News linked to both this project and an event.
According to Cryptopolitan, the North Korea–linked hacker group Lazarus Group has been found deploying the fileless remote access Trojan RemotePE, primarily targeting banks, cryptocurrency exchanges, and fintech companies. This malware runs entirely in memory and employs process hollowing, anti-analysis detection techniques, and encrypted C2 communications—making it difficult for traditional antivirus and forensic tools to detect. The report states that attacks typically begin with Telegram-based social engineering: attackers impersonate employees of trading firms and lure victims into installing malicious software using forged Calendly and Picktime links, ultimately executing the payload without touching the file system.
According to an announcement by Bankr’s official X account (@bankrbot), on May 20, 2026, Bankr—a blockchain-based financial infrastructure platform—confirmed it had suffered a cyberattack. A total of 14 user wallets were compromised. The platform has urgently suspended its trading functionality and pledged to fully compensate all losses. Blockchain analyst @99barzzz tracked the incident, revealing that the losses amounted to approximately $385,000. The hacker’s EVM-compatible address has been identified.
According to CoinDesk, Simone Maini, CEO of blockchain analytics firm Elliptic, stated that the biggest emerging risk to crypto security is not larger-scale hacking attacks, but rather AI-driven financial activity operating at a speed and scale that human compliance teams cannot keep up with. As AI lowers the barriers to hacking, scams, and fraud, security firms like Elliptic are responding by deploying AI agents to analyze on-chain data in real time—sparking an automated arms race between adversaries and defenders. Maini noted that current compliance systems remain heavily reliant on manual review, and the global pool of compliance analysts specializing in digital assets is simply insufficient to meet future demand. Elliptic has raised $120 million in funding—including from Nasdaq and Deutsche Bank—to build an “agent-based compliance system” that leverages AI to automate transaction monitoring and investigation workflows, thereby reducing the cost per alert and per investigation.
Avant announced that, based on comprehensive market feedback and its own assessment, it has decided to postpone the Token Generation Event (TGE) to mid-September. Avant stated that the broader decentralized finance (DeFi) token market is currently under pressure, and multiple protocols have recently suffered security incidents—conditions unfavorable for launching a token sale. Avant Rewards points will cease accruing on May 15; however, users’ already-earned points will be preserved and remain eligible for participation in the upcoming TGE. During the postponement period, Avant will advance partnerships, expand total value locked (TVL), and enhance its product suite. It also plans to host a public Space this Thursday at 2:00 PM Eastern Time.
According to SlowMist, its security monitoring system MistEye has detected a counterfeit TronLink Chrome MV3 extension targeting TRON wallet users with a two-layer phishing attack. The extension disguises itself as the official plugin using Unicode obfuscation and brand spoofing. Upon installation, it first loads a remote iframe-based pop-up page designed to trick users into entering their mnemonic phrases, private keys, keystore files, and passwords—then exfiltrates this sensitive data via same-origin APIs to a Telegram bot. The malicious infrastructure involved includes the domains tronfind-api[.]tronfindexplorer[.]com and trx-scan-explorer[.]org; the malicious extension ID is ekjidonhjmneoompmjbjofpjmhklpjdd. SlowMist advises users to immediately uninstall the extension. If sensitive information has already been submitted, users should promptly migrate their assets and discontinue use of the compromised wallet.
Odaily News On the 10th local time, sources indicated the key points of Iran's response to the U.S., which include a demand for the U.S. Treasury Department's Office of Foreign Assets Control to lift sanctions related to Iran's oil sales within 30 days.The sources stated that the U.S. disclosure of Iran's response was inaccurate in some important aspects, particularly regarding nuclear issues. Iran's response emphasized the need to reach an agreement through political understanding, immediately end the war, ensure no further attacks against Iran, and that the U.S. must lift sanctions. Additionally, Iran's response also addressed changes in its control over the Strait of Hormuz if the U.S. fulfills certain commitments.The sources said that Iran stressed that after signing a preliminary understanding agreement, the U.S. must immediately lift the naval blockade on Iran and remove sanctions on Iran's oil sales within 30 days. Iran's response also included the U.S. unfreezing Iranian assets based on a preliminary understanding between the two sides, and the U.S. implementing certain measures within 30 days. (CCTV News)
OpenAI has officially launched the GPT-5.5-Cyber model and the "Trusted Access for Cyber" (TAC) framework designed for cybersecurity defenders. Simultaneously, GPT-5.5-Cyber has been opened for a limited preview to defenders responsible for critical infrastructure, supporting specialized cybersecurity workflows.TAC is an identity and trust-based framework aimed at ensuring that enhanced AI capabilities are wielded by verified defenders. Defenders verified through this framework will encounter fewer instances of model refusal when performing tasks such as vulnerability identification, triage, malware analysis, binary reverse engineering, and patch verification. Starting from June 1, 2026, individual members accessing this capability will be required to enable advanced account security protection.OpenAI is currently collaborating with security vendors including Cisco, CrowdStrike, and Palo Alto Networks to accelerate the defense cycle of the security ecosystem through GPT-5.5, enhancing the efficiency of vulnerability research, patching, monitoring, and supply chain security.
