SlowMist

4K posts

SlowMist banner
SlowMist

SlowMist

@SlowMist_Team

SlowMist is a Blockchain security firm established in 2018, providing services such as security audits, security consultants, red teaming, and more.

Katılım Nisan 2018
405 Takip Edilen88.5K Takipçiler
Sabitlenmiş Tweet
SlowMist
SlowMist@SlowMist_Team·
Recently, we’ve shipped a small but solid update to the Crypto Asset Tracing Handbook! 📘✨ 📖Updated version on GitHub: github.com/slowmist/Crypt… 🚀These additions expand the handbook’s coverage of cross-chain and laundering patterns — topics that many readers have been asking for: 1️⃣More bridge explorer links🔗: • Squid • Orbiter • TeleSwap 2️⃣Two new case studies🔍: • BTC Laundering Loops via Hyperunit • Cross-Chain Source Analysis via Stargate Finance If you’ve already read the handbook, this update makes it even more actionable. If you haven’t yet — now’s a great time to dive in. 🛡️We’ll keep refining the handbook over time to make on-chain tracing knowledge accessible to everyone in the crypto ecosystem.
English
29
30
131
94.6K
SlowMist
SlowMist@SlowMist_Team·
🚨 Exploit Analysis | ShapeShift FOX Colony Authorization Trust Chain Flaw SlowMist analyzed the recent ShapeShift FOX Colony exploit on Arbitrum, where attackers abused a semantic conflict between meta-transactions and DSAuth self-call authorization to hijack the resolver and drain all ERC20 assets via malicious delegatecall. 🔍 Key Takeaways: • Arbitrary self-call in executeMetaTransaction() • DSAuth auto-trust for address(this) • Resolver hijacking through meta-tx • Full asset drain via delegatecall 🌟This incident shows how individually “reasonable” designs can combine into a complete privilege bypass chain. Developers should strictly restrict sensitive selectors in meta-transaction systems and avoid unconditional self-call authorization patterns. Full analysis👇 @slowmist/analysis-of-the-exploit-trust-chain-flaw-in-shapeshift-fox-colony-authorization-mechanism-b35a61865a80" target="_blank" rel="nofollow noopener">medium.com/@slowmist/anal…
English
0
1
13
2.4K
SlowMist
SlowMist@SlowMist_Team·
🚨 SlowMist TI Alert 🚨 MistEye has received critical threat intelligence regarding an active supply chain attack compromising node-ipc, a foundational Node.js library. The malicious releases have been identified as versions 9.1.6, 9.2.3, and 12.0.1. Threat actors injected an obfuscated credential-stealing payload into the CommonJS bundle. Once loaded, it silently harvests over 90 categories of developer data—including AWS, Azure, GCP, SSH, K8s tokens, and Terraform states—and exfiltrates it to attacker-controlled infrastructure. We have synchronized this IOC with our clients immediately. Detection & Remediation: Please urgently audit your environments for exposure: • Dependencies: Run npm ls node-ipc --all to identify direct or transitive inclusions. • Lockfiles: Search package-lock.json, yarn.lock, or pnpm-lock.yaml for the affected version ranges. • CI/CD: Review pipeline jobs executed after May 14, 2026, that may have pulled loose semver updates (~9.1.x, ^12, etc.). ⚠️ Critical Action: If a compromised version was installed, assume certain compromise. Do not wait for exfiltration confirmation. Downgrade to a known safe version immediately and aggressively rotate all credentials, tokens, and environment secrets present on the affected machine or CI runner. As always, stay vigilant! enterprise.misteye.io/threat-intelli…
SlowMist tweet mediaSlowMist tweet media
English
2
11
37
5.9K
SlowMist
SlowMist@SlowMist_Team·
🚨SlowMist TI Alert🚨 💸 @Aurellion_Labs Loss: 455,003 USDC (~$455,003) 🔍 Root Cause: Unprotected initialize(address varg0) in SafeOwnable Facet. Diamond set owner via non-initialize path without updating _initialized version slot (bytes 0-7 of 0xf0c57e...) from 0, allowing re-init by attacker to overwrite owner, call diamondCut to inject malicious facet with pullERC20, and drain approved USDC. 📌 Victim Contract: 0x0adc63e71b035d5c7fdb1b4593999fa1f296f1b2 📌 Vulnerable Facet: 0x3ca79c1cf29b8d19f7c643bb6e6bc9c49762e70f 📌 Attacker EOA: 0x9f49591a3bf95b49cd8d9477b4481ce9da68d5ca Attacker seized Diamond ownership and drained USDC from approved victims including 0x2e933518..., 0xa90714a1..., 0xeced2d37.... arbiscan.io/tx/0x19cbafae5… Powered by #SlowMist.AI
English
2
11
37
22.8K
SlowMist
SlowMist@SlowMist_Team·
🚨 MistEye TI Alert 🚨 MistEye has detected a highly sophisticated npm worm, "Mini Shai-Hulud," spreading through trusted developer projects like TanStack, UiPath, and DraftLab. The attackers hijacked GitHub credentials to publish malicious, yet seemingly legitimate, package updates. The malware injects a heavily disguised hidden script (router_init.js) that runs silently in the background of CI/CD environments (like GitHub Actions). It is specifically designed to harvest highly sensitive data, including CI/CD secrets, cloud infrastructure keys, and cryptocurrency wallets. The stolen data is then stealthily smuggled out using GitHub's own infrastructure. We have synchronized these critical IOCs with our clients. If your projects utilize the affected packages, immediate action is required: please audit your CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud, and crypto credentials, and closely monitor your development environments for any unauthorized background activity. As always, stay vigilant! enterprise.misteye.io/threat-intelli…
SlowMist tweet media
English
0
4
17
3.6K
SlowMist
SlowMist@SlowMist_Team·
🥳Excited to share that our Hong Kong Community Lead Tony Tan will be joining @0xCregis MicUp Vol 13 tomorrow! 📅 May 13 | 5:00 PM GMT+8 | Live X Space Looking forward to an insightful discussion!
Cregis@0xCregis

