Crypto Morning Brief: Suspected Attack on Predict Fun on BSC; OpenAI Releases GPT-6.1 Terra

Author: TechFlow

Yesterday's Market Updates

Predict Fun on BSC Reportedly Hit by Attack; Approximately $300,000 Flows into Tornado Cash

According to on-chain analyst Onchain Lens (@OnchainLens), the prediction market platform Predict Fun on BSC reportedly suffered an exploit. Approximately $300,000 in suspected stolen funds was transferred from multiple contracts through intermediary wallets to Relay. The funds reportedly were moved into Tornado Cash after being bridged.

Four Firms Including IBM and Oracle Oppose OKXICE Stock Tokenization Plan; Total Opposing Firms Rise to 26

According to journalist Eleanor Terrett, four companies including IBM, Oracle, Intel and quantum computing firm IonQ have recently objected to OKXICE, the joint venture between OKX and Intercontinental Exchange (ICE), tokenizing the company's stock under the U.S. Securities and Exchange Commission (SEC) innovation exemption framework.

With the addition of the four companies above, the total number of companies opposing the OKXICE stock tokenization plan has increased to 26.

Machi Big Brother's PaperTrade Account Funds Fully Lost; Hyperliquid Account Left with About $4,518

According to Lookonchain, Machi Big Brother Stanley Huang has lost all funds in his PaperTrade account, and his Hyperliquid account balance now stands at only $4,517.7. About one hour ago, he sold a Mutant Ape NFT at a loss again to raise more trading capital.

Justin Sun's Two Wallets Have Received $48.76 Million in PEPE in Total; Holding Value Rises to $51.01 Million

According to on-chain analytics platform Arkham (@arkham), two wallets associated with Justin Sun received PEPE from Poloniex in two transactions on Oct. 17 and Oct. 26: 7.2 trillion tokens (about $28.44 million) on Oct. 17 and 4.65 trillion tokens (about $20.32 million) on Oct. 26, totaling about $48.76 million. The tokens reportedly were originally purchased from Binance, then routed through Poloniex, HTX and back to Poloniex, before finally being transferred to Justin Sun's wallets.

During the same period, Justin Sun transferred $77 million in stablecoins to Poloniex in six transactions from Oct. 15 to Oct. 25, including $60 million in USDT and $17 million in USDC. The funds had previously been redeemed from Spark/AAVE and Sky, respectively.

Before Oct. 17, Justin Sun held only about $267,000 in PEPE (68 billion tokens). The current holding value of the two wallets is about $51.01 million, an increase of more than $2 million since receipt, accounting for approximately 2.82% of PEPE's total supply and 2.2% of his $2.29 billion on-chain wealth.

OpenAI Releases GPT-6.1 Terra; API Pricing 50% Lower Than Previous Generation

OpenAI announced the launch of GPT-6.1 Terra, with key improvements in visual reasoning, computer use, factual accuracy and software engineering capabilities. The model is designed for everyday office work and high-frequency automation tasks, and can be used to process technical drawings, fill out forms, edit videos and develop software.

In terms of performance, OpenAI said that on internal high-difficulty prompt tests, GPT-6.1 Terra reduced the factual error rate from 53.6% for GPT-5.6 Terra at low reasoning effort to 16.7%; at maximum reasoning effort, the error rate fell further to 4.3%. On the Terminal-Bench 4.0 programming benchmark, the model achieved a task completion rate of 50.3% at maximum reasoning effort, higher than GPT-5.6 Terra's 21.5%.

On pricing, GPT-6.1 Terra's standard API pricing is 50% lower than that of GPT-5.6 Terra and GPT-6.1 Sol, at $1 per million input tokens, $0.05 per million cached input tokens, and $5 per million output tokens.

The model is now available to Plus, Pro, Enterprise, and Edu users of ChatGPT Work and Codex, and developers can also call it via the OpenAI API.

