Sean

co-founder and ceo @chainraylabs | Blockchain security & AML Compliance

[Sean @Sean_ChainRay]

第一条推文致敬为区块链安全和合规，网络安全奋斗的所有人，致敬ChainRay的小伙伴们 #ChainRay #BlockchainSecurity #Crypto #Web3Security #web3

[Sean @Sean_ChainRay]

@xiejiayinBitget 恰好碰到今天晚上有朋友在推荐美股期权，正好看到bitget出现了这个功能，为此专门成为了新用户，加油👏

[Sean @Sean_ChainRay]

安装Claude Desktop的同学们注意了，今天看到好友熊猫正正（网络安全专家）再次发出提醒：“整个程序的下载安装过程很奇怪，程序里面包含很多行为也很异常”，同时看到有人发出了较详细的分析，自己做下判断

https://t.co/xcm1ZOoWgY

[Sean @Sean_ChainRay]

又一起供应链攻击..这是目前最完整的安全排查方案，请及时排查

[Chainray Labs @chainraylabs]

🚨 Official Security Alert: Axios npm Supply Chain Attack 🚨

We are aware of a supply chain attack targeting the Axios npm package, where malicious versions were published via a compromised maintainer account, deploying cross-platform remote access trojans.

📦 Affected versions:

Axios: 1.14.1, 0.30.4

plain-crypto-js: 4.2.1 (malicious dependency)

🖥️ Affected software types:

Electron desktop applications

Web frontend projects (Vue, React, Angular)

Node.js backend services

CI/CD pipelines

Cryptocurrency-related projects

⚠️ Current status:

The malicious versions have been identified and removed from npm.

Developers are advised to check their dependency versions immediately.

🔍 Indicators of Compromise (IOCs):

C2 Domains: https://t.co/FfXSjkLYEo, https://t.co/LGtLQZauj9

C2 IPs: 142.11.206.73, 142.11.196.73, 142.11.199.73

Suspicious files:
- Windows: C:\ProgramData\wt.exe, C:\ProgramData\system.bat, %TEMP%\6202033.ps1
- macOS: /Library/Caches/com.apple.act.mond, /tmp/.XXXXXX.scpt
- Linux: /tmp/ld.py, /tmp/.%UID%

Registry persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run → MicrosoftUpdate

🛡️ Recommended actions:

Check dependencies: npm list axios or inspect package-lock.json

Remove malicious versions and upgrade to official safe versions

Delete suspicious files and terminate related processes

Block C2 domains and IPs at network level

Restart host after cleanup

We will provide timely updates as the investigation progresses.
For security, always verify package versions and only install from trusted sources.
#Axios #SupplyChain #npm #CryptoSecurity #chainray #chainraylabs

[Sean @Sean_ChainRay]

始作俑者TeamPCP部分团伙成员已达成目的，疑似💰自由离开

[Sean @Sean_ChainRay]

⚠️预警贴⚠️一定要看到最后‼️
最近实在是忙的不可开交，推文写了又删（强迫症，始终想给用户最完美的建议），由于近日chainray @chainraylabs 接连发现多起供应链安全事件，所以还是决定挑最重要的发一下：
1.litellm遭遇供应链投毒，主要是对AI项目和开发者影响很大，千万不要觉得没见过这个东西就无所谓，litellm你可能没安装过，但是你使用的AI相关的工具很可能安装了（也就是帮你安了）
2.litellm里的恶意代码主要运行在Linux上，windows和Mac用户可以稍微喘口气
3.影响版本为1.82.7和1.82.8，安全版本为1.82.6（通过pip show litellm命令查询）
4.至于日志排查和网络通信方面的排查，可以直接问AI了，不赘述
4.来自chainray @chainraylabs 威胁情报显示，apifox也被供应链投毒，ioc:apifox[.]it[.]com，可自查

[Sean @Sean_ChainRay]

来自@ResolvLabs 的消息：“恶意攻击者通过泄露的私钥非法访问了 Resolv 的基础设施”，需要好好排查下日志，私钥是如何和何时泄露的，其他业务系统或生产系统是否存在问题

[Chainray Labs @chainraylabs]

🚨 Official Security Alert: ResolvLabs USR Stablecoin Incident 🚨
We are aware of a temporary USR price disruption on March 22, 2026, due to suspected exploitation of the USR minting mechanism.
Timeline of events (UTC):
1️⃣ 03/22 01:50:59 – Malicious address 0x04A288...13caEd initiated minting. Completed at 02:21:35.
2️⃣ 03/22 03:02:11 – Malicious address 0x68230E...89A4Af initiated minting. Completed at 03:41:47.
3️⃣ 03/22 03:20:23 – Malicious address 0x04A288...13caEd initiated minting. Completed at 03:32:47.
4️⃣ 03/22 03:41:23 – Malicious address 0x04A288...13caEd initiated minting. Completed at 03:41:47.
💰 Impact:

Approx. 80 million USR temporarily affected.

