SIX News & Signals

twitter7h agomeme

“The entire story takes place inside a massive server where an AI goddess emerges...” @annibale_sic on Inside the Compute, his piece for Beyond the Frame at @framelessldn. Projected on all six surfaces of the room, Nov 16 in London. See it at Beyond the Frame during @solana BREAKPOINT 2026. RSVP: luma.com/frzpha3k Quoted @rendernetwork: Meet the artists of BEYOND THE FRAME. 14 artists creating immersive works for @framelessldn, rendered on @rendernetwork. Featuring @jstngraphics (art shown), @DavidAriew, @MhxAlt, @kapital__tv, @ryantalbot_art + 9 more. Nov 16 | @solana BREAKPOINT 2026 RSVP: luma.com/frzpha3k

10/100·CNeutral

news10h agonews

BAM vs. kcompactd: how we fixed small blocks with two sysctls

How we traced BAM small blocks from the leader window down to a memory-compaction daemon on the Linux host
Authors: BAM Performance Team
Summary
In late September, about one in every 800 blocks built by BAM (Block Assembly Marketplace) came in under 7 million compute units. We call these small blocks (this is not a Solana-wide definition). The small block rate was low, but every small block is revenue a validator didnâ€™t earn and blockspace the network didnâ€™t use.
Over two weeks we found and fixed time losses in five layers: block replay in the BAM node, the BAM scheduler, the memory allocator, Linux TCP congestion control, and the Linux kernel on the physical hosts that run our TEE VMs. All of these changes made a measurable difference. One change explains most of the drop in small blocks, and it was a kernel scan on the Linux host that slowed our TEE VMs for about 48 seconds out of every 80.
This technical post covers the leads we chased, what each fix did and didnâ€™t change, and the unexpected culprit.
We want to give a special thanks to Alessandro Decina (@alessandrod) from Anza. Slowlana was a critical observability tool to identify where a small block lost useful leader time (replay/bank readiness, scheduling, or Turbine propagation) and validate fixes against normal slots to deliver the results presented in this post.
Background: How Jito BAM builds a block
Jito BAM runs inside an AMD SEV-SNP [1] confidential Trusted Execution Environment (TEE) Virtual Machine (VM), which we call the TEE VM. Each TEE VM has about 736 GiB of RAM and 119 vCPUs, and runs alone on a dedicated physical Linux machine, the host. The BAM node follows the chain itself: it replays every block to keep its own bank current, and it stays connected to each validator it serves.
A leader gets four consecutive slots. During this investigation each slot was 250 ms long [2, 11]. For each slot, BAM works through three steps:

Bank handoff. The parent blockâ€™s shreds arrive, BAMâ€™s replay executes and freezes the block, the next bank is created, and the bank for the leaderâ€™s slot becomes usable.
Build. BAM runs an auction over pending transactions and bundles, then simulates the winners against speculative banks.
Forward. BAM streams batches to the leader validator, which executes them while its slot is still open.
All three steps share the same 250 ms. Time lost before the handoff and time lost during the build look identical from outside: a light block, or batches the validator rejects as OUTSIDE_LEADER_SLOT because they arrived after the targeted slot finished. A small block tells you that time ran out, but not where it went.
Problem deep dive: late banks
So we started at the bank handoff. We joined BAMâ€™s build and forward logs, validator feedback, replay metrics and leader schedules into a per-slot timeline, and reconstructed the first four small blocks one by one.
All four had the same shape. BAM made its first build 3.8â€“6.5 ms after the bank became usable and forwarded 5.1â€“14.1 ms after that. Building was fast in every case. The bank had arrived late.

Slow replay of the parent bank explained the delay. On our Frankfurt BAM node, we saw slot replay times of 415â€“602 ms, more than a full slot. In Singapore, one 5.9-second replay (4.8 s of it in program-cache work) created a backlog. The next leader rotation began while BAM was still catching up, so its first two slots were lost and the last two recovered.
One fix we tried was more replay parallelism. Raising replay worker threads from 8 to 16 to 24 gave no improvement; the mainnet transaction load was long dependency chains. Replay had enough threads, but each one was running slow. That raised the question the rest of this post answers: what was slowing them down?
Time Stealing Leads
Profiling the BAM node turned up four types of stall. The first slowed replay directly. The other three cost time after the handoff. Each was a real cost worth fixing, so weâ€™ll cover them briefly.
1. False sharing that slowed replay
We questioned why replay inside the BAM node was slower than it should have been, even on capable hardware. Something else in the node was getting in its way.
We found it in BAM's scheduling thread. While waiting for its leader slot, this thread checked the working bank about 3.1 million times a second, taking two read locks each time. A read lock looks harmless, but taking one still writes to memory, because it updates a counter inside the lock. Checking the bank's memory layout showed that those counters sat on the same cache lines as bank data replay reads constantly. Every time the scheduling thread took a lock, the CPU had to pull those cache lines away from the replay cores, often from a different CCX (a group of AMD EPYC cores that share an L3 cache). Replay then had to wait to pull them back.
This is called false sharing: the two threads never touched the same data, but sharing cache lines was enough to slow replay down. We moved the lock reads to only the ticks that need them, and the slowdown went away.

2. Bank destruction on the hot path
Our speculative banks store the speculative account state for the leaderâ€™s block. On slot transitions, we retire the speculative bank, freeing up tens of megabytes. Jemalloc, the memory allocated used by BAM, then returned those pages to the kernel with madvise, synchronously, on the main state machine thread. Inside a TEE VM, every discard can trigger TLB shootdowns across all vCPUs. One capture showed 366 MADV_DONTNEED calls costing 38.6 ms.
We moved destruction to a bounded reaper thread, upgraded to jemalloc 5.3.1, and enabled background_thread:true [6] so allocator threads do the purging.
3. Auction teardown and pacing
Wavefront, our Directed Acyclic Graph (DAG) based simulator, could wait on a straggling simulation long after its round stopped being useful. This could cause auction rounds to extend more than the intended time period and reduce the throughput. Teardown is now fenced and bounded to 5ms.
Separately, a pacing latch checked only the input queue and not work already admitted to the DAG, so bundle work could resume while ordinary transactions were still unfinished. In one slot, 179 transactions sat in the DAG with only 9 executed, and the latch still reported that the round was on pace.
4. Linux BBR at the start of the leader window
BAM streams batches to the validator over a TCP connection that uses Linux BBR (Bottleneck Bandwidth and Round-trip propagation time) congestion control [3, 4]. BBR paces sending from its own estimates of bandwidth and minimum round-trip time instead of reacting to packet loss. The connection is nearly idle between leader windows, and we found two kernel paths that could start the next window throttled:
A sub-MSS ACK after idle could push BBR into PROBE_RTT, capping the congestion window at four packets for about 200 ms.
A sub-MSS sent into an empty pipe could make BBR conclude that bandwidth had collapsed.
We shipped a userspace workaround (padding the first batch to 3,000 bytes) and two patches to net/ipv4/tcp_bbr.c [5] in our TEE VMâ€™s kernel. The first keeps BBRâ€™s idle-restart guard in place until a fresh min-RTT sample arrives:

The second treats a send of less than one MSS into an empty pipe as app-limited, so the small first write isnâ€™t mistaken for a bandwidth sample:

What fixing all four changed
Every one of the four stall types was real, and every fix worked. When the scheduler fixes reached production on October 2, the longest Wavefront cleanup dropped from 65.7 ms to 5.9 ms, and main loop gaps over 5 ms went from 54 to zero.

But the fleetâ€™s small-block rate barely moved. We had removed real stalls, and something else was still slowing every thread.
The mysterious TEE VM slow hash rate
Having followed the other leads to the end, we came across a pattern in a metric we couldnâ€™t explain.
TEE VMs emit Agaveâ€™s poh-service metric, the time the Proof of History (PoH) hash loop takes per hash. This metric, being CPU-bound, is expected to be flat. On the contrary, every TEE VM showed a square wave, alternating between a fast mode and a mode 7â€“17% slower. The slow mode typically lasted 45â€“55 seconds, then the fast mode about 32 seconds, and the cycle repeated around the clock. Nothing in the TEE VMâ€™s workload ran on that cycle.

That surprised us. Our hosts pin every CPU to the performance frequency governor specifically to avoid throughput swings from frequency changes, so a 7â€“17% swing in vCPU speed shouldnâ€™t have been there.
Turns out the answer was outside the TEE VM, in the Linux kernel on the host side. QEMU backs the TEE VMâ€™s RAM with a memfd, and the host kernelâ€™s kcompactd daemon periodically tries to build contiguous free memory by isolating and migrating pages [7]. We had locked the TEE VMâ€™s memory, and locked pages land on the unevictable LRU [8]. But unevictable doesnâ€™t mean unmovable: with the default vm.compact_unevictable_allowed=1, the host kernel still tries to migrate them.
So on every pass, the hostâ€™s kcompactd scanned about 191 million pages, essentially the whole 736 GiB TEE VM. It worked through them for 45â€“55 seconds, never completed a successful compaction, and backed off for 500 ms << 6 = 32 s before starting again. Each attempt went through the KVM MMU notifier and invalidated the TEE VMâ€™s memory mappings. The TEE VM paid the full cost every cycle, and the host never got any contiguous memory out of it.
The numbers lined up closely. We compared each hostâ€™s page-isolation rate with its own TEE VMâ€™s slow-mode fraction over October 2â€“5, in 30-second intervals. On all ten hosts with PoH data, the two correlated at r = 0.94â€“0.99. Pairing a host with a different hostâ€™s TEE VM gave r â‰¤ 0.11. TEE VM memory size divided by the hostâ€™s average scan rate also predicted the cycle period on 28 of 30 hosts, with an average error of 1.8% and a worst case of 4.4%.

