Odaily: Binance stated that it has completed coverage of all affected assets from the previous security incident and released a new proof-of-reserves snapshot. After the zero-knowledge proof is generated, users can verify on their own whether their assets are backed by reserves of at least 1:1.

Odaily reports: Indian cryptocurrency exchange Unocoin stated in a security update on November 12 that investigators discovered outgoing transactions from Ethereum addresses associated with its BitGo wallet infrastructure, and has submitted the matter to BitGo for investigation. The relevant corporate accounts had previously been frozen, and the limited visibility into the account address change mechanism increased the difficulty of verifying asset flows.Unocoin said that after discovering unauthorized activity on November 6, it requested the freezing of Fireblocks and BitGo corporate accounts at 11:24 UTC and 11:29 UTC respectively, at which time no loss of funds was found. The exchange stated that over 90% of customer crypto assets are held in cold wallets.Unocoin is rebuilding its server infrastructure, which is expected to take 4 to 5 business days; customer login, trading, and withdrawals remain unavailable at present. Arkham data shows that approximately 80,986 addresses attributed to Unocoin have zero balances, but this data alone cannot prove that customer funds have been stolen. (Bitcoin.com News)

Odaily reports: According to media reports, in response to some current and former employee information being placed on external websites without authorization, TSMC (TSM.N) stated today that there is currently no evidence indicating that the company's systems have been breached. The company has been notifying affected individuals and providing necessary assistance, while also cooperating with cloud service providers, investigative authorities, and third-party cybersecurity agencies to clarify the situation and take necessary measures.Previously, media reported that hackers named TSMC on an underground forum and auctioned detailed personal information. The seller claimed to have obtained 6.9GB containing 46,000 employee records, with an asking price of 3 bitcoins, and threatened to publicly release all the data if no buyer was found within a week. TSMC stated in response that it is known that this information matches data in the system services of a certain cloud service provider and is unrelated to the company's production or customer-related data.TSMC pointed out that it has been notifying affected individuals and providing necessary assistance. TSMC is working closely with relevant cloud service providers, investigative authorities, and third-party cybersecurity agencies to accelerate clarification of the situation and take necessary measures. (Jinshi)

Odaily reports: Indian cryptocurrency exchange Unocoin has denied earlier rumors that all platform funds were stolen, stating that no user funds have been lost and that the service suspension is a proactive security measure taken by the platform.Previously, Unocoin reported on November 9 that its servers had been accessed without authorization, and platform services have been suspended since then. Arkham data shows that approximately 81,000 tracked addresses on the platform show zero holdings, the official website briefly returned a 504 error, and the related on-chain fund movements are still under investigation.

Odaily reports: Predict.fun has announced the eligibility check and claim arrangements for the PREDICT Season 1 airdrop. Users can check their individual airdrop allocations via the official page, with claims opening on November 18 at 9:00 (UTC).Users may choose from the following two claim options before the TGE:- Instant Unlock: Users can immediately claim 35% of their airdrop allocation.- Vesting Unlock: Users can claim 100% of their airdrop allocation, adjusted to equal monthly releases over 12 months after the TGE, with 1/12 unlocked each month. The first unlock occurs one month after the TGE, with subsequent monthly releases requiring manual claims.Predict.fun stated that users can freely switch between the two options before the TGE, but selections cannot be changed after the TGE is completed. If no option is confirmed before the TGE, users will default to the vesting unlock option only. After the airdrop claim period opens, users have 30 days to complete their claims; unclaimed allocations will be forfeited after the deadline.Additionally, for accounts reported as compromised or posing potential security risks, the platform will require users to complete additional identity verification through the official Discord support channel and transfer their airdrop allocations to a new secure account. Such verification must be completed within 30 days after the airdrop claim period opens.

