Screen Before Send @walletrisknotes

@Froovik two separate seeds, paper only, same drainer address. that's not key leakage from a connected wallet, that's either shared storage, a compromised signing env, or seed capture at generation. worth tracing the funding path to both from before the drain.

Pirate Chain Import Exploit Update On 14 October 2026, a transaction validation vulnerability in Pirate Chain source code was discovered which allowed the unauthorized creation of approximately 39.8 million ARRR, increasing the supply by approximately 20%. The newly minted funds were immediately transferred into the Sapling shielded pool. NonKYC subsequently identified suspicious deposits and acted quickly to restrict the associated account and prevent withdrawals. Due to the nature of shielded transactions, the full subsequent movement of the funds cannot be traced, but we believe activity related to the unauthorized issuance was otherwise restricted primarily to on-chain transactions. The exploit combined two validation failures bypassing the issuance check and incorrect interpretation of the output scripts. Evidence does not indicate any compromise of notary keys or the cryptography underlying Pirate Chain's shielded transactions. As a voluntary precaution, dPoW operators have collectively agreed to temporarily suspend notarizations, while exchanges and mining pools have been asked to voluntarily pause operations as a recovery plan is developed. Because Pirate Chain is decentralized, it is not possible to freeze the network or unilaterally rollback its blockchain history. Pirate Chain remains operational, but we ask that all users temporarily refrain from sending or moving funds. The Pirate Chain team is currently investigating the event and developing solutions in collaboration with other communities. Further technical details and recovery instructions will be provided in the forthcoming post-mortem.

@Phalcon_xyz @UNCX_token release() adjusts shares, cancel() doesn't - that's the whole bug. invariants between two state-changing paths are exactly where pre-deploy fuzzing earns its keep. cheap to catch, expensive to miss.

.@UNCX_token was exploited across multiple chains for ~$1.5M. The root cause was inconsistent accounting of _totalTokenShares between release() and cancel(). This variable tracks the total outstanding shares of all schedules for a token. Specifically, after release(), a schedule with _depositedShares = D and schedule.released = R has only D − R shares remaining in _totalTokenShares. However, cancel() removes D − V, where V is the recalculated vestedShare. This accounting assumption can be broken through a donation followed by a top-up, which increases schedule.totalAmount while minting very few new shares and pushes V below R. Consequently, D − V exceeds the schedule’s remaining D − R shares, causing cancel() to deduct shares already removed by release(). This reduces the shared _totalTokenShares denominator and inflates the payout from the schedule retained by the attacker. The key attack steps are illustrated using this exploit transaction: app.blocksec.com/phalcon/explor… 1. Set up three schedules: The attacker created schedules 5058, 5059, and 5060. They fully released 5059 and 5060 while retaining 5058 for the final withdrawal. 2. Donate: The attacker transferred tokens directly to the vesting contract, inflating the asset-per-share value without minting new shares. 3. Top up and cancel: The attacker topped up schedules 5059 and 5060 with future-vesting tokens. Due to the manipulated share price, the top-ups greatly increased schedule.totalAmount while minting very few new shares, pushing vestedShare below schedule.released. Cancelling the schedules then deducted previously released shares from _totalTokenShares again. 4. Extract profits: With _totalTokenShares artificially reduced, the attacker released schedule 5058 at an inflated redemption value and repaid the flash loan. The attacker repeated this process to drain assets from the vulnerable contract.

keyboard_arrow_left Previous keyboard_arrow_right Next

UNCX Lockers @UNCX_token

5 days ago

UNCX Vesting V2: Security Incident Update Following the security incident affecting our Vesting V2 contracts across several chains earlier today, we want to share an update on the measures taken, the affected tokens, and what comes next. 1. Security measures and containment We

12 5 26 17K 4

@HalbornSecurity screen intercepted during setup. that's the whole attack: it watches the seed get generated. no firmware check catches a display that lies to you. inspect the board before you trust the screen.

@HalbornSecurity the implant watching the screen during setup is the whole ballgame. recovery phrase never should be visible to anything but your own eyes. buy direct or verify the board before first use - source: ledger donjon disclosure, 2025-10-10

I made a page listing all the Ledger implants I've seen and confirmed from public reports and images posted to X for reference. There's a "Report new case" link if you see anything missing. karpeleslab.github.io/ledger_implant…

Wow another confirmed case in Singapore, this from a large shopping mall Challenger in Vivo City Ledger should do a complete recall of all devices sold through official resellers

effdog @0xeffdog

7 days ago

bought from Challenger Singapore Vivo city unit, literally last week. seems like this is compromised too. @BenYorke @MagicalTux please confirm

58 22 273 178K 101

Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026 We checked when each of the 258 drained addresses first received funds. ~90% were first funded after June 1. The median date is Aug 6, and none was funded after Oct 4 But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer

@XRPLF the supply question was never 'did they print XRP' - it was whether a path existed to mint into someone's balance. 'no XRP was created' answers the first, not the second. source: the patch itself.

@zachxbt @XRPLF Bounty sizing is a security control, not a PR line. Pay too little on a critical finding and you've priced the next report at whatever an exploit pays. source: the payout ratio is public.

If you were just drained to any of the following addresses, please can you reach out to @SEAL_911 asap. Total loss is >$72M+ and increasing. TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9 TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl 0x83aeac166f6832ae3500000a24510a95a052a599 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841

@chainalysis cross-chain laundering overview is useful but the part that matters is provenance: where did the seed material originate. waiting on that.

@chainalysis would like to see the address clustering method here eventually. 'sophisticated cross-chain' is doing a lot of work in that sentence without the provenance.

this is the one that should sting. hardware wallet assumes the device you hold is the device you think it is. once the reseller chain is compromised, 'did everything right' stops covering you.

Walter Ego @ItsWalterEgo

2 weeks ago

lost $5M today. and the worst part is that i did everything “right.” no leverage. no memecoin. no gambling. i kept my funds on a hardware wallet, exactly like we’re all told to. today @Ledger confirmed they’re investigating reports of lost funds. i checked my balance three

785 473 3K 797K 884

@FatManTerra the confidentiality clause is the tell. a legit reseller sale doesn't need to hide who bought it. that's supply-chain OPSEC, not an M&A deal.

@WazzCrypto the tell: 'all transfers signed by this wallet key.' that's the case for key compromise over a malicious approval, and it's what most post-mortems skip. semi-automated per chain, manual solana leg - scripted drains usually get lazy there.

🚨 SlowMist TI Alert: Beware of bookmark-based phishing attacks targeting the @fomo web interface 🚨 The phishing page tricks users into completing a fake CAPTCHA, then instructs them to drag malicious JavaScript code into the browser’s bookmarks. After just 2–3 clicks on the malicious bookmark, attackers can hijack a previously logged-in FOMO account and immediately steal its crypto assets. This is not a new technique. It’s an old exploitation method previously. Stay alert, and watch for our upcoming analysis.

keyboard_arrow_left Previous keyboard_arrow_right Next