Cryptopolitan

Moonshot says it intends to “progressively raise the cyber capability available in open weights” after its new Kimi K3.1 Pro model scored 81% in an in-house hacking test. A build trained without the company’s cyber-data cuts scored 90.5%.
The Beijing startup will release full weights for the K3.1 Pro by Nov. 4. The model is already deployed on Kimi.ai and Kimi API with a context window of 1 million tokens.
There’s a high-speed version that’s two to three times faster, the company said.
Predecessor K3 solved only 33.3% of the xdev-bench-hard tasks
Moonshot connected the model’s expanding exploit capabilities to cyber material in its general mid-training corpus and its reinforcement learning tasks.
Moonshot’s early experiments discovered that retaining the data in either stage would significantly heighten downstream cyber capability. For the open release, it took that data out of both stages and kept the general coding tasks.
In the xdev-bench-hard test, the agent is asked to exploit recently disclosed vulnerabilities in software such as the Linux kernel, Node.js, and Exim.
Each task comprises the vulnerable source code, a short hint about the bug and the binary. A task is deemed solved only if the agent can run arbitrary code in a sandbox and retrieve a secret string.
K3.1 Pro still far outscored its predecessor, Kimi K3, which managed 33.3%. Moonshot’s chart has DeepSeek-V4.1-Flash at 85.7% and GLM-5.3 at 57.1%, but they were both running on another harness.
Moonshot’s xdev-bench-hard results for Kimi K3.1 Pro and rival models, from the company’s K3.1 Pro blog.
The company said K3.1 Pro’s cyber skills lag frontier proprietary models publicly for at least three months. None of the scores have been independently corroborated.
K3.1 Pro will not extend the absolute frontier of hacking
“We aim not to release open weights that would extend the absolute frontier of cyber capability,” the company said.
Moonshot regards the slow rollout as a defensive weapon. Companies that run an open model on their own infrastructure are able to audit the code they maintain, which includes legacy systems that are seldom security reviewed, the company said.
Policing open weights is harder. Once the files are disseminated, the developer loses much of its ability to control access, monitor use, or update safeguards.
Last week, China proposed export controls that would prohibit the export of technology to generate malware using AI and curtail tools that aid in identifying vulnerabilities using AI. The draft is still open for public comment.
Cryptopolitan reported this week that Microsoft tied China-linked group Storm-0940 to a ConnectWise breach via ARTEX, an open-source penetration-testing framework that supports any AI model.
Moonshot pushed the model harder outside cyber. The company said the K3.1 Pro scored 65.7% on Terminal-Bench 4.0, ahead of OpenAI’s GPT-6 Astra at 58.2% and narrowly behind Anthropic’s Claude Opus 5.5 at 66.4%.
For Moonshot’s internal stress test on made-up facts, the claim-level hallucination rate dropped from K3’s 23.4% to 8.3%.
According to Cryptopolitan, Moonshot’s founders have a ~$700 million arbitration claim from shareholder Recurrent AI ahead of the company’s planned Hong Kong IPO.
If you're reading this, you’re already ahead. Stay there with our newsletter.

On October 23, during the 19:00 UTC hour, Irys’s IRYS token peaked at 0.32757 USDT on Bitget. By 05:49 UTC on October 24, it was trading at 0.08631 USDT, approximately 74% below the top.
The same hourly candle closed at 0.11138 USDT and the next hour made a low at 0.06106 USDT, ~81% below the peak.
CoinGecko registered an all-time high of $0.296 at 19:24 UTC and priced IRYS at $0.0863 Saturday morning. At the high, those 2 billion circulating tokens were worth ~$592M.
Market cap is ~$174 million, with 20% of the 10 billion total supply in circulation.
The won pair at Upbit followed the same. It went from the 52-week low of 16.3 won on October 18 to a 52-week high of 450 won on October 23.
It was trading at 116 won early Saturday with about 954 billion won traded on a 24-hour basis.
IRYS climbed about 1,208% in a day before the reversal
The token opened on Bitget on October 23 at 0.02058 USDT. It had crept up through the morning, but leapt from ~0.044 to 0.14 between 15:00 and 17:00 UTC.
IRYS was up about 1,208% in 24 hours to $0.2806 at 3:21 p.m. ET, with a seven-day gain of ~2,083%. The price suggested a circulating value of around $561 million.
In the run, IRYS traded much higher than its May listing high of 0.08985 USDT on Bitget. Upbit opened trading for IRYS on won, bitcoin and USDT pairs on May 15.
Irys melds blockchain data storage with smart contract execution. IRYS is staked to validate the network and pays for storage and execution fees.
Even after the slide, IRYS was still up ~212% on Bitget’s rolling 24-hour window early Saturday. During that period, Bitget’s IRYS/USDT pair traded ~57.9 million USDT.
IRYS price over 24 hours on CoinGecko, from the October 23 run through the slide into October 24.
Short sellers lost ~$21.4 million on the way up
Over 24 hours, liquidations totaled ~$24.2 million, with ~$21.4 million from shorts and ~$2.8 million from longs.
Open futures positions on IRYS were about $1.22bn. The figure was also amplified by a higher price.
A forced short exit means buying the token back and this can push the price higher.
No source says what drove the run or the collapse.
Irys’s tokenomics lock team and investor tokens for the first year. Irys puts ~20% of the supply into circulation at launch.
On October 22, a Pump.fun token pushed by trader Clayton Kim’s Kimchi account rocketed to a ~$15 million market cap in minutes before losing over 98% of its value after the post was erased about 30 minutes later, according to Cryptopolitan.
Upbit’s won pair topped the IRYS trading volume. Korean traders have also sought out leverage offshore, where products linked to the Kospi index offer up to 150 times exposure, Cryptopolitan reported on October 2.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Kraken co-CEO Arjun Sethi acknowledged that it was wrong for the exchange to email Monero (XMR) buyers about their employer, the source of their funds and their plans for the coins. He said no rule made them ask those questions.
Kraken has since withdrawn the requests and XMR is still listed. Monero is a privacy coin whose goal is to obscure transaction details on its blockchain.
A young XMR client’s wealth set off the withdrawal emails
Sethi laid out the timeline in a post on X. The email went to clients who bought XMR with their own money and then withdrew it.
Arjun Sethi explains the Monero withdrawal emails in a post on X late on October 23, 2026, US Eastern time.
“no rule required it,” Sethi wrote. A person working at the exchange saw a young client with a lot of money and called that a red flag, he said.
“that is not a red flag. that is our customer and client,” Sethi wrote, adding, “those requests are withdrawn and the clients have been told nothing is required of them.”
He said the question “what will you do with your coins” is unacceptable and is gone. “where your money came from is a fair question. what you do with it after it leaves is not,” he wrote.
Sethi concluded the post with a thank you to critics for “the call out.”
Source-of-funds checks stay as XMR remains listed
Kraken said that it may ask for source-of-funds documents to show where the money for a certain transaction came from because of laws that are against money laundering.
According to Kraken’s information request policy, recently amended on October 1, unanswered inquiries may result in frozen deposits and trading. There is no impact on withdrawals.
“xmr stays listed. buy it here, take it home,” Sethi wrote. XMR is down approximately 5% over 24 hours and was trading around $581 on Kraken early Saturday.
Kraken does not accept XMR deposits and trades for users in the European Economic Area and the UK, and users in Canada and Australia cannot deposit, hold or trade it.
