Cryptopolitan

Google has updated its privacy policy so that content in Gmail, Google Drive, and Google Photos can now affect the ads it serves.
The opening is only for users linking those apps to the company’s AI tools. The new language took effect Oct. 16.
An October 16 clause ends the flat Drive and Photos pledge
Inbox, cloud files, and picture libraries are not things that Google would use to personalize ads. The company has said this for years. Now there is a catch to the promise. On October 23, the change was seen for the first time.
“We don’t show you personalized ads based on your content from Drive, Gmail, or Google Photos, unless you choose to make data from these services available to other Google services that support personalized ads,” the policy says. But the October 1 version, which took effect two weeks earlier, ended that sentence at Photos without exception.
A ban on ads built from sensitive categories like race, religion, sexual orientation or health is unaltered.
Ads can now also use “personalized content from Google services,” whereas the text of Oct. 1 cited only interests and activity across Google services.
Ad rules in Google’s privacy policy, effective October 16, 2026.
The switch is Personal Intelligence. The feature allows AI Mode in Search and Gemini to use a user’s connected apps to customize answers.
Connected to Gmail, Search can turn up a hotel booking and recommend nearby restaurants. The new language also allows that same linked data to drive the ads a person views.
Search Services History can keep data after apps disconnect
Google says it has set limits. By default, Gmail, Drive and Photos content isn’t used to target ads, and advertisers never see what’s inside those accounts.
The company said it doesn’t share names, email addresses, or other identifying information with advertisers without permission.
Users can opt out in Data & privacy in the Google Account. From Personalization & activity, Personalization settings lead to Manage Personalized Recommendations in Search Services.
Users can disconnect Google Workspace and Google Photos from the Connected Content apps menu in the Additional Personal Intelligence section there. Users can also turn off Personalized Recommendations entirely.
Disconnecting doesn’t always get rid of what Google already has, though. The information in Search Services History can stay there even if an app is disconnected or the original email or picture is deleted.
Google already permits advertisers to embed products in AI Mode answers, with Direct Offers attaching discounts to them.
Cryptopolitan says that Gemini released Personal Intelligence in January as an optional tool for paid AI Pro and Ultra subscribers. Google had been criticized in November 2025 over claims that Gmail fed Gemini by default through Smart Features. By February, Google was testing Personal Intelligence for free users in AI Mode Search.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Malicious Electrum servers replaced users’ just-broadcast bitcoin payments with fake zero-fee transactions paying lookalike addresses.
Servers apparently bet victims would raise the fee and sign the fake.
Electrum released version 4.8.3 on October 24 to address the high-severity flaw. Maintainer SomberNight released advisory GHSA-6jp4-8v48-cc5v the same day and requested users to upgrade.
Forged address shared a GyQ3 ending with the legitimate destination
Electrum is a light client. It doesn’t have a full bitcoin node and relies on its server for unconfirmed mempool transactions. Its own documentation explains how it works.
Someone signs and sends tx1. A bad server stops it and sends a different tx2 to the wallet that sends the money to an attacker’s address.
Tx2 has invalid signatures. Older Electrum didn’t verify signatures of mempool transactions, so the wallet showed tx2 as pending and hid tx1.
Replace-By-Fee, or RBF, permits a sender to rebroadcast an unconfirmed transaction with a higher fee. If the fee on the fake is increased, the wallet signs the attacker’s version with a valid signature.
One of the targets, known as dannydeezy, documented the attack. A 2-of-3 legacy P2SH multisig with two Trezors, 31 inputs, and one output.
User checked output on both Trezors then broadcast. Wallet history then displayed the full amount going to an unknown address unconfirmed, and the entry later flipped to “Local.”
The fake replicated the real transaction’s inputs, version and locktime, with byte identical scriptSigs on all 31 inputs.
All 62 of the signatures checked out against the real transaction. None checked out against the fake.
Almost all of it was sent to a lookalike address, with a small amount being sent back to one of the wallet’s own used addresses.
The fake ended in GyQ3. So did the real endpoint.
The attacker had figured out an address which matched the last four characters of the correct address.
Incident report from user1 in Electrum’s security advisory, published October 24, 2026, on GitHub.
ZachXBT has also called out a similar address-poisoning scam affecting Phantom wallet users. Spoofed addresses are made impervious to a glance at the first and last characters.
Version 4.8.3 checks signatures only on wallet-owned inputs
Another user, Raju-K12, privately reported on Oct. 18 that they bumped the fee on the fake and lost money. Some servers are running the attack in the wild, the maintainers say.
Commit 90fe308 adds a check for signatures on wallet-owned “is_mine” inputs before adding a mempool transaction to local history. Version 4.8.3 was git-tagged on October 23 and binaries were released the next day.
Electrum still checks only inputs the wallet controls. So unconfirmed incoming transactions go unchecked.
This is because the client has no full script interpreter.
Electrum’s workaround for anyone who can’t upgrade is to verify output addresses and amounts before signing anything, including fee bumps. Those users who connected only to their own servers were never affected.
Electrum has shipped emergency fixes in the past. In January 2018, it closed down a JSON RPC interface that had been left open for some two years, after Google researcher Tavis Ormandy found that a website could detect the port and drain funds.
Cryptopolitan reported that a Coldcard seed-generation bug warning came in July, the same day approximately 594 BTC, ~$38 million, was drained from about 500 wallets.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Jack Dorsey’s Block trained its new voice model, Dessa, on human speech only, not on any text or any pre-trained models.
Block says that the finished model can be run locally on a MacBook Pro M4 Max or better. The lab trained it on a single rack of Nvidia servers.
Block says Dessa is the first AI it knows of that can carry on a lifelike live conversation and has been trained only on human speech. The tiny research lab behind it reports directly to Dorsey.
Full-duplex model talks with OpenAI’s GPT-Live-1 in unsteered demos
A lot of voice assistants take what people say, turn it into text, run it through a language model, and then turn the text back into speech. As Block puts it, the pipeline throws out emotion, sarcasm, laughter, and a sad voice that cracks.
Dessa is a model that turns speech into speech, with no text in between. Like two people, it talks and hears at the same time.
It knows when to cut in and when to chime in with a “yeah!” or “got it!” Block said. It runs faster than real time.
Block says no one guides the AI model in the recordings. It chooses what to say, when and how.
In the recordings, Dessa laughs mid-sentence, gasps at a surprise and gets louder when asked to speak up. In one of the recordings, Dessa spoke to OpenAI’s GPT-Live-1.
Block says the developer of GPT-Live-1 has not vetted or endorsed Dessa.
We made the first AI model you can have a realistic conversation with that was trained entirely on speech!
Dessa is a full-duplex speech-to-speech model that you can run on consumer GPUs.
This is a GPT3 moment for speech. pic.twitter.com/XVD8sSyJn8
— Ragavan Thurairatnam (@RagavanThurair) October 23, 2026
A GB200 NVL72 taught the model language from hundreds of times fewer words
Dessa trained on a single Nvidia GB200 NVL72, a rack-scale system. The lab says the model learned language from “hundreds of times fewer words” than a text-based LLM needs.
