MoveBit

Sub-brand of @0xbitslab. A security team focused on the Move ecosystem, building the standard and delivering security audits for the Move ecosystem.

[MoveBit @MoveBit_]

@ItsSnibby Appreciate it! That’s exactly what we’re aiming for — making Move development faster and more intuitive.

[MoveBit @MoveBit_]

🚀Move Web IDE — latest release✅

Auto Completion is now live in the LSP WASM build.

Get contextual suggestions as you type — keywords, variables, functions, structs, modules, and more.

View symbol types, icons, signatures, and type details in the suggestion popup.

🔘Press Enter or Tab to complete.

No install. No setup. Open and code.🙌
🔗https://t.co/CGVTaQILhl

#Sui #Move #Web3 #DevTools

[MoveBit @MoveBit_]

Try it in Move Web IDE and let us know what you’d like to see next. 🙌

[MoveBit @MoveBit_]

🚀 Move Web IDE — new release

Outline View is now live in the LSP WASM build. Browse Move modules, structs, and functions from a single panel — pinned to the bottom-left of the editor.

No install. No setup. Open and code.
🔗 https://t.co/xfyUkBM77o

#Sui #Move #Web3 #DevTools

[Claw Wallet @clawwalletcc]

The future of crypto isn't humans clicking "Confirm."
It's agents executing on your behalf.

But here's the problem: every AI agent today asks you
to hand over your private keys. That's not autonomy —
that's surrender.

Claw is built differently:

🔐 Key-sharding — no single point of failure, not even us
🤖 Policy-driven controls — agents act within limits you define
🛡️ Anti-phishing at the wallet layer — not your job to spot the scam
⛓️ Multi-chain, gasless, swap-routed across the best DEX aggregators

The agent economy is coming.
The wallets we use today weren't built for it.

Claw was.
→ https://t.co/VCtPbCBwoD

#AIAgents #Web3 #CryptoWallet #DeFi

[BitsLab @0xbitslab]

https://t.co/YONjwrRxvA

[BitsLab @0xbitslab]

🚨 BitsLab Research: One forged email is enough to hijack a nanobot agent.

No clicks. No user interaction. No prior access.
We disclosed CVE-2026-33654 — a zero-click Indirect Prompt Injection chained with Authentication Bypass in the Email Channel.

Here's how it works 🧵👇

[BitsLab @0xbitslab]

🚨 INCIDENT REPORT — Verus-Ethereum Bridge

$11.58M drained in a single transaction.

ETH 1,625.37 · tBTC 103.57 · USDC 147,658

Not a signature bug. Not a reentrancy.
It was a data-structure ambiguity that let the attacker walk through proof verification untouched.

BitsLab breakdown 👇

[MoveBit @MoveBit_]

🚨 On-Chain Forensics | Ink Finance @inkfinance
@0xPolygon

On May 11, 2026, an attacker drained $165,162 USDT0 from Ink Finance's Treasury — by impersonating a "legitimate" claimer and walking right through claimPayroll(3).

Net profit: ~$140K. Cost to attacker: a flash loan and a fake interface.

Full breakdown 🧵👇

[BitsLab @0xbitslab]

🚨 On-Chain Forensics | Ink Finance @inkfinance @0xPolygon

On May 11, 2026, an attacker drained $165,162 USDT0 from Ink Finance's Treasury — by impersonating a "legitimate" claimer and walking right through claimPayroll(3).

Net profit: ~$140K. Cost to attacker: a flash loan and a fake interface.

Full breakdown 🧵👇

[Claw Wallet @clawwalletcc]

Two upgrades shipping on Claw Wallet 🐾

🔀 Smarter routing — swap & bridge auto-routes across https://t.co/gobavj3sVg / OKX / Uniswap on EVM and Jupiter on Solana, with automatic fallback when a path fails.

⛽ Gasless by default — on most EVM chains + Sui + Solana, no need to prep native gas. A dedicated sponsor service handles estimation, validation and execution. Pay fees in stablecoins, or nothing at all.

Less manual switching. More reliable fills. Smoother first-tx for every new user.

Join us 👇
🌐 https://t.co/OCxmWWKWzQ
💬 https://t.co/WDhqEpCGjz

[BitsLab @0xbitslab]

Balancer V2 deployed ONE contract to hold every token across every pool.

Looks like a single point of failure.

It's actually why cross-pool arbitrage moves zero tokens, and why a flash loan can tap the entire protocol's liquidity.

A thread on the Vault 🧵👇

[BitsLab @0xbitslab]

🔬 New from BitsLab Research

Balancer V2 deployed ONE contract to hold every token across every pool.

