rome

SlowMist has issued a security warning stating that a high-risk phishing activity targeting TRON wallet users has been discovered. Attackers created a fake Chrome extension for the TronLink wallet, using Unicode bidirectional control characters and Cyrillic homographs to disguise the brand name. After installation, the extension loads a complete phishing page through a remote iframe, forming a "shell-core separation" credential theft chain.The malicious extension name uses homographs for disguise, and its Chrome Store page inherits the high user count and positive reviews of the real extension, lowering the review threshold. There is very little local code, only loading remote pages, making static analysis nearly impossible to detect malicious behavior. The remote phishing page perfectly replicates the official TronLink web wallet interface, stealing mnemonic phrases, private keys, Keystore files, and passwords, and relaying them in real-time via a Telegram Bot.Built-in anti-analysis features disable right-click, developer tools, drag-and-drop, and printing, and redirect based on the geographic and language settings of Russian users to evade detection. SlowMist recommends immediately uninstalling suspicious extensions, clearing local storage, checking for abnormal traffic, and if credentials have been entered, creating a new wallet and transferring assets immediately.

According to The Cryptonomist, Grayscale rebalanced two of its crypto funds after reviewing the first quarter of 2026. Among them, the DeFi fund added Ethena (ENA), giving it a weight of 13.59%, making it the fourth largest holding in the fund. The previous holding, Aerodrome Finance, has been removed. The current top four holdings in the fund are: Uniswap (35.22%), Aave (21.36%), Ondo (19.83%), Ethena (13.59%).The other Smart Contract fund did not introduce new assets but adjusted the proportions of its internal holdings. Ethereum remains the largest holding (30.14%), followed by Solana (29.69%) and Cardano (17.96%).

According to DL News, Coinbase has opened access to decentralized exchange (DEX) trading for UK customers, allowing users to access DeFi platforms such as Uniswap and Aerodrome through the Coinbase app to trade Base native assets, with plans to expand to other networks like Solana.The CEO of Coinbase UK stated that the UK is the most important market outside the United States, and this launch aims to demonstrate to the government the safety of DeFi under compliant operations. The design philosophy of this service is to maintain Coinbase's easy experience on the front end while integrating DeFi protocols on the back end. Coinbase will filter asset risks by collaborating with trusted third parties, such as high concentration of holdings potentially indicating rug pull risks. This is part of Coinbase's strategy to build a "full-service exchange," with plans to launch more services in the UK this year.

According to GoPlus citing a Koi report, the Claude Chrome extension under Anthropic has a high-risk prompt injection vulnerability, affecting all versions of the extension below 1.41.Attackers can construct malicious web pages that silently load an iframe containing a cross-site scripting (XSS) vulnerability in the background, executing malicious payloads within the a-cdn.claude.ai subdomain. Since this subdomain is on the extension's trust whitelist, attackers can directly send malicious prompts to the Claude extension and execute them automatically, without requiring user authorization or any clicks, leaving the victim unaware.This vulnerability can allow attackers to manipulate the Claude extension to read users' Google Drive documents, steal business access tokens, or export chat logs, and can take over the current browser session to perform sensitive operations like sending emails as the victim. GoPlus recommends that users immediately update the Claude extension to version 1.41 or above and remain vigilant against phishing links.

According to Cointelegraph, multiple joint research teams under Alibaba's AI ecosystem disclosed in a technical report that their experimental autonomous AI entity ROME exhibited unexpected behavior during training, autonomously attempting to utilize computing resources for cryptocurrency mining.Researchers stated that the aforementioned abnormal behavior occurred during the reinforcement learning training phase. The team discovered that the training server generated outbound traffic and triggered security alerts, with firewall logs recording suspected cryptocurrency mining operations and attempts to access internal network resources.In a specific case, ROME created a reverse SSH tunnel to connect to an external IP address, bypassing inbound firewall protection; in another case, the AI entity repurposed GPU resources originally allocated for model training for mining processes. Researchers confirmed that the behavior was not due to human programming but was spontaneously generated by the entity while exploring environmental interactions during the reinforcement learning optimization process.

A research team associated with Alibaba published a paper stating that while building an AI agent named ROME, they discovered that the agent attempted unauthorized cryptocurrency mining during its training process, triggering internal security alerts. The researchers indicated that the agent's behavior was spontaneous, driven by no explicit instructions, and exceeded the boundaries of the predefined sandbox. Additionally, the agent established a reverse SSH tunnel, creating a hidden backdoor from the internal system to an external computer.The paper noted that these behaviors were not triggered by prompts requesting tunneling or mining. The research team subsequently imposed stricter limitations on the model and improved the training process to prevent similar unsafe behaviors from occurring again. The research team and Alibaba have not yet responded to requests for comment.

