According to Odaily Planet Daily, Microsoft's Threat Intelligence Team has officially announced a Windows crypto-Trojan threat that has been active since February 2026. This malware combines "worm-like propagation + clipboard hijacking + Tor anonymous communication" to attack users of digital assets. Microsoft analysis indicates that the malware spreads between removable storage devices through disguised shortcut (.lnk) files and utilizes WScript and ActiveX to execute script logic, automatically deploying a local Tor client and connecting via a proxy at 127.0.0.1:9050. Onion hides a C2 server, enabling anonymous control and data backhaul. The attack chain includes multiple malicious capabilities: continuous monitoring of clipboard content, stealing mnemonic phrases and private keys, uploading screenshots, and "address replacement" when the user copies a cryptocurrency address, replacing the target address with a wallet address controlled by the attacker, thereby hijacking funds. Furthermore, this Trojan possesses worm-like propagation capabilities, automatically replicating itself on devices such as USB drives and creating scheduled tasks for persistent execution. It also has basic anti-analysis capabilities (detecting Task Manager to evade debugging). At the detection level, Microsoft has identified it as part of the Trojan:Win32/CryptoBandits family and is intercepting it based on behavioral characteristics (such as abnormal WScript calls, proxy traffic at localhost:9050, and PowerShell screenshot behavior). Security researchers recommend focusing on protecting the script execution path and monitoring abnormal local proxy traffic.

Odaily Planet Daily reports that Trent Van Epps, a former Ethereum Foundation member and Ethereum core developer, published a lengthy article analyzing the evolution of Ethereum's institutional structure and exploring its future political and economic path and the issue of "institutional succession." He points out that Ethereum is currently entering a critical institutional turning point, including the allocation of legitimacy, the evolution of governance structure, and a potential protocol funding crisis. The Ethereum Foundation has long adhered to a "subtraction" philosophy, reducing its centralized influence within the ecosystem and allowing more value to be generated externally. However, while reducing power concentration, this strategy has also led to unclear "legality boundaries," making it difficult for the ecosystem to naturally generate alternative institutional centers. In terms of funding, Ethereum is approaching a potential "structural funding gap," including the end of the Protocol Incentive Program (CIP) in 2026 and the foundation's ETH reserves entering a contraction cycle, potentially leading to long-term pressure on core development funding to drop to around $30 million. Without a sustainable funding mechanism, the core development team and infrastructure capabilities may face the risk of being lost, affecting the network's long-term reliability and potentially creating an "unfunded protocol burden." After fulfilling its early historical mission, the Ethereum Foundation is shifting its role from a "single dominant body" to a "systemic transition node." The key issue for the next stage of the ecosystem will be how to smoothly transition from the existing body to the new governance structure.

Odaily Planet Daily reports that a total of $2.13 billion worth of BTC and ETH options expired today. 31,000 BTC options expired with a put-call ratio of 0.78, a maximum price threshold of $65,000, and a notional value of $1.9 billion. 138,000 ETH options expired with a put-call ratio of 1.03, a maximum price threshold of $1,725, and a notional value of $230 million. Looking at the main options data, 6.5% of options expired this week, lower than last week and roughly at the recent average. Strategy's sale of Bitcoin and the discount have significantly damaged market confidence, making it more difficult for funds to flow back, and overall market sentiment is cold. (Greeks.live)

Odaily Planet Daily reports that Michael Saylor, founder and CEO of Bitcoin treasury company Strategy, stated in an article that while the US stock market is closed today and volatility is unavoidable, Bitcoin continues to operate. Saylor reiterated his consistent long-term Bitcoin perspective, emphasizing that Bitcoin maintains its 24/7 operational capability regardless of market conditions, contrasting it with the "market closure mechanism" of traditional financial markets.

Odaily Planet Daily reports that fintech startup Karta has announced the completion of a $15 million Series A funding round, led by Galaxy Ventures, with participation from Illuminate, Canary, and Clocktower Ventures. The company also secured a $125 million debt financing line from CIM Group. Karta provides US credit card services "without SSN or ITIN" for overseas clients holding assets in US banks or brokerages, allowing users to complete all post-card opening procedures via WhatsApp. It has already partnered with approximately 85 private banks and wealth management institutions. (Fortune)