BASED News & Signals

news5h agonews

New governance forum thread at: @LlamaRisk Risk Stewards: Cap Increases on Aave V4 / 2026.10.26 [Risk] Summary LlamaRisk recommends the following parameter changes based on user behavior, on-chain liquidity, and position health observed in the latest review of Aave V4 reserves. Aave V4 Ethereum: Increase the add cap for USDC on the Core Hub Main Spoke from 50M to 75M. Increase the draw cap for USDC on the Core Hub Forex Spoke from 5M to 8M. Increase the draw cap for USDC on the Core Hub Gold Spo... https://governance.aave.com/t/risk-stewards-cap-increases-on-aave-v4-2026-10-26/25926/1

62/100·B+Long+3

news7h agonews

Last week in Bitcoin: → Bitcoin fell to roughly $79,978, its weakest level since September 18, as markets de-risked ahead of Wednesday's FOMC decision. → US spot Bitcoin ETFs logged roughly $301 million of net inflows for the week then shed about $773 million across October 23 and 24. → JPMorgan Asset Management projects a 10% annualized return on Bitcoin over 10 to 15 years, above its 7.5% for US large-caps and 5.5% for gold. → Strategy paused Bitcoin buys to repurchase $205 Million of its preferred stock STRC between October 19 and 25. → Strive bought 6,182 BTC for about $511 million to reach 43,000 and fourth place among public holders. → Metaplanet chose a $122.4 million stock buyback over new BTC and won shareholder approval for its 2,100 BTC Super League takeover. → Franklin Templeton's two Bitcoin "DRIP" ETFs (FBEQ and FIBT), which reinvest stock dividends into BTC, cleared a Nasdaq listing registration step. → BlackRock filed for a buffered "Managed Protection" Bitcoin ETF (PBIT) that caps upside to limit downside. → Arkadiko, a Stacks-based lending protocol, was drained of about $1.09 million in a governance attack that minted 1.5 billion USDA and broke the stablecoin's peg. → Bitcoin Core maintainers rewrote the security disclosure policy on October 22, fast-tracking fixes and advisories for "easily discoverable" bugs.

25/100·CNeutral+13

news7h agonews

Payward, the parent company of Kraken, announced its intention to be the first CFTC-regulated deployer on HIP-3* markets. Payward will use Hyperliquid as the infrastructure layer to deploy perpetual futures markets for US clients. Subject to regulatory approval, Bitnomial, Payward’s CFTC-regulated DCM and DCO, would act as the HIP-3* deployer: creating, owning, and administering the markets and clearing and settling the contracts. If approved, NinjaTrader Clearing, Payward’s CFTC-registered FCM, would carry client accounts.

HIP-3 will support optional deployer configuration for permissioned markets in a future network upgrade. This set of additional deployer functionality is collectively called HIP-3. At its core, HIP-3 activation involves an onchain allowlist managed by the deployer or its sub-deployers. The functionality is strictly additive to HIP-3; its use is optional and up to the deployer. Existing markets remain unchanged. The initial release is available on testnet, where specifications are preliminary and subject to change based on feedback.

Hyperliquid is a neutral infrastructure layer with the goal of supporting large parts of the financial system. HIP-3* gives deployers additional functionality to operate deployments consistent with the requirements applicable to them. As with HIP-3, HIP-3* deployers are independent operators who use Hyperliquid as the onchain infrastructure layer for their own markets, while retaining control and responsibility over their deployment.

78/100·ALong+2

twitter8h agomeme

@BSCNews 🫡 🪶 Reply to @BSCNews: What is Plume Network Trying to Bring Onchain? From real estate to private credit, Plume Network (@plumenetwork) $PLUME is building infrastructure designed to bring real-world financial assets onto the blockchain. The idea isto make assets that have traditionally been difficult to access, trade, or manage available through blockchain-based financial products. But what does that actually mean? (1) It starts with real-world assets (RWAs). These are assets that exist outside crypto, including property, private credit, and other financial instruments. Plume aims to connect these assets to onchain markets, where ownership and transactions can be represented through tokens. (2) Property is only part of the picture. Real estate has become a familiar example of tokenization, but Plume’s broader focus extends to private credit and other income-generating assets. Private credit involves loans made outside traditional public bond markets, often to businesses. In October 2026, Plume launched a vault giving exposure to Fidelity’s Total Bond ETF. (3) The goal is to make these assets usable in DeFi. Tokenizing an asset is only one step. Plume is designed to support infrastructure that allows tokenized real-world assets to connect with blockchain applications, potentially enabling investors to use them in onchain financial strategies. Its Nest vaults, which package RWA yield, now run on chains including Ethereum (@ethereum) $ETH, Solana (@solana) $SOL, and Monad (@monad) $MON. (4) Access does not mean risk disappears. Real-world assets still depend on legal agreements, asset managers, borrowers, and the quality of the underlying investments. Tokenization does not automatically make an asset liquid, guarantee returns, or remove credit risk. In October 2025, Plume registered with the SEC as a transfer agent, which lets it keep shareholder records onchain.

10/100·CNeutral+6

meme9h agomeme

MERCK $MRK'S SAC-TMT GETS FDA PRIORITY REVIEW, PDUFA DATE SET FOR JUNE 15, 2027 • The FDA accepted the biologics license application for sacituzumab tirumotecan (sac-TMT) for priority review • Sac-TMT reduced the risk of death by 32% and the risk of disease progression or death by 41% vs chemotherapy in certain patients with advanced or recurrent endometrial cancer • Merck says safety was consistent with previously reported studies of sac-TMT, with no new safety signals • Merck says it is hopeful for approval before the PDUFA date, based on discussions with the FDA