Speech made the job tougher, said Block. A spoken word is thousands of times more bytes than the same word in print.
The lab was founded by former members of Toronto deep learning startup Dessa. The team has been building generative speech models for over eight years.
Ragavan Thurairatnam heads the project, and he called the release “a GPT3 moment for speech” on X.
Dessa is not publicly available. Block is running a waitlist and giving early access to a small group of AI safety researchers to surface risks the team hasn’t foreseen.
Three things led Block to build the model. Two are curiosity and better understanding between humans and AI.
The third reason? Safety.
Block imagines a person who is in a lot of pain, but a voice AI doesn’t notice and keeps talking.
Cryptopolitan reported that in February, Block (NYSE: XYZ) laid off 40% of its staff.
Block Inc. put out Buzz in July. It’s a chat app for the workplace where humans and AI agents can share channels.
The smartest crypto minds already read our newsletter. Want in? Join them.

Ether has fallen around 13% over the last 30 days, almost three times Bitcoin’s 4.7% decline. The token fell below $2,300 on Oct. 24.
ETH traded at $2,342.08 late on October 24, down 12.96% over 30 days, CoinGecko data indicates. The weakest price in the 30-day window came in at a 24-hour low of $2,286.76.
Bitcoin changed hands at $80,537, down 4.71% over the same period. Ether opened the window close to $2,684 and Bitcoin close to $84,249.
ETH/BTC ratio slides to 0.0291 from 0.0319
Over seven days, ETH dropped 3.33%, bitcoin 1.48%.
The ETH/BTC ratio, or the price of Ether in Bitcoin, lingered around 0.0291. It began the 30-day window near 0.0319.
Ether fell about 0.7% on the day to the late-session price, and bitcoin about 0.1%.
Ether crested for the window near $2,754 on Oct. 2. It has since lost about 15% and is down about 53% from its record high of $4,946.05 in August 2025.
Bitcoin is trading ~36% below its own $126,080 peak set in October 2025. Late October 24, Ether’s market cap was about $286 billion.
BlackRock’s ETHA drives a $110.6 million exit on October 22
US spot ether exchange-traded funds registered net outflows of $110.6 million on October 22, data from Farside showed.
BlackRock’s iShares Ethereum Trust, ETHA, saw $75.5 million lost of that total. Fidelity’s FETH gained $2.4 million.
On the same day, BlackRock’s ETHB lost $17.2 million. Grayscale’s ETHE lost $9.6 million, while its Ethereum Staking Mini ETF lost $10.7 million.
The exit on October 22 followed $14.9 million in inflows on October 21. Grayscale’s staking mini fund saw inflows of $28.1 million on Oct. 21, while FETH took in $13 million, with ETHA shedding $29.3 million.
Five successive sessions of outflows from Oct. 14 to 20 drained $388.9 million from the funds, while the seven sessions through Oct. 22 cost $484.6 million.
$129.5 million left on Oct. 14, the heaviest day of that run. October 19 added $103.3 million more.
Daily net flows for US spot ether ETFs from October 14 to 23, 2026, in US$ millions, per Farside data.
The October 23 tally showed net inflows of $4.4 million, but the ETHV fund’s figure was still absent.
According to Cryptopolitan, Ether ETFs experienced an outflow of $1.08 billion in October by October 21, marking the largest monthly outflow in 2026. The outflows erased ~$832 million of inflows from September, leaving net inflows for the year-to-date at about $485 million.
October was the worst month for the funds since November 2025. Total net assets stood at $14.98 billion as of Oct. 20, or 5.01% of the market value of ether.
Bitcoin ETFs bled only ~$67m in the same October period. They still had net inflows of ~$809 million in 2026.
A six-session streak that began on September 29 sapped ~$408 million, and ETHA alone lost $201.89 million on October 6.
The smartest crypto minds already read our newsletter. Want in? Join them.

Arbitrum’s ARB token has fallen around 24% over the last 30 days, close to double ether’s ~13% drop.
Bitcoin dropped about 5% during the same time.
Data from CoinGecko shows ARB reached $0.1638 on Oct. 24, its lowest price in four weeks. The token was trading around $0.167 late in the day, down about 5% on the day.
Ether lost about 2% and Bitcoin about 1% in the same window.
At 10:02 UTC on Oct. 23, ARB was trading at $0.1802, below the $0.183 to $0.186 band that a technical note on Oct. 14 had flagged as a potential retest zone, not a firm floor.
The October 14 note had shown ARB at $0.1916. The band gave and price kept slipping.
Arbitrum One active addresses climbed to 563,669 on October 23
Other Ethereum scaling tokens also fell precipitously. Optimism’s OP lost ~16% in 30 days and Polygon’s POL ~17%.
OP did worse in the last week. It fell ~16% in seven days vs ARB’s 9% and POL’s 5%.
Ether and bitcoin fell around 3% and 1.5% respectively over the seven-day period.
Arbitrum One’s network use went the opposite way. Growthepie data indicates daily active addresses stood at 563,669 on October 23, compared to 95,545 on September 26.
It fell from 571,767 on Oct. 21 to 299,959 the next day, then rallied. The number of addresses is not equivalent to the number of users.
Arbitrum One daily active addresses over 90 days through October 23, 2026, on growthepie.
Standard Chartered’s $0.50 target now needs a ~3x rebound
ARB’s slide wipes out much of a September rally. According to Cryptopolitan, by September 18 the token had surged more than 167% in a month to trade above $0.20 for the first time since January.
By that time, ARB had gained over 147% in 90 days and landed among the top 10 tokens outperforming Bitcoin.
Tokenized assets on Arbitrum reached a record high of over $800 million in assets under management at the time. On-chain assets increased from $9.38 billion to $11.18 billion in a month.
Standard Chartered has a $0.50 target for ARB by the end of 2026 and $10 by 2030, set in mid-September. At ~$0.167, ARB would need to triple to hit the closer mark.
“We see digital assets transitioning from a state where revenue is not yet relevant to one where revenue is critical,” wrote Geoff Kendrick, head of digital assets research at the bank.
The bank’s own note said that holders of ARB receive little of the network revenue behind the call. Chains using Arbitrum tech in the Arbitrum Expansion Program pay 10% of net protocol revenue, with 8% going to the DAO treasury and 2% to a developer guild.
The headline customer for the program is Robinhood Chain. Its daily fees attained a high of $6.04 million on Sept. 4 and fell to $448,616 by Sept. 14.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Base hosted a GMGN trading competition, which required new wallets, and logged 943,277 daily active addresses on October 22, a 49.9% increase in a single day.
The same day, user-paid fees dropped 20% to some $91,059 and transactions fell 8.6% to 9.58 million.
Addresses had already jumped 82.5% to 629,142 by October 21, a 30-day high at the time.
Address count ran 167.6% above the prior week’s median
Growthepie data indicated the October 22 count was 167.6% above the median of the past seven days, which was 352,544. It was the highest reading in the 30 days since September 23.
