third-party

According to the Science and Technology Innovation Board Daily, Doubao Work has officially integrated with multiple third-party models such as Kimi 3.1 Pro, GLM 5.3, and DeepSeek V4.1 Flash.In addition, Doubao Work has launched a limited-time discount for Doubao 2.1 Lite and DeepSeek V4.1 Flash, reducing the consumption multiplier for these two models.

The cryptocurrency derivatives trading tool platform SignalPlus announced that it was attacked in the early hours of November 4, originating from a third-party Telegram account that was hacked, affecting a small number of accounts that had not enabled IP whitelisting.The team stated that they quickly identified and controlled the intrusion. As a precautionary measure, they have revoked all associated API keys with their centralized trading platform partners and temporarily suspended terminal services. The official statement indicated that the total loss was less than $82,000, and affected users will receive full compensation. They expect to fully restore services in the coming days, with subsequent updates and operational guidelines to be released through official channels.This evening, Binance also issued a statement indicating that it has taken precautionary measures regarding the potential security issues reported by the third-party platform SignalPlus, actively revoking all API keys associated with SignalPlus.Binance emphasized that its own system was not affected and that user funds are secure. Binance reminded SignalPlus users to log directly into their Binance accounts to check their positions and open orders, and not to rebind API keys until the issues with SignalPlus are completely resolved. They also advised to always enable IP whitelisting.

The Japanese cryptocurrency exchange Zaif announced that its email service provider Arara suffered an external unauthorized access, resulting in the leak of approximately 380,000 registered customer email addresses (after deduplication).Zaif stated that the leaked information is limited to email addresses and does not include names, transaction information, passwords, or other data. Their own system has not detected any intrusion, and accounts cannot be logged in with just the email addresses. Currently, there is no confirmation of asset damage or other secondary harm. Due to the suspension of Arara's services, Zaif has halted email sending and reminded customers to be vigilant against phishing emails impersonating them or Arara, advising not to click on links or enter authentication information, and recommending the use of authentication applications for two-factor authentication.

On October 29, the prediction market platform Polymarket announced through its X account Polymarket Traders that it has identified and fixed issues affecting its international platform Polymarket.com. The statement indicated that one of its third-party service providers was compromised, and the relevant situation has been handed over to law enforcement.Polymarket stated that the losses of affected users will be compensated. As a precaution, the platform has temporarily halted trading and is working to restore the international site. The account later updated that the platform is being restored, and trading is expected to reopen around 3 PM Eastern Time.

Doubao Work announced the opening of third-party large model services to enterprise clients, with the first batch including models such as Kimi K3.1 Pro from Moon's Dark Side, Zhipu GLM-5.3, and DeepSeek V4.1 Flash. Enterprise users can directly switch models in the Doubao Work dialogue interface, no longer limited to Doubao's own models.Previously, Doubao Work supported users to access third-party models independently, and custom access required users to settle fees separately with the model vendors. The tool invocation and product costs of Doubao Work are still consumed separately. This time, third-party models are directly included in the product's model selection menu, lowering the switching and usage threshold.

According to a statement released by Predict.fun on the X platform, a small number of user wallets experienced unauthorized fund transfers, with total losses amounting to approximately 400,000 USDT. Preliminary investigations indicate that an API documentation website hosted by a third-party service provider may have been compromised, affecting a small number of users in a short period.The website has been taken offline and will remain closed until the investigation is complete. Predict.fun promises to fully compensate users who have directly suffered losses due to this incident and will release a complete review report and subsequent preventive measures after the investigation concludes. Predict.fun is a prediction market platform based on the BNB Chain.

Polkadot has issued a security warning that the browser extension of the third-party wallet Fearless Wallet has been compromised, intermittently leaking user private keys to attackers since February 2025. Investigations revealed that malicious code sends private keys to servers controlled by attackers when users unlock their wallets.According to an announcement from the Polkadot Community Foundation, 8 users have reported suspected unauthorized transactions related to this issue, involving 17,286 DOT. Polkadot urges all users who have used this extension to immediately create a new key pair through other wallets and transfer their assets, as merely changing passwords or switching wallet software will not eliminate the risk. Fearless Wallet is developed by an independent team and is not the official wallet of Polkadot.

NetEase UU Remote has publicly released a third-party app integration protocol on GitHub, allowing developers to add a remote control entry to their iOS and Android applications. For example, to add a "Connect to Work Computer" button for an AI programming assistant, when users click it for the first time, they will be redirected to UU Remote to select and bind their Windows or Mac. After that, they can directly initiate remote control with another click, without having to repeatedly search for the device.Remote control supports full screen and picture-in-picture modes, allowing users to operate their computers through a floating window while using other apps on their phones. After leaving home, users can check if Claude Code or Codex on their home Mac has completed tasks, and they can directly invoke remote control from third-party applications. Developers can obtain connection results in windowed mode to determine if the device is offline or if the connection has failed.What has been opened is a cross-app invocation protocol, not the source code of the remote control engine, nor an interface for AI to automatically operate computers. Third-party applications still need to call the installed UU Remote client, and the actual remote control is completed by NetEase. Currently, the controlled devices only support Windows and macOS, and the mobile side must use UU Remote version 4.42.0 or later.

On October 16, Tencent Holdings stated: The company discovered unexpected behavior from third-party AI models on its platform. Earlier this week, a research report claimed that "out of control" AI entities had emerged in China, originating from a sandbox on Tencent Cloud.The Shenzhen company stated that the relevant models did not come from its own Hy artificial intelligence development team, and no evidence of deliberate targeting or collusion was found. Tencent indicated that these entities were part of an evaluation activity for models built by third-party developers. The report from the international research team stated that these entities detected Alibaba Group's online mapping service and attempted to bypass anti-bot protections.