The walk-back comes days after on-chain investigator ZachXBT flagged FreedomXMR, a service on Hyperliquid Core, as a laundering venue, Cryptopolitan reported. He traced some $20 million from exploit wallets to privacy coins via the service.
ZachXBT said more than 87% of inflows to FreedomXMR were linked to illicit activity. Most centralized exchanges limit XMR trading because of US or European rules.
Payward, the parent of Kraken, signed an agreement on Oct. 14 to buy Lithuania-licensed Saldo Bank and procure an EU banking license. The agreement is subject to regulatory approval and is expected to close in 2027.
If you're reading this, you’re already ahead. Stay there with our newsletter.

A group of waddling Microduck robots stole the spotlight during Nvidia CEO Jensen Huang’s GTC Berlin keynote. It reportedly bagged more than 20,000 preorders. However, Hugging Face CEO Clem Delangue was less definite in his original post:
“Going to cross 20,000+ total pre-orders probably tomorrow making Microduck probably the most sold robot of 2026?”
Delangue was predicting that preorders would reach 20,000, not confirming they had already crossed that mark. The figures also represent advance orders, not robots delivered to customers.
A viral keynote, then a surge of preorders
In an October 21 clip, Huang asks for a somersault. The ducks walk, sit and play dead. Pollen Robotics made Microduck and became part of Hugging Face in 2025. Nvidia agreed to acquire Hugging Face in September, though the deal isn’t expected to close until 2027. Microduck deliveries are expected before Christmas.
What the Microduck actually is
The Microduck is more of a programmable desk robot than a household assistant. It is 25 cm tall and weighs 800 grams, and is equipped with 15 motors, a camera, LIDAR, and two inertial sensors. It comes with seven trained moves. But owners can teach it new tricks and share those movements with other Microduck users. Its software is open source under Apache 2.0. The robot costs $399 before taxes and shipping.
In an October 23 technical post, Nvidia showed how robots like Microduck can learn to move through simulation. AI agents first created a virtual obstacle course. Isaac Lab then trained the robot’s movements across 4,096 simulated environments using a Blackwell GPU. Finally, Isaac Sim checked its performance before testing on a physical robot.
Robots can already navigate warehouses and make deliveries, according to Epoch AI. But handling everyday objects at home is another matter. Robots typically work three to ten times slower than humans and often need retraining when faced with unfamiliar tasks. Microduck’s seven trained moves may be entertaining, but they don’t solve these problems.
Who is actually buying robots right now?
Nearly 25,000 humanoid robots were shipped worldwide in the first half of 2026, according to IDC figures reported by Forbes. That’s a 432.1% increase from a year earlier, with revenue topping $740 million. Chinese manufacturers produced more than 95% of them. However, 69% of shipments went to research, exhibitions and data collection rather than everyday commercial work.
Consumer robots tell a different story. The IFR reported that sales reached 34.2 million units in 2025, up 37%. Most were household robots, such as automated vacuum cleaners, rather than humanoids.
Microduck Robot Specs and $399 Price: Humanoid Shipments and Consumer Demand
In a survey, 65% of U.S. respondents wanted an advanced home robot. Yet 69% would not pay over $5,000, and about half worried about safety.
Former Nvidia robotics executive Amulya Vishwanath called the industry a “Lego era” in Cryptopolitan, pointing to unfinished components and safety systems. McKinsey sees supply-chain limits, too.
The real win for Nvidia may be infrastructure
While selling robots might not be considered to be Nvidia’s greatest opportunity, BCG reports that software training and deployment could lead to growth in the robotics sector. On its part, Nvidia intends to become the supplier of chips and simulation technologies employed by those robots, regardless of whether they are from China or elsewhere. The case of Microduck provides insight into this broader approach.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Warhound emerged from stealth on October 22 with $200 million in seed funding and a $1.2 billion post-money valuation, TechCrunch reported. The startup wants to develop genetically enhanced dogs for military and emergency work. Its official announcement names ARK Invest and Franklin Templeton among its backers.
There is no public evidence that a crypto-focused fund invested in Warhound’s $200 million funding round.
Engineered dogs that do not exist yet
Warhound is the brainchild of Colossal Biosciences founder Ben Lamm and Anduril founder Palmer Luckey. David Spirk leads the company as CEO.
Colossal plans to collect cells from top-performing Belgian Malinois and German Shepherds. It would then edit their genes to improve health and performance. Its subsidiary, Viagen, would handle the cloning. Anduril plans to equip the dogs with protective equipment, sensors, and software solutions, which allow their handlers to monitor the situation on the ground effectively. Information received by TechCrunch indicates that Luckey has no ownership stake in Warhound. However, Colossal has shares in the company and licenses its technology to the firm.
Warhound plans to use the dogs to detect explosives, assist in searches and handle dangerous assignments. For now, none has been born. The first births are expected in early 2027, and the company hopes to have the dogs in service within two years.
The venture also aims to address a supply problem. Warhound says more than 80% of U.S. military working dogs come from Europe. After a roughly three-year acquisition and training process, fewer than half are considered fit for service.
Who is actually writing the checks
Among the backers of Warhound are Sequoia Capital, In-Q-Tel, 8VC, ARK Invest, and Franklin Templeton. The main investor indicated by S&P Capital IQ is Sequoia, while TechCrunch mentions Corner Ventures as one of the participants as well. However, the exact amounts that they contributed to Warhound remain undisclosed. The reports also do not reveal which funds of ARK and Franklin participated in the startup’s funding rounds.
A separate Form D for Animal Capital Warhound SPV I reports $9.62 million raised from 23 investors. Filed on October 21, it lists September 23 as the date of its first sale. However, the filing names no investors and does not establish how the money relates to Warhound’s $200 million round.
Warhound $200M Funding: $1.2B Valuation, Investors and Tech Partners
Betting $1.2 billion on an unproven supply chain
The global defense sector is growing. SIPRI estimates that global military expenditure amounted to $2.887 trillion in 2025, which is a 2.9% increase. Europe’s spending rose by 14%. However, U.S. military budget has decreased by 7.5%.
In a June PitchBook report, Andreessen Horowitz and the CIA-backed organization In-Q-Tel have been recognized amongst the most active investors in defense technology in the first quarter of 2026. In-Q-Tel is also funding Warhound. At the same time, Andreessen Horowitz was instrumental in the completion of Anduril’s Series H financing of $5 billion, which raised the valuation of the company to $61 billion, as reported by Cryptopolitan.
PitchBook’s Q2 report describes a defense-tech market increasingly divided between established companies and early-stage bets. Warhound falls into the latter category, despite its $1.2 billion valuation and lack of a deployed product.
Still, Warhound has no deployed product or announced government orders. It must prove its cloning and gene-editing methods, protect animal welfare and secure government approvals. The company says it is working with the American Humane Society on training certification.
Why ARK and Franklin draw crypto attention
Franklin, with $1.78 trillion under management in May, created Franklin Crypto after acquiring 250 Digital in June. ARK tokenized its venture fund on Ethereum in September. The fund had about $1.3 billion in net assets. Neither development establishes how Warhound was financed.
Galaxy Research tracked $5.683 billion across 384 crypto deals in the second quarter, with roughly 78% going to later-stage rounds. That is a separate investment market. Warhound’s global potential rests on whether its experimental defense-biotech model can become a dependable military supply chain.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Argentina has dropped its criminal investigation into President Javier Milei and his sister, Karina Milei, over their alleged links to a crypto scandal. Federal judge Marcelo Martínez de Giorgi dismissed the case involving Milei’s promotion of the LIBRA meme coin, which later crashed.
