🚨SlowMist TI Alert🚨 💸 @WAX_io Loss: ~$90.5K 🔍 Root Cause: WAX’s eth.token::withdraw failed to enforce max_fee ≥ 0 before debiting quantity + max_fee. Setting max_fee = -quantity reduced the debit to zero while preserving the full withdrawal amount. With the configured fee at zero, the fee check was skipped. On-chain records confirm that these requests generated bridge withdrawal logs and corresponding payouts on Solana and Ethereum. 📌 Attacker: WAX: fasdfas.al; Solana: 4H1piNZ8LsYhZGYhkbJDbPDSghxRj3HWxJqVz5dve8Q7; Ethereum: 0x01664E199991b2F3fe412c2DE5B9b7A0dcDc5070 📌 Victim: WAX Multi-Chain Bridge — Solana: 8cqv3kRg1ivwPNrGGrvJANXb6RPik6XEhnBzs18tPcKC; Ethereum: 0x24b22B031Ae1B5a6b09F9a0FD33613a40e0d70e6 📌 Vulnerable Contract: eth.token on WAX Powered by SlowMist.AI

🚨 SlowMist TI Alert 🚨 The Fearless Wallet browser extension is malicious, with a threat exposure period spanning nearly 20 months, from February 2025 to October 2026. Affected versions include 3.0.1 and 3.0.3–3.0.5, containing malicious code designed to steal wallet recovery phrases, private keys, and keystore files when users unlock their wallets. The stolen data is encrypted using an empty password and exfiltrated through HTTP GET requests to tonscanner.org. A remote configuration file allows attackers to enable or disable the malicious behavior. Users who have used the affected extension since February 2025 should consider their wallets compromised. Immediately create new wallets with fresh private keys, transfer remaining assets, review suspicious transactions, and remove the affected extension. Changing passwords or reinstalling the extension is insufficient. Malicious Chrome Extension ID: nhlnehondigmgckngjomcpcefcdplmgc You can also visit misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! hackmd.io/@gWEUMERvQZyR5MSts… enterprise.misteye.io/threat…

🚨SlowMist TI Alert🚨 💸 @slice__so Loss: ~$41k 🔍 Root Cause: FundsModule’s 0x9d2edfac trusted release amounts returned by caller-selected source contracts without verifying that the corresponding ETH or USDC was actually received. In this transaction, two selected contracts returned nonzero amounts while transferring no assets. With flag=true, the function used those unbacked amounts to calculate immediate withdrawals from pooled reserves to the transaction sender. 📌 Attacker: 0xc34572ebb26b9a4c54854aae8d2347108e8c892f 📌 Victim (FundsModule Proxy): 0x61bcd1ed11fc03c958a847a6687b1875f5eacaaf 📌 Vulnerable Implementation: 0x8db3b6f51b594dc87b87a3a3b844de9c0d8d60b5 Powered by #SlowMist.AI Tx: basescan.org/tx/0x02b039a634…

🚨 Recovering Private Keys from 6 Consecutive Observations: Qubic Wallet Vulnerability Analysis During our analysis of @_Qubic_ Wallet, we found that the wallet uses the same non-cryptographically secure Math.random() stream for account seed generation and dejaVu values exposed in network packet headers, potentially enabling private key recovery through network observations. 🔍 Root Cause A shared, non-cryptographically secure random stream → Account seed generation + Network-visible header values ⚠️ Hypothesized Attack Flow 1️⃣ Collect dejaVu values from bridge/peer traffic or the plaintext bridge-to-peer link. 2️⃣ Recover the 128-bit PRNG state using 6 consecutive observations. 3️⃣ Reconstruct the 55-character seed and verify it against the public key exposed in balance requests. 4️⃣ Recover the private key and forge a SchnorrQ signature to transfer assets. Our PoC validated the technical feasibility of this recovery chain. Actual exploitability depends on network trust boundaries, observation continuity, call alignment, and other consumers of Math.random(). 🛡️ Security Recommendations Use cryptographically secure randomness for key generation, conduct comprehensive external security audits before deployment, and review trust boundaries around random number sources and protocol header fields. Read the full analysis ⬇️ slowmist.medium.com/recoveri…

🚨 Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain Following the public release of #DarkSword-related exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, with the attack infrastructure observed operating online in late September. We traced the live attack infrastructure, linked its admin panels to public GitHub repositories, and analyzed the exploit code, payload library, delivery chain, and post-exploitation capabilities. 🔍 Key Findings: 🔹 A complete attack pipeline: The infrastructure integrates exploit delivery, device and data collection, data exfiltration, and crypto wallet fund consolidation. 🔹 Extensive data theft capabilities: The toolkit targets Keychain data, files, messages, and crypto wallet data, with additional capabilities for wallet data decryption and fund consolidation. 🔹 Broader claimed coverage, narrower functional coverage: Although the toolkit claims support for iOS 13 and later, code analysis identifies two functional exploit windows: iOS 18.6–18.7.2 and iOS 26.0–26.1. Many other version entries remain incomplete or unverified. 🔹 Public code weaponized: Publicly available exploit components have been integrated into a deployable attack framework, lowering the barrier to launching sophisticated #iOS attacks. 🛡️ Recommendations Keep iOS updated and avoid untrusted links. Simply opening a malicious page in #Safari may trigger exploitation. If a device has visited a suspicious landing page, treat its seed phrases and private keys as potentially compromised. Use a device that has never accessed the page to create a new wallet and transfer your assets. Also check for abnormal transactions and token approvals across chains, and revoke unnecessary approvals. 🔗 Read the full analysis: slowmist.medium.com/threat-i…

🚨SlowMist TI Alert🚨 💸 Loss: ~$59.8k 🔍 Root Cause: The affected Argent-style smart wallet system exposed two exploitable flaws. In the recovery module, the unrestricted 0x254a2e49 setter allowed a crafted recovery period to make the calculated deadline wrap to a timestamp in the past. This let a recovery backed by a valid guardian signature be finalized in the same transaction, changing the wallet owner. Separately, the execution module failed to reject reuse of an identical signed 0xaacaaf88 payload: it succeeded 19 times in one transaction and nine times in the other. The attacker used the repeated executions to trade around a low-liquidity MARK/WETH pool. 📌 Attacker: 0xc10609ce5c032db92e562e463b1234aab0872b02 📌 Victim: 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66; 0x5a79e5772493cf4329682d202aa2d28f85a85440 📌 Vulnerable Contract: 0xf490557d67d934440677a4f16793d5ef319b8ef5; 0x4e50adfc953551286bbd7fee2b2b846d1d227394 Powered by SlowMist.AI Tx: etherscan.io/tx/0xbfed8d3356… etherscan.io/tx/0xa0ee8f9142…

🚨 SlowMist TI Alert 🚨 A fake "Ledger firmware update" campaign is exploiting the recent @Ledger supply chain incident. Looks very real: fake “Genuine check” page, device selection, “Update Now” button. Never click website links to update. Never enter your recovery phrase anywhere. ❌ Stay vigilant! 🔐 #phishing