
CMO @SALUS_sec /Co-Founder @flashrescue 没有完美的犯罪 被盗,被骗资产救援紧急联系方式 tg:DarcyAri
Tukwila, WA
Joined March 2024
- Tweets2.5K
- Following1.7K
- Followers6.1K
- Likes6.9K
从币安的初步通报来看,DevOps 工程师终端遭入侵并非罕见的攻击入口,单台终端失陷,为什么能突破后续的权限控制,最终发起未经授权的提款交易
从红蓝对抗视角拆解这起攻击的三个可能实现的核心技术点:
高阶免杀:针对 DevOps 终端的攻击极少用公开载荷。攻击者大概率结合了开发环境投毒(恶意依赖包/插件)与白加黑(Dylib/DLL 劫持)、间接系统调用(Indirect Syscalls)及内存休眠混淆,在不触发本地 EDR 告警的情况下静默驻留
隐蔽横向:不做任何内网扫描,直接复用工程师本地缓存的活跃会话(劫持 SSH Agent Socket、窃取云端 STS Token 或 kubeconfig),顺着合法的运维通道直接切入目标服务容器,完美绕过 MFA 与边界防火墙
权限绕过:现代交易所普遍采用 HSM/MPC 保护私钥,私钥本身无法导出。但攻击者拿下上游“服务容器”后,相当于控制了向签名机发号施令的大脑——直接复用容器自身的 mTLS 证书或高权限服务凭证,在内存或消息队列中伪造“已通过风控审批”的提款请求,驱使底层签名节点自动完成签名上链
Web3 机构的核心防御必须彻底打破“内网即信任”假设,在三个关键节点做阻断:
终端零信任与无凭证化:针对 DevOps 笔记本被攻破的入口风险,严禁办公终端本地明文落盘 kubeconfig、SSH 私钥或长效云端凭证,强制使用硬件密钥(如 YubiKey)绑定单次高危运维鉴权,从源头废除木马的会话劫持能力
生产容器 JIT 隔离与运行时监控:针对攻击者顺着运维通道切入服务容器的路径,切断办公网到生产集群的常驻网络权限,仅开放即时按需(JIT)临时审批通道,并配合 eBPF 容器运行时监控实时熔断异常指令
签名层独立校验与带外审批(OOB):针对未碰触私钥却能提交未授权提款的逻辑绕过,底层 MPC/HSM 节点绝不能盲目信任内部服务容器发来的指令,必须独立校验不可篡改的端到端业务原始签名,并对大额异常提款强制触发脱离生产网的硬件多签带外确认与链上速率熔断
Axis或许是和我们长期追踪的一个诈骗项目是关联的,部分证据可能考虑在近期发出
Replying to @axisrobotics
Please explain to the community why an entity received ~42M AXIS from the Axis team multisig to six addresses and sold it for ~5.04M USDC via DEX over the past 24 hours which has caused the AXIS price to crash 40%?
You only TGE’d one week ago….
0xcc279c2499bcf4bd0f169c2d3f333243473242f7
0x66612012c5ad9b2fed81d09a9ab429b5285b2c62
0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0
0x99cd3975c90b79ffdbe16425de033a605b814c49
0xbbed67fec9c7793218fa60c40fb9e6b059d86483
0xe69d8d6b9b7f9056eda455b76384e9748749f4d1
0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d
Darcy 资产救援⛑️ retweeted
The Bloom drainer stole nearly $1M and is laundering it like an eight-figure haul.
The transfer pattern suggests automation which includes repeated splits, consolidations, and bridges across thousands of addresses.
The attacker has used 2,152 unique routing and destination addresses (1,326 Solana, 822 EVM and 5 Zcash)
The attacker bridged to zcash with 26.099 ZEC going into the Sapling shielded pool,
Stay Smart
If @CoinDCX was not hacked, then it appears to have stolen its users’ assets itself.
The following addresses listed in the latest PoR:
TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGd
TM5r1bNJ2TjZwfS757tPPtr84MwtEjL9qN
have transferred funds to the hacker address:
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
Moreover, your hot wallet address, TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGd, continued distributing 15 TRX both before and after what you describe as the hacking incident. Are you suggesting that the hackers were handling gas funding distribution for you?
Some of the stolen funds have already flowed into exchanges:
Binance: 2,020,943 USDT
OKX: 5,465,933 USDT
50,000 USDT
Gate: 1,392,199 USDT
Some funds have also flowed into addresses associated with Huione and Xinbi 🤧🤧. Please don’t dodge the issue.
