十月十一日，一名自媒体博主收到高薪商业拍摄邀约。对方提前支付定金取得信任，随后诱其前往泰国。抵达后，受害人被带至一处偏僻房屋，面临被转手出售的风险 受害人察觉异常后，及时联系亲友，并装病拖延时间。据其描述，拟接手人员因受害人病情对约定价格提出异议，双方发生争执，交易暂时中止，为救援争取了时间 接到亲友求助后，我们协同警方，结合涉事人员的电话线索、受害人沿途拍摄的照片和一张外卖照片，锁定其位置，最终协助其获救 警方随后将涉事人员带回调查，并继续核查其出入境记录、边境地区行程及是否涉及非正规越境，相关情况仍在调查中 泰缅跨境转运时间窗口极短，一旦出境救援非常困难。境外工作邀约即使提供定金，也应核实雇主、工作地点和接洽人员

On October 11, a content creator received a lucrative offer for a commercial shoot. The organizers paid a deposit upfront to gain their trust, then lured them to Thailand. Upon arrival, the victim was taken to an isolated house, where they faced the risk of being sold to another party Realizing something was wrong, the victim contacted family and friends and feigned illness to buy time. According to the victim, the prospective buyers disputed the agreed price because of their apparent illness. An argument broke out, temporarily halting the transaction and buying crucial time for rescue. After receiving a request for help from the victim’s family and friends, we worked with police to pinpoint their location using phone-related leads concerning those involved, photographs the victim had taken along the journey, and a photograph of a food delivery order. We ultimately helped secure the victim’s rescue Police subsequently took those involved in for questioning and continued examining their immigration records, travel in border areas, and possible involvement in irregular border crossings. The investigation remains ongoing The window for intervention before victims are transferred across the Thai–Myanmar border is extremely narrow. Once they have been taken across, rescue becomes very difficult. Even when an overseas job offer includes an upfront deposit, verify the employer, the actual work location, and the people arranging the engagement

🚨@RevenueFamily involves malicious approvals. The perpetrators submit users’ permit signatures to obtain unlimited permission to spend their USDG, then immediately call transferFrom. The approval and fund transfer are completed in the same transaction, draining users’ wallets The funds are then split 20%/80% between two hacker addresses. This distribution structure resembles Inferno’s drainer-as-a-service model, and its promotional approach matches FomoPeek’s model of using KOLs to carry out scams

We have conducted comprehensive tracing and forensic analysis of the funds stolen from @bitget . The funds are currently held at the addresses listed below, although some remain in motion. Based on our previous experience responding to incidents involving North Korean threat actors, tracing and freezing these assets is likely to be highly challenging. We recommend that Bitget adopt a white-hat bounty program similar to @Bybit_Official ’s model, incentivizing more leading security firms and independent researchers to continue monitoring and tracing the stolen funds. ETH： 0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899 0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2 0xDc2901f741B4003e32B8B752e97b8c4C1891dC63 0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0 0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272 0xFd5EBe912e2061992437767e24e5BCb52a3f9e54 0xeD5a394a7558929112848B7e97B569de6bbE1A51 0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284 0xe07bd590e1198666230932bad5db3dbbe21e7d57 USDT / USDC： 0xe07bd590e1198666230932bad5db3dbbe21e7d57 BNB： 0x150889FE4fA7a7699588f75C4189FA9e721acFD3 0x3a82a441f1e75d2022d17f6b082979c04fd67652 0x03df4cb9aa0e73a847b2989c1cd00a2a654b32f7 0x2399548147f367375b798256cc620cf2dbac7f10 BTC： 13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T XRP： rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig rHCPH9VCKvYRsQ2eJBFydpLqLqb5S6a3ET r3PkiYKo2yFiunHuEGHtTMFPQXEgyCkWj7 rnHdntCUt2vU8YMXarhvSeDRrZ8xwaFcTR rwRnFu7QeQcd7p5qvyHkububNrfPRyEf2C r4vyVuh8QXvUHh7HFt4EiFLDVFkTBe7fJx rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z RLUSD： rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z r4CAbSkDf4MgGZjao78Ufcks3jxr2UiPfD TRX： TBWNguTTgezw9dVorX441C6nDrZpRxYwKD @GracyBitget @xiejiayinBitget

