🚨SlowMist TI Alert🚨 💸 $NEM Loss: ~$821,920 🔍 Root Cause: NemTokenV2 credited transfers into the LP pair as sell volume without verifying swap settlement. These credits remained valid after the transferred tokens were removed via skim(), allowing flushLpSellRecycle() to burn pre-existing LP reserves. The attacker repeated transfer→skim→flush 42 times, reducing the pair’s NEM balance and syncing the lower reserves, then sold the remaining NEM at the inflated price to extract USDT. 📌 Attacker: 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6 📌 Attack Contract: 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2 📌 Vulnerable Contract: 0x9cf0e3ad4efa7ab602d7b5a38c55795cfa777777 (NemTokenV2) 📌 Victim Pair: 0x840e19dcca541ee0b55a3c67e900a39d523b12b8 (PancakePair USDT/NEM) Powered by SlowMist.AI Tx: bscscan.com/tx/0xfb093c96c00…

🚨 SlowMist TI Alert 🚨 The Fearless Wallet browser extension is malicious, with a threat exposure period spanning nearly 20 months, from February 2025 to October 2026. Affected versions include 3.0.1 and 3.0.3–3.0.5, containing malicious code designed to steal wallet recovery phrases, private keys, and keystore files when users unlock their wallets. The stolen data is encrypted using an empty password and exfiltrated through HTTP GET requests to tonscanner.org. A remote configuration file allows attackers to enable or disable the malicious behavior. Users who have used the affected extension since February 2025 should consider their wallets compromised. Immediately create new wallets with fresh private keys, transfer remaining assets, review suspicious transactions, and remove the affected extension. Changing passwords or reinstalling the extension is insufficient. Malicious Chrome Extension ID: nhlnehondigmgckngjomcpcefcdplmgc You can also visit misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! hackmd.io/@gWEUMERvQZyR5MSts… enterprise.misteye.io/threat…

🚨 SlowMist TI Alert 🚨 LiteLLM has been compromised again in a supply chain attack. The malicious release [email protected] affects PyPI packages and Docker images, including floating tags such as latest and main-stable. The injected malware executes automatically during Python startup, stealing cloud credentials, AI API keys, SSH private keys, and other sensitive data. It also enables remote code execution. Affected releases have been removed or replaced. Users should avoid version 1.107.0, rebuild compromised environments from clean images, and rotate potentially exposed credentials. Pinning to 1.106.2 is recommended. You can also visit misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! enterprise.misteye.io/threat…

🚨SlowMist TI Alert🚨 💸 @slice__so Loss: ~$41k 🔍 Root Cause: FundsModule’s 0x9d2edfac trusted release amounts returned by caller-selected source contracts without verifying that the corresponding ETH or USDC was actually received. In this transaction, two selected contracts returned nonzero amounts while transferring no assets. With flag=true, the function used those unbacked amounts to calculate immediate withdrawals from pooled reserves to the transaction sender. 📌 Attacker: 0xc34572ebb26b9a4c54854aae8d2347108e8c892f 📌 Victim (FundsModule Proxy): 0x61bcd1ed11fc03c958a847a6687b1875f5eacaaf 📌 Vulnerable Implementation: 0x8db3b6f51b594dc87b87a3a3b844de9c0d8d60b5 Powered by #SlowMist.AI Tx: basescan.org/tx/0x02b039a634…

Four years ago, we built @MistTrack_io to make on-chain tracing and AML compliance analysis more accessible. Today, it’s trusted by 500+ institutions and 100,000+ users. Whether you’re investigating fund flows, building tools, or managing compliance, we’ve got options for every budget 🔎 ✅ Free tracing & wallet risk checks ✅ Premium from $229/month ✅ API from $20 for 100 calls across 19 chains Explore what we’ve built → misttrack.io

🚨 Recovering Private Keys from 6 Consecutive Observations: Qubic Wallet Vulnerability Analysis During our analysis of @_Qubic_ Wallet, we found that the wallet uses the same non-cryptographically secure Math.random() stream for account seed generation and dejaVu values exposed in network packet headers, potentially enabling private key recovery through network observations. 🔍 Root Cause A shared, non-cryptographically secure random stream → Account seed generation + Network-visible header values ⚠️ Hypothesized Attack Flow 1️⃣ Collect dejaVu values from bridge/peer traffic or the plaintext bridge-to-peer link. 2️⃣ Recover the 128-bit PRNG state using 6 consecutive observations. 3️⃣ Reconstruct the 55-character seed and verify it against the public key exposed in balance requests. 4️⃣ Recover the private key and forge a SchnorrQ signature to transfer assets. Our PoC validated the technical feasibility of this recovery chain. Actual exploitability depends on network trust boundaries, observation continuity, call alignment, and other consumers of Math.random(). 🛡️ Security Recommendations Use cryptographically secure randomness for key generation, conduct comprehensive external security audits before deployment, and review trust boundaries around random number sources and protocol header fields. Read the full analysis ⬇️ slowmist.medium.com/recoveri…

