SlowMist (@SlowMist_Team)

🚨 Recently, @COLDCARDwallet suffered a major private key vulnerability. Multiple waves of attacks resulted in at least 1,719 BTC (~$111M) in losses, involving over 5,200 addresses. Using Mk3 firmware 4.1.9 as an example, the SlowMist Security Team fully reproduced the attack chain and uncovered the truth behind the theft of thousands of bitcoins. 🧩 Attack flow: 1️⃣ After power-on, the remaining unpredictable state is reduced primarily to a single enumerable 32-bit pad (UID ^ SysTick), with the remaining state values either fixed or coming from very small enumerable spaces. 2️⃣ Attackers precisely model the three typical button-press consumption profiles (retail first-boot, empty-NVRAM, paper wallet) that advance the PRNG before seed generation. 3️⃣ From the weak random_bytes(32), the full deterministic pipeline (SHA-256 → BIP-39 → PBKDF2-HMAC-SHA512 → BIP-32 → address derivation) is reproduced offline. 4️⃣ GPU clusters brute-force the candidate pad space and button-count variations, then match the derived addresses against the global set of single-signature P2WPKH addresses to identify vulnerable wallets and sweep their funds. ⚙️ Root Cause: A build configuration error set MICROPY_HW_ENABLE_RNG to 0, disabling the STM32 hardware TRNG. The random number generation path silently fell back to the non-cryptographic Yasmarang software PRNG, whose state was almost entirely predictable, reducing effective entropy to ~40 bits (Mk2/Mk3) or ~72 bits (Mk4/Mk5/Q). 🔒 SlowMist Insight: Affected users should immediately upgrade to the patched firmware, generate a completely new seed, transfer a small amount of funds as a test, confirm the new address works correctly, then migrate all remaining funds. Full analysis 👉

🚨SlowMist TI Alert🚨 💸 @LienFinance Loss: ~542k USD 🔍 Root Cause: The `exchangeEquivalentBonds` function in BondMakerCollateralizedEth lacks proper multiset integrity checks. It only counts total exception occurrences instead of verifying each bondID's appearance per group. By repeating a single exception bondID in the output group, attackers consumed the exception count twice, masking a missing input exception. This allowed minting new non-exception BondTokens without burning the corresponding input bonds, which were then sold for USDC from a pre-approved victim address. 📌 Attacker: 0x0d7d9023531ad1a88414e216ee2715f63561808a 📌 Victim: 0xa961684a3a654fb2cca8f8991226c0cefc514d80 📌 Vulnerable Contract: 0xda6fc5625e617bb92f5359921d43321cebc6bef0, 0x843225cf6e663e4454732d6b551a737ac7b47de0 Attackers exploited the flawed exception-counting logic to mint unbacked bond tokens, swapped them for USDC via three pre-authorized endpoints, and drained 542,144.628604 USDC from the victim. Powered by Tx:

🚨 SlowMist TI Alert 🚨 💸 @VerusCoin Loss: ~$7.5M ⚠️ Unlike the prior 0x6990…b321 exploit, which decoupled the validated proof from the executed transfer payload, this attack hash-bound the transfers to the CCE but failed to validate the CCE’s economic backing; both exploit flawed cross-chain import validation. 🔍 Root Cause: `VerusProof.checkExportAndTransfers` verified selected CCE fields—including `hashReserveTransfers` against attacker-supplied serialized transfers and the source/destination IDs—but did not enforce the CCE’s accounting semantics. It failed to parse or validate `totalamounts`, `totalfees`, `totalburned`, CTxOut `nValue`, or whether the prior CCE outpoint carried sufficient value and assets to cover the claimed transfers. As a result, a matching transfer hash was incorrectly treated as authorization to release bridge assets, rather than merely a commitment to the requested transfers. 📌 Attacker EOA: 0xbda71b58cec0b1c20a8f87ccd52fa0679747855c 📌 Victim Bridge: 0x71518580f36feceffe0721f06ba4703218cd7f63 📌 Vulnerable Contract: 0x54e03a1682fd0bb065b669f6296f97028dcfd4ce 📌 Fund Receiver: 0xcfd0a20703cd11e0b9f665e1c3f1ef989c142d54 Impact: The attacker submitted a successor CCE anchored to an accepted Verus state root, containing a hash commitment to eight attacker-defined reserve transfers. Because the bridge did not verify whether the CCE’s economic fields backed those transfers, it executed eight payouts from bridge custody to the attacker-controlled receiver—releasing ETH, DAI, USDC, USDT, and four additional tokens without enforced cross-chain asset backing. Powered by Tx:

