Today's key news alerts:
Hyperliquid's cumulative protocol revenue exceeds $1.4 billion, with over $1.26 billion HYPE repurchased
Bloomberg: U.S. Department of Justice is reviewing whether Binance complied with its 2023 settlement agreement
Hong Kong SFC: Plans to extend securities trading hours, starting with the derivatives market
Ledger reseller CryptoBillis involved in the incident was secretly sold this spring, with a confidentiality agreement attached to the deal
CryptoBilis expands sales suspension, halting all branded hardware wallet sales in three Southeast Asian countries
Ledger responds to user fund theft: involves Southeast Asian reseller CryptoBillis
Tether has begun freezing USDT related to the Ledger theft case, losses rise to nearly $90 million
CFTC proposes to explicitly include sports, political, and other event contracts within the definition of Swap
Blockchain.com applies for CFTC license, plans to enter prediction markets and derivatives
Thailand SEC releases crypto ETF regulatory framework effective October 16, initially limited to Bitcoin and Ethereum
Regulation & Macro
White House requires AI companies to mandatorily report and fix security incidents, previously a voluntary mechanism
According to Axios, the U.S. Trump administration now requires all AI companies to immediately report and fix security incidents, whereas the previous mechanism was voluntary. This move stems from Anthropic's disclosure that its test models abused government systems, including submitting 19 non-immigrant visa applications to the U.S. Department of State website in August, 1 in May, and submitting false murder leads to Philadelphia police. The State Department said none of the applications were processed and the system was not compromised. SI Force stated that disclosure is a "critical national security obligation," but did not specify enforcement mechanisms or penalties.
Lithuania updates crypto asset user reporting rules, aligning with the EU DAC8 framework
According to Bitcoin.com citing Bloomberg Tax, the Lithuanian State Tax Inspectorate issued Order No. VA-63, updating crypto asset user reporting procedures to align with the EU DAC8 and OECD CARF frameworks. CASPs are required to collect and report user identity information, transaction records, account balances, and tax residency status, among other data. Entities that have already reported in other EU member states may be exempt from duplicate reporting. Relevant data will be automatically exchanged among EU tax authorities starting mid-2027.
Bloomberg: U.S. Department of Justice is reviewing whether Binance complied with its 2023 settlement agreement
According to Bloomberg, the U.S. Department of Justice is reviewing whether Binance complied with its 2023 settlement agreement with U.S. authorities, focusing on transactions after the settlement that may have violated U.S. sanctions on Iran, including whether Binance knowingly allowed transactions that its systems should have blocked. The review is led by the Manhattan federal prosecutor's office and the DOJ Criminal Division, and involves a Hong Kong entity accused of assisting in transferring payments for Iranian oil sales. Binance responded that it has zero tolerance for sanctions violations. Binance previously pleaded guilty in 2023 and agreed to pay more than $4.3 billion in forfeiture and penalties, while accepting a compliance monitor.
Hong Kong SFC: Plans to extend securities trading hours, starting with the derivatives market
Hong Kong SFC Chief Executive Officer Julia Leung said at an ASIFMA conference that Hong Kong is studying extending securities trading hours and will implement it first in the derivatives market. HKEX will publish a discussion paper in the fourth quarter on extending trading hours in the cash market. Hong Kong will shorten the settlement cycle to T+1, and HKEX will publish consultation conclusions shortly. The first phase of the narrowed bid-ask spread measures launched a year ago covered 300 stocks, with bid-ask spreads narrowed by 38% and trade execution time shortened by 26%; preliminary results from the second phase show spreads narrowed by about 30%. The extension of trading hours will be supported by measures such as tokenized money and e-HKD settlement.
CFTC proposes to explicitly include sports, political, and other event contracts within the definition of Swap
According to an official CFTC announcement, the U.S. Commodity Futures Trading Commission (CFTC) issued a notice of proposed rulemaking to further define the term "swap," explicitly including event contracts based on sports, political, cultural, and weather events. CFTC Chairman Michael Selig said such products are commodity derivatives under the Commodity Exchange Act and fall under the CFTC's exclusive jurisdiction. The proposal will seek public comment for 30 days. On the same day, the CFTC also issued an interim final rule clarifying that casino-type gambling products such as sports betting and casino games are not swaps.