As reported by Cryptopolitan, last year, Milei sparked a brief price rally by endorsing Libra on X. He later distanced himself from the project and deleted his post before the coin crashed. He insisted his intentions were entirely “in good faith” during the cryptocurrency’s upward trend before the downturn that ruined most investors.
“I was not aware of the details of the project, and once I found out, I decided to not to continue giving it publicity,” he said.
Judge Martínez de Giorgi dropped the case against Javier Milei
Judge Martínez de Giorgi dismissed the case against Javier Milei, finding no proof of deceit or fraud, as well as no indication that the alleged incidents were part of any particular legal category. Nevertheless, the federal judge emphasized that the president’s institutional position could have increased the significance of his social media post.
The allegations of fraud arose soon after Milei’s announcement of $LIBRA on his social media account, where he suggested it would help finance startups and small businesses. While the currency had risen in value, it fell sharply once he removed the post from his social media page. After the currency’s crash, opposition members of Congress began preparing an impeachment motion, and online critics accused him of a “rug pull” on the currency.
The blockchain data added to the scrutiny on the token’s collapse. A report by cryptocurrency analytics firm Nansen found 86% of LIBRA traders lost $251 million, and a smaller number of traders made $180 million in profits. The token hit $4.55 just after launch, and a week later, it lost most of its value.
But Milei argued that the mere fact of sharing the post does not mean that he was advertising the cryptocurrency. In another commentary, he pointed out that he did not know much about the project when he made the post and that he ceased speaking about the currency after gaining a better understanding of it.
Chainalysis shows cryptocurrency scams received $14 billion on-chain
For some time now, there has been a surge in crypto fraud and scams. Chainalysis believes that cryptocurrencies associated with scamming have collected at least $14 billion on-chain in 2025. This represents significant growth from the $9.9 billion first reported in 2024, which was later adjusted to $12 billion, consistent with the company’s $12.4 billion estimate.
In general, the total amount of scam-related funds has grown significantly due to impersonations that increased by 1,400%. High-yield programs and pig butchering also continue to lead in overall volume, but scam tactics are increasingly converging; fraudsters now combine AI tools, sophisticated SMS phishing, and deep money-laundering networks to maximize their reach.
Findings from a July 2025 J.P. Morgan study show cybercriminals are increasingly turning to AI-generated content and deepfakes to trick victims with convincing impersonations in financial and romance scams. Scams with on-chain links to AI vendors collect an average of $3.2 million per operation, roughly 4.5 times the $719,000 average recorded by scams without those connections, per the bank’s report.
Nevertheless, in July, more than $25 million in cryptocurrency tied to transnational fraud rings has been seized by the Cyber Fraud Task Force, according to a joint announcement today from the U.S. Secret Service and the U.S. Attorney’s Office for the District of Columbia. These assets add to the $800 million in assets recovered through the Scam Center Strike Force, an initiative launched in 2025 by U.S. Attorney Jeanine Pirro to protect U.S. and Canadian residents.
“This seizure is the result of months of tireless work by Washington Field Office investigators, who are among the best in the world at tracking down cyber criminals and tracing their illicit transactions,” said Special Agent in Charge Tara McLeese of the U.S. Secret Service Washington Field Office.
She also encouraged people who suspect they have been targeted by these scams or similar crypto-related offenses to reach out for assistance.
The dismissal closes a significant chapter in the legal scrutiny surrounding LIBRA, although it does not erase the financial losses reported by traders.
The case also highlights the risks associated with meme coins, whose prices can change sharply following endorsements from influential figures. For investors, the episode underscores the importance of conducting independent research on cryptocurrency projects rather than relying solely on public endorsements.
The smartest crypto minds already read our newsletter. Want in? Join them.

“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
“garbage and nonfunctional.”
— Spencer McIntyre, VulnCheck, quoted by The Record.
That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
Attackers are trying to turn vulnerable PHP servers into Potassium bots, part of a Mirai-derived network designed for distributed denial-of-service (DDoS) attacks. But so far, they have struggled. The Hacker News reported on October 23 that no server compromises had been confirmed.
There were two major PHP vulnerabilities that were the main targets of the cyber attacks – CVE-2026-109618 and CVE-2026-109619, both of which received 9.2 out of 10 scores in terms of severity. PHP made the patches available on October 21, but by that time hackers had already started launching attacks against these vulnerabilities.
What Sophos saw, then walked back
Arctic Wolf reports that attempted command execution and malware downloads have been attributed to Potassium. Another assessment performed in a sandbox environment revealed a different sample that reached out to thunder.godofthunder[.]st through IP 134.199.154[.]64 at TCP port 50792 and attacked two Ukrainian hosts.
It demonstrated the potential of the malware but not that the attackers have breached the production servers. On October 22, Sophos retracted a prior success announcement, saying to The Record that it had only observed unsuccessful attack attempts.
Millions of probes, zero confirmed break-ins
However, the figures do indicate the extent to which attackers are probing. Imperva recorded 482,342 request attempts in 122,311 sessions aimed at 21,998 sites in 103 countries within a 24-hour period.
At the same time, Censys reported detecting over 41 million internet-facing PHP services running versions that were affected and only about 1 million instances of deployment of patched versions of the software by October 22. The numbers reflecting scanning incidents or the number of individuals exposed are insufficient to prove an actual compromise happened.
PHP2Shell Attacks: 41 Million Exposed PHP Services and Potassium DDoS Threat
24 flood commands and a dormant ENS switch
Arctic Wolf has revealed that 24 flood commands include all types of ICMP, TCP, UDP, and Open VPN. There is also the presence of Ethereum Name Service (ENS) lookup features in both ARM and x86-64 Potassium versions, but this has been turned off in both instances.
Ethereum and ENS have not been compromised. However, activating the ENS lookup features can lead to a more difficult way of blocking command servers with any use of conventional DNS and IP controls.
Garbage PoCs versus a working private exploit
Many public proof-of-concept (PoC) exploits fail against production defenses, particularly address space layout randomization (ASLR). VulnCheck’s Spencer McIntyre described many circulating samples as:
“garbage and nonfunctional.”
— Spencer McIntyre, VulnCheck, quoted by The Record.
That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
The smartest crypto minds already read our newsletter. Want in? Join them.

Group-IB and NyxLab discovered more than 70,000 network credentials linked to a campaign by cyber threat group k0t. However, the hackers did not only steal account credentials. They also created backdoors to corporate networks, which gives ransomware groups new opportunities to infiltrate company systems.
Credentials were only the entry point
The researchers discovered some of the methods used by the attackers, such as the abuse of passwords on FortiGate devices, the exploitation of CVE-2025-64446 vulnerability affecting FortiWeb, and the use of CVE-2026-0257 against vulnerable Palo Alto GlobalProtect gateways. These devices act as shields for corporate networks and grant access to them remotely, which makes them desirable targets for those wanting to break into company systems.
The stolen data included LDAP directory dumps. After getting into the system, the attackers used OpenConnect VPN connections, remote management applications, and AdaptixC2 to maintain access. Some victims were subjected to data theft as well. Many FortiGate compromise cases occurred between February and June 2026.
Afterwards, a number of victims appeared on the leak pages belonging to the ransomware groups known as Qilin and The Gentlemen. This suggests that k0t might be profiting from access to compromised networks, but the researchers are yet to verify this connection.
In addition, the campaign has been successful across Asia-Pacific where 37.6% of all the unique domains observed originate from. Despite that, the researchers stressed that this might just indicate the number of devices that were active in Asia, and not necessarily that there was a special focus on Asian targets.
