first quarter report for OKX Boost, which shows that during the event, 23 projects distributed over $11 million in incentives, with an average of about 20,000 active participants per event and an average transparency score of over 70%. The listing rate for OKX spot or futures reached 45%.

Meta Pool indicates that a suspicious contract has been found attempting to impersonate a legitimate staking pool and tokens. Meta Pool emphasizes that this contract is not associated with Meta Pool or any official NEAR liquidity staking provider.

According to Decrypt, Mozilla recently revealed that Anthropic's latest AI model, Claude Mythos, identified 271 security vulnerabilities during internal testing of the Firefox browser, and the related vulnerabilities have been fixed this week.In comparison, a previous version of the Anthropic model only found 22 security-sensitive vulnerabilities. Mozilla stated that all discovered vulnerabilities were within the scope of top human researchers' findings. Claude Mythos was officially released in March 2026 and is Anthropic's most powerful model in the fields of reasoning, coding, and cybersecurity, currently available for use by vetted partners such as Amazon, Apple, and Microsoft through the "Project Glasswing" initiative.

According to The Block, the Solana ecosystem decentralized exchange Stabble issued an emergency notice urging liquidity providers to withdraw their funds immediately, due to a North Korean employee who previously worked on the project. This warning appears to have been triggered by information from on-chain detective ZachXBT, who disclosed that a North Korean developer had worked for many years on the Solana DeFi infrastructure project Elemental.U.S. authorities had previously issued warnings that North Korean technicians were infiltrating crypto companies using false identities. Over the weekend, Drift Protocol stated that its $280 million attack incident was likely carried out by the same North Korean hackers responsible for the October 2024 Radiant Capital attack. Stabble responded that the North Korean employee seemed to have joined a year ago, and a new team took over the project four weeks ago, emphasizing that no attacks have occurred so far and that the warning was merely a precaution. Stabble stated that it would conduct a new audit to ensure LP safety.

The 360 vulnerability mining agent recently discovered and reported 1 high-risk and 2 medium-risk high-value vulnerabilities related to OpenClaw, totaling 3 vulnerabilities. Currently, all newly discovered vulnerabilities have been officially patched and publicly disclosed.It is understood that the three newly discovered vulnerabilities directly target the core operating mechanism of AI agents, directly affecting the core security of user devices, data, and accounts.

The China Academy of Information and Communications Technology, in collaboration with Shanghai Jiao Tong University and Nanjing University, discovered a high-risk vulnerability driven by LLM command injection in the bash-tools module of the open-source autonomous intelligent agent framework OpenClaw during a security audit.This vulnerability arises from the system's failure to strictly escape command line parameters generated by LLM, allowing attackers to bypass regex defenses through inducive prompts, achieving remote code execution on the host machine and stealing sensitive data.The research team has completed attack verification in various mainstream model environments, initiated a responsible vulnerability disclosure process, and submitted repair suggestions to the NVDB Artificial Intelligence Product Security Vulnerability Professional Database (CAIVD) and the GitHub community.

White hat hacker f4lc0n posted on the X platform revealing that he discovered a "critical" vulnerability in the Injective protocol that could lead to over $500 million in assets being directly withdrawn from the blockchain. However, the project team only offered him a $50,000 bounty, far below the planned maximum limit of $500,000 for this level of severity.f4lc0n stated that the vulnerability allows any user to empty any account on the blockchain without special permissions. After submitting a report through Immunefi, the Injective team initiated a mainnet upgrade vote the next day to fix the vulnerability, but they were "unreachable" for the following three months.Currently, f4lc0n has disputed the amount of the bounty and stated that the $50,000 bounty has not yet been paid. He announced that he will allocate 10% of future bug bounty earnings to continue publicizing this matter until Injective pays the compensation as per the standard.

According to The Block, Ledger's security research team Donjon has discovered a vulnerability in the secure boot chain of MediaTek processors, allowing attackers to extract encryption keys via USB connection before the operating system loads, provided they have physical access to the phone. This could enable them to decrypt device storage and obtain the device PIN code and encrypted wallet mnemonic within approximately 45 seconds.In proof-of-concept tests, the vulnerability successfully extracted sensitive data from wallet applications such as Trust Wallet, Kraken Wallet, and Phantom. Researchers indicate that this vulnerability may affect about 25% of Android phones, involving models that use MediaTek chips and Trustonic's Trusted Execution Environment. Ledger's Chief Technology Officer Charles Guillemet stated that smartphones were never designed to be vaults. Although the vulnerability can be patched, it highlights the inherent risks of storing keys on non-secure devices, and users are advised to update security patches as soon as possible.According to data from TRM Labs, over 80% of the $2.1 billion in stolen crypto assets in the first half of 2025 stemmed from infrastructure attacks such as private key theft, mnemonic theft, and front-end hijacking. Chainalysis data shows that losses from crypto asset theft exceeded $3.41 billion in 2024, with the proportion of stolen personal wallets rising from 7.3% in 2022 to 44% in 2024.

Cosmos Labs posted on the X platform, stating that a vulnerability has recently been discovered, affecting certain blockchains built on the Cosmos EVM Stack. This vulnerability has impacted the Layer 1 blockchain Saga in the production environment.Cosmos Labs stated that its team has been investigating the issue in collaboration with Saga and ecosystem partners, and has coordinated the implementation of mitigation measures. A security patch has now been released to the affected blockchains.

GMX DAO recently approved a strategic plan to address the limited effects of ongoing buybacks and the pressure on prices caused by excess supply from CEX.According to the new plan, starting this week, staking rewards will be directed to the protocol treasury, and the protocol's liquidity will be concentrated in GMX's own infrastructure. This move is reportedly aimed at optimizing the price discovery mechanism, reducing the impact of excess supply from exchanges on the market, and strengthening the intrinsic value support of the protocol.