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses.
All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised.
Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.
如果 @CoinDCX 没有被黑客攻击,那似乎是自己窃取了用户的资产
最新的por里面,地址:TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGd ,TM5r1bNJ2TjZwfS757tPPtr84MwtEjL9qN
向黑客地址:
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 进行转账
并且你们的热钱包地址:TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGd,在你们所谓的黑客事件前后,一直在承担分发15trx的功能,您的意思是黑客帮你们在承担gas的分发工作吗?
目前部分被盗资金已流入交易所:
Binance 2,020,943 USDT
OKX 5,465,933 USDT
50,000 USDT
Gate1,392,199 USDT
部分资金同样流入huione xinbi关联地址🤧🤧,请不要触发闪避技能
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses.
All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised.
Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.
10 月 21 日 23:35:54(UTC+8),CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX
CoinDCX 热钱包及多个充值地址,向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX
其中最大单笔为 15,819,002 USDT,该地址随后向多个地址转出资金,经多次拆分流向Binance、OKX、Gate 等充值地址
Darcy 资产救援⛑️ retweeted
The Drift Protocol exploiter deposited 19,600 ETH (~$46.81M) into Tornado Cash in 196 transactions on October 20, 2026, moving funds held for roughly 202 days, according to the our Tornado monitoring system.
On April 1, the Solana perpetuals platform suffered an estimated $285M theft following social engineering and an administrative takeover, according to Chainalysis.
The exploiter bridged part of the funds to Ethereum via CCTP, converted them into ETH and parked them in 0xaa843e…57c1. That wallet made its first outgoing transaction today.
As of October 20, the wallet still held approximately 6,114.15 ETH (~$14.60M).
Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers.
This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution, including the use of durable nonce accounts to pre-sign transactions that delayed execution.
Darcy 资产救援⛑️ retweeted
十月十一日,一名自媒体博主收到高薪商业拍摄邀约。对方提前支付定金取得信任,随后诱其前往泰国。抵达后,受害人被带至一处偏僻房屋,面临被转手出售的风险
受害人察觉异常后,及时联系亲友,并装病拖延时间。据其描述,拟接手人员因受害人病情对约定价格提出异议,双方发生争执,交易暂时中止,为救援争取了时间
接到亲友求助后,我们协同警方,结合涉事人员的电话线索、受害人沿途拍摄的照片和一张外卖照片,锁定其位置,最终协助其获救
警方随后将涉事人员带回调查,并继续核查其出入境记录、边境地区行程及是否涉及非正规越境,相关情况仍在调查中
泰缅跨境转运时间窗口极短,一旦出境救援非常困难。境外工作邀约即使提供定金,也应核实雇主、工作地点和接洽人员
On October 11, a content creator received a lucrative offer for a commercial shoot. The organizers paid a deposit upfront to gain their trust, then lured them to Thailand. Upon arrival, the victim was taken to an isolated house, where they faced the risk of being sold to another party
Realizing something was wrong, the victim contacted family and friends and feigned illness to buy time. According to the victim, the prospective buyers disputed the agreed price because of their apparent illness. An argument broke out, temporarily halting the transaction and buying crucial time for rescue. After receiving a request for help from the victim’s family and friends, we worked with police to pinpoint their location using phone-related leads concerning those involved, photographs the victim had taken along the journey, and a photograph of a food delivery order. We ultimately helped secure the victim’s rescue
Police subsequently took those involved in for questioning and continued examining their immigration records, travel in border areas, and possible involvement in irregular border crossings. The investigation remains ongoing
The window for intervention before victims are transferred across the Thai–Myanmar border is extremely narrow. Once they have been taken across, rescue becomes very difficult. Even when an overseas job offer includes an upfront deposit, verify the employer, the actual work location, and the people arranging the engagement
Darcy 资产救援⛑️ retweeted
大家好,我们做了一款真正安全、超轻量、AI Native 的指纹浏览器 —@exfing_browser
我们的 ExFing 指纹浏览器 内测正式上线了!
💡 我们为什么要自己做一款指纹浏览器?
