An Ethereum node can rely on HTTPS services for signing, block building and startup data. The Teku and Besu fixes address the certificate trust behind those connections, with exposure varying by configuration and whether Java runs inside a container or separately.
Coinbase’s analytics-vendor disclosure concerns customer contact information, which can support targeted phishing even when funds remain secure. Polymarket faces a separate question about continued access to sports contracts, which account for almost all its recent US contract-face-value turnover amid the federal-state jurisdiction dispute.
Top News
Image by CryptoSlate
Teku 26.10.3 and Besu 26.10.2 remove four certificate roots from their Docker images; updating host Java does not fix an older container. Binary installations use separately installed Java, which needs its own check and remediation if affected. Teku reports no exploitation and says default mainnet nodes without HTTPS URLs are unaffected; on an unremediated runtime, an attacker intercepting an affected HTTPS connection could impersonate a remote beacon node, redirect proposal fees or cause missed validator duties.
Sports supplied 98.2% of Polymarket US’s $13.7 billion in 30-day contract-face-value turnover through October 26, according to DeFi Rate. Traders paid $3.4 billion; the federal-state dispute leaves sports-contract availability unresolved.
Coinbase says an Amplitude incident exposed some customers’ contact information without evidence of access to its systems. Separately, Daishin reported exposed records for 38,490 customers; Bithumb’s investigation had not established whether customer records were compromised.
What We’re Watching
Will court rulings limit sports-contract availability? Utah’s case targets Kalshi, while Polymarket’s exposure depends on how courts resolve federal jurisdiction and the scope of any restrictions. Source
Will Bithumb’s investigation establish whether customer records were exposed? The reported intrusion involved its employee communications system; authorities had not confirmed exposed wallet addresses or transfer-enabling information. Source
Will Earn+ disclose its live oracle wiring, actual leverage and market-price unwind triggers? Those details remain unverified and would help establish how its managers could respond to a USDe discount. Source
Elsewhere in Crypto
Ripple is heading for its best year ever while XRP faces its worst since 2022. Ripple expects a record $900 million annualized product revenue run rate by year-end, alongside XRP’s reported year-to-date decline.
Ethena Pay’s 11x leverage loop promises high yield, but risks hidden losses. Earn+ targets roughly 11x leverage; its disclosed USDT-linked valuation can miss a USDe discount, while live positions remain unverified.
Robinhood posts record $1.4 billion revenue, but a 14% profit drop exposes hidden portfolio losses. Q3 event-contract revenue reached $173 million against crypto’s $120 million; $67 million in unrealized losses weighed on profit.
Galaxy’s AI data centers bring $79 million in lease revenue and a small net loss. Adjusted EBITDA of $69 million does not measure free cash flow; the data-center segment recorded a $435,000 net loss.
Euro-area banks report record deterioration in retail-funding access. ECB surveys show tighter financing despite continued money and loan growth; effects on Bitcoin demand remain conditional.