Binance has launched bStocks, a tokenized securities product that gives users round-the-clock access to tokenized equity exposure on the exchange. The tokens trade on Binance's spot market rather than during traditional stock-market hours.

The product places continuous equity exposure on one of the largest crypto exchanges, extending trading past traditional market hours and creating an instrument that sits between crypto spot markets and regulated securities.

Binance's own documentation states that each bStocks token is backed 1:1 by a US share held at a regulated custodian and is traded 24/7 on the exchange's spot market. The offering is positioned with zero conversion fees and dividend-related features such as automatic reinvestment.

The Polkadot Community Foundation posted a security warning on the Polkadot forum stating that versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of Fearless Wallet's browser extension contain malicious code that sends users' private keys to attacker-controlled servers when the wallet is unlocked. The code entered the extension's public source in a large commit labeled "TON ecosystem" on February 19, 2025, activated intermittently between February 2025 and October 10, 2026, and can reportedly be reactivated at any time.

The Foundation advises that anyone who used the extension since February 2025 treat every account in it as compromised, generate new key pairs in another wallet and move assets immediately, noting that changing the password or reinstalling the extension is not sufficient. Eight users have so far reported unauthorized transactions attributable to the incident, totaling 17,286 DOT.

The Chrome version is confirmed affected, and a delisted Firefox version used the same code; no such code was found in the Android or iOS mobile apps, though any private key previously imported into the browser extension should still be considered leaked. Users whose assets are staked, in nomination pools, or locked in governance votes can first seek help through PAPI Rescue, a tool developed by the polkadot-api team.

OpenAI President Greg Brockman said the company led a two-month coalition to find and fix the PHP2Shell flaws in core PHP using its own models, under its Patch the Planet initiative. Security firm Calif used OpenAI's GPT-5.6 Sol to find one version of the bug in August, OpenAI's own team found a fuller version in September, and cloud security firm Wiz independently found both flaws.

The flaws, rated CVSS 9.2, let unauthenticated attackers run their own code on servers running PHP, the language behind roughly 70% of websites whose server-side language is known, and PHP shipped fixes only a day after details leaked; Finland, the Netherlands and France pulled government websites offline on Wednesday. Brockman argued defenders need access to stronger models than attackers and floated a future in which authorized defenders such as governments scan for vulnerable servers and, in extreme cases, patch them remotely.

Brockman said the bug sat in PHP for 14 years, with a limited version surfacing in 2024 that "wasn't considered significant at the time," and the release was moved up from an original October 22 target to October 21 after details began leaking. OpenAI said it is also fixing "several other significant bugs," including a Node.js remote code execution flaw announced Wednesday, and has committed $1 billion in subsidized access to Daybreak, its program for defenders of critical infrastructure.

Security firm JFrog found that LiteLLM version 1.107.0 and its official Docker images were compromised in a supply chain attack, with three extra files hidden in the Python package. Once the Python environment starts, the malicious code runs even if LiteLLM is never called, harvesting browser passwords, SSH private keys, AWS and other cloud credentials, and authentication data for tools such as Claude, Codex and Cursor, then sending it to a server disguised as an official domain.

JFrog advises anyone who installed or ran 1.107.0 to treat the related credentials as potentially leaked, isolate and rebuild the environment, and rotate API keys rather than simply uninstalling the software; version 1.106.2 is the confirmed safe rollback. The attacker also left a persistent backdoor that checks for remote instructions once an hour and can download and execute new code.

PyPI has removed the malicious version and Docker Hub has taken down the affected images. The official source code on GitHub does not contain the malicious files, yet all seven platform packages published to PyPI were implanted with the trojan; Docker build records show the release system pulled source from a look-alike repository whose name differs from the official one by a single hyphen, and how it entered the release pipeline remains unclear.

Bitcoin Lightning developers are warning publicly about security flaws after a second patch was released within five days, CryptoSlate reported. No confirmed large-scale exploit or systemic loss event has been reported in the available material.

The warning puts Lightning node operators on notice to apply the latest fixes, since security defects in payment-channel software are an operational risk for systems that hold and route funds.

The second patch arrived within a five-day window, underscoring that fixes are being rolled out in quick succession. The available evidence does not establish that the flaws were exploited at scale.