市面上流行的几款指纹浏览器屡次发生被黑客攻击、用户资产遭受不可挽回损失的事件。这说明很多厂商并没有把“安全稳定”作为产品的底层基因。 我个人在浏览器安全领域深耕多年,专注漏洞挖掘与安全风险研究。ExFing 的初衷,就是站在“攻击者”视角做最严苛的安全防护,从底层扼杀潜在攻击,打造真正安全可靠的运行环境。
⚡ 摒弃重量级框架,极致轻便与低资源占用 相信很多多开用户都深受“卡顿、内存吃紧”的困扰。相比其他同行,ExFing 并没有采用传统的 React 模式,彻底告别冗余开销。产品整体架构极度轻便,CPU与内存占用更小,运行与启动速度飞快,哪怕多开几十上百个环境依然顺滑!
🤖 拒绝伪 AI,打造真正的 AI Native 体验 现在的很多指纹浏览器只是生硬地挂个 AI 或 MCP 插件。而 ExFing 从架构之初就是 AI Native 的,旨在帮你以最高效、最自动化的方式完成账号运营工作,大幅减少繁琐的手动操作(功能很快开放!)。
🎁 内测限时福利:
完全免费:内测阶段所有高级功能全部免费开放!
不限环境与子账号:支持创建任意多个环境与子账号,无上限,放开测试!
对于内测用户,我们会在后续使用中,会有更多折扣!
🔗 立即注册下载:app.exfing.com/
🐦 关注官方推特:nitter.cf/exfing_browser
💬 加入内测反馈微信群
欢迎大家下载体验,多给我们提宝贵的 Bug 和建议!
Darcy 资产救援⛑️ retweeted
🚨警惕涉及泰国、越南等地的加密行业招聘广告
据 Web3 安全公司 @salus_sec 监测,其近期发现加密行业出现部分东南亚地区招聘广告,涉及泰国及越南等地。
若应聘者贸然前往可能存在被诱拐至缅甸的风险。
Foresight News 提醒您,前往东南亚国家需要做好充分的攻略并保持警惕,以确保人身与财产安全。
Darcy 资产救援⛑️ retweeted
⚠️据悉,这次事件当事人此前是加密从业者。
小编也提醒各位,前往泰国等地区务必警惕此类“高薪合作/拍摄”诱骗!对方先付定金也可能是圈套,务必核实雇主、实际地点与对接人员真实性,避免被带往偏远或边境区域。一旦接近泰缅边境,救援窗口极窄,难度极大。
安全第一,提高警惕!
On October 11, a content creator received a lucrative offer for a commercial shoot. The organizers paid a deposit upfront to gain their trust, then lured them to Thailand. Upon arrival, the victim was taken to an isolated house, where they faced the risk of being sold to another party
Realizing something was wrong, the victim contacted family and friends and feigned illness to buy time. According to the victim, the prospective buyers disputed the agreed price because of their apparent illness. An argument broke out, temporarily halting the transaction and buying crucial time for rescue. After receiving a request for help from the victim’s family and friends, we worked with police to pinpoint their location using phone-related leads concerning those involved, photographs the victim had taken along the journey, and a photograph of a food delivery order. We ultimately helped secure the victim’s rescue
Police subsequently took those involved in for questioning and continued examining their immigration records, travel in border areas, and possible involvement in irregular border crossings. The investigation remains ongoing
The window for intervention before victims are transferred across the Thai–Myanmar border is extremely narrow. Once they have been taken across, rescue becomes very difficult. Even when an overseas job offer includes an upfront deposit, verify the employer, the actual work location, and the people arranging the engagement
十月十一日,一名自媒体博主收到高薪商业拍摄邀约。对方提前支付定金取得信任,随后诱其前往泰国。抵达后,受害人被带至一处偏僻房屋,面临被转手出售的风险
受害人察觉异常后,及时联系亲友,并装病拖延时间。据其描述,拟接手人员因受害人病情对约定价格提出异议,双方发生争执,交易暂时中止,为救援争取了时间
接到亲友求助后,我们协同警方,结合涉事人员的电话线索、受害人沿途拍摄的照片和一张外卖照片,锁定其位置,最终协助其获救
警方随后将涉事人员带回调查,并继续核查其出入境记录、边境地区行程及是否涉及非正规越境,相关情况仍在调查中
泰缅跨境转运时间窗口极短,一旦出境救援非常困难。境外工作邀约即使提供定金,也应核实雇主、工作地点和接洽人员
On October 11, a content creator received a lucrative offer for a commercial shoot. The organizers paid a deposit upfront to gain their trust, then lured them to Thailand. Upon arrival, the victim was taken to an isolated house, where they faced the risk of being sold to another party
Realizing something was wrong, the victim contacted family and friends and feigned illness to buy time. According to the victim, the prospective buyers disputed the agreed price because of their apparent illness. An argument broke out, temporarily halting the transaction and buying crucial time for rescue. After receiving a request for help from the victim’s family and friends, we worked with police to pinpoint their location using phone-related leads concerning those involved, photographs the victim had taken along the journey, and a photograph of a food delivery order. We ultimately helped secure the victim’s rescue