TEE VM memory was already locked with QEMU -overcommit mem-lock=on-fault [9], so the fix was two runtime sysctls on the host side [10]:
vm.compact_unevictable_allowed=0, so locked pages are never isolated for compaction
vm.compaction_proactiveness=0, so there is no background compaction pass
On October 5, between 21:44 and 21:52 UTC, we applied the fix to all 15 warm-spare hosts. The 15 serving hosts stayed unfixed, which gave us a control group.

This canary proved the hostâ€™s scan was throttling the TEE VMâ€™s vCPUs. The fixed hosts were spares, though, and werenâ€™t producing blocks, so the canary couldnâ€™t show that the throttling caused small blocks. For that we needed a different experiment.
Results
Proving causation on hosts that were producing blocks
The slow mode is periodic, so it works as a natural experiment. On any unfixed host that was serving traffic, each block was produced during either a slow phase or a fast phase. Everything else is the same between the two: the host, the build, the validators connected to it, the time of day. If the slow mode causes small blocks, small blocks should pile up in the slow phase.
We took the six unfixed hosts that served the most traffic from October 2 to 5. For each 5-second window, we classified the TEE VM as slow or fast using the midpoint between that hostâ€™s 10th and 90th percentile hash time. Then we placed each of 293,000 produced BAM blocks on that timeline.

The slow phase covered about 62% of the time and 63% of all blocks. It also held 89% of the small blocks.

A block built during a compaction pass was 4.8 times as likely to be small (95% CI: 3.4â€“6.9Ã—). The effect showed up on every host individually, ranging from 2.3Ã— on the mildest to 17Ã— on the most affected.
Fleet impact
On October 6 we moved serving traffic to the warm spares, which had received the host-side fix the day before. Before the fix, their TEE VMs had run in the slow mode with a 9â€“12% PoH spread. After the fix that spread was about 1.2%, and hashing was about 9% faster overall.

The small-block rate fell by about 77%, from about one block in 800 to one in 3,600.
The phase analysis predicts almost exactly that. Before the fix, fast-phase blocks were small 0.031% of the time. After the fix, everything runs in what used to be the fast phase, and the fleet came in at 0.028%. Removing the slow mode accounts for nearly the whole drop.
What the other fixes did:
Scheduler and allocator fixes: removed real tail latency and stopped BAM from slowing replay. They may have lowered small blocks too, but they shipped alongside host changes, so we canâ€™t measure their share.
Linux BBR fixes: closed a real throttling path, confirmed by a reproducer, with no visible change in the fleet small-block rate.
Late-forward rejections (OUTSIDE_LEADER_SLOT): fell from 6.3â€“7.9% of validator responses to 4.4â€“4.6% from October 7, so more of each leader window is now usable.
We started out hunting for a scheduler bug, and the largest single win turned out to be two sysctls on the host kernel.
Comparison across clients
With these improvements in place, we compared BAMâ€™s block-packing performance against other clients, measured by the share of small blocks (under 7M CU) produced. We looked at the period before the initial fixes (Sep 16â€“29) and after they were finalized (Oct 9â€“20).
In aggregate, the share of small blocks produced by BAM leaders fell from 0.1044% to 0.0325%, a 69% improvement. Over the same period, the rest of the cluster moved in the opposite direction: the non-BAM small-block share rose 73.7%, from 0.2911% to 0.5056%.
As a result, the gap widened significantly. In September, non-BAM leaders produced small blocks at about 2.8x the rate of BAM leaders; by October, that rate was 15.6x.

Conclusion
Every fix in this post started the same way: a per-slot timeline or a profile, a controlled test, then a before-and-after measurement in production. Four of those fixes removed real stalls inside BAM, but we couldnâ€™t tie any of them to a measurable drop in small blocks. The change that mattered most was two lines of host config, outside the TEE VM entirely. We found it only because we kept measuring after fixing the obvious suspects, when the small-block rate still hadnâ€™t moved much.
There is still more work to do. About one BAM block in 3,600 still comes in small. Since writing this, weâ€™ve been working on faster ingress, simulation, bundle filtering, and other performance improvements.
What do you want us to write about next? Let us know by tagging @buffalu__ on x or in #validator-general in Discord.
References
AMD, â€œAMD SEV-SNP: Strengthening VM Isolation with Integrity Protection and More,â€� white paper. https://www.amd.com/content/dam/amd/en/documents/epyc-business-docs/white-papers/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf
Anza, â€œLeader Rotation,â€� Agave validator documentation. https://docs.anza.xyz/consensus/leader-rotation
N. Cardwell, Y. Cheng, C. S. Gunn, S. Hassas Yeganeh and V. Jacobson, â€œBBR: Congestion-Based Congestion Control,â€� ACM Queue 14(5), 2016. https://queue.acm.org/doi/full/10.1145/3012426.3022184
IETF CCWG, â€œBBR Congestion Control,â€� Internet-Draft draft-ietf-ccwg-bbr. https://datatracker.ietf.org/doc/draft-ietf-ccwg-bbr/
Linux kernel source, net/ipv4/tcp_bbr.c. https://github.com/torvalds/linux/blob/master/net/ipv4/tcp_bbr.c
jemalloc manual, background_thread option. https://jemalloc.net/jemalloc.3.html
Linux kernel documentation, â€œPage migration.â€� https://docs.kernel.org/mm/page_migration.html
Linux kernel documentation, â€œUnevictable LRU Infrastructure.â€� https://docs.kernel.org/mm/unevictable-lru.html
QEMU documentation, -overcommit mem-lock=on|off|on-fault. https://www.qemu.org/docs/master/system/invocation.html
Linux kernel documentation, /proc/sys/vm: compact_unevictable_allowed and compaction_proactiveness. https://docs.kernel.org/admin-guide/sysctl/vm.html
Solana, â€œReduced Slot Timesâ€� (SIMD-0525). https://solana.com/upgrades/reduced-slot-times

Methodology: small block = heartbeat-attributed, BAM-produced block below 7,000,000 cost units, from bam.enriched_block_stats. Phase classification uses poh-service total_hash_time_us / hashes in 5-second windows. One validator that produced only small blocks (68 of 68) from October 2 to 5 is excluded as a validator-side outlier. Confidence intervals are Poisson.(Historical earnings: For 2026Q2 (period ended 2026-06-27), AMD reported basic EPS of 2.26, diluted EPS of 2.22, net income of USD 3.680 billion, and revenue of USD 21.789 billion. Consensus expectations: For 2026Q3, consensus expects EPS of 1.9346 and revenue of USD 13.078 billion.)