The transactions went the other way. Growthepie had 10.49 million on October 21 and 9.58 million the next day.
BaseScan‘s daily export logged a matching dip, from roughly 10.53 million to 9.63 million, while user fees had risen to about $113,703 on October 21 ahead of the 20% slide.
By October 23 the wave was fading, with active addresses slipping 38% to 584,540, though they stayed 65.8% above the pre-surge median.
Then, fees fell a further 19.8% to about $73,062, and transactions eased to 8.87 million.
GMGN’s $20,000 track demands wallets with no trading history
GMGN unveiled its Base track on October 21 with a $20,000 prize for the winner, running until October 26. “Trade Base coins and climb the leaderboard,” GMGN wrote.
GMGN’s Base track announcement, with the $20,000 prize and the October 26 end date, posted by @gmgnai on X on October 21, 2026.
Base promoted the track on October 22, the same day the surge peaked.
GMGN’s rules say that each entrant must register wallets with “no funds, no holdings and no trading history.” Only trades made through GMGN from the wallets registered will count.
Starting money is capped at $2,000, and no one may enter more than once. Traders must create new addresses when they join, and Growthepie counts them as new activity.
Additionally, the rules prohibit people from washing trades or coordinating trades with one another, and the chain totals can’t show the percentage of the jump that came from contest wallets.
Growthepie keeps track of all the different “from” addresses that send transactions every day. It warns that Sybil wallets can increase active addresses during campaigns or airdrops and calls active addresses “one of the most contentious metrics.”
The data firm also says that one person can have many wallets and suggests that the number of wallets be read along with the chain revenue. On October 22 and 23, the fees users paid on Base went down.
Doubts about Base’s activity figures aren’t new. Cryptopolitan reported on October 15 that Chainalysis had logged more than 138 million x402 transactions on Base.
TRM Labs reckoned agents carried out only 0.6% to 7.5% of the x402 transactions it screened, and Artemis and a16z analysts said 48% of transactions and 81% of volume in December 2025 were gamed.
The smartest crypto minds already read our newsletter. Want in? Join them.

The PHP Foundation runs on about $974,000 a year, with one full-time employee looking after a language behind most of the web.
Two critical PHP flaws sparked a worldwide patching frenzy this week.
One full-timer and 14 contractors keep the language going
“We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” Executive Director Elizabeth Barron said Friday in an interview. The board of the foundation is unpaid, and the money comes from grants and donations.
The foundation’s Open Collective page shows its yearly budget as $974,057.80. The foundation has raised $3.06 million since its launch in late 2021, spending $2.70 million.
With that budget, the $356,614.52 left over will cover expenses for four months. It shows that 1,927 people have donated and that 340 people have made monthly pledges worth ~$9,416 in total.
The PHP Foundation’s balance, total raised, total disbursed and estimated annual budget, shown on its Open Collective page.
Barron said that in a year, the proposed changes to PHP code have almost doubled, and contributors have not kept up. Every submission and bug report still needs to be checked out by real people with experience.
AI helped researchers detect the two flaws that had been in the PHP code for a decade, and it makes programmers faster, Barron said.
AI also adds review burden to maintainers. She called the programming language badly underfunded, given how much companies and governments rely on PHP.
Barron saw no sign hackers got into patched sites
Since December 2021, Automattic is the biggest backer at $762,500. JetBrains at $476,670.
Sovereign Tech Fund is at ~$214,115. The Linux Foundation is at $183,500.
Smaller amounts are supplied by Private Packagist, Craft CMS, Cybozu, and Tideways. Zend by Perforce has given $56,000 and GoDaddy $48,000.
Chainguard Team has contributed $50,000 since October 21, the day PHP released its patches.
The foundation states on the page that it pays developers to work on the PHP language.
The largest tagged expense category is core developer work. It took 227 payments totaling ~$1.11 million out of 526 paid expenses.
PHP issued patches for CVE-2026-109618 and CVE-2026-109619 on October 21, both with a severity rating of 9.2 out of 10, Cryptopolitan reported. The pair, dubbed PHP2Shell, could allow attackers to execute code without logging in.
Wiz showed the flaws can also spill passwords and API keys from memory. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are the fixed releases.
Cloudflare registered millions of exploit attempts, and the government websites in Finland, the Netherlands and France went offline temporarily. The foundation works with OpenAI, Wiz and Calif to fix things.
Barron said there was no evidence hackers exploited the flaws prior to their disclosure or on patched sites.
This open-source language, which is over 30 years old, is employed on 69.3% of websites where the server-side language is known.
The smartest crypto minds already read our newsletter. Want in? Join them.

On Saturday, Arthur Hayes dumped Maelstrom’s directional book, with on-chain trackers tallying the sales at around $22.28 million across seven tokens.
The BitMEX co-founder cashed out on Ethereum (ETH), Ethena (ENA), Uniswap (UNI), and other altcoins and took a step back.
“I dumped it all. The Maelstrom directional book, took profits on $ETH, $ENA, $UNI and other shitcoins,” Hayes wrote on X. “I think we gotta go down to go up,” he added.
He said macro and geopolitical conditions look “a bit dicey”. He’s awaiting a green light before he buys back in.
Seven tokens left labeled wallets in a 40-minute window
On-chain trackers identified 6,400 ETH (~$15.2 million), 14 million ENA (~$2.76 million) and 323,000 UNI (~$2.24 million). The rest were smaller quantities of ETHFI, AERO, PENDLE and ZAMA.
Lookonchain’s tally of the seven tokens Hayes-labeled wallets moved, posted on X on October 24, 2026.
Etherscan records show a bigger ETH number. Another address associated with Hayes sent 8,000 ETH in four transactions, 3,200 ETH to a Galaxy Digital deposit and 1,600 ETH each to Binance, FalconX and a fourth address.
The main wallet shifted 14 million ENA to a Binance deposit and 323,000 UNI and 3 million ZAMA to an address tagged for Wintermute. Minutes later, a Wintermute wallet returned 2,425,850 USDC.
The same wallet transferred 1.89 million ETHFI to a FalconX deposit and 120,000 PENDLE to the fourth address. On Base, it channeled 546,610 AERO to Binance.
The tokens were out between 1:34 a.m. and 2:14 a.m. ET Saturday. Hayes posted at 2:18 a.m. ET.
The labeled wallet still retained some 14.45 million ENA after the transfers.
BitMEX co-founder trades the bailout bet for the sidelines
“Instead just trade the eventual multi-trillion dollar bail out. Long $BTC $ETH,” Hayes wrote Oct. 15. The address behind the ETH transfers on Saturday had taken in 8,012 ETH from his main wallet on Oct. 14.
“Going to sit on the sidelines and wait for the all clear signal,” Hayes wrote.
He exits in a way that contradicts his May essay, “The Butterfly Touch.” In it, he pegged a Bitcoin (BTC) bottom near $60,000, floated $126,000 and said he would take Maelstrom’s portfolio “to maximum risk unless anything drastically changes.”