Police subsequently took those involved in for questioning and continued examining their immigration records, travel in border areas, and possible involvement in irregular border crossings. The investigation remains ongoing
The window for intervention before victims are transferred across the Thai–Myanmar border is extremely narrow. Once they have been taken across, rescue becomes very difficult. Even when an overseas job offer includes an upfront deposit, verify the employer, the actual work location, and the people arranging the engagement
🚨警惕!与Fomopeek利用KOL诈骗的模式一致,@RevenueFamily 存在恶意授权,作案团伙提交用户的 permit 签名,取得无限额 USDG 使用权限,随即调用 transferFrom,授权和划款在同一笔交易里完成,将用户的钱包清空
资金随后被分为20%与80%流入两个黑客地址,这种分账结构,与至 Inferno 的盗币服务模式相似
🚨@RevenueFamily involves malicious approvals. The perpetrators submit users’ permit signatures to obtain unlimited permission to spend their USDG, then immediately call transferFrom. The approval and fund transfer are completed in the same transaction, draining users’ wallets
The funds are then split 20%/80% between two hacker addresses. This distribution structure resembles Inferno’s drainer-as-a-service model, and its promotional approach matches FomoPeek’s model of using KOLs to carry out scams
Bitget被盗案中,Circle 与 Tether 均已响应冻结:截至今日 13:00(UTC+8),Circle 已冻结约 10 万枚 USDC;今日 20:19(UTC+8),Tether 冻结 218,022.966977 枚 USDT
冻结地址:
0xe07bd590e1198666230932bad5db3dbbe21e7d57
此外,被盗 TRX 的洗转路径中仍存在窗口极短的冻结机会:
TRX → 分批兑换为 USDT → 经 Stargate 或直接进入 THORChain → BTC
链上样本显示,攻击者将 TRX 兑换为 USDT 后,USDT 通常仅在其控制地址停留约 1–8 分钟,随后即被送入跨链或兑换服务。因此,本案中留给 Tether 的实务冻结窗口通常只有约 1–8 分钟
其余资金已换成 BTC,或主要以 ETH、DAI 、XRP 形式停留,不具备代币发行方直接冻结地址的路径;但如果资金进入中心化交易所、托管机构或仍可识别的跨链服务,仍可通过平台协作、司法或执法程序尝试拦截
我们对@bitget 被盗资金展开了全面的追踪溯源,当前资金停留在以下地址,部分资金仍然在进行转移
结合我们以往与朝鲜黑客对抗的案例,追踪冻结相关资金具有较大难度,建议采取 @Bybit_Official 对白帽的赏金模式,激励更多优秀的安全公司以及个人研究者对案件持续追踪:
ETH:
0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899
0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2
0xDc2901f741B4003e32B8B752e97b8c4C1891dC63
0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0
0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272
0xFd5EBe912e2061992437767e24e5BCb52a3f9e54
0xeD5a394a7558929112848B7e97B569de6bbE1A51
0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284
0xe07bd590e1198666230932bad5db3dbbe21e7d57
USDT / USDC:
0xe07bd590e1198666230932bad5db3dbbe21e7d57
BNB:
0x150889FE4fA7a7699588f75C4189FA9e721acFD3
0x3a82a441f1e75d2022d17f6b082979c04fd67652
0x03df4cb9aa0e73a847b2989c1cd00a2a654b32f7
0x2399548147f367375b798256cc620cf2dbac7f10
BTC:
13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T
XRP:
rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs
r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ
rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn
rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw
r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y
rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p
r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig
rHCPH9VCKvYRsQ2eJBFydpLqLqb5S6a3ET
r3PkiYKo2yFiunHuEGHtTMFPQXEgyCkWj7
rnHdntCUt2vU8YMXarhvSeDRrZ8xwaFcTR
rwRnFu7QeQcd7p5qvyHkububNrfPRyEf2C
r4vyVuh8QXvUHh7HFt4EiFLDVFkTBe7fJx
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
RLUSD:
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
r4CAbSkDf4MgGZjao78Ufcks3jxr2UiPfD
TRX:
TBWNguTTgezw9dVorX441C6nDrZpRxYwKD
We have conducted comprehensive tracing and forensic analysis of the funds stolen from @bitget . The funds are currently held at the addresses listed below, although some remain in motion.
