🚨SlowMist TI Alert🚨 💸 Loss: ~$59.8k 🔍 Root Cause: The affected Argent-style smart wallet system exposed two exploitable flaws. In the recovery module, the unrestricted 0x254a2e49 setter allowed a crafted recovery period to make the calculated deadline wrap to a timestamp in the past. This let a recovery backed by a valid guardian signature be finalized in the same transaction, changing the wallet owner. Separately, the execution module failed to reject reuse of an identical signed 0xaacaaf88 payload: it succeeded 19 times in one transaction and nine times in the other. The attacker used the repeated executions to trade around a low-liquidity MARK/WETH pool. 📌 Attacker: 0xc10609ce5c032db92e562e463b1234aab0872b02 📌 Victim: 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66; 0x5a79e5772493cf4329682d202aa2d28f85a85440 📌 Vulnerable Contract: 0xf490557d67d934440677a4f16793d5ef319b8ef5; 0x4e50adfc953551286bbd7fee2b2b846d1d227394 Powered by SlowMist.AI Tx: etherscan.io/tx/0xbfed8d3356… etherscan.io/tx/0xa0ee8f9142…

🚨 Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain Following the public release of #DarkSword-related exploit code in March 2026, DarkSword-PROV2 appeared on GitHub in July, with the attack infrastructure observed operating online in late September. We traced the live attack infrastructure, linked its admin panels to public GitHub repositories, and analyzed the exploit code, payload library, delivery chain, and post-exploitation capabilities. 🔍 Key Findings: 🔹 A complete attack pipeline: The infrastructure integrates exploit delivery, device and data collection, data exfiltration, and crypto wallet fund consolidation. 🔹 Extensive data theft capabilities: The toolkit targets Keychain data, files, messages, and crypto wallet data, with additional capabilities for wallet data decryption and fund consolidation. 🔹 Broader claimed coverage, narrower functional coverage: Although the toolkit claims support for iOS 13 and later, code analysis identifies two functional exploit windows: iOS 18.6–18.7.2 and iOS 26.0–26.1. Many other version entries remain incomplete or unverified. 🔹 Public code weaponized: Publicly available exploit components have been integrated into a deployable attack framework, lowering the barrier to launching sophisticated #iOS attacks. 🛡️ Recommendations Keep iOS updated and avoid untrusted links. Simply opening a malicious page in #Safari may trigger exploitation. If a device has visited a suspicious landing page, treat its seed phrases and private keys as potentially compromised. Use a device that has never accessed the page to create a new wallet and transfer your assets. Also check for abnormal transactions and token approvals across chains, and revoke unnecessary approvals. 🔗 Read the full analysis: slowmist.medium.com/threat-i…

🚨 SlowMist TI Alert 🚨 A fake "Ledger firmware update" campaign is exploiting the recent @Ledger supply chain incident. Looks very real: fake “Genuine check” page, device selection, “Update Now” button. Never click website links to update. Never enter your recovery phrase anywhere. ❌ Stay vigilant! 🔐 #phishing

🚨SlowMist TI Alert🚨 💸 @UNCX_token Loss: ~$86k 🔍 Root Cause: VestingManager.cancel(uint256) did not ensure a schedule’s retained shares covered shares already released. After transferring tokens directly to the manager to lower its shares-per-token conversion rate, the sender topped up and canceled schedules whose original shares had been fully released. The cancellations over-reduced global shares, allowing another sender-controlled schedule to claim excess tokens from the shared pool. 📌 Attacker: 0x78c9b11853e4f183a34c63ffd1924d2319a2f5b3 📌 Vulnerable Contract: 0xa98f06312b7614523d0f5e725e15fd20fb1b99f5 Powered by SlowMist.AI Tx: etherscan.io/tx/0x352065378c…

