access

Bitcoin News posted on platform X that the Brazilian exchange Mercado Bitcoin reopened read-only accounts a week after being attacked, resulting in an estimated loss of about 49 million dollars. Users can view their balances as of the day the attack occurred, but withdrawals are currently not possible, and the exchange has not announced a timeline for resuming withdrawals.Mercado Bitcoin stated that it has 4.8 million customers and will cover all losses with company funds, but has not explained how the attackers accessed its wallets. After withdrawals are resumed, they will only be processed through Pix, and users will need to reconfirm their information, with withdrawals only allowed to accounts under their own names.

A security research organization, Claroc, discovered that among the 37,571 online applications created by Grok Build, 35,578 (approximately 94.7%) can be accessed without logging in, with an estimated 650 to 800 of them involving private or sensitive data. The exposed information includes internal corporate documents, medical records, employee information, and plaintext passwords, involving six Fortune 500 companies.Among them, 24 applications were created by employees of Elon Musk's SpaceXSI and X, involving internal sales plans, customer data, and confidential advertising proposals aimed at U.S. federal agencies. Researchers pointed out that Grok application sharing links can be discovered through DNS records, and some applications lack access controls. SpaceXSI has removed the 24 applications related to itself, but applications related to other users are still accessible.

AnomaPay disclosed on platform X that it has discovered an external security vulnerability in the RISC Zero proof system it uses, which may jeopardize user funds. To protect users and ensure the safety of funds, the risc0 validator behind Anoma has been suspended and will be upgraded by the RISC Zero team.AnomaPay stated that the funds deposited by users are safe, but they will be temporarily inaccessible until the Anoma protocol is upgraded to version V2, which includes the new security updates from RISC Zero. The upgrade is expected to take about two weeks. Although this downtime is not ideal, it is necessary to protect user funds. Users do not need to take any action; funds will be automatically migrated to V2 and access will be restored after the upgrade is completed.

Confidential AI Infrastructure NEAR AI updated on platform X, stating that on November 8, an attacker exploited a vulnerability in its inference engine SGLang to access part of the infrastructure.NEAR AI has indicated that it has revoked relevant access permissions and completed the repairs. Affected users have been notified, and users who have not received notifications do not need to take any action.

NEAR AI tweeted that it has closed unauthorized access and continues to complete the investigation. NEAR AI Cloud will remain suspended until it can be safely restored. NEAR Protocol and other services are not affected, and the team stated that further updates will be provided within two hours.Previously, NEAR AI tweeted that it recently discovered unauthorized access to its internal systems and has suspended NEAR AI Cloud inference services as a precautionary measure to conduct an investigation. NEAR AI Cloud inference operates in hardware-isolated TEE to protect user prompt privacy.

Brazilian cryptocurrency exchange Mercado Bitcoin announced a phased restoration of platform access starting this week: customers can log into their accounts through the website again, gradually opening from 16:00 local time, with full coverage expected before 18:00.Previously, the exchange suspended deposits and withdrawals due to a hacker attack, with media and on-chain analysis firms estimating the loss between 38 million and 46 million dollars. The exchange stated that customer balance records remained intact during this incident, and the quantity of assets recorded for each customer, as well as investment and real balance information, were unaffected; Mercado Bitcoin will use its own funds to replenish the balances that were transferred away, and balance updates will occur simultaneously with the platform reopening and market resuming.This is the first phase of restoration, where customers can currently only check their balances and positions; withdrawal and trading functions remain suspended and will be restored in phases after security checks are completed.

Robinhood announced the launch of its IPO Access service in the UK, allowing retail investors to submit purchase requests at the official offering price before new stocks officially trade on the US market. Users can submit applications through their regular investment accounts, with the app providing the prospectus and SEC documents for each available new stock for investors to review before deciding whether to subscribe. Robinhood stated that it is collaborating with a UK public offering platform provider to offer access to eligible initial public offerings.This service was first launched in the US in 2021, and Robinhood claims to have participated in over 50 IPOs since then, opening it up to millions of US customers. Jordan Sinclair, President of Robinhood UK, stated that bringing IPO Access to the UK aims to provide the same opportunities for UK retail investors to participate in investments in the next generation of innovative public companies.This launch is a continuation of Robinhood's expansion in the UK. Last year, the company acquired the exchange Bitstamp for $200 million and opened cryptocurrency trading to eligible UK customers through Bitstamp in August of this year, supporting the buying and selling of over 50 cryptocurrencies in its main UK investment app, alongside stocks, ISAs, options, and futures. In July of this year, Robinhood launched the Robinhood Chain mainnet and provided eligible users with 24/7 trading of tokenized stock products. Robinhood stated that there are no commissions for IPO subscriptions but cautioned that participating in IPO investments carries significant risks, with stock price volatility potentially being high, especially in the early stages of listing.

Gnosis Pay disclosed on November 6, 2026, that its consumer card system was accessed without authorization on November 3, resulting in the exposure of some customer information. The company stated that it initiated containment within two hours of discovering the incident and has replaced the affected credentials and fixed the vulnerabilities; customer funds were not affected.This incident only involved the Gnosis Pay brand consumer card business, and the enterprise platform supporting white-label payment projects was not affected. Rotki founder Lefteris Karapetsas stated that the leaked information included full names, addresses, card numbers, and cryptocurrency wallet addresses associated with accounts; the number of affected customers and the full scope of information have not yet been disclosed.Gnosis Pay has enabled mandatory 3D Secure verification for online card transactions and strengthened monitoring of suspicious card and wallet activities, with these measures set to continue until the consumer card system is scheduled to retire on December 20. The company stated that it has notified partners, issuing institutions, and relevant data protection agencies, and will conduct a security review.