Based on our previous experience responding to incidents involving North Korean threat actors, tracing and freezing these assets is likely to be highly challenging. We recommend that Bitget adopt a white-hat bounty program similar to @Bybit_Official ’s model, incentivizing more leading security firms and independent researchers to continue monitoring and tracing the stolen funds.
ETH:
0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899
0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2
0xDc2901f741B4003e32B8B752e97b8c4C1891dC63
0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0
0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272
0xFd5EBe912e2061992437767e24e5BCb52a3f9e54
0xeD5a394a7558929112848B7e97B569de6bbE1A51
0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284
0xe07bd590e1198666230932bad5db3dbbe21e7d57
USDT / USDC:
0xe07bd590e1198666230932bad5db3dbbe21e7d57
BNB:
0x150889FE4fA7a7699588f75C4189FA9e721acFD3
0x3a82a441f1e75d2022d17f6b082979c04fd67652
0x03df4cb9aa0e73a847b2989c1cd00a2a654b32f7
0x2399548147f367375b798256cc620cf2dbac7f10
BTC:
13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T
XRP:
rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs
r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ
rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn
rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw
r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y
rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p
r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig
rHCPH9VCKvYRsQ2eJBFydpLqLqb5S6a3ET
r3PkiYKo2yFiunHuEGHtTMFPQXEgyCkWj7
rnHdntCUt2vU8YMXarhvSeDRrZ8xwaFcTR
rwRnFu7QeQcd7p5qvyHkububNrfPRyEf2C
r4vyVuh8QXvUHh7HFt4EiFLDVFkTBe7fJx
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
RLUSD:
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
r4CAbSkDf4MgGZjao78Ufcks3jxr2UiPfD
TRX:
TBWNguTTgezw9dVorX441C6nDrZpRxYwKD
@GracyBitget @xiejiayinBitget
很遗憾看到Hsin-Ju死亡的消息,但这似乎助长了一些阴谋论的传播,我希望补充一些额外信息:
“当警员发现她时,她的手臂上插着一根针,从车窗外就能看见。他们知道是药物过量,所以打破了车窗,试图给她用药,但她已经死亡了” @hack_vc @alpackaP
I’m saddened to hear of Hsin-Ju’s death, but the news seems to have fueled the spread of conspiracy theories. I’d like to share some additional information:
“When officers found her, she had a needle in her arm that was visible through the car window. They knew it was a drug overdose, so they broke the window and tried to administer medication, but she was already deceased.” @hack_vc @alpackaP
I’m saddened to hear of Hsin-Ju’s death, but the news seems to have fueled the spread of conspiracy theories. I’d like to share some additional information:
“When officers found her, she had a needle in her arm that was visible through the car window. They knew it was a drug overdose, so they broke the window and tried to administer medication, but she was already deceased.” @hack_vc @alpackaP
Darcy 资产救援⛑️ retweeted
Salus has completed a smart contract security audit of @KeyFlow_EN’s KEYFlexibleStake
Developed by the KeyFlow team and deployed on @BNBCHAIN, the contract supports multiple asset configurations to provide users with a more flexible on-chain staking and asset management experience
The audit focused on signature verification, access control, core business logic, and critical execution paths—helping the team identify potential risks and further strengthen the contract’s security and reliability
No high- or medium-severity issues were identified within the audited scope
Read the full audit report:
github.com/Salusec/Salus-aud…
我们正在招聘兼职「渠道商务拓展」(Partnerships & Business Development)伙伴!
Salus 专注于智能合约审计、Web3 渗透测试及资产救援服务,为 Web3 项目提供专业的安全支持。
我们的安全成绩:
🛡️ 300+
已服务及保护的项目
✅ 0 REKT
官网披露的受保护项目安全记录
📈 100%
官网披露的项目安全率
⚔️ 100%
官网披露的渗透测试成功率
你将与我们一起:
• 服务有安全需求的优质 Web3 项目
• 通过社区及生态合作伙伴拓展合作渠道
• 持续跟进潜在客户与合作机会
• 协助建立长期、稳定的生态合作关系
有商务拓展、渠道合作或社区运营经验者优先。
兼职岗位 · 完全远程
提供行业内具有竞争力的薪酬与激励机制
请将简历或简短的个人介绍发送至 [[email protected]],或者直接私信投送到@Jack24klove 或 @DarcyAri 进行最快速度交流沟通
邮件主题:Part-time Channel BD(兼职渠道商务拓展)
如果你认识合适的人选,欢迎转发或推荐!
