Golden Finance launches Golden Web3.0 Daily to provide you with the latest and fastest news on games, DeFi, DAO, NFT and Metaverse industries.

This article is translated from the PPT presented by Gavin Wood during his speech at Polkadot Decoded Asia in Singapore on September 16, 2024.

I didn't expect that anyone still remembers last year's essay, what were people talking about 2049 before it skyrocketed 10 times?

Circle and Sony Block Solutions Labs are partnering to make USDC the primary transaction token on the new Soneium blockchain. This collaboration aims to enhance digital transactions and create innovative opportunities in the Web3 space, with Soneium set to launch its mainnet in 2025.

Circle, the issuer of the world’s second-largest stablecoin, USDC, is making a strategic move by relocating its global headquarters to New York City.

Someone planned an assasination on Donald Trump a second time, coincidentally a few hours before the launch of Trump's DeFi platform, World Liberty Financial.

China's new regulations require digital platforms to clearly label all AI-generated content, including text, images, videos, and audio files. The rules mandate visible logos and metadata, voice prompts for audio, and user identification for AI-generated posts to enhance transparency and prevent misinformation.

Meta has resumed AI training in the U.K., using public content from Facebook and Instagram after resolving privacy concerns with regulators. The company assures users that private messages and data from those under 18 are excluded, though some still worry about privacy and AI's growing role.

There are many similarities between Sun Yat-sen’s revolution and Web3’s digital reforms.

As the 2024 Token2049 conference draws closer, the global blockchain and cryptocurrency community is once again focusing on Singapore.

According to CryptoPotato, Ledger, a hardware wallet manufacturer, has announced plans to disable blind signing for Ethereum Virtual Machine (EVM) decentralized applications (DApps) by June 2024. The decision comes in response to an exploit where a wallet drainer was added to a library utilized by numerous DApps to connect to Ledger devices. The company revealed that approximately $600,000 in crypto assets were stolen during the recent exploit and committed to compensating affected victims. Ledger declared that it would discontinue the practice of blind signing with Ledger devices by June 2024, aiming to establish a new standard to enhance user protection and promote clear signing across decentralized applications. In the recent exploit last week, developers on Twitter identified a malicious version of the Ledger Connect Kit, a library facilitating the connection between Ledger devices and DApps. According to Web3 security firm BlockAid, the attacker injected a wallet-draining payload into the Ledger Connect Kit’s NPM package, allowing them to drain funds from users who signed on DApps like Sushi.com and Hey.xyz. MetaMask, a software wallet developer, cautioned users to “stop using DApps” following news of the attack. Ledger confirmed that the attack occurred due to a former employee falling victim to a phishing attack, which allowed the attacker to access the former employee’s NPMJS account and push a malicious version of the Ledger Connect Kit. This compromised Connect Kit rerouted user funds from any wallet connecting to a DApp using it to the hacker’s wallet. Ledger responded swiftly, deploying a fix within 40 minutes of its security teams alerting it. A new version of the Connect Kit (1.1.8) has been released. The exploit did not compromise Ledger devices and the Ledger Live app.

According to Blockworks, Ledger CEO Pascal Gauthier addressed the supply chain attack on its Ledger ConnectKit in a post on Thursday. Gauthier stated that the standard practice at Ledger involves no single person being able to deploy code without review by multiple parties, and that strong access controls, internal reviews, and multi-signature code are in place for most parts of their development. However, this was not the case on Thursday morning when a former employee was the subject of a phishing attack, giving the hacker access to Ledger's package manager. It remains unclear how the employee maintained access to the system. Gauthier called the incident an unfortunate isolated event and emphasized the need for continuous improvement in security systems and processes. Ledger plans to implement stronger security controls, connecting their build pipeline to the NPM distribution channel for stricter software supply chain security. Additionally, Ledger will increase security around dapps that enable browser-based signing. The incident was first reported on Thursday morning by decentralized exchange SushiSwap, which took its front-end web app offline after the warnings and advised users to avoid engaging with unexpected 'Connect Wallet' pop-ups. Revoke.cash was also impacted, according to cybersecurity firm BlockAid. Ledger deployed the genuine ConnectKit and worked with WalletConnect to take down the malicious code within 40 minutes of discovery. The exploit was active for approximately 5 hours. Tether CEO Paolo Ardoino posted that the attacker's address was frozen. Gauthier stated that Ledger is working with authorities and doing everything possible to help with the investigation, supporting affected users in finding the bad actor, bringing them to justice, tracking the funds, and working with law enforcement to recover stolen assets from the hacker.

According to Decrypt, hardware wallet manufacturer Ledger has warned users not to connect to decentralized applications (dapps) after a malicious version of the Ledger Connect Kit was identified. A spokesperson for Ledger stated that a genuine version is being pushed to replace the malicious file and that users should not interact with any dapps for the moment. The spokesperson also confirmed that Ledger devices and the Ledger Live app were not compromised. Software wallet developer MetaMask has also warned users to stop using dapps as news of the attack broke. Web3 security firm BlockAid reported that the attacker injected a wallet draining payload into the ledgerconnect kit's NPM package, affecting dapps using versions 1.1.4 and above of Ledger's connect-kit, including Sushi.com and Hey.xyz. SushiSwap CTO Matthew Lilley criticized Ledger for a chain of blunders and advised users to avoid using any dapps until their teams confirm that they have mitigated the attack.