SlowMist

4K posts

SlowMist

@SlowMist_Team

SlowMist is a Blockchain security firm established in 2018, providing services such as security audits, security consultants, red teaming, and more.

Katılım Nisan 2018

405 Takip Edilen87.8K Takipçiler

Sabitlenmiş Tweet

SlowMist@SlowMist_Team·8 Ara

Recently, we’ve shipped a small but solid update to the Crypto Asset Tracing Handbook! 📘✨ 📖Updated version on GitHub: github.com/slowmist/Crypt… 🚀These additions expand the handbook’s coverage of cross-chain and laundering patterns — topics that many readers have been asking for: 1️⃣More bridge explorer links🔗: • Squid • Orbiter • TeleSwap 2️⃣Two new case studies🔍: • BTC Laundering Loops via Hyperunit • Cross-Chain Source Analysis via Stargate Finance If you’ve already read the handbook, this update makes it even more actionable. If you haven’t yet — now’s a great time to dive in. 🛡️We’ll keep refining the handbook over time to make on-chain tracing knowledge accessible to everyone in the crypto ecosystem.

English

122

86.6K

SlowMist@SlowMist_Team·5d

🔍 SlowMist Security Assessment 📑 After a dedicated security audit and wallet sensitive information detection, the #OKX Web3 @wallet has been verified to NOT transmit private keys or mnemonic phrases to any external servers. ✅ Detection content: Whether the app sends the private key or mnemonic to an external server ✅ Whether to leak sensitive information: Not Found 🧩 Versions: 🔹 iOS: 6.150.0 🔹 Android: 6.150.0 🔹 Extension: 3.83.0 🔹 Commit: 541d37b00da13591568f8436a7112f0beff642b0 📄 Full Statement: github.com/slowmist/Knowl… ⚠️ Note: This conclusion applies only to the audited version and provided information at the time of review.

English

57.4K

SlowMist@SlowMist_Team·6d

⚠️ In crypto #AML vendor selection, the same address often gets wildly different risk scores — not a bug, but a result of data sources, labeling, models & fund flow analysis. 🔹 To address this problem, We launches the Crypto AML Vendor Evaluation Checklist & Implementation Guide, turning subjective selection into data-driven decisions.✨ 👋Looking for the complete execution steps? Check here👉github.com/slowmist/crypt…

English

3.1K

SlowMist@SlowMist_Team·2 Nis

🚨 SlowMist TI Alert 🚨 Drift Protocol has suffered a major exploit, with losses exceeding $200M. One week prior, the protocol migrated to a 2/5 multisig (1 old + 4 new signers) without a timelock. A few hours ago, the attacker gained admin control, minted fake CVT tokens, manipulated the oracle, disabled security mechanisms, and drained high-value assets from the pool. 🔗 Hacker address cluster: app.cielo.finance/bundles/216/wa… At present, the stolen funds have largely been consolidated into the following Ethereum addresses: 0x0fe3b6908318b1f630daa5b31b49a15fc5f6b674 0xd3feed5da83d8e8c449d6cb96ff1eb06ed1cf6c7 0xaa843ed65c1f061f111b5289169731351c5e57c1 Total: 105,969 $ETH (~$226M) We are actively tracking this incident.

Omer Goldberg@omeragoldberg

** Correction on key compromise ** A week ago, Drift moved to a new multisig, created by a signer from the old multisig. This signer did not add themselves to the new one. The exploiter also initiated the proposal in the old multisig to hand over admin control to this new wallet. Of the 5 signers on the new multisig, only 1 came from the previous setup; the other 4 were brand-new. The wallet was set with a 2/5 threshold and a 0-second timelock. ~Five hours ago, that sole carryover signer used the new multisig to propose changing Drift’s admin. One of the new signers co-signed a second later, instantly meeting the 2/5 threshold. With no timelock in place, the transaction was executed immediately. ** Note ** Some of the relevant Solana programs are not verified, which limits full analysis. We're continuing to dig into the onchain data and will publish a more thorough post-mortem covering the multisig migration, Solana DeFi contagion, and vault exposure in a follow-up.