🎙️ Cregis MicUp Vol 13: When Agents Take the Wheel — What Does the New Era of Crypto Infrastructure Look Like? 🗓️ May 13, 2026 | 5:00 PM GMT+8 | Live X Space 🔗 Set your reminder: x.com/i/spaces/1Xxyg… AI Agents are rapidly moving from concept to execution. Across crypto, finance, payments, and security, the industry is racing to integrate AI into workflows, operations, and infrastructure with the promise of greater efficiency, automation, and intelligence. But what can Agents actually do today? Where are the real limitations? And what risks emerge when autonomous systems begin interacting with financial infrastructure at scale? Join Cregis for a forward-looking discussion on how AI Agents are reshaping crypto infrastructure and what the next era of Web3 may look like. 🎤 Meet Our Expert Panel: Tony Tan — HK Community Lead at @SlowMist_Team Constance Zhou — Marketing Manager at @InterlaceMoney @xsser_w — CEO at Tanwei Dujian Technology Mike — Chief Researcher at @NeoSoulAI 🎙️ Moderated by Bovey 📋 What We’ll Explore: 🔸 Why Is Everyone Betting on AI? Why is the industry moving so aggressively toward AI adoption? What real strategic value does AI bring to crypto infrastructure and financial systems? 🔸 What Can Agents Actually Do? Beyond the hype, what are the real capability boundaries of AI Agents today across security, payments, operations, and research? 🔸 The Enterprise Reality — Risk, Cost & AI Deployment: What challenges are companies underestimating when integrating AI? From security and permissions to operational cost and team readiness, what lessons have emerged in practice? 🔸 Living Alongside AI — Opportunities, Risks & the Future: If AI becomes deeply embedded into finance, payments, and everyday decision-making over the next decade, what could that world realistically look like for ordinary people? Why This Matters: AI is no longer just a tool — it is becoming part of the infrastructure layer itself. As autonomous systems gain more responsibility across crypto and finance, understanding both their potential and their risks becomes critical for builders, enterprises, and users alike. This session brings together voices from security, payments, AI research, and infrastructure to explore what happens when Agents begin taking the wheel. 📌 Join us 5 minutes early to secure your spot! #AI #AIAgents #CryptoInfrastructure #DigitalAssets #CyberSecurity #Payments #CregisMicUp