10/100·CNeutral+23

news11h agonews

Eyes on the Market: At Cost Basis BTC dropped below $80K on Saturday. BTC fell 1.98% to $80,386 after a low of $79,107, and ETH fell 2.64% to $2,344. Thursday’s selloff erased Wednesday’s run to $84,856. Oil hit a six-month high. Brent closed Friday at $116.72, its highest close since April 29, as Gulf attacks reached Saudi energy infrastructure. Gold fell 4.31% to $4,004. The Fed is priced to hold on Wednesday. Polymarket puts a hold on October 28 at 95%. October hike odds peaked at 48% after CPI on October 14 and now sit at 6%. Treasury companies slowed down. Strategy bought 267 BTC and spent $193.1M buying back STRC ahead of its October 28 shareholder vote and MSCI’s November 11 list. Liquidations hit both sides. Shorts lost $498.1M as BTC rallied into Wednesday, then longs lost $1.23B from Thursday to Saturday. IBIT carried BTC ETF flows. BTC ETFs took in $301.2M. IBIT drew $565.7M while every other fund combined lost $264.5M. In October so far, IBIT sits at +$755.2M and the rest at -$1,068.7M. ETH ETFs posted a fourth straight outflow week. They lost $220.7M this week and $1.22B since September 28, erasing 75% of the year’s inflows. Oil Up, Everything Else Down BTC opened Monday at $82,007 and closed Sunday at $80,386, down 1.98%. ETH fell 2.64% to $2,344. Total crypto market cap fell 2.73% to $2.77T. BTC peaked at $84,856 on Wednesday and closed the day at $84,613, up 3.18% on the week, with ETH up 3.45% to $2,491. Thursday erased both gains as tanker attacks near Hormuz sent Brent higher and Big Tech sold off. From Wednesday’s close, BTC fell 4.08% and ETH 4.45%, while the Nasdaq Composite dropped 2.60%, its worst session since June. BTC fell 1.6 times as far as the Nasdaq that day. BTC broke below $80K on Saturday to a low of $79,107, under Glassnode’s estimated $80.2K average cost basis for ETF and treasury-company holders. It lost 1.14% from Friday to Sunday, and ETH lost 2.28% over the same stretch. Equities fell with crypto, but by less. The S&P 500 was down 0.71% and the Nasdaq Composite 1.34% by Sunday on weekend futures, after closing Friday’s cash session down 0.97% and 1.67%. Brent peaked at $116.72 on Friday and finished the week up 4.93%. Gold fell 4.31% to $4,004. Events of the Week Oil hits a six-month high Houthi attacks hit Saudi targets, including energy infrastructure, and about seven tankers were reported damaged near Hormuz by Thursday. On Wednesday the State Department ordered staff out of Saudi Arabia and cut staffing in Jordan, Lebanon, Qatar and the UAE. Brent closed Friday at $116.72, its highest close since April 29. The 10-year fell from 5.13% to 4.96% on Thursday, its largest one-day drop since March 2023, then closed Friday back at 5.00%. The 20-year auction cleared at 5.469%, up from 5.420% at the prior auction. A hold is expected Polymarket puts a hold at the October 28 FOMC at 95%, with hike odds at 6%. They spent most of the month higher. September payrolls set a low starting point, at 29,000 against 90,000 expected, with unemployment up to 4.2%. The October 14 CPI print then took hike odds from 22% to 48%, and they settled near 30% within a day. On October 15, PPI beat forecasts and odds still slipped, as New York Fed President John Williams said he had no reason yet to believe the Fed would need to do more. They fell to 13% after Warsh spoke at the IMF and World Bank meetings in Bangkok, where he declined to comment on the October 27–28 meeting and said only that the Fed will deliver price stability. December remains the most likely meeting for a hike, with odds sitting at 77%. Treasury companies slow down Strategy bought 267 BTC for $22.1M, spent $193.1M buying back STRC preferred shares, and raised its buyback authorization from $2B to $3B. The STRC shareholder vote is on October 28, and MSCI publishes its index decision on November 11. Strive bought 1,223 BTC for about $100M. Elsewhere: BlackRock filed for a buffered BTC ETF. Franklin Templeton’s BTC dividend-reinvestment ETFs take effect October 27. Standard Chartered agreed to acquire Zodia Custody. Germany’s Sparkassen opened crypto trading. Comment periods closed for the Fed’s GENIUS Act rules on October 19 and the SEC’s Regulation Crypto proposal on October 20. Polymarket gives Democrats a 92% chance of winning the House and 66% for the Senate ahead of the November 3 midterms, which open the lame-duck window for any second attempt at CLARITY. Volatility, Positioning and Leverage BVIV fell 4.8% from 40.76 to 38.82 by Tuesday’s close as BTC rallied, the weekly low. It then rose with the selloff, and closed higher on every day - but Friday - adding about 2% on Thursday and finishing Sunday at 41.13, up 0.9% on the week and 6.0% off the low. That close is within a tenth of the October 14 high, the highest daily close of the past month. Over the month, BVIV is up 10.8% from about 36.9. Aggregate futures open interest is $138.3B, against $140B last issue, down 1.2%. Coin-denominated BTC open interest has climbed from a low of 619K BTC on October 12 to 671K, still below its average for the year. Liquidations hit both sides. As BTC rallied to Wednesday’s high, $498.1M of shorts were liquidated from Monday to Wednesday. The selloff then flushed longs. Daily liquidations doubled to an average of $504.2M from Thursday to Saturday, $1.51B in total, with longs taking $1.23B of it, 82%. Saturday’s break below $80K was the largest day at $547.2M. BTC ETF Inflows Return as ETH Outflows Persist BTC and ETH ETFs took in $80.5M combined. BTC carried the week, and ETH lost money for a fourth straight week. BTC: +$301.2M. This week broke the outflow streak of the prior two weeks, but the net figure hides how volatile flows were. Monday to Wednesday brought $1.07B of inflows, then Thursday and Friday lost $774M. Thursday’s -$635.6M was the largest single-day outflow since June 25 (-$691.7M). IBIT drove the inflow days. It took in $665.2M on Monday, its largest day of 2026 and its biggest since October 7, 2025, and finished the week at +$565.7M. Every other fund combined lost $264.5M. For October to date, IBIT has drawn +$755.2M while the rest of the complex has lost $1,068.7M. Year-to-date flows sit at +$656.3M, down from +$1,021M on September 25. Our research on ETF flows found that IBIT’s flows predict price no better than the rest of the complex. On the 15 days IBIT took in big money while other funds sold - as it did Monday - BTC fell 0.86% on average over the next five days. Wednesday’s inflow landed on the week’s high and Thursday’s outflow on the same session as the selloff, which fits the broader finding that flows follow price. The level to watch is about $79.6K, 7% below October 6’s close of $85.5K, the highest close of the past 20 days. Once BTC closes 7% below its 20-day high, ETF flows have historically flipped from +$74M a day to -$72M within a week. Saturday’s $79,107 low broke through that line intraday, but BTC closed Sunday about 0.7% above it. From Monday’s close, the line drops to about $78.1K as early October’s highs leave the window. ETH: -$220.7M. This is the fourth consecutive outflow week. Since September 28, ETH ETFs have lost $1.22B, taking year-to-date flows from +$1,622M to +$400.5M. ETHA has not posted an inflow in 19 sessions: 15 outflow days, four flat, and -$1.04B in total. Across October, 14 of 17 sessions were outflows. Key Events for the Week Ahead Tuesday, October 27 US: FOMC convenes. Durable goods and Conference Board consumer confidence. Israel: Knesset election. Wednesday, October 28 US: FOMC decision, 2pm ET. A hold is priced at 95%, so the dissents matter more than the decision. Canada: BoC decision, 9:45am ET. About 80% priced for a hike. New Zealand: RBNZ decision. UK: Autumn Budget. Australia: Q3 CPI. Strategy: STRC shareholder vote, 10am ET. Thursday, October 29 US: Q3 GDP advance estimate and September PCE, 8:30am ET. Consensus is about 3.0% for GDP, 3.6% y/y for headline PCE and 3.1% y/y for core. Euro area: ECB decision. Coinbase and Strategy earnings, after the close. Friday, October 30 Japan: BoJ decision. Euro area: Q3 GDP, plus flash October CPI for Germany, France, Italy and Spain.(Historical earnings: For fiscal 2026Q2 (period ended 2026-06-30), Coinbase reported basic and diluted EPS of -2.85, net income of USD -0.754 billion, and revenue of USD 2.633 billion. Consensus expectations: For the upcoming 2026Q3 event on 2026-10-29, consensus EPS estimate is -0.2169 and revenue estimate is USD 1.203 billion.)

78/100·ALong+23

meme16h agomeme

Oil drops from near six-month highs on hopes Iran war hostilities to ease https://reut.rs/3WaEzC8

72/100·B+Short+1

meme17h agomeme

ZEROBASE WEEKLY 10.19–10.25 ZBT traded in a narrow band after opening the week near $0.068 on October 19. It pushed toward $0.071–$0.072 midweek on lighter volume, then gave back the gains and settled near $0.068 by the weekend. Spreads stayed tight and liquidity remained orderly, with no sharp liquidity gaps on the pullback from the local highs. Crypto spent the week consolidating after the early-month slide. Total market capitalization hovered between roughly $2.73T and $2.86T, peaking midweek before settling near $2.70T–$2.73T by Sunday. Bitcoin dominance held in the 59%–60% range. Bitcoin opened October 19 near $81,800–$82,000 after the prior weekend close around $82,000. It rallied as much as 3%–4% to a weekly high near $84,500–$84,800 on October 21–22, then reversed sharply. Price spent the remainder of the week sliding through the $81,300 area and closed near $80,400 on October 25. From the October 18 close that is a net decline of roughly 1.5%–2%, with the bulk of the damage coming after the midweek rejection. Ethereum followed the same path. ETH opened near $2,400–$2,410, printed a weekly high around $2,500–$2,525, then faded and finished near $2,340–$2,350. That left ETH roughly flat to slightly lower on the week. Derivatives and ETF flows told a clear two-phase story. U.S. spot Bitcoin ETFs drew roughly $1.07 billion from Monday through Wednesday ($527 million on October 19, $23 million on October 20, and $525 million on October 21), the strongest three-day run in nearly a month. The move reversed on Thursday and Friday with outflows of about $636 million and $138 million respectively, leaving the week with a net inflow of roughly $301 million and ending a two-week streak of outflows. Ether ETFs finished the week with approximately $221 million in net outflows. The late-week redemptions coincided with the price rejection above $84,000 and helped explain why the bounce failed to hold. Macro and geopolitics remained the dominant backdrop. The Federal Reserve stayed in its blackout period ahead of the October 28 decision, with markets pricing only a low single-digit probability of a hike. The 10-year Treasury yield began the week near 5.15% and finished near 4.95%–4.99%, with a sharp drop of nearly 20 basis points on Thursday—the largest one-day decline in years—as equities sold off and oil volatility rose. Oil itself stayed elevated amid the ongoing U.S.–Iran conflict, Houthi attacks, and Strait of Hormuz risks. Brent settled the week near $116–$117 after touching six-month highs, while WTI ended around $103. A temporary Russia sanctions waiver and mediation signals early in the week briefly eased prices, but renewed escalation talk later reversed the move. Falling yields and the equity rotation provided some offset for risk assets, yet the oil premium kept financial conditions from easing cleanly. U.S. equities finished mixed after a volatile week. From the October 16 close, the S&P 500 fell about 0.5% to 7,623.68. The Nasdaq Composite declined roughly 0.7% to 25,955, while the Dow rose about 0.4% to 52,215 and the Russell 2000 gained 2%. Monday and Wednesday posted modest gains; Thursday saw the largest decline of the week (S&P −1.2%, Nasdaq −2.6%) as Meta and semiconductor names sold off on AI spending concerns. The tape then stabilized on Friday. Leadership rotated away from mega-cap tech toward healthcare, consumer staples, and smaller caps, leaving the equal-weight S&P higher even as the headline index finished lower. Crypto Fear & Greed began the week in the high-50s (Greed), reached the mid-to-high 60s on the midweek bounce, and then cooled into Neutral territory in the low-to-mid 50s by the weekend. The shift matched the price action: early optimism around ETF inflows and the equity bid faded once the $84,000 rejection and Thursday equity selloff arrived. On-chain data showed elevated whale activity without a decisive accumulation or distribution signal. Several sessions recorded net exchange inflows in the low thousands of BTC, consistent with supply testing during the midweek rally and subsequent fade. One of the largest single-day bursts of large-UTXO spending in 2026 occurred around October 23, with more than 230,000 BTC (roughly $21 billion) moving on-chain; most of the coins had been dormant for one to six months and the transfers appeared to be between wallets rather than to exchanges. Mid-tier and whale cohorts remained mixed, with some wallets flipping to distribution while others continued to accumulate. In summary, October 19–25 was a failed bounce followed by consolidation. Spot prices briefly reclaimed the $84,000 area on the back of the strongest ETF inflow streak in weeks, then surrendered the gains as equities rotated out of AI names and oil remained elevated.

