formation

On October 28, Binance founder Zhao Changpeng stated that four data breaches were reported that day. In the cryptocurrency sector, Coinbase vendor Amplitude exposed some users' contact data, but funds were unaffected; South Korean trading platform Bithumb experienced a user data breach.In traditional finance, South Korean securities firms Mirae Asset and Daishin Securities also experienced data breaches. Zhao Changpeng mentioned that it is impossible to prevent breaches from occurring, but users can protect themselves. The leaked trading platform data includes names, email addresses, phone numbers, addresses, identification documents, and transaction records, most of which are used for phishing, SIM card hijacking, and social engineering attacks.Zhao Changpeng suggested reducing the information shared and using separate email aliases for each trading platform, so that in the event of a breach, it cannot be linked to other accounts while identifying which service experienced the breach.

The Chief Information Security Officer of Slow Fog, 23pds, stated that the data breach at Coinbase has been confirmed, but it has not yet been confirmed whether passwords or funds have been stolen. Hackers obtained contact information for over 70,000 users.

Galaxy Research report shows that the share of Meme coins in Solana's trading volume has dropped from over 50% at the end of 2024 to 15% to 20% in the second quarter of 2026. In addition, SOL has seen a decline of nearly 20% this year, and the U.S.-listed spot and staking SOL ETFs have recorded outflows for two consecutive weeks this month, totaling approximately $50 million.Meanwhile, Solana's share in on-chain perpetual contract trading volume has decreased from 17% to 6%. It is reported that the Solana Foundation has issued a statement indicating that Solana's transformation is underway, attempting to shift from a growth model reliant on Meme coins and speculative trading to more mainstream financial applications such as stablecoins and tokenized assets, in order to attract adoption from Wall Street institutions. However, with the cryptocurrency market in a downturn and competitors like Hyperliquid rising, Solana faces challenges in its growth model transformation. Market analysts point out that Solana's future key lies in its ability to attract stable assets, developers, and users, rather than relying solely on speculative trading to drive growth.

According to Bloomberg, Japanese IT giant GMO Internet has faced a cyber attack, and hackers claim to have released customer information due to the failure to receive a $50 million ransom. It is reported that its foreign exchange trading services have been suspended and are no longer accepting new subscriptions. In addition, all servers of its domain and cloud service Onamae have been compromised, which may affect users.It is reported that GMO Internet operates the cryptocurrency exchange "Z.com EX," which has been licensed by the Securities and Exchange Commission of Thailand and the Ministry of Finance of Thailand. Last week, the exchange disclosed that it had been acquired, with the acquisition involving all shares of the target company held by GMO Internet and its related subsidiaries and shareholders.

The hardware wallet OneKey co-founder Yishi stated that in light of recent data breaches and supply chain attacks in the hardware wallet industry, OneKey will further strengthen user privacy protection.OneKey has confirmed through the Shopify API that relevant historical order records and personal information such as names, emails, and shipping addresses have been deleted, and is further investigating other systems and third-party integration services. In the future, it will ensure that personal information related to orders within its control is permanently deleted within 30 days, and plans to gradually migrate its e-commerce business to self-controlled infrastructure to reduce reliance on third-party platforms like Shopify.Yishi also stated that the data retention policies of logistics service providers such as FedEx and UPS are not controlled by OneKey, and it cannot guarantee that all third parties adhere to the same 30-day timeframe.

According to the official announcement from Foundation, regarding the recent phishing email incident, the team’s investigation found that their email system recorded over 23,000 phishing email sending attempts, of which 19,057 were sent via Mailgun, and another 1,503 were sent via Google Workspace.Due to some email accounts receiving multiple emails, and some sending attempts being unsuccessful or intercepted, it is currently not possible to confirm the actual number of affected individuals.