Hayes has quit positions on macro grounds before, announcing full exits from HYPE and NEAR in June. He was accused by ZachXBT of selling HYPE, NEAR, ZEC and WLD within two weeks of boosting each token.
Days after Hayes hyped the token, on-chain observers flagged Maelstrom sending ~$1.92 million of CARDS to market maker Flowdesk later in June, Cryptopolitan reported. Hayes replied to ZachXBT, saying he “sold to a willing seller at a price.”
If you're reading this, you’re already ahead. Stay there with our newsletter.

Moonshot says it intends to “progressively raise the cyber capability available in open weights” after its new Kimi K3.1 Pro model scored 81% in an in-house hacking test. A build trained without the company’s cyber-data cuts scored 90.5%.
The Beijing startup will release full weights for the K3.1 Pro by Nov. 4. The model is already deployed on Kimi.ai and Kimi API with a context window of 1 million tokens.
There’s a high-speed version that’s two to three times faster, the company said.
Predecessor K3 solved only 33.3% of the xdev-bench-hard tasks
Moonshot connected the model’s expanding exploit capabilities to cyber material in its general mid-training corpus and its reinforcement learning tasks.
Moonshot’s early experiments discovered that retaining the data in either stage would significantly heighten downstream cyber capability. For the open release, it took that data out of both stages and kept the general coding tasks.
In the xdev-bench-hard test, the agent is asked to exploit recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, and Exim.
Each task comprises the vulnerable source code, a short hint about the bug and the binary. A task is deemed solved only if the agent can run arbitrary code in a sandbox and retrieve a secret string.
K3.1 Pro still far outscored its predecessor, Kimi K3, which managed 33.3%. Moonshot’s chart has DeepSeek-V4.1-Flash at 85.7% and GLM-5.3 at 57.1%, but they were both running on another harness.
Moonshot’s xdev-bench-hard results for Kimi K3.1 Pro and rival models, from the company’s K3.1 Pro blog.
The company said K3.1 Pro’s cyber skills lag frontier proprietary models publicly for at least three months. None of the scores have been independently corroborated.
K3.1 Pro will not extend the absolute frontier of hacking
“We aim not to release open weights that would extend the absolute frontier of cyber capability,” the company said.
Moonshot regards the slow rollout as a defensive weapon. Companies that run an open model on their own infrastructure are able to audit the code they maintain, which includes legacy systems that are seldom security reviewed, the company said.
Policing open weights is harder. Once the files are disseminated, the developer loses much of its ability to control access, monitor use, or update safeguards.
Last week, China proposed export controls that would prohibit the export of technology to generate malware using AI and curtail tools that aid in identifying vulnerabilities using AI. The draft is still open for public comment.
Cryptopolitan reported this week that Microsoft tied China-linked group Storm-0940 to a ConnectWise breach via ARTEX, an open-source penetration-testing framework that supports any AI model.
Moonshot pushed the model harder outside cyber. The company said the K3.1 Pro scored 65.7% on Terminal-Bench 4.0, ahead of OpenAI’s GPT-6 Astra at 58.2% and narrowly behind Anthropic’s Claude Opus 5.5 at 66.4%.
For Moonshot’s internal stress test on made-up facts, the claim-level hallucination rate dropped from K3’s 23.4% to 8.3%.
According to Cryptopolitan, Moonshot’s founders have a ~$700 million arbitration claim from shareholder Recurrent AI ahead of the company’s planned Hong Kong IPO.
If you're reading this, you’re already ahead. Stay there with our newsletter.

On October 23, during the 19:00 UTC hour, Irys’s IRYS token peaked at 0.32757 USDT on Bitget. By 05:49 UTC on October 24, it was trading at 0.08631 USDT, approximately 74% below the top.
The same hourly candle closed at 0.11138 USDT and the next hour made a low at 0.06106 USDT, ~81% below the peak.
CoinGecko registered an all-time high of $0.296 at 19:24 UTC and priced IRYS at $0.0863 Saturday morning. At the high, those 2 billion circulating tokens were worth ~$592M.
Market cap is ~$174 million, with 20% of the 10 billion total supply in circulation.
The won pair at Upbit followed the same. It went from the 52-week low of 16.3 won on October 18 to a 52-week high of 450 won on October 23.
It was trading at 116 won early Saturday with about 954 billion won traded on a 24-hour basis.
IRYS climbed about 1,208% in a day before the reversal
The token opened on Bitget on October 23 at 0.02058 USDT. It had crept up through the morning, but leapt from ~0.044 to 0.14 between 15:00 and 17:00 UTC.
IRYS was up about 1,208% in 24 hours to $0.2806 at 3:21 p.m. ET, with a seven-day gain of ~2,083%. The price suggested a circulating value of around $561 million.
In the run, IRYS traded much higher than its May listing high of 0.08985 USDT on Bitget. Upbit opened trading for IRYS on won, bitcoin and USDT pairs on May 15.
Irys melds blockchain data storage with smart contract execution. IRYS is staked to validate the network and pays for storage and execution fees.
Even after the slide, IRYS was still up ~212% on Bitget’s rolling 24-hour window early Saturday. During that period, Bitget’s IRYS/USDT pair traded ~57.9 million USDT.
IRYS price over 24 hours on CoinGecko, from the October 23 run through the slide into October 24.
Short sellers lost ~$21.4 million on the way up
Over 24 hours, liquidations totaled ~$24.2 million, with ~$21.4 million from shorts and ~$2.8 million from longs.
Open futures positions on IRYS were about $1.22bn. The figure was also amplified by a higher price.
A forced short exit means buying the token back and this can push the price higher.
No source says what drove the run or the collapse.
Irys’s tokenomics lock team and investor tokens for the first year. Irys puts ~20% of the supply into circulation at launch.
On October 22, a Pump.fun token pushed by trader Clayton Kim’s Kimchi account rocketed to a ~$15 million market cap in minutes before losing over 98% of its value after the post was erased about 30 minutes later, according to Cryptopolitan.
Upbit’s won pair topped the IRYS trading volume. Korean traders have also sought out leverage offshore, where products linked to the Kospi index offer up to 150 times exposure, Cryptopolitan reported on October 2.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Kraken co-CEO Arjun Sethi acknowledged that it was wrong for the exchange to email Monero (XMR) buyers about their employer, the source of their funds and their plans for the coins. He said no rule made them ask those questions.
Kraken has since withdrawn the requests and XMR is still listed. Monero is a privacy coin whose goal is to obscure transaction details on its blockchain.
A young XMR client’s wealth set off the withdrawal emails
Sethi laid out the timeline in a post on X. The email went to clients who bought XMR with their own money and then withdrew it.
Arjun Sethi explains the Monero withdrawal emails in a post on X late on October 23, 2026, US Eastern time.
“no rule required it,” Sethi wrote. A person working at the exchange saw a young client with a lot of money and called that a red flag, he said.
“that is not a red flag. that is our customer and client,” Sethi wrote, adding, “those requests are withdrawn and the clients have been told nothing is required of them.”