English
0
1
6
2.1K
SlowMist
SlowMist@SlowMist_Team·
🚨 MistEye Security Gate Officially Released｜Building Frontline Security Detection for AI Agents SlowMist has officially released MistEye Security Gate, a pre-execution security gateway Skill that provides security detection capabilities for dependency installation and domain access for mainstream #AI coding agents such as @claudeai , @cursor_ai , and @OpenAI GPT. 👉github.com/slowmist/miste… MistEye Security Gate enables: 🔹 Supply chain package risk detection (npm/pypi/go etc.) 🔹 Real-time scanning of domains/URLs/IPs/emails 🔹 File hash & malicious Skill/MCP identification 🔹 Hard blocking mechanism + daily automated inspections Core Scenarios Covered: - Dependency installation checks (requirements.txt, package.json, etc.) - External link / domain threat validation - Continuous security inspection of installed Skills How to Deploy: 1️⃣ GitHub Repo: github.com/slowmist/miste… 2️⃣ Get free API Key: app.misteye.io/api-keys 3️⃣ Set MISTEYE_API_KEY (env var preferred, or config file with 600 permission) 🛡️ Why It Matters: It cuts off #AIAgent supply chain and external interaction risks at the source, strengthening the frontline defense. Ready to make your AI Agents run more securely? Welcome to integrate MistEye Security Gate! 🔗 Full article: slowmist.medium.com/misteye-securi…
SlowMist tweet mediaSlowMist tweet mediaSlowMist tweet mediaSlowMist tweet media
English
0
8
26
7.4K
SlowMist
SlowMist@SlowMist_Team·
🚨SlowMist TI Alert🚨 💸 Loss: 140,180 USDT (140,180,175,562 tokens) 🔍 Root Cause: Missing access control in addUsers (0x4777ff62) function of PayrollDistribution. Anyone can register users for existing drop and set arbitrary totalAmount. 📌 Attacker: 0x90b147592191388e955401af43842e19faa87ee2 📌 Victim: 0xa184af4b1c01815a4b57422a3419e4fb78a96ee4 📌 Vulnerable Contract: 0xef2c77f3b9b8aaa067239bc6b4588bae26433494 Attacker registered exploit contract via addUsers in constructor, flash loaned USDT deposit, claimed oversized payroll from drop #3. Powered by #SlowMist.AI polygonscan.com/tx/0x619296d6f… polygonscan.com/tx/0xb469a24ec…
English
1
13
37
8K
SlowMist
SlowMist@SlowMist_Team·
🚨 Threat Intelligence | Analysis of a Fake TronLink Chrome Extension Phishing Campaign 🚨 SlowMist’s MistEye threat monitoring system recently detected a high-risk phishing campaign targeting #TRON wallet users. Attackers created a fake Chrome MV3 extension impersonating @TronLinkWallet, using Unicode bidirectional control characters and Cyrillic homoglyphs to spoof the brand name. Once installed, it loads a full phishing page via remote iframe — forming a “shell-core separation” credential theft chain. 🔍 Key Findings: 🔹 The extension name uses homoglyphs for disguise. Its Chrome Web Store page inherits the real extension’s high user count and positive reviews, significantly lowering review barriers. 🔹 Local code is extremely minimal — it only loads a remote page, making static analysis almost useless for detecting malice. 🔹 The remote phishing page perfectly replicates the official TronLink Web wallet UI, stealing mnemonic phrases, private keys, Keystore files, and passwords, then exfiltrating them in real time via Telegram Bot. 🔹 Built-in anti-analysis features (disables right-click, DevTools, drag-and-drop, printing) and geo/language-based redirection for Russian users to evade detection. ⚠️ This is not a simple fake extension — it employs advanced techniques like remote dynamic loading and anti-forensics, making it extremely difficult for traditional static scanners to catch. 🛡️ Immediate Actions : • Uninstall any suspicious extension (Malicious ID: ekjidonhjmneoompmjbjofpjmhklpjdd) • Official TronLink extension ID: ibnejdfjmmkpcnlpebklmnkoeoihofec • Clear localStorage and check for abnormal traffic • If credentials were entered, create a new wallet immediately and transfer assets 📖 Full technical analysis + IOCs + self-check guide here 👇 @slowmist/threat-intelligence-analysis-of-a-fake-tronlink-chrome-extension-phishing-campaign-768e8c0e8fb6" target="_blank" rel="nofollow noopener">medium.com/@slowmist/thre…
SlowMist tweet mediaSlowMist tweet mediaSlowMist tweet mediaSlowMist tweet media
English
4
12
42
12K
SlowMist
SlowMist@SlowMist_Team·
🔥 Delighted to co-host this DeFi & Fintech Security Spaces with @PureWalletPlus! In this session, we’ll dive into real-world wallet threats, military-grade offline protection, #KYT practices, and security system building. Welcome everyone to join the discussion! 👋
Larry@purewallet@LarryPureLabs