According to a statement from Keystone Hardware Wallet, its official website was breached on October 20 due to a vulnerability in third-party monitoring tools, resulting in the acquisition of approximately 25,964 purchase records containing personal information, 12,873 unpaid checkout records, and device WebAuth authentication keys. Mnemonic phrases, private keys, and payment information were not affected.Keystone will destroy 18,835 devices containing old keys from its inventory, suspend shipments from the official website, and switch to pre-sales, while reminding users that there is no need to transfer assets and to be wary of scams such as "recalls."

Strive CEO Matt Cole posted the company's Bitcoin holdings data chart on the X platform, captioned "The sats/$SATS perpetual swap has been activated," which may hint at disclosing BTC accumulation data next week.

Galaxy Research published an analysis stating that over the past three weeks, the Bitcoin network has seen approximately 40 inscriptions composed of random letters each day, which appear to be encrypted text but are not actually cryptographic information. The related address had previously written the U.S. Constitution into the Bitcoin network in May.The research found that after analyzing 562 texts, the frequency of the 26 English letters is almost evenly distributed, which is significantly different from the characteristics of normal English and substitution ciphers; metrics such as word length distribution and frequency of repeated words also indicate that these texts are likely generated by a random letter generator.Galaxy Research refers to the operator as the "Babel Scribe," believing it is more like testing a data publishing tool on the Bitcoin mainnet rather than attempting to convey hidden information. The structure of on-chain transactions, the continuous use of change addresses, and the regularity of publication times all exhibit characteristics of automated scripts. Related activities also include testing texts, random words in different languages, binary data, and the subsequent writing of the U.S. Declaration of Independence.It is estimated that the project has transferred approximately 3.33 million satoshis in total, of which about 24% was used to pay miner fees, while the remaining funds are still held in the related address. Researchers suggest that there is no need to interpret these garbled texts as hidden information.

Tom Lee stated in an interview that approximately 99% of financial activities are still operating on traditional financial infrastructure, but this situation may create misleading short-term biases, causing investors and businesses to view cryptocurrencies as a niche area and underestimate the potential speed of transformation in the financial system.Tom Lee believes that the current dominance of traditional financial infrastructure does not mean that this pattern will be maintained in the long term. If financial activities gradually shift towards cryptocurrency infrastructure, institutions' reliance on the existing market structure may lead them to underestimate the speed of industry changes. He also warned that banks that have not established cryptocurrency business channels or formulated relevant strategies may face competitive disadvantages as cryptocurrency adoption increases.

The National Information Security Vulnerability Sharing Platform (CNVD) released a security announcement titled "Analysis and Repair Suggestions for PHP Remote Code Execution Vulnerability," in which it supports affected users to closely monitor official information, download and update to the latest version through official channels. Users who are temporarily unable to update can take measures to reduce certain attack vectors, mitigate vulnerability threats, and continuously monitor for abnormal PHP process exits, abnormal system command calls, unfamiliar process creations, and abnormal file writes, while retaining logs for traceability analysis.In its protection recommendations, CNVD stated that information system operating units should further strengthen security protection, comprehensively sort out their network assets, and reduce the public exposure of information systems according to the principle of not connecting to the internet unless necessary. Operating units that are currently unable to repair should take temporary response measures such as network isolation, network access restrictions, and taking unnecessary business systems offline.

On October 23, the Central Cybersecurity and Informatization Commission issued the "National Informatization 14th Five-Year Plan." The plan proposes that by 2030, significant progress will be made in our country's informatization, with its role in promoting Chinese-style modernization becoming more prominent. The information infrastructure will consolidate and expand its leading advantages, a three-dimensional network system encompassing land, sea, air, and space will be basically formed, a new generation of communication networks will be fully established, the commercial use of the sixth generation of mobile communication (6G) will be launched in a timely manner, and the national blockchain network will be basically established, with intelligent internet development accelerating.The plan also states that the innovation capability of cybersecurity technology will be significantly enhanced, the technological innovation system will be more complete, and breakthroughs will be achieved in key core technologies in key areas. The cybersecurity industry ecosystem will prosper and develop, with deep integration of digital technology and the real economy, and the comprehensive strength of cybersecurity enterprises will be significantly enhanced. The level of digital, networked, and intelligent applications in economic and social development will reach a new level, empowering economic and social development and significantly improving governance capabilities. Cybersecurity guarantees will be solid and powerful, the legal and regulatory standards system will be more complete, and the concept of a community with a shared future in cyberspace will be deeply rooted in people's hearts.

