audit

Tether CEO Paolo Ardoino, in an interview with The Block, responded to ongoing criticisms raised after KPMG U.S. completed its first full financial audit. He stated that some critics are unable to admit that their past judgments about Tether were wrong, and said, "Honestly, I don't care." Ardoino mentioned that Tether has repeatedly proven its resilience.He noted that in 2022, Tether processed $7 billion in redemptions within 48 hours, which was about 10% of its reserves at the time, and there was no pause in redemptions during that period. He believes that many traditional financial institutions would struggle to handle withdrawals of a similar scale in such a short time. He also stated that criticism itself is not a bad thing, as it makes Tether better and stronger. Even if some critics view it as a "villain," as long as Tether can continue to serve its claimed 650 million users who rely on USDT, especially in emerging markets, he does not mind.According to informed sources, Tether, as a private company, will not publicly share audited financial statements. The company plans to conduct a full audit once a year in the future while continuing to release quarterly attestation reports. Overall, the KPMG audit is an important step for Tether to enhance transparency, but controversies surrounding its reserves, disclosure levels, and systemic impact have not completely dissipated.

Bitcoin News posted on the X platform that the 256 Foundation has launched the 256 Red Team security project, which audits ASIC miner firmware through reverse engineering, real-time traffic capture, and reconciliation by share level. The team stated that 41 issue reports have been submitted regarding the original Bitmain firmware as well as third-party firmware such as LuxOS, VNISH, and Braiins OS.Identified issues include unauthenticated factory APIs, paths that allow root access, default credentials, built-in vendor SSH keys, and updaters that cannot verify installed content. After reverse engineering the Bitmain miner daemon and checking real-time connections, researchers reported that no evidence of hash power hijacking, remote kill switches, or hidden beacons was found in the original Bitmain firmware; the related risks are mainly concentrated in third-party "optimized" firmware.Researchers have submitted 3 responsible disclosures to VNISH, Luxor, and Braiins, granting each party 30 days to respond before public disclosure. MicroBT, Canaan, Auradine, Bitdeer, and ePIC will undergo follow-up audits.

Digital asset company Tether announced that it has completed a full independent audit conducted by KPMG U.S. on the financial statements of Tether International, S.A. de C.V. as of December 31, 2025. KPMG U.S. issued an unqualified audit opinion.The audit covered transactions, systems, ownership records, valuations, counterparties, and financial statement evidence, and reviewed the balance sheet, income statement, statement of changes in equity, and cash flow statement. KPMG U.S. also physically counted and inspected each gold bar held by Tether. Tether's Chief Financial Officer Simon McWilliams stated that the audited financial statements for 2025 show that its reserve assets exceed liabilities by $6.814 billion. Tether stated that this audit is an important step in fulfilling its long-term commitment to financial transparency.

According to Decrypt, a volunteer security team stated that it scanned 150 Bitcoin code repositories using cutting-edge artificial intelligence models and discovered a dozen vulnerabilities. The team has built multiple AI-based review systems, targeting wallets, cryptographic libraries, infrastructure, and other Bitcoin projects. Team members claim that, on average, each person can find about one serious vulnerability per hour, and in the past 12 hours, they have submitted security reports to multiple projects, but specific affected projects have not yet been made public.

The Bitcoin security organization Bitcoin Red Team, composed of 16 volunteers, stated that during a rapid AI-assisted review of Bitcoin ecosystem projects, nearly 5,000 potential issues were discovered. The members of the organization include AnchorWatch CEO Rob Hamilton and Bitcoin developer Calle, among others.Calle mentioned that the Bitcoin Red Team used AI tools alongside manual reviews to scan for vulnerabilities in open-source code repositories related to Bitcoin, averaging about one critical vulnerability discovered per person per hour. Calle revealed that within 29.8 hours of launching, the team had identified 4,962 potential issues across 390 projects, with as many as 720 considered high-risk or critical issues, and currently, 21.4% of the findings are reproducible. This security review initiative was launched a few days after the Coldcard hardware wallet vulnerability incident, in which stolen Bitcoin valued at over $100 million was involved.

