third-party

Solana Mobile posted on platform X that its third-party marketing email service provider Brevo experienced a security incident affecting some customer accounts, including Solana Mobile. The team discovered unauthorized access to its Brevo account, has disabled the account, and is working with Brevo to understand the extent of the accessed information.Solana Mobile stated that, as far as they know, no emails have been sent from their account, but they are continuing to verify. They also remind users that Solana Mobile will not ask for mnemonic phrases, private keys, or wallet recovery information.

According to Bloomberg, U.S. regulators released a statement on Friday announcing a proposed guideline on third-party risk management for banks. The Federal Reserve, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the National Credit Union Administration stated that the proposal aims to help banks and credit unions "better align and customize their third-party risk management practices to match the risks of various third-party relationships."Federal Reserve staff indicated in a memorandum that as this plan is introduced, banks are increasingly outsourcing certain functions and relying on third-party relationships to improve efficiency and reduce costs. The plan will be open for public comment, is non-binding, and aims to focus institutions' regulatory attention on a principles-based approach to such risks. Federal Reserve Governor Barr opposed the proposal, citing concerns about the standards for "significant financial risks."

According to a report by Reuters, Apple Inc. is facing a class-action lawsuit in London, with claims amounting to £2 billion (approximately $2.7 billion). The lawsuit was filed today in the London Competition Appeal Tribunal by Ann Pope, a former senior official of the UK's Competition and Markets Authority, representing app developers.The core allegation is that Apple's "App Tracking Transparency" (ATT) feature, launched in 2021, imposes stricter restrictions on third-party developers than on its own services, giving Apple's own advertising ecosystem an unfair competitive advantage. Ann Pope stated that Apple's policies "have caused very significant harm to businesses that rely on Apple as a gatekeeper."Since its launch, the ATT feature has been a focal point of concern for global regulators for several years. Apple's official stance is that the feature is designed to allow users to control whether to permit apps to track their activities across other companies and websites.However, the plaintiffs argue that the actual enforcement of this rule has a double standard—tracking requests from third-party apps require strict pop-up authorization, while Apple's own personalized ads and services can bypass the same restrictions. This lawsuit represents the latest legal challenge Apple faces regarding its ATT policy and is the first large-scale private antitrust lawsuit initiated in the UK market against Apple's app ecosystem rules following scrutiny from regulators in the EU, the US, and several other countries.

The cryptocurrency wallet project SafePal has released updates on the security incident, stating that it is continuously tracking phishing websites and impersonation accounts, and plans to introduce a professional anti-phishing security company to expedite the removal of malicious information to protect user asset security. SafePal mentioned that it is currently in the final selection process among four professional anti-phishing security companies, and once a partner is selected, it will further enhance the efficiency of handling threats such as counterfeit websites and scam accounts.The team is also continuously monitoring whether the affected data has been sold or made public, including channels such as dark web forums and trading markets. Once signs of data leakage are detected, affected users will receive risk alerts immediately. Regarding security audits, SafePal stated that it is in the final selection among three mature independent security institutions, which will conduct a comprehensive security review of the order system. Meanwhile, the team is reassessing the order and logistics processes to reduce the amount of data that needs to be stored in the initial phase of the system, thereby reducing potential risks from the source.For affected users, SafePal stated that it will continue to provide one-on-one assistance through official support channels and will keep updating the fraud protection page, providing updates on the incident, FAQs, and analysis of fraud cases. SafePal once again reminds users: the official will never ask users to provide their seed phrase. Users should not disclose their seed phrase to anyone, should not scan unknown QR codes or click on suspicious links, and should verify the source of information through official channels.

Bitcoin News posted on the X platform that the 256 Foundation has launched the 256 Red Team security project, which audits ASIC miner firmware through reverse engineering, real-time traffic capture, and reconciliation by share level. The team stated that 41 issue reports have been submitted regarding the original Bitmain firmware as well as third-party firmware such as LuxOS, VNISH, and Braiins OS.Identified issues include unauthenticated factory APIs, paths that allow root access, default credentials, built-in vendor SSH keys, and updaters that cannot verify installed content. After reverse engineering the Bitmain miner daemon and checking real-time connections, researchers reported that no evidence of hash power hijacking, remote kill switches, or hidden beacons was found in the original Bitmain firmware; the related risks are mainly concentrated in third-party "optimized" firmware.Researchers have submitted 3 responsible disclosures to VNISH, Luxor, and Braiins, granting each party 30 days to respond before public disclosure. MicroBT, Canaan, Auradine, Bitdeer, and ePIC will undergo follow-up audits.

