0xnut6

Playboi Carti’s X account, @playboicarti, which has 3.62 million followers, was flagged by the community this morning as possibly having been hacked. Its bio briefly displayed the name of a token launch platform, followed by posts promoting a meme coin. I looked at the main token’s hourly chart: its liquidity pool was created shortly after 7 a.m. Taipei time, and its market cap peaked at around $1.23 million. Trading volume in the first two hours was about $4.06 million; its market cap is now down to around $13,000. When I checked again at 9 p.m., the account’s profile picture, name, and bio had all been cleared, but I haven’t found any statement from Carti or his team.

In situations like this, someone usually launches a token on a one-click platform like @Pumpfun, then posts its contract address from a large account. By the time people jump in and buy, the person who launched it has already started selling. Save this checklist:
1. If an account that has never talked about crypto suddenly posts a contract address, treat it as suspicious.
2. Sudden changes to the bio or username often reveal a problem before the posts do.
3. Search the token name on DexScreener. In this case, there were at least 27 tokens with the same name, making it difficult to tell which one, if any, was launched by Carti.
4. In a pool with only $10,000–$20,000 in liquidity, even a small sell order could send the price crashing.
5. When making a transfer, copy the address from your own contacts—not your transaction history. Address poisoning involves inserting a fake address that looks very similar into your transaction history.

Arthur Hayes said on X today that Flop Labs will open its Devnet within a few days. Anyone can join as a miner or validator, but participation will not count toward any token allocation. For those accustomed to treating every testing phase as an airdrop-farming opportunity, the electricity and time spent on this Devnet will earn them nothing but a configured machine.

The official airdrop proposal sets the genesis pool at 4.4 billion FLOP. The miners’ share of 1.2 billion tokens will be distributed proportionally based on verified computing power during the testnet, which is expected to run for about 90 days starting November 3. The number of tasks completed, active days, and token balances will not count. This differs from the approach many past projects have taken, where engagement was measured by the number of interactions. Farming tasks earns no points here; only computing power actually generated by taking on jobs counts. Validators, meanwhile, will be limited to the top 1,000 testnet performers, each receiving 1.2 million tokens, with the entire amount locked as collateral.

So the real purpose of the Devnet is to ensure machines are ready to take jobs reliably from the very first day of the testnet, since the documentation states that starting late will lower your score for the entire period. The official team also notes that these figures are still a proposal, and November 3 is a target date, not a confirmed one.

Binance co-founder @cz_binance posted, “Multiple chains, one coins,” and it has already had 470,000 views. Most people remember the new BNB Chain L1’s 200-millisecond block time and that it won’t issue a new coin. I’ve finished reading @BNBCHAIN’s developer docs, and a few other numbers matter more to people writing smart contracts.

The new chain charges based on the gas limit you declare, not the amount actually used. The docs give an example of a transaction that uses only 70,000 gas but sets a limit of 500,000. You’d be charged for 500,000—more than seven times the actual usage. Many scripts customarily multiply the estimate by 1.5; on the new chain, that would mean paying for gas you never use.

I used a public BSC node to check the latest 10,000 blocks. The average interval was 0.450 seconds. The new chain’s is 200 milliseconds, or about 432,000 blocks per day. BSC produces about 192,000 per day, a 2.25x difference. The docs’ “about 3.75x” figure is based on BSC’s old 750-millisecond interval from January this year. Smart contracts that calculate staking-lock periods and TWAP windows based on block counts will get it wrong if updated according to the docs.

For now, there’s only an internal devnet, no public RPC, and the native bridge to BSC hasn’t launched. The official plan is to launch a testnet by the end of 2026.

Elysium, built by Kinetiq, is an L2 tied to the Hyperliquid ecosystem. Its mainnet launch is set for November 9, but its most anticipated feature won’t actually be available on launch day. @Kinetiq_xyz’s documentation is clear: the layer that lets contracts read HyperCore order books directly and send orders to HyperCore won’t be added until about four weeks after mainnet launch, following an ArbOS upgrade.

Elysium aims to solve HyperEVM’s limited block space. To avoid slowing down @HyperliquidX’s perpetuals order book, HyperEVM’s small blocks allow only 3 million gas per second. Elysium uses the @arbitrum Orbit architecture, settles back to HyperEVM, and uses HYPE to pay gas fees. It targets 300 million gas per second—about two orders of magnitude more—primarily to attract market-making AMMs that need to update quotes 5 to 10 times per second. Half of the sequencer fees will go toward buying back and burning KNTQ on the open market, creating a new revenue stream for Kinetiq, whose TVL is down more than 60% from its peak last October.

The trade-off is that users will need to put more trust in the team at launch. A single sequencer will order transactions, an AnyTrust committee will handle data availability, and a whitelisted set of validators will verify the state; permissionless BoLD proofs will come later. Arbitrum One also launched on mainnet in 2021 with whitelisted validators, and didn’t open up BoLD until February 2025—more than three years later. Based on that precedent, it may take Elysium more than a few months to open up BoLD.