English

17K

SlowMist@SlowMist_Team·1 Nis

We’re excited to share that our Partner & CPO, Keywolf, will be speaking at #Web3Festival in Hong Kong 🇭🇰 See you at #Web3Festival ！👋 🗓️ April 20–23 📍 HKCEC 🔗 luma.com/hkweb3festival…

Web3Festival@festival_web3

We're thrilled to announce Keywolf, @SlowMist_Team's Partner and CPO, as a speaker for #Web3Festival. Join us in Hong Kong, where we bring together Web3 professionals, investors, and enthusiasts across the globe to connect, learn and be inspired. 🗓️20-23, April |📍HKCEC 👉luma.com/hkweb3festival…

English

2.5K

SlowMist@SlowMist_Team·31 Mar

🚨 SlowMist TI Alert 🚨 Please check for Malicious Versions of #axios 1.14.1 / 0.30.4 and Historical Exposure Risk from global #OpenClaw npm Installation. As of March 31, 2026, open-source intelligence indicates that axios@1.14.1 and axios@0.30.4 have been confirmed as malicious versions. Both contain an extra dependency, plain-crypto-js@4.2.1, which can deliver cross-platform malicious payloads via its postinstall script. 1️⃣/ The impact on OpenClaw needs to be assessed per scenario: 1) Source Build Scenario: Not Affected 🤖 👉 Lock files in v2026.3.28 actually lock axios@1.13.5 / 1.13.6, which are not malicious versions. 2) npm install -g openclaw@2026.3.28 Scenario: Historical Exposure Risk Exists 🔍 👉 This is because the dependency chain includes: openclaw -> @line/bot-sdk@10.6.0 -> optionalDependencies.axios@^1.7.4 During the time window when the malicious versions were online, axios@1.14.1 could have been resolved. 3) Current Reinstallation Result: npm now resolves to axios@1.14.0 🧩 👉 However, environments that installed within the attack window should still be treated according to the affected scenario, and IoC checks are recommended. 2️⃣/ Reference for Checks ✅ Check for malicious versions and modules first: npm list axios 2>/dev/null | grep -E "1.14.1|0.30.4" grep -A1 '"axios"' package-lock.json 2>/dev/null | grep -E "1.14.1|0.30.4" ls node_modules/plain-crypto-js 2>/dev/null && echo "POTENTIALLY AFFECTED" ✅ If OpenClaw was installed globally, also check the global path: npm root -g npm ls -g openclaw axios plain-crypto-js @ line/bot-sdk --depth=4 3️⃣/ Known IoC Path Checks #macOS ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "COMPROMISED" #Linux ls -la /tmp/ld.py 2>/dev/null && echo "COMPROMISED" #Windows (cmd.exe) dir "%PROGRAMDATA%\wt.exe" 2>nul && echo COMPROMISED 4️⃣/ Additional Notes If the plain-crypto-js directory exists, even if its package.json has been cleaned, it should still be treated as a high-risk execution trace. ⚠️ For hosts that executed npm install or npm install -g openclaw@2026.3.28 within the attack window, immediate credential rotation and host-side investigation are recommended.

SlowMist@SlowMist_Team

🚨 Another major supply chain incident 🚨 axios — one of the most widely used npm packages — has been compromised. Malicious versions axios @1.14.1 and axios@0.30.4 were published and are actively dropping malware. The attack pulls in a newly created dependency plain-crypto-js@4.2.1, confirmed as a malicious loader: it executes obfuscated payloads, runs shell commands, and attempts to evade detection while wiping traces. With 100M+ weekly downloads, this is a live, large-scale supply chain attack. More details: stepsecurity.io/blog/axios-com…

