w-source retweeted
Earlier today, NEAR Intents was exploited for $3.8m. SHIELD, the AI security layer on Intents, detected outlier behavior and Intents were temporarily paused. All of the affected users will be compensated in full.
The attacker exploited a bug in the Omni deposit/withdrawal interaction with the NEAR Intents smart contract isolated to USDT on BSC. The Intents team quickly identified the exact vulnerability and it was fixed within an hour of detection. NEAR Intents and near.com are already back online, except for a few affected chains on Intents. The core NEAR Protocol, NEAR token, and other applications on NEAR were not affected.
NEAR Intents now processes over $4B a month in trading and payments volume, serving as the industry’s connector across chains and ecosystems. At this scale, we have to hold ourselves to a higher security standard. This was the first major exploit on Intents and we will apply all learnings from this incident as part of a full retro and postmortem.
The crypto space is entering a new era of far more sophisticated cyber attacks. Recently, we have seen BitGet, Metamask, Lido all being targeted by criminals equipped with AI systems that are continuously trying to hack all infrastructure. As a space, we need to be far more vigilant and raise the bar on both onchain contract standards and offchain monitoring and proactive prevention.
This includes incorporating formal verification, a key tool for preventing a large class of vulnerabilities. The NEAR ecosystem is already working on a formal verification system for NEAR contracts and will shortly implement it as part of the release process, alongside other security measures that will come out of the postmortem.
Being more proactive against criminal activity is a critical step to ensure the growth and legitimacy of crypto. It’s time to join forces and work together to use all tools at our disposal to detect and prevent malicious activity. SHIELD is our approach to monitoring and AI-based outlier detection. We welcome new SHIELD partners to work with us to share information faster and get better at detecting and containing criminals and exploits across web3.
Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.
The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full.
The contract-side vulnerability has been patched. The operations of the NEAR Intents and near(.)com are expected to resume within 1h.
Deposits and withdrawals on the following networks will remain unavailable for an additional ~12 hours while fixes to the Omni infrastructure are completed: BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma.
In case users hold any assets from these chains inside NEAR Intents (for example, in HOT wallet or on near(.)com), they will be able to swap them into other assets once NEAR Intents is back up (in ~1h).
The incident has been reported to law enforcement, and we are working with security and blockchain analytics partners to trace the funds and pursue recovery. A detailed report will be shared publicly in the following days.
w-source retweeted
We’re keeping an eye on this situation alongside Lido. No impact to Aave markets and everything operating normally.
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
These steps include exiting its Ethereum (ETH) validators in the Lido protocol, and will likely incur foregone rewards as well as possible downtime penalties should validators be taken offline in the near future to reduce risks related to potential network penalties. Relevant validators have begun the exit process, with the final validators expected to be exited (but not fully withdrawn) by the end of October 7th, 2026.
No action is required from stETH holders. ETH exited from MetaMask Staking-operated validators is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue. As a reminder, staking operations are non-custodial in nature and MetaMask does not manage withdrawal keys for staking on behalf of clients.
As always, the Lido Protocol’s diverse Node Operator set and other security systems including the ad hoc reserve fund (of over 6,750 stETH), are designed to contain and mitigate disruptions to the normal operations of the protocol, in addition to other potential routes.
research.lido.fi/t/security-…
A full investigation is underway, and further updates will be shared as they become available. For further details, please refer to the MetaMask Staking release linked below.
w-source retweeted
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
These steps include exiting its Ethereum (ETH) validators in the Lido protocol, and will likely incur foregone rewards as well as possible downtime penalties should validators be taken offline in the near future to reduce risks related to potential network penalties. Relevant validators have begun the exit process, with the final validators expected to be exited (but not fully withdrawn) by the end of October 7th, 2026.
No action is required from stETH holders. ETH exited from MetaMask Staking-operated validators is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue. As a reminder, staking operations are non-custodial in nature and MetaMask does not manage withdrawal keys for staking on behalf of clients.
As always, the Lido Protocol’s diverse Node Operator set and other security systems including the ad hoc reserve fund (of over 6,750 stETH), are designed to contain and mitigate disruptions to the normal operations of the protocol, in addition to other potential routes.
research.lido.fi/t/security-…
A full investigation is underway, and further updates will be shared as they become available. For further details, please refer to the MetaMask Staking release linked below.
Security Update: We are responding to a security incident affecting part of our infrastructure.
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations, in coordination with clients, partners and security advisors.
We’ll share further updates as appropriate. metamask.io/news/user-update…
w-source retweeted
Today we’re announcing OpenClaw Enterprise
In collaboration with @RedHat , @nvidia and @OpenAI the OpenClaw Foundation is open sourcing a powerful enterprise control plane for persistent agents
OpenClaw Enterprise is built to run on your own infrastructure and will always be free for an organization to use
openclaw.ai/blog/openclaw-en…
w-source retweeted
RAILGUN already privatizes the stables you hold. DAI, USDC, USDT, any ERC-20.
