BitsLab

Securing and Building EMERGING Web3 Ecosystems
☂️ @MoveBit_ | @ScaleBit_ | @TonBit_

[MoveBit @MoveBit_]

🚀Move Web IDE — latest release✅

Auto Completion is now live in the LSP WASM build.

Get contextual suggestions as you type — keywords, variables, functions, structs, modules, and more.

View symbol types, icons, signatures, and type details in the suggestion popup.

🔘Press Enter or Tab to complete.

No install. No setup. Open and code.🙌
🔗https://t.co/CGVTaQILhl

#Sui #Move #Web3 #DevTools

[MoveBit @MoveBit_]

🚀 Move Web IDE — new release

Outline View is now live in the LSP WASM build. Browse Move modules, structs, and functions from a single panel — pinned to the bottom-left of the editor.

No install. No setup. Open and code.
🔗 https://t.co/xfyUkBM77o

#Sui #Move #Web3 #DevTools

[Claw Wallet @clawwalletcc]

The future of crypto isn't humans clicking "Confirm."
It's agents executing on your behalf.

But here's the problem: every AI agent today asks you
to hand over your private keys. That's not autonomy —
that's surrender.

Claw is built differently:

🔐 Key-sharding — no single point of failure, not even us
🤖 Policy-driven controls — agents act within limits you define
🛡️ Anti-phishing at the wallet layer — not your job to spot the scam
⛓️ Multi-chain, gasless, swap-routed across the best DEX aggregators

The agent economy is coming.
The wallets we use today weren't built for it.

Claw was.
→ https://t.co/VCtPbCBwoD

#AIAgents #Web3 #CryptoWallet #DeFi

[BitsLab @0xbitslab]

https://t.co/YONjwrRxvA

[BitsLab @0xbitslab]

Tweet 12/12
📄 Full technical write-up:
https://t.co/vH07LtpBnA
CVE: CVE-2026-33654
Affected: nanobot ≤ 0.1.4.post5
For ongoing AI × Web3 security research from @BitsLabHQ, follow us 👇
https://t.co/t6gCBlx7tY

[BitsLab @0xbitslab]

🚨 BitsLab Research: One forged email is enough to hijack a nanobot agent.

No clicks. No user interaction. No prior access.
We disclosed CVE-2026-33654 — a zero-click Indirect Prompt Injection chained with Authentication Bypass in the Email Channel.

Here's how it works 🧵👇

[BitsLab @0xbitslab]

Tweet 11/12

Architectural takeaway for every AI Agent framework:
Email, Webhooks, RSS — any async channel — cannot rely on claimed identity. They need cryptographically verifiable signals at the boundary.

Trust must be earned at the door, not inherited from a header string.

[BitsLab @0xbitslab]

Root cause stack:
🔴 Data structure ambiguity (supplemental vs full)
🔴 Fixed-offset parsing without flag validation
🔴 No binding between amounts and proof hash

Bridges aren't only vulnerable to logic bugs anymore. The next frontier is semantic mismatch between source and destination chains.

Stay safe on-chain.

[BitsLab @0xbitslab]

🚨 INCIDENT REPORT — Verus-Ethereum Bridge

$11.58M drained in a single transaction.

ETH 1,625.37 · tBTC 103.57 · USDC 147,658

Not a signature bug. Not a reentrancy.
It was a data-structure ambiguity that let the attacker walk through proof verification untouched.

BitsLab breakdown 👇

[BitsLab @0xbitslab]

The attacker took it one step further.

They crafted the trailing reserveTransfers bytes so that — when the contract misreads them at the wrong offset as "hashReserveTransfers" — the value matches:

keccak(serializedTransfers)
= 0x00a37ecd...3d964581

Verification passes. Funds released.