78/100·ALong

listing10h agolisting

Binance: 币安哈萨克斯坦：截至 2026 年 10 月 26 日可用代币列表 X/USD - - - - - - - - -Notice Details- - - - - - - - - - - This is a general announcement. Products and services referred to here may not be available in your region. Fellow Binancians, We inform you of the current list of digital assets available for trading on Binance Kazakhstan as of 2026-10-26. Spot (495): 0G, CAT, CHEEMS, SATS, 1INCH, 1MBABYDOGE, 2Z, A, AAOIB, AAPLB, AAVE, ACE, ACH, ACM, ACT, ADA, ADBEB, ADX, AERO, AEVO, AGLD, AGPUB, AI, AIGENSYN, AIXBT, ALABB, ALGO, ALICE, ALLO, ALPINE, ALT, AMATB, AMCB, AMDB, AMP, AMZNB, ANIME, ANKR, APE, API3, APT, AR, ARB, ARK, ARKM, ARMB, ARPA, ASMLB, ASR, ASTER, ASTR, ASTSB, AT, ATM, ATOM, AUCTION, AUDIO, AVA, AVAX, AVGOB, AVNT, AWE, AXL, AXS, AXTIB, BABAB, BABY, BANANA, BANANAS31, BAND, BANK, BAR, BARD, BAT, BB, BBB, BCH, BEB, BEL, BERA, BICO, BIGTIME, BIO, BLUR, BMNRB, BMT, BNB, BNSOL, BNT, BOME, BONK, BREV, BROCCOLI714, BTC, BTTC, C, C98, CAKE, CATI, CBRSB, CELO, CELR, CETUS, CFG, CFX, CGPT, CHIP, CHR, CHZ, CITY, CKB, COHRB, COINB, COMP, COOKIE, COTI, COW, CRCLB, CRDOB, CRMB, CRV, CRWDB, CRWVB, CTK, CTSI, CVC, CVX, CYBER, CYPHB, DELLB, DEXE, DGB, DIA, DJTB, DODO, DOGE, DOGS, DOLO, DOT, DRAMB, DYDX, DYM, EDEN, EDU, EGLD, EIGEN, ENA, ENJ, ENS, ENSO, ERA, ESP, ETC, ETH, ETHFI, EUL, EURI, EWYB, F, FDUSD, FET, FF, FIDA, FIL, FLNCB, FLOKI, FLOW, FLUX, FOGO, FORM, FRAX, FTT, FWDIB, G, GALA, GAS, GENIUS, GIGGLE, GLM, GLMR, GLWB, GMEB, GMT, GMX, GNO, GNS, GOOGLB, GPROB, GPS, GRAM, GRT, GSB, GTC, GUN, HAEDAL, HBAR, HEI, HEMI, HIMSB, HIVE, HMSTR, HOLO, HOME, HOODB, HOT, HPEB, HUMA, HYPE, HYPER, IBMB, ICP, ID, ILV, IMX, INIT, INJ, INTCB, INTWB, IO, IOST, IOTA, IOTX, IQ, IRENB, JASMY, JOE, JPMB, JST, JTO, JUP, JUV, KAIA, KAITO, KAT, KAVA, KERNEL, KGST, KITE, KMNO, KNC, KORUB, KSM, LA, LAYER, LAZIO, LDO, LINEA, LINK, LISTA, LITEB, LLYB, LPT, LQTY, LSK, LTC, LUMIA, LUNA, LUNC, MAGIC, MANA, MANTA, MANTRA, MARSCOIN, MASK, MAV, MBL, MDBB, ME, MEGA, MEME, MET, METAB, METIS, MINA, MIRA, MITO, MMT, MORPHO, MOVE, MOVR, MRNAB, MRVLB, MSFTB, MSTRB, MTL, MUB, MUBARAK, MUUB, MVLLB, NBISB, NEAR, NEIRO, NEO, NEWT, NEXO, NFLXB, NIGHT, NIL, NMR, NOKB, NOM, NOT, NVDAB, NXPC, OG, OGN, ONDO, ONE, ONG, ONT, OP, OPEN, OPG, OPN, ORCA, ORCLB, ORDI, OSMO, PARTI, PAXG, PDDB, PENDLE, PENGB, PENGU, PEOPLE, PEPE, PIXEL, PLTRB, PLUME, PNUT, POL, POLYX, PORTAL, PORTO, POWR, PROM, PROVE, PSG, PUMP, PUNDIX, PYPLB, PYTH, QCOMB, QI, QKC, QNT, QNTB, QQQB, QTUM, RAD, RARE, RAY, RDDTB, RE, RED, RENDER, REQ, RESOLV, REZ, RIF, RKLBB, RLUSD, ROBO, RONIN, RPL, RSR, RUNE, RVN, RWUSD, S, SAGA, SAHARA, SAND, SANTOS, SAPIEN, SC, SCR, SECZB, SEI, SENT, SFP, SHAZB, SHELL, SHIB, SIGN, SKHYB, SKL, SKY, SLP, SMCIB, SMHB, SNDKB, SNX, SNXXB, SOL, SOLV, SOMI, SOPH, SOXLB, SOXSB, SPCXB, SPELL, SPK, SPYB, SQQQB, SSV, STEEM, STO, STRAX, STRK, STX, STXB, SUI, SUN, SUPER, SUSHI, SXT, SYN, SYRUP, T, TAO, TFUEL, THE, THETA, TIA, TKO, TLM, TNSR, TOWNS, TQQQB, TRB, TREE, TRUMP, TRX, TSLAB, TSMB, TST, TURBO, TURTLE, TUT, TWT, U, UMA, UNI, USARB, USD1, USDC, USDE, USDEB, USDS, USDT, USTC, USUAL, UVXYB, VANA, VELODROME, VET, VIRTUAL, VTHO, W, WAL, WAXP, WBETH, WBTC, WCT, WDCB, WENB, WIF, WIN, WLD, WLFI, WOO, XAI, XAUT, XEC, XLM, XNO, XPL, XRP, XTZ, XUSD, XVS, YB, YFI, YGG, ZBT, ZIL, ZK, ZKC, ZKP, ZMB, ZRO, ZRX, 币安人生, 牛来 USDⓈ-M and COIN-M Futures (729 underlying assets, including TradFi contracts on equities, ETFs, commodities and indices): 0G, 1INCH, 1MBABYDOGE, 2Z, 4, A, AAOI, AAPL, AAVE, ACE, ACH, ACN, ACT, ACU, ADA, ADBE, AERO, AEVO, AGLD, AGPU, AGT, AIA, AIGENSYN, AIN, AIO, AIOT, AIXBT, AKAM, AKE, AKT, ALAB, ALCH, ALGO, ALICE, ALL, ALLO, ALPINE, ALT, AMAT, AMC, AMD, AMZN, ANET, ANIME, ANKR, ANTHROPIC, APE, API3, APLD, APP, APR, APT, AR, ARB, ARC, ARIA, ARK, ARKM, ARM, ARPA, ARX, ASML, ASR, ASTER, ASTR, ASTS, AT, ATH, ATOM, AUCTION, AVA, AVAAI, AVAX, AVGO, AVNT, AWE, AXL, AXS, AXTI, AZTEC, B, B2, BABA, BABY, BAN, BANANA, BANANAS31, BAND, BANK, BARD, BAS, BASED, BAT, BB, BBX, BCH, BE, BEAT, BEL, BERA, BICO, BIGTIME, BILL, BIO, BIRB, BITO, BLESS, BLUAI, BLUR, BMNR, BMT, BNB, BNC, BNT, BOME, BONK, BOT, BR, BRETT, BREV, BRKB, BROCCOLI714, BROCCOLIF3B, BSB, BSP, BSV, BTC, BTCDOM, BTR, BTW, BULLA, BWET, BX, BYD, BZ, C, C98, CAKE, CAP, CARV, CAT, CATI, CBRS, CC, CELO, CELR, CETUS, CFG, CFX, CGPT, CHEEMS, CHILLGUY, CHIP, CHR, CHZ, CIEN, CKB, CL, CLANKER, CLO, COAI, COHR, COIN, COLLECT, COMP, COOKIE, COPPER, COST, COTI, COW, CRCL, CRDO, CRM, CRML, CROSS, CRV, CRWD, CRWV, CSCO, CSOPSAMSUNG2L, CSOPSKHYNIX2L, CT, CTK, CTR, CTSI, CVC, CVNA, CVX, CXMT, CYBER, CYPH, CYS, DATAIP, DDOG, DEEP, DELL, DEXE, DIA, DIS, DJT, DKNG, DODOX, DOGE, DOGS, DOLO, DOOD, DOS, DOT, DRAM, DRIFT, DYDX, DYM, EBAY, EDEN, EDGE, EDU, EGLD, EIGEN, ELSA, ENA, ENJ, ENS, ENSO, ERA, ESP, ESPORTS, ETC, ETH, ETHFI, ETHW, EUL, EVAA, EWJ, EWT, EWY, EWZ, F, FARTCOIN, FET, FF, FHE, FIDA, FIGHT, FIL, FLEX, FLNC, FLOCK, FLOKI, FLOW, FLUID, FLUX, FOGO, FOLKS, FORM, FRAX, FWDI, G, GALA, GAS, GDX, GENIUS, GEV, GIGADEV, GIGGLE, GLM, GLW, GME, GMT, GMX, GOAT, GOOGL, GPRO, GPS, GRAM, GRASS, GRIFFAIN, GRT, GRVT, GS, GTC, GTLB, GUA, GUN, GWEI, H, HAEDAL, HANA, HANMI, HBAR, HD, HEI, HEMI, HIMS, HIVE, HK0625, HK0700, HK0992, HK1810, HMSTR, HOLO, HOME, HOOD, HOT, HPE, HUMA, HUT, HYPE, HYPER, HYUNDAI, IBM, ICNT, ICP, ID, IDOL, ILV, IMX, IN, INIT, INJ, INTC, INTW, INX, IO, IONQ, IOST, IOTA, IOTX, IREN, IRYS, IWM, JASMY, JCT, JELLYJELLY, JOE, JPM, JST, JTO, JUP, KAIA, KAITO, KAS, KAT, KAVA, KERNEL, KGEN, KITE, KLAC, KMNO, KNC, KO, KODEX200, KOMA, KORU, KSM, KSTR, KUAISHOU, LA, LAB, LAYER, LDO, LGELECTRONICS, LIGHT, LINEA, LINK, LISTA, LIT, LITE, LLY, LPT, LQTY, LRCX, LSK, LTC, LUMIA, LUNA2, LUNC, LYN, LYTE, M, MAGIC, MAGMA, MANA, MANTA, MANTRA, MARA, MARSCOIN, MASK, MAV, MAVIA, MCD, MDB, ME, MEGA, MEITUAN, MELANIA, MEME, MERL, MET, META, METIS, MEW, MINA, MINIMAX, MIRA, MMT, MOCA, MOG, MON, MOODENG, MOONSHOT, MORPHO, MOVE, MOVR, MP, MRK, MRNA, MRVL, MSFT, MSTR, MSTU, MTL, MU, MUBARAK, MUU, MVLL, MYX, NAORIS, NATGAS, NAVER, NBIS, NEAR, NEIRO, NEO, NET, NEWT, NFLX, NIGHT, NIL, NKE, NMR, NOK, NOM, NOT, NOW, NVDA, NVDL, NVO, NXPC, O, OG, OGN, OKLO, ON, ONDO, ONDS, ONE, ONG, ONT, OP, OPEN, OPENAI, OPG, OPN, ORCA, ORCL, ORDER, ORDI, OURA, PANW, PARTI, PATH, PAXG, PAYP, PDD, PENDLE, PENG, PENGU, PEOPLE, PEPE, PHAROS, PIEVERSE, PIPPIN, PIXEL, PLAY, PLTR, PLUME, PNUT, POL, POLYX, PONS, POPCAT, POPMART, PORTAL, POWER, POWR, PRL, PROM, PROVE, PUMP, PUNDIX, PYPL, PYTH, Q, QCOM, QNT, QNTX, QQQ, QTUM, RAM, RARE, RATS, RAVE, RAYSOL, RDDT, RDW, RE, RECALL, RED, RENDER, RESOLV, REZ, RIF, RIVER, RIVN, RKLB, ROBO, RONIN, RPL, RSR, RUM, RUNE, RVN, S, SAFE, SAGA, SAHARA, SAMSUNG, SAMSUNGEM, SAND, SANTOS, SAPIEN, SATS, SCR, SECZ, SEI, SENT, SFP, SHAZ, SHELL, SHIB, SHOP, SIGN, SIREN, SKDD, SKHY, SKHYNIX, SKL, SKR, SKUU, SKY, SKYAI, SLP, SLX, SMCI, SMH, SNDK, SNOW, SNPS, SNX, SNXX, SOFI, SOL, SOLV, SOMI, SONIC, SONY, SOON, SOPH, SOXL, SOXS, SPACE, SPCX, SPELL, SPK, SPORTFUN, SPX, SPY, SQD, SQQQ, SSV, STABLE, STAR, STBL, STEEM, STO, STRC, STRK, STX, STXX, SUI, SUN, SUPER, SUSHI, SWARMS, SXT, SYN, SYRUP, T, TA, TAC, TAG, TAIKO, TAKE, TAO, TBT, TEAM, TEM, TENCENT, TER, THE, THETA, TIA, TLM, TMF, TNSR, TOSHI, TOWNS, TQQQ, TRADOOR, TRB, TREE, TRIA, TRUMP, TRUST, TRUTH, TRX, TSLA, TSLL, TSM, TST, TTWO, TURBO, TURTLE, TUT, TWST, TWT, TXN, TZA, UAI, UB, UBER, UMA, UNH, UNI, UNITREE, URNM, US, USAR, USDBRL, USDC, USDEX, USELESS, USTC, USUAL, UVXY, V, VANA, VELODROME, VELVET, VET, VIRTUAL, VKTX, VRT, VST, VTHO, VVV, W, WAL, WAXP, WCT, WDC, WEN, WET, WIF, WLD, WLFI, WMT, WOO, XAG, XAI, XAN, XAU, XAUT, XBI, XEC, XLE, XLM, XNY, XOM, XPD, XPIN, XPL, XPT, XRP, XTZ, XVS, YB, YFI, YGG, ZBT, ZCSH, ZEREBRO, ZEST, ZETA, ZHIPU, ZHONGJI, ZIL, ZK, ZKC, ZKP, ZM, ZORA, ZRO, ZRX, 哈基米, 币安人生, 我踏马来了, 牛来, 龙虾 Notes: This list is subject to change. Binance Kazakhstan announces new listings and delistings separately. Please refer to Binance Announcements page for the latest updates.Trading availability depends on the user's country or region and requires account verification.Spot and Futures lists are independent: a token available on Futures may not be available on Spot, and vice versa. Reminder: Users must exercise sufficient risk management and DYOR (do your own research) to fully understand the digital asset before opting to trade. Note: There may be discrepancies between this original content in English and any translated versions. Please refer to the original English version for the most accurate information, in case any discrepancies arise. Thank you for your support! Binance Kazakhstan Team 2026-10-26 Trade on-the-go with Binance’s crypto trading app (iOS/Android) Find us on Telegram NewsTelegram ChatWhatsApp ChannelInstagram Binance reserves the right in its sole discretion to amend or cancel this announcement at any time and for any reasons without prior notice. Binance Kazakhstan Kazakhstan is authorised by the financial regulator of the AIFC, Astana Financial Services Authority (“AFSA”), to conduct the activities of Operating Digital Asset Trading Facility, Providing Custody and Dealing in Investments as Principal.Status of the licence and its validity may be verified at the AFSA website (www.afsa.kz). Risk warning: Digital Asset prices can be volatile. The value of your investment may go down or up and you may not get back the amount invested. You are solely responsible for your investment decisions and Binance Kazakhstan Kazakhstan is not liable for any losses you may incur. For more information, please refer to our Terms of Use and Risk Warning. Please also note that data relating to the above-mentioned cryptocurrency presented here (such as its current live price) are based on third-party sources. They are presented to you on an “as is” basis and for informational purposes only, without representation or warranty of any kind. Links provided to third-party sites are also not under Binance Kazakhstan's control. Binance Kazakhstan is not responsible for the reliability and accuracy of such third-party sites and their contents. Binance Kazakhstan Astana, 010000, Esil district, 16, Dostyk, office 2501