Bitget's licensed RWA issuance platform Reality announced a deepened cooperation with the American auditing firm The Network Firm. After the upgrade, The Network Firm will provide daily Proof of Reserve (PoR) audit reports for the rToken, a U.S. stock token issued by Reality, based on the attestation standards set by the American Institute of Certified Public Accountants (AICPA). The aim is to verify that each issued rToken corresponds to the stocks or ETF assets held in the custody account. The underlying stocks and ETFs continue to be held by the FINRA-registered and SIPC-protected U.S. brokerage firm Alpaca Securities LLC, forming an independent and transparent structure for issuance, verification, and custody.The rToken issued by Reality currently supports 634 tokenized stocks and ETFs and is deeply integrated with the Bitget ecosystem, allowing for core scenarios such as unified account margin and collateralized lending. Previous data showed that the assets under management (AUM) of Bitget's stock token rToken exceeded $100 million one month after its launch.

According to The Block, Texas Governor Greg Abbott ordered the Public Utility Commission (PUCT) and the grid operator ERCOT to conduct audits on all data center projects in the queue within the state this week. ERCOT subsequently suspended the "Batch Zero" large electricity approval process, which was scheduled to announce results this month.Currently, data center applications account for about 90% of the 474 GW interconnected queue of ERCOT.Bernstein analysts noted in a client report released on Tuesday that this regulatory review will suppress speculative development and compress the supply of new electricity capacity, thereby enhancing the scarcity value of approved electricity capacity, benefiting existing Bitcoin mining companies and AI operators.The report specifically mentioned that Cipher Digital (CIFR), CleanSpark (CLSK), and Core Scientific (CORZ) are significantly affected by the audit, as their recent expansion plans rely on access to the Texas grid; while Terawulf (WULF) has a stronger risk resistance due to its power assets being distributed across multiple states, including Kentucky, Maryland, and New York; Riot Platforms (RIOT) and IREN benefit from already having large-scale approved operating assets in ERCOT.

Developers on Reddit used Claude Code to scan the Coldcard open-source firmware for vulnerabilities, identifying the core issue within 8 minutes:The firmware called a software pseudo-random number generator instead of a hardware true random number generator when generating private keys, and this vulnerability led to the theft of approximately $70 million in BTC from 1,196 wallets.At the same time, community users also reported that an independent scan using Zhizhu GLM 5.2 (trained on June 16, not connected to the internet) similarly discovered the same vulnerability.This bug has existed in the open-source wallet code for over five years.

Project Eleven has launched a new zero-knowledge proof system, providing a recovery method for the quantum-vulnerable Bitcoin proposed to be frozen under BIP-361, including the Bitcoin held by Satoshi Nakamoto.The solution leverages the property that quantum computers can break elliptic curve signatures but cannot break the one-way hash used in modern wallet key derivation, allowing the true owner holding the seed material to prove control. Benchmark tests show that the Project Eleven prototype is significantly faster than previous solutions, but the prototype has not yet been audited and is incomplete. It requires controversial modifications to blockchain rules before it can protect existing Bitcoin on the chain.

Web3 security company GoPlus Security pointed out that there has been a recent surge in smart contract vulnerability attacks, particularly targeting older contracts that have been deployed for many years. Attackers are leveraging AI technology to quickly discover and exploit these vulnerabilities.Recent typical incidents include:On June 9, a Token of Power (TOP) contract deployed 7 years ago was attacked on Ethereum, resulting in a loss of approximately $1.5 million;On May 25, a WUSD.fi contract deployed 3 years ago was attacked, resulting in a loss of approximately $200,000;On June 14 and June 18, Aztec Network was attacked twice in a row due to an old contract deployed 2 years ago, with total losses exceeding $4 million.GoPlus Security believes that traditional auditing methods are insufficient to effectively cover legacy contracts, and adopting AI-based Always-on Audit services may be the most effective solution currently available, capable of conducting security checks on old contracts in a short period while balancing reliability and cost.

The founder of DefiLlama, 0xngmi, announced the launch of a new off-chain proof/verification service, which will be used to verify and audit off-chain data, including information such as bank account balances, to help projects achieve reliable verification of real-world assets and other off-chain data.

According to a report by The Wall Street Journal, the prediction market platform Polymarket is suspected of paying dozens of social media creators to instruct them to record fake betting and high-profit videos on a simulated website that closely resembles the official site, using this as a promotional tactic to attract new users. The report indicates that the campaign required creators to conceal the official sponsorship relationship and specifically targeted the domestic audience in the United States.The investigation shows that the related marketing videos have accumulated over 140 million views on platforms such as TikTok, YouTube, and Instagram, involving up to $1.9 million in false bets. In response, Polymarket did not directly address the specific details of the investigation but stated in a statement that, as part of promoting industry transparency, the platform is conducting a comprehensive audit of active promotional content to ensure it strictly complies with internal standards and applicable regulatory and legal disclosure requirements.