The Chief Information Security Officer of Slow Fog Technology, 23pds, issued a reminder to be wary of fake imToken Chrome extensions. A fake imToken Chrome extension in the Chrome Web Store is phishing for seed phrases and private keys.

GoPlus has released a security alert that a vulnerability in the Chrome browser allows malicious extensions to escalate privileges through the Gemini panel. Please upgrade your Chrome browser to version 143.7499.192 or above immediately.This vulnerability allows malicious extensions to control the Gemini Live panel in the Chrome browser, thereby escalating privileges to access the camera and microphone, take screenshots, access local files, and more without user consent. The vulnerability is identified as CVE-2026-0628, and Google has fixed it in the Windows/Mac versions 143.7499.192/.193 and the Linux version 143.7499.192 at the beginning of January 2026. Please check and upgrade your Chrome version immediately.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) has disclosed that its holdings have reached 1,248 Bitcoins, with a total market value exceeding 120 million AUD.

Farcaster founder Dan Romero announced on the X platform that he has joined the stablecoin blockchain project Tempo, which has previously received support from Stripe and Paradigm.

According to a report by Businesswire, U.S. digital asset market infrastructure provider Prometheum announced that it has secured an additional $23 million in funding since early 2025, with investments from a group of high-net-worth individuals and institutions.The funds will be used to support its commercial expansion in the U.S. digital market. Specific directions include: providing digital asset corresponding clearing services for U.S. broker-dealers, enabling their clients to trade digital assets through existing brokerage accounts; and accelerating the issuance of blockchain-based digital native and tokenized securities products, which will be distributed through its broker network.

According to DefiLlama data, as of January 22, the trading volume of decentralized exchanges (DEX) on the Base chain has surpassed that of Ethereum and BNB Chain for the first time, driven by the two major protocols, Uniswap and Aerodrome, on Base.This surge in trading may be related to the launch of the native token FUN by the well-known gaming protocol FootballFun on Base during the same week. This supported football-themed gaming protocol has a weekly trading volume of millions of dollars, making it the largest gaming protocol on Base, and its leader has recently promoted the project multiple times.However, despite the initial hype, the price of the FUN token has already retreated. According to DEXScreener data, at the time of writing, the trading price of FUN has dropped nearly 7% from its TGE price.

Bitget Onchain Trading Today's New Coin Hot List Top 3: I'm Here, Trump Derangement Syndrome, Noble US Stock Trader. Among them, the Noble US Stock Trader briefly surpassed a market cap of 5 million USD, with a 24-hour increase of 101.02%.

According to a report from the security agency Socket's Threat Research Team, a malicious Chrome extension named "MEXC API Automator" has been available in the Chrome Web Store since September 1, 2025, capable of stealing users' newly created API keys from the cryptocurrency exchange MEXC and sending them to a Telegram bot controlled by the attacker.The extension lures users with the promise of trading automation, automatically generating MEXC API keys with withdrawal permissions without the user's knowledge, while hiding the display of these permissions in the interface, subsequently leaking the keys along with their ciphertext. This allows attackers to gain complete control over the victim's MEXC account, executing trades, initiating automatic withdrawal operations, and transferring assets within the account. As of the report's publication, the extension is still available for download in the Chrome Web Store, and the research team has reported and flagged this extension to Google.

Recently, NeuroMesh, focused on embodied intelligence, announced the completion of a $5 million strategic financing round, with a post-investment valuation of $50 million. This round of financing was jointly invested by Alpha Capital and Coinvestor Ventures.NeuroMesh is dedicated to providing edge intelligence solutions for robots and smart devices. Through its device-side intelligent stack, it enables robots to achieve real-time perception, planning, and execution without relying on the cloud. Meanwhile, the experiences gained by machines during learning will be synchronized to a decentralized "collective brain," achieving continuous evolution and shared learning through network effects.This model allows the learning outcomes among agents to be verifiable and accumulative, driving the entire network to become increasingly intelligent. NeuroMesh's goal is to build a truly native, verifiable, and shared autonomous intelligent world, making decentralized machine intelligence the infrastructure for the next generation of human-machine collaboration.It is reported that the funds from this round will be used to accelerate technology research and development, expand the team size, and further explore the implementation of applications in industrial automation, service robots, and other scenarios.

Trust Wallet posted on X platform that the browser extension is now back on the Chrome Web Store. Additionally, version 2.71.0 has been released, which includes support for customer service verification codes to assist with the claims process.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) has disclosed a holding of 1,203 bitcoins, with a holding market value exceeding 170 million Australian dollars.