Thailand SEC releases crypto ETF regulatory framework effective October 16, initially limited to Bitcoin and Ethereum
The Securities and Exchange Commission (SEC) of Thailand issued 11 related announcements establishing the framework for the establishment and regulation of cryptocurrency ETFs (crypto ETFs), effective October 16. The rules require crypto ETFs to be passive funds tracking the price of a single crypto asset, with an average net exposure to that asset of no less than 80% of net asset value per fiscal year; initially, eligible underlying assets are limited to Bitcoin and Ethereum. Such ETFs will be listed and traded exclusively on the Stock Exchange of Thailand (SET), assets must be custodied by SEC-regulated digital asset custodians, and brokers may not provide margin financing for them. The SEC also allows mutual funds and private funds to invest in local crypto ETFs, but initially does not permit the issuance of alternative products such as depositary receipts related to overseas crypto ETFs.
New York State permanently bans former Celsius CEO from the crypto industry, settlement involves up to $35 million in conditional payments
According to an announcement from the New York State Attorney General's Office, Celsius co-founder and former CEO Alex Mashinsky reached a settlement with the office and will be permanently banned from participating in the securities, commodities, and cryptocurrency industries. The settlement agreement involves up to $35 million in conditional payments: if he fails to forfeit $10 million in illicit proceeds to the federal government as agreed, he must pay $25 million to New York State; if he does not serve the full 12-year sentence, he must also pay $10 million. The case involves more than 26,000 New York State investors.
UK sanctions three crypto exchanges, accusing them of helping Russia evade sanctions
According to CoinDesk, the UK Foreign Office announced new sanctions on 38 entities, including three crypto exchanges and multiple payment platforms, accusing the related network of helping Russia evade Western financial sanctions. Named entities include Canada-registered Xeltox Enterprises (operating Cryptomus, Heleket, Certa Payments), as well as Kyrgyzstan-based TokenSpot, payment platform Processing KG (operating VexPay), Tsunami Payments, and Processing KG director Ulan Bukabaev. The sanctions freeze the related entities' assets in the UK and also cover Russian oil producers, 12 shadow fleet tankers, and suppliers for missile and drone production.
Trump establishes committee to investigate Fed Governor Cook
According to Bloomberg, U.S. President Trump has established a committee to investigate mortgage fraud allegations against Federal Reserve Governor Lisa Cook, intensifying efforts to remove her from office. The White House published a memorandum signed by Trump dated Wednesday announcing the establishment of the committee.
Project Developments
Triple-A hacker transfers 4,970 ETH to Tornado Cash for money laundering, worth about $12.4 million
According to monitoring by blockchain security firm Salus, the Triple-A attacker has transferred 4,970 ETH (about $12.4 million) to Tornado Cash. The hacker stole assets from the proprietary treasury of payment service provider Triple-A in July this year, with public estimates of losses at about $11.8 million. After bridging the funds to Ethereum and swapping them, the attacker split the funds into two intermediary addresses on September 6; on October 9, they were consolidated through a single wallet and deposited into Tornado Cash in 56 transactions total: 49 transactions of 100 ETH and 7 transactions of 10 ETH. Triple-A previously said the incident did not affect customer funds.
Hyperliquid network plans upgrade around 16:15 today, expected downtime about 10 minutes
According to an announcement on the Hyperliquid API channel, the Hyperliquid network plans to upgrade around 16:15 Beijing time today (UTC 8:15), with expected downtime of about 10 minutes.
Ledger reseller CryptoBillis involved in the incident was secretly sold this spring, with a confidentiality agreement attached to the dealX user exsiway posted that the Malaysian Ledger authorized reseller involved, CryptoBillis, was sold by its original founder this spring, with the deal subject to a confidentiality agreement requiring non-disclosure until October 19, but the store and the "Ledger authorized" signage have remained to this day. Former members of the CryptoBillis team also previously said that new management had taken over and the original team was required to keep confidentiality until October 19. There is currently no official evidence directly linking the new owner to the tampered devices.
