slow

Citrini analyst Jukan cited Anthropic-related data from TickerTrends and expressed doubts. The data shows that as of September 24, 2026, Anthropic's annual recurring revenue (ARR) is approximately $76.8 billion, with a quarter-over-quarter increase of only 1.8%; OpenAI's annual recurring revenue is approximately $50.44 billion, with a quarter-over-quarter increase of 13.4%.Jukan believes that even based on this set of data, Anthropic's growth rate has clearly declined, OpenAI's growth is also slowing down, and he questions the reliability of TickerTrends data.

Slow Fog's Yuxian posted on platform X, stating that systems prior to iOS version 27 are being exploited by certain black and gray market groups to steal encrypted wallets from iPhone users.It reminds users to promptly update their iPhone, iPad, Mac, and other devices to the latest version, to be cautious when installing apps from unknown sources, and to be careful when opening unknown links through Safari and in-app browsers.

Slow Fog's Yuxian stated on platform X that the Bitget theft incident has a wide spread, involves a huge amount of money, and the related funds were quickly linked to North Korean hackers. Institutions such as Circle and Tether have promptly assisted in freezing the related funds, with Circle freezing the USDC held by the hackers.Regarding THORChain, Yuxian pointed out that when THORChain previously experienced a theft incident, it also quickly intervened in its so-called "decentralized" platform; however, in response to this major security incident in the industry, it claimed "decentralization and non-interference" and compared itself to Bitcoin and Ethereum, while continuing to earn fees from the hackers' large cross-chain transactions.He stated that decentralization should not just be a slogan; after a major security incident occurs, the key is to distinguish which issues need to be collectively addressed by the industry. He also believes that platforms like THORChain should not be easily compared to Bitcoin and Ethereum, as there are significant differences in the degree of decentralization and mechanisms of different systems.

Cryptocurrency KOL and former FTX community partner Benson Sun stated that he expects the current Bitcoin market to show a gradual new high slow bull trend, rather than forming a clear top after a rapid short-term rise like in 2013 and 2017. Before the true cycle top arrives, the market may experience multiple local top signals. He believes that after 2021, the main buyers of BTC have gradually shifted from retail investors to institutions such as publicly listed companies, spot ETFs, and corporate treasuries.Since institutions mainly buy spot, some funds will also use Delta Neutral strategies for arbitrage, and traditional indicators such as funding rates and MVRV Z-Score may not rise to extreme levels again at the cycle top. Recently, the cycle top is more likely to manifest as institutional funds losing momentum rather than retail sentiment becoming overly heated. The Institutional Liquidity Index (ILI) mainly references overall dollar liquidity, the mNAV of Strategy, and the net flow of Bitcoin ETFs to determine whether institutional funds follow up when BTC reaches new highs. When BTC sets a new rolling 30-day high while ILI does not rise simultaneously, it constitutes a yellow divergence; when BTC breaks historical highs while ILI diverges and is below 50, it constitutes a red divergence.Benson Sun indicated that he would use the frequency of yellow divergences as a reference for judging the cycle process: each occurrence would lead to a proper reduction in altcoin positions and leverage; as the market enters the later stages, he would gradually increase the proportion of BTC and ultimately retain only spot. If a red divergence occurs, he would stop participating further.

According to Cointelegraph, blockchain security company SlowMist stated that its investigation has not linked the recent security warning caused by the iPhone Safari attack to confirmed cryptocurrency theft incidents.SlowMist told Cointelegraph that it has not independently confirmed any victims affected by the specific Safari attack samples it analyzed, and the strongest technical evidence it possesses covers iOS versions 18.4 to 18.6.2. The company stated that the reported impact range of "iOS 13 to 26.5" should be regarded as a preliminary assessment, and it tends to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is obtained.SlowMist pointed out that the Safari attack reused the previously disclosed DarkSword exploit chain technology, which is independent of another investigation involving malicious components embedded in App Store applications called FomoPeek. The Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since November 2025.