He said the question “what will you do with your coins” is unacceptable and is gone. “where your money came from is a fair question. what you do with it after it leaves is not,” he wrote.
Sethi concluded the post with a thank you to critics for “the call out.”
Source-of-funds checks stay as XMR remains listed
Kraken said that it may ask for source-of-funds documents to show where the money for a certain transaction came from because of laws that are against money laundering.
According to Kraken’s information request policy, recently amended on October 1, unanswered inquiries may result in frozen deposits and trading. There is no impact on withdrawals.
“xmr stays listed. buy it here, take it home,” Sethi wrote. XMR is down approximately 5% over 24 hours and was trading around $581 on Kraken early Saturday.
Kraken does not accept XMR deposits and trades for users in the European Economic Area and the UK, and users in Canada and Australia cannot deposit, hold or trade it.
The walk-back comes days after on-chain investigator ZachXBT flagged FreedomXMR, a service on Hyperliquid Core, as a laundering venue, Cryptopolitan reported. He traced some $20 million from exploit wallets to privacy coins via the service.
ZachXBT said more than 87% of inflows to FreedomXMR were linked to illicit activity. Most centralized exchanges limit XMR trading because of US or European rules.
Payward, the parent of Kraken, signed an agreement on Oct. 14 to buy Lithuania-licensed Saldo Bank and procure an EU banking license. The agreement is subject to regulatory approval and is expected to close in 2027.
If you're reading this, you’re already ahead. Stay there with our newsletter.

A group of waddling Microduck robots stole the spotlight during Nvidia CEO Jensen Huang’s GTC Berlin keynote. It reportedly bagged more than 20,000 preorders. However, Hugging Face CEO Clem Delangue was less definite in his original post:
“Going to cross 20,000+ total pre-orders probably tomorrow making Microduck probably the most sold robot of 2026?”
Delangue was predicting that preorders would reach 20,000, not confirming they had already crossed that mark. The figures also represent advance orders, not robots delivered to customers.
A viral keynote, then a surge of preorders
In an October 21 clip, Huang asks for a somersault. The ducks walk, sit and play dead. Pollen Robotics made Microduck and became part of Hugging Face in 2025. Nvidia agreed to acquire Hugging Face in September, though the deal isn’t expected to close until 2027. Microduck deliveries are expected before Christmas.
What the Microduck actually is
The Microduck is more of a programmable desk robot than a household assistant. It is 25 cm tall and weighs 800 grams, and is equipped with 15 motors, a camera, LIDAR, and two inertial sensors. It comes with seven trained moves. But owners can teach it new tricks and share those movements with other Microduck users. Its software is open source under Apache 2.0. The robot costs $399 before taxes and shipping.
In an October 23 technical post, Nvidia showed how robots like Microduck can learn to move through simulation. AI agents first created a virtual obstacle course. Isaac Lab then trained the robot’s movements across 4,096 simulated environments using a Blackwell GPU. Finally, Isaac Sim checked its performance before testing on a physical robot.
Robots can already navigate warehouses and make deliveries, according to Epoch AI. But handling everyday objects at home is another matter. Robots typically work three to ten times slower than humans and often need retraining when faced with unfamiliar tasks. Microduck’s seven trained moves may be entertaining, but they don’t solve these problems.
Who is actually buying robots right now?
Nearly 25,000 humanoid robots were shipped worldwide in the first half of 2026, according to IDC figures reported by Forbes. That’s a 432.1% increase from a year earlier, with revenue topping $740 million. Chinese manufacturers produced more than 95% of them. However, 69% of shipments went to research, exhibitions and data collection rather than everyday commercial work.
Consumer robots tell a different story. The IFR reported that sales reached 34.2 million units in 2025, up 37%. Most were household robots, such as automated vacuum cleaners, rather than humanoids.
Microduck Robot Specs and $399 Price: Humanoid Shipments and Consumer Demand
In a survey, 65% of U.S. respondents wanted an advanced home robot. Yet 69% would not pay over $5,000, and about half worried about safety.
Former Nvidia robotics executive Amulya Vishwanath called the industry a “Lego era” in Cryptopolitan, pointing to unfinished components and safety systems. McKinsey sees supply-chain limits, too.
The real win for Nvidia may be infrastructure
While selling robots might not be considered to be Nvidia’s greatest opportunity, BCG reports that software training and deployment could lead to growth in the robotics sector. On its part, Nvidia intends to become the supplier of chips and simulation technologies employed by those robots, regardless of whether they are from China or elsewhere. The case of Microduck provides insight into this broader approach.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Warhound emerged from stealth on October 22 with $200 million in seed funding and a $1.2 billion post-money valuation, TechCrunch reported. The startup wants to develop genetically enhanced dogs for military and emergency work. Its official announcement names ARK Invest and Franklin Templeton among its backers.
There is no public evidence that a crypto-focused fund invested in Warhound’s $200 million funding round.
Engineered dogs that do not exist yet
Warhound is the brainchild of Colossal Biosciences founder Ben Lamm and Anduril founder Palmer Luckey. David Spirk leads the company as CEO.
Colossal plans to collect cells from top-performing Belgian Malinois and German Shepherds. It would then edit their genes to improve health and performance. Its subsidiary, Viagen, would handle the cloning. Anduril plans to equip the dogs with protective equipment, sensors, and software solutions, which allow their handlers to monitor the situation on the ground effectively. Information received by TechCrunch indicates that Luckey has no ownership stake in Warhound. However, Colossal has shares in the company and licenses its technology to the firm.
Warhound plans to use the dogs to detect explosives, assist in searches and handle dangerous assignments. For now, none has been born. The first births are expected in early 2027, and the company hopes to have the dogs in service within two years.
The venture also aims to address a supply problem. Warhound says more than 80% of U.S. military working dogs come from Europe. After a roughly three-year acquisition and training process, fewer than half are considered fit for service.
Who is actually writing the checks
Among the backers of Warhound are Sequoia Capital, In-Q-Tel, 8VC, ARK Invest, and Franklin Templeton. The main investor indicated by S&P Capital IQ is Sequoia, while TechCrunch mentions Corner Ventures as one of the participants as well. However, the exact amounts that they contributed to Warhound remain undisclosed. The reports also do not reveal which funds of ARK and Franklin participated in the startup’s funding rounds.
A separate Form D for Animal Capital Warhound SPV I reports $9.62 million raised from 23 investors. Filed on October 21, it lists September 23 as the date of its first sale. However, the filing names no investors and does not establish how the money relates to Warhound’s $200 million round.
Warhound $200M Funding: $1.2B Valuation, Investors and Tech Partners
Betting $1.2 billion on an unproven supply chain
The global defense sector is growing. SIPRI estimates that global military expenditure amounted to $2.887 trillion in 2025, which is a 2.9% increase. Europe’s spending rose by 14%. However, U.S. military budget has decreased by 7.5%.
