incident

In the Huang Renxun incident, the involved company Megaspeed International officially announced that it attaches great importance to complying with U.S. export control laws, stating that compliance is the company's top priority, and it is committed to constructive and transparent cooperation with the U.S. government.Megaspeed has cooperated with the U.S. Department of Commerce's Bureau of Industry and Security (BIS) inspections and is ready to fully cooperate with other relevant U.S. government agencies at any time. To further strengthen its compliance commitment, Megaspeed has hired a well-known U.S. law firm to lead a comprehensive inventory of the company's graphics processing units (GPUs) and independently verify the company's export control compliance practices. Megaspeed stated that it welcomes appropriate government oversight and will demonstrate through concrete actions that the company operates in a responsible and transparent manner while complying with applicable U.S. laws.Megaspeed is a cloud computing and data center company registered in Singapore and is an important customer of NVIDIA. The New York Times previously cited trade data reporting that from June 2024 to February 2026, Megaspeed's affiliated company in Malaysia procured advanced AI servers and other equipment, including NVIDIA chips and related products. Huang Le previously served as the CEO and chairman of the board of Megaspeed and is one of the main controllers; she has appeared alongside Huang Renxun multiple times at public business events.

Binance posted on platform X that it has completed the coverage of all affected assets from the previous security incident and released a new reserve proof snapshot. After the zero-knowledge proof is generated, users can independently verify whether their assets have at least 1:1 reserve support.

U.S. Ambassador to China David Perdue stated on November 11 that the U.S. and China are advancing the establishment of an AI crisis mechanism. U.S. Treasury Secretary Janet Yellen emphasized on the same day that both sides plan to establish direct communication channels to promptly report significant AI incidents involving national security.This mechanism is similar to an AI emergency hotline. For example, if an AI entity unauthorizedly attacks another country's network, jeopardizing critical infrastructure, or if advanced models show severe signs of losing control, both sides can exchange information in a timely manner to avoid misjudging a technical incident as a deliberate attack. In September of this year, the leaders of the U.S. and China agreed to establish a communication channel for AI incidents.

The police in Dezhou, Shandong, China, have cracked a cross-provincial online extortion case. The criminal gang impersonated environmental inspection personnel and journalists, using drones to film breeding farms and release negative videos, inducing farmers to pay for post deletion.The gang collected funds through payment codes and third-party payment platforms, which then settled with money laundering groups using virtual currency. The police stated that the gang committed 268 crimes in 22 cities across 5 provinces, including Shandong, Henan, Hebei, Jiangsu, and Anhui, within two months, involving an amount of over 800,000 yuan. A total of 23 people have been arrested, and assets worth over 2 million yuan have been sealed, seized, or frozen.

On Sunday, the NVIDIA board announced an investigation and issued a statement on November 10 at 11 AM Eastern Time, confirming the hiring of former Acting U.S. Attorney for the Southern District of New York Joon H. Kim and his law firm Wachtell, Lipton, Rosen & Katz to conduct a comprehensive and independent investigation into matters related to CEO Jensen Huang. The board also stated that there is currently no reason to believe that the company's confidential information has been compromised, and Jensen Huang has expressed support for the investigation and committed to cooperating.Public information shows that Joon H. Kim served as the Acting U.S. Attorney for the Southern District of New York from 2017 to 2018, overseeing more than 220 assistant U.S. attorneys, with cases covering economic espionage, theft of trade secrets, sanctions violations, and cybercrime. In March 2021, he was appointed by New York Attorney General Letitia James to independently investigate the sexual harassment allegations against then-Governor Andrew Cuomo, and shortly after the investigation report was released, Cuomo resigned in August 2021. In December 2023, he was again appointed by the special review committee of the Board of the Federal Deposit Insurance Corporation to independently investigate allegations of harassment and discrimination within the agency.

According to Lookonchain monitoring, the hacker address that stole over 26 million dollars in assets from TLBL used approximately 3.4 million DAI to purchase about 1,650 ETH.