10/100·CNeutral+21

meme21h agomeme

@coinbureau The issuer pushback is part of the story too. The tokenization that lasts will probably be built with companies and regulators, so holders know exactly what they own. Reply to @coinbureau: A month ago, we warned that “MASS TOKENIZATION” was coming. Today, it’s breaking records, and the numbers are getting hard to ignore. Stocks. Bonds. Bank deposits. Investment funds. The way we invest and move money is changing. You could end up using blockchain without even knowing it. What’s already changing: Wall Street is going onchain, with the NYSE’s parent company and OKX originally proposing over 60 US stocks as tokens Government debt is going onchain, with Hong Kong issuing a RECORD $2.6 BILLION digital bond and Luxembourg issuing €1.7 BILLION Tokenized stocks and ETFs total $3.53 BILLION across 4.42 MILLION holder addresses, per RWA(.)xyz Bank dollars are going onchain as JPMorgan expands JPM Coin to Ethereum for institutional clients The pushback is also growing, with Microsoft, Alphabet, Goldman Sachs and Wells Fargo among 22 companies opposing tokens of their shares on the planned OKXICE venue Investment funds are following, with Franklin Templeton’s Singapore fund reportedly adding roughly $150 MILLION in fund shares on the XRP Ledger Trading hours are stretching, with Nasdaq targeting 23 hours of weekday trading from December 6 Britain is preparing its own digital government bond pilot, with six banks appointed to lead it Most trades are fractional, with about 80% of tokenized stock trades in an IMF study smaller than one share Buying a stock token does not necessarily make you a direct shareholder in the company

25/100·CNeutral+12

meme23h agomeme

BRENT CRUDE SLIPPED ABOUT 1% FROM A SIX-MONTH HIGH TO AROUND $115.60 A BARREL, WHILE GEOPOLITICAL RISKS REMAINED ELEVATED AS US-IRAN TENSIONS INTENSIFIED. INVESTORS ALSO MONITORED PRESSURE ON CHIPMAKERS, WITH THE PHILADELPHIA SEMICONDUCTOR INDEX POSTING ITS LONGEST LOSING STREAK SINCE NOVEMBER, AS EARNINGS, CENTRAL BANK GUIDANCE AND MIDDLE EAST DEVELOPMENTS SET THE TONE FOR MARKETS.(Historical earnings: For fiscal 2026FY (period ended 2026-09-03), Micron Technology reported basic EPS of 75.38, diluted EPS of 74.33, net income of USD 84.969 billion, and revenue of USD 133.188 billion. Consensus expectations: For the upcoming 2026Q4 event, consensus expects EPS of 32.5625.)

72/100·B+Short+3

meme10/25meme

BRENT HAS RISEN AROUND 90% THIS YEAR AMID WAR-RELATED SUPPLY DISRUPTIONS, WITH FURTHER US-IRAN ESCALATION AND REGIONAL CLASHES THREATENING INVENTORIES; CBA ANALYST VIVEK DHAR SAID BRENT MAY NEED TO REACH $150 A BARREL TO TRIGGER SIGNIFICANT DEMAND DESTRUCTION IN EMERGING ASIAN ECONOMIES. Reply to @FirstSquawk: OIL PRICES EASED AFTER RALLYING MORE THAN 6% LAST WEEK TO A SIX-MONTH HIGH, WITH BRENT FALLING 0.7% TO $115.87 A BARREL AND WTI SLIPPING 0.9% TO $102.33, AS TECHNICAL OVERBOUGHT CONDITIONS AND MIDDLE EAST GEOPOLITICAL RISKS KEPT MARKETS VOLATILE.

72/100·B+Long

meme10/25meme

"In total, 15 people, including six medical professionals, were charged over $1. 8 billion in fraudulent claims submitted to government and private health insurance programs, the Justice Department said." https://www.foxnews.com/us/federal-authorities-charge-15-massive-1-8b-southern-california-medical-fraud-sweep

5/100·CNeutral

news10/25news

CENTCOM Commander Visits Strait of Hormuz during Milestone Week

STRAIT OF HORMUZ — The commander of U.S. Central Command (CENTCOM) visited the Strait of Hormuz, Oct. 25, as U.S. forces reach the milestone of assisting Gulf partners in exporting more than 1.5 billion barrels of crude oil since summer.
Adm. Brad Cooper observed the current operational environment while flying in a U.S. Army CH-47 Chinook over the international waterway. More than 3,000 commercial vessels have successfully transited the Strait of Hormuz with support from CENTCOM forces over the last six months.
"We continue to stand shoulder to shoulder with our Gulf partners and the shipping industry," said Cooper. "This visit underscores our strong commitment to continued freedom of navigation through the Strait of Hormuz."
Momentum has continued to build in recent months since American forces successfully cleared the strait's international shipping lanes of sea mines laid by Iran's Islamic Revolutionary Guard Corps (IRGC).
During the trip, Cooper met with the U.S. service members who supported the mine clearance mission. He thanked them for their continued commitment and dedication.
"Today, primary transit routes in the Strait of Hormuz remain free and clear of Iranian sea mines thanks to incredible efforts by our people," said Cooper. "We remain intensely focused on keeping commercial traffic flowing as we work with our teammates in the U.S. interagency, Gulf Cooperation Council, and shipping industry."
In recent months, over 95% of ships navigating the Strait of Hormuz have sailed through safely despite the IRGC's unwarranted aggression, clearly demonstrating that the United States and regional partners control the international waterway.

25/100·CNeutral+1

meme10/25meme

@pukerrainbrow Throughput changes what agents are for. A 10-minute task gets queued and checked later. A 20-second one you iterate on live, retry and refine while it's still in your head. Same model, different product. Reply to @pukerrainbrow: An AI agent task that takes 10 minutes at 100 tokens per second would take about 20 seconds at 3,000. Gimlet Labs wants to deliver the second number. It raised $300 million at a $3 billion valuation less than a year after leaving stealth. The company is based in San Francisco and led by CEO Zain Asgar, a former NVIDIA GPU architect who also led engineering at Google AI and teaches as an adjunct professor at Stanford. His co-founders include Michelle Nguyen, Omid Azizi, and Natalie Serrino. The four built Pixie Labs, a Kubernetes observability startup that New Relic acquired in 2020. The problem, Gimlet says, is that many inference clouds are built on one kind of GPU, which forces a tradeoff between total throughput and the speed each user experiences. It argues that inference isn't one uniform workload. Processing the prompt, generating the answer, attention, and feed-forward layers all stress chips differently. So Gimlet splits the job and runs each piece on the chip best suited to it. It works with chips from six makers, NVIDIA, AMD, Intel, Arm, Cerebras, and d-Matrix. Its software orchestrates the pieces, and developers see a standard inference API. The company says this delivers either 3 to 10 times higher interactivity or 3 to 10 times more throughput per kilowatt, depending on which target you hold fixed. It also sells Gimlet Cloud, serverless inference for AI agents, and kforge, which generates optimized GPU kernels from PyTorch code. The company is moving beyond software into infrastructure. It says it is securing data center capacity and is hiring data center architects. On September 28, Gimlet announced a partnership with Cerebras to deploy 100 megawatts of Cerebras-powered inference capacity. The first datacenter is expected online later this year, with speeds of up to 3,000 tokens per second. Gimlet will also be a launch partner for Cerebras's next system, the CS-4, in 2027. On September 4, Gimlet raised a $300 million Series B led by Andreessen Horowitz at a $3 billion valuation. Sapphire Ventures, M12, Arm, Menlo Ventures, Samsung Ventures, and Tiger Global joined, among others. Earlier came a $12 million seed and an $80 million Series A led by Menlo in March, bringing total funding to $392 million. Gimlet says it has tripled its customer base since March and added one of the top three frontier AI labs and one of the top three hyperscalers. It hasn't disclosed revenue or a customer count. Asgar says the future of inference is vertically integrated and multisilicon, with many chip architectures orchestrated as one system.

10/100·CNeutral+12

meme10/25meme

Injective's INJ has now traded as a US-regulated future on Bitnomial for six months, one route to a spot ETF under the SEC's generic listing standards. 21shares and Canary Capital have INJ ETF filings pending. @injective Retweeted by @injective from @MSBIntel

72/100·B+Long

news10/24news

OVERTRADING

October 10, 2025

i had what would become the single biggest one-day loss of my career

i lost eight figures in minutes due to systemic failures on the biggest CEXs, and to this day, no one has taken accountability for what happened

my losses made headlines and became one of the biggest stories to come out of that day

but what many people don't know is what happened in the weeks and months that followed

i lost several million more

and i did it by making one of the biggest mistakes traders like me tend to make:

