🔥 TODAY: Hyperliquid tells the Financial Times it is officially registered in Singapore, but Singapore's MAS says the platform falls outside its jurisdiction because it's decentralized.

In IPAL Network’s knowledge marketplace, Zealynx found a Critical path that let any address rewrite another creator’s subscription. `setSubscription` accepted a vault ID without checking that the caller owned that vault. An attacker could change its price, duration or co-owner—and even make private content public without the creator’s consent. The ownership check was added and the finding was fixed.

I'll never understand founders like Pacman. Incredible standing in the market with top protocols like Blur and then Blast, the best investors backing him, all the attention you could possibly ask for. And instead of building something huge and lasting out of all that, rather decided to max extract the shit out of it for a quick buck in the short term. Too many such cases, unfortunately. Which is exactly why we should appreciate the few brilliant, honest builders so much more. the ones who refuse to take the path of least resistance. If you find one, just go perpetually long.

Blast network announces it will cease operations, causing $BLAST to dump 42%.

🚨BREAKING: Apple announces new privacy protections after users find Meta’s Muse AI agent accessing ENTIRE messages history, even after being explicitly told not to. Apple says it will introduce additional controls around Full Disk Access, warning that AI agents with broad system permissions can expose files, mail, messages and browsing history without users fully understanding the risks. The move comes after tech writer Jason Aten reported that Muse synced more than 187,000 rows from his Apple Messages database despite him not granting it access. Muse reportedly even told him it only saw incoming notification banners. Meta has disputed the allegation, saying Muse cannot access Messages without explicit permission.

Who can change the code? With multisig-owned Onchain KMS apps on Phala, an operator can prepare a compose update, but the multisig approves its hash onchain before Cloud commits it. Running the app and authorizing its next version can be separate jobs. $PHA

Ehhh this is like $174M across multiple chains and cold/hot wallets sent to 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee over the past hour.

Short post on @Trueo_’s mechanics: Anyone can permissionlessly create a market through the App. Topics can include virtually anything that’s publicly verifiable! (within ethical boundaries ofc). A market’s life cycle starts from a proposal. Once submitted, it enters a 3 day funding phase where it needs to hit a liquidity threshold in order to graduate. Markets that graduate become tradable like any traditional prediction market. The ones that fail to graduate expire without becoming tradable, and funders can withdraw their deposits. Funding a market fulfills several functions in a single step: - clearing the initial odds - seeding minimum liquidity - quality filtering Every market is an event contract that resolves based its resolution rules. Those rules are immutable. They are committed onchain as plain text strings inside the proposal transaction. Once a contract is live, it cannot be altered, clarified, or changed. This gives traders peace of mind that the goal posts will not be moved mid-trading, regardless of who the original creator was. All markets are resolved through the protocol’s enshrined oracle. The oracle serves as the neutral arbiter in case of a dispute. The details of this process require its own post, but the summary is that the oracle combines elements of AI automation, economic security (TRUE holders), and a human jury pool. The idea is that most prediction markets restrict market creation to an editorial team, or gate keep it behind significant capital requirements. One of the main reasons for this gatekeeping is because those prediction markets don’t have an oracle flexible enough to resolve markets on just any topic created by just anyone. This is where Trueo shines! Its oracle is designed to surface evidence from any and all legitimate data sources. It does this through an open and fair resolution process that doesn’t suffer from the rigidity of common oracle systems! If you haven’t tried the App yet, now’s a good time. Go ahead and create a market, it only takes a minute and it costs almost nothing! Oh, and you can earn creator fees if the market graduates. If you have any questions, feel free to drop them in the comments 🫶

Live now: exploring the Kohaku CLI, how it makes Ethereum privacy tools easier to use, and demoing private transactions across Railgun, Tornado Cash, and more With @jchaskin22 and @kassandraETH of the @ethereumfndn xitter.cf/i/broadcasts/1AKEmvkag…

🇹🇷 BIG: Turkish lira collapses to near-zero against Bitcoin.

I use coding agents to work across real repositories, and the biggest mindset shift was simple: the repository is not automatically trusted context. A README can contain instructions. A test can execute code. A package script can install more code. A git hook can run before the task you actually intended. So I separate three things: • what the agent may read • what it may execute • what it may change or send outside That separation is the basis of the coding-agent security checklist we published: zealynx.io/resources/checkli…