✈️ Investigations by ZachXBT

Community Alert: Near Intents was exploited for $3.8M+ after its BSC hot wallet saw multiple irregular outflows a few hours ago.

Near Intents hot wallet 0x233c has since stopped processing transactions and the site status shows an ongoing incident impacting multiple EVM chains.

The funds were immediately transferred to Kucoin and bridged to Bitcoin.

BSC theft address
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37

✖️ Dedaub

An audit secures the code. Who holds the signing keys, whether the pipeline can be poisoned, and who answers the 3 a.m. alert: usually outside its scope.

Why Web3 security needs operational controls, and how @_SEAL_Org certification closes the gap: https://dedaub.com/blog/seal-certification-operational-security/

✖️ PeckShieldAlert

#PeckShieldAlert #ZachXBT has reported that Near Intents was exploited for $3.865M after its BSC hot wallet saw multiple irregular outflows.

The exploiter has transferred the stolen funds to #Kucoin and bridged them to BTC. The exploiter address has interacted with an address labeled #NorthKorea #LazarusGroup (0x098B7...E2f96)

✈️ The Hacker News

⚠️ 543,699 live credentials. AI-chained zero-days to root. Model inspection that runs code.

This week’s #ThreatsDay also covers blockchain-hidden malware, EDR evasion, cache poisoning, ATM jackpotting, crypto fraud, and more.

16 security stories. One fast read.

Read: https://thehackernews.com/2026/10/threatsday-ai-powered-zero-day-chain.html

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @aave v3 Loop Safe Module Loss: ~114.09 ETH

🔍 Root Cause: FlashLoopAdapter's open()/close() access control only checks ISafe(msg.sender).isModuleEnabled(address(this)), which is spoofable via a fake Safe that always returns true. Its _swap() then executes http://router.call with fully attacker-controlled router and calldata. Since the adapter is an enabled module of the victim Safes, the attacker set router=victim Safe and data=execTransactionFromModule to drain weETH and Aave collateral.

📌 Attacker: 0x42c2633438609881c8fBAb82414eb9A0c45F9353
📌 Victim: 0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520, 0xcfedf95a3653a128dfc2e4288758a1a1850d169f
📌 Vulnerable Contract: 0x16bb8b912da187870c23ec6756bb3fad061283d8

Impact: ~114.09 ETH stolen from two Safe multisigs via forged Safe authentication and arbitrary module execution; ~1300 WETH debt repaid to unlock collateral.

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0x75328f916b1a0878724d364da5eb12b255160b894cb36c63ed5d718efc616fc4

✖️ CertiK Alert

#CertiKInsight 🚨
1/4
According to our data, September 2026 recorded ~$772.4M in losses.
Full dashboard & stats 👇
https://www.certik.com/certik-report/dashboard
Here are the key takeaways you need to know 🧵

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @Goldpesatoken Loss: ~$114.9k

🔍 Root Cause: GPXHooks' reBalance() performs liquidity operations through the shared, flash-accounted PositionManager inside an attacker-controlled PoolManager unlock without verifying that the PositionManager's GPX/USDC currency deltas are zero, so the hook's burn credit is not isolated from the caller's state. The attacker opens an unlock, mints a WETH/USDC position via MINT_POSITION without settling (leaving the shared PositionManager with a −114,999.999187 USDC delta), then swaps on the GPX pool to trigger the hourly rebalance: the hook burns its real position and earns a +148,868.602189 USDC credit, but TAKE_PAIR can only withdraw the net positive delta, so the hook receives just 33,868.603002 USDC while the attacker's phantom debt absorbs the difference. Burning its own position cancels that debt and the attacker takes 114,999.999186 USDC straight out of the PoolManager — a missing delta-isolation / zero-delta check on a shared PositionManager.

📌 Attacker: 0x4a5FD2e9357cC87DF4cD6A1808174DBc8646899F
📌 Victim: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8
📌 Vulnerable Contract: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8

Powered by http://SlowMist.AI
Tx: https://basescan.org/tx/0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 MALT Loss: ~$72k

🔍 Root Cause: swap(uint256,uint256,address) records the caller’s input and pre-swap reserves, then invokes an external rebalanceHook before transferring the requested output. The hook withdraws DAI from the Capital Source and deposits it into the same pool. The swap subsequently validates its invariant against the pool’s final balances, treating this protocol-funded DAI as if it were supplied by the caller. Because the function does not isolate caller-funded input from hook-funded rebalancing capital, an attacker can provide negligible input, trigger treasury-funded liquidity injection, and withdraw a disproportionate amount of MALT.