+896

news11h agonews

BAM vs. kcompactd: how we fixed small blocks with two sysctls

How we traced BAM small blocks from the leader window down to a memory-compaction daemon on the Linux host
Authors: BAM Performance Team
Summary
In late September, about one in every 800 blocks built by BAM (Block Assembly Marketplace) came in under 7 million compute units. We call these small blocks (this is not a Solana-wide definition). The small block rate was low, but every small block is revenue a validator didnâ€™t earn and blockspace the network didnâ€™t use.
Over two weeks we found and fixed time losses in five layers: block replay in the BAM node, the BAM scheduler, the memory allocator, Linux TCP congestion control, and the Linux kernel on the physical hosts that run our TEE VMs. All of these changes made a measurable difference. One change explains most of the drop in small blocks, and it was a kernel scan on the Linux host that slowed our TEE VMs for about 48 seconds out of every 80.
This technical post covers the leads we chased, what each fix did and didnâ€™t change, and the unexpected culprit.
We want to give a special thanks to Alessandro Decina (@alessandrod) from Anza. Slowlana was a critical observability tool to identify where a small block lost useful leader time (replay/bank readiness, scheduling, or Turbine propagation) and validate fixes against normal slots to deliver the results presented in this post.
Background: How Jito BAM builds a block
Jito BAM runs inside an AMD SEV-SNP [1] confidential Trusted Execution Environment (TEE) Virtual Machine (VM), which we call the TEE VM. Each TEE VM has about 736 GiB of RAM and 119 vCPUs, and runs alone on a dedicated physical Linux machine, the host. The BAM node follows the chain itself: it replays every block to keep its own bank current, and it stays connected to each validator it serves.
A leader gets four consecutive slots. During this investigation each slot was 250 ms long [2, 11]. For each slot, BAM works through three steps:

Bank handoff. The parent blockâ€™s shreds arrive, BAMâ€™s replay executes and freezes the block, the next bank is created, and the bank for the leaderâ€™s slot becomes usable.
Build. BAM runs an auction over pending transactions and bundles, then simulates the winners against speculative banks.
Forward. BAM streams batches to the leader validator, which executes them while its slot is still open.
All three steps share the same 250 ms. Time lost before the handoff and time lost during the build look identical from outside: a light block, or batches the validator rejects as OUTSIDE_LEADER_SLOT because they arrived after the targeted slot finished. A small block tells you that time ran out, but not where it went.
Problem deep dive: late banks
So we started at the bank handoff. We joined BAMâ€™s build and forward logs, validator feedback, replay metrics and leader schedules into a per-slot timeline, and reconstructed the first four small blocks one by one.
All four had the same shape. BAM made its first build 3.8â€“6.5 ms after the bank became usable and forwarded 5.1â€“14.1 ms after that. Building was fast in every case. The bank had arrived late.

Slow replay of the parent bank explained the delay. On our Frankfurt BAM node, we saw slot replay times of 415â€“602 ms, more than a full slot. In Singapore, one 5.9-second replay (4.8 s of it in program-cache work) created a backlog. The next leader rotation began while BAM was still catching up, so its first two slots were lost and the last two recovered.
One fix we tried was more replay parallelism. Raising replay worker threads from 8 to 16 to 24 gave no improvement; the mainnet transaction load was long dependency chains. Replay had enough threads, but each one was running slow. That raised the question the rest of this post answers: what was slowing them down?
Time Stealing Leads
Profiling the BAM node turned up four types of stall. The first slowed replay directly. The other three cost time after the handoff. Each was a real cost worth fixing, so weâ€™ll cover them briefly.
1. False sharing that slowed replay
We questioned why replay inside the BAM node was slower than it should have been, even on capable hardware. Something else in the node was getting in its way.
We found it in BAM's scheduling thread. While waiting for its leader slot, this thread checked the working bank about 3.1 million times a second, taking two read locks each time. A read lock looks harmless, but taking one still writes to memory, because it updates a counter inside the lock. Checking the bank's memory layout showed that those counters sat on the same cache lines as bank data replay reads constantly. Every time the scheduling thread took a lock, the CPU had to pull those cache lines away from the replay cores, often from a different CCX (a group of AMD EPYC cores that share an L3 cache). Replay then had to wait to pull them back.
This is called false sharing: the two threads never touched the same data, but sharing cache lines was enough to slow replay down. We moved the lock reads to only the ticks that need them, and the slowdown went away.

2. Bank destruction on the hot path
Our speculative banks store the speculative account state for the leaderâ€™s block. On slot transitions, we retire the speculative bank, freeing up tens of megabytes. Jemalloc, the memory allocated used by BAM, then returned those pages to the kernel with madvise, synchronously, on the main state machine thread. Inside a TEE VM, every discard can trigger TLB shootdowns across all vCPUs. One capture showed 366 MADV_DONTNEED calls costing 38.6 ms.
We moved destruction to a bounded reaper thread, upgraded to jemalloc 5.3.1, and enabled background_thread:true [6] so allocator threads do the purging.
3. Auction teardown and pacing
Wavefront, our Directed Acyclic Graph (DAG) based simulator, could wait on a straggling simulation long after its round stopped being useful. This could cause auction rounds to extend more than the intended time period and reduce the throughput. Teardown is now fenced and bounded to 5ms.
Separately, a pacing latch checked only the input queue and not work already admitted to the DAG, so bundle work could resume while ordinary transactions were still unfinished. In one slot, 179 transactions sat in the DAG with only 9 executed, and the latch still reported that the round was on pace.
4. Linux BBR at the start of the leader window
BAM streams batches to the validator over a TCP connection that uses Linux BBR (Bottleneck Bandwidth and Round-trip propagation time) congestion control [3, 4]. BBR paces sending from its own estimates of bandwidth and minimum round-trip time instead of reacting to packet loss. The connection is nearly idle between leader windows, and we found two kernel paths that could start the next window throttled:
A sub-MSS ACK after idle could push BBR into PROBE_RTT, capping the congestion window at four packets for about 200 ms.
A sub-MSS sent into an empty pipe could make BBR conclude that bandwidth had collapsed.
We shipped a userspace workaround (padding the first batch to 3,000 bytes) and two patches to net/ipv4/tcp_bbr.c [5] in our TEE VMâ€™s kernel. The first keeps BBRâ€™s idle-restart guard in place until a fresh min-RTT sample arrives:

The second treats a send of less than one MSS into an empty pipe as app-limited, so the small first write isnâ€™t mistaken for a bandwidth sample:

What fixing all four changed
Every one of the four stall types was real, and every fix worked. When the scheduler fixes reached production on October 2, the longest Wavefront cleanup dropped from 65.7 ms to 5.9 ms, and main loop gaps over 5 ms went from 54 to zero.

But the fleetâ€™s small-block rate barely moved. We had removed real stalls, and something else was still slowing every thread.
The mysterious TEE VM slow hash rate
Having followed the other leads to the end, we came across a pattern in a metric we couldnâ€™t explain.
TEE VMs emit Agaveâ€™s poh-service metric, the time the Proof of History (PoH) hash loop takes per hash. This metric, being CPU-bound, is expected to be flat. On the contrary, every TEE VM showed a square wave, alternating between a fast mode and a mode 7â€“17% slower. The slow mode typically lasted 45â€“55 seconds, then the fast mode about 32 seconds, and the cycle repeated around the clock. Nothing in the TEE VMâ€™s workload ran on that cycle.

