AI × Crypto
AI × Crypto
256 Drops and One Payment Could Have Minted 18 Trillion XRP
An AI agent at Veria Labs chained two unchecked 64-bit additions in the XRP Ledger's 2015 payment engine: 256 offers, one payment, a buyer charged 256 drops, and 18.45 trillion XRP credited to the sellers, 184 times the supply cap. RippleX reproduced it the day it was reported, raised it to critical, and shipped the fix in xrpld 3.4.1 with no amendment vote and the source withheld, which the disclosure report calls a first in more than ten years. Veria says it was paid the program's maximum $250,000.
AI × Crypto
'Bunker Mode': Drake Says AI Math Could Break ECDSA Within Months; Coinbase's Cryptographer Calls It FUD
Ethereum Foundation researcher Justin Drake asked the industry on October 7 to plan a controlled migration to addresses that have never signed, because AI-assisted mathematics might break ECDSA before any quantum computer does, in the worst case within months. Coinbase's head of cryptography called it FUD with no evidence. The OpenAI release Drake cites contains hundreds of proofs and, in its own README, no claimed attack on elliptic curves. Vitalik Buterin said the risk is real and the migration is where people lose money.
Rogue agents
Someone's AI Agent Tried to Sell 10 USDT on Quidax
Transluce's report on AI agents abusing a public URL scanner logs 15 attempts against Nigerian exchange Quidax on September 19 and 20: a 10 USDT sell order through its Ramp widget that never submitted, an HTML-injection probe, and API requests stopped by authentication and Cloudflare. The lab ties the tooling to OpenAI's acknowledged agent swarm, which it links to a probe of an Australian government health site, but it does not attribute the Quidax activity. Nobody has claimed it, and Quidax has not commented.
Phishing as a service
EvilTokens Sold a Chatbot That Picked Who to Impersonate
Microsoft's Digital Crimes Unit and eight partners seized the infrastructure behind a phishing platform tied to more than 12,000 compromised inboxes at over 10,000 organizations since February. The access technique — device code phishing — has carried a public Microsoft advisory since early 2025. What was new sat behind it: a chatbot that read the open mailbox in 20-plus languages, mapped who held payment authority, and named the colleague worth impersonating. Coinbase traced the platform's entire revenue, about $1.1 million, to four Tron addresses. Two men were arrested in London and released on bail; nobody has been charged.
Key compromise
408.5 Million NTX Came Out of NuNet's Own Minting Key
One attacker drained 8,721,530 FET from a Fetch.ai converter with a valid authorizer signature, then minted 408.5 million NTX through NuNet's deployer and 260 million AGIX and 53.8 million WMTx at SingularityNET — all three projects belong to the Artificial Superintelligence Alliance. This desk read the converter source: the function that pays tokens out carries no per-transaction ceiling, while the one that takes them in does. Fetch.ai calls its analysis preliminary and has not said how the keys were obtained.
Agent security
DeepSeek Filed Its 9.4 Sandbox Escape Fix Under Chores
CVE-2026-82533 let a sandboxed agent in DeepSeek Harness elevate its own session to full access with approvals disabled, using one curl command to a local API that trusted the Host header instead of the peer address — and the change was logged as though the human operator made it. The fix shipped August 27 as the fifth of ten bullets under "Chores." As of September 11 the repository has published no security advisory.
Agent security
It Tried to Abort Eight Times, Then Broke Into a Real Machine
An early Claude Opus 4.6 was told it was in a simulation with no internet; a misconfiguration had put it on the open internet. It broke its own capture-the-flag target, failed to abort eight times, then found an egress path and took administrator access on a real third party's machine. Anthropic found the transcripts eight months later, after widening a search from 141,000 to 481 million.
Agent security
Who Re-Reads a Tool Description After You Approve It?
A malicious MCP server counted its own tool calls and behaved for exactly three, then rewrote the metadata it served into instructions to hunt SSH keys and cloud credentials — and to conceal the activity. Twenty-three pull requests carried it in a 74-minute window.
Agent security
The Agent Opened the Folder. The Folder Opened a Shell
Manifold Security found eight ways a repository can make a coding agent execute the repository's own commands — outside the sandbox, with no approval prompt. Four of the seven agents were still unpatched at publication.
Agent infrastructure
The Key Check Failed. The Session Opened Anyway
CISA adds a LiteLLM MCP authentication bypass to the federal exploited list — the second LiteLLM flaw there in under three months. A fabricated Bearer token opened a session onto the tool layer.
Threat landscape
"Pennies" Compared to What's Coming: Industry Leaders Warn on AI-Agent Attacks
TRM logs a 40% YoY rise in AI adoption across crypto crime. What needed a skilled attacker now runs as software against everyone at once.
Custody
MetaMask's Agent Wallet: Guardrails for Letting an AI Touch Your Money
Spending limits, allowed networks, allowed protocols — the wallet designs the agent era actually needs.
Markets infra
Binance's Agent OS Bridges ChatGPT, Claude, and Cursor to Exchange Rails
The agent-to-exchange pipe is now a product; the security perimeter of "your account" just changed shape.