The New York Stock Exchange has spent roughly a year testing Avalanche technology and working with Ava Labs as it develops infrastructure for tokenized securities, according to Ava Labs President Charley Cooper.

Cooper said during an appearance at the Avalanche Summit in New York on Thursday that NYSE had examined both the technology and economics behind Avalanche while assessing how the network could fit into its existing systems.

NYSE’s work with Ava Labs has involved questions extending beyond blockchain performance. Cooper said the exchange wanted to determine whether the company understood its business model and the requirements involved in operating one of the world’s largest securities markets.

“They weren’t just kicking the tires on our technology,” Cooper said. “They wanted to make sure that we understood their business and their economics.”

Ava Labs and NYSE have developed what Cooper described as a “close working relationship” during the process. He did not say that Avalanche had been selected as the blockchain for NYSE’s planned tokenized securities platform.

“I leave it to the NYSE guys to talk publicly about where they are in the whole process,” Cooper said.

NYSE has been evaluating Avalanche for its onchain plans

Intercontinental Exchange Head of Strategic Initiatives Michael Blaugrund appeared alongside Cooper at the Avalanche Summit, where the executives discussed ICE’s work on blockchain infrastructure and tokenized markets.

Blaugrund said ICE, which owns NYSE, has remained “very engaged” with the Avalanche team while evaluating potential blockchain networks.

“Avalanche checks a lot of those boxes for us,” he said.

NYSE has not publicly identified the blockchain or blockchains that will ultimately support its planned digital securities venue. Its proposed architecture is being designed to work with multiple blockchain networks for settlement and custody.

The exchange has been developing the project throughout 2026. In August, NYSE President Lynn Martin said the company was continuing to build onchain settlement infrastructure after the exchange first disclosed its digital trading platform plans in January.

The proposed venue combines NYSE’s Pillar matching engine with blockchain based post trade infrastructure. Subject to regulatory approvals, it is expected to support tokenized versions of existing securities alongside assets issued natively onchain.

Planned features include continuous trading, immediate settlement, fractional shares, dollar denominated orders and stablecoin based funding. Tokenized shareholders would retain conventional rights attached to the underlying securities, including dividends and governance rights.

NYSE’s plans do not mean its existing stock market will be moved entirely onto a blockchain. The company has described a separate digital venue that would operate through qualified broker dealers while connecting blockchain settlement with regulated U.S. market infrastructure.

ICE is building out its tokenized securities infrastructure

ICE has continued bringing outside infrastructure companies into the project while NYSE develops the trading and settlement system.

At the end of August, ICE agreed to invest in tZERO and license its blockchain patents as part of an arrangement covering infrastructure for the planned NYSE affiliated platform. Crypto.news previously reported that ICE tapped tZERO as a design partner for digital transfer agent and broker dealer systems.

Under the agreement, tZERO is expected to help develop infrastructure supporting the issuance, trading and onchain settlement of public securities. The companies did not disclose the size of ICE’s investment or provide a launch date for the platform.

The arrangement does not make tZERO the project’s exclusive infrastructure provider. NYSE had already signed a separate memorandum with Securitize in March, naming the company as its first digital transfer agent eligible to mint blockchain native securities for participating issuers.

ICE has left the underlying blockchain question open as those partnerships progress. The platform’s post trade architecture is intended to support several networks, leaving room for different blockchain systems to handle settlement and custody.

Avalanche has meanwhile been expanding its presence in regulated tokenization projects. In July, Japanese tokenization platform Progmat migrated its security tokens from Corda 5 to a dedicated Avalanche Layer 1.

Progmat said the migration covered every active security token project it managed, representing more than ¥452 billion in underlying assets and issued securities. The move gave the assets Ethereum Virtual Machine compatibility while allowing the platform to retain its existing issuance, ownership and transfer processes.

Institutional tokenization activity on Avalanche has continued outside Japan. Hanwha Investment & Securities reportedly completed a tokenized securities platform supporting Avalanche and Hyperledger Besu as South Korea prepares to bring blockchain based securities into its regulated capital markets framework in February 2027.

