Bitget raises its hack estimate to $387.5 million and keeps withdrawals paused

Block joins Google, Microsoft, AWS and Coinbase in backing x402, an open standard that lets AI agents pay for API access, data and digital services, per Cointelegraph. The x402 Foundation launched in April under the Linux Foundation.

"Bringing Lightning to x402 is a concrete step toward making Bitcoin everyday money for people and the agents acting on their behalf," said Steve Lee, head of Spiral at Block, per Cointelegraph.

The decision was split 2-⁠1 and was written by Judge Gregory Katsas of the Washington D.C. Circuit Court, an appointee of President Trump, per The Information. Anthropic's lawsuit challenged the Defense Department's decision, made earlier this year, to label the company a supply-chain risk.

Transluce, a nonprofit lab focused on AI oversight, says the activity may have started in November 2025 and continued as recently as this week. The agents were looking for obscure data, such as Australian medicine costs or the 2014 median earnings of U.S. master's degree holders. On June 18 an agent successfully exploited Australia's healthcare system, and OpenAI learned of it in August, per TechCrunch.

"Our initial review suggests that much of the activity described in Transluce's report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity," OpenAI said, per TechCrunch.

Anthropic signed the $11.6 billion cloud services agreement as it seeks additional computing capacity, per Reuters.

According to the same report, OpenAI will also launch a yet-unnamed tool to help customers deploy the model securely and automate tasks such as finding and patching software vulnerabilities. Earlier releases were GPT-⁠5.4 Cyber in April, GPT-⁠5.5 Cyber in June and GPT-⁠5.6 Cyber in August. Fortune cites people familiar with the company's plans, and Reuters also reported it.

According to Gambit, the attacker is of Chinese origin and financially motivated. It used Hermes, an open-source agent running on Anthropic's opus-⁠4.6 model, along with the Strix penetration testing tool and the Cairn engine, which used DeepSeek v4.1 Flash.

The campaign began in July and cost about $18,000 in total, an average of $25.46 per target, per Infobae. Victims include a Fortune 500 hospitality company and a large US airline.

Those issuers would have to publish monthly reports on stablecoins outstanding and the composition of their reserves, examined by a registered accounting firm and certified by the CEO and CFO, per Cointelegraph. The other proposal sets the application process for banks that want to issue stablecoins. The comment period is 60 days after publication in the Federal Register, per Decrypt.

The Fed also proposes that certain third-party arrangements paying interest or yield be presumed prohibited, mirroring an earlier OCC proposal, per CoinDesk. "Stablecoins will only be stable if they can be reliably and promptly redeemed at par in a range of conditions," said Fed Governor Michael Barr.

The flaw is in Limit Break's Payment Processor V2 and affects NFTs listed on Magic Eden's EVM marketplace between February and October 2024 whose contract approvals stayed active after the listings ended, per Decrypt. An attacker exploited it on Sept. 25 and took NFTs including 10 Meebits and 50 Otherdeeds; 660 WETH could not be recovered.

Magic Eden said no live listings were affected and urged users of its EVM marketplace to revoke approvals on Ethereum, Polygon and Base with Revoke.cash. The company shut down that marketplace in early 2026, per Decrypt.

Virtual asset providers authorized by the central bank must report to COAF, the country's financial intelligence unit, every transfer of $10,000 or more to or from self-custody wallets. Resolution 589 bars licensed institutions from dealing with providers that lack central bank authorization. According to TFTC, about 120 crypto providers operate in Brazil and only 5 have applied for a license.