SlowMist is a Blockchain security firm established in 2018, providing services such as security audits, security consultants, red teaming, and more.
Joined April 2018
- Tweets4.3K
- Following412
- Followers90.6K
- Likes3.5K
🥳「2026 HK Institutional RWA & Stablecoin Forum」has successfully concluded!
On November 2, during Hong Kong #FintechWeek, SlowMist and JunHe LLP co-hosted this closed-door forum in Hong Kong.
Here's a look at some of the highlights 👇🧵
2/ The forum also featured three roundtable discussions, bringing together experts from across the industry for in-depth exchanges on #RWA, payment innovation, and institutional security.
💬 Discussions focused on three key areas:
🔹 RWA Development: Bringing traditional assets on-chain, including product implementation, fund structures, and asset management.
🔹 Stablecoin Payments: Cross-border payments, multi-currency operations, and the expansion of financial services.
🔹 Institutional Security: AI-driven threats, fund tracing and recovery, digital asset custody, and post-incident response.
The discussions brought together diverse industry perspectives, with speakers sharing practical insights on the opportunities and challenges facing the digital asset industry.✨
3/ Thank you to all the speakers, guests, and partners for making this gathering in Hong Kong such a memorable one! 🫶
Moving the industry forward takes collective effort. SlowMist will continue advancing blockchain security through security audits, threat intelligence, on-chain tracing, and AML services to help safeguard the digital asset ecosystem. 🫡
🇭🇰 Looking forward to our next meeting in Hong Kong!
Full Recap👇
slowmist.medium.com/event-re…
Congratulations to @Changer_Plus on successfully completing its smart contract security audit by SlowMist! 🎉
Thanks to Changer+ for choosing SlowMist as its security partner! 👏
🔗 Audit Report: github.com/slowmist/Knowledg…
Audited by @SlowMist_Team. Passed. ✅
Changer+’s token transfer smart contracts have passed a security audit covering EVM (Ethereum & BNB), TRON and Solana.
No critical, high, medium or low severity vulnerabilities were identified.
Simple to use. Serious about security.
changer.plus/security/audit-…
#SlowMist #WalletSecurity #SelfCustody #EVM #TRON #Solana #CryptoSecurity #Ethereum #BNB
🚨 On October 29, 2026, cross-chain protocol @zkLink_Official was exploited for approximately $783K. The SlowMist Security Team analyzed the incident and uncovered how a transient storage flaw led to forged batch roots and unauthorized withdrawals.
🧩 Attack Flow:
1️⃣ Queried totalBatchesExecuted and selected the next batch (116409) for forgery.
2️⃣ Executed a genuine Linea claim through SyncL2TxHashRelayer, writing finalizeMessageHash into transient storage.
3️⃣ Reused the stale finalizeMessageHash in a second claimMessage call, triggering an attacker-controlled call to EthereumGateway.
4️⃣ Used EthereumGateway.sendMessage to call ZkLink.syncBatchRoot, forging the batch root and advancing totalBatchesExecuted.
5️⃣ Executed 12 withdrawals against the forged root: 1 ETH and 11 ERC-20 transfers using forged Merkle proofs.
⚙️ Root Cause:
Arbitrator.claimMessage allows relayers to specify arbitrary call targets and calldata, while failing to clear or bind finalizeMessageHash to the current invocation. Combined with ZkLink.syncBatchRoot only checking gateway identity without verifying batch proofs, this enabled batch root forgery.
🔒 Recommendations:
When reviewing similar cross-chain relayer projects, pay attention to four areas:
1️⃣ Reset transient storage before each call.
2️⃣ Bind verification values to the current invocation.
3️⃣ Check whether arbitrary users can indirectly leverage trusted callers through public helper contracts or relayers.
4️⃣ Independently verify batch root updates rather than relying solely on caller identity.
Full analysis 👇
slowmist.medium.com/one-fish…
Thank you to @nypost and @vivilinsv for the interview. We’re glad to have had the opportunity to share our observations and analysis.
How North Korea's ruthless state sponsored hackers, main suspects in the $6.3B Binance heist, operate trib.al/0F2iybI
🔥 Agenda Released | 2026 HK Institutional RWA & Stablecoin Forum
On Nov 2, SlowMist and JunHe LLP will host a closed-door summit in Hong Kong to explore #RWA implementation, stablecoin payments, and institutional security and risk management.