📌 Attacker: 0x8F103B6A0aD705bcE6357842A5fefEB49e8D83Ef
📌 Victim: 0xF0d314849A3Bc9270a79110F25dBA2c8325A2AAC
📌 Vulnerable Contract: 0xfe6C096a2871337d4f6F7DD04Ebda733E94D7A13

Powered by http://SlowMist.AI
Tx: https://polygonscan.com/tx/0x915eccb5791508aa89a0a3f1385b26346b127ebb648b046e4cb558474ce8445b

✖️ CertiK Alert

#CertiKInsight 🚨

We have seen suspicious fund movement on Base.

A newly deployed proxy was used to borrow ~1,783 aBaswstETH from vault
https://basescan.org/address/0xD1895f2019c2152FC2b9022D57f19198c4CFCABC,
later redeemed via Aave for ~1,783 wstETH (~$6M) now at
https://basescan.org/address/0x0B5126e1bc27C0de77e02e97945760A674EdB034

Stay Vigilant!

✖️ PeckShieldAlert

#PeckShieldAlert It appears that 0x0B5126...B034 has drained 1,783 $wstETH (~$6M) on #Base.

✖️ GoPlus Security 🚦

🚨 GoPlus Security Alert: User lost ~$305K DAI to an #AddressPoisoning attack.

Attack flow: adversary dusts the victim from a lookalike address (prefix + suffix match), then waits for a copy-paste error from tx history.

These campaigns are fully automated — target discovery, spoofed same-name fake tokens or dust poisoning, then mixer laundering.

Victim:
0xb6bce73e112e566cf04742f003e1d82fd7f6b7bf
Intended recipient:
0x085adc5a4a1227b1c8aab9a962c03676fa18f1dd

Poison address:
0x085ccc21065c8c718fa0afcb4e842f247c18f1dd

Tx: https://etherscan.io/tx/0xaae85f2d7011454ce38a2024642daad54ea9ec81899782edc81dff7294e99739

⚠️ Never copy addresses from tx history. Verify the full address. Always send a small test tx before size.

✖️ GoPlus Security 🚦

🚨 GoPlus Security Alert: A user got drained for ~$170K in $LINK after signing a malicious #Permit2 transaction.

Victim: 0x71619d71474F8D0AAa9C18a757be7617686B499b

Phisher wallets: 0x0000db5c8B030ae20308ac975898E09741e70000 0x0000cdCa01087D340e8fA4339b121B69a8aE0000 0xA6809aeDEbFA10A0C2dbcF3363cB0Ff37866f73D

🛡 Security Tips:
1. Follow the #GoPlus Anti-Phishing “4 Don’ts”:
🚫 Don’t click unknown links
🚫 Don’t install unverified software
🚫 Don’t sign transactions you don’t fully understand
🚫 Don’t send funds to unverified addresses

2. Install the GoPlus Security extension to block phishing links, risky signatures, malicious approvals, and suspicious transactions in real time 👉 https://chromewebstore.google.com/search/GoPlus

✖️ BlockThreat

BlockThreat - Week 40, 2026

This week in blockchain security: 8 exploits, a $3.8M hack that came back in full within a day, a Wasm sandbox escape, and a new open-weights model built for security research.

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @SetProtocol Loss: ~5.08 ETH

🔍 Root Cause: actualizeFee() recalculated unitShares with upward rounding even though no fee was minted, raising it from 4,927 to 4,928. The attacker issued before the update and redeemed the same quantity afterward, extracting collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit.

📌 Attacker (EOA): 0x506440728d84eb22809dc9464bc8189618a1c5b6
📌 Attack Contract: 0x016feaaa25ab8325e233bc8a2c25055bee0b2f6e
📌 Victim (Set Protocol Vault): 0x5b67871c3a857de81a1ca0f9f7945e5670d986dc
📌 Vulnerable Contract: 0x54e8371c1ec43e58fb53d4ef4ed463c17ba8a6be

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xaca5f83ff3a206209f3d213c33d04e6febe345f6ad52ef476bd1c0ee1505ba65

✖️ Rekt News

An attacker moved ~$6.07M from @Duelbits hot wallets across five chains in a suspected private-key compromise, including the replacement wallet named after its $4.6M theft in 2024. It reopened days later, cause still undisclosed. What changed since 2024?

https://rekt.news/duelbits-rekt

✖️ CertiK Alert

#CertiKInsight 🚨

On 6 Oct, a MakerDAO liquidation keeper bot was exploited resulting in a loss of 200 ETH (~$542k).

Read our full analysis here👇
https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis

Find all our stats on our CertiK Security Report Dashboard 👇
https://www.certik.com/certik-report/dashboard