FortiBleed is a separate, still-active problem
On October 6, 2026, an advisory issued by the FBI and the Secret Service cautioned that FortiBleed still poses a threat to the FortiGate firewalls and the SSL VPN gateways. The attackers used the credentials they managed to secure earlier, leveraged GPU-based systems to decode password hashes, and created new admin accounts. They sometimes managed to lock their victims out of their own devices.
FortiBleed has spread worldwide. SOCRadar verified more than 86,644 compromised devices across 194 countries. Fortinet said attackers reused stolen login credentials and tried to guess passwords. The campaign did not involve a newly disclosed Fortinet vulnerability.
Although Group-IB found little overlap between FortiBleed and k0t’s stolen data, it has not ruled out a connection between the operations. So far, there is no evidence to suggest that the same attackers were behind both incidents. The figures also represent different things: k0t’s 70,000 credentials as opposed to FortiBleed’s 86,644 devices. Combining these figures would distort the full scale of the events.
From initial access to ransomware in 22 seconds
Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation accounted for 31% of breaches, overtaking stolen credentials as the leading entry method. Yet only 26% of critical, known-exploited vulnerabilities were fully remediated, with the median time to fix them reaching 43 days.
That delay is particularly concerning because attackers can exploit vulnerabilities before patches become available. Mandiant’s M-Trends 2026 estimated a minus-seven-day mean time to exploit, indicating that attacks often began before fixes were released. Network devices such as VPN gateways and routers are particularly difficult to monitor because they often lack standard endpoint security tools.
Once attackers gain access, the threat can escalate quickly. Mandiant found that the median time between an initial breach and the hand-off to another criminal group fell from more than eight hours in 2022 to just 22 seconds in 2025.
The threat is already evident. In an October 19 update, Unit 42 reported attempted exploitation of CVE-2026-0257 by Qilin and Inc ransomware operators. It also noted separate reports involving Settra. However, its earlier investigation found no evidence that attackers had moved deeper into affected networks.
k0t vs FortiBleed: 70,000 Credentials and 22-Second Attack Hand-Offs
What it means for finance and crypto infrastructure
IBM found that 62% of reported AI-driven attacks targeted critical infrastructure. Financial-services breaches averaged $6.3 million. The IMF also warned in October that cyber threats could become systemic as financial networks grow more interconnected. Crypto firms face similar risks from compromised access. Cryptopolitan reported roughly $2 million in losses involving Fetch.ai and NuNet in September 2026. Those incidents involved compromised signing credentials, not VPN access, and have no established connection to k0t.
The smartest crypto minds already read our newsletter. Want in? Join them.

On Thursday, trader Kimchi’s X account sent a brand-new Pump.fun token to a ~$15 million market cap in minutes.
About 30 minutes later the post disappeared and the coin tumbled by over 98%.
Market cap fell to ~$284,000 after $8.66 million in volume
The account shared a photo of a poster on a sidewalk in Manhattan that read “project kimchi, same internet, different outcome.” Poster had a Pump.fun logo, App Store badges and QR code pointing to a fresh token called Project Kimchi.
Market cap hit $10 million in seconds and peaked at about $15 million, though Lookonchain pegged the high at around $14 million.
Pump.fun co-founder Alon Cohen reposted the promo from his personal account, before erasing it. Traders who rescanned the QR code later said it no longer led to the token.
At one snapshot market cap was ~$284k, with $8.66M in trading volume. Another got it at ~$600,000 in minutes and ~$183,000 the next day.
Market cap prices the full supply at last trade.
Lookonchain flagged wallets that bought early and sold into the rally for a combined $385,000+ in profit. It listed three addresses on Solana.
Clayton Kim drops Pump.fun from his X bio as hack claim draws doubt
Early posts blamed an account hack. Skeptical on-chain sleuths doubted this within minutes, citing Cohen’s speedy repost and just as fast reversal.
Cohen did not post any hack warning after pulling the repost, trader Fabiano said on X. If they had a partnership deal, it made little sense for Kimchi to delete Pump.fun posts, he added.
Kimchi, real name Clayton Kim, has since scrubbed Pump.fun from his X bio and wiped older posts about joining the platform. By Friday, neither Kim nor Pump.fun had responded.
On October 20, two days prior to launch, Kimchi became a creative partner with Pump.fun. Cohen called him “the first ever example of a trader becoming a celebrity.”
X user tontheneko told Cohen to return buyers’ money. “You literally retweeted a rug pull and made hundreds of people lose money,” the user wrote.
There has been no official finding of fault or refund. Separately, Bitquery also detected three related wallets that made ~$104,000 on an earlier KIMCHI launch around October 20, but couldn’t connect them to the deployer.
Kimchi’s notoriety is based on a claim to ~$40 million in profit from the official TRUMP token, which launched in January 2025. Bubblemaps tracked his linked wallets on the day of the crash and found ~$6 million in verifiable profits.
Bubblemaps’ thread on Kimchi’s TRUMP profits, posted on X on October 22, 2026.
Bubblemaps said a hidden address was possible, but unlikely, as Kimchi would have probably revealed it by now.
His first KIMCHI meme coin attained ~$40 million within an hour of the Pump.fun signing. An anonymous deployer purchased ~79% of supply for ~$9,300 and routed creator fees to a wallet labeled Kimchi.
Former Pump.fun developer Jarett Dunn got six years in prison from a London judge over a $2 million Solana fraud, Cryptopolitan reported in December 2025.
Only 6.25% of Solana meme traders made a profit over 90 days, with the median trader down $120, Cryptopolitan reported in August.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

China’s stock market is crashing, and investors are starting to wonder how much worse things could get. Chinese stocks have been falling for weeks as traders lose patience with the country’s struggling economy, expensive AI companies, and Beijing’s attempts to keep everything moving.
The CSI 300 index, which tracks 300 major companies listed in Shanghai and Shenzhen, entered a bear market Thursday after dropping 20% from its June peak. By Friday, the benchmark had fallen another 3%, making an already miserable situation even worse.
The index has seen 10 consecutive weeks of decline, and according to LSEG figures released during the week, the figure is 2.6%. The problem is not only confined to the US, as it has also spread to Asia, where the index that measures large Chinese companies is down as much as 2.9%.
There is yet another issue to consider; retail investors trade mostly in China. HSBC believes their share in trading is close to 90%, while in the New York stock exchange, it is 20%-25%.
China’s AI excitement is fading while consumers keep their wallets closed
In the current year, up until recently, the companies from China in the tech industry had been receiving plenty of coverage. The reason was quite clear – due to the rapidly developing industry of artificial intelligence in the country, the stock price was about to explode.
But as it often happens, popularity does not equal profits.
Now the investors are assessing the actual worth and profitability of the firms considering how they capitalize on the development of artificial intelligence.
Unlike other companies, which were valued based on potential capabilities instead of the numbers, such inflated expectations may lead to the disappointment of the investors resulting in mass sale of shares.
The situation does not apply only to China but the shares of all artificial intelligence companies are being put under pressure around the world including Asian markets.
The challenge that faces Chinese technology companies is that they may find themselves in difficulty as a result of weak stock prices, which could reduce their ability to raise capital to support business growth.
As far as China’s domestic consumption is concerned, it continues to be an issue. The economy actually performed better than expected during the third quarter, with GDP growth reaching 4.5%.
That means that Beijing has become close to achieving its yearly growth goal of 4.5% to 5%, since the last quarter was below this range.
