SlowMist

SlowMist is a Blockchain security firm established in 2018, providing services such as security audits, security consultants, red teaming, and more.

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users

⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.

DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.

🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.

🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.

📖 Related SlowMist analyses:

🔗 DarkSword Trojan Backend & iOS Attack Chain:
https://t.co/B1hYr9mGl5

🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
https://t.co/IcHU32boZb

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert: iOS sandbox escape 0day PoC “worse_query” disclosed 🚨

A public PoC for a sandbox escape 0day, worse_query, targets iOS 26.0–26.7.2 and iOS 27.2. It is the successor to bad_query. 📱

⚠️ This is a container sandbox escape, not a jailbreak. It breaks the assumption that apps can’t see each other: a malicious app that successfully exploits it can reach system paths and read or modify other apps’ data.

💸 The bug does not steal assets by itself. The real risk starts when a user installs an app from an untrusted source, such as a sideloaded IPA. If a wallet stores its seed phrase, keystore or WebView cache in plaintext locally, a malicious app could read it.

🛡️ Recommendations:
🔸 Don’t install IPAs or apps from unknown sources
🔸 Keep iOS up to date and install Apple’s fix as soon as one is released
🔸 Wallet developers: don’t store sensitive data in plaintext locally
🔸 If you installed an untrusted app on a device holding wallets, treat it as risky and consider moving assets to a new wallet created on a clean device

🔗 https://t.co/sIP4hX85TR

[forcequit @forcequitOS]

Introducing worse_query, a zero-day sandbox escape for iOS 26 and 27, again.
In collaboration with @0xjohnny!
https://t.co/dOZF8oaaw0

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert 🚨

A supply chain attack has compromised Ethersphere’s npm package `@ethersphere/[email protected]` and Swarm Desktop v0.56.2. Attackers abused compromised GitHub accounts and legitimate release pipelines to distribute malicious code across Windows, macOS, and Linux.

The malicious code retrieves and executes remote JavaScript from `api[.]frameworkmetrics[.]xyz`. Its later-stage backdoor uses the Ethereum smart contract `0xf8a900Db50b3331be6B768bA460BB59f3E40C344` as a decentralized command-and-control (C2) configuration store, allowing attackers to dynamically update C2 addresses. The same contract was previously linked to the SleepyDuck / EtherDuck malware campaign targeting malicious Open VSX extensions.

Potential risks include wallet credential theft, private key exfiltration, persistent backdoor deployment, and unauthorized remote access.

Users should remove `@ethersphere/[email protected]`, pin version 13.2.0, and upgrade Swarm Desktop to the clean v0.56.3 release. Investigate affected systems, rotate potentially exposed credentials, and monitor suspicious connections to the malicious infrastructure.

You can also visit https://t.co/ft6lerUm0y to check for free whether the npm packages, pip packages, domains, or IPs you use are safe.

As always, stay vigilant!

Reference: https://t.co/GujlDKgVNq
https://t.co/6IXJe1CURC

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert 🚨

💸 @ankr Loss: ~$304.5k

🔍 Root Cause: The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and withdrawal amounts. All five receipts carried valid signatures from the bridge's trusted consensus signer, allowing withdraw() to release assets without independently verifying the receipts against the actual source-chain events.

⚠️ The origin of the unauthorized signatures remains under investigation. Signer compromise has not been confirmed.

📌 Attacker (Tx Sender): 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703
📌 Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6
📌 Vulnerable Contract: 0xc437DF90B37C1dB6657339E31BfE54627f0e7181

Powered by https://t.co/Mz5jOnx997
Attack Tx:
https://t.co/dU9j2cO3dI
https://t.co/ALkBI5RbiA
https://t.co/i2iFAEe73X
https://t.co/ZPCecX3FkP
https://t.co/LyaWqIvutJ

Reused Source Tx:
https://t.co/ATrjujtYHV

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert: Beware of the “Cracked TradingView Premium” Infostealer 🚨

Since mid-October, X account "cryptotrice" has repeatedly promoted a so-called “reverse-engineered cracked #TradingView Premium,” with some posts passing 300K views. The software requires downloading a password-protected archive and generating a license code via a KeyGen. 🔑

The author claims the project is open source on GitHub, but the download link in the article does not point to #GitHub. In some replies, the author also said the repo has been made private and that links are only available in-app and expire after a single use. Several users warned in the comments that it looks like malware stealing account info and crypto wallets, and one said their antivirus flagged and deleted it right after extraction. 🦠

We analyzed it and confirmed the Windows sample is an infostealer:
🔸 Collects browser credentials, crypto wallet data and Telegram data, and sends it to the C2 via WinINet
🔸 Uses Telegram and Steam to dynamically fetch and rotate C2 servers
🔸 The download site, arche-hypnose[.]com, appears to be a legitimate website compromised to distribute the malware
🔸 The macOS link currently returns 404, so no sample has been obtained

⚠️ If you have already run this software: disconnect from the network immediately, move your assets to a clean device with a new wallet and seed phrase, change passwords for your browsers, exchanges, email and Telegram, and terminate active Telegram sessions.

Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don’t install them. 🛡️

IOC
Sample source: teapawt[.]org/cryptotrice/article/2111472920241524897

Download links:
hxxps://www[.]arche-hypnose[.]com/get/ (Windows)
hxxps://www[.]arche-hypnose[.]com/mac/ (macOS, currently 404)

C2:
hxxps://xn[.]amanlay[.]org/rn/gate
hxxps://z[.]dak69[.]org/j/gate
hxxps://xn[.]amanlay[.]org/kw/gate

[MistTrack🕵️ @MistTrack_io]

Dirty money isn’t only caught once it reaches an exchange. On-chain fund flows are traceable by nature.

Before accepting funds from an unfamiliar address, or from a “friend” or “relative,” check the address on MistTrack first. You’ll see its risk score, associated labels, and upstream/downstream fund paths, so you can spot fraud- or laundering-related risk early.

A check takes a minute. A freeze can take months to resolve.

👉 https://t.co/kcPJGQ0nex

[SlowMist @SlowMist_Team]

If you're experiencing disruptions to your KYT services, MistTrack is here to help.

[MistTrack🕵️ @MistTrack_io]

If you're experiencing disruptions to your KYT services, MistTrack is here to help.

We offer free trials and dedicated technical support to help businesses maintain their on-chain risk screening and compliance workflows, while exploring alternative or complementary #KYT solutions.

🔎 Two Solutions for Different Business Needs

1️⃣ MistTrack: Fast Integration, Flexible Deployment

Convenient #API integration and dedicated technical support to help businesses quickly establish alternative or complementary screening capabilities.

Flexible pricing options, including subscription plans and prepaid credit packages. Developer plans start at $20 for 100 address checks, with credits valid for one year.

2️⃣ SlowMist KYT: Advanced Risk Management for Large Institutions

A real-time #AML engine designed for institutional compliance teams, focusing on in-depth high-risk fund flow screening and flexible risk configuration.

Prepaid packages based on the number of addresses, with tiered pricing that offers lower per-address costs at higher volumes. Minimum purchase: 10,000 addresses.

🌐 Building a More Resilient Risk Management Ecosystem

We believe diversified risk screening capabilities are essential to business continuity. @SlowMist_Team is committed to working with industry partners to provide reliable technical support and more KYT options.

🙋 Looking for a backup KYT solution? Contact us to learn more about free trials and integration support.

🌐 Website: https://t.co/35HJ4rHom0
📝 Contact Form: https://t.co/55gn9dkpBl
📧 Email: [email protected]

[SlowMist @SlowMist_Team]

Worth a read. A clear and detailed breakdown of a recruitment phishing attack that led to a malware infection simply by opening a project in Cursor.

Appreciate @brucexu_eth sharing this.

[brucexu.eth @brucexu_eth]

https://t.co/Fx5jjCo7mx

[SlowMist @SlowMist_Team]

One thought for wallet teams: it may be helpful to gently remind users when they open the app on an iOS version that isn’t up to date. A small reminder could help users stay a little safer.🫡

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users

⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.

DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.

🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.

🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.

📖 Related SlowMist analyses:

🔗 DarkSword Trojan Backend & iOS Attack Chain:
https://t.co/B1hYr9mGl5

🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
https://t.co/IcHU32boZb

[SlowMist @SlowMist_Team]

Keep your iOS up-to-date.

[CZ 🔶 BNB @cz_binance]

Keep your iOS up-to-date.

[SlowMist @SlowMist_Team]

🚨 The U.S. Treasury’s OFAC has sanctioned 10 individuals and one entity linked to #DPRK IT worker networks.

SlowMist used @MistTrack_io to analyze the listed crypto addresses and uncovered several on-chain connections:

🔎 Boykov ↔ Obertas
• OFAC listed the same #Ethereum address under both individuals.
• Boykov transferred approximately $9.88M to this address. Two of his #TRON addresses also sent a combined 1.66M $USDT to an address attributed to Obertas.

🔎 Boykov ↔ Kim Ki Hyok
• Both had Ethereum addresses sending funds to the same #Bybit deposit address:
Boykov: ~$4M
Kim Ki Hyok: 50,000 $DAI

The risks posed by DPRK IT workers go beyond financial activities. Using false identities, they may gain access to company devices, internal systems, and sensitive data.

⚠️ Companies should verify worker identities, monitor the use of company devices, and carefully manage system access.

📖 Read the full analysis:
https://t.co/X7mlbcfAKp

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert: Android’s November 2026 security bulletin is out 🚨

Among the critical flaws: CVE-2026-58868 (Critical) in the Framework component. 💥 It allows remote code execution with no user interaction and no extra privileges.

📱 Affects Android 14, 15, 16, 16-QPR2 and 17.