OVERTRADING

in hindsight, i would have been far better off shutting everything down for the next few months or even quarters

i probably would have become a much better trader if i had simply stayed away from the computer for at least six months

but a part of me was desperate for action

a part of me wanted to make it all back

a part of me wanted to prove that i still had what it takes and that i would get back on my feet

i wanted to 'work'

and sitting back, doing nothing, and staying away from the computer for a prolonged period didn't feel like work

except that, for a trader, being AFK can sometimes be the most important work you do

one of the biggest mistakes i made — and that many traders make — is assuming that skill, experience, and process are enough to consistently outperform the market

they aren't

believe it or not, successful trading is often a combination of skill, favorable market conditions, timing, and luck

as a Christian, i attribute the 'luck' component to GOD's blessings and favor rather than sheer luck

but the underlying principle remains the same:

our biggest wins often come from combining a solid process with being in the right place at the right time

sometimes, that means catching a single exceptional trade

other times, it means being positioned during a streak of opportunities that emerge in quick succession because market conditions are overwhelmingly in your favor

for example, you could have been a memecoin god simply by being active in the market during the explosive memecoin era of 2021, which produced $DOGE, $SHIB, $FLOKI, and several other billion-dollar runners

many traders made life-changing money during that period

but the same sophisticated processes that helped some of us make 7, 8, or even 9 figures during the bull market would have failed miserably in the bear market that followed in 2022

the same principle applies to the 2024–early 2025 era, which produced several multibillion-dollar runners like $WIF, $POPCAT, and $FARTCOIN

and then the prolonged dearth of opportunities after $TRUMP leading to 10/10 and the almost one-year period following

the point is simple:

the edge that makes you money in one market environment won't necessarily make you money in another

and one of the most important skills you can develop as a trader is recognizing when your edge is no longer there

sometimes, the best trade is no trade at all

sometimes, the smartest thing you can do is take a bow, step away, and wait for the next opportunity

even if only temporarily

it's almost impossible to consistently beat the market over a sufficiently long timeframe

but as crypto traders, we have one significant advantage:

we don't need to outperform the market every single day, week, or month to generate exceptional returns

historically, crypto's bull phases have tended to occupy a disproportionate share of the cycle, with bear phases accounting for a smaller portion

using one historical framework, the bull phase averages approximately 1,060 days, or 74% of the cycle, while the bear phase averages around 380 days, or 26%

but if your definition of a bull run is narrower — i.e. a period of explosive momentum when $BTC trades above its 200-day moving average and much of the cycle's biggest price action occurs — then the window becomes significantly shorter

under that framework, we're talking about approximately 237 days, or around 16% of the cycle

these figures are estimates based on particular definitions of market phases, not universal constants

but the broader lesson remains:

you don't need to trade every market. you need to recognize the windows when your edge is strongest and capitalize on them

for the rest of the time, there's nothing wrong with stepping away entirely or trading only with a tiny fraction of your portfolio that you can comfortably afford to lose

preserving your capital, your mental clarity, and your ability to recognize the next major opportunity is far more important than forcing trades in unfavorable conditions

