Omar "Beched" Ganiev

🚨 @binance - Loss ~$201.2M (2026-10-29) Network: Ethereum Type: Delegation Abuse (EIP-7702) / Private Key Compromise Follow-up sweep in the Binance hot-wallet drain. The wallet 0x28c6…1d60 carries an EIP-7702 delegation (code 0xef0100 + 63e842b0…), pointing at the same operator-gated wallet-drainer kit. In this tx the attacker operator EOA 0x7c8601d4 (NOT the account owner) called sweep(address recipient, address[] tokens) = 0x8a179be4, and the delegate code transferred the wallet's inventory — 200.40M USDT, 369.8 ETH, plus LINK, UNI, ENA, COMP, AAVE, QNT, PEPE, SHIB, ONDO, PENDLE, IMX, MORPHO, NIL and more — to attacker collection 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. Net ~$201.2M in this transaction. Setting a 7702 delegation requires a signature from the account's own key, so this is a signing/private-key compromise of an exchange hot wallet, extracted via an operator-gated universal sweep (one of several sweeps totaling ~$2.5B). TX: etherscan.io/tx/0x55ba4dabc4… Attacker: etherscan.io/address/0x7c860… Victim: etherscan.io/address/0x28c6c… ⏱️ Real-time alerts: defimon.xyz

🚨 @binance - Loss ~$2.53B (2026-10-29) Network: Ethereum Type: Delegation Abuse (EIP-7702) / Private Key Compromise The Binance hot wallet 0x28c6…1d60 was made to carry an EIP-7702 delegation (code 0xef0100 + 63e842b0…) pointing at a wallet-drainer implementation — the same kit flagged pre-drain for operator 0x7c8601d4 (Tornado-funded). In this tx the operator EOA (NOT the account owner) called sweep(address recipient, address[] tokens) = selector 0x8a179be4, and the delegate code transferred the wallet's entire token inventory — ~1.62B USDT, 167K ETH, UNI, LINK, PEPE, ENA, wBETH, xaut, PAXG, WBTC and ~60 other assets — to attacker collection address 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. Net ~$2.53B drained. Setting a 7702 delegation requires a signature from the account's own key, so this is a signing/private-key compromise of an exchange hot wallet, extracted via an operator-gated universal sweep. TX: etherscan.io/tx/0x53bd38b816… Attacker: etherscan.io/address/0x7c860… Victim: etherscan.io/address/0x28c6c… ⏱️ Real-time alerts: defimon.xyz

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

Concentrated liquidity depends on exact delta math. @DecurityHQ audited those calculations and the calldata bounds on VM hook paths. One of 8 independent Aqua and SwapVM audits.

Have you heard about ERC-7715? It allows a dApp to request human-readable permissions from a user's smart account to act on their behalf. E.g. stream fixed amounts of tokens or revoke approvals. So it made me thinking what if it could allow a watcher service like @DefimonAlerts to withdraw a position from your wallet if a threat is detected? Operational 24/7 on its own, without a hurry to open your wallet to submit a withdraw tx. The only wallet that supports this kinda experimental tech is @MetaMask (new users get 7710 smart accounts by default). However MetaMask supports only a limited set of permissions that do not allow fixed calldata (which makes sense). That's why I decided to expand the allowed permissions with `erc20-token-swap` which allows to swap your DeFi positions into safe stablecoins in the event of a protocol hack. PR: github.com/MetaMask/snap-771… Inspired by revoke.delegate by @ayushbherwani ethglobal.com/showcase/revok…

1/ Many DeFi hacks aren't atomic. We reconstructed per-tx timelines for 10 exploits where the drain ran for minutes to hours to ask one question: how much could have been saved after the first malicious tx? 🧵

Real-time DeFi monitoring is how anomalies get caught early. @DefimonAlerts is building not only an alert system, but also a white hat rescue bot that can protect defi in real time. Learn more: youtube.com/watch?v=ioGtupYR… Support: qf.giveth.io/project/defimon…

How we cut block latency 4x and scaled exploit detection to 8 chains: our CTO @theRaz0r shares insights on how @DefimonAlerts works under the hood on the @Quicknode blog 👇

The market is still underrating the gap between finding bugs and actually proving exploitability. A lot of companies argue that vulnerability discovery is becoming commoditized, that multiple models can now spot bug patterns, and that results like Anthropic Mythos are reproducible. That misses the real technical bottleneck. Finding the bug is not the hard part anymore. In many cases, that’s close to a solved problem. What matters is whether a model can turn that finding into a real exploit: chaining primitives, building a working test case, and demonstrating that the issue is actually exploitable without a human carrying it across the finish line. That capability matters on both sides: - offensively, because exploitability is what separates signal from noise - defensively, because you need a credible proof case to build the right fix We’re probably heading into another market correction where a lot of “AI companies” that are really just UI wrappers get washed out. The next winners won’t be the ones with the nicest interface. They’ll be the ones with real underlying capability.

1/ Since inception, Decurity has focused on real-time threat prevention. Our flagship product @DefimonAlerts has prevented hacks with direct impact exceeding $20M. But in 2025-2026, the world changed. AI is disrupting cybersecurity - and we had to adapt. 🧵

⚡ Every second matters when a DeFi exploit hits onchain. That's why we moved @DefimonAlerts from self-managed pipelines to @QuickNode Streams and went from 3 chains to 8, cut latency 4x, and freed us to focus on what actually matters - detection.