English

11.8K

SlowMist@SlowMist_Team·31 Mar

🚨 Another major supply chain incident 🚨 axios — one of the most widely used npm packages — has been compromised. Malicious versions axios@1.14.1 and axios@0.30.4 were published and are actively dropping malware. The attack pulls in a newly created dependency plain-crypto-js@4.2.1, confirmed as a malicious loader: it executes obfuscated payloads, runs shell commands, and attempts to evade detection while wiping traces. With 100M+ weekly downloads, this is a live, large-scale supply chain attack. More details: stepsecurity.io/blog/axios-com…

Feross@feross

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios @1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

English

309

128.4K

SlowMist retweetledi

Kong'@TycheKong·27 Mar

0x03D8096377Ea7683d840E395d72439F7B6415Abe was exploited. Power by SlowMist AI 👇 bscscan.com/tx/0x96c9ce3c5… Attack Overview Attack Type: Oracle Manipulation (AMM Spot Price Manipulation) + Staking Reward Distribution Logic Flaw (Missing rewardDebt update) + EIP-7702 Account EOA Restriction Bypass Victim Contract: Stake (0x03d8096377ea7683d840e395d72439f7b6415abe) Attacker Address (EIP-7702): 0xc93a5ab3737081f00788b61da42281955d3df692 Helper Accounts (EIP-7702): 0xfd11c78a2ffc9102080f1accfb2c9cd2ce2aceab, 0x9007983c0b1db337e3c0ff29771027b8e2be550b Total Profit: Approximately 209,793 USDT (133,490 USDT secured by 0xef670d9c2e24d1788f39ad35c70f4cc51b4e5898 and 76,303 USDT by 0x972bfaae4093baf00bd5b4db2e11d143adc16f97) Flash Loan Source: Moolah Protocol (0x8f73b65b4caaf64fba2af91cc5d4a2a1318e5d8c), borrowing 1,900,000 USDT Root Cause Analysis Primary Vulnerability — Missing rewardDebt Update During Referral Reward Distribution Contract: Stake (0x03d8096377ea7683d840e395d72439f7b6415abe) Function: _distributeRefPower(address user, uint256 power) Secondary Vulnerability — Price Oracle Utilizing AMM Spot Price Contract: Stake (0x03d8096377ea7683d840e395d72439f7b6415abe) Functions: getPowerAmount(uint256 amount) → getTURPrice() / getNobelPrice() Both price sources rely on getReserves() (AMM spot price), which can be manipulated via flash swaps or large-scale swaps within a single transaction. This allows the attacker to artificially inflate the _power value calculated by getPowerAmount(), thereby magnifying the amount of power distributed to referrers via _distributeRefPower.

English

9.2K

SlowMist@SlowMist_Team·27 Mar

🎉🎉 We’ve officially upgraded our #Web3 Annual Security Service Framework — moving from one-time audits to continuous, AI-powered, full-lifecycle protection. What’s new👇 • From fixed delivery → dynamic, on-demand security • From single audits → customized, full-stack security systems • From manual analysis → AI-driven threat detection & response 🔁 Pre · During · Post — a complete security loop 🤖 AI-powered stack: MistAgent · MistEye · MistTrack 🛡️ From design → launch → long-term operations Security is no longer an action. It’s a capability that evolves with your project.💪 From #DeFi to #AIAgents — we’ve got you covered.🫡 If you’re interested in customized service plans or pricing, feel free to reach out anytime. 📮👉team@slowmist.com 📖 Read more: slowmist.medium.com/comprehensive-…

