GoPlus Security 🚦

Protect Your Every Transaction.
User App: 🛡️
Dev Integration: Security Intelligence & SafeToken Protocol 🛡️

[GoPlus Security 🚦 @GoPlusSecurity]

📢GoPlus #DeepScan Comprehensive Upgrade: A New Paradigm of AI-Powered Smart Contract Security.

Smart contracts hold funds — and hackers are already using AI to uncover deep-layer vulnerabilities. One-time audits can no longer keep pace with today's attack-defense dynamics. The industry must evolve toward AI-powered, continuous security: higher efficiency, lower cost, full-lifecycle protection.

GoPlus DeepScan delivers three interconnected modules forming a closed-loop, continuous security service for the entire smart contract lifecycle: AI Contract Audit, Continuous Security Monitoring, and Token Security Self-Check.

Features

AI Auditing
AI-powered deep analysis of contract source code, permission management, and business logic. Systematically detects syntax vulnerabilities and business-logic flaws, and delivers a structured audit report — including security scores, key findings, issue details, and remediation recommendations.

Security Monitoring
Post-audit, always-on assurance for live contracts. Tracks newly disclosed vulnerabilities, on-chain attacks, and status changes in external dependencies (oracles, cross-chain bridges) in real time. AI continuously assesses impact, triggers targeted re-reviews, and issues alerts — moving beyond the "audit as finish line" model.

Token Security Checking
A rapid pre-launch self-inspection tool for tokens preparing to launch or list. Identifies common high-risk characteristics in minutes, including: Honeypot detection, Malicious mint detection, Blacklist mechanism detection, Abnormal buy/sell tax detection, Owner privilege & trading restriction risks.

Benchmark
An open-source benchmark built from real-world attack incidents. Extracts vulnerable contract source code from attacked projects to systematically evaluate AI capabilities in vulnerability identification, attack-path understanding, contextual reasoning, and audit stability. Nearly 100 real, representative attack cases from May 2025 to date, continuously updated.

Use Cases

Developers — Cost-effective, high-efficiency security scanning with audit-grade quality, enabling fast, confident innovation.

Project Teams — Pre-launch scanning as a complement to traditional audits; continuous auditing and monitoring during operations to stay ahead of attackers.

Exchanges — Enhanced pre-listing security review efficiency and capability; continuous monitoring as routine risk control to catch new threats early and minimize post-listing incidents.

Get Started

GoPlus DeepScan is live — try it now: **https://t.co/wH4waSE3r1**

AI Auditing Benchmark: https://t.co/c03mKQN52I

[GoPlus Security 🚦 @GoPlusSecurity]

On certain affected Alpine Linux setups, a logic collision between OpenSSH and the underlying musl libc lets an attacker bypass password auth and potentially reach root by simply feeding 257–1024 characters into the password field.

Recommend upgrading the packages and restarting sshd, or fully disabling password login in `/etc/ssh/sshd_config`.

[International Cyber Digest @IntCyberDigest]

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

[GoPlus Security 🚦 @GoPlusSecurity]

⚠️ #iPhone Security Warning: Update to the latest iOS version and check your device for malicious apps as soon as possible!

SEAL recently reported asset losses among several users of self-custody wallets on iOS, including multiple Trust Wallet users and one Uniswap Wallet user. Losses reported so far total approximately $561,000.

Based on the information currently available, we suspect these cases may be linked to the recent wave of iOS-related cybercrime. In these iOS attacks, attackers exploit unpatched vulnerabilities in older versions to steal private data and obtain unauthorized privileges, then steal and transfer crypto assets.

Full report: https://t.co/BY8rzNl2Xe

[GoPlus Security 🚦 @GoPlusSecurity]

Older iOS flaws are being exploited to steal Web3 keys and crypto. #Coruna and #DarkSword fuel exploit trading, malware sales, phishing and trojanized apps. Our report breaks down the attacks, operators, money trails and how to stay safe 👇 https://t.co/SkjoRyvBY2

[GoPlus Security 🚦 @GoPlusSecurity]

Excited to see @SmartXTerminal integrating #GoPlus Token Security 🛡️

Users can spot honeypots, hidden taxes, and risky owner rights before they trade. Glad to help make trading on SmartX safer.

[SmartX @SmartXTerminal]

Trading on SmartX just got safer with @GoPlusSecurity 🛡️

Every token now gets a #GoPlus Token Security check before you trade, so you see warnings on honeypots, hidden taxes and risky owner rights before you buy

One more layer in how we keep trading on SmartX secure

[GoPlus Security 🚦 @GoPlusSecurity]

🚨 GoPlus Security Alert: #Android has released an important security bulletin addressing severe vulnerabilities. Check your device and update immediately!