That surprised us. Our hosts pin every CPU to the performance frequency governor specifically to avoid throughput swings from frequency changes, so a 7â€“17% swing in vCPU speed shouldnâ€™t have been there.
Turns out the answer was outside the TEE VM, in the Linux kernel on the host side. QEMU backs the TEE VMâ€™s RAM with a memfd, and the host kernelâ€™s kcompactd daemon periodically tries to build contiguous free memory by isolating and migrating pages [7]. We had locked the TEE VMâ€™s memory, and locked pages land on the unevictable LRU [8]. But unevictable doesnâ€™t mean unmovable: with the default vm.compact_unevictable_allowed=1, the host kernel still tries to migrate them.
So on every pass, the hostâ€™s kcompactd scanned about 191 million pages, essentially the whole 736 GiB TEE VM. It worked through them for 45â€“55 seconds, never completed a successful compaction, and backed off for 500 ms << 6 = 32 s before starting again. Each attempt went through the KVM MMU notifier and invalidated the TEE VMâ€™s memory mappings. The TEE VM paid the full cost every cycle, and the host never got any contiguous memory out of it.
The numbers lined up closely. We compared each hostâ€™s page-isolation rate with its own TEE VMâ€™s slow-mode fraction over October 2â€“5, in 30-second intervals. On all ten hosts with PoH data, the two correlated at r = 0.94â€“0.99. Pairing a host with a different hostâ€™s TEE VM gave r â‰¤ 0.11. TEE VM memory size divided by the hostâ€™s average scan rate also predicted the cycle period on 28 of 30 hosts, with an average error of 1.8% and a worst case of 4.4%.

TEE VM memory was already locked with QEMU -overcommit mem-lock=on-fault [9], so the fix was two runtime sysctls on the host side [10]:
vm.compact_unevictable_allowed=0, so locked pages are never isolated for compaction
vm.compaction_proactiveness=0, so there is no background compaction pass
On October 5, between 21:44 and 21:52 UTC, we applied the fix to all 15 warm-spare hosts. The 15 serving hosts stayed unfixed, which gave us a control group.

This canary proved the hostâ€™s scan was throttling the TEE VMâ€™s vCPUs. The fixed hosts were spares, though, and werenâ€™t producing blocks, so the canary couldnâ€™t show that the throttling caused small blocks. For that we needed a different experiment.
Results
Proving causation on hosts that were producing blocks
The slow mode is periodic, so it works as a natural experiment. On any unfixed host that was serving traffic, each block was produced during either a slow phase or a fast phase. Everything else is the same between the two: the host, the build, the validators connected to it, the time of day. If the slow mode causes small blocks, small blocks should pile up in the slow phase.
We took the six unfixed hosts that served the most traffic from October 2 to 5. For each 5-second window, we classified the TEE VM as slow or fast using the midpoint between that hostâ€™s 10th and 90th percentile hash time. Then we placed each of 293,000 produced BAM blocks on that timeline.

The slow phase covered about 62% of the time and 63% of all blocks. It also held 89% of the small blocks.

A block built during a compaction pass was 4.8 times as likely to be small (95% CI: 3.4â€“6.9Ã—). The effect showed up on every host individually, ranging from 2.3Ã— on the mildest to 17Ã— on the most affected.
Fleet impact
On October 6 we moved serving traffic to the warm spares, which had received the host-side fix the day before. Before the fix, their TEE VMs had run in the slow mode with a 9â€“12% PoH spread. After the fix that spread was about 1.2%, and hashing was about 9% faster overall.

The small-block rate fell by about 77%, from about one block in 800 to one in 3,600.
The phase analysis predicts almost exactly that. Before the fix, fast-phase blocks were small 0.031% of the time. After the fix, everything runs in what used to be the fast phase, and the fleet came in at 0.028%. Removing the slow mode accounts for nearly the whole drop.
What the other fixes did:
Scheduler and allocator fixes: removed real tail latency and stopped BAM from slowing replay. They may have lowered small blocks too, but they shipped alongside host changes, so we canâ€™t measure their share.
Linux BBR fixes: closed a real throttling path, confirmed by a reproducer, with no visible change in the fleet small-block rate.
Late-forward rejections (OUTSIDE_LEADER_SLOT): fell from 6.3â€“7.9% of validator responses to 4.4â€“4.6% from October 7, so more of each leader window is now usable.
We started out hunting for a scheduler bug, and the largest single win turned out to be two sysctls on the host kernel.
Comparison across clients
With these improvements in place, we compared BAMâ€™s block-packing performance against other clients, measured by the share of small blocks (under 7M CU) produced. We looked at the period before the initial fixes (Sep 16â€“29) and after they were finalized (Oct 9â€“20).
In aggregate, the share of small blocks produced by BAM leaders fell from 0.1044% to 0.0325%, a 69% improvement. Over the same period, the rest of the cluster moved in the opposite direction: the non-BAM small-block share rose 73.7%, from 0.2911% to 0.5056%.
As a result, the gap widened significantly. In September, non-BAM leaders produced small blocks at about 2.8x the rate of BAM leaders; by October, that rate was 15.6x.

Conclusion
Every fix in this post started the same way: a per-slot timeline or a profile, a controlled test, then a before-and-after measurement in production. Four of those fixes removed real stalls inside BAM, but we couldnâ€™t tie any of them to a measurable drop in small blocks. The change that mattered most was two lines of host config, outside the TEE VM entirely. We found it only because we kept measuring after fixing the obvious suspects, when the small-block rate still hadnâ€™t moved much.
There is still more work to do. About one BAM block in 3,600 still comes in small. Since writing this, weâ€™ve been working on faster ingress, simulation, bundle filtering, and other performance improvements.
What do you want us to write about next? Let us know by tagging @buffalu__ on x or in #validator-general in Discord.
References
AMD, â€œAMD SEV-SNP: Strengthening VM Isolation with Integrity Protection and More,â€� white paper. https://www.amd.com/content/dam/amd/en/documents/epyc-business-docs/white-papers/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf
Anza, â€œLeader Rotation,â€� Agave validator documentation. https://docs.anza.xyz/consensus/leader-rotation
N. Cardwell, Y. Cheng, C. S. Gunn, S. Hassas Yeganeh and V. Jacobson, â€œBBR: Congestion-Based Congestion Control,â€� ACM Queue 14(5), 2016. https://queue.acm.org/doi/full/10.1145/3012426.3022184
IETF CCWG, â€œBBR Congestion Control,â€� Internet-Draft draft-ietf-ccwg-bbr. https://datatracker.ietf.org/doc/draft-ietf-ccwg-bbr/
Linux kernel source, net/ipv4/tcp_bbr.c. https://github.com/torvalds/linux/blob/master/net/ipv4/tcp_bbr.c
jemalloc manual, background_thread option. https://jemalloc.net/jemalloc.3.html
Linux kernel documentation, â€œPage migration.â€� https://docs.kernel.org/mm/page_migration.html
Linux kernel documentation, â€œUnevictable LRU Infrastructure.â€� https://docs.kernel.org/mm/unevictable-lru.html
QEMU documentation, -overcommit mem-lock=on|off|on-fault. https://www.qemu.org/docs/master/system/invocation.html
Linux kernel documentation, /proc/sys/vm: compact_unevictable_allowed and compaction_proactiveness. https://docs.kernel.org/admin-guide/sysctl/vm.html
Solana, â€œReduced Slot Timesâ€� (SIMD-0525). https://solana.com/upgrades/reduced-slot-times

Methodology: small block = heartbeat-attributed, BAM-produced block below 7,000,000 cost units, from bam.enriched_block_stats. Phase classification uses poh-service total_hash_time_us / hashes in 5-second windows. One validator that produced only small blocks (68 of 68) from October 2 to 5 is excluded as a validator-side outlier. Confidence intervals are Poisson.(Historical earnings: For 2026Q2 (period ended 2026-06-27), AMD reported basic EPS of 2.26, diluted EPS of 2.22, net income of USD 3.680 billion, and revenue of USD 21.789 billion. Consensus expectations: For 2026Q3, consensus expects EPS of 1.9346 and revenue of USD 13.078 billion.)

10/100·CNeutral+23

meme17h agomeme

🌴🤖 AI-powered travel is taking a major step forward! @AEON_Community has launched Agentic Checkout V2 with @travalacom, enabling AI agents to search, compare, and book hotels based on your destination, dates, group size, and budget. 🏨✨ 🔑 What makes it stand out? 💳 Dedicated on-chain wallets for AI agents 🔍 Transparent, trackable transactions 🌐 Expanded utility beyond e-commerce into real-world travel bookings AI is moving beyond recommendations and into execution, turning digital assistants into active participants in the economy. ⚡️ AEON is building the infrastructure to make this evolution possible, connecting AI agents with payments and on-chain fund management. 🚀 The future of autonomous travel is taking shape. Explore what Agentic Checkout V2 can do! #AEON #AgenticCheckout #AgenticEconomy #AI #Travala Retweeted by @travalacom from @0xAndrewKeller

62/100·B+Long

news22h agonews

Yemen-Based Houthis Say They Attacked Saudi Arabia’s East-West Crude Oil Pumping Stations with Drones; No Immediate Saudi Confirmation