🎤 Keynote Sessions
🔹 Keywolf (Partner & CPO, SlowMist): Security defense and #AML screening in the AI era
🔹 Jacqueline Qiao @CryptoQiao (Partner, JunHe LLP): Licensing and compliance for virtual assets and stablecoin payments in Hong Kong
💬 Key Discussion Topics
🔸 RWA tokenization and on-chain product development
🔸 Cross-border payments and financial services
🔸 On-chain incident response, fund tracing and recovery
Industry professionals from diverse sectors will come together for roundtable discussions.
📅 Nov 2 | 14:00–18:30 (GMT+8)
📍 AIA Central, Hong Kong
🙋 Register: luma.com/0p20jvw
See you in Hong Kong! 👋
🚨 SlowMist TI Alert: Trezor Hardware Wallet Supply Chain Alert 🚨
@Trezor hardware wallets have also been affected by the CryptoBilis reseller incident.
If you purchased a Trezor device from CryptoBilis since March 2026, follow Trezor’s security guidance:
⚠️ Already set up? Move your funds to a newly created wallet with a fresh seed as soon as possible.
⚠️ Do not reuse your old seed on any hardware or software wallet.
⚠️ Not yet set up? Do not use the device or enter your existing recovery phrase.
⚠️ Never share your recovery phrase with anyone.
Stay vigilant!
CryptoBilis update
We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:
Already using it?
Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.
Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.
We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.
On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far.
NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.
If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: trezor.io/support#open-chat
We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.
For more information, visit our blog: trezor.io/blog/news/implant-…
🚨SlowMist TI Alert🚨
💸 @zkLink_Official Loss: ~783.1k
🔍 Root Cause: Arbitrator.claimMessage failed to clear the transient finalizeMessageHash and require a fresh authenticated callback for each invocation. Through the publicly callable, authorized SyncL2TxHashRelayer, the attacker first populated a valid hash, then reused it while substituting EthereumGateway.sendMessage as the claim target. This executed ZkLink.syncBatchRoot under the legitimate gateway identity, installed an attacker-chosen l2LogsRootHashes root, and withdrew assets using forged proofs.
📌 Attacker: 0xaca0655a11200a80d33d0e48786317304cde5718, 0xDAB137F390dF77caA97fd492540E973fd5e2F8c8
📌 Victims: ZkLink 0x5fd9f73286b7e8683bab45019c94553b93e015cf; L1ERC20Bridge 0xad16edcf7deb7e90096a259c81269d811544b6b6
📌 Vulnerable Contract: Arbitrator 0x1ee09a2caa0813a5183f90f5a6d0e4871f4c6002 (implementation: 0x7a0bb4805ecb7fd3c8dabbe4afa0e91cb1761e34)
Powered by SlowMist.AI
Tx:
etherscan.io/tx/0x4f3c23e75b…
etherscan.io/tx/0x8a7e38b9c2…
🚨 SlowMist TI Alert 🚨
💸 Loss: ~1.013M USDC from a TranchePool reportedly associated with @ValinorDigital, Oatfi, and @fence_finance
🔍 Root Cause: At the UTC day rollover, the victim’s settlement logic treated a scheduled principal payment as received and subtracted it from the tranche’s recorded outstanding principal, despite no USDC repayment. The draw function (0x8e27c105) then checked the requested amount against funded principal − outstanding principal. That artificially restored 1.013M USDC of draw capacity, allowing the attacker to draw the same amount a second time with identical calldata.
📌 Attacker: 0x6ff1c3ffa622e1062168f3497a275be9cc2b1246
📌 Vulnerable Contract: 0xe25cb545bdd47a8ec2d08001cb5661b00d47621a
Powered by SlowMist.AI
Tx:
snowscan.xyz/tx/0x19ab145e7f…
snowscan.xyz/tx/0x3f6b23292a…
🚨 Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Deposit Addresses
@SlowMist_Team recently detected an attack involving malicious code injected into scripts associated with the #Udesk customer service system during routine threat intelligence investigations. We obtained and analyzed two #JavaScript samples to trace how the malicious code was loaded into webpages and executed.
🔍 Further analysis revealed two key malicious behaviors:
🔹 The malicious script collects cookies, localStorage, sessionStorage, and sensitive information submitted through forms and authentication requests, potentially exposing user sessions and account credentials.