According to Cointelegraph, the Bitcoin Lightning Network wallet platform LNbits urgently released version 1.7.0 after experiencing a wave of attacks that led to stolen funds, urging users to update immediately. LNbits warned that the vulnerability affects all earlier versions, and simply upgrading will not protect users whose credentials have already been leaked. It is recommended to reset wallet keys, change relevant credentials, and migrate servers if an intrusion is suspected.LNbits founder Ben Arc stated that the team is working hard to respond after users and the team suffered losses. Some users reported that attackers created new accounts using their LNbits instances, stealing approximately 0.023 Bitcoin.

According to The Defiant, security company PeckShield discovered a Hyperliquid account holding long positions in ETH that may be related to a theft incident involving the Web3 social protocol UXLINK through an intermediary wallet. Subsequent dashboard snapshots show that the position is approximately 20,919 ETH, valued at around 44 million dollars, with an unrealized loss of about 652,000 dollars, an average entry price of 2,134.45 dollars, using 15x full leverage, and an estimated liquidation price of 1,630.63 dollars.The report states that the connection is based on an intermediary address transferring 11 million USDC to the trading account, and this intermediary address had previously interacted with an address marked as the UXLINK attacker; this indirect link alone cannot prove that the trader controls the attacker’s wallet. Previously, related addresses had begun to gradually close out long positions in ETH, SOL, and XRP, with the original position's total value being approximately 148 million dollars.

Bernstein stated that the recent personal relationship-related allegations faced by NVIDIA CEO Jensen Huang are unlikely to directly impact the demand for the company's AI chips, but they may increase regulatory and political pressure. This incident could, at the very least, severely distract management's attention, and at worst, provide a reason for bipartisan lawmakers in the United States to intensify scrutiny of NVIDIA.Additionally, the firm warned that NVIDIA faces key person risk. Jensen Huang has long dominated the company's strategy and major operational decisions, reportedly overseeing about 60 direct reports, and the company's management system heavily relies on his personal leadership. It is currently unclear who could succeed him if he is unable to continue in his role. Despite these risks, Bernstein maintains its outperform rating on NVIDIA with a target price of $400.

According to GoPlus monitoring, the Keplr wallet has experienced a vulnerability in the social login service provider Web3Auth, resulting in the leakage of some users' private keys or the theft of transaction signing capabilities, with at least approximately 1 million dollars in assets stolen, and another approximately 6 million dollars in assets transferred to an officially confirmed rescue address.GoPlus stated that the affected Keplr wallets were those created using Google or Apple login, while accounts created using mnemonic phrases or hardware wallets were not affected. Web3Auth has announced a recovery address and stated that some transfers protecting assets were mistakenly identified as attacker activities.

According to market news, the relevant address received at least approximately 6.01 million dollars in cross-chain transfers, and the losses from the Keplr incident have not yet been verified.

b14g released a security incident review report on October 31, 2026, which pointed out that attackers exploited a compatibility flaw between its staking contract and the native staking contract of the Core network. Through a single transaction, they initiated 99 zero-amount (0 CORE) withdrawal requests to 91 staking orders, resulting in approximately 97.05 million CORE being stolen. This attack did not involve private key leakage, nor did the attackers modify or deploy new b14g contract code.BTC staked through b14g was unaffected and remains locked on the Bitcoin chain. In terms of fund recovery, approximately 68.15 million CORE (about 70.2% of the total stolen amount) was recovered on November 2 through a hard fork of Core, and another approximately 12 million CORE has reportedly been frozen by trading platforms. Regarding user compensation, b14g plans to return the recovered CORE to affected orders in proportion to their original balances within the next 5 to 7 days, while the remaining losses will be repaid through 50% of future Core staking business income, with affected users able to receive payments weekly.

North Korea establishes hacker teams through state-supported talent training programs, selecting about 150 to 200 students from middle schools each year to receive computer education, with some individuals eventually entering military cyber units.Outstanding hackers can receive benefits such as housing in Pyongyang and foreign currency rewards, while relevant military cyber units can receive up to 30% of the profits from attacks.

According to the Nikkei, data from Chainalysis shows that in reported cryptocurrency theft incidents in 2026, 89% involved North Korean hackers, compared to 15% in 2021.The report states that North Korean hackers are increasingly using generative AI to create fake documents and impersonate technicians. The South Korean government estimates that more than 8,000 personnel are employed by North Korean authorities for this purpose.