Looks like a single point of failure. It's actually why:

→ Cross-pool arbitrage moves zero tokens
→ Flash loans tap the entire protocol's liquidity
→ A 2-token swap completes in just ONE SSTORE

We spent weeks dissecting the Vault contract line by line. Part 1 of our 3-part Balancer V2 deep dive is live — covering every gas trick, every safety check, and the trade-off no one talks about (the Aug 2023 Boosted Pool incident wasn't an accident of architecture).

If you're building a DeFi protocol, auditing one, or investing in one — this one's worth 15 minutes.

📖 Read Part 1 ↓
https://t.co/4ZHF2BoLUO

Part 2 (Pool math) and Part 3 (real vulnerability post-mortems) coming next.

[MoveBit @MoveBit_]

"split('|') was added for Telegram compatibility."

That single line — promoted into the base Channel class — is now CVE-2026-31977. One `|` in a sender address bypasses nanobot's allowlist entirely.

BitsLab's first nanobot disclosure. Full write-up ↓

[BitsLab @0xbitslab]

It took one character to break it.

`|` — that's all an attacker needs to bypass nanobot's Channel allowlist and slip into the Agent Loop with full access to whatever tools the deployment exposes.

CVE-2026-31977. The first vuln BitsLab found in nanobot. Read on ↓

[Claw Wallet @clawwalletcc]

🌍 New Partnership: Claw Wallet × TagAI

We are excited to announce our collaboration with TagAI @TagAIDAO!

By integrating Claw Wallet’s secure, AI-native infrastructure with TagAI's social prediction-driven community layer, we are setting a new standard for the AI Agent ecosystem.

Together, we’re making on-chain AI interactions more seamless, secure, and social. 🛡️

Proudly building the future of AI Agents together on @BNBCHAIN ! 🟡

#ClawWallet #TagAI #Web3AI #AIAgents #Crypto #TagClaw #BNBChain #BuildOnBNB

[MoveBit @MoveBit_]

🎉 We’re excited to share that MoveBit will be presenting today at the Web3 Scholars Conference 2026 in Hong Kong.
https://t.co/rqfGE4mawh

Our presentation:
“Beyond Guesswork: LLM Driven Semantic Distillation to Fuzz and Exploit Smart Contracts”

🏆 Presenting on site today: Ziqiao Kong and Wanxu Xia

Authors:
Ziqiao Kong (Nanyang Technological University)
Wanxu Xia (Beihang University)
Borui Li (Jilin University)
Yi Lu (MoveBit)
Pan Li (BitsLab)
Yang Liu (Nanyang Technological University)

Proud to contribute to smart contract security research at the intersection of LLMs, fuzzing, DeFi semantics, and vulnerability discovery.

See you at #Web3Scholars2026 in Hong Kong.
@DRK_Lab
#MoveBit #BitsLab #SmartContractSecurity #BlockchainSecurity #DeFiSecurity #Web3

[MoveBit @MoveBit_]

Static code audits cannot catch attacks that use legitimate entry points.

The Volo incident wasn't a contract bug — it was a privilege design flaw. When a single Keeper holds both `OperatorCap` and oracle submission rights, the loss_tolerance check becomes a self-validating loop the moment that key is compromised.

Move's type system protects you from many things. It does not protect you from trusting the wrong signer.

[BitsLab @0xbitslab]

🚨 Incident Analysis: Volo Protocol (Sui) Vault Exploit
On 2026-04-21, Volo Protocol on Sui suffered a vault theft resulting in ~$3.27M in direct losses, plus ~$230K in LP share-ratio collapse — combined impact of ~$3.5M.

BitsLab's post-incident analysis below. 👇

[BitsLab @0xbitslab]

🚨 Incident Analysis: Volo Protocol (Sui) Vault Exploit
On 2026-04-21, Volo Protocol on Sui suffered a vault theft resulting in ~$3.27M in direct losses, plus ~$230K in LP share-ratio collapse — combined impact of ~$3.5M.

BitsLab's post-incident analysis below. 👇

[BitsLab @0xbitslab]

$292M vanished in a single transaction.

Not from a complex zero-day. Not from a reentrancy bug.

From one number set wrong in a config file.

Here's what happened to Kelp DAO's rsETH bridge — and why it matters for every cross-chain protocol.

[MoveBit @MoveBit_]

DVN misconfiguration is the new "approve unlimited allowance."

It looks harmless in code review. It's catastrophic in production.

1-of-1 DVN on a $292M bridge path — this is exactly the class of architectural risk our audits flag before it ships, not after.

Read the full breakdown by @0xbitslab

[BitsLab @0xbitslab]

$292M vanished in a single transaction.

Not from a complex zero-day. Not from a reentrancy bug.

From one number set wrong in a config file.

Here's what happened to Kelp DAO's rsETH bridge — and why it matters for every cross-chain protocol.

[BitsLab @0xbitslab]

https://t.co/OjaHqzBqeI