喵内酱

Web3爱好者 🌏

[Vladyslav @Vladyslav2mst]

This user swapped $948,000 and got only $3,987 🥶

Full unluck
https://t.co/uGexyp7pit

[BlockSec Phalcon @Phalcon_xyz]

Wanchain @wanchain_org Cardano bridge was reportedly being attacked, with ~515M $NIGHT drained from the bridge Treasury.

Our initial investigation suggests that the root cause seems to be a non-injective signed-message encoding in the TreasuryCheck validator. The signed message is built by raw-concatenating 14 variable-length redeemer fields (via `AppendByteString` fold) without delimiters or length prefixes. Different field-value tuples can produce the same byte string — and therefore the same hash and a valid signature reuse.

We verified this by decompiling the on-chain Plutus V2 bytecode (pic 1) and decoding the attack redeemer from the exploit TX (pic 2).

The same on-chain bytecode also contains a `SerialiseData` builtin — but it is only used on the output-datum matching path, not in the signature-hash construction. Using `Sha3_256(SerialiseData(...))` instead would have provided unambiguous CBOR-encoded field boundaries, preventing this class of field-splitting signature reuse.

Attack TX: https://t.co/hmmPlgmfma

[Defi Nerd @Defi_Nerd_sec]

🚨 DeFiTuna on #Solana was exploited for 569,601 USDC after a fixed-point value below one raw unit was truncated to zero and is_healthy() treated the zero-valued, debt-bearing position as healthy.

💰 Impact: The lending vault sent 570,000 USDC; 399 USDC was retained as protocol fee and the remaining 569,601 USDC was routed into an attacker-created TUNA/USDC pool. Two malicious limit orders immediately withdrew 568,560.966462 USDC; the remaining 1,040.033538 USDC stayed in the fake pool vault at that point.

�� Time: 2026-07-16 05:48:12 UTC, Solana slot 433214256

🔎 Root cause: compute_total_and_debt() multiplied 494 raw TUNA units by the reference price and converted the positive fixed-point result with to_num::<u64>(), discarding the fractional part and producing total = 0. is_healthy() then returned true solely because total == 0, without requiring debt == 0.

🧭 Attack trace:

The attackers created a nearly empty TUNA/USDC Fusion pool and placed two limit orders containing only 0.000526 TUNA each at an extreme tick.
They opened a DeFiTuna spot position with zero collateral and borrowed 570,000 USDC.
After the 399 USDC fee, an attacker-controlled Jupiter route sent 569,601 USDC into the prepared pool.
The pool returned only 0.000494 TUNA, worth less than one raw USDC unit at DeFiTuna's reference price.
Integer conversion rounded the position's total assets to zero; the total == 0 branch marked the indebted position healthy.
The two attacker-controlled limit orders withdrew 284,280.483231 USDC each.

📌 Key addresses:

Primary signer: 7hiHL8AgDuLNVDQLfN3GHdLAEeCN1F7uz6nSANRvFJst
DeFiTuna program: tuna4uSQZncNeeiAMKbstuxA9CUkHH6HmC64wgmnogD
Fusion program: fUSioN9YKKSa3CUC2YUc4tPkHJ5Y6XW1yz8y6F7qWz9
Fake pool: 917DKTphW3rhBG5gsJpwKsNGisNV2dx74uUFd8HBEjtg
Lending-vault state/authority: D76dDcSU5HnAGqVEZCDLyGgLpTp4xZuqeZyVDtUdDv55
Damaged USDC token vault: 4iTbtBmr4fXpkUD4kTW9pujvXbCT3AkWya6h3dbNP7a6
Fake-pool USDC vault: GpKYG4iFoty4mnhfKfyLCkQ26Mm2NRFcezmDmzaBQb14

🧾 Txs:

Borrow and swap: https://t.co/yscbw9RlxF
First withdrawal: https://t.co/FS8yyzwkZB
Second withdrawal: https://t.co/WM3MSteH6m

🛡️ Takeaway: A zero asset valuation is not an empty position when debt is nonzero. Solvency checks must round conservatively, preserve fixed-point precision through the comparison, reject zero-collateral debt, and require debt == 0 before treating total == 0 as healthy.

Powered by #DarkNavy Web3 AI Agent

[F12 @f12sec]

🚨 EXPLOIT - TeleSwap (BTC bridge) was exploited on Jul 15 for ~10.33 BTC (~$735K) - still undisclosed 5 days later.