🔹 The script replaces deposit addresses displayed on specific websites and tampers with clipboard contents, potentially redirecting deposits to substituted recipient addresses.
MistEye (misteye.io), SlowMist’s Web3 threat intelligence system, promptly disseminated the relevant risk information through its intelligence push and customer alert channels.🫡
🛡️ Recommendations:
Stop serving compromised scripts and restore trusted versions. Investigate data exfiltration records, revoke potentially exposed sessions, and rotate potentially exposed credentials from a clean environment. Independently verify deposit addresses and transaction records through trusted channels.
Read the full analysis 👇
slowmist.medium.com/threat-i…
As #RWA tokenization and stablecoin payments move into broader financial use cases, institutions face growing challenges in compliance, fund risk, and security.
On Nov 2, during Hong Kong FinTech Week, SlowMist × JunHe LLP will host the closed-door summit “Legal Breakthrough, Risk Foundation | 2026 Hong Kong RWA & #Stablecoin Payments Institutional Summit.”
Discussion topics include:
✅ RWA issuance & distribution workflows
✅ Stablecoin payments & cross-border settlement
✅ On-chain risk monitoring & emergency response
📅 Nov 2, 2026 | 14:00–18:30 (GMT+8)
📍 AIA Central, Central, Hong Kong
🙋 Register: luma.com/0p20jvwy
We sincerely welcome senior executives and decision-makers from relevant institutions to join us! 👋
🚨SlowMist TI Alert🚨
💸 Yapeswap Loss: ~$21.9k
🔍 Root Cause: WorkersUnion’s zero quorum let a proposal backed by ~0.000055% of voting power transfer YapeFactory’s `feeToSetter` role to the attacker. The attacker installed a Registry that returned fake vaults from `latestVault()` while `vaults()` still listed real ones. YapePair counted the diverted deposits as farming assets without receiving redeemable shares.
📌 Attacker: 0x6e523866424220b3cb2cab88ba2195cfa5636b12 (EOA) / 0x327bf6dfc38a79393f78866c705193c39b04be01 (contract)
📌 Victim: YapePair contracts (e.g. 0x23c1653e…, 0x670120d4…, 0x8e5b9d85…, 0xe3b43be5…, 0xec5ed926…, 0x0415af9f…)
📌 Vulnerable Contract: YapeFactory / YapePair / YapeWrapper (0x46adc1c052fafd590f56c42e379d7d16622835a2)
Powered by SlowMist.AI
Tx: etherscan.io/tx/0x4c741568cc…
🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users
⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword.
DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk.
🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges.
🛡️ Stay safe:
• Keep your iOS devices updated.
• Be cautious of suspicious or compromised apps.
• Never store sensitive wallet credentials or seed phrases in Notes.
📖 Related SlowMist analyses:
🔗 DarkSword Trojan Backend & iOS Attack Chain:
slowmist.medium.com/threat-i…
🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:
slowmist.medium.com/threat-i…
🚨 Threat Intelligence | Beware: Web3 Interview Questions Conceal a Data-Stealing Backdoor
@SlowMist_Team recently received user reports about a GitHub repository named sol-live, presented as a #Solidity interview practice project. Analysis revealed a hidden download-and-execute command in .vscode/settings.json that can run a remote script when the project's custom terminal configuration is launched.
🔍 The retrieved payload contains three main modules capable of:
🔹 Collecting browser login databases and wallet extension storage, and copying #macOS Keychain files
🔹 Scanning and uploading local files
🔹 Executing remote commands, providing interactive shell access, and monitoring clipboard contents
⚠️ On macOS/Linux, execution requires users to actively launch the malicious terminal configuration. The #Windows execution chain remains unconfirmed due to potential quoting issues.
We also identified 8 other #GitHub projects with similar terminal-based download-and-execute techniques. The analysis does not confirm the actual scope of infection or whether data was exfiltrated.
🛡️ Recommendations:
Review .vscode/settings.json and terminal launch arguments before using untrusted projects. If execution is confirmed or cannot be ruled out, isolate and investigate the affected host, then migrate wallet assets and rotate relevant credentials from a trusted device.
Read the full analysis 👇
slowmist.medium.com/threat-i…