🚨SlowMist TI Alert🚨 💸 Loss: ~$59.8k 🔍 Root Cause: The affected Argent-style smart wallet system exposed two exploitable flaws. In the recovery module, the unrestricted 0x254a2e49 setter allowed a crafted recovery period to make the calculated deadline wrap to a timestamp in the past. This let a recovery backed by a valid guardian signature be finalized in the same transaction, changing the wallet owner. Separately, the execution module failed to reject reuse of an identical signed 0xaacaaf88 payload: it succeeded 19 times in one transaction and nine times in the other. The attacker used the repeated executions to trade around a low-liquidity MARK/WETH pool. 📌 Attacker: 0xc10609ce5c032db92e562e463b1234aab0872b02 📌 Victim: 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66; 0x5a79e5772493cf4329682d202aa2d28f85a85440 📌 Vulnerable Contract: 0xf490557d67d934440677a4f16793d5ef319b8ef5; 0x4e50adfc953551286bbd7fee2b2b846d1d227394 Powered by SlowMist.AI Tx: etherscan.io/tx/0xbfed8d3356… etherscan.io/tx/0xa0ee8f9142…

🚨 Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain Following the public release of #DarkSword-related exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, with the attack infrastructure observed operating online in late September. We traced the live attack infrastructure, linked its admin panels to public GitHub repositories, and analyzed the exploit code, payload library, delivery chain, and post-exploitation capabilities. 🔍 Key Findings: 🔹 A complete attack pipeline: The infrastructure integrates exploit delivery, device and data collection, data exfiltration, and crypto wallet fund consolidation. 🔹 Extensive data theft capabilities: The toolkit targets Keychain data, files, messages, and crypto wallet data, with additional capabilities for wallet data decryption and fund consolidation. 🔹 Broader claimed coverage, narrower functional coverage: Although the toolkit claims support for iOS 13 and later, code analysis identifies two functional exploit windows: iOS 18.6–18.7.2 and iOS 26.0–26.1. Many other version entries remain incomplete or unverified. 🔹 Public code weaponized: Publicly available exploit components have been integrated into a deployable attack framework, lowering the barrier to launching sophisticated #iOS attacks. 🛡️ Recommendations Keep iOS updated and avoid untrusted links. Simply opening a malicious page in #Safari may trigger exploitation. If a device has visited a suspicious landing page, treat its seed phrases and private keys as potentially compromised. Use a device that has never accessed the page to create a new wallet and transfer your assets. Also check for abnormal transactions and token approvals across chains, and revoke unnecessary approvals. 🔗 Read the full analysis: slowmist.medium.com/threat-i…

🚨 SlowMist TI Alert 🚨 A fake "Ledger firmware update" campaign is exploiting the recent @Ledger supply chain incident. Looks very real: fake “Genuine check” page, device selection, “Update Now” button. Never click website links to update. Never enter your recovery phrase anywhere. ❌ Stay vigilant! 🔐 #phishing

🚨SlowMist TI Alert🚨 💸 @UNCX_token Loss: ~$86k 🔍 Root Cause: VestingManager.cancel(uint256) did not ensure a schedule’s retained shares covered shares already released. After transferring tokens directly to the manager to lower its shares-per-token conversion rate, the sender topped up and canceled schedules whose original shares had been fully released. The cancellations over-reduced global shares, allowing another sender-controlled schedule to claim excess tokens from the shared pool. 📌 Attacker: 0x78c9b11853e4f183a34c63ffd1924d2319a2f5b3 📌 Vulnerable Contract: 0xa98f06312b7614523d0f5e725e15fd20fb1b99f5 Powered by SlowMist.AI Tx: etherscan.io/tx/0x352065378c…

