Recently, we’ve shipped a small but solid update to the Crypto Asset Tracing Handbook! 📘✨ 📖Updated version on GitHub: github.com/slowmist/Crypto-A… 🚀These additions expand the handbook’s coverage of cross-chain and laundering patterns — topics that many readers have been asking for: 1️⃣More bridge explorer links🔗: • Squid • Orbiter • TeleSwap 2️⃣Two new case studies🔍: • BTC Laundering Loops via Hyperunit • Cross-Chain Source Analysis via Stargate Finance If you’ve already read the handbook, this update makes it even more actionable. If you haven’t yet — now’s a great time to dive in. 🛡️We’ll keep refining the handbook over time to make on-chain tracing knowledge accessible to everyone in the crypto ecosystem.

🚨SlowMist TI Alert🚨 💸 @Fetch_ai Loss: ~$2M 🔍 Root Cause: TokenConversionManagerV3's conversionIn() leaves single-EOA ECDSA signature as the sole authorization check. It lacks the checkLimits(amount) modifier present in conversionOut(), and does not verify any on-chain burn/lock proof. Using the leaked authorizer private key, the attacker signed a fresh message for their own address, passed the check, and drained the bridge's entire FET balance in one call. 📌 Attacker: 0x1572f2af7696b39c85e3221cde8efb640f86c362 📌 Recipient: 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe 📌 Victim/Vulnerable Contract: 0xab424a430cc09864fa1277a38193111705adf3a3 Powered by SlowMist.AI Tx: etherscan.io/tx/0xfe12c63b32…

🚨 SlowMist TI Alert: FomoPeek App v1.1–1.2 Asset Theft 🚨 We have recently received multiple reports of users having assets stolen. Our investigation found that the affected cases involved private key exposure, and some of the users had previously installed and used @FomoPeek App versions 1.1–1.2. A joint investigation by the @SlowMist_Team and @okx security teams confirmed that the app contains malicious code.⚠️ Besides its normal features, FomoPeek includes two modules that are unrelated to its stated business functions. One of them contains an #iOS kernel exploitation framework with eight different exploit methods. The framework can automatically choose an attack method based on the device model and iOS version. ‼️Affected iOS versions: iOS 12.0–18.7 and iOS 26.0–26.1.‼️ If the exploit succeeds, the app may escape the iOS sandbox, access and decrypt Keychain data, and read files belonging to other apps on the device. 🔐 This means sensitive data stored on the device, including private keys, seed phrases, login credentials, chat history, and files, may be exposed. The app also connects to hidden servers that are unrelated to its public-facing services and can receive remote commands. Based on plaintext traffic captured during our analysis, the attack functionality is currently enabled and runs automatically at regular intervals. In general, devices running older iOS versions are at higher risk. If you have installed or used FomoPeek versions 1.1–1.2, we recommend that you take action immediately: 1️⃣ Check your accounts and assets for any unusual activity. 2️⃣ On a trusted device where FomoPeek has never been installed, create a new account and generate a new private key and seed phrase. 3️⃣ Move your assets to the new account as soon as possible. 4️⃣ Update your device to the latest available iOS version. 5️⃣ Do not continue using or reinstalling FomoPeek. 6️⃣ If you notice any suspicious asset activity, contact the official support team of the relevant platform and keep the affected device and related evidence for further investigation.

🚨SlowMist TI Alert🚨 💸 @nimiq Loss: ~$50,463 🔍 Root Cause: ERC20PermitHTLCHandler's `execute()` discards all five calldata parameters (including signature & nonce) and performs no EIP-712 signature, nonce, or business pre-check. The only signature/nonce validation lived in its `preRelayedCall()`, but GSN RelayHub calls `preRelayedCall` on the attacker-specified paymaster. So the attacker set himself as paymaster, fully bypassing that check, used 1 MATIC GSN relay registration to pass `onlyRelayHub` and forged `request.from = victim`, causing `openPrivate()` to call `token.transferFrom(victim, handler, full balance)`. Finally, the attacker directly called the `redeem` function to withdraw these funds using the hosted secret they had crafted. 📌 Attacker: 0x2258491525C21f334c5a2dc22CE55e55023FC45D 📌 Victim: 0x24Cb173Ae221AeA93369f34bdcF0Ddb35b436773 📌 Vulnerable Contract: 0x0cFD862bE942846Cebad797d7c1BC6e47714959b, 0xf615bd7eA00C4Cc7F39fAAD0895Db5f40891359f Powered by SlowMist.AI Tx: polygonscan.com/tx/0xb067efa… polygonscan.com/tx/0xb2ca76d…