Affected versions: Android 14, 15, 16, 16 QPR2, and 17.

Check and update:

1️⃣ Go to Settings → About phone → Android version. Check your Android security update / security patch level.

2️⃣ Install your device manufacturer’s system update, then restart. Update to security patch level 2026-11-05 or later.

⚠️ Of the vulnerabilities listed in this month’s bulletin, the 2026-11-01 patch level addresses only CVE-2026-58868. The 2026-11-05 patch level is required to cover all vulnerabilities in the bulletin.
https://t.co/E2cY4rAqTE

[GoPlus Security 🚦 @GoPlusSecurity]

Quantum progress is raising the stakes for Bitcoin and Ethereum. What can today’s machines actually do, which assets face the greatest exposure, and can blockchains migrate before Q-Day? We separate the breakthroughs from the hype. https://t.co/lmUzpDpjV2

[GoPlus Security 🚦 @GoPlusSecurity]

#Binance ’s postmortem identifies social engineering targeting employees and the misuse of AI tools as the most immediate causes of the incident. AI-related risks were particularly prominent, with AI tools providing the most direct entry point:

1️⃣ An AI coding tool became a supply-chain lure. An engineer downloaded a tampered installer found through a search engine, setting the incident in motion.

2️⃣ An internal AI tool became a springboard for lateral movement. The attacker used it to then gain control over employees A and C. This is a warning defenders must take seriously: attackers are using AI tools and their permissions to expand lateral movement within enterprises. Defenders must upgrade identity, device, permission, signing, and continuous behavioral verification controls around AI tools in parallel.

In a subsequent interview, Binance founder CZ reflected on the incident, warning that it was a real wake-up call—not just for crypto, but for the entire financial system. AI is strengthening attackers’ capabilities and connecting security challenges across crypto and traditional finance.

This demands serious industry reflection and action. According to an alert shared in onchain investigator ZachXBT’s community, French bank Crédit Mutuel Arkéa had $133 million stolen just days after the Binance incident.

[Binance @binance]

https://t.co/sU9dUqLQDH

[GoPlus Security 🚦 @GoPlusSecurity]

🚨 GoPlus Security Alert:
Brazilian exchange @MercadoBitcoin has experienced abnormal asset outflows from its multichain custody wallets, with losses exceeding $30 million. Some stolen funds have been frozen. MB has suspended deposits and withdrawals following the attack.

The stolen assets span at least 9–10 networks, including Bitcoin, Ethereum, Arbitrum, Solana, Tron, Stellar, Polygon, Avalanche, BNB Chain, and XDC.

The Ethereum wallet transferred out approximately 2,852 ETH, while the Solana wallet transferred out approximately 10,695.56 SOL. On Bitcoin, alongside a transfer of approximately 104.43 BTC, another transaction spent funds from 54 distinct addresses across 86 inputs. Large XLM, USDC, and EURC outflows were also recorded on Stellar.

The underlying issue may involve abuse of hot-wallet signing or transaction authorization systems. Concentrated outflows across multiple chains and simultaneous spending from multiple Bitcoin addresses warrant priority investigation into key management, signing services, and withdrawal approval workflows. These characteristics resemble the earlier Binance theft, but the available evidence does not yet identify a specific threat group.

📌 Attacker-Related IOCs:

EVM Receiving Address Across Multiple Chains:
0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478

Bitcoin Receiving Address:
19qGpsHvzh1t6pVi526XNNkh6hW6prDZp

Solana Receiving Address:
3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J

Tron Receiving Address:
TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L

Stellar Receiving Address:
GDXYRI6IONQA5YTGRLQ6O3FGJ2BWXPJTTQPUXFPSEXSRKBZLFKMZSOLP

🛡️ Security Recommendations:

Exchanges and custodians should strengthen transaction risk controls: check recipient addresses, networks, assets, and transaction amount patterns; enforce delays on withdrawals to new recipient addresses, additional review for large transfers, aggregate limits across chains, and circuit breakers for anomalous outflows. MPC/HSM deployments should be paired with independent authorization policies to limit the damage from compromised administrator privileges.

Users should follow official updates and avoid using the service until MB confirms it is secure and service has been restored. Preserve account balance records and transaction records, and watch for phishing exploiting the incident. Obtain updates on service restoration or reimbursement only through verified official channels. Never share passwords, verification codes, private keys, or seed phrases with supposed “reimbursement support.”

