replacement

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

The latest research report from the Hyperliquid Policy Center (HPC) states that perpetual contracts expand hedging options and improve price discovery, with no evidence found of statistically significant harm to the benchmark futures market. The report argues that perpetual contracts are complementary to traditional futures with expiration dates, rather than zero-sum substitutes.The study utilizes the natural experiment of traditional markets being closed on weekends while perpetual markets continue trading, comparing 205 weekends of Bitcoin trading and 19 weekends of on-chain crude oil perpetual (xyz:CL) samples. The report states that expiring futures require calendar-based forced rollovers, with the cost of rolling a $10 million exposure on the Monday of April 2026 being about $950,000, while on Friday it is about $110,000; perpetual positions do not have this forced cost. The median transaction price for on-chain crude oil perpetual during non-trading hours is about $1,300, approximately one percent of the benchmark WTI median transaction price.HPC also provides an example where the crude oil weekend repricing on the week of March 6, 2026, was 15.8%, with the benchmark market completely closed; if hedged through on-chain crude oil perpetual, a $10 million position loss could be reduced from about $1.58 million to approximately $62,000 (after accounting for all costs).

Binance will suspend the deposit and withdrawal services for AC Milan Fan Token (ACM), AS Roma Fan Token (ASR), Atlético de Madrid Fan Token (ATM), FC Barcelona Fan Token (BAR), Manchester City Fan Token (CITY), Juventus Fan Token (JUV), OG Fan Token (OG), and Paris Saint-Germain Fan Token (PSG) on the Chiliz Chain (CAP20) at 09:00 on May 11, 2026.After the contract swap is completed, the original tokens will be renamed to ACMOLD, ASROLD, ATMOLD, BAROLD, CITYOLD, JUVOLD, OGOLD, PSGOLD, and all old tokens will be swapped for new tokens at a ratio of 1:1.

OKX will officially launch the USDS/USDT spot trading pair on April 17, 2026, at 17:00. From April 13, 2026, at 15:00, DAI-related trading services will be suspended, and on April 15 at 16:00, DAI deposit, withdrawal, and fund transfer functions will be closed. All eligible DAI will be swapped at 17:00 on April 15, and after the swap is completed, DAI will no longer be displayed in the asset list.

Binance announces that Alpha 2.0 will support the contract swap for DeAgentAI (AIA). Starting from December 11, 2025, 20:00 (UTC+8), Binance Alpha 2.0 has temporarily suspended AIA trading to execute this contract swap. The contract swap will be executed at a ratio of 1:1. The snapshot time is December 11, 2025, 20:00 (UTC+8). Binance Alpha 2.0 will resume DeAgentAI (AIA) trading on December 15, 2025, 16:00 (UTC+8).

ChainCatcher message, according to the official MKR plan and OKX arrangements, MKR will be swapped for SKY at a ratio of 1:24,000. Today at 17:00, OKX will stop lending MKR, and from September 3rd 16:00 to 18:00, leveraged trading of MKR/USDT will be suspended; on September 4th at 16:00, the MKR/USDT perpetual contract will be delisted.On September 8th from 10:00 to 11:00, OKX will delist MKR-related spot trading pairs and suspend services such as flash swaps, and at 12:00, MKR deposits, withdrawals, and transfers will be closed; on that day at 13:00, a snapshot of MKR accounts will be taken (positions < 0.0001 will not be counted), and from September 8th 13:00 to September 10th 18:00 (UTC+8), the swap will be completed, with MKR being converted to SKY for distribution. The trading time for SKY will be announced separately.

ChainCatcher news, according to the official announcement from Upbit, in order to cooperate with the rebranding of the EOS network and the token swap, the deposit and withdrawal services for EOS and IQ tokens will be suspended starting from June 4, 2025, at 11:00 AM (Korean Standard Time). At the same time, the withdrawal functions for 6 other tokens, including ADD and BLACK, will also be suspended. The EOS/KRW and EOS/BTC trading markets will be suspended starting from June 5 at 2:00 PM, and after resumption, the market names will be changed to A/KRW and A/BTC.According to the project party's announcement, EOS will be renamed to Volta (with the token symbol changing to A), with a conversion ratio of 1:1. Volta plans to focus on developing Web3 financial services, including wealth management and payment sectors. Upbit stated that it will maintain communication with the project party to ensure the safety of user assets, and the specific resumption time will be notified separately.

ChainCatcher news, according to the official announcement, OKX will support a 1:1 token swap based on the official EOS plan, where the original EOS assets will be swapped for the new token A, with a snapshot taken on May 27, 2025. The snapshot accounts include funding accounts and trading accounts. After the swap is completed, the held EOS assets will be exchanged for A and credited to the funding accounts. The trading and deposit/withdrawal times for A will be announced separately.