Odaily reports: On local time the 12th, the Iranian Islamic Revolutionary Guard Corps Navy stated that the previous night, two oil tankers had an accident while navigating the Strait of Hormuz. Previously, the Iranian Islamic Revolutionary Guard Corps Navy had issued multiple warnings, pointing out that the "southern route" they chose was an illegal and unsafe path, but these oil tankers ignored the warnings and were ultimately forced to stop sailing after the explosion. The Iranian Islamic Revolutionary Guard Corps stated that both ships were supertankers, carrying a total of more than 4 million barrels of crude oil. (CCTV News)

Odaily Report: South Korea's Financial Services Commission (FSC) plans to allow cryptocurrency exchanges to suspend deposits and withdrawals when a hack is suspected, without waiting for confirmation of an attack. The FSC said Thursday that it will issue no-action letters permitting exchanges to precautionarily suspend related operations under specific conditions.The FSC also requires exchanges to implement round-the-clock monitoring and incident response, increase the proportion of cold wallet holdings, and strengthen insurance coverage and reserve funds. Exchanges unable to maintain continuous monitoring may only process deposits and withdrawals when staff are on duty, and must notify users in advance.South Korean cryptocurrency exchange GOPAX suspended trading, deposits, and regular withdrawals on Friday after receiving a hacking threat, though its representatives stated that no security breach occurred. Trading platform Prabang suspended services on October 24 after detecting abnormal withdrawals from its hot wallet, reporting losses of approximately $70,000.The FSC found cybersecurity deficiencies in 130 of 555 financial companies inspected nationwide in October, and included GOPAX operator Streami and Prabang among 16 companies involved in previous security incidents. (Cointelegraph)

Odaily report: Binance Chief Security Officer Jimmy Su said in a July interview that fake job interviews could trick employees into running malicious code on company devices, thereby leading to devices being compromised, credentials being stolen, and used to infiltrate internal networks. In September, a Binance software engineer downloaded a malicious programming assignment to a work computer during a fake interview; Binance's preliminary investigation said the incident became part of the multi-stage attack behind the October theft.Jimmy Su also pointed out that attackers may use seemingly normal technical assessment steps to bypass antivirus tools. Binance's subsequent investigation said the installer for the malicious assignment evaded endpoint security tools through obfuscation and other evasion techniques.Binance said that so far this year it has blocked 57 suspected North Korea-related cyber threats, about one every five days. After the October attack, Binance said it has strengthened device and access controls, rebuilt the affected wallet systems and internal AI tools, and increased investment in endpoint protection and development environment security. (Cointelegraph)

Odaily Report: Ethlabs published an article on the Ethereum community forum, proposing to advance Ethereum's goal of achieving quantum resistance (Post-Quantum) and AI attack resistance (Post-AI) to 2027, under the codename "pqai27," and recommending it be designated as the highest priority for protocol development. The team believes that AI is accelerating the cracking of mathematical problems and the discovery of software vulnerabilities, while the timeline for quantum computing threats is also moving up. Ethereum needs to enhance its long-term network security by adopting cryptographic schemes with fewer security assumptions, strengthening client security, and formal verification.To advance this goal, Ethlabs recommends reassessing the upgrade scope of the subsequent hard fork Hegotá, reconsidering features that are not on the critical path for pqai27, and announcing the withdrawal of the Quick Slots resources previously sought for Hegotá to redirect them toward pqai27. The preliminary roadmap vision includes: at the Hegotá stage, implementing a quantum-resistant consensus mechanism and account signature scheme to enable Ethereum to operate in a quantum-resistant manner; subsequently, achieving full-capacity operation through signature aggregation and quantum-resistant data availability solutions. Ethlabs emphasizes that achieving "pqai-ready" by 2027 is the core goal, while reaching full capacity "pqai-scaled" is a more challenging stretch objective.

Odaily: Security research firm Claroc found that of the 37,571 online apps created with Grok Build, 35,578 (about 94.7%) could be accessed without logging in, with an estimated 650 to 800 apps involving private or sensitive data. The exposed information includes internal corporate documents, medical records, employee information, and plaintext passwords, involving 6 Fortune 500 companies.Among them, 24 apps were created by employees of Musk's SpaceXSI and X, involving internal sales plans, customer materials, and confidential advertising proposals for U.S. federal agencies. The researchers noted that Grok app sharing links could be discovered through DNS records, and some apps lacked access controls. Currently, SpaceXSI has taken down the 24 apps involving itself, but related apps created by other users remain accessible.