Ripple Receives Final U.S. OCC Approval to Establish a National Trust Bank to Support RLUSD and Institutional Digital Asset Custody

Ripple CEO Brad Garlinghouse said in a post that the U.S. Office of the Comptroller of the Currency (OCC) has granted final approval for applications related to Ripple National Trust Bank. The approval will provide Ripple with a business platform under a federal regulatory framework to support its USD stablecoin RLUSD and provide digital asset custody services to enterprise clients.

Garlinghouse said the move reflects the convergence of the crypto industry and the traditional banking system, underscoring the importance of innovation, accountability, and federal oversight.

Kraken Parent Payward Plans to Deploy CFTC-Regulated Perpetual Futures Market via Hyperliquid

Hyperliquid officially announced that Kraken parent Payward plans to use Hyperliquid as underlying infrastructure to deploy a perpetual futures market for U.S. users, becoming the first institution to deploy trading products regulated by the U.S. Commodity Futures Trading Commission (CFTC) on a HIP-3* market; the specific plan remains subject to regulatory approval.

Under the plan, Bitnomial, Payward's CFTC-regulated trading market and clearinghouse, will be responsible for creating, operating, and managing the relevant markets, as well as clearing and settling contracts; its registered futures commission merchant, NinjaTrader Clearing, will be responsible for accepting client accounts.

Hyperliquid said HIP-3* will support permission-restricted market deployments through an on-chain allowlist mechanism. An initial version has been launched on testnet, and related specifications may still be adjusted based on feedback. This feature is an optional extension of HIP-3, and existing markets are not affected.

SlowMist: Udesk Customer Service Script Injected with Malicious Code That Can Steal User Session Data and Replace Deposit Addresses

According to disclosures by SlowMist, its security personnel, during routine threat intelligence checks, discovered that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js had been injected with a malicious loader. The loader hides addresses using hexadecimal encoding and asynchronously loads the remote script deeps.js (source: udeskqlobal[。]com; note that the domain begins with the letter q). The script reads cookies, localStorage, and sessionStorage accessible to the page, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[。]com/c.php; attackers could use this to hijack sessions or take over accounts. This data collection is not limited by target-site rules, and non-matching pages may also be affected.

According to SlowMist's analysis, the script also targets three types of sites: mgbx[。]com, bikingex[.], and bitxex[。]io, scanning deposit pages every 200 milliseconds and replacing identified deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. At the same time, the script wraps the clipboard API, replaces copy buttons, and intercepts copy events, ensuring that the addresses users see and copy are the tampered ones. If users transfer funds to the displayed address, the funds will flow to the attacker's address.

SlowMist recommends: preserve evidence and stop distributing affected scripts, revoke sessions and rotate tokens and passwords in a clean environment, verify deposit addresses and transaction records through a trusted backend, and restrict loading scripts from and exfiltrating data to udeskqlobal[。]com. Related IOCs have been incorporated into the MistEye threat detection engine.

Ethereum fixes Glamsterdam upgrade vulnerability to prevent staked ETH from being incorrectly credited to block builder accounts

According to CoinDesk, Ethereum developers have fixed a vulnerability in the upcoming Glamsterdam upgrade that could cause ETH deposited by staking services for new validators to be incorrectly credited to block builder accounts, allowing operators to withdraw the affected funds. The fix was merged into the Ethereum consensus specification on October 26, after being rejected on October 19 due to insufficient support from client teams.

Researchers noted that the related finding is a conditional code risk rather than a confirmed actual attack, and no losses have been reported. The fix still needs to be integrated by client teams, and the launch of Glamsterdam on the Hoodi testnet has also been delayed.