🚨 Big Security Drop Incoming (sometime this week) – Pure Wallet x SlowMist Spaces Teaser 🚨 Hey PureWallet Army! 👀 Something major is cooking… We’re teaming up with @PureWalletPlus & @SlowMist_Team — one of the top blockchain security powerhouses — for an exclusive X Spaces on Security in DeFi & Fintech. Expect deep dives into: • Real-world wallet threats & how to stay protected • Military-grade offline security in action • ISO-certified standards vs. the wild west of DeFi • Future of trust, audits, and threat intelligence This is your chance to hear straight from the experts building the most secure mobile cold storage solution in crypto. Date & time dropping very soon — Set your reminders and turn on notifications! Who’s ready to level up their security game? Drop a 🔥 below if you’re tuning in! #PureWallet #SlowMist #DeFiSecurity #CryptoSecurity #Web3 x.com/PureWalletPlus…

English
4
5
18
2.6K
SlowMist
SlowMist@SlowMist_Team·
🚀SlowMist RWA Smart Contract Security Audit Service Officially Launched！ RWA (Real World Assets) has become a major frontier where #Web3 meets traditional finance. Unlike traditional DeFi projects, #RWA security involves far greater complexity — including ownership verification, compliance governance, and on-chain/off-chain consistency. Drawing on years of blockchain security expertise, SlowMist has officially launched a specialized RWA smart contract audit service, delivering comprehensive protection across compliance, permission systems, and on/off-chain consistency. Read full announcement👇 slowmist.medium.com/slowmist-rwa-s… RWA project teams and institutions are welcome to contact us for collaboration! 🤗 📮team@slowmist.com
English
4
4
16
8.2K
SlowMist
SlowMist@SlowMist_Team·
🚨 A typical AI Agent security incident recently occurred on the Base chain. An attacker sent a carefully crafted Morse code message to @grok, inducing it to output transfer instructions. @bankrbot then directly parsed and executed those instructions, ultimately leading to the transfer of real on-chain assets. Our analysis found that the core issue was NOT that Grok held private keys. Instead, the real problem was: • Untrusted #AI natural language outputs were treated as executable financial commands • Permission isolation was insufficient • Trust boundaries between AI output and execution systems were poorly defined This incident highlights the growing security risks at the intersection of AI + Crypto Agents.⚠️ Full analysis 👇 slowmist.medium.com/behind-the-gro…
English
4
5
23
4.4K
SlowMist
SlowMist@SlowMist_Team·
🚨SlowMist TI Alert🚨 💸 Loss: ~1,291.16 ETH + ~1,268,771 USDC + ~206,282 USDT + ~16.94 WBTC @trustedvolumes 🔍 Root Cause: In fillOrder function (selector 0x4112e1c2) of RFQ Implementation, signature validation checks _allowedSigners[msg.sender][signer] using caller (taker) instead of order's maker as key, allowing registration via registerAllowedOrderSigner for attack contract and execution of forged orders for any maker. 📌 Attacker EOA: 0xc3ebddea4f69df717a8f5c89e7cf20c1c0389100 📌 Victim Contract: 0x9ba0cf1588e1dfa905ec948f7fe5104dd40eda31 📌 Vulnerable Contract: 0x88eb28009351fb414a5746f5d8ca91cdc02760d8 Attacker drained assets from custodial contract with unlimited approvals via 4 forged RFQ orders.
SlowMist tweet media
English
7
18
77
14.5K
SlowMist
SlowMist@SlowMist_Team·
🚨SlowMist TI Alert🚨 We have detected a malicious transaction exploiting a flawed EIP-7702 account, resulting in a loss of 1,988.5 $QNT (approx. 54.93 $ETH). The root cause is that the admin identity of a QNT reserve pool is held by an EOA (0xc6ddf90790b433743bd050c1d1d45f673a3413f4), which delegated its code to a `BatchExecutor` contract via the EIP-7702 mechanism. Unfortunately, `BatchExecutor` designates the permissionless `BatchCall` contract (0x044dc3e39c566a95011e272ec800dbd2cc9c057c) as an authorized caller. However, `BatchCall.batch()` is entirely open to any external caller without any permission checks. This led to an arbitrary call vulnerability, allowing the attacker to drain the $QNT tokens from the reserve pool. Exploit tx: etherscan.io/tx/0x4f31f68df… Powered by #SlowMist.AI
SlowMist tweet media
English
2
16
57
12K
SlowMist
SlowMist@SlowMist_Team·
🥳Unphishable is participating in the current @thedaofund × @Giveth Ethereum Security Quadratic Funding round! If you care about #Web3 security and want to help users stay safe from phishing scams, please consider supporting us.🫶 Unphishable (unphishable.io) is a free, browser-based phishing simulation platform with 30+ realistic challenges. Train to detect real-world attacks like seed phrase scams, fake airdrops, malicious approvals, fake job interviews, and more — all in a safe, gamified environment (MetaMask testnet only). Built jointly by @DeFiHackLabs,@realScamSniffer, and @SlowMist_Team 🙌 It’s quadratic funding, which means small donations get massively amplified by the matching pool. Even a modest contribution can have a huge impact! 🔥 👉 Support Unphishable here: qf.giveth.io/project/unphis… Big thanks to @1nf0s3cpt for the collaboration and strong support!🥰🛡️
English
2
1
17
6.3K
SlowMist
SlowMist@SlowMist_Team·
🚨. @ZetaChain has been exploited. Based on initial analysis, the following outlines the root cause. Root Cause The core vulnerability lies in the call function of ZetaChain's GatewayZEVM contract, which lacks both access control and input validation. This allows any arbitrary user to invoke cross-chain calls through GatewayZEVM and execute arbitrary operations on external chains via the relayer. Specifically, an attacker can craft a malicious call on ZetaChain to emit a cross-chain event. ZetaChain's relayer picks up this event and, through TSS, executes the malicious call on the destination chain — enabling the attacker to drain funds. Transactions: zetascan.com/tx/0xdaa19f995… etherscan.io/tx/0x81fc9b245…
SlowMist tweet media
ZetaChain 🟩@ZetaChain

