A total of 40 new addresses have cumulatively withdrawn 9,458 BTC from Wintermute this month.

Beating AI Express: Vercel announced it will phase out long-term static keys from its Marketplace. Starting November 30, third-party services that still rely on long-term keys and do not support Vercel OIDC authentication will be marked as "insecure". By January 2027, non-compliant providers will be delisted, with Vercel’s own APIs and native integrations required to follow the same standards. Long-term keys are non-expiring credentials, often stored in environment variables to enable apps or AI Agents to access services like databases. If leaked, attackers can exploit them indefinitely. Vercel’s OIDC, by contrast, allows programs to obtain short-lived credentials based on their own identity, with restricted access scopes and permissions. After credentials expire, the SDK automatically refreshes them, and caching reduces extra requests, eliminating the need for developers to manually rotate keys repeatedly. Vercel has faced such risks before: in April this year, third-party AI tool Context.ai was hacked, letting attackers breach Vercel’s internal systems and access some customers’ environment variables. The company only announced full remediation on October 16. Vercel also disclosed that past key rotation efforts consumed thousands of engineering hours. The company surveyed over 1,000 SaaS providers and found only 8.4% support the more secure authentication method. Long-term keys are widely used for their simplicity, while short-lived credentials are safer but more complex to configure and may increase network latency. Vercel is mitigating these costs via SDK and automatic caching, and using Marketplace listing eligibility to push providers to adopt more secure authentication practices.

According to Reuters citing Bloomberg, SpaceX is in talks with U.S. cellular infrastructure companies to gain access to at least 80,000 cell tower sites nationwide. Insiders said the relevant deal could solidify its path to become the fourth national wireless carrier, challenging AT&T, Verizon, and T-Mobile. The report noted SpaceX is acquiring national low-frequency spectrum and has held negotiations with tower firms including Crown Castle. Data from the Wireless Infrastructure Association shows 80,000 sites are roughly half of the total dedicated cellular towers in the U.S. last year, which stood at around 158,500. Public records show Crown Castle operates about 40,000 towers in the U.S., American Tower has roughly 42,000 U.S. sites, and private firm Vertical Bridge owns around 18,000 towers. When asked at Wednesday’s earnings call whether it was in lease talks with satellite communications players like SpaceX and Amazon, Crown Castle CEO Christian Hillabrant said, "You can consider we are in discussions with all parties," but declined to name specific clients. TD Cowen estimates building a national terrestrial network could cost over $80 billion, requiring years of additional capital investment, with related lease transactions potentially running into billions of dollars. Crown Castle, American Tower, Vertical Bridge, and SpaceX did not immediately respond to Reuters’ request for comment. Separately, SpaceX recently reached an agreement to acquire a portfolio of approximately 800MHz low-frequency spectrum across the U.S. held by Grain Management, pending FCC approval. This week, the FCC also approved SpaceX’s plan to launch around 15,000 second-generation direct-to-phone satellites. CEO Elon Musk said at an earnings call that SpaceX will build a terrestrial network to achieve wide coverage in areas where SpaceX and Starlink are licensed to operate. Following the news, AT&T, Verizon, and T-Mobile saw post-market declines ranging from 4.2% to 5%.

According to data from Farside, U.S. spot Bitcoin ETFs posted a net outflow of $635 million yesterday. Among them, BlackRock’s IBIT saw a net outflow of $254 million, Fidelity’s FBTC recorded a net outflow of $217 million, and ARK’s ARKB had a net outflow of $109 million. Additionally, U.S. spot Ethereum ETFs reported a net outflow of $110 million yesterday, with BlackRock’s ETHA seeing a net outflow of $75.5 million and BlackRock’s ETHB recording a net outflow of $17.2 million.

According to official sources, Bitget has launched two stock perpetual contracts: DHR (Danaher) and TSTOCK (American Telephone & Telegraph). The contracts are settled in USDT, support up to 20x leverage, and are available for 24/7 trading. As of now, Bitget supports a total of 376 stock contract underlyings.

According to TradingBeats data, the largest short position address for crude oil (xyz:CL) on Hyperliquid is on the verge of liquidation. The address uses an aggressive 20x leverage to trade crude oil contracts, holding a position worth $12.63 million, with an entry price of $96.7 and a liquidation price of $102.85. At the current oil price of $100, it only needs to rise 2.85% more to trigger liquidation. Recently, oil prices have climbed again, driven by a combination of surging Middle East geopolitical risks and persistent tight supply. Escalating U.S.-Iran tensions in the Strait of Hormuz, increased clashes between Iran’s Revolutionary Guards and U.S. forces, and ongoing Houthi attacks on Saudi oil facilities have collectively lifted the risk premium for crude oil supply disruptions.

SlowMist Security Team has released an in-depth analysis report on critical PHP vulnerabilities, stating that two recently disclosed high-severity PHP flaws pose systemic risks to Web3’s off-chain segments. Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities scored 9.2 on the CVSS v4.0 scale, classified as critical severity. Attackers do not need usernames, passwords, or API keys—they only need to send crafted requests to publicly exposed PHP services to execute arbitrary code with the web service process’s privileges. SlowMist notes the vulnerabilities affect all PHP versions from 5.4 to 8.5.11, with details leaked before official patches were released. Amazon Threat Intelligence observed active exploitation attempts four days prior to public disclosure. SlowMist’s threat intelligence system MistEye scanned 1,488 crypto-related domains, finding 793 (≈53.3%) carry direct PHP fingerprints. This means a large number of Web3 projects’ off-chain infrastructure—including frontends, APIs, airdrop claim pages, admin dashboards, and custodial wallet services—may run on vulnerable PHP environments. SlowMist emphasizes that Web3 security cannot focus solely on on-chain smart contracts. Attackers who exploit PHP vulnerabilities to compromise a project’s web server can alter frontends, trick users into signing malicious transactions, and directly steal assets. Even if on-chain contracts have no flaws, this does not guarantee the safety of off-chain components operating around them. For remediation, the PHP team has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; affected projects should upgrade immediately. PHP 8.1 and older versions have reached end of regular upstream support and must be migrated as soon as possible. SlowMist also warns that temporary mitigation measures for cases where upgrades cannot be done immediately only reduce risks from specific attack vectors—applying patches remains the only definitive solution.