CryptoBilis expands sales suspension, halts all branded hardware wallet sales in three Southeast Asian countries
According to a CryptoBilis announcement, the company has suspended the sale and shipment of all branded hardware wallets across all stores and online channels in Malaysia, the Philippines, and Indonesia, with physical stores temporarily closed. The move is intended to protect customers during the Ledger security incident investigation and an independent expert review of internal processes. Customer service will proactively contact users with undelivered orders, and users who have already purchased Ledger devices should follow security guidance. The company expects to announce further progress within three business days.
Ledger responds to user fund theft: involves Southeast Asian reseller CryptoBillis
Ledger Support posted on X that it is investigating reports of stolen funds from users in Southeast Asia who purchased devices from reseller CryptoBillis, and has asked it to suspend all Ledger device sales and shipments. Ledger advises users who purchased devices from this reseller in the past 90 days not to set them up if they have not been initialized; if already set up, they should transfer assets to a new device using a new mnemonic phrase. Analyst Specter previously said related losses may exceed $86 million.
Pump.fun is developing Hyperliquid-based perpetual contract trading
According to MMS News, Pump.fun is developing a perpetual contract trading feature powered by Hyperliquid. A PANews check found that Pump.fun's official API already returns data for 150 Hyperliquid perpetual contract markets, including 76 crypto assets, 61 U.S. stocks, and 13 commodity contracts, with maximum leverage of 50x; however, its perps page still shows a 404, and the feature has not yet launched.
Aero merger to launch on October 21, each VELO convertible to about 0.044 AERO
According to The Defiant, the Aerodrome and Velodrome merger project Aero has announced token conversion terms. The merger will launch at 8 p.m. Eastern Time on October 21, when emissions from the old platforms will stop. Existing AERO will be exchanged 1:1 for new AERO, and each VELO will be convertible to about 0.044 AERO. Of the new token supply, Aerodrome holders will receive 94.5%, and Velodrome holders will receive 5.5%. As of October 9, the combined total value locked on the two platforms was about $422 million. Existing veAERO and veVELO locks will convert to the new sAERO, with remaining lock duration carried over, but migration must be completed manually through the official website portal, and self-custodied assets will not convert automatically.
Tether has begun freezing USDT related to the Ledger theft case, losses rise to nearly $90 million
SlowMist's MistTrack posted that Tether has frozen a large amount of USDT on addresses related to the Ledger user fund theft incident. Based on its current tracking, losses in the incident have approached $90 million, and some affected users have contacted it for assistance, with the team following up. Ledger previously said it is investigating the theft of user funds related to Southeast Asian reseller CryptoBillis.
Ledger reseller CryptoBilis suspends sales and shipments, reminds users to move assets
According to a CryptoBilis announcement, because Ledger is investigating the loss of user assets from devices purchased through the reseller, CryptoBilis has suspended the sale and shipment of all Ledger devices. Users who have not yet activated their devices should stop setup, and those who have activated should transfer assets to a new device using a completely new mnemonic phrase. CryptoBilis reminded users never to disclose their mnemonic phrase or PIN code, and users who have suffered losses should preserve their devices and transaction records and call the police.
Blockchain.com applies for CFTC licenses, plans to enter prediction markets and derivatives
According to CNBC, crypto platform Blockchain.com has applied to the U.S. CFTC for Designated Contract Market (DCM) and Futures Commission Merchant (FCM) licenses. If approved, it will offer event contracts (prediction markets) and crypto derivatives trading to U.S. users. Blockchain.com currently already offers prediction markets to some overseas users through Polymarket and supports perpetual contract trading through Hyperliquid.
Telegram rolls out Gram wallet Money to all users
According to Telegram's official Walt channel, the Gram wallet previously available only to some users has been renamed Money and is being rolled out to all Telegram users. Money can be used to store and send Gram, as well as to buy gifts and collectible usernames. Trading and investing are conducted through Walt, which supports more than 300 assets, including tokenized stocks, precious metals, perpetual contracts, and Earn wealth management products. Users can top up Money from Walt with one click, and transfers arrive instantly with no network fees.
