Suspected Sonic Labs-Related Address Transfers 11.78 Million S Tokens to Binance, Valued at Approximately $5.55 Million

According to an official announcement from OKX, the platform will officially launch the USD-margined LLYUSD X-Contract (X-Perp) at 16:30 (UTC+8) on October 21, 2026, with support for web, app, and API trading.

According to Bloomberg Law, the state of Arkansas and its Oil and Gas Commission on Tuesday requested the U.S. Eighth Circuit Court of Appeals to overturn a lower court order that blocks enforcement of the state’s law restricting foreign entities from holding interests in digital asset mining operations. The lower court had previously ruled the law was likely invalid due to federal preemption. Joseph Nelson from Arkansas’s Office of the Attorney General pushed back on that finding, noting the law falls within core state police power and targets the same countries the U.S. federal government has designated as national security threats. The legislation, passed in 2024, bans citizens or companies of countries subject to U.S. Department of State arms export controls from holding interests in digital asset mining facilities located in the state.

SlowMist issued a statement noting that PHP published a security advisory on October 20, disclosing two critical vulnerabilities that could lead to remote code execution (RCE), with CVE identifiers CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on the CVSS v4.0 scale. No official patch has been released to date, and the vulnerabilities’ technical details, exploitation conditions, and affected versions remain unconfirmed by the PHP project. Third-party reports suggest PHP 5 and subsequent versions may be impacted, though this scope has not been verified. The official is expected to roll out a security update at 14:00 UTC (22:00 Beijing time) on October 21. SlowMist recommends relevant teams audit PHP versions across their servers and business systems, prioritize checking internet-facing services, and update immediately after the official patch becomes available. If a fix is not immediately feasible, restrict access to exposed PHP services and isolate them if needed.

Official announcement: OKX’s new account security system “Anxin Shield” has officially launched. The system allows users to check their account and device security status with one click, and further strengthens account protection by enabling six security safeguards. Additionally, Anxin Shield provides coverage of up to 500,000 USDT for stolen funds from eligible accounts. In the event of an unauthorized third-party account takeover that complies with official terms, users may report the incident and submit compensation applications via official channels. Specific compensation eligibility and amounts are subject to official terms and audit outcomes. To access Anxin Shield, users can navigate to the “Assets” tab at the bottom of the OKX App homepage, then click the shield icon in the upper right corner to view their account security status and complete relevant settings.

Crypto payment firm MoonPay and Dunamu, parent company of South Korean crypto exchange Upbit, have announced a strategic partnership. The two sides will jointly explore business opportunities in stablecoin-based global payments, cross-border fund transfers, corporate finance and treasury management. Additionally, they plan to integrate MoonPay’s global service network with Dunamu’s blockchain infrastructure to expand the global footprint of GIWA Chain—Dunamu’s Ethereum Layer 2 network—and drive GIWA-based products and services into overseas markets.

Whales continue to accumulate $BTC! Another 3 newly created wallets received 1,090 $BTC ($90.38M) from Wintermute.