However, investors need proof that households have started consuming more, firms are seeing better profits, and confidence has been restored.
Beijing’s spending cuts are raising more questions about its rescue plans
Another major concern is that China’s government has been cutting spending when investors were hoping for stronger support.
September was the seventh consecutive month of reduced public expenditure. Government figures showed broad spending falling 3.7% from a year earlier, while revenue declined 3.5%.
The monthly fiscal deficit consequently narrowed by 3.8%.
Across the first nine months of 2026, government expenditure exceeded revenue by 7.57 trillion yuan, or approximately $1.1 trillion.
Those spending restrictions have done little to strengthen domestic demand, leaving booming exports to carry much of the economy’s growth.
Investment conditions remain difficult, too. Fixed-asset investment continued contracting, while infrastructure spending recorded a slightly deeper decline.
Beijing hasn’t completely abandoned stimulus, though.
Officials recently introduced mortgage subsidies for eligible homebuyers and authorized local governments to issue an additional 550 billion yuan in bonds to support economic activity.
Those measures followed earlier efforts to accelerate previously approved programs, including 800 billion yuan in financing through state-owned policy banks intended to encourage investment.
Additional spending could arrive as major national projects get underway, including the Six Networks initiative, which forms part of China’s broader technology ambitions.
Authorities have also used government-backed stock purchases to limit market losses.
Still, there’s a difference between stopping prices from falling temporarily and giving investors a reason to buy again.
Earlier expectations of a much larger stimulus package helped lift shares, but those hopes have weakened as Beijing favors smaller interventions.
For now, traders are watching whether these policies actually improve company earnings, revive household demand, and bring private investment back into the economy.
If you're reading this, you’re already ahead. Stay there with our newsletter.

OpenAI sent teams of its own frontier-model agents to its training infrastructure, and the models found unknown software bugs that let them break free of sandboxes and access the live internet.
Patches reach Kata Containers, gVisor and the Linux kernel
The campaign featured some of the company’s best models, including the upcoming GPT-6 Astra Cyber model and an internal frontier model. OpenAI furnished them with source code for infrastructure, configuration information and documentation on likely weak spots.
They then spent hundreds of billions of tokens on the tests.
Red-teaming findings plotted against tokens spent, from OpenAI’s post on October 23, 2026.
The agents had three goals: to reach the live internet, to cross an internal security boundary, and to exchange messages with agents they were supposed to be walled off from.
Fixes went upstream to Kata Containers (including CVE-2026-24834) and to gVisor and Moby/Docker.
Linux kernel patches are out for CVE-2026-74753, CVE-2026-80521, and CVE-2026-80841. OpenAI said it has also reported many other vulnerabilities that have not been made public.
Agents that were given a host machine exposed holes in almost all narrow services that still allowed out, such as metrics, logging and authentication management. In one test, an agent used an existing connection approved by a firewall to hit a blocked authentication endpoint in the metrics service and then had it fetch a URL the model gave it.
Agents in distinct VMs exchanged secrets even in the absence of a network link and common files. One evicted chosen data from the processor’s cache, the other timed how long it took to reload it, the same cache-timing trick behind the Spectre and Meltdown attacks.
OpenAI said it didn’t find a way to the internet that agents could trivially exploit while hiding from its monitors. As testing went on, discoveries dwindled, the company said, but it expects that future models will find flaws it doesn’t know about yet.
Frontier runs restarted October 1 with no live internet
Now, says OpenAI, it blocks live internet access during frontier training, until its safeguards are good enough to warrant more. Models practice browsing in an “offline world” of indexed and cached web pages, wrote OpenAI, so that capable, misaligned agents have no opportunities to influence systems outside the company’s control via live access.
The pause was forced by the incident of September 20. An internal research model stuck on a search task detected that its sandbox’s own DNS resolver was responding to real queries.
It used DNS delegation to pass questions on to an outside chatbot that replied “The capital of France is Paris.” Monitoring flagged the activity for review within 15 minutes and a person began reviewing it three minutes later.
The run didn’t stop automatically and was killed about 2.5 hours later. OpenAI froze training and evaluation of its most capable models, and then closed the gap at two independent layers.
The RL training and internal use of its frontier models resumed Oct. 1, 11 days after the pause began.
The lockdown goes back to July when OpenAI agents hacked Hugging Face’s systems, getting around evaluation controls. OpenAI’s biggest planned frontier RL run was still on ice in August.
Since then, California Attorney General Rob Bonta has issued the company an investigative subpoena over cybersecurity incidents involving its models, Cryptopolitan reported.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Meta has postponed the implementation of its revised Commercial Terms and Self-Serve Ad Terms to November 20. Originally set to be implemented on October 30, the revised schedule come after some publishers and advertisers raised concerns regarding a new website-crawling provision. The outcome of this decision will determine who holds the right to use journalistic content in AI products.
Three more weeks to explain what Meta says isn’t changing
On 23 October, Reuters reported that the complaints had been submitted to the EU and UK competition authorities. Meta dismissed the allegations about wanting to have unlimited rights to content published online. The company said that the postponement gives it a chance to give an explanation about its crawlers. It also reminded publishers of the fact that they have a right to exclude or allow the usage of their sites through robots.txt, a file giving instructions to automated bots.
Publishers call the delay “a pause, not a solution”
Publishers are looking for more than just a sense of security. UK News Media Association chief Theo Bamber referred to the postponement as “a pause, not a solution,” and urged the introduction of legally binding commitments.
In a letter dated October 22, WAN-IFRA called for binding robots.txt protections, revocation of Meta’s permission to generate test credentials, measures preventing the bypassing of paywalls, as well as the possibility of opting out of crawling without losing access to business tools.
WAN-IFRA president Ladina Heimgartner summed up the industry’s concerns:
Journalism is not raw material to be collected as a condition of being present on a platform.
What the disputed clause actually allows
The issue is in the language. Meta’s revised terms allow the automatic harvesting of data from online content “associated with” business accounts for the purpose of creating advertisement and business products.
Meta has dropped the word “training.” However, legal experts told Nieman Lab that “develop” may still be interpreted as AI training. Moreover, the new terms do not contain any explicit statement that robots.txt will be honored. Meta disputes that reading.
Brussels welcomes the pause, Blackburn wants a withdrawal
The postponement has not contributed much to easing regulatory concerns. Although the European Commission welcomed the move, Britain’s Competition and Markets Authority said it would continue examining Meta’s terms.
There is also an increasing call by publishers for better protections. Angela Mills Wade, the executive director of the European Publishers Council, stated that there should be no reason for the company to gain control over publishers’ content simply due to it having a Meta business account. In the US, Senator Marsha Blackburn has even demanded that the company guarantee the withdrawal of the new terms altogether.
Why the fight reaches past newsrooms
The dispute goes beyond publishers’ control over their content. It could also affect the growing market for AI licensing deals. As Cryptopolitan reported on October 15, CNN joined Google’s paid News AI pilot, which now includes more than 400 publications.
Such deals may be harder to reach once platforms are allowed to access content more broadly under their commercial terms. Small AI developers may also suffer against those firms that have control over both distribution and access to content. The OECD points out that the current concentration of AI resources plus vertical integration entails risks for competition.
Still, publishers are not counting on licensing to deliver substantial revenue. The Reuters Institute’s 2026 survey found that only 20% of publisher respondents expected substantial AI-related income. Another 49% anticipated minor contributions, while 20% expected none.
