SlowMist founder Cosine posted on social media that there is no problem with the Safe contract, the problem is in the non-contract part, the front end is tampered with and forged to achieve the effect of deception. This is not an isolated case. North Korean hackers have succeeded in this method several times last year, such as the WazirX incident (stolen $230 million, Safe multi-signature), Radiant Capital incident (stolen $50 million, Safe multi-signature), DMM (stolen $305 million, Gonco multi...
Slow Mist Technology Chief Information Security Officer 23pds said on the X platform that Bybit attackers took away safe owner privileges in a forged signature attack. It is speculated that more than one macOS or Windows computer must have been charged, and the attacker may have stayed on the intranet for a while, able to monitor internal chat, transfer time and other information.
SlowMist said on the X platform that the following are some details of the Bybit hackers: - The malicious implementation contract was deployed at 7:15:23 UTC 2025-02-19: 0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516; 2025-02-21 14:13:35 UTC, the attacker used three owners to sign a transaction to replace the Safe implementation contract with a malicious one: 0x46deef0f52e3a983b67abf4714448a41dd7ffd6d32d32da69d62081c68ad7882; - malicious upgrade logic is embedded in STORAGE [0x0] via DELEGATECALL: 0...
According to a report by SlowMist, the security team has detected potentially suspicious activity related to BOLT tokens, and SlowMist warns users to remain vigilant.
SlowMist Cosine posted on the X platform that the Mode network has taken action to freeze most of the stolen assets of the Ionic Money project. The currently frozen Mode wallet holds $8.80 million of stolen funds, limiting the loss in capital transferred across the chain to outside the Mode network to $3.50 million. The funds that were not intercepted have been transferred through the coin mixing protocol Tornado Cash.
According to SlowMist founder Cosine Monitor, Starknet's on-chain lending protocol zkLend was hacked on February 12, losing more than $9.50 million. The reason for the attack is that the safeMath library used in its market contract uses direct division when performing division calculations, resulting in a rounding vulnerability in the number of zTokens that actually need to be destroyed when calculating withdrawals. The attacker is taking advantage of this vulnerability to profit. The on-chain d...
SlowMist Cosine posted on the X platform that hackers have transferred zkLend stolen funds from the Starknet network to other networks, with most of the funds flowing to the Ethereum network.
On February 11, SlowMist issued a security warning, detecting potentially suspicious activity related to the contract 0xB5486F71... 8F47834D90B1B on the Base chain. The contract has been upgraded to an implementation contract with a backdoor function transferTokens. Attackers use this function to steal user assets that have previously approved the contract. Please revoke the authorization of this contract ASAP.
According to blockchain security firm SlowMist on the X platform, fraudsters are using fake Cloudflare verification pages to induce users to execute malicious code. In addition, a scam called "Safeguard" has appeared on Telegram, and users need to be vigilant. SlowMist advises users to install trusted antivirus software such as AVG, Bitdefender or Kaspersky to enhance security protection.
Crypto security agency SlowMist has issued a security alert, saying it has detected potentially suspicious activity related to Cashverse and urging users to remain vigilant. On-chain data can be seen, involving multiple large transfer transactions of BNB and ADAcash tokens.