ChainCatcher news, according to official sources, Arena-Z announced that LOKA will be renamed to A2Z, with each LOKA being exchangeable for 20 A2Z.

ChainCatcher message, this morning according to community users' feedback, some Alipay users have recently received promotional advertisements for Huabao Fund's cryptocurrency fund, and this advertisement has now been replaced.Previously reported, promotional advertisements for cryptocurrency funds appeared on the homepage of Alipay for users in mainland China.

ChainCatcher news, according to Bloomberg, major Democratic donors on Wall Street are intensifying their efforts to urge Vice President Kamala Harris's team to replace Federal Trade Commission (FTC) Chair Lina Khan and Securities and Exchange Commission (SEC) Chair Gary Gensler if she wins the election in November.According to informed sources, these wealthy donors have repeatedly named Khan during calls and fundraising events, accusing her of hindering the development of the tech industry and other economic sectors. Since IAC Chairman Barry Diller and LinkedIn co-founder Reid Hoffman publicly called for Khan's removal in July, discussions about a private replacement have become increasingly heated.At the same time, some insiders have indicated that bipartisan donors are also dissatisfied with Gensler, believing he has an arrogant attitude towards Wall Street. Billionaire Mark Cuban stated this week to CNBC that he has asked the vice president's team to consider him for the SEC chair position.Although donors may continue to lobby privately, they are unlikely to stop their contributions over the issue of Khan's fate. Harris's team has also not made a clear statement to donors regarding Khan's position. FTC spokesperson Douglas Farrar declined to comment, while SEC spokesperson stated that its initiatives are aimed at improving the efficiency, transparency, and resilience of U.S. capital markets.

According to ChainCatcher's news, it has been exclusively learned from Wu that Bybit has recently undergone a large-scale replacement of internal executives, with the heads of almost all business departments, including spot, derivatives, customer service, and VIP, being replaced for unknown reasons. The current management of Bybit includes CEO Ben and COO Helen, the latter of whom is responsible for HR and other business departments.Earlier, after the Notcoin delayed crediting incident, Bybit's management had already experienced a major upheaval, with several executives "voluntarily resigning." The sudden launch of user registration for Chinese users by Bybit has also caused panic among some employees.Helen responded to Wu, stating that the current changes in leadership are a routine arrangement for organizational development, and the company is still expanding into multiple regions, aiming to focus on stronger localization and provide the most relevant products for regional users.

ChainCatcher news, the blockchain data storage protocol Serenity Shield announced today that the project-related MetaMask wallet has been compromised. In response, the team has taken urgent measures to protect the interests of community members: trading of the SERSH token on PancakeSwap has been immediately suspended, and trading on Gate and MEXC has also been halted.It is reported that Serenity Shield is re-launching the smart contract to initiate the SERSH token, with previous SERSH holders receiving new tokens at a 1:1 ratio. More details about this replacement plan will be announced later.

ChainCatcher news, Slow Mist founder Yu Xian posted on social media that a replacement loop attack has emerged in the Lightning Network, which is somewhat similar to the sandwich attack in MEV, using a front-and-back squeeze to extract funds from the targeted victim.The implementation of this attack method is not easy and requires meeting the following conditions: opening two channels on the victim; routing payments through one of these two channels; successfully replacing the victim's HTLC-timeouts within Δ blocks; at the same time, ensuring that the victim does not discover the HTLC pre-image transaction.Before this risk is mitigated, project teams using the Lightning Network should be cautious when establishing channels with upstream and downstream partners, preferably collaborating with reputable entities to reduce the risk of being squeezed. Specific situations still need further testing and verification.

ChainCatcher message, OKX will conduct a swap of LBR tokens, exchanging LBR (V1) for LBR (V2) at a ratio of 1:1. The specific arrangements are as follows:On September 25 at 2:00 PM (UTC+8), the LBR deposit and withdrawal functions will be closed, and the swap will begin; trading of LBR will not be affected. After the swap is completed, OKX will resume the deposit and withdrawal functions for LBR, but will no longer support deposits of LBR (V1), only deposits of LBR (V2). Users are advised to pay attention when making deposits to avoid any financial loss.

ChainCatcher message, Lido releases V2 version progress update: The preparation work for the replacement of withdrawal vouchers has been completed, and all withdrawal voucher messages have been successfully signed (replacing 0x00 voucher with 0x01). Once the Shanghai upgrade is completed, message broadcasting can be carried out to complete the voucher replacement.It is reported that the replacement of withdrawal vouchers and the Staking Router are the two main focuses of Lido v2. In addition, 0x00 and 0x01 are two different types of withdrawal vouchers, with the former being the default withdrawal voucher that does not require specifying a withdrawal address during withdrawals; the latter requires specifying a withdrawal address in the withdrawal request. (Source link)