In a June PitchBook report, Andreessen Horowitz and the CIA-backed organization In-Q-Tel have been recognized amongst the most active investors in defense technology in the first quarter of 2026. In-Q-Tel is also funding Warhound. At the same time, Andreessen Horowitz was instrumental in the completion of Anduril’s Series H financing of $5 billion, which raised the valuation of the company to $61 billion, as reported by Cryptopolitan.
PitchBook’s Q2 report describes a defense-tech market increasingly divided between established companies and early-stage bets. Warhound falls into the latter category, despite its $1.2 billion valuation and lack of a deployed product.
Still, Warhound has no deployed product or announced government orders. It must prove its cloning and gene-editing methods, protect animal welfare and secure government approvals. The company says it is working with the American Humane Society on training certification.
Why ARK and Franklin draw crypto attention
Franklin, with $1.78 trillion under management in May, created Franklin Crypto after acquiring 250 Digital in June. ARK tokenized its venture fund on Ethereum in September. The fund had about $1.3 billion in net assets. Neither development establishes how Warhound was financed.
Galaxy Research tracked $5.683 billion across 384 crypto deals in the second quarter, with roughly 78% going to later-stage rounds. That is a separate investment market. Warhound’s global potential rests on whether its experimental defense-biotech model can become a dependable military supply chain.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Argentina has dropped its criminal investigation into President Javier Milei and his sister, Karina Milei, over their alleged links to a crypto scandal. Federal judge Marcelo Martínez de Giorgi dismissed the case involving Milei’s promotion of the LIBRA meme coin, which later crashed.
As reported by Cryptopolitan, last year, Milei sparked a brief price rally by endorsing Libra on X. He later distanced himself from the project and deleted his post before the coin crashed. He insisted his intentions were entirely “in good faith” during the cryptocurrency’s upward trend before the downturn that ruined most investors.
“I was not aware of the details of the project, and once I found out, I decided to not to continue giving it publicity,” he said.
Judge Martínez de Giorgi dropped the case against Javier Milei
Judge Martínez de Giorgi dismissed the case against Javier Milei, finding no proof of deceit or fraud, as well as no indication that the alleged incidents were part of any particular legal category. Nevertheless, the federal judge emphasized that the president’s institutional position could have increased the significance of his social media post.
The allegations of fraud arose soon after Milei’s announcement of $LIBRA on his social media account, where he suggested it would help finance startups and small businesses. While the currency had risen in value, it fell sharply once he removed the post from his social media page. After the currency’s crash, opposition members of Congress began preparing an impeachment motion, and online critics accused him of a “rug pull” on the currency.
The blockchain data added to the scrutiny on the token’s collapse. A report by cryptocurrency analytics firm Nansen found 86% of LIBRA traders lost $251 million, and a smaller number of traders made $180 million in profits. The token hit $4.55 just after launch, and a week later, it lost most of its value.
But Milei argued that the mere fact of sharing the post does not mean that he was advertising the cryptocurrency. In another commentary, he pointed out that he did not know much about the project when he made the post and that he ceased speaking about the currency after gaining a better understanding of it.
Chainalysis shows cryptocurrency scams received $14 billion on-chain
For some time now, there has been a surge in crypto fraud and scams. Chainalysis believes that cryptocurrencies associated with scamming have collected at least $14 billion on-chain in 2025. This represents significant growth from the $9.9 billion first reported in 2024, which was later adjusted to $12 billion, consistent with the company’s $12.4 billion estimate.
In general, the total amount of scam-related funds has grown significantly due to impersonations that increased by 1,400%. High-yield programs and pig butchering also continue to lead in overall volume, but scam tactics are increasingly converging; fraudsters now combine AI tools, sophisticated SMS phishing, and deep money-laundering networks to maximize their reach.
Findings from a July 2025 J.P. Morgan study show cybercriminals are increasingly turning to AI-generated content and deepfakes to trick victims with convincing impersonations in financial and romance scams. Scams with on-chain links to AI vendors collect an average of $3.2 million per operation, roughly 4.5 times the $719,000 average recorded by scams without those connections, per the bank’s report.
Nevertheless, in July, more than $25 million in cryptocurrency tied to transnational fraud rings has been seized by the Cyber Fraud Task Force, according to a joint announcement today from the U.S. Secret Service and the U.S. Attorney’s Office for the District of Columbia. These assets add to the $800 million in assets recovered through the Scam Center Strike Force, an initiative launched in 2025 by U.S. Attorney Jeanine Pirro to protect U.S. and Canadian residents.
“This seizure is the result of months of tireless work by Washington Field Office investigators, who are among the best in the world at tracking down cyber criminals and tracing their illicit transactions,” said Special Agent in Charge Tara McLeese of the U.S. Secret Service Washington Field Office.
She also encouraged people who suspect they have been targeted by these scams or similar crypto-related offenses to reach out for assistance.
The dismissal closes a significant chapter in the legal scrutiny surrounding LIBRA, although it does not erase the financial losses reported by traders.
The case also highlights the risks associated with meme coins, whose prices can change sharply following endorsements from influential figures. For investors, the episode underscores the importance of conducting independent research on cryptocurrency projects rather than relying solely on public endorsements.
The smartest crypto minds already read our newsletter. Want in? Join them.

“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
“garbage and nonfunctional.”
— Spencer McIntyre, VulnCheck, quoted by The Record.
That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
Attackers are trying to turn vulnerable PHP servers into Potassium bots, part of a Mirai-derived network designed for distributed denial-of-service (DDoS) attacks. But so far, they have struggled. The Hacker News reported on October 23 that no server compromises had been confirmed.
There were two major PHP vulnerabilities that were the main targets of the cyber attacks – CVE-2026-109618 and CVE-2026-109619, both of which received 9.2 out of 10 scores in terms of severity. PHP made the patches available on October 21, but by that time hackers had already started launching attacks against these vulnerabilities.
What Sophos saw, then walked back
Arctic Wolf reports that attempted command execution and malware downloads have been attributed to Potassium. Another assessment performed in a sandbox environment revealed a different sample that reached out to thunder.godofthunder[.]st through IP 134.199.154[.]64 at TCP port 50792 and attacked two Ukrainian hosts.
It demonstrated the potential of the malware but not that the attackers have breached the production servers. On October 22, Sophos retracted a prior success announcement, saying to The Record that it had only observed unsuccessful attack attempts.
Millions of probes, zero confirmed break-ins
However, the figures do indicate the extent to which attackers are probing. Imperva recorded 482,342 request attempts in 122,311 sessions aimed at 21,998 sites in 103 countries within a 24-hour period.
At the same time, Censys reported detecting over 41 million internet-facing PHP services running versions that were affected and only about 1 million instances of deployment of patched versions of the software by October 22. The numbers reflecting scanning incidents or the number of individuals exposed are insufficient to prove an actual compromise happened.
PHP2Shell Attacks: 41 Million Exposed PHP Services and Potassium DDoS Threat
24 flood commands and a dormant ENS switch
Arctic Wolf has revealed that 24 flood commands include all types of ICMP, TCP, UDP, and Open VPN. There is also the presence of Ethereum Name Service (ENS) lookup features in both ARM and x86-64 Potassium versions, but this has been turned off in both instances.
