At around 18:45 UTC on November 10, a bad actor took control of the across.to domain after a social engineering attack on registrar Namecheap and used it to host a phishing site.

The team was alerted within 15 minutes and moved to shut the site down. SEAL911 flagged across.to as a phishing domain with major wallets, and Cloudflare marked it as at risk before pulling its DNS records. The phishing page is no longer available.

Users who visited across.to before the block may have been affected, while third-party integrations and API users were not.

Across says Namecheap has been unresponsive, so its frontend and API will stay down until the domain is secured. Affected users are asked to revoke attacker permissions and share transaction details with the team, and a post-mortem is promised.

In a mid-quarter treasury update, the Nasdaq-listed company (FWDI) said it added 226,396 SOL between October 1 and November 9 through purchases and staking, at an average cost of $75 per token.

Holdings now stand at 8,727,694 SOL, about 1.5% of circulating supply, valued near $756M at the company's $86.61 mark.

SOL per fully diluted share rose 2.3% to 0.0824. Forward also secured a $50M two-year credit line backed by staked SOL, committed up to $50M to the tokenized US home price index USHP and added Barclays to its at-the-market equity program alongside Cantor.

The buying comes as net asset value fell to $600M from $870M at the end of September, with institutional debt up to $187.5M and shares trading below NAV (0.976x fully diluted mNAV).

Kalshi, the largest regulated prediction market in the US, is reportedly facing potential charges from the CFTC tied to the launch of certain wagers on its platform. A person with direct knowledge of the probe described the charges as potentially imminent.

The warning comes from the same federal regulator that has backed Kalshi in its fight with state authorities. In August the CFTC invoked emergency powers to keep Kalshi operating in New York, one of several states trying to restrict its event contracts.

Charges would mark a sharp turn in the relationship between the agency and the prediction market it oversees as a Designated Contract Market, at a time when federal protection is Kalshi's main defense against state lawsuits.

The open-source Lightning wallet and accounts server published LNbits 1.7.0 with security fixes after a vulnerability discovered on November 8. The team told all operators to upgrade before running LNbits again.

Every version prior to 1.7.0 is affected, and funds held on older instances are at risk of being stolen.

Upgrading alone is not enough: credentials exposed before the patch may still give an attacker access. LNbits advises a fresh server if compromise is suspected, a reset of all user wallet keys, new funding-source credentials and fresh connections for extensions such as NWC Provider, LNDHub, Bolt Cards and TPOS.

A full report on the exploit will follow separately. The team also reminded operators that LNbits is a hot wallet and urged them to keep only day-to-day funds online.

A newly created account found a flaw in how Arcus, the tokenized stocks and perps DEX on Robinhood Chain, handled transfers between a user's own subaccounts. Under specific conditions the bug let it record a balance far larger than it held, and the account then withdrew against it, as detailed in the Arcus incident report.

$2,234,391 USDG left on-chain before withdrawals were stopped, while the bridge's rate limit held back a further $3M that was never paid out and later reversed.

The exploit started around 10:07 PM ET on November 9. The team paused withdrawals an hour later, deployed a fix at 11:37 PM and blocked the exploiter's addresses. Withdrawals reopened the next morning, and Arcus Labs covered the shortfall from its treasury, so no user balances or positions were affected.

Arcus is working with blockchain investigators to trace the funds and has published the exploiter's initial address, asking exchanges to flag any deposits from it.

The crosschain bridge posted an urgent alert on X on November 10, saying its team is investigating an issue with the Across domain.

Users are told not to visit the app, connect a wallet, or sign any transaction or approval there until further notice.

Across says it has moved more than $40B across chains for over 5M wallets. The project has not yet said whether funds or smart contracts are affected and promised further updates.

Domain incidents are a common route for front-end attacks, where a compromised site prompts users to sign malicious approvals. Users who interacted with the app recently may want to review and revoke token approvals.

Everything that moved crypto today, in one card.

Today's headliners: Goldman Sachs, Visa, Moody's, Coinbase, MARA, Securitize, Plume, Initia, MegaETH, Alta

Public ledgers expose every Solana wallet's balances and transaction history, which has kept payments and payroll off-chain. Helius has now released Solana Privacy Rings on mainnet, programmable shielded pools that execute natively on Solana.

The default permissionless Ring encrypts assets and amounts while wallet addresses stay visible, and only the owner can decrypt balances with a viewing key. It supports SOL, SPL and Token-2022 tokens, with succinct ZK proofs verifying private transactions in milliseconds. Developers integrate via TypeScript and Rust SDKs and dedicated privacy RPC methods.

Decrypt, Ore and Aurora Intents are already live on the Ring, while Backpack, DFlow, Jupiter, Squads and Titan are working on integrations.

Range, Chainalysis and Elliptic support compliance screening. Custom Rings for institutions, with auditor keys, allowlists and freezes, are under audit and targeted for a Q4 2026 mainnet release.

Grayscale has launched Zcash Invest, an education platform and national campaign built around its Zcash ETF (ZCSH), which listed on NYSE Arca on August 25. The campaign opens with a Wall Street Journal wrap and a new national ad, then rolls out across print, outdoor, streaming and social.

The asset manager plans to direct $1M to Zcash nonprofits and initiatives. The first $400K went out as four $100K grants to the Zcash Foundation, Pretty Good Policy for Zcash, Shielded Labs and Project Tachyon. Grayscale also intends to reinvest 100% of ZCSH sponsor fees into Zcash development, marketing and education for up to a year.

ZCSH recorded about $61M in net outflows over October and November: $46.25M in October and more than $15M so far this month.

The fee commitment is voluntary and can be modified or discontinued at any time. It funds ecosystem work rather than ZEC purchases, so it does not translate directly into buying pressure on the token.

Nasdaq-listed TON Strategy (TONX), a treasury company built around the TON network, posted its third-quarter results with revenue almost entirely from staking rewards on its GRAM (formerly Toncoin) holdings.

The company held about 235.1 million GRAM worth $348.5M at September 30, with 232.9 million staked. It earned roughly 9.4 million GRAM in the quarter, flat versus Q2, but revenue fell to $13.1M from $15.0M on lower GRAM prices.

Annualized gross staking yield reached about 16%, lifted by higher validator rewards after TON's Catchain 2.0 upgrade in April.

A $27.2M unrealized loss on GRAM holdings pushed the quarter to a $22.9M pre-tax loss from continuing operations. The company has no debt, $25.3M in cash, and bought back $5.7M of stock, while Telegram began a limited rollout of its native Gram Wallet on August 31.