Bitget lost $387.5m without anyone stealing a private key
Attackers spoofed transaction data so that legitimate-looking transfer approvals drained hot and warm wallets. The haul includes about 103 million XRP; the CEO points at North Korea.
News Feed
Everything we have published, newest first, from every desk.
Formal verification does not remove trust from a client, it shrinks it
An ethresear.ch post reframes the question as the Trusted Computing Base: everything trusted rather than proven, which is what humans still have to check.
The FCA closes firms that used a UK licence as an offshore badge
Twenty-one CFD firms have closed since 2025 and three are cancelling permissions. The conduct was little UK business plus an authorisation that made linked overseas companies look regulated.
Four of tonight's stories are about trusting an authority you inherited
Bitget's approvals trusted their own request generator. Solana's consensus trusted a library. XRPL trusted a duplicated spec. And 21 CFD firms sold a licence they barely used.
Bitcoin, Ethereum and XRPL all spent today editing specifications that had already shipped
BIP-138 redefines which keys enter its backup derivation, EIP-8298 removes a runtime-only restriction, and five XRPL standards are being synced to their reference implementations.
Five open XRPL standards changes move the spec toward the code, not the other way round
Open pull requests sync XLS-86, XLS-78 and XLS-65 with their reference implementations, align an XLS-85 error code from tecFROZEN to tecLOCKED, and pin byte order in XLS-102.
Avalanche's Helicon upgrade set a hard mainnet deadline and moved every node to plugin version 46
The avalanchego release schedules Helicon activation for 11 AM ET on 22 September and states that all mainnet nodes must upgrade before it; the same release line carries Granite on Fuji.
SIMD-0215 records a 2^81 collision attack on the accounts hash and explains why it cannot be built
The proposal now states that a published analysis puts a collision below 2^128 queries, and that the colliding sets would need more accounts than a valid ledger state can contain.
BIP-138 widens its recipient set to every distinct key in the backup payload
The merged change redefines the keys used by the wallet-account backup scheme: distinct public keys across all descriptor and policy sets and all content items, rather than one descriptor's keys.
EIP-8298 drops the runtime-only restriction on SETCODEFROM and lets initcode use it
The instruction sets the calling account's code hash to that of a source account with existing deployed code; the update removes the wording that confined it to runtime.