Doubao Mobile Assistant stated that the 30-day public announcement period for its "Screen Automation Operation Declaration Agreement" (SAEP) ended on October 14, 2026, and it will gradually lift the screen automation operation permissions for third-party applications. Applications that have explicitly declared refusal of operation permissions will not be operated by the agent.After the public announcement period ends, developers can still declare refusal at any time, and Doubao Mobile Assistant will provide feedback within 3 working days. This agreement is aimed at cross-application operations of graphical interface agents, allowing developers to declare their interaction strategies with the agent.

According to Defimon Alerts monitoring, a new address funded by Tornado Cash withdrew 200 WETH from a dormant MakerDAO ETH-A liquidation bot on October 6, resulting in a loss of approximately $538,000.This upgradable proxy had won four ETH-A liquidation auctions in 2020 (numbers 1457 to 1460, each with 50 WETH), but did not call deal(), leaving the collateral in Flipper.The withdrawal function of the implementation contract was not protected by ds-auth, allowing any caller to trigger it: first calling deal() on the aforementioned old auctions, then transferring the collateral to the keeper via Vat.flux, and subsequently using GemJoin.exit to transfer 200 WETH to the address specified by the caller and unpacking it into ETH. The MakerDAO core contracts operated as designed, with the vulnerability lying in the unprivileged exit function of the third-party bot.

Regarding the previous incident where the FlashLoopAdapter vulnerability caused a loss of approximately 114 ETH from two Safe multi-signatures, Aave founder Stani Kulechov stated that the contract with the vulnerability is not the Aave v3 contract, but rather a third-party external adapter built on top of Aave, which does not affect Aave v3 itself.Previously, SlowMist disclosed that the FlashLoopAdapter has an access control vulnerability, which attackers exploited to bypass permission checks and transfer assets from two Safe multi-signatures that enabled the module, ultimately resulting in a loss of approximately 114.09 ETH.

Bitget's Greater China Regional Head, Xie Jiayin, recently addressed community concerns during a live broadcast. He reflected that since Bitget's establishment 8 years ago, user asset security has always been the top priority, successfully resisting multiple attempts of cyber attacks and maintaining a long-term record of secure operations. This incident marks the first security crisis in the platform's 8-year development history.Upon complete tracing, this incident is classified as a special attack targeting a third-party security software supply chain. The attacker exploited vulnerabilities in third-party products to obtain internal network credentials; however, private keys were not leaked, and cold wallet assets were unaffected. Currently, Bitget has partnered with security agencies Mandiant and SlowMist to conduct an independent review and will comprehensively upgrade the monitoring and management standards for third-party components. We are not only committed to promoting a full recovery following this incident but will also contribute to a safer, more robust, and healthier development of the industry through continuous technological iteration and system upgrades.

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

X Platform post by Xu Jiayin stated that Bitget has commissioned a third-party security team to conduct an independent forensic investigation into this security incident. Multiple teams are working together to verify remedial measures, confirm the attack vector, and assist in law enforcement cooperation. The investigation results will be announced promptly.He stated that Bitget has sufficient protection funds to cover the related losses and will restore withdrawals as soon as all potential security risks are eliminated.

Solana Mobile posted on platform X that its third-party marketing email service provider Brevo experienced a security incident affecting some customer accounts, including Solana Mobile. The team discovered unauthorized access to its Brevo account, has disabled the account, and is working with Brevo to understand the extent of the accessed information.Solana Mobile stated that, as far as they know, no emails have been sent from their account, but they are continuing to verify. They also remind users that Solana Mobile will not ask for mnemonic phrases, private keys, or wallet recovery information.

According to Bloomberg, U.S. regulators released a statement on Friday announcing a proposed guideline on third-party risk management for banks. The Federal Reserve, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the National Credit Union Administration stated that the proposal aims to help banks and credit unions "better align and customize their third-party risk management practices to match the risks of various third-party relationships."Federal Reserve staff indicated in a memorandum that as this plan is introduced, banks are increasingly outsourcing certain functions and relying on third-party relationships to improve efficiency and reduce costs. The plan will be open for public comment, is non-binding, and aims to focus institutions' regulatory attention on a principles-based approach to such risks. Federal Reserve Governor Barr opposed the proposal, citing concerns about the standards for "significant financial risks."

According to a report by Reuters, Apple Inc. is facing a class-action lawsuit in London, with claims amounting to £2 billion (approximately $2.7 billion). The lawsuit was filed today in the London Competition Appeal Tribunal by Ann Pope, a former senior official of the UK's Competition and Markets Authority, representing app developers.The core allegation is that Apple's "App Tracking Transparency" (ATT) feature, launched in 2021, imposes stricter restrictions on third-party developers than on its own services, giving Apple's own advertising ecosystem an unfair competitive advantage. Ann Pope stated that Apple's policies "have caused very significant harm to businesses that rely on Apple as a gatekeeper."Since its launch, the ATT feature has been a focal point of concern for global regulators for several years. Apple's official stance is that the feature is designed to allow users to control whether to permit apps to track their activities across other companies and websites.However, the plaintiffs argue that the actual enforcement of this rule has a double standard—tracking requests from third-party apps require strict pop-up authorization, while Apple's own personalized ads and services can bypass the same restrictions. This lawsuit represents the latest legal challenge Apple faces regarding its ATT policy and is the first large-scale private antitrust lawsuit initiated in the UK market against Apple's app ecosystem rules following scrutiny from regulators in the EU, the US, and several other countries.