🚨SlowMist TI Alert🚨 💸 @ethervista Loss: ~18.6K 🔍 Root Cause: The EtherVistaPair.swap() function suffers from an integer overflow in its K-invariant check. Since both reserves are uint112, their multiplication overflows and wraps around, allowing the invariant check to pass even when the actual reserve product decreases significantly. The attacker exploited this flaw through an attacker-controlled contract registered as the authorized router, executing two crafted swaps to drain WETH and VISTA from the pool. 📌 Attacker: 0xbbf8f3fe8e4fdf6b594e6107144d78293d2018fa 📌 Attack Contract (Router): 0x469424b628a9d2036e41496e814db500d683b120 📌 Vulnerable Contract: 0xfdd05552f1377aa488afed744c8024358af02041 Powered by SlowMist.AI Tx: etherscan.io/tx/0xb2c7332d9e…

🚨SlowMist TI Alert🚨 💸 @BitBayofficial Loss: ~$14K 🔍 Root Cause: The Vault's `_withdraw()` function transfers its entire token balance when `liquidity == 0`, without limiting the payout to the user's proportional share. The attacker exploited this flaw by triggering a zero-liquidity state via `reposition()`, then redeeming just 1 minimal share unit to drain approximately 14,838.47 DAI. 📌 Attacker: 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B 📌 Victim: 0x048E88311ca84876aeA086125825492e2AF2e5A0 📌 Vulnerable Contract: 0x048E88311ca84876aeA086125825492e2AF2e5A0 Powered by SlowMist.AI Tx: polygonscan.com/tx/0x5b795dc…

🔍 In a recent investigation, SlowMist analyzed a malicious bookmark #phishing attack targeting @fomo users and uncovered a fake “human verification” page designed to execute malicious JavaScript in the context of a logged-in Fomo page. Victims were instructed to identify an icon, drag it to the browser bookmarks bar, and click the bookmark three times. The malicious bookmarklet then collected Privy access/refresh tokens, browser storage, IndexedDB data, and wallet-related information, while also containing logic related to MFA/TOTP. 🕵️ Using @MistTrack_io , we traced the stolen funds and found a complex flow involving repeated USDC/SOL swaps, multi-address splitting, cross-chain transfers, and deposits to Privacy Cash and gambling platforms. 🛡️ Security tip: Legitimate human verification should not require dragging an icon to the bookmarks bar and clicking it on a wallet or trading page. Stop immediately if you encounter such a request. Regularly check your bookmarks, enable MFA, and revoke abnormal sessions from a trusted device if you have executed a suspicious bookmark. 📖 Read the full analysis: slowmist.medium.com/threat-i…

🚨SlowMist TI Alert🚨 💸 @X7_Finance Loss: ~6.78 ETH 🔍 Root Cause: In `claimRewards()`, `totalRewards` is incremented by `(address(this).balance - lastETHBalance)` on every call, but `lastETHBalance` is only updated when `claimable > 0`. Calling with an empty array leaves `claimable` at 0, so the same unaccounted balance is repeatedly added to `totalRewards`, inflating the per-token reward. The attacker also donated ETH to amplify the delta before draining funds. 📌 Attacker: 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2 📌 Victim: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7 📌 Vulnerable Contract: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7 (X7Pioneer) Powered by SlowMist.AI Tx: etherscan.io/tx/0xc98056d6ab…

🚨 SlowMist TI Alert: Beware of bookmark-based phishing attacks targeting the @fomo web interface 🚨 The phishing page tricks users into completing a fake CAPTCHA, then instructs them to drag malicious JavaScript code into the browser’s bookmarks. After just 2–3 clicks on the malicious bookmark, attackers can hijack a previously logged-in FOMO account and immediately steal its crypto assets. This is not a new technique. It’s an old exploitation method previously. Stay alert, and watch for our upcoming analysis.

