✖️ Rekt News

A wallet funded with 10 USDT drained $3.87M from a BNB Chain vault serving @near_intents using valid signed authorizations. After 48-hour ultimatum, team announced a full recovery & closed its investigation; the full story of the failure remains unclear.

https://rekt.news/near-intents-rekt

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @BitBayofficial Loss: ~$14K

🔍 Root Cause: The Vault's _withdraw() function transfers its entire token balance when liquidity == 0, without limiting the payout to the user's proportional share. The attacker exploited this flaw by triggering a zero-liquidity state via reposition(), then redeeming just 1 minimal share unit to drain approximately 14,838.47 DAI.

📌 Attacker: 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B
📌 Victim: 0x048E88311ca84876aeA086125825492e2AF2e5A0
📌 Vulnerable Contract: 0x048E88311ca84876aeA086125825492e2AF2e5A0

Powered by http://SlowMist.AI
Tx: https://polygonscan.com/tx/0x5b795dc5c5e1665b712c7ccf478c1d8c59a162d698f4e0bfb40bd303e04a7ff2

✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @ethervista Loss: ~18.6K

🔍 Root Cause: The EtherVistaPair.swap() function suffers from an integer overflow in its K-invariant check. Since both reserves are uint112, their multiplication overflows and wraps around, allowing the invariant check to pass even when the actual reserve product decreases significantly. The attacker exploited this flaw through an attacker-controlled contract registered as the authorized router, executing two crafted swaps to drain WETH and VISTA from the pool.

📌 Attacker: 0xbbf8f3fe8e4fdf6b594e6107144d78293d2018fa
📌 Attack Contract (Router): 0x469424b628a9d2036e41496e814db500d683b120
📌 Vulnerable Contract: 0xfdd05552f1377aa488afed744c8024358af02041

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0xb2c7332d9e1be6a86d9d37083aa4cc0d94b60eb95cc9b29494555a3c09764930

✖️ CertiK Alert

#CertiKInsight 🚨

On 30 Sept, HOT Omni Bridge on NEAR was exploited resulting in five observed BSC treasury payouts totaling $3.86M, which was later returned.

Read our full analysis here👇
https://www.certik.com/blog/hot-bridge-near-intents

CertiK Report Security Dashboard 👇
https://certik.com/certik-report/dashboard

✖️ Socket

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel.
Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

✈️ The Hacker News

🚨 DarkSword's new P7 iOS variant goes beyond data theft.

Its implant can extract iCloud Keychain and crypto wallet data, execute attacker commands, and poll for new commands every 15 seconds.

Details: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html

✖️ BlockThreat

BlockThreat - September, 2026

$780M stolen across 76 incidents. Worst month of 2026.

DPRK crossed $1B for the year with another exchange super hack.

Two hacks did 91% of the damage. They are not what concerns me most. 🧵

✖️ PeckShieldAlert

#PeckShieldAlert The CryptoBillis Ledger drainer, who drained >$90M worth of crypto, has deposited ~$3.89M worth of cryptos, including 3.685M $USDT & 615K $TRX (~$204K), to #Binance deposit addresses on #Tron over the past 2 days.

✈️ The Hacker News

‼️ Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet.

Amid reports of stolen funds, it paused reseller sales and warned buyers from the past 90 days: don't set up unused devices; consider moving assets from initialized ones.

https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html