Bitget CEO Gracy Chen stated that Bitget is conducting a comprehensive investigation into the recent platform security incident in collaboration with independent third-party expert Mandiant and Slow Mist. The platform will continue to release the latest updates through official channels.He emphasized that ensuring user safety is Bitget's top priority at the moment, and user balances remain intact. The Bitget User Protection Fund will cover the impacts caused by this platform-level incident. The Bitget Wallet is a self-custody wallet, using infrastructure that is completely separate and independent from Bitget Exchange, and therefore was not affected by this incident.Currently, the recharge, trading, and reward functions of Bitget Exchange are still operating normally. The withdrawal function remains suspended during additional security checks and will be reopened as soon as the platform confirms it can be safely restored.

Slow Mist MistTrack updates Bitget hacker wallet addresses, adding 7 marked Ripple network addresses, with a total balance of approximately 102,926,478 XRP, equivalent to about 157 million USD.In addition, it includes 11 EVM addresses and 1 TRON address. Among them, the EVM addresses hold approximately 67,980.25 ETH, 5,896.58 BNB, 495.625 WETH, 218,022.9 USDT, and 99,989.9 USDC; the TRON address holds approximately 20,593,376.5 TRX.

According to Slow Fog Security Alert, the AI memory toolchain under MemTensor has been compromised. The open-source long-term memory library MemoryOS (PyPI) aimed at LLM and AI Agent, as well as the official plugin memtensor/memos-cloud-openclaw-plugin (npm) that connects to the OpenClaw runtime, have been implanted with a cross-platform Go binary, which triggers execution when the package is loaded or imported.Affected versions include: MemoryOS==2.34 on PyPI, and npm plugins 0.1.21, 0.1.23, 0.1.25. Among them, the affected npm plugins may also cause user prompt content leakage. Slow Fog recommends taking the following measures: uninstall or downgrade to known safe versions (npm 0.1.20, PyPI 2.33); terminate the sckit process; block related infrastructure; check network activity; and rotate credentials in the affected environment.

Slow Mist's Yuxian posted on platform X, stating that the related application is FomoPeek, and Slow Mist has never referred to it as the FOMO App. Overseas related security KOLs and media have misrepresented this.

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

On-chain data analysis platform Glassnode stated: As Bitcoin reaches $86,000, the bullish leverage in the options market is slowly rebuilding, and the open interest put/call ratio is rising.However, this is still far below the overheated levels seen near Bitcoin's peak. Speculation in perpetual contracts also remains sluggish, with the funding rate below neutral levels.

Nic Carter, co-founder of Castle Island Ventures, commented on the "slow down the frontier" proposal put forward by Anthropic CEO Dario Amodei. Nic Carter stated that if the goal is to widen the gap between the public and the true frontier internally, and requires cooperation from competitors, then the proposal is reasonable. The main commercial risk for Anthropic is the commoditization of models due to distillation, rather than safety issues.Nic Carter mentioned that safety and profit incentives tend to align in limiting public access to truly frontier models. The highest return use of frontier tokens is for internal research and capturing downstream intellectual property, rather than public API sales. Anthropic has made models like Mythos Preview available only to a few partners.Nic Carter expressed that unilateral slowing down cannot solve the prisoner's dilemma, and coordinated restraint requires antitrust exemptions or regulation. Dario called for the U.S. government to provide limited exemptions for safety discussions so that companies can voluntarily set standards.

Donald Trump and his family business are continuing to expand their investments in artificial intelligence, data centers, power infrastructure, and related technology companies. Financial disclosures show that after Trump's return to the White House, his investment accounts have reported nearly 30,000 securities transactions, including buying and selling stocks of chip, server, and energy infrastructure companies such as Dell Technologies, Micron Technology, GE Vernova, Broadcom, Texas Instruments, Credo Technology, and Advanced Micro Devices. It is currently unclear whether Trump still holds these shares, as related transactions do not require real-time disclosure, and Trump has not placed his assets in a blind trust.Trump Media Technology Group plans to merge with the fusion company TAE Technologies, which intends to build power generation facilities amid the growing demand for electricity in AI data centers. Truth Social also plans to authorize platform data to AI labs through TruthAPI and has launched a search tool supported by technology from Perplexity. Donald Trump Jr. serves as a partner at 1789 Capital, which has completed fundraising for a $1.2 billion fund, focusing on investments in digital infrastructure such as data centers, and has invested in Cerebras, Perplexity, and xAI. Eric Trump, on the other hand, invests in defense, robotics, and AI data processing companies through American Ventures.The White House denies any conflict of interest, stating that Trump's investments are entirely managed by independent managers, with related assets held in discretionary accounts and automatically replicating indices such as Schwab 1000 through computer models, meaning Trump and his family cannot decide on specific investments and transaction timings.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.