Zcash founder Zooko Wilcox posted to express gratitude to Anthropic for helping to protect Zcash users.At the request of Shielded Labs, they conducted a security audit of Zcash using Mythos, and no other serious vulnerabilities were found in the Zcash protocol. Shielded Labs and other teams are continuing to advance security reinforcement work, and updates will be released later.

According to official news, Tether announced that it has appointed a new independent director to the board of Bitcoin reserve company Twenty One Capital (XXI) to fill the previous vacancy in the audit committee. The company stated that this appointment complies with the independence requirements of the SEC's Securities Exchange Act Rule 10A-3 and the New York Stock Exchange listing rules.This vacancy arose after Tether acquired the shares of XXI held by SoftBank Group on May 20, leading to the termination of the governance agreement between the two parties, and the resignation of the directors appointed by SoftBank, one of whom was a member of the audit committee.It was introduced that Twenty One Capital currently holds over 43,500 bitcoins and is positioned as a vertically integrated Bitcoin company, with business covering Bitcoin mining, asset reserves, capital markets, and financial services.Tether CEO Paolo Ardoino stated that XXI is building one of the most important Bitcoin companies in the world, and therefore the company prioritizes ensuring that the board has an independent oversight mechanism that meets SEC and NYSE requirements to match its strong balance sheet.

According to CoinDesk, security engineer Taylor Hornby, who discovered a serious vulnerability in Zcash using the Anthropic Opus 4.8 AI model, stated that Monero (XMR) has been added to the audit queue, and more privacy coin projects will undergo security reviews in the future.Hornby previously discovered a critical vulnerability in the Zcash Orchard privacy pool on May 29, which had gone unnoticed since May 2022 and could theoretically allow attackers to create unlimited undetectable fake ZEC. The development team at Shielded Labs completed an emergency fix before June 1 and subsequently disclosed the details of the vulnerability. As a result of the incident, ZEC dropped by as much as 38% within 24 hours after the news broke, with the market concerned that attackers may have exploited the vulnerability to steal funds from the privacy pool without leaving on-chain traces.Hornby stated that he was commissioned by the nonprofit organization Shielded Labs in April of this year to identify protocol vulnerabilities before attackers could exploit them. Although he had the means to profit from the vulnerability, he chose to report the issue to the development team, stating that "such betrayal is unacceptable." Additionally, Hornby plans to apply for funding from the Zcash community to support subsequent security research efforts.

According to Bits.media, the Central Bank of Brazil has tightened the licensing rules for virtual asset service providers, requiring them to undergo independent financial audits before obtaining operational licenses starting June 1. The auditing firms must not only examine the company's financial status but also review its compliance with anti-money laundering and counter-terrorism financing regulations, including whether the platform separates its own funds from customer assets, its risk management practices, and employee training. Auditors must be registered with the Brazilian Securities Commission. Cryptocurrency exchanges, brokerage firms, and custody services applying for a license for the first time must comply with these requirements from the start of the registration process, and companies that already hold licenses must also pass independent audits when renewing.Brazil first clarified in legislation in 2022 that virtual asset services are regulated by the central bank, establishing a category for licensed virtual asset service providers in November 2025. Additionally, Brazil recently imposed a complete ban on 28 betting and prediction market platforms, including Polymarket and Kalshi, on the grounds that they did not comply with local derivatives trading requirements. Starting October 1, Brazilian electronic foreign exchange providers will be prohibited from using cryptocurrencies for international remittances.

According to Protos, Bitcoin treasury company Twenty One Capital received formal notification from the New York Stock Exchange (NYSE) that it was deemed non-compliant due to insufficient independent directors on the audit committee and must complete rectification by June 5; otherwise, it will be marked as BC (below compliance standards) starting June 9.Previously, Tether completed the acquisition of approximately 89.1 million Class A shares held by SoftBank and terminated the related governance agreement, resulting in the resignation of two directors appointed by SoftBank, one of whom was a member of the audit committee. This left the company with only one independent director on the audit committee during the transition period, which does not meet NYSE requirements. Twenty One Capital stated that it will appoint new independent audit committee members as soon as possible.