According to the official announcement, Binance has announced support for users to deposit eligible third-party tokenized stocks and convert them 1:1 into corresponding bStocks. During the event period (until August 26 at 23:59 UTC), the conversion rate is fixed at 1:1 and is free of charge.Currently, it supports four assets: Tesla (TSLAon), MicroStrategy (MSTRon), Coinbase (COINon), and Circle (CRCLon), with versions available on both the ETH and BSC chains. The converted bStocks can be traded around the clock or redeemed 1:1 for the underlying stocks.Binance stated that the deposited third-party tokenized stocks can only be held or converted into bStocks and cannot be used for spot trading.

According to a report by CryptoSlate, BitMine's Ethereum staking and validation business heavily relies on the third-party operator Ethereum Tower. According to the relevant management service agreement, Ethereum Tower holds an irrevocable interest of 2% in MAVAN, and the initial term of the agreement lasts for up to 10 years; if BitMine terminates the cooperation early under non-specific default circumstances, the other party can still choose to continue receiving revenue sharing for the remaining term or receive a one-time compensation according to a formula.Documents show that in the three months ending May 31, 2026, BitMine's staking and validation business revenue was $45.743 million, accounting for 98.3% of total revenue of $46.535 million. During the same period, the company held approximately 5.4169 million ETH, valued at about $10.856 billion, of which approximately 4.7187 million had been used for staking. The report suggests that this means BitMine's revenue performance is not only dependent on Ethereum staking returns but is also significantly constrained by third-party management relationships and potential termination costs.

According to CoinDesk, as the competition for tokenization in the capital markets heats up, the Securities Transfer Association (STA) recently submitted a letter of opinion to the U.S. Securities and Exchange Commission (SEC), warning that stock tokens issued by third-party organizations may undermine market integrity and calling on regulators to prioritize support for tokenized securities authorized by publicly listed companies in future rule-making.The STA represents several Wall Street transfer agents, whose members believe that true tokenized stocks should be formally authorized by the issuing company and recorded in the official shareholder register, rather than created as "packaged" token products by independent platforms.The association pointed out that third-party stock tokens may confuse investors about the actual rights they hold and expose them to risks related to platform credit, custody, and operations, without establishing a direct legal relationship with the publicly listed company. Therefore, any innovative exemptions, pilot projects, or permanent regulatory frameworks for tokenized securities should prioritize the issuer-supported model.The STA also urged the SEC to reform the existing Direct Registration System (DRS), arguing that the current U.S. securities custody system is inadequate to meet the real-time transfer and settlement needs of on-chain securities, and suggested that regulators collaborate with the Depository Trust & Clearing Corporation (DTCC) to optimize the digital securities infrastructure.Currently, the global market for tokenized stocks, valued at approximately $2 billion, is primarily dominated by third-party models, including products launched by Ondo Finance and Kraken, while organizations like Securitize and Figure adopt the issuer authorization model.

Binance announced a partnership with Anchorage Digital to further expand its third-party banking product network. By integrating Anchorage Digital's Atlas settlement platform, institutional clients can now trade on Binance while securely holding their assets in Anchorage Digital's independent qualified custody.It is reported that this is the first time the Atlas settlement platform has integrated with a cryptocurrency exchange. This partnership introduces the structure of "custody and trade execution separation" from traditional financial markets, allowing eligible institutions to use crypto assets, interest-bearing USD accounts, and specific tokenized real-world assets as collateral.

According to Chosun Biz, South Korea's Kiwoom Securities is seeking to acquire a stake in South Korea's second-largest virtual asset exchange, Bithumb. Both parties are discussing the issuance of new shares through a third-party allotment, with the specific equity ratio and investment scale still being coordinated.South Korean securities companies are rushing to enter the virtual asset industry ahead of the issuance of security tokens (STO) and the institutionalization of stablecoins; the Financial Services Commission of South Korea is also discussing the major shareholder equity regulations in the second phase of the virtual asset law, which will generally limit the shareholding ratio of major shareholders in virtual asset exchanges to 20%, with exceptions allowing up to 34%. Bithumb's largest shareholder, Bithumb Holdings, currently holds 73.56%, and if the relevant regulations are implemented, it will need to reduce its stake by more than 50 percentage points.

The cross-chain protocol Axelar Network released a statement regarding the recent security incident related to Secret Network, stating that there is a misunderstanding within the community about the event. Both Axelar and the Inter-Blockchain Communication Protocol (IBC) were not attacked or compromised. The affected token smart contracts were neither developed, deployed, nor maintained by Axelar, and Axelar's firewall mechanism also prevented the impact from spreading to other chains.It is reported that the exploited contract is a forked version based on CW20-ICS20, but the developers removed two core security checks, resulting in an "infinite minting" vulnerability. By deleting the verification mechanisms originally used to prevent such issues, this fork altered the original trust model of the contract and did not undergo a new security audit.Axelar Network explained that anyone can deploy contracts for cross-chain asset wrapping through IBC, and similar contracts have also been used to wrap tokens from other chains into Secret Network. However, the Secret side fork version in this incident has vulnerabilities due to the removal of key security checks. This incident is not a unique logical flaw, nor is it an issue with the IBC protocol itself, but rather a security risk introduced by modifications to third-party contracts.