Meta AI Content Terms Delay: Publisher Revenue Expectations and Key Dates
Better tracking could help publishers negotiate. On October 2, the SPUR Coalition introduced a telemetry standard to record when AI systems retrieve or cite their content. It could strengthen their bargaining position, although it cannot guarantee payment.
For now, publishers want Meta to turn its assurances into binding protections for crawling, opt-outs, and licensed AI use before November 20.
The smartest crypto minds already read our newsletter. Want in? Join them.

Onchain analyst Ai Yi linked a second dormant ether wallet to an early buyer who paid about $18 a coin, bringing the buyer’s suspected sales to ~6,000 ETH since August 2025. Those coins were worth ~$15.85M at the time of hitting exchanges.
The more recent wallet shifted 3,000 ETH, valued at about $7.23 million, to a Kraken deposit address on Oct. 22.
Ai Yi puts combined profit above $15.74 million
Ai Yi marked address 0xa4c…F02D0 on October 23 in a Chinese post, pointing out that the buyer wasn’t done selling yet.
The analyst said that the address could be linked to the same whale as a wallet that had been tracked before because the buy timing, funding source, and deposit method all matched.
If the link holds, all 6,000 ETH were deposited at an average deposit price of $2,642.42. Combined return estimated at over 139x, total profit at over $15.74 million, per Ai Yi.
Ai Yi’s post tying the two wallets together, above a transfer list of the 2017 buyer’s Kraken deposits, posted by @ai_9684xtpa on X on October 23, 2026.
The previous wallet moved 3,000 ETH from Gemini nine years ago, which was worth ~$56,400 at the time. It sat inactive until August 2025, then started feeding coins to exchanges in batches.
By September 29, trackers had it selling 2,000 ETH at an average price of $3,096 or $6.19 million total. The last 1,000 ETH left on Oct. 20 and Ai Yi pegged the average deposit price of that wallet at $2,874.17, a 151.7x return.
In a post on Oct. 21, Ai Yi said that the earlier wallet was probably empty. If they sold all of the coins, they would make about $8.57 million in profit.
A $7.23 million batch lands at Kraken after eight idle years
Onchain data shows 3,000 ETH moved from a Gemini hot wallet around 9 years ago, worth ~$56,480 or $18.83 a coin. The coins went through two intermediary wallets before arriving at 0xa4c… in August 2018.
They hung on for eight years. All 3,000 ETH were transferred to Kraken in one transaction at 14:49 UTC on October 22.
Ether close to $2,410, a 128x return. Trackers priced the batch at $7.23 million.
They logged it as a sale, but so far, the chain only shows a Kraken deposit.
Other early holders also moved coins this month. One, bought at $14, deposited 6,369 ETH, or about $16 million, to Kraken.
A 2015 ICO participant who purchased 170,000 ETH at $0.31 sent 13,330 ETH to Coinbase.
Ether trades near $2,400 after running from below $2,000 to $2,800 and stalling. Outflows persist for spot ether ETFs.
Tom Lee’s Bitmine, the biggest corporate buyer of ether, said it will cease buying ETH at 5% of supply.
Near-record 44.1M ETH are staked. In February, Cryptopolitan wrote that wallets holding 1,000 ETH or more shrank their holdings by as much as 1.5% in early 2026 as ETH fell below $2,000.
Two other whales pulled a combined 29,079 ETH, about $60 million, off OKX and Binance in early February, Cryptopolitan reported.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

A high-severity soundness bug in Succinct’s zero-knowledge proving system, SP1, exposed the company’s own mainnet Prover Network to invalid proofs.
The network was the only deployment Succinct was aware of that was affected, according to a GitHub security advisory released Oct. 11.
Native Rust verifiers in 6.0.0 through 6.8.0 could accept invalid proofs
The advisory, filed as GHSA-p7v2-jjv3-8p8f, says a malicious prover could submit a proof for an invalid execution and the network’s verifier would accept it. The Prover Network accepted proofs from third-party provers.
To take advantage of the bug, proofs had to be sent directly to SP1’s native Rust verifier. Core and Compressed proofs were exposed on that path.
The Groth16 and Plonk checks were safe because they used wrapped proofs with fixed shapes and never touched the bug’s prover-controlled tensor format.
The Solidity checkers for on-chain Plonk and Groth16 checks were also unaffected. Apps using the verify_sp1_proof function to check Compressed proofs were only safe if proof aggregation ended in a Groth16 or Plonk proof.
The advisory says that from 6.0.0 to 6.8.0, sp1_hypercube, sp1_prover, and sp1_sdk are affected. The fix was sent out by Succinct in version 6.8.1 on September 24, 17 days before the advisory was made public.
Succinct’s security advisory GHSA-p7v2-jjv3-8p8f on GitHub, rated high severity, lists sp1_hypercube, sp1_prover and sp1_sdk versions 6.0.0 through 6.8.0 as affected and 6.8.1 as patched.
Tensors with storage lengths that don’t match are thrown out by version 6.8.1
SP1’s native Rust verifier had the bug. This is the part of the program that checks if a proof is valid.
SP1 stores multidimensional data in a Tensor. A Tensor consists of a buffer of stored values and declared dimensions describing its shape.
Both need to tally for sound verification. The number of stored elements must be the same as the product of the dimensions that were given.
A label on each piece of proof data shows how big it is. The verifier never made sure that what was on the label matched what was inside. It only looked at the label.
So an attacker could send data with a fake label. Different parts of the check would then look at various parts of the same data, which means that a fake proof could pass.
With version 6.8.1, there is now a length check in deserialization. Any tensor that has a number of stored elements not equal to the product of its declared dimensions is rejected.
After 6.8.1 was published, Succinct deployed the fix to the mainnet Prover Network.
People who request proofs from the network don’t have to change anything on their end. Anyone who runs their own native Rust verifier and accepts proofs from provers they don’t trust needs to upgrade to 6.8.1.
Vitalis Salis found the flaw and reported it through Immunefi’s bug bounty program, the advisory says.
Other proof-system soundness bugs, including a soundness bug in Zcash’s Orchard shielded pool, have been reported this year by Cryptopolitan. Cryptopolitan also discussed an exploit at Foom.Cash where an attacker forged zkSNARK proofs because of a verifier misconfiguration.
The smartest crypto minds already read our newsletter. Want in? Join them.

HSBC on Friday launched RedCoin (RCHKD), its Hong Kong dollar stablecoin, for more than 3.3 million users of its PayMe platform.
It is the first retail stablecoin issued by a bank in Hong Kong.
Wallets pay more than 100,000 merchants across Hong Kong
RedCoin is a currency within PayMe, HSBC’s consumer payments app, and is pegged to the Hong Kong dollar. HSBC said users can activate a stablecoin wallet in the app over the coming days.
The wallet transmits tokens to friends and family. It also pays at over 100,000 merchants via PayMe.
HSBC’s release of October 23, 2026, opens RedCoin to more than 3.3 million PayMe users for P2P and merchant payments.
The token is licensed and regulated by the Hong Kong Monetary Authority under the city’s Stablecoins Ordinance. The law, which targets issuers of fiat-referenced stablecoins, came into force in August 2025.
HSBC was awarded its issuer license, FRS02, in April 2026. PayMe is regulated by a separate stored value facility license, SVFB002.
HSBC Digital Assets Custody is the custodian of the tokens. The launch includes PayMe transaction discounts and RewardCash offers.
Hong Kong requires the identification of all stablecoin holders. But PayMe users had already undergone HSBC’s know-your-customer checks, so the closed system got over that hurdle and put the bank ahead of the curve in the retail market.
