GoPlus Challenges THORChain’s Decentralization Claims Over DPRK-Linked Fund Flows GoPlus Security argued that THORChain should not compare itself directly with Bitcoin or Ethereum when defending its inability to block illicit flows. It said THORChain outbounds rely on threshold signatures from a relatively small active validator set, while the protocol already includes pause, per-chain signing halt and governance mechanisms. GoPlus pointed to prior intervention during THORChain’s own exploit and argued that FBI- or OFAC-attributed DPRK-linked funds could be blocked under the protocol’s existing emergency framework.

GoPlus: Bitget’s $387.5M Hack Exploited the Transaction-Signing Trust Chain, Not Private Keys GoPlus Security said its review of Bitget’s $387.5 million security incident found that the attack did not involve a private-key leak, but rather a compromise of the transaction-signing trust chain. Attackers breached a critical wallet backend system, forged transaction data, and caused Bitget’s authorized signing flow to generate valid signatures for transfers the exchange did not intend to make. GoPlus said the fund-drain window lasted about 2 hours and 25 minutes, with the largest wave moving roughly $185 million in about one minute. It has blacklisted attacker-linked addresses and shared them with ecosystem partners. GoPlus said the incident shows structural similarities to the 2025 Bybit hack, though Bitget has not yet published a full technical report and the initial intrusion method remains unconfirmed.

GoPlus Security (GPS) price has changed by +15.61%. . The highest price was 0.390158 baht and the lowest price was 0.311463 baht in the past 24 hours on Bitkub Exchange. . Bitkub Exchange reminds investors to thoroughly research before investing. . Check the latest price at: . *Cryptocurrency and digital tokens involve high risks; investors may lose all investment money and should study information carefully and make investments according to their own risk profile. . #Bitkub# #BitkubExchange# #Token# #priceupdate# #marketupdate# #GoPlusSecurity# #GPS# _________________________________ Website: Facebook: Instagram: Tiktok: Call Center: 1518

GoPlus Security is proud to support Robinhood Chain by @RobinhoodCrypto . As a Web3 security infrastructure provider, GoPlus brings its token and transaction risk detection capabilities to the Robinhood Chain ecosystem. GoPlus token and transaction risk detection for Robinhood Chain assets are now available across @GeckoTerminal , @DEXToolsApp , @dexscreener , @CoinMarketCap , @BinanceWallet , @wallet , @BitgetWallet , @TokenPocket_TP , @Debot_Official , and @UseUniversalX . To support builders and developers in the Robinhood Chain ecosystem, simply sign up on our platform to get your API key and access complimentary API quota for our services. Get started:

🚨 GoPlus Security Alert: On October 31, the official Flap and Kintsu websites suffered DNS hijacking attacks. The attacker likely compromised a domain registrar, with more than 10 other domains also hijacked alongside Flap and Kintsu. By manipulating DNS, the attacker redirected traffic from official project domains to malicious clone sites to steal assets. ⚠️ How Funds Are Stolen: Users who click “Connect Wallet” on the clone sites are redirected to a malicious wallet-connection or drainer page. The theft takes two forms, with attack characteristics pointing to the #StepDrainer# group: 1. Direct native-token transfers: Users sign a transaction sending BNB to the attacker’s Safe. 2. ERC-20 approval abuse: Users approve the Safe to spend their tokens. The attacker then calls `transferFrom` to move the tokens. Attacker-controlled Safe recipient address: 0x24497068cA4166ca32a04ae530ce00Cf79755bD5 Safe’s sole owner / execution address: 0x33dfc810365193bff54326812d7df34b3e438da3 🚑 Recovery Status: Kintsu is back online ( Flap is also back online ( with remaining available as an alternative domain. The cause of the DNS hijacking is still under investigation. 🛡️ Security Recommendations: 1️⃣ Stay alert to unusual behavior or anything that differs from the site’s usual behavior. DNS hijacking can redirect you to a malicious clone. 2️⃣ If you signed a suspicious transaction or notice a suspicious transfer, investigate immediately and move your remaining assets to a fresh, secure wallet as soon as possible. 3️⃣ Use tools such as the GoPlus security extension to check for and revoke suspicious token approvals promptly.