The Chief Information Security Officer of Slow Fog, 23pds, posted on platform X stating that the black and gray industries have established an attack chain against iOS users: clicking on links to extract private keys and mnemonic phrases; when users access web pages using Safari, they gain JS layer read and write capabilities through WebKit/JSC memory corruption; bypassing PAC to obtain native call capabilities; escaping the WebContent sandbox; escalating privileges in the kernel to gain root access, stealing Keychain and wallet data.The affected versions are iOS 13 to 26.5, and it is recommended that iOS users upgrade as soon as possible.

SlowMist released a security warning stating that it has recently received multiple reports of FomoPeek users' assets being stolen. After a joint investigation with the OKX security team, it was found that some affected users had previously installed or used FomoPeek versions 1.1 to 1.2, which contained malicious code. SlowMist stated that there are modules in FomoPeek unrelated to normal business, one of which includes a kernel exploit framework targeting the iOS system, supporting eight different attack methods that can automatically select the exploitation method based on device model and iOS version. Affected systems include iOS 12 to 18.7 and iOS 26 to 26.1. If the exploitation is successful, the application may break through the iOS sandbox and access and decrypt Keychain data, leading to the leakage of private keys, mnemonic phrases, login credentials, and other sensitive files. In addition, FomoPeek also connects to hidden servers unrelated to its public services and can receive remote commands. SlowMist indicated that its analysis of captured plaintext traffic shows that the related attack functions are currently enabled and will run automatically on a regular basis. SlowMist recommends that users who have installed or used FomoPeek versions 1.1 to 1.2 immediately check for any anomalies in their assets, generate new private keys and mnemonic phrases on trusted devices that have never installed the application, and transfer assets to new accounts as soon as possible, while also upgrading to the latest iOS version and not continuing to use or reinstall FomoPeek.

According to Politico, Anthropic, OpenAI, SpaceX AI, and Google have been sued for calling to "slow down" AI development.The lawsuit claims that Anthropic CEO Dario Amodei publicly called for "industry-wide coordination" to "set the pace for the frontier" earlier this month, with the support of SpaceX AI head Elon Musk, OpenAI CEO Sam Altman, and Google DeepMind co-founder Demis Hassabis, which amounts to an illegal business agreement among competitors under U.S. antitrust law.Nick Lolly, one of the lawyers representing the four plaintiffs in the Northern District of California, stated that the case aims to ensure that private self-serving agreements among the world's most powerful profit-driven tech companies do not lead to AI "rapidly spiraling out of human control." When it comes to existential threats like nuclear war and the greatest risks in human history today, humanity deserves ironclad guarantees. The rule of law should be established transparently and legally by the U.S. government and be accountable to the public.

According to Slow Fog's disclosure, Core Lightning (CLN) has an experimental feature vulnerability that may put user funds at risk. Core Lightning's official statement indicates that they are investigating the vulnerability and recommend that all nodes with experimental features enabled immediately disable them and wait for a patch. High-risk options include --experimental-dual-fund, --experimental-splicing, and --experimental-peer-storage.Slow Fog stated that similar issues were fixed in August, where remote peers could specify arbitrary or even zero fees in channel opening or fund adjustment protocols. Local nodes would sign and write to the database without additional verification, potentially forcing nodes to incur abnormal fees or even trigger a crash loop, leading to long-term offline status for the nodes.Node operators are advised to immediately disable or remove all experimental parameters; do not completely shut down the nodes, but use offline mode to retain on-chain monitoring capabilities to prevent peers from forcefully closing channels while the node is offline; verify signatures after the official patch is released before upgrading, and be cautious of fake patch links shared by impersonating official accounts.