The week in the XDRIP Universe: 29 October – 4 November

A week of signing and finality lessons on Central, backup guidance on xdrip.io, open firmware on Xdripia Waves and two new Seventh Amulet Dev Logs from Arcadian Pixels.

Security#

Binance hot wallet swept via EIP-7702 delegation On 29 October an EIP-7702 delegation let an attacker sweep a Binance hot wallet. We set out what we verified on-chain, what is still open, and why the lesson is about signing rather than leaked keys. https://xdripcentral.com/blog/binance-hot-wallet-eip-7702-delegation-sweep

THORChain halts after a one-block Ethereum reorg A one-block reorg on 31 October led THORChain to pay out 10 ETH it never received. The post covers the on-chain picture, the open questions and what it says about finality. https://xdripcentral.com/blog/thorchain-halts-after-eth-reorg-double-payout

Mercado Bitcoin drained across 10+ chains Mercado Bitcoin wallets on more than ten chains were drained on 2 November. Public estimates range from $38M to $49M, with about $11M frozen. We separate what we verified on-chain from what remains open. https://xdripcentral.com/blog/mercado-bitcoin-drained-across-10-chains

BTCPay Server hot wallets on outdated versions Hot wallets on BTCPay Server 2.4.1 and earlier were swept from 1 November. The post explains why updating alone is not enough, what we saw on-chain and what is still unknown. https://xdripcentral.com/blog/btcpay-server-hot-wallets-outdated-versions

Products / sites#

xdrip.io: Signed, not stolen The Binance drain via EIP-7702 authorizations, with no key leak reported, and Electrum users tricked into signing. Both point to the same weak spot: what you approve, not where the key lives. https://xdrip.io/blog/signed-not-stolen-binance-electrum-signing

xdrip.io: LLMjacking — your AI key is a wallet Google found stolen AI keys running up $100,000 a day in model charges. The article looks at how those keys leak and the controls that cap the damage. https://xdrip.io/blog/llmjacking-your-ai-key-is-a-wallet

xdrip.io: Backup is the weak point A Trezor reseller warning, 128-character passphrases and Liana encrypted backups: what this week teaches about protecting recovery phrases. The short version: a new device with the old words is the same wallet. https://xdrip.io/blog/backup-weak-point-seeds-passphrases-supply-chain

XDRIP Academy: every year ends with a practical Each Academy year ends with a practical you have to pass, such as restoring a wallet from backup after a wipe. Orientation and Year One are free to read without an account, and a short placement check tells you where to start. https://x.com/xdrip/status/2118018697008722043

Creative#

Xdripia Waves: open firmware Behringer posts Kick firmware, Akai opens the MPC Sample to custom builds and Polyend publishes Tracker source. The post looks at what open firmware means for owners. https://xdripiawaves.com/blog/synth-waves-november-2026-open-firmware

Xdripia Waves: code layers on the canvas Figma ships code layers and shaders, Wix Studio Two exports React, Affinity reaches iPad with Linux next, and Relume locks image styles for brand work. https://xdripiawaves.com/blog/graphics-november-2026-code-layers-on-the-canvas

Xdripia Waves: Suno MCP and paid fan remixes Suno MCP now runs inside AI assistants, Spotify reportedly targets Q1 2027 for paid fan remixes, and a Suno-voiced song climbs into Melon's top three. https://xdripiawaves.com/blog/ai-music-november-2026-suno-mcp-spotify-remix-price

Xdripia Waves: new polysynths Behringer's Polyeight goes on preorder, Arturia ships the MiniFreak 49, and Waldorf and UDO add compact polysynths. A round-up of what each offers before year-end. https://xdripiawaves.com/blog/synth-waves-november-2026-new-polysynths

Xdripia Waves: attribution and output rights Sonilo adds attribution reports, MUVO dates its commercial-use rights, and the AFM wants AI terms for session musicians before label talks resume. https://xdripiawaves.com/blog/ai-music-october-2026-attribution-output-rights-union

Arcadian Pixels: Verdalia's world assets land in Unreal Engine 5.8 The first large batch of Verdalia world assets — art-reviewed props, furnishings and textures — is now in UE 5.8. It is the foundation for levels, lighting and gameplay in The Seventh Amulet. https://arcadianpixels.com/dev-log/seventh-amulet-dev-log-verdalias-world-assets-land-in-unreal-engine-5-8

Arcadian Pixels: Brad takes shape Brad gets a new cape and outfit, with cloth and hair tested under Lumen, plus ragdoll and impact tests and a new shield and gadget in UE 5.8. The Dev Log also shows a first pass on a new ruins area. https://arcadianpixels.com/dev-log/seventh-amulet-dev-log-brad-takes-shape-physical-movement-new-ruins-area

Arcadian Pixels: Evercade Nexus screen math Evercade Nexus launched at $199.99 with an 840x512 screen. Notes on specs, early review findings, integer scaling across Evercade handhelds and the indie cart route. https://arcadianpixels.com/dev-log/evercade-nexus-screen-math-indie-notes-for-pixel-teams

Tales of Xdripia: Brad of Verdalia, the Commander's equipment The Library introduces Brad of Verdalia, hero of Tales of Xdripia: The Seventh Amulet, and his equipment: coat, Sword of Sereveldra, Oak Shield and Pendant. https://library.talesofxdripia.com/blog/brad-of-verdalia-the-commanders-equipment

Social highlights#

• Meet Brad of Verdalia, hero of The Seventh Amulet — https://x.com/talesofxdripia/status/2117977770886086869
• Seventh Amulet Dev Log: Verdalia's world assets land in UE 5.8 — https://x.com/talesofxdripia/status/2117975773680205833
• Seventh Amulet Dev Log: Brad takes shape — https://x.com/talesofxdripia/status/2117975769464938832
• XDRIP Academy: every year ends with a practical, not a video — https://x.com/xdrip/status/2118018697008722043

All of these are collected on https://xdripcentral.com/socials