🚨SlowMist TI Alert🚨 💸 @ethervista Loss: ~18.6K 🔍 Root Cause: The EtherVistaPair.swap() function suffers from an integer overflow in its K-invariant check. Since both reserves are uint112, their multiplication overflows and wraps around, allowing the invariant check to pass even when the actual reserve product decreases significantly. The attacker exploited this flaw through an attacker-controlled contract registered as the authorized router, executing two crafted swaps to drain WETH and VISTA from the pool. 📌 Attacker: 0xbbf8f3fe8e4fdf6b594e6107144d78293d2018fa 📌 Attack Contract (Router): 0x469424b628a9d2036e41496e814db500d683b120 📌 Vulnerable Contract: 0xfdd05552f1377aa488afed744c8024358af02041 Powered by SlowMist.AI Tx: etherscan.io/tx/0xb2c7332d9e…

🚨SlowMist TI Alert🚨 💸 @BitBayofficial Loss: ~$14K 🔍 Root Cause: The Vault's `_withdraw()` function transfers its entire token balance when `liquidity == 0`, without limiting the payout to the user's proportional share. The attacker exploited this flaw by triggering a zero-liquidity state via `reposition()`, then redeeming just 1 minimal share unit to drain approximately 14,838.47 DAI. 📌 Attacker: 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B 📌 Victim: 0x048E88311ca84876aeA086125825492e2AF2e5A0 📌 Vulnerable Contract: 0x048E88311ca84876aeA086125825492e2AF2e5A0 Powered by SlowMist.AI Tx: polygonscan.com/tx/0x5b795dc…

🔍 In a recent investigation, SlowMist analyzed a malicious bookmark #phishing attack targeting @fomo users and uncovered a fake “human verification” page designed to execute malicious JavaScript in the context of a logged-in Fomo page. Victims were instructed to identify an icon, drag it to the browser bookmarks bar, and click the bookmark three times. The malicious bookmarklet then collected Privy access/refresh tokens, browser storage, IndexedDB data, and wallet-related information, while also containing logic related to MFA/TOTP. 🕵️ Using @MistTrack_io , we traced the stolen funds and found a complex flow involving repeated USDC/SOL swaps, multi-address splitting, cross-chain transfers, and deposits to Privacy Cash and gambling platforms. 🛡️ Security tip: Legitimate human verification should not require dragging an icon to the bookmarks bar and clicking it on a wallet or trading page. Stop immediately if you encounter such a request. Regularly check your bookmarks, enable MFA, and revoke abnormal sessions from a trusted device if you have executed a suspicious bookmark. 📖 Read the full analysis: slowmist.medium.com/threat-i…

🚨SlowMist TI Alert🚨 💸 @X7_Finance Loss: ~6.78 ETH 🔍 Root Cause: In `claimRewards()`, `totalRewards` is incremented by `(address(this).balance - lastETHBalance)` on every call, but `lastETHBalance` is only updated when `claimable > 0`. Calling with an empty array leaves `claimable` at 0, so the same unaccounted balance is repeatedly added to `totalRewards`, inflating the per-token reward. The attacker also donated ETH to amplify the delta before draining funds. 📌 Attacker: 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2 📌 Victim: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7 📌 Vulnerable Contract: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7 (X7Pioneer) Powered by SlowMist.AI Tx: etherscan.io/tx/0xc98056d6ab…

🚨 SlowMist TI Alert: Beware of bookmark-based phishing attacks targeting the @fomo web interface 🚨 The phishing page tricks users into completing a fake CAPTCHA, then instructs them to drag malicious JavaScript code into the browser’s bookmarks. After just 2–3 clicks on the malicious bookmark, attackers can hijack a previously logged-in FOMO account and immediately steal its crypto assets. This is not a new technique. It’s an old exploitation method previously. Stay alert, and watch for our upcoming analysis.

🚨SlowMist TI Alert🚨 💸 @SetProtocol Loss: ~5.08 ETH 🔍 Root Cause: actualizeFee() recalculated unitShares with upward rounding even though no fee was minted, raising it from 4,927 to 4,928. The attacker issued before the update and redeemed the same quantity afterward, extracting collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit. 📌 Attacker (EOA): 0x506440728d84eb22809dc9464bc8189618a1c5b6 📌 Attack Contract: 0x016feaaa25ab8325e233bc8a2c25055bee0b2f6e 📌 Victim (Set Protocol Vault): 0x5b67871c3a857de81a1ca0f9f7945e5670d986dc 📌 Vulnerable Contract: 0x54e8371c1ec43e58fb53d4ef4ed463c17ba8a6be Powered by SlowMist.AI Tx: etherscan.io/tx/0xaca5f83ff3…