🚨SlowMist TI Alert🚨 💸 @42dao_official Loss: ~ 912k USD 🔍 Root Cause: Attackers exploited an abnormally low BTCB oracle price from Median Oracle via Spotter `poke` and Dog `bark`. The spotter lacked price deviation checks, max drawdown limits, and minimum price protections, allowing immediate write of the low spot into Vat. The dog module then used this updated spot without any liquidation delay or oracle price validation, enabling instant liquidation of multiple BTCB vaults. 📌 Attacker: 0x9d8dd9f2d734675e2bfcc142d1c7a45609ca213c 📌 Victim: 0x973a722fd8bcd4b81f4c5c1ac687073e44aa9a0c 📌 Vulnerable Contract: 0x849dc2416cbe54995a1d725afe526c0e38829228 (Spotter) & 0x00101ae4467d72e83ef68df447c41de0c71f634e (Dog) Impact: A single-transaction combo exploited the missing price protection and liquidation delay in Maker-style system, allowing an attacker to liquidate multiple BTCB vaults using an abnormally low oracle price and profit from the arbitrage. Powered by Tx:

🚨 Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension Following @Will42W’s warning about TRAE IDE extension supply chain risks, SlowMist investigated the malicious extension juannegro.solidity. Although removed from Open VSX, the extension was still available through the TRAE marketplace as of July 18, 2026. It impersonated a legitimate Solidity plugin and acted as a cross-platform malware dropper. Our analysis found that it: 🔹 Impersonates a legitimate Solidity extension and uses the marketplace as the initial malware delivery channel 🔹 Automatically executes after IDE startup and establishes persistence across platforms 🔹 Uses an Ethereum smart contract to store and retrieve dynamic C2 configurations 🔹 Allows attackers to update C2 endpoints and payload delivery without republishing the extension This incident highlights how extension marketplaces can become initial infection vectors, while blockchain infrastructure can be abused for dynamic C2 management. Users who installed juannegro.solidity should remove the extension and check their systems for potential compromise. Full analysis👇

Previously, we analyzed Grok CLI’s data upload behavior and found that its repository upload mechanism could send git bundles containing sensitive files such as .env files and RSA private keys. Following that analysis, we continued auditing Grok Build CLI’s security model after it was open-sourced. Within 24 hours, we identified two attack chains that can lead to arbitrary code execution without explicit user approval. The root cause is not a single bug, but a fragmented trust model: project-level files can influence AI Agent instructions and permission decisions without sufficient validation. Key findings: 🔹 cargo check was incorrectly classified as a safe command. Combined with malicious AGENTS.md instructions, attackers can trigger execution and achieve code execution. 🔹 .claude/settings.json with bypassPermissions can override permission checks and enable unrestricted tool execution. 🔹 Grok Build CLI inherits Claude Code CLI’s permission configuration model, exposing similar risks. 🔹 .mcp.json introduces additional project-level attack surfaces through MCP configuration. These findings highlight a broader issue: When #AI# coding agents trust project-level files too much, opening a project can become equivalent to granting shell access. 📖 Full technical analysis: 👉 Previous analysis:

🚨SlowMist TI Alert🚨 💸 @Ostium Loss: ~11,862,445 USDC 🔍 Root Cause: An authorized oracle signer was used to submit malicious price reports through a registered forwarder. The attacker provided validly signed but manipulated oracle data, which was accepted by the oracle verification mechanism. By repeatedly opening and closing trades with artificially favorable prices, the attacker generated artificial profits and drained funds from the OstiumVault. 📌 Attacker Address: 0xd1794196f0fc99c7f27970e661597d77d9a85869 📌 Victim Address: 0x20d419a8e12c45f88fda7c5760bb6923cee27f98 (vault) 📌 Vulnerable Contract: 0x0aebc4094b60ea4e21e937e80dafdd58c07c5ebb (OstiumPrivatePriceUpKeep impl) & 0xd456939e54f68ef9b0be62abb2ec4a37397cb814 (OstiumVerifier) Impact: The attacker exploited compromised oracle privileges to submit manipulated price reports and execute repeated profitable trades, draining ~11.86M USDC from the vault. Powered by Tx:

✍️ Technical Analysis Published: Telegram Account Compromised, Wallet Swapped: How Does macOS Malware Break Through Your Defenses? Our latest investigation reconstructs how a single malware sample chains together Telegram session theft, wallet database exfiltration, offline decryption and fake wallet applications into a complete account takeover workflow. Our analysis shows: 1️⃣Stolen Telegram Desktop and Telegram for macOS session files can be restored on another Mac without re-entering a phone number, verification code or 2FA password 2️⃣For Telegram for macOS, even after server-side security mechanisms respond, cached chat history may remain accessible instead of being cleared by a forced logout 3️⃣Wallet databases can be paired with passwords collected from Keychain, browsers and Apple Notes for offline decryption, without interacting with the victim's device 4️⃣Fake Ledger and Trezor desktop apps are actually WKWebView-based loaders that replace trusted wallet interfaces with attacker-controlled phishing pages The malware doesn't rely on a single technique—it combines authenticated sessions, encrypted wallet data and credential material into one attack chain. 💡 Defense tip: Protect your local Telegram session by enabling a Telegram Passcode and using a strong, unique password. Full analysis and practical mitigation guidance👇

🚨SlowMist TI Alert🚨 💸 @dripsnetwork Loss: 24,882.99 DAI 🔍 Root Cause: Integer type conversion flaw in `DaiDripsHub`'s `give(address,uint128)` function. The function converts `uint128 amt` to `int128` without validating `amt <= type(int128).max`. Attackers pass `2^128 - reserveBalance` (exceeding int128 max), causing `int128(amt)` to become a negative value. `-int128(amt)` then becomes positive, flipping the transfer direction from "user pays" to "reserve withdraws to user," draining DAI. 📌 Attacker: 0x84da7a5e2315eb798f04b75554aeb15047269cce 📌 Victim Contract (DaiReserve): 0xf9bbb2df44cfe46e501cf91c99b2f8fef9d9d44a 📌 Vulnerable Contract (Hub Proxy): 0x73043143e0a6418cc45d82d4505b096b802fd365 📌 Attack Contract: 0x00c64b5a926ba1fcec30efad88c344c619f54f12 Summary: Missing input validation allows a crafted `give()` call to reverse fund flow, draining the reserve. Powered by Tx:

🚨SlowMist TI Alert🚨 💸 @Lumi_Finance Loss: ~ $264k 🔍 Root Cause: A vulnerability in Lumi smart accounts allowed token approvals to be performed as a side effect during UserOperation validation. Due to improper validation logic, an attacker-controlled paymaster could trigger approval operations during the validation phase and obtain ERC20 allowances from multiple smart accounts without explicit user intent. 📌 Attacker: 0xce1a3bb0b98d0d90c7dd0620ab86c9a771888d88 📌 Victim: Multiple Lumi smart accounts affected by unintended token approvals during UserOp validation 📌 Malicious contract: 0x56362412ae17cac443aafbab4289946ad958e8a1 The attacker abused a flaw in Lumi smart account UserOperation validation logic to obtain token allowances from multiple wallets through validation-time side effects. The attacker then used the malicious sweeping contract to batch drain approved ERC20 tokens, swapped the stolen assets into ETH, and transferred the proceeds to the attacker-controlled address. Powered by #SlowMist#.AI Tx:

Every stolen transaction tells a story—but following that story across multiple wallets, chains, bridges, and mixers isn't easy. That's why we built TrackAgent, SlowMist's AI-powered On-Chain Intelligence Agent, now integrated into our Free Stolen Asset Assessment Service.🚀 Instead of simply retrieving blockchain data, TrackAgent continuously traces stolen funds, reconstructs complex fund flows, correlates attacker addresses, and combines on-chain intelligence with security threat intelligence to support real-world investigations. 🔍 Key capabilities: 🌐 Supports 31 blockchains 🌉 Cross-chain & laundering path analysis 🔗 Multi-address correlation 🛡️ Threat intelligence-powered investigation 📊 Over 12,000+ stolen asset cases have been submitted to SlowMist over the past four years. By bringing AI into our investigation workflow, we're making preliminary analysis faster while enabling our analysts to focus on the cases that need deeper investigation. 🤝 We're excited to bring AI-powered on-chain investigation to more victims and the broader Web3 community. ❓Need help after a crypto theft? Submit your case through our Free Stolen Asset Assessment Service to receive a TrackAgent-powered on-chain assessment and support from the SlowMist security team. 👉 📖 Read more：

🚨 SlowMist presents the 2026 Mid-year Blockchain Security & AML Report! 1/ In H1 2026, blockchain security entered a new phase. AI-driven scams, supply chain attacks, and cross-chain infrastructure exploits expanded the attack surface beyond smart contracts, while global regulation around stablecoins, #AML#, and VASPs continued to mature. 📊 Stats: 🔺 182 security incidents, ~$956M in losses (vs. 121 incidents / ~$2.373B in H1 2025) 🔹 By ecosystem: #Ethereum# $134M > #BSC# $36.35M > #Arbitrum# $4.93M 🔹 By project type: #DeFi# 116 incidents / ~$490M > Cross-chain bridges 20 incidents / ~$346M (Kelp DAO: ~$292M single loss) 🔹 By attack vector: 85 contract & logic vulnerabilities > 17 private key/credential compromises > 12 supply chain attacks ⚠️Note: Data is calculated using token prices at the time of each incident. Due to price fluctuations, undisclosed incidents, and the exclusion of individual user losses, actual losses are likely higher. Full report 👇

🚀 SlowMist has officially launched three security Agent Skills on @OKX AI ！ 🔹 SlowMist Agent Security Skill — Comprehensive protection for Agent interactions and execution 🔹 MistTrack Skill — On-chain address risk analysis and AML tracing 🔹 MistEye Skill — AI Agent security detection and dependency risk identification All Skills can be accessed through the OKX Onchain OS standardized interface, enabling on-chain automated settlement with near-instant execution. Ready to try them? 🧵👇

We're closely monitoring the Ill Bloom wallet weak randomness risk alert from @coinspect . Please check whether any of your historical wallet addresses are affected👉 Thanks to @coinspect for the responsible disclosure. Stay safe!

🚨SlowMist TI Alert🚨 💸 @edeldotfinance Loss: ~ $350k 🔍 Root Cause: `latestAnswer()` in price source reads `convertToAssets()` from ERC4626 vault. Vault's `totalAssets()` directly uses underlying asset balance, allowing attacker to donate assets via direct transfer to inflate share price. No TWAP, rate cap, or donation protection. 📌 Attacker EOA: 0x58428161bb55c14a413945f06cbdec157f411c76 📌 Victim: Aave Pool 0x3eeeb3cd20f844a578807fc457388ceb9a67faa6 📌 Vulnerable Contracts: - Price Source: 0x4c2c9df4559d80e0a7aa3c7f281704a7992f4ce2 - ERC4626 Vault: 0x14f37168ab9eafcd94d5b142a00e6e9b261bad48 (WrappedBackedTokenImplementation) Flash loan + donation attack on ERC4626 vault manipulates oracle, enabling attacker to drain ~$350k and other reserves. Powered by #SlowMist#.AI

🚨SlowMist TI Alert🚨 AIDC token on BSC has been exploited. 💸 Loss: 220.12 WBNB (~$120929.35) 🔍 Root Cause: AIDCToken's `_sellTransfer()` accumulates a 30% burn amount without deducting it from the seller. Subsequently, any non-Pair transfer triggers `_executeAccumulatedBurn()`, which incorrectly burns tokens from the `uniswapPair` balance instead of the seller. After burning, `sync()` is called, artificially deflating the AIDC reserve in the AMM, allowing the attacker to drain WBNB. 📌 Attacker: 0x89eb2c99e970d831525c7a52badc290afa116b63 📌 Victim: 0x2725033282b3bd4be8873b7f0f622c18e3b7cbd8 (Pancake V2 AIDC/WBNB Pair) 📌 Vulnerable Contract: 0x5021d71859f81b4c905b573591db8f9cc4a0c6fe (AIDCToken) The attacker exploited a flawed burn mechanism where sell-induced burn debt is wrongly imposed on the liquidity pool, enabling repeated reserve manipulation and a final swap that drained nearly all WBNB from the Pair. Powered by #SlowMist#.AI