SEC exemption opens another route for tokenized stock trading

Regulatory conditions around tokenized equities changed this week after the U.S. Securities and Exchange Commission granted eligible venues conditional relief to trade tokenized U.S. stocks through permissioned automated market makers and liquidity pools.

The five year exemption applies to qualifying tokenized National Market System stocks under a set of conditions covering shareholder rights, smart contracts, trading limits and coordinated market halts.

Cooper pointed to the regulatory action while discussing how quickly onchain stock trading could develop. He expects some trading venues to begin offering 24 hour weekday access within the next year, though he stopped short of predicting that major exchanges would move on the same timetable.

“Will that be the mainstream exchanges? The largest in the world? The LSEs, the NYSEs, the CMEs? I don’t know about that,” Cooper said.

Smaller venues could move more quickly as they compete for liquidity, according to Cooper.

“There are a lot of smaller venues that are making a very compelling case to the world to put liquidity on them,” he said.

The Trump Administration should push for technical exchanges on how to actually test models for dangerous capabilities and behaviors that neither country wants to see released into the wild. These include AI systems capable of helping amateurs develop bioweapons, or evading human oversight and control. American AI companies have been studying these risks for years, and they have also begun to appear in Chinese technical standards related to safety testing. Exchanging best practices and new insights about how to test for and mitigate these risks could render the systems built in both countries meaningfully safer.

These proposed technical exchanges would not depend on “trust” or even strict “reciprocity” between the two superpowers, nor would they require identical conceptions of AI risk. They would be driven by self-interest. As the most advanced AI models grow even more powerful, both countries have an interest in ensuring that these systems remain controllable, regardless of where they are built or deployed. That will require both countries to improve their model testing, monitoring and safeguards, and share promising findings that could enhance safety without surrendering a competitive edge or undermining national security. 

A study published in 2016 examined the foot measurements of 68 women aged 20 to over 80. It found that the widths of the balls of the feet increased by 3 to 4 millimeters per decade, while ball circumferences increased by about 5 to 7 millimeters, high-step circumferences 0.4 to 4.8 millimeters, and heel instep circumferences up to 2 millimeters. 

“That may sound small, but these changes accumulate over several decades and can become enough to affect shoe fit,” Koury says. 

If your feet seem to be getting wider or longer and you’re experiencing pain, swelling, numbness, tingling, or difficulty walking or doing other activities, see your doctor, Koury says. Also, talk to your doctor if you’re getting recurrent calluses, blisters, or skin breakdown, or if your bunions, hammertoes, or flatfoot are worsening. Sudden foot changes, especially if they only affect one foot, should also get checked, Srinivas says. 

Morpho has opened lending markets for five Coinbase tokenized stocks on Base, with users pledging $104,401 in stock tokens and borrowing $54,652 in USDC against them so far.

According to Morpho, holders can now use the Coinbase issued assets as collateral and borrow USDC through variable rate markets or its Midnight fixed rate lending layer, giving eligible investors a way to access dollars without selling their tokenized stock positions.

Hyperliquid’s HYPE rose more than 11% to nearly $89 as of Asian morning hours Friday, the strongest move among the majors, according to CoinDesk data. Zcash’s ZEC added 8% to roughly $1,472 and Solana’s SOL 6% to just above $106.

BNB and DOGE each gained about 4%, with XRP, ether and bitcoin up 2%. TRX was the laggard at under 1%.

Bitcoin traded just below $78,000 after touching $75,972 during U.S. hours, recovering the whole of that overnight drop and marking a third consecutive day of gains. Total crypto market value rose 2% to roughly $2.66 trillion.

None of the 40 most liquid coins fell over the period, according to FxPro chief market analyst Alex Kuptsikevich, who said traders are “cautiously shifting their focus towards altcoins” even with the altcoin season index still subdued. NEAR led that group at 30%, followed by UNI at 26% and APT at 18%.

The move came with equities rising and a broader appetite for risk, a day after the Fed’s quarter-point hike landed without the reaction traditional markets had braced for.

Bitcoin faces the upper edge of its established trading range near $82,000. Kuptsikevich expects profit-taking into the weekend to delay any attempt at it.

