✖️ CertiK Alert

#CertiKInsight 🚨

On 30 Sept, HOT Omni Bridge on NEAR was exploited resulting in five observed BSC treasury payouts totaling $3.86M, which was later returned.

Read our full analysis here👇
https://www.certik.com/blog/hot-bridge-near-intents

CertiK Report Security Dashboard 👇
https://certik.com/certik-report/dashboard

✖️ Socket

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel.
Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

✈️ The Hacker News

🚨 DarkSword's new P7 iOS variant goes beyond data theft.

Its implant can extract iCloud Keychain and crypto wallet data, execute attacker commands, and poll for new commands every 15 seconds.

Details: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html

✖️ BlockThreat

BlockThreat - September, 2026

$780M stolen across 76 incidents. Worst month of 2026.

DPRK crossed $1B for the year with another exchange super hack.

Two hacks did 91% of the damage. They are not what concerns me most. 🧵

✖️ PeckShieldAlert

#PeckShieldAlert The CryptoBillis Ledger drainer, who drained >$90M worth of crypto, has deposited ~$3.89M worth of cryptos, including 3.685M $USDT & 615K $TRX (~$204K), to #Binance deposit addresses on #Tron over the past 2 days.

✈️ The Hacker News

‼️ Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet.

Amid reports of stolen funds, it paused reseller sales and warned buyers from the past 90 days: don't set up unused devices; consider moving assets from initialized ones.

https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

✖️ Rekt News

Holders voted 99.2% to shut down @Balancer 11 months after a $128M exploit. Pools go withdrawals-only Oct. 30; redemptions open May 2027 at $0.158/BAL. Unreconciled losses, a liability release & a delegate-vote failure unresolved. Who balances the books?

https://rekt.news/out-of-balance

‌✖️ SlowMist

🚨SlowMist TI Alert🚨

💸 @UNCX_token Loss: ~$86k

🔍 Root Cause: VestingManager.cancel(uint256) did not ensure a schedule’s retained shares covered shares already released. After transferring tokens directly to the manager to lower its shares-per-token conversion rate, the sender topped up and canceled schedules whose original shares had been fully released. The cancellations over-reduced global shares, allowing another sender-controlled schedule to claim excess tokens from the shared pool.

📌 Attacker: 0x78c9b11853e4f183a34c63ffd1924d2319a2f5b3
📌 Vulnerable Contract: 0xa98f06312b7614523d0f5e725e15fd20fb1b99f5

Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0x352065378c4a41b77e5b6a1e5b5616cd2886c3e1a2c87ed3db8e5ddddc23823d

✈️ The Hacker News

🚨 Ahsay has released new fixes for two AhsayCBS vulnerabilities exploited by attackers after earlier patches failed to fully address them.

Attackers used the flaws to install web shells and cryptocurrency miners.

Read: https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html

✖️ PeckShieldAlert

#PeckShieldAlert The phisher who drained a Bofur Capital-related address of $2M in DAI has swapped the stolen funds for 825.5 $ETH.