Today's Market Overview

Recommended Reading

AI-generated spam reports flood in; Firedancer requires burning 1 SOL before submitting vulnerabilities

https://www.techflowpost.com/article/34902

This article focuses on how the Solana validator client Firedancer is using economic costs to address the flood of AI-generated vulnerability reports. In an audit competition with a total prize pool of $1 million, researchers submitted 809 reports, but only 127 unique vulnerabilities were ultimately confirmed; a large volume of false and duplicate reports consumed the security team's review resources. To improve report quality, Firedancer requires permanently burning 1 SOL before each submission, while doubling standard bug bounties and increasing the maximum reward for critical vulnerabilities in the Alpenglow consensus architecture to $300,000. The new mechanism attempts to filter out low-quality reports by making submissions costly while offering high rewards for genuine vulnerabilities, but it may also raise the barrier for independent white hats. Its core takeaway is that when AI makes content generation nearly costless, security review mechanisms also need to redesign incentives and screening rules.

Kimi K3.1 Review Triggers X Account Bans? Multiple Overseas Bloggers Forced to Add 'Paid Partnership' Labels, Even Negative Reviews Not Spared

https://www.techflowpost.com/article/34901

This article focuses on the overseas social platform account ban controversy triggered by the Chinese large model Kimi K3.1. Multiple overseas AI review bloggers and technology writers said that after they posted Kimi benchmark tests on X, shared public review data, or even published posts criticizing subscription rate limits, their accounts were flagged by the system as violating paid promotion rules; some were also required to add a 'paid partnership' label before their accounts could be unlocked, after which they could only delete the posts. The article suggests this may be related to compliance disputes over Kimi's overseas promotion and the over-sensitivity of X's anti-fraud algorithms, but the specific triggering mechanism has not been confirmed. The incident shows that once platform automated moderation cannot distinguish genuine reviews, negative comments, and commercial advertising, it may undermine the credibility of independent reviews, and it also serves as a compliance warning for Chinese AI companies expanding overseas marketing.

Kraken's Parent Company Seeks On-Chain Derivatives Business, Pays Hyperliquid $38 Million 'Entry Fee'

https://www.techflowpost.com/article/34900

This article focuses on the partnership between Kraken's parent company Payward and Hyperliquid: Payward plans to leverage Hyperliquid's HIP-3 mechanism to launch a regulated on-chain perpetual futures market in the United States. On the compliance side, Bitnomial is responsible for market deployment, clearing, and settlement, while NinjaTrader Clearing is responsible for customer accounts and KYC; trade matching is handled by Hyperliquid's on-chain engine. Under HIP-3 rules, deployers are required to stake 500,000 HYPE, worth approximately USD 38.5 million at the roughly USD 77 price cited in the article, with a minimum lock-up period of 183 days. Trading fee rates on related markets are typically twice those of the native market, with approximately 97%–99% flowing into the Assistance Fund for HYPE buyback and burn. The article argues that this reflects a new division of labor in the industry: traditional trading platforms provide regulatory licenses and customer channels, decentralized protocols provide trading infrastructure, and CEXs do not necessarily need to build their own chains.

Podcast Notes | NEAR Co-founder Illia and Core Team Members in Conversation: Using DeepSeek Reduced Security Audit Costs from Tens of Thousands of USD to a Few Hundred USD

https://www.techflowpost.com/article/34897

This article summarizes the views expressed by NEAR co-founder Illia Polosukhin and others in the podcast. The core message is that AI is significantly reducing software security audit costs, while the convergence of blockchain and AI requires simultaneously addressing privacy, trusted execution, and agent collaboration issues. Illia disclosed that the team used a DeepSeek open-source model optimized with a customized toolchain for formal code verification, achieving results close to Claude and ChatGPT, while inference costs were 100–200x lower, reducing tasks that originally cost tens of thousands of USD to a few hundred USD. The NEAR team also emphasized technologies such as confidential-by-default design, post-quantum signatures, hardware secure enclaves, and chain signatures, and proposed using NEAR Intents trading fees to subsidize decentralized AI compute, enabling users to access more private and verifiable AI services. However, the above are mainly the project team's technical claims and hands-on testing results; whether the related cost advantages, privacy guarantees, and business model can scale still requires independent verification.

Source: 深潮 TechFlow