Solv Protocol has announced the migration of over $700 million in tokenized Bitcoin assets to Chainlink's cross-chain protocol CCIP, and will gradually phase out LayerZero's bridging support across multiple chains. The migration involves core assets such as SolvBTC and xSolvBTC. Solv stated that the decision is based on the latest security reviews and recent cross-chain security incidents, and CCIP will become its standard cross-chain infrastructure. This move follows Kelp DAO's migration of approximately $290 million in assets to Chainlink, further strengthening the trend of "cross-chain infrastructure shifting toward security-first migration." (CoinDesk)
Aave has announced the completion of the liquidation of the remaining rsETH position belonging to the Kelp DAO attacker. The related collateral assets will be transferred to the Recovery Guardian multi-signature wallet managed by DeFi United, to be used for restoring rsETH reserves and compensating affected users.This liquidation is part of the recovery plan following the previous $292 million attack incident. Aave had previously passed a governance vote to temporarily adjust the rsETH oracle price in order to create bad debt in the attacker's position and trigger liquidation. The relevant parameters will be restored upon completion of the liquidation. Previously, the attacker exploited the Kelp DAO cross-chain bridge based on LayerZero to forge 116,500 unbacked rsETH and borrowed ETH from protocols such as Aave and Compound. Currently, the recovery funds managed by DeFi United have exceeded $320 million.
According to Odaily, Drift Protocol has released a user recovery plan for the approximately $295 million security vulnerability incident on April 1, which was attributed to a North Korean-backed hacker group. Under the plan, Drift will issue receipt tokens representing users' verified losses, with each token corresponding to $1 in losses, allowing holders to gradually redeem based on the recovery pool's funding size.Currently, the recovery pool has initial funding of approximately $3.8 million. Subsequent funding sources include up to $127.5 million from exchange revenue, Tether-backed funds, and up to $20 million from partner contributions, aiming to cover total losses of approximately $295.4 million. Drift has frozen approximately $3.36 million in USDC and has established a public bounty program offering 10% of recovered assets. It is expected to relaunch the exchange in a "security-first" model during the second quarter. (CoinDesk)
According to the Wall Street Journal, algorithm development company MicroAlgo Inc. has announced the launch of a quantum technology–based blockchain architecture that enhances transaction security and transparency by integrating cyclic Quantum Secure Channels (QSC) with Quantum Key Distribution (QKD). The architecture features a four-layer design: a quantum communication layer, a blockchain core layer, a smart contract layer, and an application layer. QKD enables highly secure key generation and distribution, while quantum encryption safeguards transaction data against theft and tampering—and remains resistant to attacks from quantum computers.
Paradigm researcher Dan Robinson proposed a new scheme called PACT (Prove Address Control with Timestamp), aimed at protecting long-dormant Bitcoin, including Satoshi Nakamoto's early addresses, from future quantum computing attacks.The mechanism allows users to prove control over an address via a timestamp without transferring assets or exposing on-chain activity. Should a future quantum attack occur, assets can be recovered based on this proof within a quantum-resistant version of the Bitcoin network.Compared to mandatory migration schemes such as BIP-361, PACT avoids the privacy exposure issues caused by proactively transferring assets, offering long-term holders a more flexible proactive protection path.
The Ethereum Applications Guild (EAG) has officially launched as a global, nonprofit collaborative organization dedicated to supporting the growth of the Ethereum application ecosystem—driving its evolution from infrastructure to the application layer. EAG will operate across four key pillars: accelerating real-world application adoption, connecting cross-domain ecosystem networks, establishing unified evaluation and development frameworks, and building sustainable funding mechanisms. EAG will implement a membership contribution model based on institutional scale (e.g., valuation, market cap, or assets under management), and introduce a staking-rewards donation mechanism—allocating a portion of ETH staking rewards into an Ecosystem Growth Fund. Additionally, EAG has unveiled its 2026 Global Applications & Developers Program, which includes developer education initiatives, hackathons, and research projects, alongside regional roadshows and ecosystem showcases to strengthen local developer communities.
the White House has recently opposed Anthropic's proposal to expand the use of its AI model, Mythos, to approximately 120 companies, primarily based on security and computing power concerns. Anthropic had originally planned to add 70 new companies to the roughly 50 enterprises currently using Mythos, but the White House has raised doubts, worrying that insufficient computing power might affect the government's own usage of Mythos.Launched in early April, Mythos is designed to detect and exploit critical software vulnerabilities. It is currently limited to testing by enterprises managing key infrastructure, with no plans for public release. The White House fears that expanding usage to more commercial users could create a computing power bottleneck for the government when using the model. This is particularly concerning given Anthropic's computing power procurement agreements with Amazon, Google, and Broadcom—though contracts have been signed, new capacity has not yet come online.On the political front, relations between the White House and Anthropic have not eased. The Trump administration has publicly criticized Anthropic for hiring multiple former officials from the Biden administration and expressed dissatisfaction with its ties to liberal organizations. One example highlights the trust issues between the two sides: Collin Burns, a former researcher at Anthropic who was originally assigned to a government AI model evaluation role, was replaced by senior White House officials upon learning of his background, to avoid having AI company personnel directly involved in matters concerning dealings with other AI companies.Additionally, last week Anthropic disclosed an unauthorized access incident involving the Mythos model, further intensifying external regulatory scrutiny on the company.
