✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 MUS Loss: ~$36.9k

🔍 Root Cause: deposit() included the first-deposit bonus in both the immediate ETH refund and the user’s MUS allocation; withdraw() allowed same-transaction redemption without limiting total ETH returned to the amount deposited. Sixteen fresh addresses repeated the cycle to extract ETH from MUSystem.

📌 Attacker: 0x1a083ADf234a8f67ad65A9B9B616853ACf5998E5
📌 Victim: 0x9bdf81e6066d32764b7e75a1b5577237e06d9364
📌 Vulnerable Contract: 0x9bdf81e6066d32764b7e75a1b5577237e06d9364

Powered by http://SlowMist.AI
Tx:
https://etherscan.io/tx/0xfe28118e48c64b275b587c90da472fc13b8c3dbed9d3cded1e18c1e7a7fc0392
https://etherscan.io/tx/0xaa172fcaa4800b14826daed1a78c9d6dcd8f26ae45ce5f31786d55768b709ec6
https://etherscan.io/tx/0x905af4e8cdaf32c183605358c97181e9ad57393bd4ed1d945baf6d6eebe983fe

✖️ CertiK Alert

#CertiKStatsAlert 🚨

Combining all the incidents in September we’ve confirmed ~$766.4M lost to exploits and phishing.

September has seen the highest recorded losses as well as the most incidents in 2026.

More details below 👇

✖️ Rekt News

An attacker drained $387.5M from @bitget hot and warm wallets after breaching third-party security products and reaching its wallet system. No keys stolen, Bitget says; freezes barely dented the loss, and the products remain unnamed.

https://rekt.news/bitget-rekt

✖️ PeckShieldAlert

#PeckShieldAlert In Sep. 2026, the crypto industry experienced 55 major hacks, resulting in total losses of $766.49M - a ~462% month-over-month increase from August's $136.3M.
The #Bitget incident (~$387M) and #LiquidNetwork (~$320M, with $285M returned) have jumped to #1 & #2 among the largest crypto thefts of the year to date, surpassing the #Drift and #KelpDAO/#LayerZero exploits.
Top 10 hacks in Sep.
- #Bitget: $387M
- #LiquidNetwork: $320M (returned $285M)
- MEV bot "yoink" front-run: $7.81M (returned)
- #Duelbits: $7M
- Payment Processor V2 : $6.6M (returned $3.4M)
- #DCENT Wallet: $6.57M
- #Astroport: $4.9M
- #Drop: $4.4M
- #NostraFinance: $3.5M
- #Nomic nBTC Bridge: $3.15M

✈️ Investigations by ZachXBT

Community Alert: Near Intents was exploited for $3.8M+ after its BSC hot wallet saw multiple irregular outflows a few hours ago.

Near Intents hot wallet 0x233c has since stopped processing transactions and the site status shows an ongoing incident impacting multiple EVM chains.

The funds were immediately transferred to Kucoin and bridged to Bitcoin.

BSC theft address
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37

✖️ Dedaub

An audit secures the code. Who holds the signing keys, whether the pipeline can be poisoned, and who answers the 3 a.m. alert: usually outside its scope.

Why Web3 security needs operational controls, and how @_SEAL_Org certification closes the gap: https://dedaub.com/blog/seal-certification-operational-security/

✖️ PeckShieldAlert

#PeckShieldAlert #ZachXBT has reported that Near Intents was exploited for $3.865M after its BSC hot wallet saw multiple irregular outflows.

The exploiter has transferred the stolen funds to #Kucoin and bridged them to BTC. The exploiter address has interacted with an address labeled #NorthKorea #LazarusGroup (0x098B7...E2f96)

✈️ The Hacker News

⚠️ 543,699 live credentials. AI-chained zero-days to root. Model inspection that runs code.

This week’s #ThreatsDay also covers blockchain-hidden malware, EDR evasion, cache poisoning, ATM jackpotting, crypto fraud, and more.

16 security stories. One fast read.