I’m saddened to hear of Hsin-Ju’s death, but the news seems to have fueled the spread of conspiracy theories. I’d like to share some additional information: “When officers found her, she had a needle in her arm that was visible through the car window. They knew it was a drug overdose, so they broke the window and tried to administer medication, but she was already deceased.” @hack_vc @alpackaP

We’re hiring a part-time Channel Business Development professional to join our Partnerships & Business Development team! Salus specializes in smart contract audits, Web3 penetration testing, and asset recovery services, providing professional security support for Web3 projects. Our security track record: 🟠 300+ Projects served and protected 🔴 0 REKT Publicly disclosed security record of protected projects 🟠 100% Project security rate disclosed on our official website 🔴 100% Penetration testing success rate disclosed on our official website You’ll work with us to: • Support high-quality Web3 projects with security needs • Develop partnership channels through communities and ecosystem partners • Follow up with prospective clients and partnership opportunities • Help build stable, long-term ecosystem partnerships Experience in business development, channel partnerships, or community operations is a plus. Part-time · Fully remote Industry-competitive compensation and incentives Send your CV or a brief introduction to [email protected]. For the fastest response, you can also DM @Jack24klove or @DarcyAri directly. Email subject: Part-time Channel BD Know someone who might be a great fit? Feel free to share this opportunity or refer them to us!

Analysis indicates that the group behind the FomoPeek incident had already been involved in a private-key theft case in June. Whether the same method was used in this incident remains under investigation Confirmed hacker address in this incident: 0x6d37f2C5e8F8546b648D317295565dA95975f4BB Estimated proceeds: approximately 579,900 USDT The funds were primarily transferred through three routes: • FixedFloat route: 215,000 USDT via 0x111faeb95cd0786593433bcc762dc5c1debf541c 27,028 USDT via 0x2d53113c89c83c520c17b8bbcdc22aa0518a38be 159,000 USDT via 0x0df6ac2e2856114228756947d1b1d9ff63ea3e68 totaling 401,028 USDT • KuCoin route: 20,000 USDT was transferred from 0x2d53113c89c83c520c17b8bbcdc22aa0518a38be in two separate transactions of 10,000 USDT each. The funds passed through two deposit addresses before being consolidated into a KuCoin hot wallet • Escrow-platform route: 111,458.3085 USDT was routed through 0x4c73d7e8ef0e61129403e219debc597fd43aa0ec before reaching addresses associated with an escrow platform. 10,000 USDT entered the CCE mixing service via 0x0361897d757d13a4afad64a2e1bc561b96a8c7cf and subsequently reached addresses associated with an escrow platform. We are conducting a more comprehensive trace of the remaining addresses involved in the incident.

A Hyperliquid user account was taken over without authorization. Approximately 738,600 USDC was transferred out, while another 10,287 HYPE was undelegated. Some of the stolen funds appear to have reached addresses potentially associated with Bitget. Affected account: 0x5b6d236e39a4723a8f79db93cfd1af4d228f9c60 At the time of our review, the HYPE remained in the staking balance and had not yet entered the withdrawal queue. If the attacker initiates a cWithdraw, the assets can be transferred after the seven-day waiting period. In two similar cases we handled recently, the victims also had assets still in staking when their accounts were compromised. Due to the absence of a user-triggered emergency pause or recovery mechanism, they were unable to prevent those assets from subsequently being withdrawn and stolen. Losses under this scenario have already exceeded $1.1 million. The 10,287 HYPE in this case now faces the same risk. To better protect staked assets that remain pending withdrawal after a private key or account-signing compromise, we propose that Hyperliquid consider introducing an optional Guardian / Recovery mechanism that users can configure in advance. A Guardian should only be able to place a temporary hold on cWithdraw, transfers, Agent approvals, and multisig changes. It must never be able to move funds, and the hold should expire automatically without allowing indefinite renewal. Guardian replacement or account recovery should require a timelock, evidence-based review, and an independent or validator-governed threshold, with every state change recorded publicly on-chain.