According to a notice from the U.S. Department of the Treasury, as part of the "Economic Exile Action," FinCEN issued an order against the cryptocurrency exchange MEXC Global under Section 9714(a) of the Anti-Money Laundering Act concerning Russia, prohibiting U.S. financial institutions from conducting any fund transfers with it, thereby cutting off its access to the U.S. financial system. The order will take effect 30 days after its publication in the Federal Register.The Treasury stated that between May 2021 and May 2026, MEXC Global facilitated at least $16 billion in transactions related to sanctions evasion and cybercrime involving Iran, North Korea, and Russia, including approximately $22 million in transactions related to the Central Bank of Iran and the Quds Force of the Islamic Revolutionary Guard Corps, as well as nearly $1.5 billion in transactions related to sanctions evasion concerning Russia.

On November 5, MetaMask released a security incident update stating that on September 28, part of its infrastructure was accessed without authorization. The attacker modified the reward receiving addresses of some Ethereum validators, transferring approximately 0.385 ETH in staking rewards.MetaMask stated that the related issues were fixed on the same day, and all affected Ethereum validators have now completed their exit. This incident caused temporary delays in withdrawals for some customers and may have resulted in losses of staking rewards. MetaMask emphasized that there is currently no evidence that user wallets, private keys, or customer staking principal have been leaked or withdrawn without authorization.

Sony Bank announced that its external contractor for digital securities, Securitize Japan, experienced unauthorized access to its systems, resulting in a leak of customer information. This includes the names, addresses, birth dates, and account numbers of 4 customers, as well as the names of an additional 617 customers.Sony Bank stated that no improper transactions have been identified as a result of this incident, and there is no evidence that the leaked information has been made public or disseminated online. This matter only involves digital securities services, and related transactions have been suspended, with further notifications to be provided upon resumption.Securitize Japan detected system anomalies on October 29 and confirmed the unauthorized external access on the same day, subsequently notifying Sony Bank. An investigation of the logs confirmed the leak of customer information. Sony Bank will contact the affected customers individually.

According to foreign media reports, OpenAI employees warned management as early as before the launch of ChatGPT that the company's code and research material access permissions were too broad, which could lead to the leakage of sensitive technology.Internal risks include overly broad code repository permissions and research materials being widely stored on GitHub and Slack. OpenAI has strengthened security measures and will initiate a new round of security special actions.

Solana ecosystem wallet Solflare co-founder Vidor stated that Solflare has entered a state of heightened security alert. He mentioned that after the industry just went through this month, the company has closed access to infrastructure and code.Vidor stated that all changes require multiple approvals, and no new content is allowed to enter. He said this would slow down work, but he can accept it.

The Solana ecosystem MEV infrastructure project Jito announced its first batch of external node operators for BAM, which are Triton One, Bitwise, and SOL Strategies.The three institutions have initiated the testnet access process, and the BAM access for all mainnet validators is expected to open in early Q1 2027.

Flap posted on the X platform that the Flap official website has now resumed normal access, and the backup domain remains open. Users can currently access Flap through two domains.Flap thanks the community for their patience and support during this incident and states that it will continue to monitor the platform's operation.

Stonk posted that the StonkFun official website has resumed access. Previously, the team took the website offline due to a domain attack and migrated it to new infrastructure.Stonk stated that the on-chain functions have returned to normal, and no user impact has been detected so far. However, since some network synchronization DNS changes may take up to an hour, the team recommends that users wait an hour before connecting their wallets through the official website.

The founder of Flap posted on platform X to explain the impact of the official website domain anomaly event.He stated that the risk only involves users who accessed the abnormal website and connected their wallets or signed authorizations within a few minutes before the announcement was made. Users who had previously connected to the FLAP official website normally are not affected by this event and do not need to change their wallet addresses.The founder of Flap also emphasized that FLAP does not store users' private keys, mnemonic phrases, or wallet data; this information will not be saved in the FLAP backend. Until the issue is resolved, users should temporarily avoid accessing the official website, and once the site is restored, the team will issue a notification through the official account.For users who have just connected their wallets on the abnormal website, the founder of Flap stated that they can contact him for assistance via private message.

The founder of the cryptocurrency trading platform Gate, Han Lin, published an article sharing thoughts on fund security, proposing the Vault solution. The core principle is to prevent any party from having the ability to unilaterally access the funds. The private key is split into three shards through MPC, held respectively by the user’s device, Gate, and a disaster recovery party. The complete private key will not appear in any single location.Han Lin stated that since 2026, there have been over 600 security incidents, resulting in losses exceeding 8 billion dollars. In September alone, the losses amounted to 768 million dollars, and October is not yet over, with monthly losses already exceeding 6 billion dollars. More than 60% of the losses in the first half of the year were due to private key breaches and phishing, while code vulnerabilities accounted for just over 10%. In October, a hardware implant attack targeting distribution channels caused users to lose nearly 100 million dollars.The solution sets a 48-hour delay for Vault withdrawals, during which users can freeze their accounts at any time. If a user’s device is lost or the backup password is forgotten, Gate and a third party can assist in recovery after the user completes identity verification. If Gate services are unavailable, users can use device shards combined with third-party shards to recover assets through open-source tools. Han Lin expressed that the platform is willing to open up this architectural idea and the real user scenarios encountered for discussion among peers.

According to current laws, those who operate virtual asset businesses without declaration can be sentenced to a maximum of 5 years in prison or fined 50 million Korean Won. This law also applies to foreign operators targeting Korean residents. The Financial Intelligence Unit (FIU) stated that undeclared operators are in a regulatory blind spot and may be used for money laundering.In June of this year, DAXA and compliant operators jointly conducted an investigation and found that the average transaction fee of the operators under investigation was between 1.5% and 10%, which is up to 62 times the average level of the top five Korean exchanges (0.16%).