SlowMist headlines
-
U.S. OFAC Sanctions Individuals and Entities Linked to DPRK IT Worker Networks
Recently, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced the designation of 10 individuals and one entity. According to the U.S. Department of the Treasury, these targets were involved in facilitating overseas IT worker networks operated by the North Korean...
-
Event Recap | 2026 HK Institutional RWA & Stablecoin Forum Successfully Held
On November 2, during Hong Kong FinTech Week, the “Legal Breakthrough, Risk Foundation | 2026 HK Institutional RWA & Stablecoin Forum,” co-hosted by SlowMist and JunHe LLP, was held at AIA Central in Central, Hong Kong. The event brought together institutional representatives and industry guests...
-
One Fish, Multiple Meals — Analysis of the $780K zkLink Exploit
Background On October 29, 2026, the well-known cross-chain protocol zkLink was attacked, resulting in losses of approximately $783,000. The following is a detailed analysis of this incident by the SlowMist security team: Prerequisites zkLink is a multi-chain zk-rollup protocol. On Ethereum, the...
-
MistTrack Quarterly Update: KYA Batch Screening and Tracing Canvas Now Available
To address the practical needs of batch risk screening and on-chain fund investigations, MistTrack has recently introduced two new features: KYA Batch Screening and Tracing Canvas. The former helps risk management and compliance teams process large numbers of wallet addresses in one place and...
-
Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Transfer Addresses
Background Recently, SlowMist security personnel detected an attack involving the injection of malicious code into scripts associated with the Udesk customer service system during routine threat intelligence investigations. The team subsequently obtained two JavaScript samples,...
-
Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor
Background SlowMist’s security team recently received user reports about a GitHub repository named sol-live. Presented as a Solidity interview practice project, its README lists eight questions and claims that each should take 5 to 10 minutes to complete, lowering users' guard. Upon analysis, we...
-
PHP Unveils Critical “Internet-Wide” Vulnerabilities: How Can Web3 Patch Its “Off-Chain Weaknesses”?
What Happened On October 21, the PHP project released emergency security updates to fix two critical vulnerabilities, CVE-2026–109618 and CVE-2026–109619, which could lead to unauthenticated remote code execution (RCE). Both were rated 9.2 under CVSS v4.0. The PHP team explicitly stated that before...
-
Recovering Private Keys in Just 6 Connections: Qubic Wallet May Have Leaked Most of Its Private…
Recovering Private Keys in Just 6 Connections: Qubic Wallet May Have Leaked Most of Its Private Keys Background On October 18, Qubic disclosed in an official announcement that attackers had exploited insufficient randomness in certain wallets to access and transfer approximately 2.94 trillion QU...
-
Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain
Background On March 18, 2026, Google Threat Intelligence Group published a report titled “The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors,” focusing on the spread of the DarkSword exploit chain among multiple threat groups. This chain targets iPhones running iOS...
-
Threat Intelligence | Analysis of a Malicious Bookmark Phishing Attack Targeting Fomo Users
1. Background Recently, the SlowMist security team received a request for assistance from a Fomo user. The user reported that while viewing the details of the MOONLET token on the Fomo web interface, they clicked the project website entry displayed on the page and were redirected to voltage.family....
-
FATF Report | How to Understand and Address Risks in Gaming and Gambling
In September 2026, the Financial Action Task Force (FATF) published the report Risks of Gaming and Gambling , providing a systematic analysis of money laundering, terrorist financing, and proliferation financing risks in areas including casinos, sports betting, other forms of gambling, and online...
-
Analysis | Joint Report by Japan, the US, Australia, and Germany: Job-Seeking Phishing and Laptop…
Analysis | Joint Report by Japan, the US, Australia, and Germany: Job-Seeking Phishing and Laptop Farms Operated by the North Korean Hacker Group “WaterPlum” On September 18, Japan’s National Police Agency, together with the National Cybersecurity Office, the U.S. Federal Bureau of Investigation,...
-
Threat Intelligence | PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager
Background The sample comes from a development branch of the Laravel Nova extension package visanduma/nova-two-factor, associated with the PolinRider campaign. This is a PHP package published on Packagist, with more than 700,000 cumulative downloads as of the time of this analysis. The delivery...
-
Threat Intelligence | Analysis of FomoPeek App Store Poisoning and iOS Kernel Exploitation
Recently, the SlowMist security team received multiple reports of user assets being stolen. Upon verification, all of the incidents involved private key exposure, and some of the affected users had previously downloaded and used FomoPeek App versions 1.1–1.2. Through a joint analysis with the OKX...
-
Analysis of the Liquid Network Cache Key Collision Vulnerability: Nearly 4,000 L-BTC Minted Out of…
Analysis of the Liquid Network Cache Key Collision Vulnerability: Nearly 4,000 L-BTC Minted Out of Thin Air At 13:52:10 UTC on September 6, two transactions with the same structure appeared in Liquid block 4,050,335. One minute later, a third transaction was confirmed in block 4,050,336, bringing...
-
U.S. OFAC and DOJ Join Forces to Crack Down on Xinbi Guarantee, Restricting More Than $52 Million…
U.S. OFAC and DOJ Join Forces to Crack Down on Xinbi Guarantee, Restricting More Than $52 Million in Crypto Assets On September 9, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the U.S. Department of Justice (DOJ) announced coordinated enforcement actions against...
-
The Vanishing Debt — An Analysis of the Notional Finance Hack
Background On September 4, 2026, the well-known decentralized lending platform Notional Finance was attacked, resulting in approximately $1.73 million in losses. The following is a detailed analysis of this attack by the SlowMist Security Team: Prerequisite Knowledge In Notional Finance V1, fCash...
-
Threat Intelligence | iOS Safari DarkSword Wallet Asset Theft
Background A campaign offering free VPS services was actually a decoy. A page recovered from a public web archive shows that event[.]polarnode[.]vip, registered in late August 2026, declared https[:]//lk[.]wyincc[.]com/lk.js as a preload script and automatically loaded it once the page became...
-
On-Chain Fund Source Risks Behind OKX’s Risk Control Strategy
Recently, the CEO of OKX responded to a user post about a situation where a “gambling platform directly transferred funds to an exchange, causing the deposit to trigger a review.” According to his public statement, deposits to OKX from high-risk addresses may trigger stricter anti-money laundering...
-
SlowMist: MistTrack & SlowMist KYT Partner Program Officially Launches
As crypto assets, stablecoin payments, and digital financial services continue to develop, on-chain AML, KYT, and fund risk analysis are becoming practical needs for an increasing number of institutions. To this end, MistTrack & SlowMist KYT has officially launched its Partner Program, recruiting...
-
“Gray Rhinos” and “Black Swans”: SlowMist Founder Cos on Security Risks and Protection in the…
“Gray Rhinos” and “Black Swans”: SlowMist Founder Cos on Security Risks and Protection in the Crypto World On August 28, at the Cypher Asia Intelligent Crypto Finance Summit, SlowMist Founder Cos delivered a keynote speech titled “Gray Rhinos and Black Swans in the Crypto World.” Starting from...