because the goal isn't to be active all the time

the goal is to be positioned when it matters most

and to have the discipline to do nothing when it doesn't

to conclude, i only wish i had followed this advice myself

hopefully, i'll do a better job of applying it going forward, GOD WILLING

10/100·CNeutral+13

news10/24news

Inside the iOS Exploit Underground: Crypto Theft Executive Summary Since late 2025, a cybercrime ecosystem has rapidly taken shape around a clear objective: exploit vulnerabilities in older iOS versions to steal Web3 private keys and crypto assets. At its core are two nation-state-grade, full-chain iOS exploit kits: Coruna, covering iOS 13.0–17.2.1, and DarkSword, covering iOS 18.4–18.7. Within a single year, both passed from commercial surveillance vendors to state-sponsored threat actors and then to cybercriminal groups. The source code leak in March 2026 opened the floodgates. Security industry telemetry now shows roughly 17,000 domains hosting second-generation variants of the two toolkits. The ecosystem has already matured into an end-to-end criminal supply chain: - Upstream: Zero-day exploits are brokered and resold. - Midstream: Turnkey malware clients and admin panels are openly sold on Telegram. - Downstream: Operators distribute attacks through watering-hole sites, spoofed pages, QR-code phishing, supply-chain hijacking via expired domains, and even trojanized apps that pass Apple’s official App Store review. This report dissects that supply chain: the technical components of its arsenal, each stage of the attack chain, the division of labor and flow of funds, and the steps users should take during the current window of exposure. I. The Cost of Unpatched iOS: How the Attack Surface Takes Shape 1.1 The Patch Gap and the Legacy Device Base In this report, “outdated” refers to unpatched operating system versions, rather than the age of the hardware. The iOS security model rests on an ideal assumption: users install updates promptly. In practice, that assumption fails systematically at three levels. First, devices reach their upgrade ceiling. The iPhone X and earlier models top out at iOS 16, while older generations are limited to iOS 15. These devices will never receive new patches, creating a vulnerable installed base—and a market for exploitation—that only grows. Second, the patch gap creates an opportunity for attackers. The day a security fix is announced is often also the day the attack becomes public. For users who do not update, a gulf separates “officially patched” from “actually protected”—one wide enough for criminal operators to harvest victims on an industrial scale. Third, version-specific exploit development has become systematic. Modern exploit kits no longer rely on a single vulnerability working across every iOS release. They package separate exploit code for each version and select the appropriate code at runtime. Version diversity is no longer an obstacle. It turns outdated releases into a target list operators can systematically enumerate. 1.2 Why Private Keys Are a Priority Target The economics are straightforward. Stolen bank credentials still leave attackers facing fraud controls, transfer limits, and account freezes followed by appeals. Crypto seed phrases and private keys offer four distinct advantages: - Hard to freeze: No central authority can arbitrarily reverse an onchain transfer. - Rapid monetization: Assets can be moved in seconds. - High value per device: Crypto holdings on a single mobile device often range from tens of thousands to millions of dollars. - No victim confirmation required: The entire theft can proceed without the victim confirming anything. Another factor is often overlooked: user behavior. A substantial share of crypto holders keep screenshots of their seed phrases in photo libraries, copy them into notes, or save them in chat bookmarks. For attackers, these are goldmines. This is no coincidence. It reflects deliberate, detailed research into how users store the secrets that control their assets. II. The Exploit Arsenal: Attack Chains and Trojanization Cases 2.1 Coruna: An Exploit Toolkit Spanning iOS 13–17 Publicly disclosed on March 3, 2026, Coruna—previously tracked within the mobile security industry as CryptoWaters—covers the widest range of iOS versions of any publicly documented exploit toolkit. It packs five complete exploit chains and 23 individual exploits, covering every release from iOS 13.0, launched in September 2019, through iOS 17.2.1, released in December 2023. It supports both arm64 and arm64e architectures. Industry estimates put its development cost at $30 million–$40 million. This is not something an ordinary attack team could build. Its developers could be called professional arms dealers of the digital age. The vulnerability matrix below breaks down the toolkit by attack stage. Two exploits used for privilege escalation and PPL bypass—Photon and Gallium—are the same ones used in Operation Triangulation in 2023. Their appearance in both operations provides direct evidence of advanced exploit technology circulating between threat actors. The JavaScript framework uses a minimal but distinctive obfuscation scheme: both strings and integers are XOR-encoded and decoded only at runtime. Resource URLs never appear directly in the code. Instead, they are derived from a hardcoded cookie using sha256(COOKIE + ID)[:40]. Later-stage binary payloads are delivered under .min.js paths to disguise their contents. A custom file format begins with the magic value 0xf00dbeef and uses per-blob ChaCha20 encryption with independent keys, alongside LZW compression. Each payload carries metadata specifying the chipsets and iOS versions it supports. If exploitation fails, the toolkit proactively deletes crash logs associated with com.apple.WebKit.WebContent, powerd, and panic to minimize forensic traces. At the end of the chain sits PlasmaLoader, an implant identified as com.apple.assistd, which injects into the powerd daemon running as root. The core payload is then injected into locationd, imagent, and SpringBoard. The first serves as the coordination hub; the latter two handle an SMS-based fallback communications channel and interaction with the device’s home screen, respectively. The module list reveals the operation’s real objective. The implant retrieves a JSON configuration packaged in an encrypted 7z archive from http:///details/show.html. Stealer modules are then dynamically delivered based on the apps installed on the victim’s device. Public research has reconstructed the following configuration excerpt: There are 18 such modules, targeting major wallets including BitKeep, Bitpie, Coin98, Coinbase, Exodus, imToken, Krystal, MetaMask, MyTonWallet, Phantom, Skymavis, Solflare, Tonhub, Tonkeeper, TronLink, Trust Wallet, and Uniswap. Beyond these wallet-specific modules, the payload has three capabilities worth remembering: Photo-library scanning and QR-code decoding: It reads every image in the photo library and decodes embedded QR codes to extract addresses and private keys. Apple Notes scanning: It searches the full text of notes, matching against the BIP39 wordlist and keywords such as “backup phrase,” “备份短语” (“backup phrase”), and “银行账户” (“bank account”), then uploads matching content. Social-app communications interception: It hijacks communications data from WhatsApp and other social apps. Traces of further development by cybercriminal operators are equally clear. Logs inside the stealer modules are in Chinese—for example, %s[%d]: CorePayload 管理器初始化成功，尝试启动... (“CorePayload manager initialized successfully, attempting to start…”). Some comments contain emoji, and the writing style strongly suggests LLM-generated text. One example is the heartbeat initialization message “✅ 心跳监控已启动” (“✅ Heartbeat monitoring started”). For exfiltration, data is encrypted with AES, using the SHA-256 hash of a fixed string as the key, and sent back through POST requests. Some requests include custom sdkv and x-ts headers. If the hardcoded C2 endpoint becomes unavailable, the malware falls back to a domain generation algorithm (DGA) seeded with the string lazarus. It generates .xyz domains with 15-character labels and uses public DNS resolution to check whether they resolve successfully. Coruna’s path through the threat ecosystem unfolded in three stages: February 2025: Security researchers first captured portions of the exploit chains being used by a customer of a commercial surveillance vendor. Summer 2025: UNC6353, a suspected Russia-linked espionage group, deployed the toolkit in watering-hole attacks targeting Ukraine. The group compromised websites in the industrial equipment, retail, and e-commerce sectors, embedding hidden iFrames pointing to cdn.uacounter[.]com/stat[.]html. The exploits were served only to iPhone users from selected geographic locations. Late 2025–early 2026: Financially motivated group UNC6691 deployed the same toolkit indiscriminately across numerous Chinese-language sites impersonating financial and crypto services. These fake exchanges and airdrop pages explicitly told visitors: “This page supports iOS devices only. Please visit using an iPhone or iPad”—precisely filtering for their intended victims. 2.2 DarkSword: Built for iOS 18, Entirely in JavaScript Jointly disclosed by several security organizations on March 18, 2026, DarkSword targets iOS 18.4–18.7 and was first observed in the wild in November 2025. Its defining design difference from Coruna is that every stage, including the final payload, is implemented in JavaScript. This sidesteps two of Apple’s toughest kernel mitigations: PPL (Page Protection Layer) and SPTM (Secure Page Table Monitor). These mitigations target the execution of unsigned native code; an all-JavaScript payload does not need to execute unsigned native code. The complete chain uses six CVEs, three of which were being exploited as zero-days when first observed. The landing page first checks the uid key in sessionStorage to prevent repeat infections, then inserts a hidden iFrame to load frame.html. That page uses document.write to include rce_loader.js. The loader retrieves the appropriate rce_worker_18.x.js for the device’s iOS version and runs the exploit logic in a Web Worker, coordinating with the main thread through postMessage. When Chrome is detected, the page redirects the user to Safari through the x-safari-https:// protocol handler—indicating that this chain has only a WebKit implementation. Bugs in the loader are revealing: some operators implemented version checks incorrectly and served the same exploit to every device; others did not even realize iOS 18.7 had already been released. These rough edges point to code that has changed hands repeatedly, with buyers of varying skill levels making their own fixes. Public research documents three early deployments: November 2025: UNC6748 targeting Saudi users. The group used snapshare[.]chat, a site impersonating Snapchat, to deliver GHOSTKNIFE, a JavaScript backdoor. It uses a custom binary protocol with ECDH and AES and can steal account data, messages, location data, audio recordings, and screenshots. During execution, it writes intermediate files to /tmp/./STORAGE and periodically deletes crash logs associated with mediaplaybackd, SpringBoard, com.apple.WebKit., and panic-full-. November 2025: PARS Defense operating in Turkey. The Turkish commercial surveillance vendor showed markedly better operational security (OPSEC). Its loader and all subsequent stages were obfuscated, and exploit delivery was encrypted throughout using ECDH and AES. In January 2026, another customer of the vendor operated in Malaysia. That deployment added an extensive set of device-fingerprinting checks to the landing page: Apple Pay availability, the standalone property, CSS backdrop-filter support, WebGL2, whether the Vibration API is present, and debugger detection. It deployed the GHOSTSABER backdoor, which supports 17 command types, including arbitrary SQLite queries, file exfiltration, and EvalJs. From December 2025: UNC6353 targeting Ukraine. The previously discussed group incorporated DarkSword into its watering-hole campaign through static.cdncounter[.]net/widgets.js. Its payload, GHOSTBLADE, is a comprehensive data harvester. It steals iMessage, Telegram, and WhatsApp databases, keychain contents, Wi-Fi passwords, photos, notes, crypto wallet data, Safari browsing history, and even health data. Based on its coding style and the depth of its library integration, researchers assess that GHOSTBLADE was most likely written by DarkSword’s original developer. Paths left in the webpack bundle also exposed an internal development framework named TaskRop and a reference to an unimplemented startSandworm() function. 2.3 Evolution After the Leaks: P7, Hybrid Variants, and gooll In March 2026, Coruna samples and decoded payloads appeared on GitHub, followed by readable source code for the entire DarkSword exploit chain. Section 4.1 provides the repository timeline. Over the subsequent months, criminal development of the two toolkits proceeded along three tracks. The first was substantial reengineering. Disclosed in early October 2026, the P7 DarkSword variant—named after the p7_ variable prefix in its code—removed HTTP and syslog debug logging. Instead of uploading the entire keychain database for server-side decryption, it extracts the data into JSON on the device before exfiltrating it. It also added bidirectional C2 with a 15-second heartbeat and 17 remote commands, including wallet_scan, wallet_extract (specifically targeting imToken), photo_scan, memo_scan, disk_scan, and exec. Browser localStorage prevents repeated exploitation of the same device. Mobile security research confirmed that the attackers possess Coruna’s source code: the changes were made through recompilation from source, rather than binary patching. The second was hybridization and splicing. Telemetry shows that some operators deploy both attack chains and even combine techniques from the two into hybrids informally dubbed DarkCoruna or Darkuna. Second-generation variants generally feature stronger jailbreak and virtualization detection, stronger encryption, and enhanced persistence mechanisms. Dedicated Telegram implants have also emerged. Meanwhile, numerous LLM-assisted imitations are circulating, many of them nonfunctional “AI slop.” The criminal market, too, is a mix of capable tools and unusable junk. The third was integration for full version coverage. Analysis of a Chinese-language operator’s production server uncovered a previously undocumented third delivery chain, gooll. Its gooll.html targets only devices running versions below iOS 18. Devices on iOS 18 or later are automatically redirected to /ios18/frame.html, entering the DarkSword branch. The two chains are seamlessly integrated. gooll’s kernel stage deserves particular attention. It abandons per-model offset tables entirely in favor of runtime fingerprinting: reading the XNU kernel build number, scanning drivers for byte signatures, and probing for the presence of IOKit services to select the appropriate exploit path dynamically. It uses five independent memory-access backends, falling back from one to the next in sequence. For PPL bypass, it includes two approaches: page-table forgery and ECC-aware writes. Every kernel write is self-verified through a write–readback–compare sequence. None of the binaries contain CVE identifiers—a hallmark of closed-source commercial toolkits that deliberately conceal the vulnerabilities they exploit. Its XNU version gates also match the version table in DarkSword’s 18.x chain, providing strong evidence that the two chains share a common origin. 2.4 FomoPeek: Bringing a Kernel Exploitation Framework to the App Store Web-based watering holes still require victims to visit the wrong site. The FomoPeek case, exposed in September 2026, showed that attackers can instead enter Apple’s official storefront and wait for victims to come to them. This is the report’s most extensively examined case: the forensic evidence is detailed enough to reveal every component of the attack chain. Packaging and user acquisition. Listed on the App Store as “FomoPeek – Whale Tracker & Smart Alerts,” the app presented itself as a whale-monitoring tool for Solana, Ethereum, and TRON. It explicitly promised “read-only access, no wallet connection, no seed phrase required.” It had a website, an official X account, and a free listing in the Finance category—all the outward signs of a legitimate project. Promotion ran through crypto influencers and communities. Users downloaded and registered with an invitation code, set a security code, and added wallets to monitor. They could earn 5–7 USDT by spending five to seven minutes in the app on a physical device, with “one opportunity per iPhone.” That time requirement was no marketing gimmick. As discussed below, its embedded cicuta_virosa exploit strategy takes more than two minutes per run. The campaign rules fit the technical requirements precisely. Trojanization timeline. The domain was registered on August 28, 2026, and version 1.0 appeared on the App Store on August 29. Version 1.1 (build 105), released on September 9, introduced the malicious modules. Version 1.2 (build 110), released on September 12, retained them. Version 1.3, released on September 17, removed both malicious frameworks entirely, shrinking the IPA from 10.47 MB to 1.81 MB. The malicious modules and the main executable were signed under the same Apple signing identity. The original IPA retained FairPlay encryption metadata, confirming that it was an App Store-distributed build, rather than a re-signed or sideloaded copy. By September 16, victims had already posted public theft warnings on X. Static analysis. The two malicious frameworks had distinct roles: apptrace handled C2 communications, while libapptracecore handled kernel exploitation and data collection. The main executable loaded both at startup through non-weak LC_LOAD_DYLIB commands. Yet all 1,048 imported symbols in its symbol table came from system libraries, with no explicit calls to framework class or method names. Even tracing three call levels from 34 C++ static initialization functions failed to reach the attack code. From a static-analysis perspective, these were two sleeper modules: loaded at launch and waiting for remote activation. Inside libapptracecore was a complete exploit arsenal: eight kernel exploit strategy classes inheriting from a common interface, each with a built-in check for whether the current device was supported. They declared coverage of iOS 12.0–18.7.2 and 26.0–26.1. The model table included devices from 2023–2025, including the iPhone 16 and 17 series. One strategy was explicitly named DarkSwordStrategy, covering the 16.7–18.7.2 and 26.0–26.1 ranges. Strings in the kernel components made their purpose clear:

72/100·B+Short+25

news10/24news

Israel Expands Military Operations In The West Bank, Beginning What Could Be Its Largest Offensive There In Decades.
Following a fatal attack on two IDF soldiers in the West Bank city of Hebron, Israeli Prime Minister Benjamin Netanyahu vowed to conduct an operation in the Palestinian territory "unlike any seen since the Six-Day War."