Pre-launch had staff pilots with ~100 users. They tested the minting, wallet activation, and live transfers.
HSBC is among the three commercial banks authorized to issue Hong Kong dollar banknotes. Since 2022, it has participated in the HKMA’s e-HKD+ Pilot Programme and Project Ensemble.
By the end of August 2026, its HSBC Gold Token for retail customers had logged 390,000 trades worth US$2.5 billion.
A tokenized HKD money market fund comes next
Later this year HSBC plans to let customers subscribe to tokenized investment products using RedCoin. First up is a new share class of its long-running HKD money market fund.
The fund plan was not mentioned when HSBC rolled out the RedCoin brand in September. Stablecoin wallet functions are also planned for the HSBC HK Mobile Banking App later this year.
“We will soon add more products, including expanding into wholesale corporate and institutional use cases,” said John O’Neill, HSBC’s managing director for digital assets and currencies.
“Money, assets and information are moving from traditional infrastructure to always-on, data-rich and increasingly programmable digital networks,” said Maggie Ng, chief executive of HSBC in Hong Kong.
HSBC is one of two companies in the HKMA’s first batch of licenses. The other is Anchorpoint Financial, a joint venture between Standard Chartered Bank (Hong Kong), HKT and Animoca Brands.
Anchorpoint began to roll out its HKDAP token in phases in August, initially opening the token to institutional and professional investors. As per Cryptopolitan, HKDAP had around 522,000 tokens in circulation as of August 19.
Anchorpoint has said retail access could be as soon as the end of 2026.
HSBC took the other route, going straight to consumers with an app that has millions of accounts.
HKMA took in 36 license applications in 2025.
The HKMA chief executive, Eddie Yue, said the regulator will first examine the performance of the first two stablecoins before approving others, previous Cryptopolitan coverage noted.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

The SEC is adopting the term “super intelligence” and is ditching the term “artificial intelligence” in its Fiscal Year 2027 examination priorities.
The exam priorities were published on Friday, and the change reflects the language used in President Trump’s Executive Order.
The change by the SEC also mentions crypto just once inside a line about tokenization.
Where the “super intelligence” term comes from
The new terminology did not come out of thin air. In fact, the term emanates from Executive Order 14434, “Inaugurating the Era of Super Intelligence,” signed by President Trump on September 29, 2026.
The executive order was published in the Federal Register on the 2nd of October. The order mandates agencies to use the term “Super Intelligence” and “SI” rather than “Artificial Intelligence” and “AI” across websites, reports, policy documents, and other non-statutory materials. And the executive branch “will not acknowledge” the older terms.
The legal ramifications might be too deep, especially because the order does not change much in the near future. In fact, based on the analysis of Arnold & Porter attorneys Alexis C. Archer and Eun Young Choi, the executive order starts a 60-day window that runs till late November 2026 for the White House to draft federal legislation that will redefine the technology in federal law.
National Institute of Standards and Technology has followed the directives of the executive order.
The SEC made the switch before now
The SEC had adopted the new language prior to the release of the FY 2027 report. The SEC has a page dedicated to explaining the agency’s use of the new term.
The page, named “Super Intelligence at the SEC,” details a Super Intelligent Task Force created in August 2025, with Valerie Szczepanik appointed as the Chief SI Officer at the SEC and saddled with the responsibility of SI innovation, adoption, and governance across divisions.
Super Intelligence can be found under info security and operational resiliency in the new exam priorities. Examiners will look to scrutinize emerging technologies, including super intelligence, and how they affect market operations, compliance, and fraud prevention and investor protection.
Crypto shrinks to just one word: tokenization
The SEC is moving differently this year, at least compared to other years. For instance, based on a report from November last year, the SEC dropped crypto from its FY 2026 exam priorities and placed more emphasis on AI, cybersecurity, and new rules.
But this year, the FY 2027 document leaves crypto on the list, albeit as a subtopic as one of the risks linked to “evolving market infrastructure,” together with Treasury clearing reforms and tokenization.
However, such framing is at odds with the digital asset agenda set forth by Chairman Paul S. Atkins. In a statement released on the 1st of October, Chairman Atkins put forward a proposal that will set custody rules for crypto assets as “another element of a comprehensive crypto asset regulatory approach.”
He cited the January 2026 tokenization taxonomy and an Innovation Exemption that will facilitate trading of tokenized NMS stock.
What the exam program still covers
Aside from technology, the FY 2027 priorities stick to the usual: investment advisers’ fiduciary duties and conflicts of interest, retail protection around complex and illiquid products, private funds and private credit, broker-dealer financial responsibility and anti-money-laundering compliance, and cybersecurity.
However, the list is subject to change during the year as the program is designed to evolve with the market trends, according to Keith Cassidy, director of the Division of Examinations.
Watch the late-November deadline for the White House’s proposed legal definition of “super intelligence,” which could eventually change how statutes that reference AI apply.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Crypto wallet Phantom has switched on Kalshi-powered event contracts for US customers. This gives Kalshi another distribution channel; however, it is coming around the same time that CME Group is fighting the prediction market platform in federal court, before the SEC, and now in the oil pit.
On the other hand, CME’s prediction market venture, FanDuel, has shrunk, while platforms like Kalshi and Polymarket have since expanded where they can trade.
Event contracts have become a contested frontier between the platforms offering those contracts, regulators, and other firms that have been playing in the space or adjacent sectors. This time around, it has been CME, one of the oldest and largest derivatives marketplaces in the US, arguing that Kalshi is breaking rules as it continues to expand.
Phantom opens another door for Kalshi
Phantom users can now buy and sell Kalshi event contracts inside the app, and they will get access to more Kalshi offerings in the coming weeks.
Currently, trades are funded with CASH, which is Phantom’s dollar-pegged stablecoin. The funds are then routed to Kalshi for settlement before winnings return to a user’s Phantom Cash account.
Phantom quoted a feed of two cents per contract plus a small network fee.
While this new distribution channel has opened for Kalshi, it has not taken away the headaches that it is facing with state regulators across the US.
Several states challenge Kalshi’s position that federal oversight shields its contracts from state gambling laws.
In its announcement, which was released on Thursday, October 22, Phantom said that certain market categories will not be accessible to users in Michigan, Nevada and Washington. This is not unrelated to the various lawsuits that Kalshi is facing in those states.
Phantom received a conditional no-action letter from the CFTC in March, and this spares it from registering as a broker. That relief has since been widened to other software providers.
Kalshi has logged more than $291 billion in volume this year, and it has already reached $55.33 billion in October with nine days to run, on track to top September’s record of $59.32 billion per The Block data.
CME’s fight widens into oil
On October 20, Kalshi asked the CFTC to approve WTIPERP, a cash-settled West Texas Intermediate crude contract that never expires. If cleared, it would be the first energy “perp” available in the US.
The contract would track a constant one-month WTI price calculated by Pyth Network and represent 100 barrels against the 1,000 barrels in a standard NYMEX contract. NYMEX is owned by CME.
Kalshi is pursuing voluntary approval, which gives the CFTC between 45 and 90 days to decide. The exchange already runs a related product, WTIFUTURE, which it self-certified on October 7. That contract behaves like a perpetual but carries a ten-year maturity. It was doing $57 million in daily volume with up to 5.9 times leverage.
The lawsuit CME is losing ground on
CME sued the CFTC on June 18 over the regulator’s May 29 approval of Kalshi’s Bitcoin perpetual, BTCPERP, as Cryptopolitan reported.