🚨SlowMist TI Alert🚨 💸 @likwid_fi Loss: 74.31 BNB 🔍 Root Cause: LikwidMarginPosition._executeAddCollateralAndBorrow (leverage=0 branch) never assigns delta.pairDelta, so the borrow path leaves pairReserves untouched. getAmountOut(pairReserves,...) returns the same 4.7857 BNB quote on every call — the attacker repeated the margin/borrow cycle 14 times, settling 211.8M TOKEN at the first-trade marginal price with no AMM price impact. 📌 Attacker EOA: 0x90bde1e0bb16b3deeb9d638acf8d01f19fd2f31e 📌 Attack Contract: 0xc63fb27f52ed8d06673c60c3075b2d3bd26cf4aa 📌 Vulnerable Contract: 0x6bec0c1dc4898484b7f094566ddf8bc82ed7abe8 (LikwidMarginPosition) 📌 Victim Contract: 0x065d449ec9d139740343990b7e1cf05fa830e4ba (LikwidVault) Powered by SlowMist.AI Tx: bscscan.com/tx/0x83cbd07d59a…

🚨SlowMist TI Alert🚨 💸 @flamincome Loss: ~$345.9K 🔍 Root Cause: Share-price inflation caused by unsafe asset accounting and valuation. The Strategy treated a permissionlessly injectable Convex `BaseRewardPool` balance as its own assets and valued the injected USDP/3CRV LP using Curve `get_virtual_price()`, which significantly overstated its value in the depegged pool. The inflated share price was then redeemed against real Aave aUSDT liquidity. 📌 Attacker: 0x83381e7f7232775735169d72d237b858ffc36871 📌 Victim Strategy: 0xb8d6471cA573C92c7096Ab8600347F6a9Fe268a5 📌 Flawed Contract (Impl): 0xff20De3F3F4C7E9518035a968B4A3CEE500a2AFB Powered by SlowMist.AI Tx: etherscan.io/tx/0x5ff8150482…

🚨 SlowMist TI Alert 🚨 @DCENTWALLETS has reported abnormal asset transfers involving its App Wallet. Users should update the DCENT app to the latest version before making any transfers. Stay alert for #phishing and impersonation attempts. Never share your recovery phrase/private key or send assets to any address for “recovery” or “compensation.” Please refer to DCENT’s official announcement for details and further updates.

🚨 SlowMist TI Alert 🚨 A vulnerability in an experimental feature of #CoreLightning (CLN) may put user funds at risk. Please check your node immediately! Official @Core_LN announced on September 15 that it is investigating a vulnerability in an experimental feature that may affect user funds. All nodes with experimental features enabled are strongly advised to disable them immediately and wait for a patch. 🔴 High-risk options include: --experimental-dual-fund (dual funding) --experimental-splicing (now enabled by default) --experimental-peer-storage ⚠️ The SlowMist team found that a similar issue had already been fixed in August: a remote peer could specify an arbitrary or even zero fee rate during the channel opening/funding adjustment (splice) protocol. The local node would sign and write it to the database without additional validation, potentially forcing the node to pay abnormal fees and even triggering a crash loop, leaving the node offline for an extended period and unable to respond to on-chain attacks in a timely manner. 🛡️ Node operators should: 1️⃣ Immediately run lightning-cli disableoption or remove all --experimental-* parameters when restarting; 2️⃣ Do not shut down the node completely — use --offline mode to retain on-chain monitoring capabilities and prevent counterparties from force-closing channels while the node is offline, which could result in fund losses; 3️⃣ After the official patch is released, verify the signature (GPG/SHA256) before upgrading. Do not blindly take action based solely on social media posts; 4️⃣ Beware of fake “urgent patch” links shared by impersonated official accounts. 📌 Source: nitter.cf/Core_LN/status/2099927…

