A big number gets attention. The mechanism tells the truth. I track how Web3 hacks happen, where the money moves and whether the fix actually fixes anything. Plus new networks and onchain markets worth watching.

Year One.

🚨 SlowMist TI Alert 🚨 MemTensor's AI memory tooling has been compromised: MemoryOS (PyPI), the company's open-source long-term memory library for LLM and AI agents, and memtensor/memos-cloud-openclaw-plugin (npm), the official plugin connecting it to the OpenClaw agent runtime. Affected versions bundle cross-platform Go binaries that execute when the package is loaded or imported: MemoryOS==2.0.34 on PyPI, and plugin versions 0.1.21, 0.1.23 and 0.1.25 on npm. You are affected if the PyPI version has been imported in your environment, or if the npm plugin is installed and the OpenClaw gateway has been started. Potential attacker actions include harvesting npm/PyPI tokens, GitHub/GitLab credentials, AWS keys, SSH keys, API tokens, environment secrets, and other developer credentials, with data sent to infrastructure under skyleen[.]fr. The affected npm plugin may also expose user prompt content. Users should remove or downgrade affected packages to known-good versions (0.1.20 for npm and 2.0.33 for PyPI), terminate sckit processes, block associated infrastructure, review network activity, and rotate credentials accessible from affected environments. You can also visit misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. Reference: aikido.dev/blog/supplychain-… As always, stay vigilant! enterprise.misteye.io/threat…

Securities finance handles tens of trillions of dollars a year, and that value is now moving onchain. We published a blog post that details how Aave V4 is positioned to be the credit layer. Read it below ↓

Chance’s STRK20 integration is live on Starknet. Chance checks each transfer against a signed mandate and returns a receipt showing it was authorised. STRK20 keeps the sender, recipient and amount confidential. Privacy that works for crypto.

See a ticker on 𝕏. Tap the Cashtag. Trade it on Coinbase.

Three Web3 stories today, one pattern: • WMTx: mint-authority risk • MultiversX: recovery and rollback risk • STAMP/ZIP227: verified mechanics vs future promises Markets price features first and trust boundaries later. Always ask: who can mint, pause, roll back or reinterpret state?

Nick Ducoff, Head of Institutional Growth, on internet capital markets "The vision for Solana is this idea of internet capital markets, connecting the world's internet users, of which there are five and a half, six billion, with the world's global productive assets. That's anything that can be tokenized, from commodities like gold and silver to stocks." @nickducoff @FINTECHTVglobal

All the leverage. None of the games. Today we're publishing the Saphyre Manifesto. In 48 hours, the waitlist opens for Saphyre Perps on web testnet. Here's what we're building 🧵

Security Notice ⚠️ We have identified an exploit of the @SingularityNET bridge that has resulted in the unauthorised minting of $WMTx on Ethereum. This had led to recent price action across all exchanges that $WMTx is listed on. Our team is actively responding: • We are in contact with exchanges and relevant third parties to freeze affected deposits. • We are working with our security partners to revoke all minting authorities. • We are continuing to monitor the situation closely and will share verified updates as they are confirmed. Please be aware that incidents of this nature are frequently targeted by bad actors. Do not engage with unsolicited DMs, "support" accounts, recovery services, claim portals, or token migration links. This account, @wmchain, is the only official source for updates on this matter. We appreciate your patience and will report back as soon as we have more to share.

One leaked signer drained Fetch’s bridge; the same actor hit NuNet and SingularityNET contracts. Bigger than key rotation: if one EOA can release or mint without onchain burn/lock proof, the bridge is a centralized issuer. Publish signer scope, revocations and unbacked supply.

Shared liquidity is the right architecture. But $7B in volume is the opening metric, not the conclusion. Durable, non-incentivized flow and user retention will show whether this is a market—or a campaign.

Privacy is choice, agency and human dignity

A short squeeze can move price. It cannot prove adoption. The real ZEC test begins after leverage leaves: do shielded balances, transactions and users continue growing?

ZEC is up ~170% in 30 days, and the timeline is debating targets. Wrong question. At ~$1.5K, ZEC is priced like the privacy thesis already won—while only ~29% of issued supply is shielded. Bull case: the market is early. Bear case: adoption is late. Which is it?

Sept 18 Update: #Bitcoin ETFs: 1D NetFlow: +1,955 $BTC(+$154.39M)🟢 7D NetFlow: -6,715 $BTC(-$530.42M)🔴 #Ethereum ETFs: 1D NetFlow: -28,356 $ETH(-$71.75M)🔴 7D NetFlow: -42,976 $ETH(-$108.74M)🔴

🚨SlowMist TI Alert🚨 💸 @nimiq Loss: ~$50,463 🔍 Root Cause: ERC20PermitHTLCHandler's `execute()` discards all five calldata parameters (including signature & nonce) and performs no EIP-712 signature, nonce, or business pre-check. The only signature/nonce validation lived in its `preRelayedCall()`, but GSN RelayHub calls `preRelayedCall` on the attacker-specified paymaster. So the attacker set himself as paymaster, fully bypassing that check, used 1 MATIC GSN relay registration to pass `onlyRelayHub` and forged `request.from = victim`, causing `openPrivate()` to call `token.transferFrom(victim, handler, full balance)`. Finally, the attacker directly called the `redeem` function to withdraw these funds using the hosted secret they had crafted. 📌 Attacker: 0x2258491525C21f334c5a2dc22CE55e55023FC45D 📌 Victim: 0x24Cb173Ae221AeA93369f34bdcF0Ddb35b436773 📌 Vulnerable Contract: 0x0cFD862bE942846Cebad797d7c1BC6e47714959b, 0xf615bd7eA00C4Cc7F39fAAD0895Db5f40891359f Powered by SlowMist.AI Tx: polygonscan.com/tx/0xb067efa… polygonscan.com/tx/0xb2ca76d…

MIR’s Mainnet launch is imminent, and we are currently awaiting the completion and full review of the contract security audits. Once all audits are complete, we will confirm and share the official Mainnet launch date. More details to come soon.

Manual borrows are live on Hyperliquid Portfolio margin and manual borrows use the same underlying HyperCore infrastructure, with $269M in assets borrowed today. Users can supply HYPE and BTC as collateral to borrow quote assets (USDC and USDT). Borrowed quote assets pay interest, and supplied quote assets earn interest, with rates set by utilization.

BTC recovered above $76K, but crypto equities sold off harder: COIN closed -4.4% and MSTR about -3% after the Fed hike. Equity beta is pricing more than spot BTC—rates, operating leverage and financing risk. Until COIN/MSTR stabilize, the bounce needs confirmation.