✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @Goldpesatoken Loss: ~$114.9k

🔍 Root Cause: GPXHooks' reBalance() performs liquidity operations through the shared, flash-accounted PositionManager inside an attacker-controlled PoolManager unlock without verifying that the PositionManager's GPX/USDC currency deltas are zero, so the hook's burn credit is not isolated from the caller's state. The attacker opens an unlock, mints a WETH/USDC position via MINT_POSITION without settling (leaving the shared PositionManager with a −114,999.999187 USDC delta), then swaps on the GPX pool to trigger the hourly rebalance: the hook burns its real position and earns a +148,868.602189 USDC credit, but TAKE_PAIR can only withdraw the net positive delta, so the hook receives just 33,868.603002 USDC while the attacker's phantom debt absorbs the difference. Burning its own position cancels that debt and the attacker takes 114,999.999186 USDC straight out of the PoolManager — a missing delta-isolation / zero-delta check on a shared PositionManager.

📌 Attacker: 0x4a5FD2e9357cC87DF4cD6A1808174DBc8646899F
📌 Victim: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8
📌 Vulnerable Contract: 0x4519e2b040ff1B64fa03aBe2AeF0BC99D7CcEaA8

Powered by http://SlowMist.AI
Tx: https://basescan.org/tx/0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 MALT Loss: ~$72k

🔍 Root Cause: swap(uint256,uint256,address) records the caller’s input and pre-swap reserves, then invokes an external rebalanceHook before transferring the requested output. The hook withdraws DAI from the Capital Source and deposits it into the same pool. The swap subsequently validates its invariant against the pool’s final balances, treating this protocol-funded DAI as if it were supplied by the caller. Because the function does not isolate caller-funded input from hook-funded rebalancing capital, an attacker can provide negligible input, trigger treasury-funded liquidity injection, and withdraw a disproportionate amount of MALT.

📌 Attacker: 0x8F103B6A0aD705bcE6357842A5fefEB49e8D83Ef
📌 Victim: 0xF0d314849A3Bc9270a79110F25dBA2c8325A2AAC
📌 Vulnerable Contract: 0xfe6C096a2871337d4f6F7DD04Ebda733E94D7A13

Powered by http://SlowMist.AI
Tx: https://polygonscan.com/tx/0x915eccb5791508aa89a0a3f1385b26346b127ebb648b046e4cb558474ce8445b

✖️ CertiK Alert

#CertiKInsight 🚨

We have seen suspicious fund movement on Base.

A newly deployed proxy was used to borrow ~1,783 aBaswstETH from vault
https://basescan.org/address/0xD1895f2019c2152FC2b9022D57f19198c4CFCABC,
later redeemed via Aave for ~1,783 wstETH (~$6M) now at
https://basescan.org/address/0x0B5126e1bc27C0de77e02e97945760A674EdB034

Stay Vigilant!

✖️ PeckShieldAlert

#PeckShieldAlert It appears that 0x0B5126...B034 has drained 1,783 $wstETH (~$6M) on #Base.

✖️ GoPlus Security 🚦

🚨 GoPlus Security Alert: User lost ~$305K DAI to an #AddressPoisoning attack.

Attack flow: adversary dusts the victim from a lookalike address (prefix + suffix match), then waits for a copy-paste error from tx history.

These campaigns are fully automated — target discovery, spoofed same-name fake tokens or dust poisoning, then mixer laundering.

Victim:
0xb6bce73e112e566cf04742f003e1d82fd7f6b7bf
Intended recipient:
0x085adc5a4a1227b1c8aab9a962c03676fa18f1dd

Poison address:
0x085ccc21065c8c718fa0afcb4e842f247c18f1dd

Tx: https://etherscan.io/tx/0xaae85f2d7011454ce38a2024642daad54ea9ec81899782edc81dff7294e99739

⚠️ Never copy addresses from tx history. Verify the full address. Always send a small test tx before size.

✖️ GoPlus Security 🚦

🚨 GoPlus Security Alert: A user got drained for ~$170K in $LINK after signing a malicious #Permit2 transaction.