What @protocol_fx built on top is private issuance: ETH goes in shielded, fxUSD comes out shielded. No public mint.
A dollar that is yours the way cash is yours.
Wall Street is buying privacy from a brokerage account.
The market is finally admitting what cypherpunks have said for 30 years: money that everyone can watch is money that can be used against you.
But there is a question nobody in this trade is asking.
Where is the private dollar?
Because you don't live in ZEC. You live in DOLLARS. You save in dollars, you pay in dollars, you measure your life in dollars. And every dollar onchain today is the opposite of private. Every balance is a public record, sitting under an issuer who can freeze it with one transaction.
We built digital cash, then handed it a surveillance camera and a kill switch.
fxUSD is the answer to that question.
It's the first stablecoin that can be minted privately on Ethereum. Through @RAILGUN_Project and @anondotinc, your ETH goes in shielded and your dollars come out shielded. No visible minter. No public position. No issuer who can freeze it. Hold it, send it, put it to work in DeFi, and never step back into the open.
A dollar that is yours the way cash is yours.
And it lives on the one chain that has actually been through the fire. A nation state sanctioned privacy code on Ethereum. Developers were arrested. Everyone said privacy on Ethereum was finished. The sanctions were thrown out. The code never stopped running. Not for a single block.
That's what a real privacy test looks like. Not a price chart. A government trying to switch it off, and failing.
Ethereum passed it. fxUSD is built on top of it.
You don't have to sell your ETH. You don't have to leave Ethereum. You don't have to choose between privacy and a dollar you can actually use.
The market just figured out that privacy matters. The private dollar is already here.
w-source retweeted
We got an important step closer towards unified liquidity between L2s and Ethereum via @etheconomiczone.
Here is a @CoWSwap trade settled on L2 while using liquidity from L1. Bridging tokens out and receiving other tokens back all happens atomically!
Public testnet soon!
🤖 Made with AI
w-source retweeted
Tempo is compounding very quickly. Seeing a lot of new stablecoin + agent use-cases.
w-source retweeted
AI for cyber is about to go vertical. The models increasingly becoming insanely good at finding and exploiting vulnerabilities. Frontier models are ahead, but we’re already seeing that open weights is not far behind.
Most enterprises are already inundated with cyber discoveries, so now that’s only going to multiply. Triaging and automating the fixes with more AI -along with human oversight- is essentially the only way forward.
In case you were wondering what jobs AI was going to create, it’s definitely going to great time to be in security.
As we prepare to release Astra, we’re focused on making increasingly capable AI safe and broadly accessible.
Astra represents a significant advance in cybersecurity capability, reaching the Critical threshold under our Preparedness Framework.
We're previewing how we evaluated the model, how its safeguards have advanced alongside its capabilities, and what we'll continue to learn and improve.
openai.com/index/path-to-ast…
w-source retweeted
AI model-training startup AfterQuery has reportedly raised a round that valued it at $3.2 billion, just five months after announcing its $30 million Series A at a $300 million valuation in April.
spr.ly/6019B17w0b
w-source retweeted
My conversation with @dougleone, partner at @sequoia.
0:00 How to Dominate for Decades
3:17 Turning Fear Into a Tailwind
5:40 Immigrant Drive, Hard Work & the Beach Club
12:19 Simplifying Life & Choosing Discomfort
14:37 The Homeless Sequoia Partner With No Plan B
16:49 Stepping Down, Coming Back & Starting Over
20:04 Why AI Is Different From Every Previous Technology Shift
22:13 Doug's Three Investment Heuristics
23:52 The Cost of Selling Great Companies Too Early
25:39 Helping Founders Turn Products Into Businesses
28:28 David Vélez, Nubank & the Psychology of Founder Support
32:25 Why Founders Must Remain the Soul of the Company
36:13 Torturing Yourself Into Greatness
39:57 Don Valentine, Succession & the Sequoia School of Hard Knocks
44:28 Staying Grounded & Developing a Sniffer for People
47:46 Hypercompetitive With a Heart of Gold
50:13 Fred Luddy, Israeli Founders & Radical Directness
52:28 Trust Is the Accelerant of Business
59:57 Starting From Zero & Hunting for the Next Great Founder
1:05:59 Architect Your Board Like Your Product
1:10:24 Truth, Disagreement & the Art of Difficult Feedback
1:13:43 Humanity, Introversion & the Value of Relationships
1:18:18 What Doug Learned From Michael Moritz
Includes paid partnerships.
w-source retweeted
Owner has raised $240M, reached a $2.3B valuation, and crossed $100M ARR.
Goldman Sachs Alternatives led the round, joined by Meritech, Redpoint, Headline, & Jack Altman.
The world is racing to build AI to replace people’s jobs. Owner is building AI to do the opposite:
w-source retweeted
Payments with Instinct are now powered by @link.