Tongyi Qianwen open-sources Qwen-Image-2.1-Turbo, generates images in 8 steps
The Alibaba Tongyi Qianwen team posted that it has open-sourced the image generation model Qwen-Image-2.1-Turbo, which can generate and edit images with only 8 denoising steps. The model is accelerated from the 7-billion-parameter architecture of Qwen-Image-2.1, can generate 2K images, and supports continuous natural language editing. The weights have been released on Hugging Face and ModelScope, and the Pro and Turbo APIs are also live.
Zcash development team plans to introduce quantum-resistant signature opcode in January next year
According to CoinDesk, Roman Akhtariev, an engineer at Zakura, the Zcash node software development team, said the team plans to introduce a post-quantum signature opcode for Zcash in January next year, enabling the network to verify hash signatures resistant to quantum attacks. The plan covers transparent transactions, accounting for about 70% of issued ZEC; shielded transactions require separate protection. Previously, Justin Drake called for the industry to plan for a "bunker mode," and ZEC has fallen about 11% in the past week.
CAICT's agent identifier and identity network begins trial operation, adopting a "blockchain + DID" approach
According to the official WeChat account of the China Academy of Information and Communications Technology, CAICT's agent identifier and identity network has officially begun trial operation and is open for public access. The network relies on trusted agent interconnection centers in Beijing, Xiamen, and other locations to provide services such as identifier registration, identity verification, addressing and resolution, and capability discovery for agents. It adopts a "blockchain + DID + super agent" technical approach, is compatible with multiple DID methods, and supports mainstream interconnection protocols such as A2A and ANP.
Bithumb to list XDP token on the Korean won market
According to an official announcement, South Korean crypto exchange Bithumb will list the XDP token on the Korean won market, with trading expected to open at 21:00 local time.
Investment and financing news
Jev developer TypeSafe AI raises $870 million at a $7.5 billion valuation, led by a16z
According to Bloomberg, AI startup TypeSafe AI has completed about $870 million in financing, led by Andreessen Horowitz (a16z), valuing the company at $7.5 billion. The company's AI model Jev quickly went viral weeks after release, is currently used by about one-third of Fortune 500 companies, and surpassed 1 million users within days.
Network School led by Polychain, valued at $2 billion
Polychain Capital founder Olaf Carlson-Wee announced during a livestream at the Network State conference that Polychain is leading a new funding round for Network School at a $2 billion valuation, with participation from a16z, Coinbase, and Network School founder Balaji Srinivasan, among others. The funding amount was not disclosed.
Views & Analysis
SlowMist 23pds: Ledger implanted module may steal mnemonic phrases displayed on screenFormer Mt.Gox CEO Mark Karpelès posted that a Ledger device he purchased from Malaysia contained a spy module with a SIM card chip hidden in the screen pad position, with the outer packaging intact. SlowMist Chief Information Security Officer 23pds analyzed that the attack process may involve a malicious module connecting to the screen data cable, recording the words displayed when generating the mnemonic phrase, and then sending them to the attacker via LTE/eSIM; the secure element can only protect the private key from being read and cannot prevent the screen contents from being intercepted.
AI giants internally war-game public political backlash "after doomsday"
According to Axios, executives at AI companies such as Anthropic and OpenAI are privately war-gaming plans to respond to public and political backlash after a catastrophic AI incident. These executives expect a large-scale incident, most likely a cyberattack that cuts off financial services, internet connectivity, or even water and power supplies, and most leading AI researchers and executives believe a major accident is inevitable. OpenAI says it conducts "preparedness drills" but does not regard them as inevitable, while Anthropic declined to comment. The planning includes red-team exercises for worst-case scenarios, with the core being to step up AI education for members of Congress to shape the legislative direction after the first catastrophic incident. Most industry insiders believe a major incident will occur within the next 6 to 12 months. Proposals include banning superintelligence, pausing advanced AI development, and setting a "kill switch" for advanced AI.