Hacktron AI says it managed to hack OpenAI in less than 72 hours. The security research team revealed that it chained two separate vulnerabilities to gain access to ChatGPT and Codex accounts belonging to OpenAI employees. To prove the access was real, the researchers used an employee’s Codex account to open a harmless pull request in OpenAI’s internal monorepo rather than accessing sensitive code. The entire attack started with something that sounds relatively harmless: uploading an image.

Hacktron shared the details in a technical write-up on September 13, while also summarizing the exploit chain on X.

According to the researchers, the chain looked like this:

• HEIF upload → libheif heap overflow → remote code execution → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal repository

Key Takeaways

• Hacktron AI says it compromised OpenAI systems in less than 72 hours.
• The attack began with a HEIF image upload and a vulnerability in libheif.
• An OpenAI SSO flaw allegedly allowed the researchers to move from the compromised forum to employee ChatGPT and Codex accounts.
• A connected GitHub integration provided a path to demonstrate access to OpenAI’s internal repository.
• OpenAI says it fixed its side of the issue about 14 hours after the report and later paid Hacktron a $6,500 bounty.
• The research highlights how AI can accelerate vulnerability research and exploit development, although Hacktron says human guidance was still necessary.

The Hack Started With a Heif Image

Hacktron was looking at the image-upload system used by OpenAI’s community forum, which runs on Discourse. The researchers noticed that HEIC and HEIF images were processed differently from other image formats. Because Discourse’s usual image-checking tool did not support HEIF, those files were passed to ImageMagick for conversion.

That meant the uploaded files eventually reached libheif, an image-processing library responsible for handling the format. Hacktron then discovered a heap buffer overflow in the version of libheif used by the environment.

According to the team, some security fixes had not been backported to the Debian package. This left the library vulnerable to a memory corruption attack that could provide out-of-bounds read and write capabilities. In other words, a specially crafted image could become much more than just an image.

AI Helped Turn the Bug Into an Exploit

This is where the story gets particularly interesting. Hacktron says it used AI models to help investigate and exploit the vulnerability.

The researchers initially worked with Claude Opus 4.8, asking it to examine the installed libheif package for potential security problems. The model helped identify the relevant vulnerability, but getting a reliable exploit working proved difficult when ASLR was enabled.

Then Anthropic released Claude Opus 5. Hacktron says the new model was able to produce a working ARM64 exploit within about three hours. The researchers then had it adapt the exploit to the x86-64 environment and the jemalloc configuration used by Discourse.

By the morning of July 25, the team says it had confirmed remote code execution through an image upload. And that was only the beginning.

The Openai SSO Flaw Changed Everything

Getting code execution on the forum wasn’t enough to reach OpenAI employee accounts. Hacktron discovered that the forum supported “Sign in with OpenAI” through OpenAI’s authentication infrastructure at auth.openai.com. The researchers believed this SSO setup could provide a route from a compromised forum account into other OpenAI services.

According to Hacktron, they were able to confirm that assumption. The researchers said they took over an OpenAI employee’s ChatGPT and Codex accounts. That employee’s Codex account was connected to OpenAI’s GitHub organization.

Rather than digging through OpenAI’s internal source code, Hacktron used the compromised Codex account to create a pull request in OpenAI’s internal monorepo. The team described the pull request as a harmless proof of concept and stopped testing after demonstrating the access.

OpenAI Fixed the Issue Within Hours

Hacktron reported its findings to OpenAI through the Bugcrowd bug bounty program on July 25. According to the team’s timeline, OpenAI confirmed that its side of the issue had been fixed at around 22:49 UTC, roughly 14 hours after the initial report.

The researchers also reported the underlying Discourse vulnerability to Discourse through HackerOne. Discourse responded the next day and had a fix ready by July 27. The company also added sandboxing for ImageMagick as an additional security measure.

OpenAI later awarded Hacktron a $6,500 bounty for the OpenAI-side vulnerability. OpenAI clarified that testing against the Discourse-hosted community forum was outside the scope of its bug bounty program.

The Bigger Concern Is AI-Assisted Hacking

For Hacktron, this wasn’t just another vulnerability disclosure. The researchers say the experiment shows how AI is changing the amount of time and expertise required to turn vulnerabilities into working exploits.