[GoPlus Security 🚦 @GoPlusSecurity]

@givinghan4 @zkLink_Official Paid plans start at $99. You can check them out on the official website: https://t.co/V75FFlKAwp

[GoPlus Security 🚦 @GoPlusSecurity]

DeepScan’s AI audit flagged the @zkLink_Official vulnerability in just 10 minutes.

We recommend that project teams use DeepScan AI audits for continuous smart-contract scanning to strengthen contract security and reduce related risks.

Full report: https://t.co/prAPGRMbQf

Benchmark update: https://t.co/paDhtFVbrL

[GoPlus Security 🚦 @GoPlusSecurity]

1/4
⚠️ Exploit Breakdown: zkLink Nova Ethereum Bridge Attack

On October 29, an attacker withdrew 22.43129453 ETH and 11 different ERC-20 tokens from zkLink Nova’s L1 custody contracts in a single transaction. The stolen assets were worth approximately $797,016.48 at the time of the attack.

🔍 Root Cause:

The vulnerability was in zkLink Nova’s `Arbitrator.claimMessage`. The function uses `finalizeMessageHash` in transient storage to record the hash of a message just authenticated through a callback from the source chain’s canonical message service.

The value was not cleared after the call. The function also did not require a fresh authentication callback for every call, allowing an already-authenticated message to be reused.
https://t.co/wJck3LcGyp

[GoPlus Security 🚦 @GoPlusSecurity]

In September’s report, we called it the year’s costliest month: $793M lost.

October broke that record: $6.46B in Web3 losses, led by the $6.3B #Binance multichain hot-wallet theft…

Sobering. https://t.co/ncIKLEN75T

[GoPlus Security 🚦 @GoPlusSecurity]

13/13
📌 Related Addresses and Transactions

Attacker Address:
0xbeBa8CEfD0D75d747C5AD966Dc17C0Bb60D84dBd

Attack Contract:
0x577168C8c6fA937495C3D6961f1d7D734b2d785f

Affected Vault Contracts:
0x45dF5EA836A15B561937Ae8373ab9eE984aea531
0xbae43c546DFADC69576aE73C68e0694A54F08e1B
0x6A1FC0E1c60BA6564CDe4910A425F1F1a1d18C1F
0xDC631d88dbB5eb39f5c4Bf8B4e5298d098912fFf
0xD46993F25D298ebbCD31E941156C66f7e628A52a
0xBe3E229319f86f5ee96ee1dc0b6d55e8b68a439e

Attack Transactions:
https://t.co/iGIjTffoc7
https://t.co/rV6dtjPfMl
https://t.co/vYDcxw0UM2

[GoPlus Security 🚦 @GoPlusSecurity]

1/13
⚠️ Exploit Breakdown: Premia Labs Options Vault Attack

On November 1, @PremiaLabs vault contracts on #Arbitrum were exploited for over $400,000. The factory allows permissionless deployment of option pools, but the vaults lacked sufficient checks to establish whether those pools were safe to interact with. The attacker created empty pools, used flash loans to buy options and trigger the vaults to lock collateral into those pools, then extracted the collateral through the pools’ liquidity mechanisms.

🔍 Root Cause:

Premia v3 separates options trading into two layers:

① Option Pool: Deployed permissionlessly through the factory for a given underlying/quote pair, strike price, expiry, and option type (call or put). Anyone can create a new series.

② Underwriter Vault: Users deposit a single asset. The vault uses those deposits as collateral to write options for buyers and collect premiums. Call vaults hold the underlying asset (WBTC/WETH/ARB), while put vaults hold USDC.e.

When a buyer trades with a vault, the vault locks collateral into the corresponding option pool. If the vault checks only whether the pool was deployed by the official factory—without checking its liquidity, age, or whether it is an empty pool controlled exclusively by the attacker—then:

• The attacker can deploy a fresh, empty pool with no other LPs.
• A flash loan can fund the entire sequence in one transaction: establish a position → trigger the vault to lock collateral into the pool → extract that collateral through liquidity or pool-side accounting mechanisms.
• In an empty pool, the attacker effectively controls the entire market and can manipulate the initial trading path and accounting state.

🔗 Attack Flow:

1️⃣ Deploy empty option pools

The attacker’s EOA called the attack contract to create the six option pools used in the subsequent exploit.
https://t.co/iGIjTffoc7

[GoPlus Security 🚦 @GoPlusSecurity]

12/13
3️⃣ Drain the ARB-related vaults in the second exploit transaction

The attacker repeated the same pattern against the ARB call and put vaults.
https://t.co/QXM0f2M0Tr