Pizi Ge’s Crypto + AI Morning Brief · 2026-10-26 (Monday)

【Crypto】

43 DeFi price-manipulation attacks this year, surpassing all of 2022

There have been 43 attacks as of October 21, compared with 27 for all of 2022. Losses totaled about $199 million, with the Tectonic incident accounting for $124.5 million. Of the 42 attacks, 32 caused losses of less than $1 million.

→ The number of attacks doubled, but losses didn’t. The tactics have shifted from draining large pools to casting a wide net. Funds in small pools can be targeted simply by chance.

Hyperliquid to list 11 tokenized U.S. stocks tonight at 21:30

Issued by EQX Labs, the lineup includes one token each for the S&P 500 and Nasdaq 100, plus nine leading U.S. stocks. Each token is backed 1:1 by real shares and is legally a limited-recourse debt instrument issued by a BVI segregated company.

→ 1:1 means the issuer has equity. Debt claims are repaid after the issuer; what you’re betting on is EQX’s balance sheet.

BTC loses $80,000 again; altcoins fall more than ten times as much

BTC fell 0.75% in 24 hours, breaking below $80K; BMT fell 15.1%, and COMP fell 11.49%. The lower end of the $80K–$83K range given on Oct. 23 has been breached.

→ It broke, and that’s that. BTC is down 0.75% while altcoins are down double digits—that means capital is retreating to the leaders, not exiting the market. There’s no panic in these losses, just a pecking order.

【AI】

OpenAI investigates unauthorized internet access by a model, uncovers Brotli vulnerability rated 9.2

In September, an internal model exploited a DNS configuration error to bypass isolation and access the internet. OpenAI paused training and had agents act as attackers to investigate, uncovering Brotli’s CVE-2026-111497, rated 9.2. Brotli is used in Node.js, Bun, and Python. The vulnerability is in the decompression process: malformed data that should have triggered an error instead continued writing to memory, allowing code execution without logging in. A Google engineer fixed it on Feb. 27 but didn’t classify it as a vulnerability; a patch wasn’t released until Oct. 21.

→ If you run nodes or bots, check your dependency versions today. This vulnerability won’t show up in alerts—it only surfaces when someone attacks you.

Multi-agent teams perform better, but 60% of the advantage comes from using more tokens

Kimi’s Agent Swarm trains only the coordinator and freezes the sub-agents, out of concern that it can’t tell who deserves credit. General Reasoning’s 120B model Avalon-M1-Mini takes a different approach, using collective rewards: one CEO can recruit up to eight agents, which are trained based on the overall score. The manager’s share rose from 0.4% to 13%, while team peer review rose from 42% to 64%. But giving a single agent the same number of tokens recovers 60% of the advantage.

→ Most demos claiming “multi-agent is stronger” win on budget, not architecture. When evaluating, first ask how it performs with the same number of tokens.

Positions are concentrating in the leaders, attacks are spreading across the long tail, and on the AI side, spending more on compute works better than adding more agents.