CME’s argument is that contracts with no expiry are swaps under Dodd-Frank, not futures, a label that changes margin, registration, and tax treatment.
The agency wants the case gone. On October 16, the CFTC asked Judge Colleen Kollar-Kotelly to dismiss, saying CME had not shown it was harmed. The agency pointed to CME’s own figures, with monthly crypto futures volume climbing from roughly 2.66 million contracts in May to 3.28 million in September, and to Chairman Terrence Duffy’s statement that clients were not asking for perps. The regulator argued that CME lacks standing.
The pressure is not only in commodities. On October 14, CME, Nasdaq and Cboe lodged objections with the SEC over Kalshi’s separate plan for perpetual security futures tied to individual stocks. Kalshi, meanwhile, launched a US500 perpetual on October 6.
CME’s own prediction bet has shrunk
While Kalshi adds venues, CME’s consumer play has pulled back. FanDuel Predicts, the app CME launched with FanDuel in December 2025, has since been rewired so that sports wagers run through Crypto.com’s Nadex rather than CME.
CME, which holds a 51% stake in the joint venture, now processes only the non-sports contracts, which it said account for under 1% of the app’s activity.
CME’s prediction-market volume during the first two weeks of July was estimated to be about 0.02% of all volume from US regulated entities.
The contrast is sharp compared with CME’s core business. The exchange posted record third-quarter revenue of $1.74 billion, up 13% from a year earlier. The futures giant is thriving; however, its bet on prediction markets is not.
The smartest crypto minds already read our newsletter. Want in? Join them.

DeepSeek and MiniMax have signed up under Beijing’s draft AI export rules, said a CCTV-affiliated account, Yuyuan Tantian, on Thursday. The two developers also completed open-sourcing and overseas licensed use of their models, the account said.
In a separate post Friday, Yuyuan Tantian said overseas Internet users encouraged other Chinese open-source models to follow suit.
On October 16, China’s Ministry of Commerce and Ministry of Science and Technology announced the opening of public comment on a revised Catalogue of Technologies Prohibited and Restricted from Export. The draft lists 23 AI techs such as large models, agents, compute clusters and information processing.
The list triggered questions in markets and foreign policy circles about whether China was closing the door on AI exports. The Commerce Ministry’s Q&A spent more words on what the rules don’t cover than what they do, the account said.
Liu Hongmei says restricted items can still win licenses
Lawyers Liu Jing and Liu Hongmei from Beijing Dacheng Law Firm participated in the consultations on the draft, which began in the first half of the year. Some AI entries had control points that kept shifting with the industry, they told Yuyuan Tantian, as drafts moved on.
Many of the concerns companies aired at those meetings found their way into the draft. Their bigger question now, the account said, is whether there will be clearer operating guidance.
This is not an export of the model: furnishing API access, interacting via an app or web, SaaS services, or lightweight on-device deployment with a restricted model.
Yuyuan Tantian said most artificial intelligence (AI) technology will continue to be freely exported once the measures are in effect. Open-sourcing AI, running self-built compute centers abroad, taping out chips overseas, joint R&D with foreign resources, and work on international standards qualify for automatic licensing, close to file-and-go.
Members of the World Artificial Intelligence Cooperation Organization will get stronger support for building capabilities and making rules together.
The draft delineates three areas. A model trained on core national data that is provided as a service would be barred from export, and one trained on important data restricted, irrespective of size or number of parameters.
Agent technology above a certain level of performance would be restricted. If it is mainly intended for critical information infrastructure, defense or core government systems, it moves up to prohibited.
The third category is compute, which encompasses the design of AI chips and high-speed interconnects connecting nodes inside large AI compute clusters. Numeric thresholds include, for example, training compute > 10^26 floating-point operations, > 2 trillion parameters, or capability in the global top ten.
As Cryptopolitan reported in May, DeepSeek’s flagship V4-Pro has 1.6 trillion parameters.
Once the rules come into effect, banned-category technology cannot be exported, Liu Hongmei said. She said companies could seek licenses for restricted items without having to scrap existing plans overseas.
Yuyuan Tantian calls the revision routine, citing changes since 2001
Federal civilian agencies have been instructed by the Department of Homeland Security to discontinue use of DeepSeek products and any third-party tools developed on its models, Cryptopolitan reported. The order was signed by Secretary Markwayne Mullin on July 24, 2026.
Yuyuan Tantian said Washington categorizes AI export restrictions by country and alliance, referencing the January 2025 AI Diffusion Framework. The account said China has revised the catalogue several times since 2001 and the current revision is routine work under existing law.
Yuyuan Tantian said oversight is then on the act of exporting technology, not the technology itself.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Michigan Senate candidate Abdul El-Sayed says stock buybacks should be illegal.
His comment, which came days after General Motors unveiled a $20 billion repurchase, does not broadly affect crypto buybacks. Buybacks in the crypto sector run on two separate tracks, and only one of them will be affected by the ban El-Sayed is calling for.
Should buybacks be illegal?
Abdul El-Sayed, the Democrat in Michigan’s November 3 Senate race, wrote on X on Wednesday that “stock buybacks should be illegal,” accusing GM executives of paying themselves and shareholders instead of funding workers and new products.
Prior to his post, General Motors (GM) announced a $20 billion buyback plan that the United Auto Workers (UAW) called the largest buyback in U.S. automaker history.
El-Sayed’s Republican opponent Mike Rogers, a former U.S. House member, also went after the company, saying it chose to “put profits over people.”
The UAW, which has endorsed El-Sayed, called the move “legalized mass looting” in a statement from President Shawn Fain, who noted that CEO Mary Barra earned $48 million in 2025.
GM has said that its “first priority is investing in our business and our employees.” The company cited more than $100 billion reinvested since 2020.
GM has reportedly repurchased about $29.5 billion in stock since 2023, with Barra calling the shares undervalued.
A Marist poll taken October 15 to 18 put El-Sayed at 50% and Rogers at 48% among likely voters.
El-Sayed holds a small lead over Rogers in the Michigan Senate race. Source: Marist Poll
Will token buybacks become more common?
Strategy Inc., the Bitcoin treasury company formerly called MicroStrategy, now holds 848,517 BTC and does traditional corporate buybacks.
An 8-K filing with the SEC covering October 19 shows the board raised the limit on its digital credit securities repurchase program from $2.0 billion to $3.0 billion, leaving $1.16 billion available. In the week ending October 18, the company bought back 1,938,780 shares of its Series A Perpetual Stretch Preferred Stock (STRC) for $193.1 million.
Strategy also has a separate $1.0 billion authorization for buying back its MSTR common stock, which is still open.
El-Sayed’s target, spelled out in his post about GM, is public companies buying back their own shares. Strategy’s STRC and MSTR repurchases are exactly that, which means a ban on corporate buybacks would affect them.
Crypto projects, on the other hand, are increasingly using a different method of buybacks called “token buybacks.” Under this method, a protocol takes money it earns from trading and uses it to buy its own token on the open market, often destroying (burning) the tokens afterward.
This practice recently got clearer regulatory backing after the SEC’s Division of Corporation Finance said in an updated FAQ that announcing a buyback for an already working crypto network doesn’t turn the token into a security.
For example, Hyperliquid’s Assistance Fund automatically buys and burns HYPE tokens using 99% of eligible trading fees. Cryptopolitan recently reported that the Hyperliquid Policy Center asked the SEC to include the buyback guidance directly into its proposed Regulation Crypto Assets.
Meanwhile, token buybacks have reached a record $638 million.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.