English

7.1K

SlowMist@SlowMist_Team·26 Mar

🚨 Security Alert: Supply Chain Attack on Apifox Desktop Client Yesterday, we detected a supply chain attack in which a front-end script file hosted on #Apifox’s official CDN was injected with heavily obfuscated malicious JavaScript code. ⚡ Impact on Apifox Desktop Client (Electron-based): Once loaded, the script can: 🔹 Silently steal credentials 🔹 Exfiltrate sensitive data 🔹 Execute remote commands (RCE) — no user interaction required 🛑 What’s at risk? • 🔑 accessTokens & account credentials • 💻 Local system & environment data • 📡 API requests & sensitive context • 🕵️ Persistent remote control via C2 ⚠️ Why this is dangerous: The malicious code is appended to legitimate analytics logic and automatically executed at runtime, making it highly stealthy and difficult to detect. 👥 Who may be affected: Apifox desktop users, especially those with: • Stored tokens • API integrations • Active development environments 🛠️ What to do now: ✅ Revoke all tokens & reset passwords ✅ Log out & re-login to invalidate sessions ✅ Block *.apifox.it.com ✅ Clear localStorage (_rl_headers, _rl_mc) ✅ Review API logs & abnormal activity 📖 Read more: 👉 @slowmist/security-alert-supply-chain-attack-on-apifox-desktop-client-via-compromised-official-cdn-script-bc3870992564" target="_blank" rel="nofollow noopener">medium.com/@slowmist/secu…

English

4.4K

SlowMist@SlowMist_Team·26 Mar

🚨 SlowMist TI Alert: Overpowered Memory Layer Detected 🚨 We’ve identified potential privacy risks in the project Acontext (Agent Skills as a Memory Layer, 3.2k⭐): github[.]com/memodb-io/Acontext. While convenient, it automatically uploads all local conversations to its cloud for analysis, even sensitive data like mnemonics, storing them in plaintext. Claude Code/OpenClaw can install and use it directly, repeating this process every update. ⚠️ Although a collection switch exists, data collection is enabled by default — this poses serious privacy risks. 🛡️ If you’ve installed the SlowMist Agent Security Skill, such risks can be detected: github.com/slowmist/slowm… 💡 With Skills multiplying rapidly, privacy and security vary widely — always discuss with your Agent before installation. cc @evilcos

English

2.9K

SlowMist@SlowMist_Team·25 Mar

🚨 SlowMist TI Alert: LiteLLM Supply Chain Attack The widely used LLM routing library #LiteLLM (~97M monthly downloads) was recently reported to be affected by a PyPI supply chain attack. A suspected malicious version (1.82.8) may lead to sensitive data exposure upon installation. ⚠️ Potential impact includes: • SSH keys • Cloud credentials (AWS / GCP / Azure) • Kubernetes configs • Git credentials & API keys • Shell history, database passwords, crypto wallets, etc. Notably, the risk may be triggered automatically via a .pth mechanism during Python startup, meaning no explicit function call is required in certain cases. 💥 Potentially affected scenarios: • Direct installation of LiteLLM • Projects depending on LiteLLM • Indirect dependencies (e.g. AI tooling ecosystems) • Shared environments or containers 🔍 Suggested check: pip show litellm If version = 1.82.8, further investigation is recommended. There are reports suggesting possible large-scale data exposure and credential leakage, though the full scope is still being assessed. 🛑 Recommended actions: • Remove or replace the affected version • Rotate relevant credentials as a precaution • Review logs, access records, and sensitive data usage Stay vigilant!

23pds (山哥)@im23pds

每月下载量高达 9700 万次的 LiteLLM 发生 PyPI 供应链攻击：通过 pip install litellm 即可窃取敏感信息，包括 SSH 密钥、云凭据（AWS/GCP/Azure）、Kubernetes 配置、Git 凭据、环境变量（API 密钥）、Shell 历史、加密钱包及数据库密码等。

English

5.6K

SlowMist@SlowMist_Team·25 Mar

🛠️ Update: SlowMist Agent Security Skill v0.1.2 is now live! This release focuses on improving the report template output — making it more clean, concise, and easier to read for better security insights. A small update, but a meaningful step toward a smoother analysis experience. 🔗 Try it on ClawHub: clawhub.ai/slowmist/slowm… 🔗 GitHub: github.com/slowmist/slowm…