: The U.S. Department of Justice (DOJ) announced that a 22-year-old California man, Evan Tangeman, has been sentenced to 70 months (approximately 5 years and 10 months) in prison, followed by 3 years of supervised release, for his involvement in a criminal organization that stole approximately $263 million in crypto assets through social engineering fraud and home invasions.According to court documents, Tangeman pleaded guilty in December 2025, admitting to helping the criminal network launder at least $3.5 million in illicit funds.The criminal group allegedly used the stolen funds for lavish spending, including multi-million dollar nightclub bills, Lamborghini sports cars, and high-end assets like Rolex watches.U.S. District Attorney for the District of Columbia, Jeanine Pirro, stated in a release that the organization "built a criminal system based on nearly absurd greed," emphasizing that Tangeman not only participated in money laundering but also destroyed evidence after his accomplices were arrested, demonstrating clear criminal intent.This sentencing comes as data shows that the crypto industry suffered $482 million in losses from scams and hacks in the first quarter of 2026, with social engineering fraud and physical violent robberies on the rise. (Cointelegraph)
the Lido team has initiated a proposal, planning to allocate up to 2,500 stETH (approximately $5.8 million) from the DAO to cover the rsETH asset shortfall resulting from the recent attack on Kelp DAO.Lido noted that the LayerZero-based exploit has led to insufficient rsETH reserves, triggering a chain reaction across the DeFi ecosystem, including rising interest rate pressure, tightening lending markets, and certain leveraged strategies facing passive liquidation risks.The proposal emphasizes that these funds will only be used as part of a complete recovery solution, provided that the overall shortfall can be fully addressed.Previously, the approximately $292 million attack on Kelp DAO had already impacted Aave, leading to bad debt issues, and its total value locked (TVL) once declined by nearly $8 billion.
According to Decrypt, OpenAI CEO Sam Altman stated that Anthropic is promoting its AI model Claude Mythos through “fear-based marketing,” using narratives about security risks to justify its limited-open strategy. Claude Mythos has recently drawn attention for its ability to autonomously discover software vulnerabilities and perform complex cybersecurity operations. The report notes that Mozilla previously disclosed that the model identified 271 vulnerabilities in the Firefox browser during testing. Meanwhile, discussions surrounding the model’s potential offensive cybersecurity risks continue to intensify. Altman also emphasized that OpenAI will not scale back its infrastructure investments and will continue expanding its computational capabilities.
Ledger Chief Technology Officer Charles Guillemet pointed out that the development of post-quantum cryptography has entered a critical stage. Although the timeline for a practical quantum computer remains unclear, a full-scale migration of the encryption systems across the industry is an inevitable trend. Led by NIST, the traditional sector plans to phase out high-risk algorithms by 2030 and completely ban them by 2035, with government and enterprise institutions expected to complete their migration layouts by 2029. Encryption and key exchange will adopt ML-KEM to defend against quantum decryption attacks on harvested data, with digital signatures becoming the core of blockchain transformation. The traditional industry prefers ML-DSA hybrid schemes, while the blockchain sector favors the more secure and robust SLH-DSA hash-based signature. Both schemes have their respective advantages and disadvantages. The compatibility challenges of post-quantum algorithms with MPC and threshold signatures remain a key risk that the industry urgently needs to address.
TechFlow News, April 22: According to a Jefferies report cited by Bloomberg, a hacker attack over the weekend resulted in nearly $300 million in losses for a small crypto project and triggered an outflow of approximately $10 billion from the largest decentralized lending platform—potentially dampening Wall Street’s interest in blockchain technology. Andrew Moss, a member of Jefferies’ digital assets research team, noted that banks, asset management firms, and payment companies have spent the past year developing products based on similar technological systems. However, this attack—allegedly carried out by North Korean hackers—may prompt traditional financial institutions to pause their related initiatives and reassess associated risks.
The Economic Daily published an article titled “Leveraging China’s Token Advantages,” which points out the need to clearly recognize potential risks associated with tokens, including identity theft due to token leakage, unauthorized access and theft of sensitive data through forged permissions, and user exploitation via agent-based commission schemes. Some lawbreakers have begun targeting tokens, setting up consumer traps disguised as “discounted token packages” or “token agents.” It is essential to continuously improve policy frameworks, regulations, and standards, and to standardize token trading秩序 by cracking down on price monopolies, false advertising, and illegal financial activities. Illegal and non-compliant activities—including speculative “hoarding for appreciation” and over-the-counter trading—must be resolutely curbed, guiding tokens back to their fundamental roles in technical services, value settlement, and rights transfer.