Crypto Morning Brief: Predict Fun on BSC Allegedly Attacked, OpenAI Releases GPT-6.1 Terra

Author: TechFlow

Yesterday's Market Dynamics

Predict Fun on BSC Suspected Under Attack, Approximately $300K in Funds Flow Into Tornado Cash

According to blockchain analyst Onchain Lens (@OnchainLens), the BSC-based prediction market platform Predict Fun is suspected of having been exploited via a vulnerability. Approximately $300,000 in suspected stolen funds were transferred from multiple contracts through intermediary wallets to Relay. These funds reportedly entered Tornado Cash after being bridged across chains.

IBM, Oracle, and 3 Other Companies Oppose OKXICE Stock Tokenization Plan, Total Opponents Rise to 26

As reported by journalist Eleanor Terrett, four companies—IBM, Oracle, Intel, and quantum computing firm IonQ—have recently filed objections against OKXICE, a joint venture between OKX and ICE, tokenizing their company stocks under the SEC's Innovation Exemption framework.

With the addition of these four companies, the number of issuers opposing OKXICE's stock tokenization plan has increased to 26.

Jelly's PaperTrade Account Blown Up, Hyperliquid Balance Drops to ~$4,518

Monitored by Lookonchain, Huang Licheng's (Jelly) account on PaperTrade has suffered total losses, leaving his Hyperliquid account balance at just $4,517.7. Approximately an hour ago, he sold another Mutant Ape NFT at a loss to raise additional funds for trading.

Justin Sun's Two Wallets Accumulate $48.76M in PEPE Transfers, Holdings Value Rises to $51.01M

On-chain analytics platform Arkham (@arkham) monitored two wallets linked to Justin Sun receiving PEPE transfers from Poloniex in two batches on October 17 and 26: 7.2 trillion tokens (approx. $28.44M) on Oct 17, and 4.65 trillion tokens (approx. $20.32M) on Oct 26, totaling roughly $48.76M. These tokens appear to have originally been purchased on Binance, then routed through Poloniex and HTX before returning to Poloniex, and finally transferred to Sun's wallets.

Meanwhile, between October 15 and 25, Sun transferred $77M in stablecoins to Poloniex in six installments, including $60M in USDT and $17M in USDC, previously redeemed from Spark/AAVE and Sky, respectively.

Before October 17, Sun held only about $267K worth of PEPE (68 billion tokens). His two wallets currently hold approximately $51.01M in value, an increase of over $2M since receipt, representing about 2.82% of PEPE's total supply, or 2.2% of his $2.29B in on-chain wealth.

OpenAI Launches GPT-6.1 Terra, API Pricing Cut by 50% from Previous Generation

OpenAI announced the launch of GPT-6.1 Terra, focusing on enhancements to visual reasoning, computer use, factual accuracy, and software engineering capabilities. Targeted at daily office tasks and high-frequency automation, the model can process technical blueprints, fill out forms, edit videos, and develop software.

In terms of performance, OpenAI stated that GPT-6.1 Terra reduced its factual error rate in internal complex prompt tests from 53.6% (with low reasoning intensity in GPT-5.6 Terra) to 16.7%. At maximum reasoning intensity, the error rate dropped further to 4.3%. In the Terminal-Bench 4.0 coding benchmark, the model achieved a task completion rate of 50.3% at max reasoning intensity, surpassing GPT-5.6 Terra's 21.5%.

Regarding pricing, GPT-6.1 Terra's standard API rates are 50% lower than those for GPT-5.6 Terra and GPT-6.1 Sol, charging $1 per million input tokens, $0.05 per million cached input tokens, and $5 per million output tokens.

The model is now available to ChatGPT Work and Codex Plus, Pro, Enterprise, and Edu users, and developers can also access it via the OpenAI API.