TermiX × @GoPlusSecurity — the Security Agent trial is settled. 8 participants passed verification. All 8 are paid: 12.5 USDC on BNB Chain plus 1,518.75 base:0x0c1dc73159e30c4b06170f2593d3118968a0dca5 on Base, each. Don't take our word for it. The eight addresses: 0x592b9B9be02Bd5A5d97a7DB770b4c4dcA1b98aF5 0x176C17f09a30dc7941A0e5e89e3ABe34cd3f8a99 0xC568AA0d7386fFd8F5804aC74c0482fef5111522 0xC5e62C8A854d2Df11A17a59429D3Bd4a9C5414D9 0x1a7a76d4875917317161602027E44f880dF2f327 0xaE5720ed4Be0cA45eda7ee30987d471A714d9fE9 0x6C827099F5EaE57dDDccBa80c92673AB6674fa92 0xF5FDfA97a439004b2d3598936267787368538C81 Paid from 0x11F5872F093191b52C7C501483f0281727f1A46b. Every tx hash is in the image.

🚨 GoPlus Security Alert At Hexacon 2026, researchers demoed 4 bugs against Apple iOS / iPadOS / macOS ( ). One-click: open a malicious PDF in iMessage or Signal and it can run code, then exfil local messages to a remote server. Appears tied to CoreGraphics CVE-2026-86950. Affected: iOS / iPadOS < 26.7.1 macOS Tahoe < 26.7.1 Sequoia < 15.8.1 Apple shipped emergency updates 26.7.1 / 15.8.1 on Sept 28: ⚠️ Do not open any suspicious PDF. Update iPhone, iPad, and Mac now, and stay on the latest OS.

📢 GoPlus Service Update #Abstract# (chain ID 2741) and #Blast# (chain ID 81457) are shutting down. GoPlus will end Token Security API support for both chains on October 19, 2026. Token Security API coverage on all other chains is unchanged.

🚨 GoPlus Security Alert: On Base, a vault contract that no project team has publicly claimed was hit. 1,783.067 aBaswstETH was taken out, then redeemed on Aave V3 for about 1,783 wstETH. Loss is roughly $6 million. The vault holds a position on Aave V3 Base, sized in the tens of millions. Aave’s core lending contracts and Base itself were not attacked. 🔍 Root Cause: multisig governance and access-control failure. The exploit contract (0xcdFE9130…) was added to the vault’s borrow allowlist through a Safe multisig. The Safe flow may have been socially engineered or phished, or this was insider collusion. The team had not executed any Safe transaction for 25 days. These two were executed suddenly. Most concerning: about $31.7 million in assets is still sitting in the vault, at risk. Someone even sent the attacker an on-chain message pushing them to withdraw the rest and asking for a tip. Still zero response and zero announcement from the project team. Attacked vault: 0xD1895f2019c2152FC2b9022D57f19198c4CFCABC Attacker: 0x0B5126e1bc27C0de77e02e97945760A674EdB034 Related addresses: 0xcdFE91301356da873562EF513828a60dba1F569d 0xC73448432a05deeA5Ea18a07D3b5d9ccf6297f8D Malicious authorization (Safe execution): Attack transaction (first borrow, 1 aBaswstETH): Attack transaction (Aave redemption, 1,783.067 wstETH):

🚨 GoPlus Security Alert: A user got drained for ~$170K in $LINK after signing a malicious #Permit2# transaction. Victim: 0x71619d71474F8D0AAa9C18a757be7617686B499b Phisher wallets: 0x0000db5c8B030ae20308ac975898E09741e70000 0x0000cdCa01087D340e8fA4339b121B69a8aE0000 0xA6809aeDEbFA10A0C2dbcF3363cB0Ff37866f73D 🛡 Security Tips: 1. Follow the #GoPlus# Anti-Phishing “4 Don’ts”: 🚫 Don’t click unknown links 🚫 Don’t install unverified software 🚫 Don’t sign transactions you don’t fully understand 🚫 Don’t send funds to unverified addresses 2. Install the GoPlus Security extension to block phishing links, risky signatures, malicious approvals, and suspicious transactions in real time 👉