Floki posted on the X platform stating that it is investigating a vulnerability exploitation incident. Currently, the related bot services have been taken offline, and the team is taking measures to protect the remaining user funds and confirm the specific affected users.Subsequently, affected users will be migrated to a new secure wallet, and the remaining funds will also be transferred to them. Floki reminds users not to deposit funds into the bot wallet until further notice; if users have exported their private keys and still have funds in the wallet, they should immediately transfer them to a wallet they fully control. The official emphasizes that the team will never proactively message users or ask for mnemonic phrases or private keys, and users should ignore anyone claiming to provide "refund" or "recovery" services.

According to Bloomberg, the Binance hacking incident is prompting the cryptocurrency industry to re-examine its long-held decentralized philosophy, as well as the transaction review, settlement delays, and fund intervention mechanisms in the traditional financial system.As the cryptocurrency industry seeks to enter the mainstream financial market in the United States, some institutional investors are beginning to reconsider Wall Street's financial risk control mechanisms. In traditional finance, banks, payment networks, and clearing institutions can review suspicious transactions during the fund transfer process and can suspend fund flows under certain circumstances.Third Eye CEO Tian Zeng stated that he hopes the settlement time can be shortened from the traditional financial T+1 day to T+1 hour, by appropriately extending the settlement time and increasing review steps, thereby reducing hackers' ability to quickly transfer funds.FalconX Co-Head of Markets Joshua Lim pointed out that as more institutions enter the cryptocurrency market, the client structure is changing, and some institutions are no longer willing to fully accept the risks associated with irreversible transactions. As the cryptocurrency industry further integrates with traditional finance, how to balance transaction efficiency, decentralization, and fund security will become a problem that the industry must face.

GitBook released a security incident review on November 2, stating that attackers exploited a vulnerability in its single sign-on process to forge employee login sessions, allowing them to query improperly configured GitHub App authentication information within the organization, access internal code repositories, and obtain Cloudflare API keys, ultimately gaining full production environment permissions through service accounts.GitBook disabled the relevant internal service accounts to cut off the attack within hours, resulting in the platform being offline for approximately 16 hours, and fully restored on November 3 at 11:56 UTC. The attackers remained in the production environment for a total of about 3 hours and 25 minutes. GitBook has rotated all infrastructure and revoked customer keys and API tokens.GitBook stated that current indications show the attack targeted a single customer rather than the platform as a whole, and no other customer content has been found to be tampered with. However, since the attackers could access customer data within the platform, they are treating it as if all customer data may have been exposed, including API tokens, integration keys, session signing keys, assistant Q&A records, and authorized repository permissions for GitHub and GitLab applications. Billing information, passwords, and IP addresses were not affected.GitBook noted that the speed and precision of the attack heavily relied on automation and AI. Slow Mist's Chief Information Security Officer 23pds forwarded the review, stating that the targeted entity was Trade.xyz. Trade.xyz previously indicated that the document anomaly stemmed from an intrusion into GitBook's infrastructure, and there were no signs of their own infrastructure being compromised, and they will migrate away from GitBook within a few days.

According to Digital Asset, the Financial Services Commission of South Korea announced that it will formulate new guidelines requiring virtual asset service providers to immediately notify the Financial Supervisory Service and the Financial Security Institute upon discovering security incidents. Currently, these companies only need to report to the Korea Internet & Security Agency. Financial authorities believe that as virtual assets become increasingly intertwined with the financial industry, it is necessary to quickly convey incident information to financial regulatory bodies for investigation, information sharing, and consumer protection.Financial authorities also plan to establish the Digital Financial Security Act, which will apply security regulations comparable to the current Electronic Financial Transactions Act to virtual asset service providers, insurance agencies, and the lending industry, which hold a large amount of customer information or could cause significant asset losses. The legislation is planned to be completed and submitted in the first quarter of 2027. In addition, South Korea will conduct comprehensive security inspections of approximately 580 financial companies, including virtual asset service providers.

According to The Block citing the Korean Central News Agency, Kim Yo-jong, the Minister of the Workers' Party of Korea, issued a second statement regarding the Binance hacking incident, stating that North Korea is willing to engage in dialogue, but this may not necessarily align with national interests.Kim Yo-jong is the sister of North Korean leader Kim Jong-un. She previously criticized the United States for blaming North Korea for the $6.3 billion Binance vulnerability incident.