On October 23, Elysium’s official account, @Enter_Elysium, also issued a public reminder that mainnet had not officially launched yet and warned users to watch out for unofficial tools and scams. Until the official mainnet contract addresses are announced, there’s no way to verify the authenticity of any token claiming to be tradable on Elysium.

Former X product lead Nikita Bier posted a warning today: AI is rapidly uncovering system vulnerabilities while also making voices indistinguishable from real people. Scammers can spoof caller ID and make it look like your bank is calling you.

The crypto world already has a playbook for this scenario. In February 2025, @zachxbt and investigator tanuki42 compiled a batch of cases involving Coinbase users who had their accounts drained. In just two months, victims lost at least $65 million. The scammers spoofed phone numbers to impersonate customer support, then sent emails with fake case numbers, tricking victims into transferring their crypto to the scammers’ addresses. They estimated the losses exceeded $300 million over the course of a year.

In May of the same year, @coinbase revealed that overseas customer support staff had been bribed, resulting in the leak of some users’ names, phone numbers, photos of their identity documents, and transaction records. The estimated costs of handling the incident and compensating users were between $180 million and $400 million. The hardest part of this scam is convincing people that the person on the phone really is customer support. The leaked personal information has already done half the work for scammers; voice models can add the right tone, leaving even fewer clues.

So you can no longer rely on someone’s voice or caller ID to tell if they’re genuine:
1. If someone calls claiming to be from an exchange or bank, hang up and contact customer support yourself through the app.
2. Treat any request to transfer your assets to a “safe wallet” as a scam.
3. Enable a withdrawal address whitelist, and set newly added addresses to take effect after a delay.

xAI’s newly launched Grok for Startups program releases only 20% of the credits upfront after approval. The remaining 80% is automatically released only once the product is actually being used, and the credits expire six months after activation—any unused credits are forfeited.

This is very different from @googlecloud’s approach to its AI startup program. Google offers AI startups up to $350,000 over two years, with up to $250,000 available in the first year—the amounts are clearly stated. xAI’s official page only says that credits are allocated based on actual usage over 6 to 12 months. Applications are reviewed based on funding, revenue, current AI spending, and team size. Each corporate group can receive credits only once, and applicants may not split their businesses into separate entities to apply multiple times. Any promotional credits received previously must also be disclosed, and verification documents must be submitted within 10 days. Releasing a small portion upfront and the rest only after real usage is demonstrated follows the same logic as airdrop projects’ anti-Sybil measures.

For crypto teams, the difference lies in eligibility: Google’s terms explicitly exclude mining companies and projects that issue tokens in violation of its rules, while xAI’s published terms list employees of affiliated companies and people in sanctioned regions as ineligible. These credits are non-transferable, cannot be exchanged for cash, and cannot be used to buy X Premium. They can only be spent on @grok chat, Grok Build, Grok Bot, and the API.

In an interview on Israel’s Channel 10 economic channel on 10/23, Netanyahu said banking sanctions could really happen, so he had already asked people to prepare an “alternative economy” plan that could circumvent sanctions, with blockchain as one option. He did not say which chain would be used or mention any tokens. So far, the only information made public is this interview.

On the same day, China announced its 15th Five-Year National Informatization Plan, stating that it aims to basically complete a national blockchain network by 2030. However, mainland China’s crypto ban remains unchanged. The network is state-led infrastructure and has nothing to do with public blockchains or tokens.

Israel is considering ways to circumvent sanctions. China, meanwhile, uses a separate system, mBridge, to enable some cross-border settlements without going through the dollar banking system. But the bottleneck for approaches like these is usually at the on- and off-ramps. Russia’s Garantex exchange ground to a halt after Tether froze about $27 million in USDT in March 2025. The chain was not shut down, but once the issuer froze the funds, they could no longer be moved. The China-led cross-border platform mBridge instead uses central bank digital currencies to settle transactions directly between countries. According to the Atlantic Council, cumulative transactions reached about $69 billion by June this year. But the BIS withdrew in October 2024 (officially saying the project was ready to be handed over for the central banks to operate themselves), and Saudi Arabia also left after completing its proof of concept.

Israel already has a ready-made tool. In April this year, Israel’s Capital Market Authority approved Bits of Gold to issue BILS, a stablecoin pegged 1:1 to the shekel. It is issued on Solana, with custody technology provided by Fireblocks. However, BILS’s reserves are held in bank accounts in Israel, so the stablecoin would also be affected if sanctions directly targeted the banks. I think the plan most needs to clarify where its reserves and redemption channels would be located. If it ultimately still relies on domestic banks for custody, the range of sanctions it could withstand would likely be quite limited.

Solana officially announced on 10/21 that the Alpenglow consensus upgrade had gone live on mainnet, reducing finality from about 12.8 seconds to about 150 milliseconds.

