SlowMist is a Blockchain security firm established in 2018, providing services such as security audits, security consultants, red teaming, and more.
Joined April 2018
- Tweets4.3K
- Following412
- Followers91.3K
- Likes3.5K
Pinned Tweet
🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users
⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.
DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.
🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.
🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.
📖 Related SlowMist analyses:
🔗 DarkSword Trojan Backend & iOS Attack Chain:
slowmist.medium.com/threat-i…
🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
slowmist.medium.com/threat-i…
If you're experiencing disruptions to your KYT services, MistTrack is here to help.
If you're experiencing disruptions to your KYT services, MistTrack is here to help.
We offer free trials and dedicated technical support to help businesses maintain their on-chain risk screening and compliance workflows, while exploring alternative or complementary #KYT solutions.
🔎 Two Solutions for Different Business Needs
1️⃣ MistTrack: Fast Integration, Flexible Deployment
Convenient #API integration and dedicated technical support to help businesses quickly establish alternative or complementary screening capabilities.
Flexible pricing options, including subscription plans and prepaid credit packages. Developer plans start at $20 for 100 address checks, with credits valid for one year.
2️⃣ SlowMist KYT: Advanced Risk Management for Large Institutions
A real-time #AML engine designed for institutional compliance teams, focusing on in-depth high-risk fund flow screening and flexible risk configuration.
Prepaid packages based on the number of addresses, with tiered pricing that offers lower per-address costs at higher volumes. Minimum purchase: 10,000 addresses.
🌐 Building a More Resilient Risk Management Ecosystem
We believe diversified risk screening capabilities are essential to business continuity. @SlowMist_Team is committed to working with industry partners to provide reliable technical support and more KYT options.
🙋 Looking for a backup KYT solution? Contact us to learn more about free trials and integration support.
🌐 Website: misttrack.io/
📝 Contact Form: kyt.slowmist.com/get-started…
📧 Email: support@misttrack.io
Worth a read. A clear and detailed breakdown of a recruitment phishing attack that led to a malware infection simply by opening a project in Cursor.
Appreciate @brucexu_eth sharing this.
One thought for wallet teams: it may be helpful to gently remind users when they open the app on an iOS version that isn’t up to date. A small reminder could help users stay a little safer.🫡
🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users
⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.
DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.
🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.
🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.
📖 Related SlowMist analyses:
🔗 DarkSword Trojan Backend & iOS Attack Chain:
slowmist.medium.com/threat-i…
🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
slowmist.medium.com/threat-i…
🚨 The U.S. Treasury’s OFAC has sanctioned 10 individuals and one entity linked to #DPRK IT worker networks.
SlowMist used @MistTrack_io to analyze the listed crypto addresses and uncovered several on-chain connections:
🔎 Boykov ↔ Obertas
• OFAC listed the same #Ethereum address under both individuals.
• Boykov transferred approximately $9.88M to this address. Two of his #TRON addresses also sent a combined 1.66M $USDT to an address attributed to Obertas.
🔎 Boykov ↔ Kim Ki Hyok
• Both had Ethereum addresses sending funds to the same #Bybit deposit address:
Boykov: ~$4M
Kim Ki Hyok: 50,000 $DAI
The risks posed by DPRK IT workers go beyond financial activities. Using false identities, they may gain access to company devices, internal systems, and sensitive data.
⚠️ Companies should verify worker identities, monitor the use of company devices, and carefully manage system access.
📖 Read the full analysis:
slowmist.medium.com/u-s-ofac…
🚨 SlowMist TI Alert: Android’s November 2026 security bulletin is out 🚨
Among the critical flaws: CVE-2026-58868 (Critical) in the Framework component. 💥 It allows remote code execution with no user interaction and no extra privileges.
📱 Affects Android 14, 15, 16, 16-QPR2 and 17.