The cross-chain routing protocol Squid stated on platform X that the SquidRouterModule involved in the attack disclosed by Blockaid was neither developed, deployed, nor operated by Squid, but rather a third-party Gnosis Safe module that chose to integrate with protocols like Squid, with no prior connection between the two parties.Squid indicated that this third-party module has a vulnerability that accepts a fixed string provided by the caller as message security verification. The attacker exploited this string, which is publicly visible in the verified code of the contract, to execute arbitrary call data and steal funds. Squid's own routing contract (0xce16F) is architecturally completely different from this module and is unaffected; user funds, authorizations, and integrations are all secure.

Tiger Research's Research Director Ryan Yoon stated that the U.S. Securities and Exchange Commission (SEC) is preparing to launch an "innovation exemption" framework that allows third parties to tokenize listed stocks without the issuer's approval.Ryan Yoon warned that this move could cause two major structural shocks to traditional exchanges: first, liquidity fragmentation, as funds will disperse from centralized exchanges to multiple blockchain platforms; second, revenue fragmentation, as trading fees and intermediary income may flow to overseas or competing platforms, threatening the competitiveness of U.S. finance.He believes that traditional exchanges are like monopolistic superstores, while tokenized stocks are akin to allowing anyone to set up a street stall, which will significantly change the concentration of capital markets. The SEC is advancing this framework at this time to keep global financial income within the domestic regulatory scope.

Binance announced that due to third-party system maintenance, Binance Alpha tokenized securities trading services are currently in temporary maintenance status, and users are temporarily unable to place orders or conduct transactions.Binance stated that user asset security is not affected, and the platform is actively communicating with the third party to promote service recovery. Users will be notified as soon as the relevant functions are restored.

Anthropic announced that starting from June 15, 2026, a new billing policy for the Agent SDK will be implemented. According to the new regulations, third-party Agent tools such as OpenClaw will be allowed to access the Claude subscription version again, but they must use a separate "exclusive monthly quota," which will no longer be shared with the regular chat quota.Previously, Anthropic had restricted third-party tools from accessing the Claude subscription quota in April of this year to prevent abuse. This adjustment is seen as the final solution to the related controversy, which is to reopen third-party access while completely isolating Agent calls from the regular chat quota.Specifically, Pro users will receive a monthly exclusive quota of $20; Max 5x and advanced Team versions will receive $100; Max 20x and advanced Enterprise versions can receive up to $200. The relevant quotas can only be used for third-party applications, self-built Agent projects, and claude-p backend command calls, with quotas refreshing monthly, and any excess must be paid at the standard API rate.

Vercel announced a security incident analysis, stating that some of its internal systems were accessed without authorization. This was caused by a third-party AI tool, Context.ai, used by an employee being compromised, allowing the attacker to take over their Google Workspace account and access some environment configuration data.The initial impact is that a small number of environment variables not marked as "sensitive" (such as API Keys, Tokens, etc.) may have been leaked. Relevant users have been notified and advised to rotate their credentials immediately. There is currently no evidence that data marked as "sensitive" or the supply chain (such as npm packages) has been tampered with.Vercel stated that the attacker possesses a high level of technical skill and has partnered with Mandiant and several security agencies to investigate, and has reported the incident to law enforcement. They also emphasized that platform services are still operating normally. Additionally, users are advised to enable multi-factor authentication, comprehensively rotate potentially leaked environment variables, and check account activity logs and deployment records to prevent further risks.

According to market news, researchers from the University of California recently disclosed that some third-party AI large language model (LLM) routers have security risks that could lead to the theft of cryptocurrency assets. The research shows that LLM routers, acting as API intermediaries, can read plaintext information, and some routers have been found to inject malicious code and steal credentials.The team tested 28 paid and 400 free routers, finding that 9 routers actively injected malicious code, 2 deployed evasion triggers, and 17 accessed Amazon Web Services credentials. Some routers even transferred ETH using the researchers' Ethereum private keys.The study pointed out that the malicious behavior of the routers is difficult to detect, and some AI agent frameworks' "YOLO mode" can automatically execute commands, increasing security risks. The research recommends that developers should not allow private keys or mnemonic phrases to be transmitted through AI agents and calls on AI companies to encrypt signatures in responses to enhance security.

OpenAI stated that during a recent industry-wide security incident, potential security issues were discovered in the third-party development library Axios that they use. After investigation, no evidence was found of user data being accessed, systems being compromised, or software being tampered with.Out of caution, OpenAI has initiated security reinforcement measures, focusing on strengthening the authentication mechanism of the macOS application to prevent malicious parties from distributing counterfeit official applications. OpenAI also reminds all macOS users to update to the latest version of the application as soon as possible, either through in-app updates or official channels, to reduce potential risks.