SlowMist@SlowMist_Team

⚠️ As AI Agents shift from "assistive tools" to "autonomous executors", traditional security fails against "cognitive-layer hijacking" like prompt injection and malicious code. How can an AI Agent determine what is truly SAFE? In response, we officially introduce SlowMist Agent Security Skill — a comprehensive security review framework built on real-world adversarial experience. 👉 github.com/slowmist/slowm… 🔅 It empowers AI Agents to: 🔹 Skill/MCP Risks – Detect malicious patterns before installation 🔹 Supply Chain Threats – Identify runtime secondary downloads & build-time injection 🔹 Social Engineering – Defense against prompt injection & pseudo-authority traps 🔹 Code Vulnerabilities – #Audit GitHub repos for exfiltration & backdoors 🔹 On-Chain Risks – Integrated #AML risk assessment 🛡️ Core Defense Libraries: 🔸 patterns/red-flags.md: Code-level dangerous patterns (11 categories) 🔸 patterns/social-engineering.md: Social engineering, prompt injection, and deceptive narratives (8 categories) 🔸 patterns/supply-chain.md: Supply chain attack patterns (7 categories) 🤝 Synergy with @MistTrack_io: When combined with MistTrack Skills, it creates a closed loop from "behavioral logic review" to "fund flow monitoring," leveraging 400M+ address labels. 🛠️ How to Deploy? 1️⃣ Download: Get the latest release from GitHub & extract to your #OpenClaw workspace. 2️⃣ Activate: Automatically triggers when agents encounter external inputs (Skills, URLs, Addresses). 3️⃣ Standardize: Generates structured risk reports (🟢 Safe / 🟡 Caution / 🔴 High / ⛔ Reject) using built-in templates. ✨ Usage Examples: "Analyze this Solana address for AML risks before I interact." "Review this document for potential prompt injection attempts." Ready to make your #AI Agents safer and smarter? Integrate SlowMist Agent Security Skill today and build trust into every autonomous action. 🔗Learn more: slowmist.medium.com/slowmist-agent…

English

13.8K

SlowMist@SlowMist_Team·24 Mar

English

9.6K

SlowMist@SlowMist_Team·24 Mar

🚨 Security Alert 🚨 According to @CPOfficialtx, the domain of the once privacy-focused Bitcoin wallet #SamouraiWallet (samouraiwallet[.]com) — previously seized by the FBI in Aug 2025 — has now been taken over by scammers and is being used to host #phishing infrastructure targeting $BTC users. Our analysis shows the domain was hijacked earlier this month, and the current services are no longer related to the original project. ⚠️ We also identified suspicious activity under its subdomains, including: jinduyulechangbeiyongwangzhi.samouraiwallet[.]com This subdomain previously hosted malicious samples, including trojanized PDFs (e.g. “Cryptocurrency Mining For Dummies”), likely used to deliver malware. Additional notes: 🔹 Domain is registered via privacy protection — current owner unknown 🔹 Multiple users have reported the phishing site to NameCheap, but no action yet 🛑 Stay alert!