🔍 No confirmed in-the-wild exploitation so far. But if a bug like this ever gets exploited at scale, it would be a nuke for mobile. Android runs on roughly 7 out of every 10 smartphones worldwide. 🌍
🛡️ Patch levels:
✅ 2026-11-01+: includes CVE-2026-58868 and other Framework/System fixes
✅ 2026-11-05+: covers ALL fixes this month, incl. kernel, MediaTek & Qualcomm
⚙️ Check: Settings → About phone → Android version → Security patch level
Please update ASAP ⬆️
📄 Details: source.android.com/docs/secu…
🥳「2026 HK Institutional RWA & Stablecoin Forum」has successfully concluded!
On November 2, during Hong Kong #FintechWeek, SlowMist and JunHe LLP co-hosted this closed-door forum in Hong Kong.
Here's a look at some of the highlights 👇🧵
2/ The forum also featured three roundtable discussions, bringing together experts from across the industry for in-depth exchanges on #RWA, payment innovation, and institutional security.
💬 Discussions focused on three key areas:
🔹 RWA Development: Bringing traditional assets on-chain, including product implementation, fund structures, and asset management.
🔹 Stablecoin Payments: Cross-border payments, multi-currency operations, and the expansion of financial services.
🔹 Institutional Security: AI-driven threats, fund tracing and recovery, digital asset custody, and post-incident response.
The discussions brought together diverse industry perspectives, with speakers sharing practical insights on the opportunities and challenges facing the digital asset industry.✨
3/ Thank you to all the speakers, guests, and partners for making this gathering in Hong Kong such a memorable one! 🫶
Moving the industry forward takes collective effort. SlowMist will continue advancing blockchain security through security audits, threat intelligence, on-chain tracing, and AML services to help safeguard the digital asset ecosystem. 🫡
🇭🇰 Looking forward to our next meeting in Hong Kong!
Full Recap👇
slowmist.medium.com/event-re…
Congratulations to @Changer_Plus on successfully completing its smart contract security audit by SlowMist! 🎉
Thanks to Changer+ for choosing SlowMist as its security partner! 👏
🔗 Audit Report: github.com/slowmist/Knowledg…
Audited by @SlowMist_Team. Passed. ✅
Changer+’s token transfer smart contracts have passed a security audit covering EVM (Ethereum & BNB), TRON and Solana.
No critical, high, medium or low severity vulnerabilities were identified.
Simple to use. Serious about security.
changer.plus/security/audit-…
#SlowMist #WalletSecurity #SelfCustody #EVM #TRON #Solana #CryptoSecurity #Ethereum #BNB
🚨 On October 29, 2026, cross-chain protocol @zkLink_Official was exploited for approximately $783K. The SlowMist Security Team analyzed the incident and uncovered how a transient storage flaw led to forged batch roots and unauthorized withdrawals.
🧩 Attack Flow:
1️⃣ Queried totalBatchesExecuted and selected the next batch (116409) for forgery.
2️⃣ Executed a genuine Linea claim through SyncL2TxHashRelayer, writing finalizeMessageHash into transient storage.
3️⃣ Reused the stale finalizeMessageHash in a second claimMessage call, triggering an attacker-controlled call to EthereumGateway.
4️⃣ Used EthereumGateway.sendMessage to call ZkLink.syncBatchRoot, forging the batch root and advancing totalBatchesExecuted.
5️⃣ Executed 12 withdrawals against the forged root: 1 ETH and 11 ERC-20 transfers using forged Merkle proofs.
⚙️ Root Cause:
Arbitrator.claimMessage allows relayers to specify arbitrary call targets and calldata, while failing to clear or bind finalizeMessageHash to the current invocation. Combined with ZkLink.syncBatchRoot only checking gateway identity without verifying batch proofs, this enabled batch root forgery.
🔒 Recommendations:
When reviewing similar cross-chain relayer projects, pay attention to four areas:
1️⃣ Reset transient storage before each call.
2️⃣ Bind verification values to the current invocation.
3️⃣ Check whether arbitrary users can indirectly leverage trusted callers through public helper contracts or relayers.
4️⃣ Independently verify batch root updates rather than relying solely on caller identity.
Full analysis 👇
slowmist.medium.com/one-fish…
Thank you to @nypost and @vivilinsv for the interview. We’re glad to have had the opportunity to share our observations and analysis.