72/100·B+Long

meme10/24meme

@Meta Congrats @joulee!! Reply to @joulee: Today, we're announcing that Sundial has been acquired by @Meta! Chandra Narayanan and I are joining along with some other incredible members of our team. Nearly six years ago, Chandra and I started Sundial with two core beliefs: 1) better decisions come from using data well, and 2) great things come from working on hard problems with people you like. Sundial automated away many of the obstacles involved in getting to meaningful analysis (Cleaning data! Creating semantic layers! Writing SQL! Storytelling!), and we were proud to support some of the fastest-growing AI companies from OpenAI to Gamma. We started before the AI wave and rebuilt ourselves to be AI-native. We raised our first round when interest rates were near zero, and our Series A when they were the highest in two decades. We watched customers hyperscale and then close shop, new grads grow into leaders, and software development change completely. Entrepreneurship has been my dream since college, when I first took a class on start-ups (shoutout Mayfield Fellows!). I wish I'd been brave enough sooner because there’s no better way to learn how the world works and who you really are than betting on yourself to launch a business. Meta is my former home and where I learned product and design. It's also one of the most analytically rigorous places on the planet. So many of Sundial's values came from there: questioning assumptions, diagnosing with data, owning the user’s experience. I'm thrilled to bring what we've learned to the place where it all started and continue our mission of improving the quality and velocity of business decisions with people we like. To Team Sundial past and present, THANK YOU thank you thank you. You created that special feeling within our team, and I bask in the memories of having walked those lush miles and eaten those breakfast dosas with you. To our investors and supporters especially @dpatil, David Fischer + the whole 01A advisors team, @mvernal, @sequoia: how did we get so lucky to have your counsel and support? And to my beloved @mikesego and kiddos: I could not have made it without you. These have been some of the hardest, most humbling, and most alive years of my life. I hope I'm wiser for it and will have many chances to pay it forward! https://t.co/qToXTtHHsO(Historical earnings: For fiscal 2026Q2 (period ended 2026-06-30), Meta Platforms reported basic EPS of 16.79, diluted EPS of 16.62, net income of USD 42.621 billion, and revenue of USD 117.111 billion. Consensus expectations: For the upcoming 2026Q4 event, consensus expects EPS of 8.278 and revenue of USD 73.742 billion.)

35/100·CLong+6

meme10/23meme

Aztec Alpha's V6 payload has been approved by $AZTEC holders! V6 will bring security improvements and make moving between Ethereum and Aztec much faster. The payload also keeps v5 sequenced and proven for 30 days after v6 becomes canonical. Reply to @aztecnetwork: V6 of the Aztec Alpha Network is on its way, https://zk.money shipped all month, and six teams are launching with V6. Here’s what's been happening on Aztec Network: 🧵

72/100·B+Long

news10/23news

YZi Labs Introduces Its First Atlas Scout Cohort to Back Student-Sourced Early-Stage Startups Key Takeaways YZi Labs is introducing the inaugural cohort of the Atlas Scout Program to give exceptional university students hands-on exposure to early-stage investing earlier than the traditional internship, analyst and associate path. Scouts will source deals, conduct initial research and diligence, build conviction and may help support early-stage founders across Web3, AI and biotech, with up to $1 million in indicative allocation to opportunities arising from the Program and access to YZi Labs' 300+ portfolio ecosystem. The first cohort brings together four Scouts from Stanford, Yale, UC Berkeley and UCLA, with backgrounds spanning applied mathematics, AI and physical AI, neuroscience and biotech, AI infrastructure and agents, computational biology and neurotechnology. YZi Labs is introducing the inaugural cohort of its Atlas Scout Program, bringing four university students from Stanford, Yale, UC Berkeley and UCLA into its early-stage investment work across Web3, AI and biotech. Atlas gives students the autonomy to launch initiatives on their campuses – from building founder communities to exploring investment opportunities. Students source founders, conduct diligence and develop their own investment perspectives alongside the YZi Labs team, with up to $1 million in indicative allocation to opportunities arising from the Program and access to YZi Labs’ 300+ portfolio ecosystem. YZi Labs has a belief that the industry needs to take unconventional young founders seriously earlier, especially before their work fits a standard funding process. The best people to recognize and support them are often their peers: students building beside them in labs, open-source projects, founder groups and technical communities where early ideas are still being shaped. Atlas turns that belief into a working model. For founders, it can mean potential access to capital, mentorship, access to YZi Labs' network and, where relevant, a bridge into EASY Residency or future investment conversations with YZi Labs. For Scouts, it means learning venture by doing the work itself: meeting founders, asking better questions and forming judgment alongside the YZi Labs team. As Ella Zhang, Managing Partner of YZi Labs, said: "As we see founders of tomorrow emerge earlier than ever, the investors backing them need to be there from the start. Students often recognize ambition and potential in one another long before the rest of the world takes notice. With Atlas, we’re putting capital and conviction behind that instinct -- empowering students to champion their peers, take chances on bold ideas, and open doors for founders whose journeys are just beginning.” Meet the first four Atlas Scouts. Xinmeng Zeng, Stanford University Applied Mathematics | AI Web3 and Physical AI Xinmeng has spent the past three years in the Bay Area close to the kinds of founder conversations Atlas was created to reach. At Stanford, she is an Applied Mathematics PhD candidate. Her current research focuses on DeFi and crypto market structure, including how traders behave on blockchain-based trading venues and in perpetual futures markets. Before Stanford, she completed both her bachelor's and master's degrees in mathematics at ETH Zurich in three years. Her academic work has moved across fields, from random matrix theory and combinatorics to now decentralized finance. Her life has also moved across countries and technical cultures. Xinmeng grew up across China and Switzerland, speaks Chinese, English and French, and brings a cross-border perspective to the way she meets people and builds trust. At Stanford Founders, where she previously served as VP of Finance, she became part of a graduate founder community spanning more than 1,000 builders across Stanford's seven schools. Xinmeng likes the human part of venture: sitting with founders, hearing how they think, connecting people to resources and helping ideas move from conversation into something more concrete. Atlas gives her a structured way to build on work she was already doing in the Bay Area, between research and startups, technical ambition, and commercial reality. As a Scout, Xinmeng is especially drawn to visionary founders with the ambition to shape the future. She looks for ventures grounded in real utility—products that solve meaningful problems, create lasting value, and have the potential to make a positive impact. Peng (Endy) Xu, Yale University PhD Neuroscience | Biotech Neurotechnology and AI Peng begins with a question he has been thinking about for years: “What makes us human, and how far can humanity evolve from here?” That question led him to neuroscience. At Yale, Peng studies how aging and Alzheimer’s disease affect neuromodulatory signaling and cortical network dynamics. His broader scientific interests span consciousness, cognition and the biological basis of human intelligence, and he received a Gruber Science Fellowship upon entering Yale’s Interdepartmental Neuroscience Program. Working on Alzheimer’s disease made that broader question more concrete. If memory and cognition can deteriorate, how much can we do to preserve them, restore them and, eventually, enhance them? That question gradually pushed his interests beyond neuroscience alone and toward the convergence of AI, biotech and engineering, particularly technologies that could change how humans think, stay cognitively healthy and interact with machines. Outside the lab, Peng has increasingly focused on the people building those technologies. He leads Yale Venture Club, founded Neuro X and co-founded ISEA, working closely with researchers and students at the earliest stages of turning scientific ideas into companies. He also built Project RAW, an early founder discovery and support initiative across university and research communities. Through Project RAW, he has helped source and screen projects, run office hours, prepare teams for pitches, connect them with investors and industry partners, and support them through Demo Day and beyond. That experience shaped how he thinks about early-stage investing. For YZi Labs, Peng brings both scientific depth and the instinct to create a founder pathway around it. Atlas gives him a way to connect the work he has already been doing with deeper access to capital, mentorship and the broader YZi Labs network. “I hope to back people who are building for a world that may still be ten or twenty years away,” he says. His goal is to meet technical founders early enough that the relationship can actually matter. As a Scout, Peng is focused on founders at the frontier of biotech, neurotechnology and AI x bio — people building technologies that could redefine human cognition, extend the limits of healthy brain function and ultimately expand what humans are capable of. Hanchen Li, UC Berkeley PhD Computer Science | AI Infrastructure Agents and Payments Hanchen studies AI infrastructure, but the most interesting part of his profile is where his curiosity goes once the technical system starts touching the real world. At UC Berkeley’s Sky Computing Lab, where he is a computer science PhD student advised by Ion Stoica and Joseph Gonzalez, he works on agent infrastructure, inference, context engineering, data and evaluation. Before Berkeley, he worked on long-context LLM inference and became the first employee of Tensormesh, the company behind LMCache. Working on LMCache also pulled him outside research. He helped grow the repository from around 300 GitHub stars to 5,000, while getting hands-on experience with user interviews, distribution, hiring and industry partnerships. Over time, Hanchen became interested in a broader class of infrastructure: systems that sit underneath everything else and determine how important resources move. Compute is one of them. As intelligence becomes increasingly tied to access to compute, questions around who controls it, how it is allocated and how efficiently it can be used start to matter far beyond infrastructure itself. Payments caught his attention for a similar reason. If compute governs how intelligence can be produced and distributed, payments govern how value moves between people, companies and markets. That is where Hanchen’s curiosity goes next. Once he understands the technology, he wants to understand the system around it: who pays, who takes risk, where the bottlenecks are, and what has to be true for a new market to work. He sees YZi Labs as a platform with a long-term investment mandate, a broad technical ecosystem and the patience to study categories that do not fit neatly inside one label yet. Hanchen brings more than access to one of the strongest AI research communities in the world. He brings the habit of following an infrastructure question into the financial, operational and behavioral systems around it. As a Scout, Hanchen is looking at agent infrastructure, AI systems, payments, developer infrastructure, consumer AI and founders whose strongest insight may come from connecting AI with another market. Shawn Wang, UCLA Computational Biology | Neurotechnology Biotech and AI Shawn has been thinking about immersive virtual worlds since he was fourteen. That interest first took him into venture. As a college freshman, he saw VC as a way to get exposure to several of the technologies he cared about at once. He interned at a Hong Kong-based fund investing in infrastructure and software, and later at Verge, which focuses on healthtech software globally. He liked talking to founders and learning what they were building, eventually realizing that one day, he wanted to become a builder himself. He moved to a neuroscience lab at UCLA Health, where he worked as a software engineer on research into human memory using electrodes implanted in the brain. Then he left the lab to start his own company World Zero, building AI gaming companions that can join games, hop on calls and play alongside users.If neurotechnology could eventually change how people enter virtual worlds, Shawn sees AI characters as part of what makes those worlds feel inhabited once they are there. Building on his own also changed how he thinks about early-stage founders. As a solo founder, he found that the hardest part was sometimes not the work itself, but having no one around to calibrate the doubts when things went wrong. Working alone can turn uncertainty into an echo chamber. That is why he pays particular attention to young and unconventional founders as an Atlas Scout. Many are already building before they have had the chance to develop the networks, capital or support systems that come with years in industry. Shawn knows that gap firsthand, and through UCLA and younger founder communities, he is close to people building well before they look like conventional founders. As a Scout, Shawn is drawn to neurotechnology, computational biology, consumer AI and founders working where AI, biology and human experience meet. Backing Founders from Day One Amazon began with door desks in a Bellevue garage. Google began as a Stanford research project, with computers in dorm rooms. Facebook started in a Harvard dorm room as a campus directory running on a single server. Before the traction, the funding rounds, and the signals, there is often a small group of people experimenting with something most of the market has yet to notice. For an Atlas Scout, that could be a classmate working on an unexpected idea or a conversation after a lab meeting that stays with them. Scouts have the autonomy to follow that curiosity and decide what to do next. They might bring a student club together around an emerging technology, host a gathering for campus founders, or spend time exploring an investment opportunity they believe in. They shape their own campus initiatives, with YZi Labs providing connections, guidance and support to help bring those plans to life. Through these student-led efforts, Atlas creates more opportunities for young founders to find support while their ideas are still taking shape. A campus conversation can become an introduction to a mentor, a connection to another builder, or the start of an investment discussion with YZi Labs. And the students making those connections develop their own judgment along the way -- about the technologies worth exploring, the people they believe in and how to help them move forward. About YZi Labs YZi Labs manages over $10 billion in assets globally. Our investment philosophy emphasizes impact first—we believe that meaningful returns will naturally follow. We invest in ventures at every stage, prioritizing those with solid fundamentals in Web3, AI, and biotech. YZi Labs' portfolio covers over 300 projects from over 25 countries across six continents. Some notable portfolios include Trustwallet, CoinMarketCap, Polygon, Injective, Ethena, Safepal Wallet, Better Payment Network, Aster, XAI, and more. More than 100 of YZi Labs' portfolio companies have gone through our incubation programs. For more information, follow YZi Labs on X. Disclaimer The Atlas Scout Program is designed to provide selected university students with educational exposure to early-stage venture investing, including opportunities to learn about sourcing, research, and diligence alongside the YZi Labs team. Scouts participate in an independent capacity and are not employees, agents, partners, investment advisers, brokers, dealers, placement agents or other representatives of YZi Labs. Scouts do not have authority to bind or represent YZi Labs, make or approve investment decisions, negotiate investment terms, commit or deploy capital on behalf of YZi Labs, or otherwise act on behalf of YZi Labs in connection with any investment. Any opportunity sourced, researched, or discussed through the Program is subject to YZi Labs’ independent evaluation, due diligence, internal approval processes and sole discretion as to whether, and on what terms, to pursue any investment. Any reference to capital allocation is indicative only, and does not constitute committed or pre-allocated capital to any Scout, founder, company, or investment opportunity. The information provided in this article is intended for informational purposes only and does not constitute investment advice, endorsement, analysis, or recommendations with respect to any financial instruments, investments, or issuers. Each person should consult their own legal, tax, and financial advisors for current applicability. This article may contain forward-looking statements which are by nature subject to risks and uncertainties. Investment in cryptocurrency and DeFi projects involves substantial risk, including the risk of complete loss.(Historical earnings: For 2026Q2 (period ended 2026-06-30), reported basic EPS of 14.41, diluted EPS of 14.24, and net income of USD 174.771 billion. Consensus expectations: Consensus for 2026Q3 expects EPS of 3 and revenue of USD 127.677 billion.)