🚨SlowMist TI Alert🚨 💸 @SetProtocol Loss: ~5.08 ETH 🔍 Root Cause: actualizeFee() recalculated unitShares with upward rounding even though no fee was minted, raising it from 4,927 to 4,928. The attacker issued before the update and redeemed the same quantity afterward, extracting collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit. 📌 Attacker (EOA): 0x506440728d84eb22809dc9464bc8189618a1c5b6 📌 Attack Contract: 0x016feaaa25ab8325e233bc8a2c25055bee0b2f6e 📌 Victim (Set Protocol Vault): 0x5b67871c3a857de81a1ca0f9f7945e5670d986dc 📌 Vulnerable Contract: 0x54e8371c1ec43e58fb53d4ef4ed463c17ba8a6be Powered by SlowMist.AI Tx: etherscan.io/tx/0xaca5f83ff3…

🚨SlowMist TI Alert🚨 💸 MALT Loss: ~$72k 🔍 Root Cause: swap(uint256,uint256,address) records the caller’s input and pre-swap reserves, then invokes an external rebalanceHook before transferring the requested output. The hook withdraws DAI from the Capital Source and deposits it into the same pool. The swap subsequently validates its invariant against the pool’s final balances, treating this protocol-funded DAI as if it were supplied by the caller. Because the function does not isolate caller-funded input from hook-funded rebalancing capital, an attacker can provide negligible input, trigger treasury-funded liquidity injection, and withdraw a disproportionate amount of MALT. 📌 Attacker: 0x8F103B6A0aD705bcE6357842A5fefEB49e8D83Ef 📌 Victim: 0xF0d314849A3Bc9270a79110F25dBA2c8325A2AAC 📌 Vulnerable Contract: 0xfe6C096a2871337d4f6F7DD04Ebda733E94D7A13 Powered by SlowMist.AI Tx: polygonscan.com/tx/0x915eccb…

🚨SlowMist TI Alert🚨 💸 @Goldpesatoken Loss: ~$114.9k 🔍 Root Cause: GPXHooks' reBalance() performs liquidity operations through the shared, flash-accounted PositionManager inside an attacker-controlled PoolManager unlock without verifying that the PositionManager's GPX/USDC currency deltas are zero, so the hook's burn credit is not isolated from the caller's state. The attacker opens an unlock, mints a WETH/USDC position via MINT_POSITION without settling (leaving the shared PositionManager with a −114,999.999187 USDC delta), then swaps on the GPX pool to trigger the hourly rebalance: the hook burns its real position and earns a +148,868.602189 USDC credit, but TAKE_PAIR can only withdraw the net positive delta, so the hook receives just 33,868.603002 USDC while the attacker's phantom debt absorbs the difference. Burning its own position cancels that debt and the attacker takes 114,999.999186 USDC straight out of the PoolManager — a missing delta-isolation / zero-delta check on a shared PositionManager. 📌 Attacker: 0x4a5FD2e9357cC87DF4cD6A1808174DBc8646899F 📌 Victim: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8 📌 Vulnerable Contract: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8 Powered by SlowMist.AI Tx: basescan.org/tx/0x5c1febd504…

Before sending crypto, take a few seconds to check where you are and where your funds are going. #punycode Stay vigilant!

👀🫡

Congrats to @TokenPocket_TP — the Asset Inheritance feature has passed our security audit. 🎉 We appreciate TokenPocket’s commitment to security.👏 🔗Audit report: tokenpocket.pro/TokenPocket-…

🚨SlowMist TI Alert🚨 💸 MUS Loss: ~$36.9k 🔍 Root Cause: deposit() included the first-deposit bonus in both the immediate ETH refund and the user’s MUS allocation; withdraw() allowed same-transaction redemption without limiting total ETH returned to the amount deposited. Sixteen fresh addresses repeated the cycle to extract ETH from MUSystem. 📌 Attacker: 0x1a083ADf234a8f67ad65A9B9B616853ACf5998E5 📌 Victim: 0x9bdf81e6066d32764b7e75a1b5577237e06d9364 📌 Vulnerable Contract: 0x9bdf81e6066d32764b7e75a1b5577237e06d9364 Powered by SlowMist.AI Tx: etherscan.io/tx/0xfe28118e48… etherscan.io/tx/0xaa172fcaa4… etherscan.io/tx/0x905af4e8cd…