Read: https://thehackernews.com/2026/10/threatsday-ai-powered-zero-day-chain.html

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @aave v3 Loop Safe Module Loss: ~114.09 ETH

🔍 Root Cause: FlashLoopAdapter's open()/close() access control only checks ISafe(msg.sender).isModuleEnabled(address(this)), which is spoofable via a fake Safe that always returns true. Its _swap() then executes http://router.call with fully attacker-controlled router and calldata. Since the adapter is an enabled module of the victim Safes, the attacker set router=victim Safe and data=execTransactionFromModule to drain weETH and Aave collateral.

📌 Attacker: 0x42c2633438609881c8fBAb82414eb9A0c45F9353
📌 Victim: 0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520, 0xcfedf95a3653a128dfc2e4288758a1a1850d169f
📌 Vulnerable Contract: 0x16bb8b912da187870c23ec6756bb3fad061283d8

Impact: ~114.09 ETH stolen from two Safe multisigs via forged Safe authentication and arbitrary module execution; ~1300 WETH debt repaid to unlock collateral.

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0x75328f916b1a0878724d364da5eb12b255160b894cb36c63ed5d718efc616fc4

✖️ CertiK Alert

#CertiKInsight 🚨
1/4
According to our data, September 2026 recorded ~$772.4M in losses.
Full dashboard & stats 👇
https://www.certik.com/certik-report/dashboard
Here are the key takeaways you need to know 🧵

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @Goldpesatoken Loss: ~$114.9k

🔍 Root Cause: GPXHooks' reBalance() performs liquidity operations through the shared, flash-accounted PositionManager inside an attacker-controlled PoolManager unlock without verifying that the PositionManager's GPX/USDC currency deltas are zero, so the hook's burn credit is not isolated from the caller's state. The attacker opens an unlock, mints a WETH/USDC position via MINT_POSITION without settling (leaving the shared PositionManager with a −114,999.999187 USDC delta), then swaps on the GPX pool to trigger the hourly rebalance: the hook burns its real position and earns a +148,868.602189 USDC credit, but TAKE_PAIR can only withdraw the net positive delta, so the hook receives just 33,868.603002 USDC while the attacker's phantom debt absorbs the difference. Burning its own position cancels that debt and the attacker takes 114,999.999186 USDC straight out of the PoolManager — a missing delta-isolation / zero-delta check on a shared PositionManager.

📌 Attacker: 0x4a5FD2e9357cC87DF4cD6A1808174DBc8646899F
📌 Victim: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8
📌 Vulnerable Contract: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8

Powered by http://SlowMist.AI
Tx: https://basescan.org/tx/0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 MALT Loss: ~$72k

🔍 Root Cause: swap(uint256,uint256,address) records the caller’s input and pre-swap reserves, then invokes an external rebalanceHook before transferring the requested output. The hook withdraws DAI from the Capital Source and deposits it into the same pool. The swap subsequently validates its invariant against the pool’s final balances, treating this protocol-funded DAI as if it were supplied by the caller. Because the function does not isolate caller-funded input from hook-funded rebalancing capital, an attacker can provide negligible input, trigger treasury-funded liquidity injection, and withdraw a disproportionate amount of MALT.

📌 Attacker: 0x8F103B6A0aD705bcE6357842A5fefEB49e8D83Ef
📌 Victim: 0xF0d314849A3Bc9270a79110F25dBA2c8325A2AAC
📌 Vulnerable Contract: 0xfe6C096a2871337d4f6F7DD04Ebda733E94D7A13

Powered by http://SlowMist.AI
Tx: https://polygonscan.com/tx/0x915eccb5791508aa89a0a3f1385b26346b127ebb648b046e4cb558474ce8445b

✖️ CertiK Alert

#CertiKInsight 🚨

We have seen suspicious fund movement on Base.

A newly deployed proxy was used to borrow ~1,783 aBaswstETH from vault
https://basescan.org/address/0xD1895f2019c2152FC2b9022D57f19198c4CFCABC,
later redeemed via Aave for ~1,783 wstETH (~$6M) now at
https://basescan.org/address/0x0B5126e1bc27C0de77e02e97945760A674EdB034

Stay Vigilant!

✖️ PeckShieldAlert

#PeckShieldAlert It appears that 0x0B5126...B034 has drained 1,783 $wstETH (~$6M) on #Base.