Victim: 0x71619d71474F8D0AAa9C18a757be7617686B499b

Phisher wallets: 0x0000db5c8B030ae20308ac975898E09741e70000 0x0000cdCa01087D340e8fA4339b121B69a8aE0000 0xA6809aeDEbFA10A0C2dbcF3363cB0Ff37866f73D

🛡 Security Tips:
1. Follow the #GoPlus Anti-Phishing “4 Don’ts”:
🚫 Don’t click unknown links
🚫 Don’t install unverified software
🚫 Don’t sign transactions you don’t fully understand
🚫 Don’t send funds to unverified addresses

2. Install the GoPlus Security extension to block phishing links, risky signatures, malicious approvals, and suspicious transactions in real time 👉 https://chromewebstore.google.com/search/GoPlus

✖️ BlockThreat

BlockThreat - Week 40, 2026

This week in blockchain security: 8 exploits, a $3.8M hack that came back in full within a day, a Wasm sandbox escape, and a new open-weights model built for security research.

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @SetProtocol Loss: ~5.08 ETH

🔍 Root Cause: actualizeFee() recalculated unitShares with upward rounding even though no fee was minted, raising it from 4,927 to 4,928. The attacker issued before the update and redeemed the same quantity afterward, extracting collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit.

📌 Attacker (EOA): 0x506440728d84eb22809dc9464bc8189618a1c5b6
📌 Attack Contract: 0x016feaaa25ab8325e233bc8a2c25055bee0b2f6e
📌 Victim (Set Protocol Vault): 0x5b67871c3a857de81a1ca0f9f7945e5670d986dc
📌 Vulnerable Contract: 0x54e8371c1ec43e58fb53d4ef4ed463c17ba8a6be

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xaca5f83ff3a206209f3d213c33d04e6febe345f6ad52ef476bd1c0ee1505ba65

✖️ Rekt News

An attacker moved ~$6.07M from @Duelbits hot wallets across five chains in a suspected private-key compromise, including the replacement wallet named after its $4.6M theft in 2024. It reopened days later, cause still undisclosed. What changed since 2024?

https://rekt.news/duelbits-rekt

✖️ CertiK Alert

#CertiKInsight 🚨

On 6 Oct, a MakerDAO liquidation keeper bot was exploited resulting in a loss of 200 ETH (~$542k).

Read our full analysis here👇
https://www.certik.com/blog/makerdao-legacy-auction-keeper-incident-analysis

Find all our stats on our CertiK Security Report Dashboard 👇
https://www.certik.com/certik-report/dashboard

✈️ The Hacker News

⚠️ PoeLLM has infected 3,400+ servers in a crypto-mining campaign targeting exposed AI/LLM infrastructure.

The malware hides its C2 address inside a GitHub-hosted poem and repurposes some compromised hosts to scan for more vulnerable systems.

Read more: https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html

✖️ Socket

🚨 Tensorlake’s npm SDK (12K weekly downloads) was compromised in a ChainDrop / Shai-Hulud attack.

Version 0.5.144 contains a credential-stealing worm with a dead-man switch designed to execute attacker code when a stolen GitHub token is revoked.

https://socket.dev/blog/tensorlake-compromise

✈️ The Hacker News

🚨 $8,200 paid to ransomware attackers. $150,000 billed to the victim.

DOJ charges MonsterCloud’s owner with fraud, alleging he secretly paid attackers for decryptors while claiming to use proprietary recovery tools.

Over $19 million in client charges.

Read - https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html

✖️ CertiK Alert

🚨 #CertiKInsights

We have seen suspicious movement from @79thVault .

2.01M 79AU were sold via a privileged function, moving 16.2k BNB (~$12.5M) to attacker: https://bscscan.com/tx/0xee0e44167518ff0071ede02a03b3710a1a8438d52616aad4bf1d5e417b37b0df

~90% held at: https://bscscan.com/address/0xa9537B40b02Af7Af8f1543aea3691992B2174F89 to which a 10% bounty was offered.

Stay Vigilant!

✖️ PeckShieldAlert

#PeckShieldAlert @79thVault was exploited, with 10K $79AU drained and swapped for 16.249K $BNB (~$12.51M). The exploiter has since deposited 30 $BNB to #Kucoin.