🚨 SlowMist TI Alert: KREMLIN Malware 🚨 Recently, a Brazilian banking malware operation, #REF9334, active since at least May 2025, was disclosed. 🔴 The #KREMLIN malware ecosystem uses multi-stage loaders and malicious browser extensions to steal credentials, session tokens, and sensitive data. ⚠️ Its malicious extensions can be installed in #Chrome and #Edge without user approval by bypassing Chromium integrity mechanisms, including Secure Preferences, HMACs, and App-Bound encrypted hashes. ⛓️ The operation also uses #Ethereum smart contracts as dead-drop resolvers to dynamically update C2 endpoints and payload hosting locations, making the infrastructure harder to disrupt. ⚙️ After registering a network canary (kill switch) domain, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. 🛡️ Security teams should monitor for related malware, browser-extension activity, and infrastructure associated with the campaign. 🔑 Admin: - 0x5C32A09873be70a92fd8bB5A9fED7967dE06BdE6 📜 Smart Contracts: - 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 - 0x64Def0A6099c4DE9C413B108EAae85A3C7457615 - 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b (currently active) 🔎 IOCs: github.com/elastic/labs-rele… 📌 Source: elastic.co/security-labs/thr…

🚨SlowMist TI Alert🚨 💸 @Bonfiretoken Loss: ~ $50k 🔍 Root Cause: Access control missing in BonfireSwap router's `transfer`. The function does not check `msg.sender == from` nor verify the caller's allowance on `from`, letting anyone set a victim as `from` and themselves as `to`. The router drains the victim's TOKEN using its pre-approved allowance (victim → router) and forwards funds via same-token pool swap. 📌 Attacker: 0x2b5bf7d9d9dc1eec68f40c6b7a8f197e65f9731a → attack contract 0x28E976Ea7b83553d6D1D45CE81334156A2632127 📌 Victim: 41 TOKEN holders who approved the router (largest: 0xefF2FC4E3145f58F534d68A36Bcd3085Be6a4096, −5289.1 TOKEN) 📌 Vulnerable Contract: 0x17e801e17cefc6334059189c178d4783830e03d3 (BonfireSwap router) Powered by SlowMist.AI Tx: bscscan.com/tx/0xb4c00e8f3ba…

🚨SlowMist TI Alert🚨 💸 Unknown Gnosis Safe wallet Loss: ~$7.73M 🔍 Root Cause: In the `multicall(address, bytes[])` function of the Router contract (address `0x4f005592…`), the `_contract` parameter could be set to `address(this)`. Consequently, the `_isAuthorized` function—used for internal permission checks—would unconditionally return true. This allowed the victim Safe module contract to execute attacker-crafted malicious call data via `DelegateCall`, injecting aEthrsETH into an attacker-created liquidity pool equipped with a hook; the assets were subsequently swapped and redeemed for profit. 📌 Attacker: 0x2f7e143e27f2fa26ef3b8ac72698f1d321422f67 📌 Victim: 0x40e93a52f6af9fcd3b476aedadd7feabd9f7aba8 📌 Vulnerable Contract: 0x4f0055926c839d1d960a82cbf84e2ee933958ebc Txs: etherscan.io/tx/0x0e7680b06c… etherscan.io/tx/0xffbc6f742c… etherscan.io/tx/0xb95af93953… etherscan.io/tx/0x850342386d… Powered by SlowMist.AI

🚨 SlowMist TI Alert: CVE-2026-85706 🚨 🔴 A critical path traversal vulnerability in @gitlab CE/EE (CVSS 10.0) could allow unauthenticated attackers to read arbitrary files from affected GitLab servers via the Repository Commits API. 🛠️ GitLab has released security patches to address this vulnerability. ⚠️ Affected: affected from 18.7 before 19.1.8 affected from 19.2 before 19.2.6 affected from 19.3 before 19.3.2 🚨 Self-managed GitLab users should upgrade to 19.1.8, 19.2.6, or 19.3.2 immediately, and review logs and potentially exposed credentials after patching. 🔐 Stay alert and keep your infrastructure up to date. 🔗 cve.org/CVERecord?id=CVE-202…

