Kiwi News: handpicked crypto news for builders

It should now be abundantly clear that ETH on Ethereum L1 is a very different beast from stablecoins like USDC and USDT, or ETH on e.g. Arbitrum. It is time to ask really hard questions: Which “beast” do people really want, and when? And how much capacity should there be to move instantly between them? Clearly, we still want strongly censorship-resistant assets like ETH and Bitcoin. But in many cases, having an entity that can intervene in the event of a hack can be a positive. However, the way that power is exercised can feel arbitrary. Is Paolo asleep? Do you have a direct line to Jermey so suddenly they block without court order. I think it would be good to have assets and rollups that offer an additional layer of protection, but under clear, transparent, consistently applied rules that protect smaller users too, not just the well-connected.

Did you know Twitter links can reveal which device was used to share them? Check the URL ending: s=46 → iPhone s=20 → Web Browser s=19 → Android Try it yourself by copying a tweet link. Technology is interesting, isn't it?

BREAKING: France just voted to tax the internet. French lawmakers approved a tax of €0.055 (5.5 cents) for every gigabyte of data that companies like Netflix and YouTube send to French users. It’s a tax on the companies, not users directly, but the cost could get passed on to subscribers. The vote was 11 to 10, with only 35 of 577 lawmakers present. Supporters say it could raise up to €10 billion a year. The French government opposed it, warning it would hit smaller French companies hardest; VLC says it would cost it over €1 million a year.

BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit. Thanks to all other signers involved. Exploiter address 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6

Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: https://www.chainalysis.com/blog/binance…

It's state-sponsored military cyber warfare against normal engineers working from home. Crypto spent billions building multisigs, KMS enclaves, and MPC clusters, but the adversary isn't trying to crack prime numbers. They find one tired DevOps dev on LinkedIn, send a poisoned PDF, and walk straight through the front door with full sudo rights. You can audit your smart contracts fifty times, but the human endpoint is always running zero-day vulnerabilities. Damn, Lazarus is good at breaking people.

CryptoBilis update We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do: Already using it? Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Not set up yet? Don’t set it up, and never enter your existing wallet backup on it. We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives. On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far. NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it. If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://trezor.io/support#open-chat We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else. For more information, visit our blog: https://trezor.io/blog/news/implant-repo…

Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: - temporarily suspended deposits and withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. https://www.binance.com/en/support/annou…

BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen: • $1.45 billion $BTC • $875 million $ETH • $234 million $TRX • $50 million $XAUT • $1.57 billion $USDT • $823 million $USDC • $75 million $WBETH • $88.5 million $RLUSD + $447.5 million additional cryptocurrencies This is the largest hack in crypto history.

By design, a Morpho Blue market can't protect its users: it can't freeze the market to mitigate risk, act on the interest rate curve or implement rate limiting, and it has no Umbrella junior tranche to protect deposits. When an isolated market breaks, its lenders take 100% of the loss. If you're a Morpho user facing an adverse event, they will just tweet and let you sink, as they did during the dozens of vault blowups that led to dire user losses. Ask anyone who was in a curator vault during Stream/Elixir. Users won't trust an infra with real size if it doesn't care about them or support them. That's why, even with infinite VC funding, deployed incentives, a competitor that lost its best contributors and paid partnerships, Morpho only added a pathetic +$2.15B in active loans this year. For comparison, I did as much in one week at the Plasma launch.

Happy 18th birthday to the Bitcoin white paper. It is finally an adult.

Smoking gun. Attacker confirmed as North Korea.

Seeing rumors blaming EIP7702 for the Binance hack. From what I can see EIP7702 was just used to preform the hack efficiently but was NOT the root cause.

INTEL: Binance incident escalates from an EIP-7702 delegation exploit to a potential compromise of Binance 16 signing key

🚨995 Polymarket accounts just got drained through Polymarket's own website. Let me explain how, because this one should scare everyone in crypto. No fake link. No shady airdrop. These people were on the real Polymarket dot com on Thursday. Polymarket's site loaded a script from DebugBear, a tool whose only job is measuring how fast the page loads. Somebody poisoned it. Once it was running in your browser, it grabbed your logged-in trading session and started dumping every open position you had, first at 3% under market, then at half price, then at the lowest price possible. Then it swapped the whole balance into POL and shipped it to the attacker. Stablecoins can be frozen. POL can't. It even reported back after every hit. Your wallet, your country, your portfolio size, whether the transfer went through. All of it sent home through DebugBear's own data endpoints. The attacker's wallet went from empty to $2M in about 45 minutes. Conor Grogan's final count was $2.65M. One trader said he lost $800K and watched every position get sold. His friend got hit for $600K. Polymarket flipped the exchange to cancel-only, paused the relayer and says everyone will be made whole. Credit where it's due. But this is the third time this year. About $700K in May. About $3M in June, through a hacked third-party script, same as now. I've been phished. I've been drained. Stay in crypto long enough and it happens to you. But the people on Thursday did nothing wrong. They opened the right website. Not one of these three hacks touched a smart contract. We spent ten years making the blockchain unbreakable and then let a page speed tracker sit right next to people's money.