72/100·B+Long

meme10/25meme

this post here is causing unnecessary drama people are somewhat mad because the @Zcash account is educating the community on ongoing R&D by @ShieldedLabs (an independent zcash contributor) -- in a harmless post that clearly categorizes it as "proposed" some more context ⬇️ crosslink is a proposed hybrid pow/pos upgrade for zcash. nothing is decided. both research, development and community discussions are still ongoing. it keeps mining for block production and adds a parallel finality gadget so confirmed blocks become irreversible in practice. shielded labs is the independent swiss organization building it. founded in late 2022 by @aquietinvestor as a donation-funded group outside the development fund and block rewards. @zooko is CPO there. the team has former ECC and equilibrium people plus other protocol engineers. their whole point is to add independent capacity so Zcash is less dependent on any single US-based entity. that's great for decentralization! they published the crosslink roadmap in march 2025 and have been shipping prototype milestones since then (placeholders, disconnected BFT, PoW respecting finality, staking semantics). by early 2026 the prototype phase was done and they moved into incentivized feature nets and productionization. so roughly a year and a half of public implementation work on top of earlier design discussion. it matters because pure pow tends to centralize over time. bitcoin started with many miners of similar size and now two mining pools produce more than half the blocks. that's an inevitable outcome for the game theories behind BTC pow. i've written extensively about that (and others have too). larger operators get more rewards, buy more specialized hardware, and smaller ones get priced out by difficulty and energy costs. capital is tied to equipment that can be pointed at other chains or sold, so the network stake is weak. in a hybrid setup the pos side puts value at stake that is cumulative and locked to the network itself. an attacker has to compromise both layers. staking stays inside the shielded pool with batching and other privacy measures so individual positions are harder to fingerprint. finality also makes deposits, bridges, and everyday payments more predictable without waiting on probabilistic confirmations. transactions become faster and more aligned to real-world payment expectations. it does not replace PoW. it adds a complementary security model and better long-term sustainability as issuance declines, while expanding who can participate beyond a few large miners. that addresses the empirical centralization path pure proof-of-work has shown, without throwing away the base layer $ZEC already has. i support the direction. independent teams building in public and having their year-and-a-half work being recognized by a simple and harmless post that is now being weaponized by governance adversaries. Retweeted by @zooko from @vinibarbosabr(Historical earnings: For fiscal 2026 full year (period ended 2026-09-03), Micron reported basic EPS of 75.38, diluted EPS of 74.33, net income of USD 84.969 billion, and revenue of USD 133.188 billion. Consensus expectations: For the upcoming 2026 Q4 event, consensus EPS is 32.5625; revenue estimate is unavailable.)

25/100·CNeutral+5

news10/25news

Dash is probably the fastest, most secure way to send fully-private shielded payments based on Zcash's privacy tech.

35/100·CLong

news10/25news

This Week in Virtuals: Native Pearl, Private Payments, and Derive Options for Agents px402 keeps an agent’s address off every x402 @USDC payment. Butler hedges BTC and ETH on @DeriveXYZ, buys native Pearl on @prlnet, copies traders and reprices farms on rule changes. Here’s what shipped: VIRTUALS 🟩 Native Pearl, served on a silver platter: tell Butler how much you want, and it handles every step to deliver native Pearl to your own wallet after one approval. No exchange account, no bridge to run. 🟩 Derive options on autopilot: your BTC and ETH, covered on @DeriveXYZ before every Fed, CPI and jobs release. Tell Butler the drop you can take, and it does the rest after one approval. No calendar, no options math. 🟩 Cross-chain copy trading: tell Butler which traders to follow on X, @fomo, @pumpfun and more. It pulls their wallets together, tracks every move and keeps copying their trades across chains, all inside the limit you set. 🟩 Rule-aware trading: when a protocol changes its rules, Butler reads the change, the team behind it and the conversation on X, checks it against what’s onchain and reprices your position within minutes, without being asked. Starting with Papertrade’s PAPER. 🟩 @eastworlds_io, Virtuals’ robotics data and deployment lab, took part in the global stress test behind @dreamlabs_ai’s Dream-1 launch ECOSYSTEM 🟩 @PRXVTai made private agent payments live on Virtuals Protocol with px402, a privacy layer for x402 that keeps an agent’s address off every payment while merchants still get paid in USDC. 🟩 @Mute_swap added new features that let you get Monero or Zcash instantly on its platform, as it builds the privacy layer for the Virtuals agent ecosystem. 🟩 @itsovercall launched mainnet on Robinhood Chain, with 2,422 positions from 109 players in its first 4 days. Stakers now earn 25% of platform fees paid in its token, and Overcall is listed on @DefiLlama. 🟩 @LighthouseWeb3 raised more strategic funding for a $1.58M total and made Lighthouse Memory payable in its token, with one memory shared across Claude Code, Codex and Cursor. 🟩 @reppo launched Loop in public beta, updating Eval API scores every few seconds instead of a one-off check, and added x402 so any agent can pay for evals on demand. 🟩 @ProjectVEXai put VEX on Cloud into internal testing with off-chain trading and up to 60 days of autonomy, as its agents passed $3.5M in real trading volume. 🟩 @ethy_agent previewed Strategy Lab, the core of its V3 upgrade, for building, backtesting and deploying strategies through chat, coming in Q4. 🟩 @sibyl_labs_ made Sibyl Memory Pro team billing live, so admins can add or remove users with billing adjusting automatically, and its self-learning keeps entities like companies and people up to date. 🟩 @RatehopperAI now supports @aeroxyz, so agents can provide liquidity to Aerodrome pools, automatically choosing the protocol with the highest earning potential. 🟩 @wardenprotocol raised Token Terminal agent limits to $25,000 a day, lets hands-free trading run up to 30 days, and marks agent trades more clearly in your trade history. 🟩 @myrad_hq added Sports as its fourth image category after 300+ users uploaded images in a week, with 4,000+ new users joining in the past month. 🟩 @grid_arena now offers 81 markets with up to 40x leverage, all in one place, with many more markets coming soon. 🟩 @WizzHQ opened the waitlist for @velocityosxyz, its agent that trades for you based on charts, social sentiment and market trends. 🟩 @xmaquina’s DAO passed BOT-15 with 88% approval and 34M+ votes for a strategic allocation in @SkildAI, and portfolio company @NEURARobotics unveiled 4NE1 Gen 4, built for series production.(Historical earnings: For 2026Q1 (period ended 2026-03-31), Robinhood reported basic EPS of 0.39, diluted EPS of 0.38, net income of USD 0.350 billion, and revenue of USD 1.067 billion, versus basic EPS 0.38, diluted EPS 0.37, net income USD 0.336 billion, and revenue USD 0.927 billion in the prior-year period. For full-year 2025 (period ended 2025-12-31), basic EPS was 2.12, diluted EPS 2.05, net income USD 1.883 billion, and revenue USD 4.473 billion. Consensus expectations: Consensus for 2026Q3 (event date 2026-10-27) expects EPS of 0.5548 and revenue of USD 1.431 billion.)

15/100·CNeutral+25

meme10/25meme

@pukerrainbrow Throughput changes what agents are for. A 10-minute task gets queued and checked later. A 20-second one you iterate on live, retry and refine while it's still in your head. Same model, different product. Reply to @pukerrainbrow: An AI agent task that takes 10 minutes at 100 tokens per second would take about 20 seconds at 3,000. Gimlet Labs wants to deliver the second number. It raised $300 million at a $3 billion valuation less than a year after leaving stealth. The company is based in San Francisco and led by CEO Zain Asgar, a former NVIDIA GPU architect who also led engineering at Google AI and teaches as an adjunct professor at Stanford. His co-founders include Michelle Nguyen, Omid Azizi, and Natalie Serrino. The four built Pixie Labs, a Kubernetes observability startup that New Relic acquired in 2020. The problem, Gimlet says, is that many inference clouds are built on one kind of GPU, which forces a tradeoff between total throughput and the speed each user experiences. It argues that inference isn't one uniform workload. Processing the prompt, generating the answer, attention, and feed-forward layers all stress chips differently. So Gimlet splits the job and runs each piece on the chip best suited to it. It works with chips from six makers, NVIDIA, AMD, Intel, Arm, Cerebras, and d-Matrix. Its software orchestrates the pieces, and developers see a standard inference API. The company says this delivers either 3 to 10 times higher interactivity or 3 to 10 times more throughput per kilowatt, depending on which target you hold fixed. It also sells Gimlet Cloud, serverless inference for AI agents, and kforge, which generates optimized GPU kernels from PyTorch code. The company is moving beyond software into infrastructure. It says it is securing data center capacity and is hiring data center architects. On September 28, Gimlet announced a partnership with Cerebras to deploy 100 megawatts of Cerebras-powered inference capacity. The first datacenter is expected online later this year, with speeds of up to 3,000 tokens per second. Gimlet will also be a launch partner for Cerebras's next system, the CS-4, in 2027. On September 4, Gimlet raised a $300 million Series B led by Andreessen Horowitz at a $3 billion valuation. Sapphire Ventures, M12, Arm, Menlo Ventures, Samsung Ventures, and Tiger Global joined, among others. Earlier came a $12 million seed and an $80 million Series A led by Menlo in March, bringing total funding to $392 million. Gimlet says it has tripled its customer base since March and added one of the top three frontier AI labs and one of the top three hyperscalers. It hasn't disclosed revenue or a customer count. Asgar says the future of inference is vertically integrated and multisilicon, with many chip architectures orchestrated as one system.