Hacktron said the OpenAI and Discourse attack took a few days for an AI agent and only a few hours of human effort. Its broader HEIF Heist research reportedly involved three researchers and cost less than $3,000 in AI tokens.

The team is careful to point out that the process wasn’t completely autonomous. Human researchers still provided guidance and made important decisions during the operation. Still, the speed is notable. Hacktron argues that tasks that once required highly specialized security expertise and significant amounts of time can increasingly be accelerated by AI.

The incident also shows why vulnerabilities in seemingly ordinary software can have much wider consequences when that software is connected to authentication systems and other services.

North Korea linked hacking group WaterPlum has compromised more than 30,000 devices across over 100 countries and regions, stealing information from more than 7,000 cryptocurrency wallets while targeting developers through fake recruitment campaigns.

Japan’s National Police Agency said on Sept. 18 that its investigation, conducted with the National Cybersecurity Office, the FBI, the U.S. Department of Defense Cyber Crime Center and agencies in Australia and Germany, uncovered the group’s attack methods and links to North Korean IT workers.

Japanese and U.S. authorities assessed that WaterPlum, which is associated with the threat activity commonly known as Contagious Interview, and some North Korean IT workers operate under Bureau 313 of the Workers’ Party of Korea’s Munitions Industry Department.

Investigators found that more than 30,000 computers were likely infected between around December 2025 and July 2026. The victims were spread across more than 100 countries and regions, including Japan, with web designers, engineers and people working in crypto, blockchain and Web3 among the main targets.

More than 7,000 cryptocurrency wallet records were stolen during the infections, while wallets controlled by WaterPlum received at least 1.7 billion yen, equivalent to roughly $10.7 million based on the exchange rate used by Japanese authorities.

Japan’s Foreign Ministry separately confirmed that authorities from Japan, the United States, Australia and Germany had jointly disclosed WaterPlum’s tactics and the activities of North Korean IT workers involved in foreign currency generation and recruitment schemes.

WaterPlum used fake crypto jobs to spread malware

WaterPlum approached software developers and other IT workers through social media, online job sites, gig platforms and freelance marketplaces, according to the Japanese police report. The attackers posed as legitimate artificial intelligence, cryptocurrency and NFT companies or recruitment services before presenting candidates with apparently attractive job opportunities.

During technical interviews or coding tests, candidates were instructed to download malicious programs hosted on collaborative development platforms and code repositories. Some victims were told that the files were needed to diagnose problems with video conferencing software or complete a coding assignment.

The group placed malware including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle inside malicious NPM packages. Once a device was compromised, attackers could establish backdoors and use remote access tools to retain access and move through affected systems. Information stealing malware was then used to extract confidential data and cryptocurrency.

Stolen information included browser credentials, keystrokes, screenshots and clipboard data. Private keys and seed phrases for cryptocurrency wallets were among the targeted records, along with identity documents such as passports and driver’s licenses stored on affected computers or shared folders.

Security researchers have documented similar recruitment methods in the crypto industry. As crypto.news previously reported,North Korean linked developers had worked inside more than 40 DeFi projects over seven years, according to MetaMask developer and security researcher Taylor Monahan. Investigators described job postings, emails, LinkedIn messages, Zoom calls and interview processes as recurring routes used to approach targets.

North Korean IT workers used laptop farms in Japan

Japanese investigators said they dismantled the first known domestic “laptop farm” connected to North Korean IT workers in the country. Under the arrangement, a local facilitator kept computers at their residence while workers remotely controlled the machines from elsewhere.

Workers used identity documents supplied by people living in Japan to impersonate them while seeking contracts. In some cases, payments were directed into bank accounts controlled by facilitators, who then transferred the money onward. North Korean workers connected to the investigations sent cryptocurrency and other assets worth hundreds of millions of yen overseas, according to the agency.

Some workers operated from North Korea, while others were based in China or Russia, with smaller numbers located in Africa and Southeast Asia. Laptop farms and virtual private servers allowed them to disguise where the work was actually being performed while accepting jobs through domestic and overseas crowdsourcing services.

