Blanket, an independently developed AI tool, is using Kalshi’s regulated event-contract markets to help small businesses identify and hedge operational risks.

Blanket matches business risks with Kalshi contracts

Blanket is designed to evaluate the risks facing a business and identify Kalshi contracts that may provide a hedge against specific outcomes. Potential exposures include unusual weather, changes in energy costs, new tariffs, and election results that could affect revenue or operating expenses.

A small business could provide information about its operations and the events most likely to disrupt them. Blanket’s AI system would then analyze those exposures and recommend available contracts connected to the relevant outcome.

The tool does not automatically place orders, control customer accounts, or handle funds. Business owners retain responsibility for reviewing the recommendations and deciding whether to trade through Kalshi.

This distinction also separates Blanket from Kalshi itself. Zminsky built the tool independently using markets available on Kalshi’s platform. Kalshi provides the underlying event contracts and regulated trading infrastructure, but Blanket is not one of its internal products.

How event contracts can hedge operational risks

Event contracts are derivatives whose payouts depend on whether a specified event occurs or a defined value is reached. The Commodity Futures Trading Commission cites corporate earnings, snowfall levels, economic indicators and hurricane damage as examples of outcomes that can underpin these contracts.

That structure can allow a business to take a position that may offset losses caused by an external event. For example, a company exposed to high energy costs could use a contract tied to future energy prices. A weather-dependent business could consider a contract linked to snowfall, temperature, or storm activity.

Blanket aims to make that process more accessible by using AI to connect a company’s stated risks with relevant markets. Small firms may lack the dedicated risk teams employed by larger corporations, making it harder to identify suitable hedging instruments.

However, an event contract does not provide the same coverage as an insurance policy. Its payout depends on the contract’s specific terms, while the recommended position may not fully match the business’s actual financial loss. AI-generated recommendations also require human review.

Kalshi pushes further into institutional risk management

Kalshi operates as a CFTC-designated contract market, a status it received in November 2020. Its role in Blanket gives the independent tool access to contracts traded through a federally regulated U.S. venue.

The development follows Kalshi’s move to expand beyond retail prediction trading. As crypto.news reported on Aug. 4, the platform partnered with compliance technology provider Comply to help financial firms monitor employee activity involving event contracts.

The planned integration will place Kalshi trades within workplace surveillance systems already used to track stocks, bonds and cryptocurrencies. Employers will be able to identify restricted positions or activity that may involve material non-public information.

Kalshi also expects the compliance system to cover its planned perpetual futures products when they become available.

Market oversight remains a key issue

The focus on surveillance follows enforcement cases involving the misuse of prediction markets. Crypto.news reported that former U.S. Representative George Santos agreed to return $17,569.98 in gains, pay a $17,500 civil penalty and accept a three-year trading ban in a CFTC settlement involving Kalshi contracts.

Kalshi had referred Santos’ activity to regulators after he traded on whether he would attend President Donald Trump’s State of the Union address while making public statements related to the outcome. Santos neither admitted nor denied the CFTC’s findings.

Blanket’s launch points to another potential use for prediction markets: commercial risk management. Its adoption will depend on whether its recommendations closely match the financial exposures of small businesses and whether users understand the limits of event-contract hedges.

BTCPay Server has urged users to install version 2.4.2 immediately after discovering that attackers are actively exploiting a critical vulnerability that could lead to stolen funds.

BTCPay Server tells users to install v2.4.2

BTCPay Server issued the warning through its official X account on Aug. 7, describing the vulnerability as critical and saying successful exploitation could result in the loss of funds.

The project instructed server administrators to open the Admin Dashboard and navigate to Server, Maintenance and Update. Operators should then confirm that the version number displayed in the server footer reads 2.4.2.

“There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds,” the project said.

Users who cannot complete the update immediately have been told to turn off their BTCPay Server until the patched version can be installed. The measure is intended to block further unauthorized access to servers that may remain exposed.

BTCPay Server did not identify which previous versions are vulnerable. It also did not disclose how attackers are gaining access, how many servers have been compromised, or whether any losses have been confirmed.

Critical flaw threatens self-hosted Bitcoin payments

BTCPay Server is an open-source payment processor that lets merchants accept Bitcoin and Lightning Network payments through infrastructure they control. Unlike custodial payment platforms, operators are responsible for maintaining and securing their own installations.

That structure reduces reliance on a centralized payment provider but places the responsibility for software updates on individual merchants and server administrators. A compromised installation could expose payment operations or other sensitive server functions, depending on the vulnerability’s reach.

The project’s recommendation to shut down systems shows the urgency of the threat. Operators should not leave an affected server online while waiting for a convenient maintenance period because BTCPay Server has confirmed that exploitation is already occurring.

Users should obtain the update through the server’s official maintenance interface and verify the 2.4.2 version string. The project has not advised users to rely on third-party downloads or unofficial fixes.

Bitcoin infrastructure faces wider security review

The disclosure follows another recent incident involving Bitcoin payment infrastructure. As reported by crypto.news, Zeus Wallet took its infrastructure offline after containing a cyberattack and began auditing its systems before restoring services.

Zeus said no customer funds were lost or placed at risk. It also said its investigation had not identified a vulnerability in Lightning node software. No evidence currently indicates that the Zeus incident and the BTCPay Server vulnerability are connected.

Security reviews have expanded across the Bitcoin ecosystem following a series of recent attacks. Crypto.news reported on Aug. 6 that the volunteer Bitcoin Red Team had found 4,962 potential issues while reviewing 390 Bitcoin-related projects.

The group classified 720 of those findings as high or critical severity. Its work covers Bitcoin wallets, cryptographic libraries and infrastructure software, although it did not publicly identify projects with unresolved critical flaws.

What BTCPay Server operators should do next

BTCPay Server operators should treat the upgrade as an emergency security action rather than a routine software update. Servers should remain offline if administrators cannot confirm that version 2.4.2 has been installed.

Merchants may also need to review server activity for signs of unauthorized access. However, BTCPay Server has not yet published indicators of compromise or technical details that operators could use to determine whether their systems were targeted.

Further information may follow once more users have installed the patch and public disclosure no longer increases the risk to unpatched servers. Until then, the project’s guidance remains limited but direct: update to v2.4.2 or shut down the server.

There is already money on the chain for the feature to serve. Onchain data aggregator RWA.xyz tracks about $1.38 billion of distributed real-world assets on XRPL, including $845.7 million of RLUSD. Ondo accounts for another $212.6 million, followed by VERT Capital at $116.1 million and Archax at $55.4 million. Societe Generale sits further down the table at $11.6 million.

That leaves more than $530 million of tracked tokenized assets outside RLUSD, though the market remains concentrated in a handful of issuers.

Confidential Transfers stays narrow in its first version. Holders have to opt into the encrypted format, and it currently works for direct MPT payments between accounts. It does not cover trades on XRPL’s built-in exchange, escrow or checks.

The other five are aimed at the same audience. Batch can package as many as eight transactions together, including an all-or-nothing mode where every step succeeds or none does. Sponsor lets one account cover another’s fees and reserve requirements, removing the need for a new user to hold XRP before transacting.

Permission Delegation lets an account authorize another party to submit only specified transaction types, giving a fund administrator limited authority without handing over full control. Dynamic MPT lets issuers change certain properties of a token after issuance.