✖️ Socket

🚨 Tensorlake’s npm SDK (12K weekly downloads) was compromised in a ChainDrop / Shai-Hulud attack.

Version 0.5.144 contains a credential-stealing worm with a dead-man switch designed to execute attacker code when a stolen GitHub token is revoked.

https://socket.dev/blog/tensorlake-compromise

✈️ The Hacker News

🚨 $8,200 paid to ransomware attackers. $150,000 billed to the victim.

DOJ charges MonsterCloud’s owner with fraud, alleging he secretly paid attackers for decryptors while claiming to use proprietary recovery tools.

Over $19 million in client charges.

Read - https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html

✖️ CertiK Alert

🚨 #CertiKInsights

We have seen suspicious movement from @79thVault .

2.01M 79AU were sold via a privileged function, moving 16.2k BNB (~$12.5M) to attacker: https://bscscan.com/tx/0xee0e44167518ff0071ede02a03b3710a1a8438d52616aad4bf1d5e417b37b0df

~90% held at: https://bscscan.com/address/0xa9537B40b02Af7Af8f1543aea3691992B2174F89 to which a 10% bounty was offered.

Stay Vigilant!

✖️ PeckShieldAlert

#PeckShieldAlert @79thVault was exploited, with 10K $79AU drained and swapped for 16.249K $BNB (~$12.51M). The exploiter has since deposited 30 $BNB to #Kucoin.

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @X7_Finance Loss: ~6.78 ETH

🔍 Root Cause: In claimRewards(), totalRewards is incremented by (address(this).balance - lastETHBalance) on every call, but lastETHBalance is only updated when claimable > 0. Calling with an empty array leaves claimable at 0, so the same unaccounted balance is repeatedly added to totalRewards, inflating the per-token reward. The attacker also donated ETH to amplify the delta before draining funds.

📌 Attacker: 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2
📌 Victim: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7
📌 Vulnerable Contract: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7 (X7Pioneer)

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xc98056d6ab55ef898189da5fa1fb08b968cb84ca99528d171f8240836b21766d

✖️ Rekt News

A wallet funded with 10 USDT drained $3.87M from a BNB Chain vault serving @near_intents using valid signed authorizations. After 48-hour ultimatum, team announced a full recovery & closed its investigation; the full story of the failure remains unclear.

https://rekt.news/near-intents-rekt

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @BitBayofficial Loss: ~$14K

🔍 Root Cause: The Vault's _withdraw() function transfers its entire token balance when liquidity == 0, without limiting the payout to the user's proportional share. The attacker exploited this flaw by triggering a zero-liquidity state via reposition(), then redeeming just 1 minimal share unit to drain approximately 14,838.47 DAI.

📌 Attacker: 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B
📌 Victim: 0x048E88311ca84876aeA086125825492e2AF2e5A0
📌 Vulnerable Contract: 0x048E88311ca84876aeA086125825492e2AF2e5A0

Powered by http://SlowMist.AI
Tx: https://polygonscan.com/tx/0x5b795dc5c5e1665b712c7ccf478c1d8c59a162d698f4e0bfb40bd303e04a7ff2

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @ethervista Loss: ~18.6K

🔍 Root Cause: The EtherVistaPair.swap() function suffers from an integer overflow in its K-invariant check. Since both reserves are uint112, their multiplication overflows and wraps around, allowing the invariant check to pass even when the actual reserve product decreases significantly. The attacker exploited this flaw through an attacker-controlled contract registered as the authorized router, executing two crafted swaps to drain WETH and VISTA from the pool.

📌 Attacker: 0xbbf8f3fe8e4fdf6b594e6107144d78293d2018fa
📌 Attack Contract (Router): 0x469424b628a9d2036e41496e814db500d683b120
📌 Vulnerable Contract: 0xfdd05552f1377aa488afed744c8024358af02041

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xb2c7332d9e1be6a86d9d37083aa4cc0d94b60eb95cc9b29494555a3c09764930

✖️ CertiK Alert

#CertiKInsight 🚨

On 30 Sept, HOT Omni Bridge on NEAR was exploited resulting in five observed BSC treasury payouts totaling $3.86M, which was later returned.

Read our full analysis here👇
https://www.certik.com/blog/hot-bridge-near-intents

CertiK Report Security Dashboard 👇
https://certik.com/certik-report/dashboard

✖️ Socket

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel.
Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

✈️ The Hacker News

🚨 DarkSword's new P7 iOS variant goes beyond data theft.

Its implant can extract iCloud Keychain and crypto wallet data, execute attacker commands, and poll for new commands every 15 seconds.

Details: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html

✖️ BlockThreat

BlockThreat - September, 2026

$780M stolen across 76 incidents. Worst month of 2026.

DPRK crossed $1B for the year with another exchange super hack.

Two hacks did 91% of the damage. They are not what concerns me most. 🧵

✖️ PeckShieldAlert

#PeckShieldAlert The CryptoBillis Ledger drainer, who drained >$90M worth of crypto, has deposited ~$3.89M worth of cryptos, including 3.685M $USDT & 615K $TRX (~$204K), to #Binance deposit addresses on #Tron over the past 2 days.

✈️ The Hacker News

‼️ Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet.

Amid reports of stolen funds, it paused reseller sales and warned buyers from the past 90 days: don't set up unused devices; consider moving assets from initialized ones.

https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html