Ethereum and ENS have not been compromised. However, activating the ENS lookup features can lead to a more difficult way of blocking command servers with any use of conventional DNS and IP controls.
Garbage PoCs versus a working private exploit
Many public proof-of-concept (PoC) exploits fail against production defenses, particularly address space layout randomization (ASLR). VulnCheck’s Spencer McIntyre described many circulating samples as:
“garbage and nonfunctional.”
— Spencer McIntyre, VulnCheck, quoted by The Record.
That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
The smartest crypto minds already read our newsletter. Want in? Join them.

Group-IB and NyxLab discovered more than 70,000 network credentials linked to a campaign by cyber threat group k0t. However, the hackers did not only steal account credentials. They also created backdoors to corporate networks, which gives ransomware groups new opportunities to infiltrate company systems.
Credentials were only the entry point
The researchers discovered some of the methods used by the attackers, such as the abuse of passwords on FortiGate devices, the exploitation of CVE-2025-64446 vulnerability affecting FortiWeb, and the use of CVE-2026-0257 against vulnerable Palo Alto GlobalProtect gateways. These devices act as shields for corporate networks and grant access to them remotely, which makes them desirable targets for those wanting to break into company systems.
The stolen data included LDAP directory dumps. After getting into the system, the attackers used OpenConnect VPN connections, remote management applications, and AdaptixC2 to maintain access. Some victims were subjected to data theft as well. Many FortiGate compromise cases occurred between February and June 2026.
Afterwards, a number of victims appeared on the leak pages belonging to the ransomware groups known as Qilin and The Gentlemen. This suggests that k0t might be profiting from access to compromised networks, but the researchers are yet to verify this connection.
In addition, the campaign has been successful across Asia-Pacific where 37.6% of all the unique domains observed originate from. Despite that, the researchers stressed that this might just indicate the number of devices that were active in Asia, and not necessarily that there was a special focus on Asian targets.
FortiBleed is a separate, still-active problem
On October 6, 2026, an advisory issued by the FBI and the Secret Service cautioned that FortiBleed still poses a threat to the FortiGate firewalls and the SSL VPN gateways. The attackers used the credentials they managed to secure earlier, leveraged GPU-based systems to decode password hashes, and created new admin accounts. They sometimes managed to lock their victims out of their own devices.
FortiBleed has spread worldwide. SOCRadar verified more than 86,644 compromised devices across 194 countries. Fortinet said attackers reused stolen login credentials and tried to guess passwords. The campaign did not involve a newly disclosed Fortinet vulnerability.
Although Group-IB found little overlap between FortiBleed and k0t’s stolen data, it has not ruled out a connection between the operations. So far, there is no evidence to suggest that the same attackers were behind both incidents. The figures also represent different things: k0t’s 70,000 credentials as opposed to FortiBleed’s 86,644 devices. Combining these figures would distort the full scale of the events.
From initial access to ransomware in 22 seconds
Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation accounted for 31% of breaches, overtaking stolen credentials as the leading entry method. Yet only 26% of critical, known-exploited vulnerabilities were fully remediated, with the median time to fix them reaching 43 days.
That delay is particularly concerning because attackers can exploit vulnerabilities before patches become available. Mandiant’s M-Trends 2026 estimated a minus-seven-day mean time to exploit, indicating that attacks often began before fixes were released. Network devices such as VPN gateways and routers are particularly difficult to monitor because they often lack standard endpoint security tools.
Once attackers gain access, the threat can escalate quickly. Mandiant found that the median time between an initial breach and the hand-off to another criminal group fell from more than eight hours in 2022 to just 22 seconds in 2025.
The threat is already evident. In an October 19 update, Unit 42 reported attempted exploitation of CVE-2026-0257 by Qilin and Inc ransomware operators. It also noted separate reports involving Settra. However, its earlier investigation found no evidence that attackers had moved deeper into affected networks.
k0t vs FortiBleed: 70,000 Credentials and 22-Second Attack Hand-Offs
What it means for finance and crypto infrastructure
IBM found that 62% of reported AI-driven attacks targeted critical infrastructure. Financial-services breaches averaged $6.3 million. The IMF also warned in October that cyber threats could become systemic as financial networks grow more interconnected. Crypto firms face similar risks from compromised access. Cryptopolitan reported roughly $2 million in losses involving Fetch.ai and NuNet in September 2026. Those incidents involved compromised signing credentials, not VPN access, and have no established connection to k0t.
The smartest crypto minds already read our newsletter. Want in? Join them.

On Thursday, trader Kimchi’s X account sent a brand-new Pump.fun token to a ~$15 million market cap in minutes.
About 30 minutes later the post disappeared and the coin tumbled by over 98%.
Market cap fell to ~$284,000 after $8.66 million in volume
The account shared a photo of a poster on a sidewalk in Manhattan that read “project kimchi, same internet, different outcome.” Poster had a Pump.fun logo, App Store badges and QR code pointing to a fresh token called Project Kimchi.
Market cap hit $10 million in seconds and peaked at about $15 million, though Lookonchain pegged the high at around $14 million.
Pump.fun co-founder Alon Cohen reposted the promo from his personal account, before erasing it. Traders who rescanned the QR code later said it no longer led to the token.
At one snapshot market cap was ~$284k, with $8.66M in trading volume. Another got it at ~$600,000 in minutes and ~$183,000 the next day.
Market cap prices the full supply at last trade.
Lookonchain flagged wallets that bought early and sold into the rally for a combined $385,000+ in profit. It listed three addresses on Solana.
Clayton Kim drops Pump.fun from his X bio as hack claim draws doubt
Early posts blamed an account hack. Skeptical on-chain sleuths doubted this within minutes, citing Cohen’s speedy repost and just as fast reversal.
Cohen did not post any hack warning after pulling the repost, trader Fabiano said on X. If they had a partnership deal, it made little sense for Kimchi to delete Pump.fun posts, he added.
Kimchi, real name Clayton Kim, has since scrubbed Pump.fun from his X bio and wiped older posts about joining the platform. By Friday, neither Kim nor Pump.fun had responded.
On October 20, two days prior to launch, Kimchi became a creative partner with Pump.fun. Cohen called him “the first ever example of a trader becoming a celebrity.”
X user tontheneko told Cohen to return buyers’ money. “You literally retweeted a rug pull and made hundreds of people lose money,” the user wrote.
There has been no official finding of fault or refund. Separately, Bitquery also detected three related wallets that made ~$104,000 on an earlier KIMCHI launch around October 20, but couldn’t connect them to the deployer.
Kimchi’s notoriety is based on a claim to ~$40 million in profit from the official TRUMP token, which launched in January 2025. Bubblemaps tracked his linked wallets on the day of the crash and found ~$6 million in verifiable profits.
Bubblemaps’ thread on Kimchi’s TRUMP profits, posted on X on October 22, 2026.
Bubblemaps said a hidden address was possible, but unlikely, as Kimchi would have probably revealed it by now.