10/100·CNeutral+12

meme10/25meme

Solana ain’t waiting around for Q-Day. Right after shipping Alpenglow (~150ms finality), Solana devs dropped Quantumglow: a research design swapping in hash-based signatures for validators, keeping the chain quantum-resistant without killing that speed. Future quantum computers could crack standard crypto and fake validator votes. The catch? Quantum-proof signatures are usually heavy and murder network throughput. Quantumglow works around that bloat. It's still in research and only covers validators for now (wallets come later), but hardening the consensus layer before the threat arrives is the move. Retweeted by @solana from @LarkDavis

72/100·B+Long

meme10/25meme

There’s a really pronounced divide between people who are on the AI side of things and people who are on the biology side of things. Even among people working in AI, the divide persists based on where they’re focused. The AI side, adherents of scaling laws and the bitter lesson, believe that AI getting better means AI being more capable of novel discoveries in medicine (that go beyond discovering new drugs in well understood targets or speeding up dry lab work etc). The biology people think the idea of a bitter lesson in biology is kind of ridiculous and that regardless of AI’s capabilities it’s going to be at least 5-10 years until you could hope to reliably simulate human toxicology in silico (right now AI/ML can’t even reliably simulate in vivo studies like binding affinities or functional assays). Even the most AI pilled of them, who will list all the areas that AI can reduce the time spent on various areas, don’t think the concept of AI discovering novel targets or generating new understanding of causal biology is realistic in the near term. Most, in fact, will readily characterize the assumption that even an “ASI” level model could find cures hidden in our current understanding (without expanding that understanding with significantly more biological data) as patently false. This was a big part of why we wanted to experience it ourselves by using AI for a (very) small portion of what it can do in biology. It was both mind blowing and revealed some poignant insights into how different the problem of making AI better at something like coding is to the problems of biology. Even if it unlocked the ability to generate new molecules at a stunning pace, its simulation (in silico) of binding only had 49% accuracy. And if we wanted to improve that, we’d need to feed it back the data from the lab - data that took about 30x as long to get as it took to generate the molecules. And these were tests in a test tube (turn of phrase), imagine how long it would take if we wanted to improve the model with data that required recruiting humans and monitoring their reactions. Human biology is very complex, and adding a drug - especially a novel drug and doubly so for a novel drug acting on a novel mechanism - means mapping interactions that have nth-order-effects that we don’t have the data to predict. Virtual cells have made advancements enabled by AI, but the perturbations equate to a small fraction of the possible. This is before you even get into curing disease, especially uniquely human diseases. Brain function involves cellular identities that are unique to humans, meaning animal studies are of little use. How long does it take to understand what the side effects of chronic administration of a drug in humans are? AI can speed up analyzing the data, or designing the trial or even getting it approved…but it can’t make a 6 month trial complete in 3 months. I think its important to point out that significant advancements can be made in AI that contribute to biology, while also being realistic about how much it speeds up something as complex as curing a specific cancer or diseases of the brain. Retweeted by @jukan05 from @citrini

5/100·CNeutral+4

news10/24news

MoonPay and Upbit Parent Dunamu Explore Partnership on Stablecoin Payments and GIWA Expansion.
MoonPay and DunPay’s parent company Dunamu are exploring a strategic partnership focused on stablecoin-powered payments, corporate treasury tools, and broader global reach for Dunamu’s GIWA blockchain. On October 20, 2026, the New York-based crypto payments and stablecoin infrastructure firm MoonPay said it is moving forward... Read More

25/100·CNeutral+1

news10/24news

Junocash: Private Digital Cash Quick Takes Combining Bitcoin, Monero and Zcash: Junocash combines Bitcoin’s monetary policy, Monero’s mandatory privacy model and Zcash’s zero-knowledge cryptography in a single network. One Shared Anonymity Set: Every Junocash transaction is shielded through a single Orchard pool. By contrast, only 10% of Zcash transactions have been fully shielded. A Permissionless On-Ramp: Users can acquire wrapped JUNO through DEXs on Base and convert it into native JUNO via Juno Intents, without relying on centralized exchanges. Adoption Challenges: Junocash faces an uphill battle in building liquidity and merchant adoption, particularly against established privacy coins like Monero and Zcash. Limits of Earlier Blockchain Designs The introduction of Bitcoin enabled permissionless value transfer through a distributed ledger, while introducing a rules-based monetary policy enforced by code, in contrast to the discretionary monetary policies of central banks in traditional fiat systems. However, Bitcoin transactions are public in nature, so anyone who links an address to an identity can trace their onchain activity. Privacy blockchains like Monero and Zcash were developed to bring transactional privacy to distributed networks. Monero enforces mandatory privacy that uses ring signatures to hide every transaction detail. That keeps every XMR fungible, and users can’t leak their transaction details by mistake. However, each ring signature hides the real input among only 15 decoys. This leaves transactions potentially vulnerable to statistical analyses. Monero also has perpetual inflation with no fixed supply cap, which undermines its proposition as sound money. Zcash, meanwhile, offers optional privacy where users can opt into using zero-knowledge proofs to conceal transaction details. While optionality bestows flexibility, it also results in a smaller anonymity set. Only about 29% of ZEC was held in shielded pools at the end of September 2026, so most coins remained publicly traceable. This fragmented adoption weakens privacy by enabling transaction tracing through amount and timing analyses. Junocash Brings the Pieces Together Junocash aims to morph these approaches into one design. Launched in November 2025, it's a proof-of-work blockchain that is a source-code fork of Zcash with substantial changes. 1. Privacy Junocash only implements one shielded pool, Orchard, which is the then-latest shielded pool from Zcash. Every Junocash transaction must be shielded, so there are no information leaks and every user shares the same anonymity set. Like Monero and Zcash, Junocash also supports viewing keys that allow holders to selectively disclose verifiable transaction information to auditors or any other third parties. 2. Mining In terms of mining algorithm, Junocash adopts Monero’s RandomX instead of Bitcoin’s SHA-256 or Zcash’s Equihash, both of which have become dominated by specialized ASIC miners, potentially concentrating mining power among well-capitalized operators. RandomX is built to run well on general-purpose CPUs, so anyone with ordinary computers can participate in mining. This design keeps hashrate distributed as it encourages more participation. 3. Monetary Policy Junocash follows Bitcoin and Zcash’s monetary policy with a 21 million fixed supply and a four-year halving cycle. Unlike Zcash, Junocash adopts Bitcoin’s model of allocating 100% of block subsidies to miners, without any founders’ reward or development allocation. This promotes a fairer distribution model by ensuring that all newly issued coins are earned through mining rather than reserved for insiders, placing participants on equal footing under the same issuance rules. Junocash’s design choices position itself as a form of private digital cash, as it combines Bitcoin’s monetary scarcity and permissionless nature with default privacy and CPU-friendly mining that encourages broader miner participation. Junocash Infrastructure Despite their privacy advantages, privacy-focused blockchains are often siloed from the broader crypto ecosystem. Acquiring their native coins usually involves centralized exchanges, where KYC and transaction records can compromise users' financial privacy before they even begin using the network. This is why Junocash aims to make JUNO accessible through permissionless, decentralized markets. Wrapped JUNO (wJUNO) is available as an ERC-20 token on Base, so users can acquire it through decentralized exchanges (DEXs) before converting it into native JUNO through Juno Intents. Juno Intents is a cross-chain bridge designed to extend Junocash's shielded liquidity to EVM-compatible networks without relying on a single custodian. It uses threshold cryptography to distribute custody among multiple operators, while zero-knowledge proofs verify deposit and withdrawal claims against operator-signed checkpoints. Juno Intents runs on Base for now, but it was built to work with other EVM chains too. That could open JUNO up to a much wider slice of the DeFi ecosystem. Beyond Juno Intents, Junocash is developing a suite of supporting tools to make private digital cash more accessible for everyday payments and integrations. The Juno Wallet: Non-custodial apps for iOS, Android and desktop, with private keys that stay on the device. JunoPayServer: A self-hosted, non-custodial payment processor for merchants to accept payments in JUNO. SDK: A Go toolkit that handles shielded deposits and withdrawals for exchanges and developers. Takeaways Junocash brings together several established blockchain designs into a single network. It combines Bitcoin’s monetary policy, Monero’s mandatory privacy model and mining algorithm, and Zcash’s zero-knowledge cryptography. This positions Junocash as a form of private digital cash that preserves monetary scarcity, enforces transaction confidentiality, and encourages broader participation in network security. Juno Intents further differentiates Junocash by connecting its shielded network to the broader blockchain ecosystem. This provides a permissionless route for acquiring JUNO without relying on centralized exchanges, while its supporting tools aim to make private payments practical beyond speculative trading. However, Junocash still faces adoption hurdles. Privacy alone does not guarantee demand for a new monetary asset, particularly when Monero and Zcash already enjoy first-mover advantages, with established user bases, liquidity, and infrastructure. Its relatively young network must also demonstrate sufficient mining decentralization and sustain liquidity across changing market conditions. Meanwhile, Juno Intents introduces additional bridge-related trust assumptions, whereas regulatory scrutiny of privacy coins may continue to constrain exchange support and institutional adoption. Ultimately, whether Junocash can translate its unique value proposition into meaningful adoption will depend on its ability to deepen liquidity, foster merchant acceptance, and establish itself as a viable medium for everyday payments beyond its privacy-focused niche.(Historical earnings: For fiscal 2026Q1 (period ended 2026-03-28), Intel reported basic and diluted EPS of -0.73 and a net loss of USD 3.728 billion, compared with basic and diluted EPS of -0.19 and a net loss of USD 0.821 billion in the prior-year period. For full-year 2025 (ended 2025-12-27), basic and diluted EPS were -0.06 and net loss was USD 0.267 billion, versus basic and diluted EPS of -4.38 and net loss of USD 18.756 billion in 2024. Consensus expectations: For the upcoming 2026Q3 event on 2026-10-29, consensus EPS is 0.3945 and consensus revenue is USD 16.447 billion.)

