SlowMist discloses investigation progress into the Bitget hot wallet theft, with the attack involving a vulnerability in a third-party security product.

According to official announcements, HSBC has revealed that its upcoming Hong Kong-based stablecoin will be named HSBC RedCoin, with a phased rollout plan. The initial phase will focus on peer-to-peer (P2P) transfers and peer-to-merchant (P2M) payments, before expanding to corporate and institutional use cases. HSBC also released a new survey of over 1,000 local customers, which found strong market interest and readiness for the stablecoin. Among respondents, 74% are familiar with at least one stablecoin use case. The top use cases are digital asset trading and tokenized investment (57%), followed by personal transfers (53%), cross-border remittances (52%), and merchant payments (52%).

Beating AI Express News: AI coding tool Pi has officially integrated MCP in its version 0.99.0. The original "No MCP" label on its official site was crossed out and updated to "Now with MCP+Codemode". Pi has long openly criticized common MCP integration approaches. Last year, developer Mario Zechner found in tests that Playwright MCP’s 21 tool descriptions take roughly 13,700 tokens, while Chrome DevTools MCP’s 26 tools occupy around 18,000 tokens. He argued that an overabundance of tools wastes context window space, is difficult to combine, and the large volume of returned content directly enters the model’s context. This time Pi adopted a different integration strategy: MCP tools are not exposed to the model by default, instead managed via Codemode. The model can write JavaScript to call, combine, and filter tools in parallel, only sending necessary results back to the context. Tools can also be loaded lazily, no need to declare all upfront. Pi team member Earendil has not retracted prior criticism, noting many MCP servers still overload with excessive tools and text results, and the tool combination issue remains unresolved. Pi now retains MCP’s general interface, while using Codemode to avoid the usage patterns it was most dissatisfied with before.

According to TradingBeats monitoring, a large whale address on Hyperliquid placed 140 regular limit buy orders in batches this morning for BTC and ETH, planning to purchase 400 BTC and 5,000 ETH with a total order value of approximately $45.207 million. The address currently holds no crypto positions. BTC buy orders are concentrated in the $79,600–$81,695 range, totaling around $32.294 million, with the highest buy price roughly 1.9% below the current market price. ETH buy orders fall between $2,565 and $2,600, amounting to about $12.913 million, and their highest buy price is approximately 2.7% below the current price.

According to official announcements, Solana ecosystem tokenization platform Metaplex has launched MPL-3643, a new standard for permissioned real-world assets (RWAs) and tokenized securities tailored for the Solana ecosystem. The standard allows issuers to issue assets directly on Solana, removing the requirement for wrapped asset models. It embeds functions including transfer restrictions, lock-up periods, and compliance lifecycle management, and is built on Token-2022, sRFC 37, and the Solana Attestation Service. MPL-3643 is now in a limited open alpha phase.

BitMEX co-founder Arthur Hayes stated during Korea Blockchain Week (KBW) that he expects Ethereum (ETH) to reach $10,000 by the end of this year. The executive also expressed a bullish outlook on ETH’s future prospects in an interview with CoinDesk. As of now, ETH is trading at roughly $2,672.

SlowMist, a leading blockchain security firm, announced in a statement that Bitget has commissioned its security team to investigate the hot wallet asset theft incident that occurred on September 25. As of September 29, SlowMist’s investigation found the attack involved malicious activities targeting a third-party security product, the wallet application’s host, and a custom withdrawal tool developed by the attacker. The investigation revealed the attacker’s key attack methods: exploiting a zero-day vulnerability in the third-party product to carry out malicious operations; using an internal employee’s identity to gain unauthorized access to the third-party product’s management platform on September 25; obtaining and deploying a custom withdrawal tool tailored for the wallet’s withdrawal logic; on-chain activity began at 02:31 UTC+8 on September 25, with the attacker transferring assets across multiple blockchains over roughly 2 hours and 52 minutes; the attacker later attempted to alter withdrawal records and triggered additional BTC withdrawals. SlowMist noted that it is still investigating how the attacker performed lateral movement between the affected systems.