Kalshi has reached an agreement with crypto custodian BitGo that will let clients of Kalshi Prime — its CFTC-registered futures commission merchant — borrow against digital assets held in custody and use the loan proceeds as margin for leveraged perpetual futures trading on Kalshi. Bloomberg reported the arrangement, which uses a tri-party collateral management structure in which loans are made by Kalshi's affiliated lending company Kalshi Katalyst and collateral sits at BitGo Bank & Trust.

Kalshi Prime CEO Jeff Bandman said the arrangement is intended to let clients take trading positions without exiting their crypto holdings, and that it may attract crypto-native trading firms and large holders of digital assets.

Eligible collateral includes bitcoin, ether and stablecoins deemed compliant with the GENIUS Act, with additional custodians expected to be added later. Kalshi launched gold, silver and crypto perpetual contracts earlier this year and has applied to list perpetual-style products tied to oil and US equities.

Tokenized stock trading is gaining volume in overseas jurisdictions, according to CNBC, while Goldman Sachs and other U.S. companies are objecting to the practice. The standoff sets up a fight over market structure and regulation for tokenized equities.

The objection from a major U.S. issuer raises the question of whether offshore venues can keep expanding tokenized share trading without the consent of the companies whose stock is being tokenized.

Under U.S. law, a tokenized instrument that meets the definition of an equity security remains subject to the federal securities laws, SEC regulations and FINRA requirements, according to a recommendation from the SEC's Market Structure Subcommittee. The CNBC report describes an evolving trend rather than a single ruling or enforcement action.

Wallets tied to the April Drift Protocol exploit deposited another 24,885 ETH (about $61.3 million) into Tornado Cash within roughly one hour, according to on-chain monitor Ember (余烬), bringing the attacker's two-day total to 50,595 ETH (about $122 million). The exploiter-linked addresses still held 56,569 ETH, worth roughly $139 million, after the transfers.

The funds are now passing through a mixer designed to break the on-chain link between deposit and withdrawal addresses, making tracing harder for investigators and reducing the likelihood that affected Drift users recover the stolen assets.

The reported loss figures vary by source: the headline cites over $270 million, while reporting on the April 1 hack puts losses at about $295 million, which DefiLlama ranks as the year's third-largest crypto heist. Some trackers recorded a two-day total of 44,510 ETH (about $109 million), including 18,800 ETH (about $46 million) transferred on Wednesday, a figure that differs from the 50,595 ETH cited by Ember.

SpaceX and Tesla are reportedly exploring a merger that would consolidate their corporate bitcoin holdings into a single entity holding more than 30,000 BTC. One report put the combined figure at 30,221 bitcoin.

A combination would pool two of the largest corporate bitcoin holders in the world onto a single balance sheet, making the merged company one of the biggest corporate owners of BTC.

The talks are described as an early-stage exploration rather than an agreed transaction, with no terms, timing or regulatory review disclosed. Reported figures for the combined holdings differ, with some coverage citing nearly 20,000 bitcoin and other reports citing 30,221 BTC.

Germany's Sparkassen savings bank network has launched Bitcoin trading, giving retail customers direct access to BTC through established banking infrastructure rather than a separate crypto exchange account, CryptoSlate reported.

The Sparkassen-Finanzgruppe is the largest financial services group in Germany and Europe by assets, so offering BTC through its retail banking channel puts direct Bitcoin access inside one of the region's most conservative banking networks.

Sparkassen operate as public-law institutions (Anstalten des öffentlichen Rechts) under municipal or regional trusteeship, combining decentralized governance with a shared institutional framework. Trading is integrated into the banks' digital banking platforms, so customers reach the digital asset market through their existing bank accounts.

Anthropic announced Claude Duet, an AI agent aimed at professionals and small business owners, launching as a research preview. It is available as a standalone app on iOS and Android and through Claude on the web (claude.ai).

Duet puts Anthropic into the same consumer and small-business agent category as Meta's Muse and OpenAI's Dots, a segment where the three leading labs are now shipping directly competing products. Anthropic's own materials describe the agent as proactive, messaging users when something needs their attention.

According to The Verge, the agent is built around Claude Opus 5.5, and Anthropic frames it as handling an inbox, calendar and follow-ups. Anthropic labels the release a research preview rather than a fully shipped platform, and its product page invites users to join a waitlist.