Early investment institution ZhenFund has launched Ask AI on its official website. Entrepreneurs can directly inquire about which teams ZhenFund has invested in, what fields they are currently focusing on, and what activities are suitable for them.ZhenFund has compiled publicly available information about its investment team, invested companies, areas of interest, entrepreneurial activities, and contact information into a bilingual zhenfund.md. After users click on any AI entry point, the website will redirect to Kimi, ChatGPT, Claude, or DeepSeek, and pre-fill the prompts, allowing the model to read the document before answering questions.

Imran Khan, co-founder of Alliance, expressed his views on a16z crypto's shift towards cutting-edge technology. He stated that he is always grateful to a16z for leading the investment in Coinbase in 2013, which provided external validation for the crypto industry; Marc Andreessen's 2014 article "Why Bitcoin Matters" in The New York Times pushed him to shift his career towards Bitcoin.Imran Khan mentioned that at that time, very few institutions or funds were willing to publicly support crypto, and a16z and USV were two funds that took on brand risk. Since then, a large number of talents have entered and reshaped the crypto industry. He believes that the current infrastructure development in artificial intelligence has a practical connection with Bitcoin mining infrastructure and the talent flowing from crypto to artificial intelligence.He stated that the shift from crypto to cutting-edge technologies such as robotics, biology, artificial intelligence, energy, and computing power means that the talents and capabilities built in crypto over the past decade can be applied to a broader range of fields. He cited the resistance faced by data centers as an example, noting that crypto also faced opposition, but traditional finance has now accepted crypto to a certain extent. He believes that cutting-edge technology is the next generation of technology builders, and the world often recognizes the importance of new technologies many years later.

U.S. Secretary of Defense Lloyd Austin has prohibited all Pentagon personnel from using non-public information to place bets on upcoming military operations, involving prediction market platforms such as Kalshi and Polymarket. In a memo sent to senior Pentagon officials and defense agencies on Tuesday, he stated that all Department of Defense personnel are prohibited from using non-public information for financial transactions, with the relevant restrictions covering both classified and unclassified information.Austin wrote in the memo that adversaries will observe movements in these markets, and the safety of U.S. military personnel often depends on the enemy not knowing what is about to happen. He also pointed out that, aside from operational security, financial betting can distort judgment: a logistics personnel betting on the date of an operation will be concerned about that date, and an analyst holding a position on the outcome will also be concerned about that outcome.Before this directive was issued, U.S. Army soldier Gannon Ken Van Dyke was charged in April for allegedly profiting over $400,000 on Polymarket by using classified information regarding the operation to capture Venezuelan leader Nicolás Maduro. Prosecutors claimed he participated in the planning and execution of the operation and used advance knowledge to bet on the outcome of Maduro's ousting; he pleaded not guilty to all charges. In February, Israeli authorities also arrested and charged a military reservist and a civilian for allegedly using classified information to bet on events related to Israeli strikes against Iran on Polymarket.

According to The Information, a16z will remove "Crypto" from the name of its flagship blockchain fund, renaming it to "a16z Frontier," and will shift its focus to other investment areas; the fund's first founding member will also be leaving.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

Founder of Strategy Michael Saylor has once again released information related to the Bitcoin Tracker. He stated, "We found room for more orange."According to previous patterns, the orange dots represent Strategy's Bitcoin purchase records, which may suggest that the company will increase its BTC holdings. Strategy typically discloses changes in Bitcoin holdings the day after relevant news is released.