🚨SlowMist TI Alert🚨 💸 @spir8l_com Loss: ~10.7 ETH 🔍 Root Cause: SpiralHookV2.borrow() uses Uniswap V4 pool spot price (poolManager.getSlot0()) to value collateral without TWAP or price-change limits. The protocol's noSameBlockSwap guard is keyed by tx.origin, so the attacker used 6 different EOAs to bypass it and borrow against inflated collateral within the same block as the pump. 📌 Attacker (EOA): 0x859E69A29244A10800A34eE66919426C02aFa2f0 📌 Attack Contract: 0x0c23c8bc3b7c565f3f9f4ac691a4dc4275086f86 📌 Vulnerable Contracts: 0x1725577dC9B1ee2D95dB49c2193226471594aacc Tx: etherscan.io/tx/0x84f2f1d061… etherscan.io/tx/0x0599c7769d… etherscan.io/tx/0x3172b1d4ba… etherscan.io/tx/0x09524ce13b… etherscan.io/tx/0x129f6c6894… etherscan.io/tx/0xc197577734… etherscan.io/tx/0x0dd9a193c7… Powered by SlowMist.AI

🚨SlowMist TI Alert🚨 💸 $ORB Loss: ~ $32,610.72 🔍 Root Cause: The ORBCore contract acts as a whitelisted entity for ORBToken, allowing ORB to be sold without incurring the 5% burn tax. Attackers exploited a mechanism where the ORBToken contract's `receive()` function automatically grants a maximum allowance and triggers an external call to the ORBCore contract's `addPoolAndSell` function(which lacked a reentrancy guard), thereby enabling a cycle of tax-free sell-offs. Furthermore, when the ORBCore contract sells tokens, it uses the `burnLP` function to destroy a large amount of ORB within the liquidity pool (Pair); finally, the attackers call `sync()` to manipulate reserve balances and profit. 📌 Attacker (EOA): 0xd8b49172b1a33e77c2619a78e08471facff5dad3 📌 Attack Contract: 0x4f33733a40fae6c19c3a4faf9bc08ce9a1806831 📌 Vulnerable Contracts: ORBToken: 0xc4d27261c06407053cad16cb825ecc0eee7ee7d7 Core: 0x24b6308ab84b182d0598b73d21a42f4c2bb33c18 PancakeSwap Pair: 0x64fad72e5dde70b2960497744b348fd64cb4788c Tx: bscscan.com/tx/0x5e6b33b7d69… Powered by SlowMist.AI

🚨 On September 6, 2026, @Liquid_BTC was affected by a cache key collision vulnerability in rangeproof verification. An attacker minted ~3,998.5 L-BTC with no corresponding peg-in. Within minutes, the unbacked L-BTC was pegged out into real BTC on the Bitcoin mainnet. About 3,400 BTC was later returned to the federation peg wallet, while ~598.5 BTC remains under the attacker’s control. The SlowMist Security Team traced the fund flows on the #Bitcoin side using @MistTrack_io and fully analyzed the incident. 🧩 Attack flow: 1️⃣ Two setup transactions first landed valid rangeproofs and commitments, while embedding a crafted payload in the locking script to seed node caches. 2️⃣ A follow-up minting output reused a colliding cache key — the same raw concatenation of proof, commitment, asset commitment, and scriptPubKey, but with different field boundaries. 3️⃣ On a cache hit, nodes skipped secp256k1_rangeproof_verify and min-value checks, accepted an unbacked commitment, and minted ~3,998.5 L-BTC. The fake UTXOs were consolidated and pegged out within minutes. ⚙️ Root Cause: The Elements rangeproof cache key concatenated variable-length fields without length prefixes. Distinct argument tuples could hash to the same key, so a positive cache hit meant skipping cryptographic verification. 🛡️ SlowMist Insight: A positive-result cache in a consensus verification path is itself a cryptographic primitive. Every field the verifier reads — and every field boundary — must be unambiguously bound into the key. Treat cache-key integrity as a mandatory item in consensus-layer audits. Full analysis👇 medium.com/@slowmist/analysi…