10/100·CNeutral+30

news10/23news

THE BLOCK: BIT's Swiss asset management subsidiary received approval from the Swiss Financial Market Supervisory Authority to launch its Bitcoin Fund ETF (BBIT). This is the first ETF in Switzerland to invest directly in bitcoin. Trading is set to begin next month on the SIX Swiss Exchange.

78/100·ALong

news10/22news

Gate Money: One Account for Everything You Do With Money Money has always lived in separate places. Cash sits in a bank, stocks in a brokerage, crypto on an exchange, and moving value between them means transfers, settlement delays and fees at every step. Stablecoins are the first asset to blur those lines. As the best version of cash in crypto, they give dollars the speed and portability of onchain assets, and they have grown accordingly: supply stands at just under $300 billion as of October 2026, roughly 50% above where it started 2025, the year the GENIUS Act was passed. Gate Money is Gate’s attempt to bring the rest of the picture together. Announced at TOKEN2049 on October 7, the Gate Money section, inside the main Gate app, now puts fiat accounts, crypto, payments, yield and investing on one balance. A day later, Gate announced a partnership with Visa for a crypto-linked card. This primer covers what Gate Money does, along with Gate’s Visa partnership, and what we'd watch as it rolls out. Why Now: Stablecoins Are Becoming Everyday Money Supply growth has stalled for most of 2026, but usage has not. Onchain stablecoin transfer volume reached $92.7 trillion over the 12 months to September 2026, up ~82% from the prior 12 months. Year-to-date (YTD), 2026 has seen ~$74 trillion in onchain stablecoin transfer volume, already above the $60.6 trillion recorded for all of 2025. It is worth noting that raw transfer volume can overinflate true “usage” as the metric includes bot activity, contract-to-contract hops and internal transfers. Adjusting for those, a16z’s 2025 report strips those out and has adjusted stablecoin volume at ~$9 trillion over its trailing year. Policy and payment rails are following the usage, with the GENIUS Act giving US issuers a clear regulatory perimeter, Stripe’s acquisition of stablecoin infrastructure startup Bridge, and over 160 stablecoin-linked Visa card programs now live globally, per Visa. For many users, holding crypto or stablecoins is only half the job. Spending or cashing out those assets still typically runs through a bank, which means leaving the exchange’s ecosystem. Trading activity tends to fluctuate with market volatility, while products tied to payments, balances and financial services can create more recurring user activity. As crypto increasingly moves beyond trading, the value of having one account for holding, spending, investing and earning becomes more important. This is the gap Gate Money is built to close. Gate Money Functionally, Gate Money organizes six jobs around one balance. Hold - Users can hold multiple fiat currencies and crypto in one consolidated account system, as it supports fiat deposits and withdrawals alongside onchain deposits and transfers. Receive - Eligible users can set up a bank account inside the same app and use the account details to receive and withdraw funds. Pay - Online and in-store purchases can use fiat or crypto, with Apple Pay and Google Pay support, alongside ATM withdrawals and local QR payments in some countries. Convert - In-app swaps between assets. Earn - Eligible USDT balances can earn up to 3.6% with no lock-up, subject to Gate's product terms. Invest - Access to crypto and traditional assets including stocks. Many of these features, including Gate Card, Gate Pay and stock trading, existed before Gate Money. What the new Gate Money adds is integration, where a user's balance can be received, held, earned on, invested and spent in one account, turning Gate from somewhere users come to trade into an everyday financial platform. The Visa Partnership In early October, Gate and Visa announced a partnership for a crypto-linked Visa card that can be applied for and managed inside the Gate app. With this, eligible users will be able to pay at any Visa-accepting merchant, and the crypto in their Gate account is converted to fiat automatically at checkout to cover the purchase. Visa’s main contribution is its global network, as the payments feature is the job that decides whether an account gets used every day or only when someone trades. Moreover, Visa is itself one of the stablecoin rails described above, so the card sits on infrastructure with the same vision in mind. Gate’s CEO described the partnership as a step toward crypto becoming part of everyday financial life, while Visa's Asia Pacific head of digital currency pointed to consumer demand for flexible, convenient and widely accepted payment options. Why The Build Matters Some platforms launching consumer money products opt for a separate app with its own brand. In contrast, Gate Money lives inside the main Gate app. While the former may present a cleaner approach from a consumer identity perspective, it has to build its user base from scratch. On the other hand, an embedded product starts with the full user base that can switch Gate Money on without having to download anything, while balances also stay within Gate. There is also a clear connection to the topic discussed in Primer 1, where Gate CrossEx gives professional desks one pool of margin that works across multiple venues so capital stops sitting idle in silos. Gate Money applies the same idea at the other end of the user spectrum. Between the two, Gate is building account infrastructure for institutions and for everyday users, which is the groundwork for the forthcoming Gate iWeb3 report. Reserves and Asset Security An account that holds users’ cash, crypto and investments, and pays out from them every day, only works if users trust the assets are there. Gate says it was the first exchange to launch 100% proof of reserves. Their latest report, published on 21st October, puts total reserves at $8.68 billion with an overall reserve ratio of 118%. Licensing as the Moat For crypto exchanges, trading features can be easily shipped by a product team. But bank accounts and cards cannot as they require licenses and banking partners on a jurisdictional level, which is why Gate Money’s availability is region-dependent and its licensing stack would take a considerable amount of time to replicate. The pairing that stands out is the MiCA and PSD2 licenses, both held in Malta, as they cover both the crypto side and the payment-account side of what Gate Money does in Europe. The licenses determine where each feature can go live, while the partnerships, such as the one with Visa, determine how fast. Conclusion Gate Money changes what a Gate account is for. Before, it was a place users came to trade. Now, it is built to be where they hold, receive, spend, invest and earn, across both crypto and fiat. As digital assets and payment rails mature, the contest moves up a layer, to the account where people hold and spend their money. Gate Money is Gate's answer, built on an exchange account with 61M+ users, wired into Visa for spending and backed by licenses across several key jurisdictions. The question for the foreseeable future is how quickly Gate Money’s bank account and card footprint expands, and whether Gate's users start treating it as their de facto money platform.

20/100·CNeutral+18