Use Instinct to buy from businesses on the internet: compare deals and purchase at the best price, arrange a ride to the airport, or order groceries.
Approve what Instinct spends while your payment details are protected.
Instinct + Stripe
Instinct users who make purchases spend over $1300/month on average through Instinct. Using Instinct to make high value purchases is a sign of trust that we deeply value.
We’re partnering with Stripe to deliver a more seamless payment experience. Instinct has enabled use cases that involve payments including:
- Planning and booking international trips
- Ordering weekly groceries and household essentials
- Booking yoga classes, ski tuning sessions, doctor’s appointments, car part repairs, and more
- Getting you the best price for anything you’re looking for
w-source retweeted
EIP-8130 has shown us the future for Ethereum wallets 👌
Now let's split it into 3 smaller native AA proposals:
- EIP-8398: Keystore with actors, authenticators and config.
- EIP-8399: Adds keyed nonces, batching, sponsorship.
- EIP-8400: Adds policies, locking, and nonceless.
New EIP!
Keystore Authority Layer
🔗 github.com/ethereum/EIPs/pul…
Highlights:
- EIP-8130 is refocused to a minimal, chain-portable authority core: a Keystore mapping (account → actors), where each actor is identified by a 32-byte actorId and bound to an authenticator contract that verifies signatures and returns that actorId.
- Authority is encoded in a single packed per-actor storage slot `authenticator(20) ‖ expiry(6) ‖ scope(2) ‖ reserved(4)`, designed so validation can be cheap and predictable (one SLOAD to decide if an actor exists/is live and what it’s allowed to do).
- The `scope` word is a fail-closed `uint16` grants bitmask: `0x0000` means “admin/unrestricted”; explicit grants include SENDER (originate), SELF_PAYER (pay own gas), and SPONSOR_PAYER (pay others’ gas). Bits `0x02` and `0x04` are intentionally reserved so extensions can add semantics while keeping the same portable scope representation.
- Actor liveness is time-bounded via `expiry` (seconds): live iff `expiry == 0 || now <= expiry`. Separately, a local-epoch + sequence system exists for replay protection of signed configuration changes; `IncrementLocalEpoch` cancels unlanded local signatures without revoking already-authorized actors.
- Accounts can be created/imported and kept consistent across chains: `createAccount` deploys to a deterministic CREATE2 address derived from `userSalt`, `bytecode`, and a commitment to a strictly-sorted list of initial actors; `importAccount` bootstraps an already-deployed contract account via ERC-1271 over an EIP-712-style digest binding the account, chain domain, and initial actors.
ELI5:
This EIP describes a simple, reusable “who can sign for this account?” system for Ethereum-style accounts. Think of it like a shared keyring (the Keystore) that lists the people/devices (actors) allowed to act for an account, and for each one, which kind of lock they use (authenticator contract) to prove it’s really them. It also explains how you can safely add/remove/rotate those keys with signed updates, make the same account show up at the same address on different chains (deterministic CREATE2 addresses), and use a small set of permission bits (scope) to say what each actor is allowed to do (send transactions, pay gas for itself, or sponsor someone else).
w-source retweeted
Can a sufficiently powerful quantum computer forge the signatures used to authorize Bitcoin and Ethereum transactions? What would it take to upgrade both networks before that happens?
In this new lecture, Stanford cryptographer @danboneh explores why blockchains may turn to signatures built from hash functions. He also presents new research on threshold signing.
The talk ends with the questions Bitcoin still has to answer, including whether post-quantum signatures will require larger blocks, what happens to abandoned coins, and how someone such as Satoshi could prove ownership after Bitcoin’s current signatures have been retired.
00:00 Why blockchains need to prepare for quantum computers
03:05 Why Bitcoin may bet on hash-based signatures
06:25 The “big footgun” in stateful signatures
08:58 A quantum-safe signature that takes one billion hashes
14:13 Inside SLH-DSA’s virtual tree
20:30 How Bitcoin and Ethereum could make the switch
23:48 What happens when a wallet loses its state?
32:47 Can threshold signing survive the quantum transition?
36:39 How to hide lattice cryptography from the blockchain
38:49 Why threshold one-time signatures seem impossible
45:36 How context prevents forged signatures
49:37 The forgotten idea behind Winternitz signatures
54:50 Turning one-time signatures into threshold signatures
1:04:27 Will quantum-safe signatures require bigger Bitcoin blocks?
1:06:26 Abandoned bitcoin and Satoshi’s recovery problem
w-source retweeted
🚨Seems a Critical Vulnerability was discovered in the Bitcoin Core Lightning Network - take your nodes offline
Hidden source code (with the idea of patches not being reverse-engineerable) binaries, holding a fix, will be published in <48hrs
Discussion:
stacker.news/items/1555439
w-source retweeted
JUST IN: Nvidia agreed to buy Hugging Face for $12.9B.
At roughly $150M in reported annualized revenue of HuggingFace, thats 86X that run rate.
- The Information.