His first KIMCHI meme coin attained ~$40 million within an hour of the Pump.fun signing. An anonymous deployer purchased ~79% of supply for ~$9,300 and routed creator fees to a wallet labeled Kimchi.
Former Pump.fun developer Jarett Dunn got six years in prison from a London judge over a $2 million Solana fraud, Cryptopolitan reported in December 2025.
Only 6.25% of Solana meme traders made a profit over 90 days, with the median trader down $120, Cryptopolitan reported in August.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

China’s stock market is crashing, and investors are starting to wonder how much worse things could get. Chinese stocks have been falling for weeks as traders lose patience with the country’s struggling economy, expensive AI companies, and Beijing’s attempts to keep everything moving.
The CSI 300 index, which tracks 300 major companies listed in Shanghai and Shenzhen, entered a bear market Thursday after dropping 20% from its June peak. By Friday, the benchmark had fallen another 3%, making an already miserable situation even worse.
The index has seen 10 consecutive weeks of decline, and according to LSEG figures released during the week, the figure is 2.6%. The problem is not only confined to the US, as it has also spread to Asia, where the index that measures large Chinese companies is down as much as 2.9%.
There is yet another issue to consider; retail investors trade mostly in China. HSBC believes their share in trading is close to 90%, while in the New York stock exchange, it is 20%-25%.
China’s AI excitement is fading while consumers keep their wallets closed
In the current year, up until recently, the companies from China in the tech industry had been receiving plenty of coverage. The reason was quite clear – due to the rapidly developing industry of artificial intelligence in the country, the stock price was about to explode.
But as it often happens, popularity does not equal profits.
Now the investors are assessing the actual worth and profitability of the firms considering how they capitalize on the development of artificial intelligence.
Unlike other companies, which were valued based on potential capabilities instead of the numbers, such inflated expectations may lead to the disappointment of the investors resulting in mass sale of shares.
The situation does not apply only to China but the shares of all artificial intelligence companies are being put under pressure around the world including Asian markets.
The challenge that faces Chinese technology companies is that they may find themselves in difficulty as a result of weak stock prices, which could reduce their ability to raise capital to support business growth.
As far as China’s domestic consumption is concerned, it continues to be an issue. The economy actually performed better than expected during the third quarter, with GDP growth reaching 4.5%.
That means that Beijing has become close to achieving its yearly growth goal of 4.5% to 5%, since the last quarter was below this range.
However, investors need proof that households have started consuming more, firms are seeing better profits, and confidence has been restored.
Beijing’s spending cuts are raising more questions about its rescue plans
Another major concern is that China’s government has been cutting spending when investors were hoping for stronger support.
September was the seventh consecutive month of reduced public expenditure. Government figures showed broad spending falling 3.7% from a year earlier, while revenue declined 3.5%.
The monthly fiscal deficit consequently narrowed by 3.8%.
Across the first nine months of 2026, government expenditure exceeded revenue by 7.57 trillion yuan, or approximately $1.1 trillion.
Those spending restrictions have done little to strengthen domestic demand, leaving booming exports to carry much of the economy’s growth.
Investment conditions remain difficult, too. Fixed-asset investment continued contracting, while infrastructure spending recorded a slightly deeper decline.
Beijing hasn’t completely abandoned stimulus, though.
Officials recently introduced mortgage subsidies for eligible homebuyers and authorized local governments to issue an additional 550 billion yuan in bonds to support economic activity.
Those measures followed earlier efforts to accelerate previously approved programs, including 800 billion yuan in financing through state-owned policy banks intended to encourage investment.
Additional spending could arrive as major national projects get underway, including the Six Networks initiative, which forms part of China’s broader technology ambitions.
Authorities have also used government-backed stock purchases to limit market losses.
Still, there’s a difference between stopping prices from falling temporarily and giving investors a reason to buy again.
Earlier expectations of a much larger stimulus package helped lift shares, but those hopes have weakened as Beijing favors smaller interventions.
For now, traders are watching whether these policies actually improve company earnings, revive household demand, and bring private investment back into the economy.
If you're reading this, you’re already ahead. Stay there with our newsletter.

OpenAI sent teams of its own frontier-model agents to its training infrastructure, and the models found unknown software bugs that let them break free of sandboxes and access the live internet.
Patches reach Kata Containers, gVisor and the Linux kernel
The campaign featured some of the company’s best models, including the upcoming GPT-6 Astra Cyber model and an internal frontier model. OpenAI furnished them with source code for infrastructure, configuration information and documentation on likely weak spots.
They then spent hundreds of billions of tokens on the tests.
Red-teaming findings plotted against tokens spent, from OpenAI’s post on October 23, 2026.
The agents had three goals: to reach the live internet, to cross an internal security boundary, and to exchange messages with agents they were supposed to be walled off from.
Fixes went upstream to Kata Containers (including CVE-2026-24834) and to gVisor and Moby/Docker.
Linux kernel patches are out for CVE-2026-74753, CVE-2026-80521, and CVE-2026-80841. OpenAI said it has also reported many other vulnerabilities that have not been made public.
Agents that were given a host machine exposed holes in almost all narrow services that still allowed out, such as metrics, logging and authentication management. In one test, an agent used an existing connection approved by a firewall to hit a blocked authentication endpoint in the metrics service and then had it fetch a URL the model gave it.
Agents in distinct VMs exchanged secrets even in the absence of a network link and common files. One evicted chosen data from the processor’s cache, the other timed how long it took to reload it, the same cache-timing trick behind the Spectre and Meltdown attacks.
OpenAI said it didn’t find a way to the internet that agents could trivially exploit while hiding from its monitors. As testing went on, discoveries dwindled, the company said, but it expects that future models will find flaws it doesn’t know about yet.
Frontier runs restarted October 1 with no live internet
Now, says OpenAI, it blocks live internet access during frontier training, until its safeguards are good enough to warrant more. Models practice browsing in an “offline world” of indexed and cached web pages, wrote OpenAI, so that capable, misaligned agents have no opportunities to influence systems outside the company’s control via live access.
The pause was forced by the incident of September 20. An internal research model stuck on a search task detected that its sandbox’s own DNS resolver was responding to real queries.
It used DNS delegation to pass questions on to an outside chatbot that replied “The capital of France is Paris.” Monitoring flagged the activity for review within 15 minutes and a person began reviewing it three minutes later.
The run didn’t stop automatically and was killed about 2.5 hours later. OpenAI froze training and evaluation of its most capable models, and then closed the gap at two independent layers.
The RL training and internal use of its frontier models resumed Oct. 1, 11 days after the pause began.
The lockdown goes back to July when OpenAI agents hacked Hugging Face’s systems, getting around evaluation controls. OpenAI’s biggest planned frontier RL run was still on ice in August.
Since then, California Attorney General Rob Bonta has issued the company an investigative subpoena over cybersecurity incidents involving its models, Cryptopolitan reported.
If you're reading this, you’re already ahead. Stay there with our newsletter.