There was an attack against the ZetaChain GatewayEVM contract today that impacted the internal ZetaChain team wallets only. We've already blocked the attack vector so no more funds can be compromised and will be releasing a detailed post mortem after we have completed our investigation. As a precaution cross-chain transactions are currently paused on ZetaChain. Investigation is still ongoing and at this time no user funds were impacted by this attack. The current status can be tracked at status.zetachain.com.

English
12
25
84
24.8K
SlowMist
SlowMist@SlowMist_Team·
🚨 SlowMist TI Alert 🚨 MistEye has monitored threat intelligence regarding a sophisticated supply chain campaign targeting official Checkmarx distribution channels. The attack involved maliciously overwriting tags in the checkmarx/kics Docker Hub repository and injecting remote payload execution logic into specific extension versions, including checkmarx/cx-dev-assist (1.17.0, 1.19.0) and checkmarx/ast-results (2.63.0, 2.66.0). This campaign specifically aims to exfiltrate developer and cloud credentials to obtain GitHub and npm tokens for lateral propagation. Consequently, this propagation has led to the compromise of the @bitwarden/cli@2026.4.0 package, which now contains a malicious file named bw1.js. These IOCs have been synchronized with clients immediately. It is advised to avoid unverified checkmarx/kics Docker images and strictly refrain from using the compromised extension or CLI versions mentioned above. Immediate auditing of development environments and rotation of any potentially exposed credentials or tokens is strongly recommended. As always, stay vigilant! enterprise.misteye.io/threat-intelli… enterprise.misteye.io/threat-intelli…
SlowMist tweet mediaSlowMist tweet media
English
3
9
21
12K

Keşfet

@Aurellion_Labs @0xCregis @claudeai @cursor_ai @OpenAI @TronLinkWallet @LarryPureLabs @PureWalletPlus