Solana said Alpenglow cuts finality from about 12.8 seconds to about 150 milliseconds. This is indeed the biggest change to Solana’s consensus layer since launch. With the old TowerBFT retired, validators now vote directly with one another and bundle their votes into certificates. A block is considered finalized after one or two rounds of voting, so transactions no longer have to wait more than ten seconds to be sure they won’t be rolled back.

However, 150 milliseconds is a design target, not yet a stable, measured figure on mainnet. The Foundation’s dashboard showed 202 milliseconds on 10/21 and 10/22, while validator operator StakeCraft recorded a median of about 414 milliseconds. The main difference comes down to whether a block takes one or two rounds of voting. Even at 414 milliseconds, finality is about 30 times faster than before. And compared with Ethereum’s roughly 12.8-minute finality, the gap remains enormous.

Two other things are worth noting:
1. Vote transactions are no longer written to blocks, so Solana’s TPS figures will drop noticeably. But actual usage hasn’t decreased; the TPS chart spanning 10/21 mixes two different methods of calculation.
2. The network’s tolerance for malicious stake has fallen from 33% to 20%. In exchange, the chain can keep running even if another 20% of stake goes offline. The day before activation, 151 validators representing about 20.3% of stake were still marked as unready, and this migration does not support the Firedancer client.

Anyone staking SOL should check that their delegated validator is still voting normally, since nodes that don’t vote won’t receive inflation rewards. The second phase, Rotor, planned by @anza_xyz, does not yet have a scheduled launch date. Until then, the median shown on the dashboard will be a closer reflection of the real-world experience than the 150-millisecond target.

Ptah Relics can only be minted by Binance Agent IDs. I read the contract directly on BNB Chain this afternoon, and the current supply is 20,550. The claim circulating in the community is that “100,000 were minted in one night”—nearly five times the on-chain figure. There may have been burns in between, or the claimed total may have been inaccurate to begin with. Before following the crowd, it’s worth checking the chain yourself.

For context, @BinanceWallet launched .ai Agent ID on October 20. It uses @spaceidprotocol’s domain infrastructure, is free to claim, and each Agentic Wallet can link only one. According to current reports, it also can’t be transferred. The buzz seems to have picked up after projects began making Agent ID a prerequisite for participation. According to the rules compiled by the community, each ID can mint up to 4 Ptahtrade tokens. If that limit is accurate, at least 5,100 IDs took part in this round.

This is a lot like the BAB soulbound token Binance launched in 2022: first, an identity credential that can’t be transferred is issued, then projects open access only to its holders. The difference is that BAB is linked to an account that has completed KYC, while Agent ID is linked to a wallet that lets AI sign transactions automatically. The barrier to entry is much lower, and the risk of bulk registrations is higher. To mint automatically using skills, you first have to enable developer mode. When selling, you also have to grant the marketplace contract setApprovalForAll authorization—allowing it to transfer all the collectibles you hold in that NFT contract. Most of the risk lies in these two settings.

If you do decide to participate, these three things matter more than speed:
1. Set a low spending limit for your Agentic Wallet, and turn off developer mode as soon as you finish minting.
2. Verify the contract address using only the project’s official accounts, and don’t click links shared in group chats.
3. After selling, reset the marketplace approval on the NFT contract to false.

SlowMist scanned 1,488 crypto domains and found PHP on 793 of them. This week PHP patched two bugs that let a stranger run code on a web server without logging in.

Both are rated 9.2 and sit in memory management and error handling, code that nearly every request touches. On Apache with mod_php, one unauthenticated request can trigger the first bug before any app code runs. Fixes shipped Oct 21, but PHP 8.1 and older are end-of-life and get no official release, so those servers depend on a distro backport or an upgrade.

Users can get hurt even when no smart contract breaks, because an attacker who owns the web server can change what the page asks your wallet to sign. @SlowMist_Team flags swapped recipient addresses, swapped token approvals and stolen API keys that might reach a hot wallet. BadgerDAO lost about $120M to this kind of front-end tampering in December 2021, although the attacker got in through a stolen Cloudflare API key rather than PHP. Its contracts held up, while a script injected into the front end slipped extra approvals into normal deposits.

PHP on a domain doesn't mean that site is vulnerable. @PancakeSwap says it runs no PHP at all, and @binance says it had safeguards in place before the patch. PHP also disclosed a third bug on Oct 23. It only hits an unusual session setup and one config switch blocks it, so there's no emergency release, but teams still have cleanup left to do.

What I'd do this week:
- read the spender and amount on every approval, even on sites you use daily
- treat a sudden "re-approve" or "migrate" prompt as a warning sign
- revoke old unlimited approvals you don't need

Binance has announced that Binance Feed has been rebranded as Binance Square, evolving from a content aggregator to a social platform that, in addition to supporting news, facilitates communication between content creators and followers. In addition to this, Binance Square recently launched a tipping option to reward creators for their content contributions.