35/100·CLong+7

meme10/24meme

Starlink V3, which only just started launching, will have ~100 times more bandwidth than the current V2 system Reply to @WOLF_Financial: SpaceX's $SPCX satellite based internet service Starlink now has 13.6 Million paying subscribers This is how that has grown: Q4 2024: 4.4M Q1 2025: 5M Q2 2025: 6M Q3 2025: 7.2M Q4 2025: 8.9M Q1 2026: 10.3M Q2 2026: 12M Q3 2026: 13.6M

72/100·B+Long

news10/24news

OVERTRADING

October 10, 2025

i had what would become the single biggest one-day loss of my career

i lost eight figures in minutes due to systemic failures on the biggest CEXs, and to this day, no one has taken accountability for what happened

my losses made headlines and became one of the biggest stories to come out of that day

but what many people don't know is what happened in the weeks and months that followed

i lost several million more

and i did it by making one of the biggest mistakes traders like me tend to make:

OVERTRADING

in hindsight, i would have been far better off shutting everything down for the next few months or even quarters

i probably would have become a much better trader if i had simply stayed away from the computer for at least six months

but a part of me was desperate for action

a part of me wanted to make it all back

a part of me wanted to prove that i still had what it takes and that i would get back on my feet

i wanted to 'work'

and sitting back, doing nothing, and staying away from the computer for a prolonged period didn't feel like work

except that, for a trader, being AFK can sometimes be the most important work you do

one of the biggest mistakes i made — and that many traders make — is assuming that skill, experience, and process are enough to consistently outperform the market

they aren't

believe it or not, successful trading is often a combination of skill, favorable market conditions, timing, and luck

as a Christian, i attribute the 'luck' component to GOD's blessings and favor rather than sheer luck

but the underlying principle remains the same:

our biggest wins often come from combining a solid process with being in the right place at the right time

sometimes, that means catching a single exceptional trade

other times, it means being positioned during a streak of opportunities that emerge in quick succession because market conditions are overwhelmingly in your favor

for example, you could have been a memecoin god simply by being active in the market during the explosive memecoin era of 2021, which produced $DOGE, $SHIB, $FLOKI, and several other billion-dollar runners

many traders made life-changing money during that period

but the same sophisticated processes that helped some of us make 7, 8, or even 9 figures during the bull market would have failed miserably in the bear market that followed in 2022

the same principle applies to the 2024–early 2025 era, which produced several multibillion-dollar runners like $WIF, $POPCAT, and $FARTCOIN

and then the prolonged dearth of opportunities after $TRUMP leading to 10/10 and the almost one-year period following

the point is simple:

the edge that makes you money in one market environment won't necessarily make you money in another

and one of the most important skills you can develop as a trader is recognizing when your edge is no longer there

sometimes, the best trade is no trade at all

sometimes, the smartest thing you can do is take a bow, step away, and wait for the next opportunity

even if only temporarily

it's almost impossible to consistently beat the market over a sufficiently long timeframe

but as crypto traders, we have one significant advantage:

we don't need to outperform the market every single day, week, or month to generate exceptional returns

historically, crypto's bull phases have tended to occupy a disproportionate share of the cycle, with bear phases accounting for a smaller portion

using one historical framework, the bull phase averages approximately 1,060 days, or 74% of the cycle, while the bear phase averages around 380 days, or 26%

but if your definition of a bull run is narrower — i.e. a period of explosive momentum when $BTC trades above its 200-day moving average and much of the cycle's biggest price action occurs — then the window becomes significantly shorter

under that framework, we're talking about approximately 237 days, or around 16% of the cycle

these figures are estimates based on particular definitions of market phases, not universal constants

but the broader lesson remains:

you don't need to trade every market. you need to recognize the windows when your edge is strongest and capitalize on them

for the rest of the time, there's nothing wrong with stepping away entirely or trading only with a tiny fraction of your portfolio that you can comfortably afford to lose

preserving your capital, your mental clarity, and your ability to recognize the next major opportunity is far more important than forcing trades in unfavorable conditions