We’re hiring a part-time Channel Business Development professional to join our Partnerships & Business Development team!
Salus specializes in smart contract audits, Web3 penetration testing, and asset recovery services, providing professional security support for Web3 projects.
Our security track record:
🟠 300+
Projects served and protected
🔴 0 REKT
Publicly disclosed security record of protected projects
🟠 100%
Project security rate disclosed on our official website
🔴 100%
Penetration testing success rate disclosed on our official website
You’ll work with us to:
• Support high-quality Web3 projects with security needs
• Develop partnership channels through communities and ecosystem partners
• Follow up with prospective clients and partnership opportunities
• Help build stable, long-term ecosystem partnerships
Experience in business development, channel partnerships, or community operations is a plus.
Part-time · Fully remote
Industry-competitive compensation and incentives
Send your CV or a brief introduction to [email protected]. For the fastest response, you can also DM @Jack24klove or @DarcyAri directly.
Email subject: Part-time Channel BD
Know someone who might be a great fit? Feel free to share this opportunity or refer them to us!
分析发现,FomoPeek 事件作案团伙在今年 6 月已有私钥盗取相关的作案记录,但其作案手段是否与Fomopeek案一致,仍有待进一步核查
本次事件的已确认黑客地址:
0x6d37f2C5e8F8546b648D317295565dA95975f4BB
获利约 57.99 万 U,资金主要分为以下三条路径进行转移:
FixedFloat 路径,合计 401,028 USDT:
经地址:0x111faeb95cd0786593433bcc762dc5c1debf541c 转入FixedFloat,215,000 USDT
经地址: 0x2d53113c89c83c520c17b8bbcdc22aa0518a38be 转入FixedFloat,27,028 USDT
经地址:0x0df6ac2e2856114228756947d1b1d9ff63ea3e68 转入FixedFloat,159,000 USDT
KuCoin 路径,合计 20,000 USDT:
从 0x2d53113c89c83c520c17b8bbcdc22aa0518a38be 分两笔转出,每笔 10,000 USDT,分别经过两个存款地址,最终归集至 KuCoin 热钱包
担保平台路径,合计121,458.3085 USDT:
经地址: 0x4c73d7e8ef0e61129403e219debc597fd43aa0ec 中转后,流向担保平台关联地址,111,458USDT
经地址: 0x0361897d757d13a4afad64a2e1bc561b96a8c7cf 进入 CCE 混币服务,流向担保平台关联地址,10,000 USDT
我们正在对其余涉案地址展开更全面的追踪。如果你是 FomoPeek 事件受害者,或掌握相关线索,可私信@DarcyAri 或 @Jack24klove ,提供被盗地址、交易哈希,帮助我们进一步锁定资金流向和关联地址
Analysis indicates that the group behind the FomoPeek incident had already been involved in a private-key theft case in June. Whether the same method was used in this incident remains under investigation
Confirmed hacker address in this incident:
0x6d37f2C5e8F8546b648D317295565dA95975f4BB
Estimated proceeds: approximately 579,900 USDT
The funds were primarily transferred through three routes:
• FixedFloat route:
215,000 USDT via 0x111faeb95cd0786593433bcc762dc5c1debf541c
27,028 USDT via 0x2d53113c89c83c520c17b8bbcdc22aa0518a38be
159,000 USDT via 0x0df6ac2e2856114228756947d1b1d9ff63ea3e68
totaling 401,028 USDT
• KuCoin route:
20,000 USDT was transferred from 0x2d53113c89c83c520c17b8bbcdc22aa0518a38be in two separate transactions of 10,000 USDT each. The funds passed through two deposit addresses before being consolidated into a KuCoin hot wallet
• Escrow-platform route:
111,458.3085 USDT was routed through 0x4c73d7e8ef0e61129403e219debc597fd43aa0ec before reaching addresses associated with an escrow platform.
10,000 USDT entered the CCE mixing service via 0x0361897d757d13a4afad64a2e1bc561b96a8c7cf and subsequently reached addresses associated with an escrow platform.
We are conducting a more comprehensive trace of the remaining addresses involved in the incident.