English

3.7K

SlowMist@SlowMist_Team·19 Mar

Analyzed by SlowMist AI👇 1️⃣ Attack Overview 🔍 💥 Attack Type: Missing Access Control leading to malicious burn of LP pool tokens, causing extreme AMM price distortion followed by arbitrage 🎯 Victim Contract: ShiMama/Shibaba LP Pool (0x564cb2bae0b35cfc8c77d94d65015fe898f8f927) 🧑‍💻 Attacker Address: 0xd10880e7591e30a336b28a5855f0ccb4b8c7c8e9 (EOA) 📦 Attack Contract: 0xcf7380462b7ca3e9f1717d17372eb093bf87f8d5 (Dynamically deployed in this transaction) 💰 Profit Amount: Approx. 52.98 WBNB (Net profit, after deducting 30.78 shimama token cost and gas) 2️⃣ Root Cause of Vulnerability 🧠 📄 Contract: ShiMamaProtocol (0x5049d10378356fde0b44c93fa7bb75836f10b49a) ⚙️ Function: executePairBurn(uint256 referenceIn, uint256 minPullFromPair, uint256 deadline) ❗ Defect: This function lacks any form of access control, allowing any external address to call it. The attacker can pass an arbitrarily large referenceIn parameter, combined with pairBurnBpOnSell = 10000 (100% burn ratio), to forcefully extract and burn almost all shimama tokens from the LP pool in one go. 📉 This causes the shimama balance in the LP pool to approach zero, leading to an extreme distortion in the AMM pricing mechanism—allowing the attacker to swap out a large amount of shibaba tokens for arbitrage using a very small amount of shimama. 3️⃣ Critical Vulnerability Code as shown in the figure below. 💻 4️⃣ Attack Step Sequence 🧩 🚀 Preparation Phase (Off-chain): The attacker EOA 0xd108... pre-holds approximately 30.78 shimama tokens. 🔗 On-chain Execution: 🔹Deploy Attack Contract 🔹Query Flash Loan Amount + Approve Repayment 🔹Initiate Flash Loan (≈374,585 WBNB) 💸 🔹Callback: Acquire shimama Tokens 🔹Callback: Query LP Pool shimama Balance 🔹Execute executePairBurn (Core Exploit) 🔹Arbitrage Swap (shimama → shibaba → WBNB) 🔹Extract Profit (~52.98 WBNB) 🔹Repay Flash Loan 🔹Result: LP pool loses massive liquidity (shimama + shibaba). Attacker nets ~52.98 $WBNB 5️⃣ Analysis Confidence Statement 📊 ✅ High Confidence (Code Verified) ✅ High Confidence (Trace Verified) ⚠️ Medium Confidence (Some inferred steps, non-critical) 🛡️ Takeaway: Missing access control + extreme parameter settings = catastrophic LP manipulation risk Stay safe.

Bythos@bbbb

bscscan.com/tx/0x13959bc1e…

English

7.9K

SlowMist@SlowMist_Team·18 Mar

🦞 Following our previous v2.7 release, OpenClaw Security Practice Guide v2.8 Beta is now live. ⤴️ v2.8 Beta has been validated through hundreds of hours in production, but is still actively evolving. It now covers the latest models including #Gemini / #Opus / #Kimi / #MiniMax / #GPT. 👉 v2.7 remains the stable version — use v2.8 if you want the latest enhancements: github.com/slowmist/openc… Key upgrades vs v2.7: 🤖 Agent-assisted deployment workflow (5-step automation) 🛡️ --light-context Cron anti-hijacking 📝 Hardened inspection script standards 📂 Persistent reports at $OC/security-reports/ + 30-day rotation 🔄 Post-upgrade baseline rebuild process 🔍 Enhanced code audit protocol ⚡ Token optimization (pre-filter in Bash before LLM) 🧠 7 real-world lessons learned (timeouts, model choice, false positives, etc.) ⚠️ Please read the README carefully before use.

SlowMist@SlowMist_Team

⚠️ Running an AI Agent like @openclaw with root/terminal access is powerful but inherently risky. How do we ensure controllable risk and auditable operations without sacrificing capability? Recently, we released the OpenClaw Security Practice Guide — a structured defense matrix designed for high-privilege autonomous agents running in Linux Root environments. cc @evilcos 📖GitHub Version: 👉github.com/slowmist/openc… 🛡️ 3-Tier Defense Matrix 🔹Pre-action — Behavior blacklists & strict Skill installation audit protocols (Anti-Supply Chain Poisoning) 🔹In-action — Permission narrowing & Cross-Skill Pre-flight Checks (Business Risk Control) 🔹Post-action — Nightly automated explicit audits (13 core metrics) & Brain Git disaster recovery 🛠️ Built around four core principles: • Zero-friction operations • High-risk requires confirmation • Explicit nightly auditing • Zero-Trust by default 🚀 Zero-Friction Flow: 1️⃣ Drop the guide directly into your #OpenClaw chat 2️⃣ Ask the Agent to evaluate reliability 3️⃣ Instruct it to deploy the full defense matrix 4️⃣ Use the Red Teaming Guide to simulate an attack and ensure the Agent correctly interrupts the operation 🚨 Honest limitation: this guide is intended for human operators and AI Agents with foundational Linux system administration capabilities, and is particularly designed for OpenClaw operating in high-privilege environments. As AI models and their underlying service environments vary, the security measures provided in this guide are for defensive reference only. Final responsibility always remains with the human operator. Please assess and execute cautiously based on your own environment and capabilities. 🤝 If you have new findings, lessons learned, or improvement suggestions from real-world deployment, we welcome you to share them with the community via Contributions, Issues, or Feature Requests. Special thanks to @leixing0309 for the professional contribution. As we continue unlocking #AI capability, may we remain vigilant and clear-headed about risk.🫡