Its BTC hot wallet sent the stolen funds straight to the attacker, then went quiet (balance now 0)

Theft addr (now empty):

https://t.co/drvfc06x8C

[喵内酱 @UK621593]

@0xAstra 6

[无颜 @WY_mask]

生成地址证明平台集合，可过一些打新平台的KYC，但是也和运气有关

1、账单地址生成
https://t.co/DswCklh4d3
2、地址证明文件，可以用加密货币支付
https://t.co/LoarboNiyU
3、可生成香港、澳洲、加拿大、英国、新加坡的地址证明
https://t.co/zoudrue4O3
4、地址证明文件，支持微信、加密货币
https://t.co/buiNFvkrrm
5、简陋生成地址
https://t.co/Mo4gjcXkfg

[Labrin @Labrin]

一个自己用的 Robinhood LP 小工具，已经开源;
这两周挖的蛮爽的

仓库地址：https://t.co/sXbq6aoH0H

网址访问：https://t.co/KVio86Yml8

[喷子 @jt588888]

这个李呆妹 也是个臭傻逼
你的认证地址: 0xdb1d8353f5092b40c92c64206d7272b788ab80fb
购买哈基仙人:900U成本 39K

分仓:
0xfc000eb725b669e5beb687995e6202b05f3e00d1 卖出300U
签名0xca568a3fd073a956a23ace387edf977f4db465ca2a9c13558b99e6a30e4fb95b

分仓:
0xb37b441d2eb304b295204c4a16b74aca2d26d9af 卖出688U
签名0x262ff4cf2e59fb51a7ed833d6770baa357440872d3d19b7a78af9972564d39d4

分仓:
0xc6a1cbb3033e611765cb304c5d2daedbee1ae4e5 卖出240U
签名: 0x77eae78a21c25721d8f9a178bb2aeb77056d091737fde51c6bba14aa6bd695ef

重点:
0x3b4b4b2be503378040ed4b1d6f75a6df904d19e8
这个地址一直在出货,这个地址也是您的
证明:
你的地址:
0xdb1d8353F5092B40C92C64206D7272b788AB80fB
转入0x577EEABDEFcC551830DdF9573337D44fA869B7A8 (300万个)
签名0xf85c41ef7b3d469b36ab1bba5f936e689d902ff719ed774cab82cd2242fd4e50

并且还有很多其他小地址(也是你的吧)给这个地址0x577eeabdefcc551830ddf9573337d44fa869b7a8 转入代币
最后这个地址一共转出:
2000万个哈基仙人到地址
0x3b4B4b2bE503378040ed4B1d6F75A6df904d19e8 (收到2000万个哈基仙人，并且在47万市值出货)
转入2000万个代币的签名
0x6a975a726c90bea4f7d27541ba01d868475beda512b4399cbedf61b750342910

0x3b4b4b2be503378040ed4b1d6f75a6df904d19e8
这个地址现在是榜7，并且在高点出货
卖货签名:
0x3795880ad9b9f9fa0a19aa84bf0ccfaa1fb9e6a76e338931088bd1a14f1d6ea6

0x7c75bf5e2e6cea198dea3afdf4360486674c3afb76a39aa6471cd630420f0b5c

0x116bfdb4a5307547518cb60963b7425e72b7f4405e2b1b777d8f86a16c8aced9

你的操作太垃圾了，拙劣，我都不想扒，实在太简单了，你怎么好意思去别人群里，让别人支持你的，还骂别人管理。
还好这两天行情不好，不然又被你个小逼崽子爽翻了

#哈基仙人 #哈基米

这种打着建设，然后一边偷偷出货的垃圾KOL，真的太多了，我操你

狗女人

[喵内酱 @UK621593]

@trondaoCN @tron_boniu 牛牛也是超级无敌可爱🥵🥵

[TRON DAO中文 @trondaoCN]

🏖️波场人专属夏日OOTD征集令来啦！

🎯参与方式：
✅关注 @trondaoCN @tron_boniu
✅转发本推文
✅评论区晒出你的夏日穿搭实拍图：穿TRON周边，或搭配任意波场红元素，都算通关

🎁抽20位穿搭达人送出夏日大礼包 #TRON

⚠️领奖仅限中国大陆地址

[喵内酱 @UK621593]

@luge517 @predictdotfun 用 https://t.co/IDMRszY8iV 预测BTC!😋

[藤蔓鲁哥 @luge517]