Ripple Receives Final Approval from U.S. OCC to Establish National Trust Bank, Will Support RLUSD and Institutional Digital Asset Custody

Ripple CEO Brad Garlinghouse posted that the U.S. Office of the Comptroller of the Currency (OCC) has granted final approval for Ripple National Trust Bank. This approval provides Ripple with a federally regulated business framework to support its USD stablecoin, RLUSD, and offer digital asset custody services to institutional clients.

Garlinghouse noted that this move reflects the convergence of the crypto industry with traditional banking systems, underscoring the importance of innovation, accountability mechanisms, and federal oversight.

Kraken Parent Company Payward Plans to Deploy CFTC-Regulated Perpetual Swap Markets via Hyperliquid

Official channels for Hyperliquid announced that Kraken's parent company, Payward, plans to leverage Hyperliquid as underlying infrastructure to deploy perpetual swap markets for U.S. users, making it the first institution to list CFTC-regulated trading products on a HIP-3* market. The specific proposal still requires regulatory approval.

Under the plan, Payward's CFTC-regulated exchange and clearinghouse, Bitnomial, will handle the creation, operation, and management of the relevant markets, as well as contract clearing and settlement. Its registered futures commission merchant, NinjaTrader Clearing, will be responsible for managing client accounts.

Hyperliquid stated that HIP-3* will support permission-restricted market deployments through an on-chain allowlist mechanism. An initial version has launched on testnets, and related specifications may still be adjusted based on feedback. This feature is an optional extension of HIP-3 and does not affect existing markets.

SlowMist: Udesk Customer Service Script Infected with Malicious Code, Capable of Stealing User Session Data and Replacing Deposit Addresses

SlowMist disclosed that during routine threat intelligence checks, its security team discovered that a Udesk customer service script, `udeskApi.2026-10-16.cached.js`, had been infected with a malicious loader. This loader conceals its address via hexadecimal encoding and asynchronously loads a remote script, `deeps.js` (originating from `udeskqlobal[.]com`, note the domain starts with 'q'). The script reads accessible page cookies, localStorage, and sessionStorage, intercepts form submissions and login/authentication requests, and sends data to `udeskqlobal[.]com/c.php`, allowing attackers to hijack sessions or take over accounts. This data collection behavior bypasses the target site's policies, meaning even unmatched pages could be affected.

According to SlowMist's analysis, the script also targets three types of sites (`mgbx[.]com`, `bikingex[.]`, and `bitxex[.]io`), scanning deposit pages every 200 milliseconds and replacing identified deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Simultaneously, the script wraps the clipboard API, replaces copy buttons, and intercepts copy events, ensuring users see and copy the tampered address. Any funds sent to this address will be funneled to the attacker's wallet.

SlowMist recommends: preserve evidence and cease distribution of the affected scripts, revoke sessions and rotate tokens/passwords in a clean environment, verify deposit addresses and transaction records through trusted backends, and restrict script loading and data exfiltration to `udeskqlobal[.]com`. Relevant IOCs have been integrated into the MistEye threat detection engine.

Ethereum Fixes Glamsterdam Upgrade Vulnerability to Prevent Staked ETH from Being Misallocated to Block Builder Accounts

According to CoinDesk, Ethereum developers have fixed a vulnerability in the upcoming Glamsterdam upgrade that could cause staking services' deposits for new validators to be incorrectly credited to block builder accounts, giving operators a chance to withdraw the funds. The fix was merged into the Ethereum consensus specification on October 26, following an earlier rejection on October 19 due to insufficient client team support.

Researchers noted that the findings represent a conditional code risk rather than a confirmed live exploit, with no reported losses so far. The fix still requires integration by client teams, and the Glamsterdam launch on the Hoodi testnet has been delayed accordingly.