USR price briefly dropped to $0.257 (-74.2%), now recovering to $0.7847.

One additional transaction from 0x68230E...89A4Af at 04:14:47 failed; funds automatically returned, no additional minting occurred.

⚠️ Current status:

The ResolvLabs team is investigating the root cause.

USR minting paused until security review is complete.

No user funds were permanently lost.

As of now, the total value of the hacker's address is approximately $1,788,600.

We will provide timely updates as the investigation progresses.
For security, always verify transactions on-chain and only interact with official smart contract addresses.
#ResolvLabs #USR #CryptoSecurity #Stablecoin

[Sean @Sean_ChainRay]

@SexyMichill @gmgnai 这个钱包已经不能使用了，早已被黑

[Sean @Sean_ChainRay]

I'm glad to see such a result. Chainray @chainraylabs has rich and professional experience in on-chain tracking and network security. We disclosed the complete criminal chain of Lazarus for the first time in the 2025 Annual Report on Blockchain Security. Welcome 👏 to view and cooperate to jointly build blockchain ecological security

[Sean @Sean_ChainRay]

🚨用AI编程，vibe coding的同学们请注意（尤其是喜欢调用各种交易工具）
攻击者已经开始利用github高星项目和AI工作流（skills）盗取电脑凭证和系统权限，例如下图
Jamf Threat Labs @JamfSoftware 识别出多个与此活动相关的 GitHub 代码库,均发现了一致的命令与控制 (C2) 基础设施。
建议进行自检查或者可以尝试让AI或者你的龙虾🦞去检查你的电脑是否有过与这个域名通信
hxxps://trackpipe|.]dev

[Sean @Sean_ChainRay]

🤯老周脑子应该嗡嗡的了，大家近期避免安装突然出现的360产品（可能会出现攻击者通过社会工程学诱导下载木马），一家安全公司出现这样的低级错误，是对用户的极大不负责任

[Lukasz Olejnik @lukOlejnik]

China's biggest cybersecurity company apparently just shipped an AI assistant with its own SSL private key sitting inside the installer. Qihoo 360, think Norton or McAfee, but dominant across the entire Chinese market

It appears that their new AI product, 360安全龙虾 (Security Claw) bundles a wrapper on @OpenClaw. Inside the installer package - accessible to anyone who downloaded it - was a private SSL certificate key for the domain *.myclaw.360.cn. An SSL private key is essentially the master password to a website's encrypted connection. With it, an attacker can impersonate 360's servers, silently intercept user traffic, forge a login page that looks completely legitimate, or possibly take over the AI agent altogether. The cert is valid until April 2027 and covers every subdomain on the platform. It's now public. The founder launched the product with a promise it would "never leak passwords". It did that during release? 461 million users, a $10B valuation, and nobody checked the zip file before shipping. The cert expires April 2027.

[Sean @Sean_ChainRay]

@star_okx @wallet okx这波纯躺枪，从黑客团队成员自曝的说法来看，问题应该出现在trust wallet @cz_binance @heyibinance @TrustWallet

[Sean @Sean_ChainRay]

@star_okx @wallet okx这波纯躺枪，从黑客团队成员自曝的说法来看，问题应该出现在trust wallet @cz_binance @heyibinance @TrustWallet

[Sean @Sean_ChainRay]

⚠️分享一个黑客的攻击“骚”技巧，开发者们必须注意‼️
攻击者通过精心构造提示词，诱导大模型的输出结果为其想要的结果，最后将对话链接分享以达到欺骗openclaw和其他用户下载并执行其恶意脚本等操作