English

11.1K

SlowMist@SlowMist_Team·18 Mar

We’re currently assisting @more_login with the investigation. Good news: together with relevant platforms, a portion of the funds has been successfully frozen. 🛑 The investigation is still ongoing—please stay tuned for official updates.

MoreLogin Browser@more_login

We are currently analyzing the 76 reported user theft cases we have accumulated. Progress is as follows: 1. The installed client versions are dispersed. By comparing the client versions used by users with the official client Hash, no abnormalities were found, ruling out client-side issues. 2. 88% of affected users (67 people) did not enable the extension sharing setting, and all extension data is stored locally on users’ devices. This rules out the possibility of data storage server compromise. We have contacted @SlowMist_Team and are conducting a joint investigation. We will provide further updates as progress is made. In the meantime, we strongly advise all users not to store large amounts of cryptocurrency in browsers.

English

5.6K

SlowMist@SlowMist_Team·18 Mar

🚨 AI is trading for you now. But is your money safe? Proud to collaborate with @bitget, @Bitget_zh on our latest research: #AI Agents> 🎉🎉 ⚠️ Prompt injection can hijack trading decisions 🔌Malicious plugins can steal your data & keys 🔑Leaked API = full account execution access 🤖One wrong autonomous action = real asset loss In #Web3, mistakes are irreversible. Protect your funds before it’s too late. We present a 5-layer security framework + practical checklists for users & devs. 🛡️ Dive in 👉 slowmist.medium.com/slowmist-bitge…

English

51.4K

SlowMist@SlowMist_Team·13 Mar

@jeffsecurity Thanks for the shoutout! Hope it helps more people use OpenClaw more securely.🤗

English

255

Jeff Security@jeffsecurity·12 Mar

Planning to use OpenClaw? Make sure you read this safety guide from SlowMist first!!! github.com/slowmist/openc…

English

6.2K

SlowMist@SlowMist_Team·13 Mar

SlowMist KYT equips VASPs with the tools to stay ahead of regulatory requirements and structural risks, turning reactive compliance into proactive, auditable #AML operations.💡 🚀 Deployment Options: • Starter Plan — Early-stage teams, < $1 per check, up to 3 members • Enterprise Plan — Rapid-growth platforms, tiered pricing, up to 10 members 🤝We welcome interested organizations to contact us for trial inquiries and procurement! 👉Email: kyt@slowmist.com

English

1.9K

SlowMist@SlowMist_Team·13 Mar

6️⃣Stablecoin Ecosystem Risk Monitoring Handling #stablecoins? SlowMist KYT keeps you one step ahead. 🚀 🔄 Fully automated continuous screening ⏱️ Monitors every blockchain transaction in real time 💰 Detects high-risk exposure during issuance, redemption & large transfers 🌐 Gives issuers & regulators a complete view of the risk landscape 💡 Stay proactive, spot risks early, and protect your stablecoin ecosystem

English

1.8K

SlowMist@SlowMist_Team·13 Mar

⚠️ With crypto adoption growing and stablecoins accelerating cross-border fund flows, VASPs face increasingly complex #AML & #KYT challenges. 🎉🎉🎉We're thrilled to announce our new product: SlowMist KYT, transforming years of blockchain intelligence into a full-lifecycle compliance system 👋For more detailed industry insights and AML trends, read our latest report: slowmist.medium.com/the-cat-and-mo…

English

10.5K

Keşfet

@wallet @evilcos @MistTrack_io @CPOfficialtx @more_login @bitget @Bitget_zh @jeffsecurity