Today's Market Overview

Recommended Reading

AI Spam Reports Flood In, Firedancer Requires Burning 1 SOL Before Submitting Vulnerabilities

https://www.techflowpost.com/article/34902

This article focuses on how Solana validator client Firedancer uses economic costs to combat the flood of AI-generated vulnerability reports. In an audit competition with a total prize pool of $1 million, researchers submitted 809 reports, but only 127 unique vulnerabilities were ultimately verified, with numerous fake and duplicate reports overwhelming the security team's review resources. To improve report quality, Firedancer mandates burning 1 SOL permanently before each submission, while doubling standard bounty rewards and increasing the top reward for critical vulnerabilities in the Alpenglow consensus architecture to $300,000. The new mechanism aims to filter out low-quality reports through "costly submission, high return for genuine discoveries," though it may also raise the entry barrier for independent white hats. The core takeaway is that when AI drives content generation costs to near zero, security auditing mechanisms must redesign incentives and filtering rules.

Reviewing Kimi K3.1 Leads to X Bans? Multiple Overseas Bloggers Forced to Label Posts "Paid Partnership," Even Negative Reviews Not Spared

https://www.techflowpost.com/article/34901

This article examines the backlash and account bans on overseas social platforms sparked by reviewing the domestic large language model Kimi K3.1. Multiple overseas AI reviewers and tech writers reported that after publishing Kimi's benchmarks, sharing public evaluation data, or posting criticisms about subscription throttling on X, their accounts were flagged for violating paid promotion rules. Some were forced to add a "Paid Partnership" label to regain account access, subsequently compelled to delete their posts. The article suggests this may stem from compliance controversies surrounding Kimi's overseas expansion and X's overly sensitive anti-spam algorithms, though the exact trigger mechanisms remain unconfirmed. The incident highlights that when platform automated moderation fails to distinguish genuine reviews, negative comments, and commercial ads, it risks undermining the credibility of independent evaluations and serves as a warning for the compliance of domestic AI marketing going global.

Kraken Parent Looks to Enter On-Chain Derivatives Business, Pays $38M "Admission Fee" to Hyperliquid

https://www.techflowpost.com/article/34900

This article details the collaboration between Kraken's parent company Payward and Hyperliquid: Payward plans to leverage Hyperliquid's HIP-3 mechanism to launch a regulated on-chain perpetual swap market in the U.S. For compliance, Bitnomial handles market deployment, clearing, and settlement; NinjaTrader Clearing manages client accounts and KYC; trade execution relies on Hyperliquid's on-chain engine. Under HIP-3 rules, deployers must stake 500,000 HYPE, valued at approximately $38.5M at the article's cited price of ~$77, locked for at least 183 days. Trading fees in these markets are typically double that of native markets, with roughly 97%–99% flowing into an aid fund for HYPE buybacks and burns. The article argues this demonstrates a new industry division of labor: traditional exchanges provide regulatory licenses and client access, decentralized protocols supply trading infrastructure, proving that centralized exchanges don't necessarily need to build their own chains.

Podcast Notes | NEAR Co-founder Illia & Core Team Discuss: We Used DeepSeek, Drastically Reducing Six-Figure Security Audit Costs to Hundreds of Dollars

https://www.techflowpost.com/article/34897

This article summarizes insights from NEAR co-founder Illia Polosukhin and core team members in a podcast, centering on how AI is drastically reducing software security audit costs, while merging blockchain and AI requires simultaneously addressing privacy, trusted execution, and agent collaboration. Illia revealed that the team utilizes the open-source DeepSeek model optimized with a custom toolchain for formal code verification, achieving results comparable to Claude and ChatGPT at inference costs 100–200 times lower, compressing what were once multi-million-dollar tasks into hundreds of dollars. The NEAR team also emphasized technologies like default confidentiality, post-quantum signatures, hardware security enclaves, and chain signatures, proposing that NEAR Intents transaction fees subsidize decentralized AI compute, enabling users to access more private and verifiable AI services. However, these primarily represent the project's technical claims and practical demonstrations; whether these cost advantages, privacy guarantees, and business models can scale remains to be independently verified.