Comparable operations have been prosecuted in the United States. Two U.S. men received 18 month prison sentences in 2026 for helping North Korean workers remotely access company laptops, while the Justice Department said the schemes involved nearly 70 companies and generated more than $1.2 million. The sentences brought the number of laptop farm facilitators sentenced in the United States over a five month period to eight.

U.S. authorities have pursued the proceeds of the employment schemes through cryptocurrency forfeiture cases as well. A federal judge in September ordered the forfeiture of roughly $212,700 in USDC and USDT traced to payment addresses used by North Korean IT workers, part of a Justice Department effort involving more than $7.74 million in digital assets.

Prosecutors said the forfeited wallet had received around 158,123 USDC from at least 10 addresses used to pay workers and 54,574 USDT from at least four other payment addresses. Authorities alleged that workers concealed their identities and locations while taking overseas technology jobs before routing their earnings through cryptocurrency.

bitFlyer caught suspected North Korean applicant

Japan’s investigation identified a separate attempt by a suspected North Korean IT worker to secure an engineering position at cryptocurrency exchange bitFlyer in May 2025.

The applicant submitted a resume under another person’s identity directly through the exchange’s recruitment form and used Gmail as the contact address. Investigators said the person accessed the application system through VPN and proxy services including NETNUT Proxy, Astrill VPN and High Speed Rabbit Proxy.

During an online interview, the applicant claimed to be Malaysian and living in Finland. The resume listed extensive experience across programming languages, blockchain, cryptocurrency and cloud services, along with education at a European university and employment in several European and Asian cities.

The applicant could answer simple questions about the listed skills but gave abstract responses or avoided more detailed questions, according to the agency. Investigators noted repeated checks of another monitor during the interview, occasional voices in the background and interruptions to the video feed. The person resisted relocating to Japan and insisted on receiving salary in cryptocurrency. bitFlyer identified the suspicious behavior and did not hire the applicant, and no damage was reported.

A similar recruitment attempt had previously been detected at Kraken, where an applicant suspected of links to North Korea joined an interview using a name different from the one on the resume and appeared to receive real time assistance during the call. The exchange later connected the applicant’s email address with information previously flagged by industry partners.

Investigators tied WaterPlum activity to the same infrastructure

Japanese authorities found a technical connection between the WaterPlum attacks, the overseas worker operations and the attempted bitFlyer recruitment.

IP addresses used by WaterPlum attackers matched addresses used by North Korean IT workers to connect to laptop farms and crowdsourcing services, according to the National Police Agency. Investigators found that the suspected North Korean worker who applied for the bitFlyer engineering position had used matching infrastructure.

The National Police Agency and FBI assessed that Bureau 313 played a central role in both WaterPlum’s cyberattacks and some of the foreign currency earning operations carried out by North Korean IT workers.

Japanese authorities advised companies to verify applicants’ claimed locations, qualifications and contact information, particularly when candidates insist on remote work or cryptocurrency payments. Employers were urged to check technical skills during interviews and scrutinize cases where a candidate’s stated residence does not correspond with the location of the IP address used to submit an application.

Bitcoin’s longer-term price structure is starting to look more stable, with analyst Willy Woo pointing to a well-known technical setup that historically has aligned with major bear-market endings. Woo argues that Bitcoin’s latest monthly “Fisher Transform” signal marks a new phase of trend reversal—though he also cautions that clean bottoms are not guaranteed and some consolidation is still possible.

Writing in a Friday update on X, Woo highlighted that the Fisher Transform indicator produced a monthly bullish crossover in August—only the fourth time this has happened in Bitcoin’s history—suggesting the market may have already formed its next macro floor.

Key takeaways

• Willy Woo says Bitcoin’s Fisher Transform produced a monthly bullish crossover in August—only the fourth such event on record.
• Woo links prior monthly crossovers to bear-market bottoms, citing late 2022 as an example when the indicator reached about -3.83.
• A weekly bullish divergence in Fisher continues to develop, echoing the pattern seen during the final six months of Bitcoin’s 2022 bear market.
• Woo notes the signal tends to be more reliable near bear-market bottoms because speculative churn is typically lower than during bull phases.