[庆祝]https://t.co/1utmJDvi9T 世界杯周边大礼包抽奖！
准备了 3份 大礼包送给大家～
每份包含：限定球衣 + 官方足球 + YES/NO 袜子 + 金属徽章 + 精美礼盒
参与方式：
1、关注 @predictdotfun & @luge517
2、转发本帖 + 点赞
3、在评论区回答：你最想用 https://t.co/1utmJDvi9T 预测的下一场大赛事是什么？

抽奖时间： 即日起至 7月23日 23:59
开奖方式： 随机抽取 3 位幸运用户，私信领取地址

祝大家好运！⚽另外谢谢tc @TC8880 送我的周边

#PredictFun #世界杯 #抽奖

[喵内酱 @UK621593]

@bclaobai @deepcoin_cn @grok 哥哥哥哥抽��我一次也没���过🥺

[老白｜LaoBai 🌊 👑 @bclaobai]

【阿根廷🇦🇷 x 深币官方周边抽奖】🎟️

感谢 @deepcoin_cn 提供精美阿根廷联名周边：
1 套豪华礼盒🎁 + 10个足球⚽️，共 11 个名额。

24小时后，全部通过 @grok 抽出送给大家✌️

参与形式：仅需关注 @deepcoin_cn ，三连本抽奖帖。

[余烬 @EmberCN]

一个半小时前，DeBank 用户名为 "musti_akrep" 的地址，通过利用漏洞在 Perp DEX @Ostium 上 "盈利" 了 2375 万 USDC 并提走。

这 2375 万 USDC 被提出到 Arbitrum 链上，然后立即买成了 12,085 枚 ETH，买入价格 $1,965。

这 12,085 枚 ETH 现在还在 Arbitrum 链上放着，话说...他不知道 Arbitrum 链是有能力转走他的 ETH 的吗😂
虽然这次 Arbitrum 链不一定还会跟上次 rsETH 事件那样帮忙从黑客地址里取回 ETH。

漏洞利用地址：https://t.co/2vM21swpBb
ETH 存放地址：https://t.co/43KgXltoSD

--------------------------------------------------------------------------
#Bitget 来了就是VIP！Crypto、美股、CFD，全球先机一站布��

[喵内酱 @UK621593]

@0xMulight @deepcoin_cn 可以私募吗抽奖一次也没中过😋

[Mulight 沐光🌟 @0xMulight]

赠送几套Deepcoin世界杯周边！6套足球+杯子，

送给喜欢的朋友，质量真的没得说，杠杠的！
手感、做工、颜值都在线，超级实用。

奖品：
共 6套 Deepcoin周边，

每套包含：
1个Deepcoin足球
1个Deepcoin杯子

参与方式：
· 关注 @0xMulight 和 @deepcoin_cn
· 点赞 + 转发本动态条推文
· 评论区随意回复

活动时间：
48小时开奖

每个账号仅限参与1次
中奖后请在24小时内私信领取，逾期视为放弃

快来评论区参与吧！

[DogeSwap @swap_doge]

https://t.co/So9MXSBhAS

cpu挖矿

Bitcoin 09 (09C) 来了！
✅ 21M cap、无 premine、公平发射
📷📷 50 币/块、10min 出块，完全比特币参数
就像 2009 年一样，从家用电脑开始挖！
官网: https://t.co/So9MXSBhAS
浏览器: https://t.co/JWuSuykXfE
#Bitcoin09 #09C #CPUMining

[喵内酱 @UK621593]

@tron_boniu @Jb18cm_Biggest 没流量啊牛牛

[喵内酱 @UK621593]

见过凌晨四点的K线，也熬过漫长的寒冬。不管外界怎么��，作为亲历者，还是希望行业能越来越规范。祝九周年快乐，未来九年，继续见证。🙏🎂

#币安九周年 #9号球员

[币安Binance华语 @binancezh]

9️⃣号球员就是九周年的币安，新的赛场已开赛！

感谢每一位陪伴币安走到今天的你们 —— 球员已上场，这一次你是哪一席？

💛 请选择你的身份：教练、队友、后援、主持……从身份出发分享和币安相关的故事、视频、图文

用你的故事、祝福或创意，为9号球员送上助攻💪

🎁带作品和 #币安九周年 RT即可参与活动，9位最佳助攻获得199U，10位优秀创作者获得周年���边礼盒