[Sean @Sean_ChainRay]

openclaw的开发周期依然是不健全的，如下图软件开发生命周期模型所示。所以大家还是要猥琐使用😂
从安全的角度来说，没有任何所谓的安全方案，发一个从根源，极简角度出发的综合建议，可以大概率减少黑客攻击
1.docker/vmware虚拟机部署（最新版本）/使用全新电脑/云主机/AI厂商推出的云龙虾服务（⚠️切记如果在自己家部署，做好防火墙隔离）
2.使用官方技能（skills)
3.时刻关注openclaw更新（尤其是安全方面）
4.关键数据备份与管理（自行决定）

[Orange AI @oran_ge]

🦞 最近被龙虾轰炸太多了？玩腻了？想卸载？
等一下！听说最近卸载小龙虾服务越来越火了，上门服务一次收费 500 块。
但卸载 OpenClaw 不是拖进废纸篓就完事，需要至少 5 个复杂步骤：停服务、清配置、删状态、处理多 profile...
我把这套流程打包好了，写成完全开源免费的工具 —— OpenClaw Killer

为你劲省 500 💰

OpenClaw Killer 支持 macOS/Linux/Windows
三大系统，一键搞定
完全免费，MIT 开源！

项目地址，立即卸载🗑：https://t.co/AxpOtJfqTl

[Sean @Sean_ChainRay]

没想到刚发了几点思考，就看到不幸的消息……

[Alexey Grigorev @Al_Grigor]

Claude Code wiped our production database with a Terraform command.

It took down the DataTalksClub course platform and 2.5 years of submissions: homework, projects, and leaderboards.

Automated snapshots were gone too.

In the newsletter, I wrote the full timeline + what I changed so this doesn't happen again.

If you use Terraform (or let agents touch infra), this is a good story for you to read.

https://t.co/Mbi3oM4HMn

[Sean @Sean_ChainRay]

https://t.co/zoh3zSlMMX

[Sean @Sean_ChainRay]

未知全貌，但是目测是黑客已经深入企业内网，我们不久前发布的2025年度报告着重指出了这一种精细的区块链行业攻击趋势，查看报告可关注@chainraylabs

[IoTeX @iotex_io]

We are aware of recent reports regarding suspicious activity involving an IoTeX token safe. Our team is fully engaged, working around the clock to assess and contain the situation.

Initial estimates indicate the potential loss is significantly lower than circulating rumors suggest. We have already coordinated with major exchanges and security partners, which are actively assisting in tracing and freezing the hacker's assets.

The situation is under control. We will continue to monitor closely and provide timely updates to the community.

[Sean @Sean_ChainRay]

我们的2025年度报告也提及到了这方面，具体可查看@chainraylabs AI对于网络安全行业及各行业冲击会越来越大，细到代码审计，应急取证，大到攻防对抗……

[Claude @claudeai]

Introducing Claude Code Security, now in limited research preview.

It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss.

Learn more: https://t.co/n4SZ9EIklG

[Sean @Sean_ChainRay]

还是先挺一波何总，能高强度刷推解决客户问题，币安了不得。看了下最近一些关于被交易所等冻结的推文，很多人认为这是交易所在抢大家的币，其实不是这样的：近两年全球交易所等加密货币服务商和各国都在加强监管与风控，这是为了web3行业生态负责的行为，行业内确实在努力改善，希望用户理解，也希望交易所能够继续加大与客户沟通，给到客户安心。
话再说回来，不够成熟可以理解，但是如果仅单一凭借IP判断用户所在地区的方式去改变用户的合规服务策略，未免有点...武断

[Yi He @heyibinance]

@LaoTieBro 非常抱歉给你带来不愉快的体验，随着币安在合规的大规模投入，根据您的描述，之前你的vpn跑去了我们不能服务的国家，就会变成提现模式，需要联系客服接入💁‍♀️服务。

[Sean @Sean_ChainRay]

chainray2025年度区块链安全报告刚提到此种类型的安全问题，26开年bithumb工作人员就来了一次。。。😓代码审计再安全，防护做的再好，也防不住人为操作

[AB Kuai.Dong @_FORAB]

世界巨大的草台班子！刚刚韩国第二大币圈交易所 Bithumb，出现了短时比特币 -22% 的向下插针。

原因竟然是 Bithumb 交易所误将 2000 枚比特币，当成 2000 韩元奖励，错发给了数百名用户。

而收到钱的用户，在看到后第一件事就是砸盘、变现、赶紧提走跑路。