🚨SlowMist TI Alert🚨 We first reached out to the ether.fi team privately to responsibly disclose the issue before making any public statement. 💸 @ether_fi Loss: ~15.45 ETH 🔍 Root Cause: `AtomicQueue.solve()` lacks access control on the caller-supplied `solver` — there is no `solver == msg.sender` check, nor any signature, registration, or consent verification. The attacker first created a maliciously crafted `AtomicRequest` using the `updateAtomicRequest()` function, then forced a victim address to act as the `solver`. AtomicQueue subsequently called `finishSolve` on the victim and executed `want.transferFrom(solver, users[i], assetsToUser)`, abusing the victim's pre-existing ERC-20 allowance to drain funds. 📌 Attacker: `0xa5cc6e490bce9185fa47b421f2eac677a83b64ea` 📌 Vulnerable Contract (AtomicQueue): `0xd45884b592e316eb816199615a95c182f75dea07` Powered by SlowMist.AI Tx: etherscan.io/tx/0x7cbe0b4349…

🚨SlowMist TI Alert🚨 💸 @BeatXswap Loss: 2,984,557 BTX (~$77,512) 🔍 Root Cause: The `LiquidityVestingConvert` contract calculates BTX quotes via `_calculateQuote()`, which reads `IUniswapV3Pool.slot0()` spot price as the sole oracle. No TWAP protection, no sanity check, no deviation limit. An attacker borrowed 6,000,000 BTX via flash loan, dumped it into the V3 pool to crash `sqrtPriceX96`, then called `deposit()` twice (10,000 + 2,000 USDT), triggering `POSITION_MANAGER.mint()` at the manipulated spot price and draining BTX from LP positions. 📌 Attacker: 0x67B2f08683A735cfE6f6E57fA86909b62218C2a1 📌 Victim: 0x1e647FAADb05f2124BFCcFC003EDc06D1A90bf5D 0x9a7A92240FBAc4030b65A6E61239928d6Bcc716F 📌 Vulnerable Contract: 0x1e647FAADb05f2124BFCcFC003EDc06D1A90bf5D Powered by SlowMist.AI Tx: bscscan.com/tx/0xcc71a3bb131…

🚨SlowMist TI Alert🚨 💸 $OMNI404 Loss: 2.4 WETH 🔍 Root Cause: In `_transfer()` of OMNI404 (O404), NFT mint/burn counts are derived only from `(balanceOf / units)` integer differences before/after the ERC20 transfer. OMNI404's `transfer(address,uint256)` treats values ≤ 50 as ERC721 token IDs, but also transfers a fixed 1e18 OMNI404 units. Uniswap V3 exact-output swaps calling `transfer(recipient, 1/2/.../21)` received 1e18 OMNI404 per call while the pool accounted only wei-level amounts, enabling flash-loan assisted profit. 📌 Attacker: 0xfb26db4eab18cb50d29ff431888dd643a7e9c9f8 📌 Victim Pool: 0xb3f613b9bc84ddb29d78fa4685b01d98412bba0b 📌 Vulnerable Contract: 0xd5c02bb3e40494d4674778306da43a56138a383e Powered by SlowMist.AI Tx: etherscan.io/tx/0x4cbc3d8db8…

🚀 MistTrack Agent is now live on @Finchtech_ai . Start with an address or tx hash to investigate fund flows across 19 chains, including mixers, bridges and DEX swaps, with checks against 400M+ labeled addresses and major sanctions lists — helping you uncover risk and follow the money. Free to acquire 👉 finchtech.ai/market/chips/ag…

On Sept 9, OFAC and DOJ took joint action against Xinbi Guarantee and its supporting service network, restricting more than $52 million in crypto assets. Xinbi Guarantee is a Chinese-language online escrow marketplace connecting scam groups with merchants offering money laundering, scam-site development, and other illicit services. OFAC designated Xinbi Guarantee as a significant Transnational Criminal Organization (TCO), and also sanctioned supporting firms SafeW Technology and Anwen Technology. DOJ seized related Telegram channels and wallets, including ~$12M from 2 collection wallets. Treasury said the marketplace has processed over $24B in digital assets and fiat since around 2022. The case highlights the importance of tracking illicit fund flows across service networks. SlowMist @MistTrack_io will continue updating related risk labels to support on-chain monitoring and illicit fund analysis. Read more 👇 medium.com/@slowmist/u-s-ofa…