🚨 SlowMist TI Alert 🚨 A new Shai-Hulud / Miasma / Hades npm malware variant linked to the compromised npm developer account czirker, affecting the npm ecosystem. The campaign uses a preconfigured binding.gyp file to execute during npm install; reported scope includes 23 affected packages, with leo-logger noted at 3,140 weekly npm downloads. As of the tweet publication time, 408 infected GitHub repositories containing stolen credentials had already been observed. Potential attacker actions include GitHub token theft, npm token theft, AWS / GCP / Azure credential theft, local environment data exfiltration, malicious GitHub workflow abuse, and further npm supply-chain propagation. Security teams should immediately check lockfiles and package histories for affected versions, downgrade or remove impacted packages, rotate npm, GitHub, cloud, CI/CD, and application secrets, enforce 2FA. Thanks to @OX__Security for the excellent analysis. As always, stay vigilant! The following URL can be used to track the latest situation:

🔥Glad to support @HTX_DAO’s HTX Genesis Hackathon as a security partner! Hosted by HTX DAO & this global hackathon focuses on AI × Web3 innovations in smart finance, AI Agents, and on-chain infrastructure. $20,000 prize pool + $100k compute power and strong ecosystem support. Top projects can enter HTX DAO accelerator.✨ Register by July 5! Wishing all hackers a great experience and groundbreaking innovations! 🚀

🚨SlowMist TI Alert🚨 @aztecnetwork has been exploited again. 💸 Loss: 1,158 ETH+150,000 DAI+0.4696 renBTC (~$2,209,704.23 USD) 🔍 Root Cause: The `RollupProcessor.escapeHatch()` function (`0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba`) lacks access control: no `onlyOwner`, no `rollupProviders` authorization, and no provider signature verification. When `rollupSize == 0`, the TurboVerifier accepts an escape hatch proof, and `processDepositsAndWithdrawals()` directly trusts the `proofData` public inputs (`publicOutput`, `outputOwner`, `assetId`) without independent validation of fund ownership or withdrawal balance, executing `withdraw(1158 ETH, attacker, 0)`. 📌 Attacker EOA: `0x6952d9246e9afe8b887b2877225163436f78e97f` 📌 Victim Contract: `RollupProcessor` at `0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba` 📌 Verifier Contract: `TurboVerifier` at `0x48cb7ba00d087541dc8e2b3738f80fdd1fee8ce8` Impact: Attacker drained 1,158 ETH from the `RollupProcessor` by submitting a valid escape hatch proof with spoofed public inputs, exploiting validation in the escape hatch withdrawal path. Powered by #SlowMist#.AI

🚨SlowMist TI Alert🚨 💸 @LittleBoyPlus has been exploited. Loss: ~377,642 USDT (~610.555 BNB) 🔍 Root Cause: The `LBPHashrate._update()` function (in `0x5e3c...85fe`) is triggered by zero-value `transferFrom` calls, which bypasses OpenZeppelin's allowance check. This allows an attacker to call `LBPHashrate.transferFrom(pair, DEAD, 0)` without pair authorization, triggering `_harvest(pair)` which mints LBP tokens directly to the PancakePair address via `LBP.mintReward(pair, reward)`. The minted LBP increases the pair's balance but not its reserve, enabling the attacker to drain USDT via `PancakePair.swap()`. 📌 Attacker: `0x5449ded887576f43fc339851e942ebc1e6f8118b` 📌 Victim Pair: `0x00e3ea08fd8cbad955ec5d2292ad637670c31524` 📌 Vulnerable Contract (LBPHashrate): `0x5e3cbc82d020be91a989eb747934104e9ab585fe` Impact: Zero-value `transferFrom` on LBPHashrate allows unapproved harvest & mint to PancakePair, leading to reserve imbalance and immediate USDT drain. Powered by #SlowMist#.AI