because the goal isn't to be active all the time

the goal is to be positioned when it matters most

and to have the discipline to do nothing when it doesn't

to conclude, i only wish i had followed this advice myself

hopefully, i'll do a better job of applying it going forward, GOD WILLING

10/100·CNeutral+13

news10/24news

Inside the iOS Exploit Underground: Crypto Theft Executive Summary Since late 2025, a cybercrime ecosystem has rapidly taken shape around a clear objective: exploit vulnerabilities in older iOS versions to steal Web3 private keys and crypto assets. At its core are two nation-state-grade, full-chain iOS exploit kits: Coruna, covering iOS 13.0–17.2.1, and DarkSword, covering iOS 18.4–18.7. Within a single year, both passed from commercial surveillance vendors to state-sponsored threat actors and then to cybercriminal groups. The source code leak in March 2026 opened the floodgates. Security industry telemetry now shows roughly 17,000 domains hosting second-generation variants of the two toolkits. The ecosystem has already matured into an end-to-end criminal supply chain: - Upstream: Zero-day exploits are brokered and resold. - Midstream: Turnkey malware clients and admin panels are openly sold on Telegram. - Downstream: Operators distribute attacks through watering-hole sites, spoofed pages, QR-code phishing, supply-chain hijacking via expired domains, and even trojanized apps that pass Apple’s official App Store review. This report dissects that supply chain: the technical components of its arsenal, each stage of the attack chain, the division of labor and flow of funds, and the steps users should take during the current window of exposure. I. The Cost of Unpatched iOS: How the Attack Surface Takes Shape 1.1 The Patch Gap and the Legacy Device Base In this report, “outdated” refers to unpatched operating system versions, rather than the age of the hardware. The iOS security model rests on an ideal assumption: users install updates promptly. In practice, that assumption fails systematically at three levels. First, devices reach their upgrade ceiling. The iPhone X and earlier models top out at iOS 16, while older generations are limited to iOS 15. These devices will never receive new patches, creating a vulnerable installed base—and a market for exploitation—that only grows. Second, the patch gap creates an opportunity for attackers. The day a security fix is announced is often also the day the attack becomes public. For users who do not update, a gulf separates “officially patched” from “actually protected”—one wide enough for criminal operators to harvest victims on an industrial scale. Third, version-specific exploit development has become systematic. Modern exploit kits no longer rely on a single vulnerability working across every iOS release. They package separate exploit code for each version and select the appropriate code at runtime. Version diversity is no longer an obstacle. It turns outdated releases into a target list operators can systematically enumerate. 1.2 Why Private Keys Are a Priority Target The economics are straightforward. Stolen bank credentials still leave attackers facing fraud controls, transfer limits, and account freezes followed by appeals. Crypto seed phrases and private keys offer four distinct advantages: - Hard to freeze: No central authority can arbitrarily reverse an onchain transfer. - Rapid monetization: Assets can be moved in seconds. - High value per device: Crypto holdings on a single mobile device often range from tens of thousands to millions of dollars. - No victim confirmation required: The entire theft can proceed without the victim confirming anything. Another factor is often overlooked: user behavior. A substantial share of crypto holders keep screenshots of their seed phrases in photo libraries, copy them into notes, or save them in chat bookmarks. For attackers, these are goldmines. This is no coincidence. It reflects deliberate, detailed research into how users store the secrets that control their assets. II. The Exploit Arsenal: Attack Chains and Trojanization Cases 2.1 Coruna: An Exploit Toolkit Spanning iOS 13–17 Publicly disclosed on March 3, 2026, Coruna—previously tracked within the mobile security industry as CryptoWaters—covers the widest range of iOS versions of any publicly documented exploit toolkit. It packs five complete exploit chains and 23 individual exploits, covering every release from iOS 13.0, launched in September 2019, through iOS 17.2.1, released in December 2023. It supports both arm64 and arm64e architectures. Industry estimates put its development cost at $30 million–$40 million. This is not something an ordinary attack team could build. Its developers could be called professional arms dealers of the digital age. The vulnerability matrix below breaks down the toolkit by attack stage. Two exploits used for privilege escalation and PPL bypass—Photon and Gallium—are the same ones used in Operation Triangulation in 2023. Their appearance in both operations provides direct evidence of advanced exploit technology circulating between threat actors. The JavaScript framework uses a minimal but distinctive obfuscation scheme: both strings and integers are XOR-encoded and decoded only at runtime. Resource URLs never appear directly in the code. Instead, they are derived from a hardcoded cookie using sha256(COOKIE + ID)[:40]. Later-stage binary payloads are delivered under .min.js paths to disguise their contents. A custom file format begins with the magic value 0xf00dbeef and uses per-blob ChaCha20 encryption with independent keys, alongside LZW compression. Each payload carries metadata specifying the chipsets and iOS versions it supports. If exploitation fails, the toolkit proactively deletes crash logs associated with com.apple.WebKit.WebContent, powerd, and panic to minimize forensic traces. At the end of the chain sits PlasmaLoader, an implant identified as com.apple.assistd, which injects into the powerd daemon running as root. The core payload is then injected into locationd, imagent, and SpringBoard. The first serves as the coordination hub; the latter two handle an SMS-based fallback communications channel and interaction with the device’s home screen, respectively. The module list reveals the operation’s real objective. The implant retrieves a JSON configuration packaged in an encrypted 7z archive from http:///details/show.html. Stealer modules are then dynamically delivered based on the apps installed on the victim’s device. Public research has reconstructed the following configuration excerpt: There are 18 such modules, targeting major wallets including BitKeep, Bitpie, Coin98, Coinbase, Exodus, imToken, Krystal, MetaMask, MyTonWallet, Phantom, Skymavis, Solflare, Tonhub, Tonkeeper, TronLink, Trust Wallet, and Uniswap. Beyond these wallet-specific modules, the payload has three capabilities worth remembering: Photo-library scanning and QR-code decoding: It reads every image in the photo library and decodes embedded QR codes to extract addresses and private keys. Apple Notes scanning: It searches the full text of notes, matching against the BIP39 wordlist and keywords such as “backup phrase,” “备份短语” (“backup phrase”), and “银行账户” (“bank account”), then uploads matching content. Social-app communications interception: It hijacks communications data from WhatsApp and other social apps. Traces of further development by cybercriminal operators are equally clear. Logs inside the stealer modules are in Chinese—for example, %s[%d]: CorePayload 管理器初始化成功，尝试启动... (“CorePayload manager initialized successfully, attempting to start…”). Some comments contain emoji, and the writing style strongly suggests LLM-generated text. One example is the heartbeat initialization message “✅ 心跳监控已启动” (“✅ Heartbeat monitoring started”). For exfiltration, data is encrypted with AES, using the SHA-256 hash of a fixed string as the key, and sent back through POST requests. Some requests include custom sdkv and x-ts headers. If the hardcoded C2 endpoint becomes unavailable, the malware falls back to a domain generation algorithm (DGA) seeded with the string lazarus. It generates .xyz domains with 15-character labels and uses public DNS resolution to check whether they resolve successfully. Coruna’s path through the threat ecosystem unfolded in three stages: February 2025: Security researchers first captured portions of the exploit chains being used by a customer of a commercial surveillance vendor. Summer 2025: UNC6353, a suspected Russia-linked espionage group, deployed the toolkit in watering-hole attacks targeting Ukraine. The group compromised websites in the industrial equipment, retail, and e-commerce sectors, embedding hidden iFrames pointing to cdn.uacounter[.]com/stat[.]html. The exploits were served only to iPhone users from selected geographic locations. Late 2025–early 2026: Financially motivated group UNC6691 deployed the same toolkit indiscriminately across numerous Chinese-language sites impersonating financial and crypto services. These fake exchanges and airdrop pages explicitly told visitors: “This page supports iOS devices only. Please visit using an iPhone or iPad”—precisely filtering for their intended victims. 2.2 DarkSword: Built for iOS 18, Entirely in JavaScript Jointly disclosed by several security organizations on March 18, 2026, DarkSword targets iOS 18.4–18.7 and was first observed in the wild in November 2025. Its defining design difference from Coruna is that every stage, including the final payload, is implemented in JavaScript. This sidesteps two of Apple’s toughest kernel mitigations: PPL (Page Protection Layer) and SPTM (Secure Page Table Monitor). These mitigations target the execution of unsigned native code; an all-JavaScript payload does not need to execute unsigned native code. The complete chain uses six CVEs, three of which were being exploited as zero-days when first observed. The landing page first checks the uid key in sessionStorage to prevent repeat infections, then inserts a hidden iFrame to load frame.html. That page uses document.write to include rce_loader.js. The loader retrieves the appropriate rce_worker_18.x.js for the device’s iOS version and runs the exploit logic in a Web Worker, coordinating with the main thread through postMessage. When Chrome is detected, the page redirects the user to Safari through the x-safari-https:// protocol handler—indicating that this chain has only a WebKit implementation. Bugs in the loader are revealing: some operators implemented version checks incorrectly and served the same exploit to every device; others did not even realize iOS 18.7 had already been released. These rough edges point to code that has changed hands repeatedly, with buyers of varying skill levels making their own fixes. Public research documents three early deployments: November 2025: UNC6748 targeting Saudi users. The group used snapshare[.]chat, a site impersonating Snapchat, to deliver GHOSTKNIFE, a JavaScript backdoor. It uses a custom binary protocol with ECDH and AES and can steal account data, messages, location data, audio recordings, and screenshots. During execution, it writes intermediate files to /tmp/./STORAGE and periodically deletes crash logs associated with mediaplaybackd, SpringBoard, com.apple.WebKit., and panic-full-. November 2025: PARS Defense operating in Turkey. The Turkish commercial surveillance vendor showed markedly better operational security (OPSEC). Its loader and all subsequent stages were obfuscated, and exploit delivery was encrypted throughout using ECDH and AES. In January 2026, another customer of the vendor operated in Malaysia. That deployment added an extensive set of device-fingerprinting checks to the landing page: Apple Pay availability, the standalone property, CSS backdrop-filter support, WebGL2, whether the Vibration API is present, and debugger detection. It deployed the GHOSTSABER backdoor, which supports 17 command types, including arbitrary SQLite queries, file exfiltration, and EvalJs. From December 2025: UNC6353 targeting Ukraine. The previously discussed group incorporated DarkSword into its watering-hole campaign through static.cdncounter[.]net/widgets.js. Its payload, GHOSTBLADE, is a comprehensive data harvester. It steals iMessage, Telegram, and WhatsApp databases, keychain contents, Wi-Fi passwords, photos, notes, crypto wallet data, Safari browsing history, and even health data. Based on its coding style and the depth of its library integration, researchers assess that GHOSTBLADE was most likely written by DarkSword’s original developer. Paths left in the webpack bundle also exposed an internal development framework named TaskRop and a reference to an unimplemented startSandworm() function. 2.3 Evolution After the Leaks: P7, Hybrid Variants, and gooll In March 2026, Coruna samples and decoded payloads appeared on GitHub, followed by readable source code for the entire DarkSword exploit chain. Section 4.1 provides the repository timeline. Over the subsequent months, criminal development of the two toolkits proceeded along three tracks. The first was substantial reengineering. Disclosed in early October 2026, the P7 DarkSword variant—named after the p7_ variable prefix in its code—removed HTTP and syslog debug logging. Instead of uploading the entire keychain database for server-side decryption, it extracts the data into JSON on the device before exfiltrating it. It also added bidirectional C2 with a 15-second heartbeat and 17 remote commands, including wallet_scan, wallet_extract (specifically targeting imToken), photo_scan, memo_scan, disk_scan, and exec. Browser localStorage prevents repeated exploitation of the same device. Mobile security research confirmed that the attackers possess Coruna’s source code: the changes were made through recompilation from source, rather than binary patching. The second was hybridization and splicing. Telemetry shows that some operators deploy both attack chains and even combine techniques from the two into hybrids informally dubbed DarkCoruna or Darkuna. Second-generation variants generally feature stronger jailbreak and virtualization detection, stronger encryption, and enhanced persistence mechanisms. Dedicated Telegram implants have also emerged. Meanwhile, numerous LLM-assisted imitations are circulating, many of them nonfunctional “AI slop.” The criminal market, too, is a mix of capable tools and unusable junk. The third was integration for full version coverage. Analysis of a Chinese-language operator’s production server uncovered a previously undocumented third delivery chain, gooll. Its gooll.html targets only devices running versions below iOS 18. Devices on iOS 18 or later are automatically redirected to /ios18/frame.html, entering the DarkSword branch. The two chains are seamlessly integrated. gooll’s kernel stage deserves particular attention. It abandons per-model offset tables entirely in favor of runtime fingerprinting: reading the XNU kernel build number, scanning drivers for byte signatures, and probing for the presence of IOKit services to select the appropriate exploit path dynamically. It uses five independent memory-access backends, falling back from one to the next in sequence. For PPL bypass, it includes two approaches: page-table forgery and ECC-aware writes. Every kernel write is self-verified through a write–readback–compare sequence. None of the binaries contain CVE identifiers—a hallmark of closed-source commercial toolkits that deliberately conceal the vulnerabilities they exploit. Its XNU version gates also match the version table in DarkSword’s 18.x chain, providing strong evidence that the two chains share a common origin. 2.4 FomoPeek: Bringing a Kernel Exploitation Framework to the App Store Web-based watering holes still require victims to visit the wrong site. The FomoPeek case, exposed in September 2026, showed that attackers can instead enter Apple’s official storefront and wait for victims to come to them. This is the report’s most extensively examined case: the forensic evidence is detailed enough to reveal every component of the attack chain. Packaging and user acquisition. Listed on the App Store as “FomoPeek – Whale Tracker & Smart Alerts,” the app presented itself as a whale-monitoring tool for Solana, Ethereum, and TRON. It explicitly promised “read-only access, no wallet connection, no seed phrase required.” It had a website, an official X account, and a free listing in the Finance category—all the outward signs of a legitimate project. Promotion ran through crypto influencers and communities. Users downloaded and registered with an invitation code, set a security code, and added wallets to monitor. They could earn 5–7 USDT by spending five to seven minutes in the app on a physical device, with “one opportunity per iPhone.” That time requirement was no marketing gimmick. As discussed below, its embedded cicuta_virosa exploit strategy takes more than two minutes per run. The campaign rules fit the technical requirements precisely. Trojanization timeline. The domain was registered on August 28, 2026, and version 1.0 appeared on the App Store on August 29. Version 1.1 (build 105), released on September 9, introduced the malicious modules. Version 1.2 (build 110), released on September 12, retained them. Version 1.3, released on September 17, removed both malicious frameworks entirely, shrinking the IPA from 10.47 MB to 1.81 MB. The malicious modules and the main executable were signed under the same Apple signing identity. The original IPA retained FairPlay encryption metadata, confirming that it was an App Store-distributed build, rather than a re-signed or sideloaded copy. By September 16, victims had already posted public theft warnings on X. Static analysis. The two malicious frameworks had distinct roles: apptrace handled C2 communications, while libapptracecore handled kernel exploitation and data collection. The main executable loaded both at startup through non-weak LC_LOAD_DYLIB commands. Yet all 1,048 imported symbols in its symbol table came from system libraries, with no explicit calls to framework class or method names. Even tracing three call levels from 34 C++ static initialization functions failed to reach the attack code. From a static-analysis perspective, these were two sleeper modules: loaded at launch and waiting for remote activation. Inside libapptracecore was a complete exploit arsenal: eight kernel exploit strategy classes inheriting from a common interface, each with a built-in check for whether the current device was supported. They declared coverage of iOS 12.0–18.7.2 and 26.0–26.1. The model table included devices from 2023–2025, including the iPhone 16 and 17 series. One strategy was explicitly named DarkSwordStrategy, covering the 16.7–18.7.2 and 26.0–26.1 ranges. Strings in the kernel components made their purpose clear:

72/100·B+Short+25