Why the Fisher Transform matters for market timing

Woo used the Fisher Transform, a trend-strength indicator developed in 2002, to assess whether Bitcoin’s broader trajectory has shifted. The Fisher Transform works by smoothing price action into a form that is easier to interpret as trend conditions change.

The method applies a log-based transform to correct for the way raw price tends to linger near extreme values. In practice, the Fisher Transform is plotted as two lines: the Fisher line and a trigger line derived from it, delayed by one period. Both lines oscillate around a central zero line, with crossovers between the Fisher and trigger lines typically interpreted as a signal of regime change.

According to Woo, when these two trend lines cross upward on monthly time frames, the occurrence has repeatedly coincided with bear-market bottoms—events that historically precede larger macro uptrends.

August’s monthly crossover: “3 for 3” with a fourth added

In Woo’s read-through, the key development is the timing and frequency of Bitcoin’s monthly Fisher bullish crossover. He states that a sharp upward reversal—where the Fisher and trigger lines intersect—has matched bear-market bottoming phases on monthly charts, and that the latest August cross appears to extend this track record.

Woo specifically points to the crossover occurring during July at around -2.26 on the Fisher Transform scale, stating that it would represent the fourth recorded bullish monthly crossover if it plays out as history suggests. He also frames the pattern as “3 for 3 without fake out,” before adding the newest event as a potential extension rather than a one-off.

Importantly, Woo does not claim that the crossover automatically prevents additional volatility. He notes that even when the indicator turns, price can still consolidate and potentially test lower levels before a more durable macro advance takes hold. He compares this to other cycles where Fisher showed a bearish crossover during bull markets—followed later by a fresh bullish signal—implying that the macro signal can precede full directional confirmation.

Bear-market signals may be “cleaner” than bull-market ones

Woo’s reasoning goes beyond chart math. He argues that the reliability of the Fisher Transform’s reversal timing depends on market participants. In his view, long-term bull phases often include more speculative activity—traders reacting aggressively to short-term swings—creating choppier conditions and increasing the odds of “fake out” signals.

By contrast, in bear-market bottom zones, he says speculative participation is largely reduced. When buy pressure returns because value buyers step in, the price reversal becomes less noisy, which can make trend signals such as Fisher crossovers easier to interpret.

That distinction is central to how Woo frames the current setup: even if the indicator has turned, investors should still expect that a bottom can involve time-consuming stabilization rather than an immediate straight-line recovery.

Weekly bullish divergence mirrors 2022’s late-stage pattern

Alongside the monthly crossover, Woo also emphasized a bullish divergence developing on weekly time frames. In this setup, Fisher continues to form higher lows while Bitcoin’s price prints lower lows—an often-cited sign that downward momentum is weakening even as the market remains trapped in a drawdown.

Woo says Fisher hit a swing low near -2.85 at the end of December last year, when BTC/USD was around the $90,000 area. Since then, he reports that Fisher has produced a series of higher lows while price has not followed suit. The divergence matters because it suggests deterioration in selling pressure may be occurring underneath the surface.

Critically, Woo links this current divergence structure to what was seen during Bitcoin’s 2022 bear market. He notes that a similar Fisher bullish divergence appeared as the prior bear market moved into its final months—then proceeded to coincide with the eventual transition out of the downtrend.

What remains uncertain: July’s $57,000 area and buyer behavior

Even with the technical backdrop improving, Woo and other onchain-driven observations leave room for doubt. The article points to ongoing uncertainty about whether recent lows near $57,000 on July 1 truly marked a full cycle bottom. Earlier onchain analysis referenced in the coverage suggested that while some metrics have produced bear-market reversal signals, there may not yet be consistent confirmation from traditional “buyer interest” behavior.

Woo himself previously flagged a “lack of typical buyer interest” at those lows, arguing that accumulation appeared dominated by a smaller set of large-volume investors rather than broad-based demand. That matters for how traders interpret reversals: a market can bounce on limited buying, but more durable cycle transitions usually require sustained participation across the market.

For now, the key question is whether the monthly Fisher crossover will translate into a macro uptrend rather than only a temporary turn. Readers should watch whether Fisher continues to confirm on higher time frames and whether price action starts to align with the divergence signals on weekly charts—especially if Bitcoin tests deeper support before any sustained break higher.