Important Data
Hyperliquid cumulative protocol revenue exceeds $1.4 billion, with over $1.26 billion HYPE repurchased
According to Castle Labs data, as of October 7, Hyperliquid's cumulative protocol revenue exceeded $1.4 billion, of which native perpetual contracts accounted for $1.2 billion, or 88.7%; spot revenue was $50.1 million, or 3.6%; and HIP-3 perpetual contracts were $29.2 million, or 2.1%. The research report said that 95% of the protocol's fees are used to repurchase HYPE, and to date more than $1.26 billion of HYPE has been repurchased in the open market, with current OI hitting a new high of $9 billion.
A user bought a Ledger from CryptoBillis and all 80 BTC were stolen
According to Lookonchain monitoring, a user bought 80 BTC at an average price of about $65,000 four months ago (about $5.2 million), once with an unrealized gain of $1.38 million. About a week ago, the user purchased a Ledger device from dealer CryptoBillis and deposited all 80 BTC into it, and all have now been stolen. On-chain data shows that the BTC was deposited on September 29 and transferred on October 9 to an address previously flagged by analysts for stolen funds.
XRP Ledger fixes a vulnerability latent for about ten years, attackers could mint XRP out of thin air
According to official disclosure from XRP Ledger, version xrpld 3.4.1 has fixed an integer overflow vulnerability in the payment engine. An attacker could mint XRP out of thin air through hundreds of specially crafted offers and one payment and spend it normally, and could bypass the "do not mint XRP" safety check, with the minted amount potentially far exceeding the total supply. The vulnerability may have existed since 2015. Researchers submitted it on September 22 through the bug bounty program, version 3.4.1 was released on September 25, and no signs of exploitation have been found so far.
Ethereum spot ETFs saw total net outflows of $56.1001 million yesterday, extending net outflows to 9 consecutive days
According to SoSoValue data, yesterday (US Eastern Time October 9), Ethereum spot ETFs saw total net outflows of $56.1001 million, marking 9 consecutive days of net outflows. The largest single-day net outflow was BlackRock ETF ETHA, with net outflows of $56.1001 million. ETHA's historical total net inflows currently amount to $12.793 billion. As of press time, the total net asset value of Ethereum spot ETFs was $15.710 billion, the ETF net asset ratio reached 5.18%, and historical cumulative net inflows reached $13.260 billion.
Hacker suspected of transferring Tornado Cash money laundering funds to Hyperliquid, opening 40x leveraged short on BTC
According to on-chain analyst Yu Jin (@EmberCN), a wallet received 263 ETH from Tornado Cash yesterday, then sold it for $643,000 USDC and deposited it into Hyperliquid. The address opened a 40x maximum leverage cross-margin short on 305.5 BTC at $83,068, with a position size of about $25.38 million, a liquidation price of $84,088, and current unrealized profit of about $160,000.
Analyst: Suspected wallets of multiple Ledger users stolen, losses exceed $86 million
On-chain analyst Specter posted that multiple reports of stolen Ledger user wallets have appeared on X and Reddit. After tracking the theft addresses, they found inflows of funds from hundreds of victim wallets across multiple major chains including Ethereum, TRON, and Bitcoin, with total losses exceeding $86 million. On-chain data shows that three BTC theft addresses received more than 211 BTC from October 8 to 9, which have not yet been transferred out. The cause of the theft is still unclear, and Ledger has not yet responded.
Two addresses belonging to the same whale have cumulatively opened nearly $50 million in long positions on BTC and ETH
According to on-chain analyst Ai Yi (@ai_9684xtpa), two addresses belonging to the same whale are collectively long about $50 million in BTC and ETH. Among them, diamondbull.eth opened a 25x long position on 11,500 ETH during the rebound, worth $28.72 million, ranking seventh among Hyperliquid ETH long positions, with a current unrealized loss of $109,000. Its funding source address samurai.eth also holds long positions of 200 BTC and 2,000 ETH, worth $21.58 million, with a current unrealized profit of $753,000.