How North Korea's ruthless state sponsored hackers, main suspects in the $6.3B Binance heist, operate trib.al/0F2iybI
🔥 Agenda Released | 2026 HK Institutional RWA & Stablecoin Forum
On Nov 2, SlowMist and JunHe LLP will host a closed-door summit in Hong Kong to explore #RWA implementation, stablecoin payments, and institutional security and risk management.
🎤 Keynote Sessions
🔹 Keywolf (Partner & CPO, SlowMist): Security defense and #AML screening in the AI era
🔹 Jacqueline Qiao @CryptoQiao (Partner, JunHe LLP): Licensing and compliance for virtual assets and stablecoin payments in Hong Kong
💬 Key Discussion Topics
🔸 RWA tokenization and on-chain product development
🔸 Cross-border payments and financial services
🔸 On-chain incident response, fund tracing and recovery
Industry professionals from diverse sectors will come together for roundtable discussions.
📅 Nov 2 | 14:00–18:30 (GMT+8)
📍 AIA Central, Hong Kong
🙋 Register: luma.com/0p20jvw
See you in Hong Kong! 👋
🚨 SlowMist TI Alert: Trezor Hardware Wallet Supply Chain Alert 🚨
@Trezor hardware wallets have also been affected by the CryptoBilis reseller incident.
If you purchased a Trezor device from CryptoBilis since March 2026, follow Trezor’s security guidance:
⚠️ Already set up? Move your funds to a newly created wallet with a fresh seed as soon as possible.
⚠️ Do not reuse your old seed on any hardware or software wallet.
⚠️ Not yet set up? Do not use the device or enter your existing recovery phrase.
⚠️ Never share your recovery phrase with anyone.
Stay vigilant!
CryptoBilis update
We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:
Already using it?
Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.
Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.
We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.
On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far.
NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.
If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: trezor.io/support#open-chat
We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.
For more information, visit our blog: trezor.io/blog/news/implant-…
🚨SlowMist TI Alert🚨
💸 @zkLink_Official Loss: ~783.1k
🔍 Root Cause: Arbitrator.claimMessage failed to clear the transient finalizeMessageHash and require a fresh authenticated callback for each invocation. Through the publicly callable, authorized SyncL2TxHashRelayer, the attacker first populated a valid hash, then reused it while substituting EthereumGateway.sendMessage as the claim target. This executed ZkLink.syncBatchRoot under the legitimate gateway identity, installed an attacker-chosen l2LogsRootHashes root, and withdrew assets using forged proofs.
📌 Attacker: 0xaca0655a11200a80d33d0e48786317304cde5718, 0xDAB137F390dF77caA97fd492540E973fd5e2F8c8
📌 Victims: ZkLink 0x5fd9f73286b7e8683bab45019c94553b93e015cf; L1ERC20Bridge 0xad16edcf7deb7e90096a259c81269d811544b6b6
📌 Vulnerable Contract: Arbitrator 0x1ee09a2caa0813a5183f90f5a6d0e4871f4c6002 (implementation: 0x7a0bb4805ecb7fd3c8dabbe4afa0e91cb1761e34)
Powered by SlowMist.AI
Tx:
etherscan.io/tx/0x4f3c23e75b…
etherscan.io/tx/0x8a7e38b9c2…
🚨 SlowMist TI Alert 🚨
💸 Loss: ~1.013M USDC from a TranchePool reportedly associated with @ValinorDigital, Oatfi, and @fence_finance
🔍 Root Cause: At the UTC day rollover, the victim’s settlement logic treated a scheduled principal payment as received and subtracted it from the tranche’s recorded outstanding principal, despite no USDC repayment. The draw function (0x8e27c105) then checked the requested amount against funded principal − outstanding principal. That artificially restored 1.013M USDC of draw capacity, allowing the attacker to draw the same amount a second time with identical calldata.
📌 Attacker: 0x6ff1c3ffa622e1062168f3497a275be9cc2b1246
📌 Vulnerable Contract: 0xe25cb545bdd47a8ec2d08001cb5661b00d47621a
Powered by SlowMist.AI
Tx:
snowscan.xyz/tx/0x19ab145e7f…
snowscan.xyz/tx/0x3f6b23292a…