与「SlowMist」相关的搜索结果

每个月给 ChatGPT / Claude / Codex 续费，最烦的就是支付这一步：没有海外卡，找代充又贵又怕跑路。 说下我最近在用的解决方案 @BenPayGlobal 👇 先交代背景，这也是我敢用的前提： BenPay 是币信（Bixin）集团孵化的项目——币信是 2014 年就成立的老牌加密机构，官网可查，合约有慢雾（SlowMist）公开审计报告，不是来路不明的小作坊。 💳 我自己用的是 Delta 卡，专门付 AI 订阅： ✅ 免身份认证，几分钟开卡，限时 0 开卡费 ✅ 有专属 AI 绑定地址，绑一次之后每月自动续费，省心 ✅ 10U 起充，充进去的就是自己的消费金 ✅ 押金 20U，性质类似共享单车押金：正常用就一直在那不动，注销时官方原路退回 也如实说一些缺陷：卡里的钱只能消费不能提现；有 1U/月的月费；每笔消费 $0.35+1%——所以它适合 20U+ 的订阅场景，别拿来买咖啡。 💪 如果你要的是一张日常主力卡 → Alpha 卡： ✅ 身份证 / 护照就能认证，对国内用户很友好 ✅ 0 充值费，长期用成本最低 ✅ 余额支持提现，资金能进能出 ✅ Apple Pay / 支付宝 都能绑，国内外消费通吃 押金 100U，同样注销可退。 顺带安利他们家自带的中转站 BenPay AI：一个 API Key 就能调 GPT、Claude、Gemini、DeepSeek、千问、Kimi 这些主流模型，稳定币充值、按量计费，做 AI 应用的朋友可以看看。 🎁 官方活动（以官方页面实时规则为准）： • 新用户开卡 + 消费满 50U，返 2U • 填 BenPay AI 问卷，有机会拿 3U 👉 开卡入口：

🚨 Recently, @COLDCARDwallet suffered a major private key vulnerability. Multiple waves of attacks resulted in at least 1,719 BTC (~$111M) in losses, involving over 5,200 addresses. Using Mk3 firmware 4.1.9 as an example, the SlowMist Security Team fully reproduced the attack chain and uncovered the truth behind the theft of thousands of bitcoins. 🧩 Attack flow: 1️⃣ After power-on, the remaining unpredictable state is reduced primarily to a single enumerable 32-bit pad (UID ^ SysTick), with the remaining state values either fixed or coming from very small enumerable spaces. 2️⃣ Attackers precisely model the three typical button-press consumption profiles (retail first-boot, empty-NVRAM, paper wallet) that advance the PRNG before seed generation. 3️⃣ From the weak random_bytes(32), the full deterministic pipeline (SHA-256 → BIP-39 → PBKDF2-HMAC-SHA512 → BIP-32 → address derivation) is reproduced offline. 4️⃣ GPU clusters brute-force the candidate pad space and button-count variations, then match the derived addresses against the global set of single-signature P2WPKH addresses to identify vulnerable wallets and sweep their funds. ⚙️ Root Cause: A build configuration error set MICROPY_HW_ENABLE_RNG to 0, disabling the STM32 hardware TRNG. The random number generation path silently fell back to the non-cryptographic Yasmarang software PRNG, whose state was almost entirely predictable, reducing effective entropy to ~40 bits (Mk2/Mk3) or ~72 bits (Mk4/Mk5/Q). 🔒 SlowMist Insight: Affected users should immediately upgrade to the patched firmware, generate a completely new seed, transfer a small amount of funds as a test, confirm the new address works correctly, then migrate all remaining funds. Full analysis 👉

In H1 2026, we blocked 10M+ risky site visits and flagged 4M high-risk signatures. Our Web3 Security Report with @SlowMist_Team and @osec_io shows how threats are evolving, and how protection starts before you sign. Read it here:

🚨 SlowMist TI Alert 🚨 💸 @VerusCoin Loss: ~$7.5M ⚠️ Unlike the prior 0x6990…b321 exploit, which decoupled the validated proof from the executed transfer payload, this attack hash-bound the transfers to the CCE but failed to validate the CCE’s economic backing; both exploit flawed cross-chain import validation. 🔍 Root Cause: `VerusProof.checkExportAndTransfers` verified selected CCE fields—including `hashReserveTransfers` against attacker-supplied serialized transfers and the source/destination IDs—but did not enforce the CCE’s accounting semantics. It failed to parse or validate `totalamounts`, `totalfees`, `totalburned`, CTxOut `nValue`, or whether the prior CCE outpoint carried sufficient value and assets to cover the claimed transfers. As a result, a matching transfer hash was incorrectly treated as authorization to release bridge assets, rather than merely a commitment to the requested transfers. 📌 Attacker EOA: 0xbda71b58cec0b1c20a8f87ccd52fa0679747855c 📌 Victim Bridge: 0x71518580f36feceffe0721f06ba4703218cd7f63 📌 Vulnerable Contract: 0x54e03a1682fd0bb065b669f6296f97028dcfd4ce 📌 Fund Receiver: 0xcfd0a20703cd11e0b9f665e1c3f1ef989c142d54 Impact: The attacker submitted a successor CCE anchored to an accepted Verus state root, containing a hash commitment to eight attacker-defined reserve transfers. Because the bridge did not verify whether the CCE’s economic fields backed those transfers, it executed eight payouts from bridge custody to the attacker-controlled receiver—releasing ETH, DAI, USDC, USDT, and four additional tokens without enforced cross-chain asset backing. Powered by Tx:

🚨 Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension Following @Will42W’s warning about TRAE IDE extension supply chain risks, SlowMist investigated the malicious extension juannegro.solidity. Although removed from Open VSX, the extension was still available through the TRAE marketplace as of July 18, 2026. It impersonated a legitimate Solidity plugin and acted as a cross-platform malware dropper. Our analysis found that it: 🔹 Impersonates a legitimate Solidity extension and uses the marketplace as the initial malware delivery channel 🔹 Automatically executes after IDE startup and establishes persistence across platforms 🔹 Uses an Ethereum smart contract to store and retrieve dynamic C2 configurations 🔹 Allows attackers to update C2 endpoints and payload delivery without republishing the extension This incident highlights how extension marketplaces can become initial infection vectors, while blockchain infrastructure can be abused for dynamic C2 management. Users who installed juannegro.solidity should remove the extension and check their systems for potential compromise. Full analysis👇

强烈呼吁所有人不要使用 Trae 这个 IDE，要坚决抵制，这就是个毒窝。 所有的 Open VSX 上发布的插件都会被它第一时间同步到市场上，但是明确有安全隐患、木马并且被拉黑和下架的插件，它却不会同步下架和拉黑。这种漠视安全的行为，简直令人发指！ 这根本不是疏忽的问题，这是企业价值观的问题。 @SlowMist_Team @VisualStudio @OpenAI @claudeai @SolvProtocol

🚨SlowMist TI Alert🚨 💸 @Lumi_Finance Loss: ~ $264k 🔍 Root Cause: A vulnerability in Lumi smart accounts allowed token approvals to be performed as a side effect during UserOperation validation. Due to improper validation logic, an attacker-controlled paymaster could trigger approval operations during the validation phase and obtain ERC20 allowances from multiple smart accounts without explicit user intent. 📌 Attacker: 0xce1a3bb0b98d0d90c7dd0620ab86c9a771888d88 📌 Victim: Multiple Lumi smart accounts affected by unintended token approvals during UserOp validation 📌 Malicious contract: 0x56362412ae17cac443aafbab4289946ad958e8a1 The attacker abused a flaw in Lumi smart account UserOperation validation logic to obtain token allowances from multiple wallets through validation-time side effects. The attacker then used the malicious sweeping contract to batch drain approved ERC20 tokens, swapped the stolen assets into ETH, and transferred the proceeds to the attacker-controlled address. Powered by #SlowMist#.AI Tx:

Every stolen transaction tells a story—but following that story across multiple wallets, chains, bridges, and mixers isn't easy. That's why we built TrackAgent, SlowMist's AI-powered On-Chain Intelligence Agent, now integrated into our Free Stolen Asset Assessment Service.🚀 Instead of simply retrieving blockchain data, TrackAgent continuously traces stolen funds, reconstructs complex fund flows, correlates attacker addresses, and combines on-chain intelligence with security threat intelligence to support real-world investigations. 🔍 Key capabilities: 🌐 Supports 31 blockchains 🌉 Cross-chain & laundering path analysis 🔗 Multi-address correlation 🛡️ Threat intelligence-powered investigation 📊 Over 12,000+ stolen asset cases have been submitted to SlowMist over the past four years. By bringing AI into our investigation workflow, we're making preliminary analysis faster while enabling our analysts to focus on the cases that need deeper investigation. 🤝 We're excited to bring AI-powered on-chain investigation to more victims and the broader Web3 community. ❓Need help after a crypto theft? Submit your case through our Free Stolen Asset Assessment Service to receive a TrackAgent-powered on-chain assessment and support from the SlowMist security team. 👉 📖 Read more：