🔍 No confirmed in-the-wild exploitation so far. But if a bug like this ever gets exploited at scale, it would be a nuke for mobile. Android runs on roughly 7 out of every 10 smartphones worldwide. ���

🛡️ Patch levels:
✅ 2026-11-01+: includes CVE-2026-58868 and other Framework/System fixes
✅ 2026-11-05+: covers ALL fixes this month, incl. kernel, MediaTek & Qualcomm

⚙️ Check: Settings → About phone → Android version → Security patch level

Please update ASAP ⬆️

📄 Details: https://t.co/il4orBvSFo

[SlowMist @SlowMist_Team]

3/ Thank you to all the speakers, guests, and partners for making this gathering in Hong Kong such a memorable one! 🫶

Moving the industry forward takes collective effort. SlowMist will continue advancing blockchain security through security audits, threat intelligence, on-chain tracing, and AML services to help safeguard the digital asset ecosystem. 🫡

🇭🇰 Looking forward to our next meeting in Hong Kong!

Full Recap👇
https://t.co/v3mU99em9r

[SlowMist @SlowMist_Team]

🥳「2026 HK Institutional RWA & Stablecoin Forum」has successfully concluded!

On November 2, during Hong Kong #FintechWeek, SlowMist and JunHe LLP co-hosted this closed-door forum in Hong Kong.

Here's a look at some of the highlights 👇🧵

[SlowMist @SlowMist_Team]

2/ The forum also featured three roundtable discussions, bringing together experts from across the industry for in-depth exchanges on #RWA, payment innovation, and institutional security.

💬 Discussions focused on three key areas:

🔹 RWA Development: Bringing traditional assets on-chain, including product implementation, fund structures, and asset management.

🔹 Stablecoin Payments: Cross-border payments, multi-currency operations, and the expansion of financial services.

🔹 Institutional Security: AI-driven threats, fund tracing and recovery, digital asset custody, and post-incident response.

The discussions brought together diverse industry perspectives, with speakers sharing practical insights on the opportunities and challenges facing the digital asset industry.✨

[Binance @binance]

https://t.co/sU9dUqLQDH

[SlowMist @SlowMist_Team]

Congratulations to @Changer_Plus on successfully completing its smart contract security audit by SlowMist! 🎉

Thanks to Changer+ for choosing SlowMist as its security partner! 👏

🔗 Audit Report: https://t.co/4gknZbAqzL

[Changer+ | Stablecoin-First Wallet @Changer_Plus]

Audited by @SlowMist_Team. Passed. ���

Changer+’s token transfer smart contracts have passed a security audit covering EVM (Ethereum & BNB), TRON and Solana.

No critical, high, medium or low severity vulnerabilities were identified.

Simple to use. Serious about security.

https://t.co/T5VmdStKF9

#SlowMist #WalletSecurity #SelfCustody #EVM #TRON #Solana #CryptoSecurity #Ethereum #BNB

[SlowMist @SlowMist_Team]

🚨 On October 29, 2026, cross-chain protocol @zkLink_Official was exploited for approximately $783K. The SlowMist Security Team analyzed the incident and uncovered how a transient storage flaw led to forged batch roots and unauthorized withdrawals.

🧩 Attack Flow:

1️⃣ Queried totalBatchesExecuted and selected the next batch (116409) for forgery.
2️⃣ Executed a genuine Linea claim through SyncL2TxHashRelayer, writing finalizeMessageHash into transient storage.
3️⃣ Reused the stale finalizeMessageHash in a second claimMessage call, triggering an attacker-controlled call to EthereumGateway.
4️⃣ Used EthereumGateway.sendMessage to call ZkLink.syncBatchRoot, forging the batch root and advancing totalBatchesExecuted.
5️⃣ Executed 12 withdrawals against the forged root: 1 ETH and 11 ERC-20 transfers using forged Merkle proofs.

⚙️ Root Cause:

Arbitrator.claimMessage allows relayers to specify arbitrary call targets and calldata, while failing to clear or bind finalizeMessageHash to the current invocation. Combined with ZkLink.syncBatchRoot only checking gateway identity without verifying batch proofs, this enabled batch root forgery.

🔒 Recommendations:

When reviewing similar cross-chain relayer projects, pay attention to four areas:

1️⃣ Reset transient storage before each call.
2️⃣ Bind verification values to the current invocation.
3️⃣ Check whether arbitrary users can indirectly leverage trusted callers through public helper contracts or relayers.
4️⃣ Independently verify batch root updates rather than relying solely on caller identity.

Full analysis 👇
https://t.co/5uwU2ZTumF

[SlowMist @SlowMist_Team]

@vivilinsv Thank you, Vivi! We really appreciate your thoughtful questions and professionalism throughout the interview. It was a pleasure speaking with you.

[SlowMist @SlowMist_Team]

Thank you to @nypost and @vivilinsv for the interview. We’re glad to have had the opportunity to share our observations and analysis.

[New York Post @nypost]

How North Korea's ruthless state sponsored hackers, main suspects in the $6.3B Binance heist, operate https://t.co/W43nSUwogz