SlowMist says a third-party Aave adapter exploit drained about 114 ETH from two Safe wallets. Aave v3’s core contracts were unaffected. Other wallets using the same vulnerable module may still be exposed.

SlowMist CISO: Critical Apple Update May Patch Zero-Day Vulnerability Used to Drain Crypto Wallets SlowMist Chief Information Security Officer (CISO) 23pds stated that Apple has released a critical security update, which likely patches a zero-day vulnerability actively exploited to drain cryptocurrency wallets. Apple acknowledged a report indicating that the issue may have been exploited in extremely sophisticated attacks against specific targeted individuals, affecting iOS versions prior to iOS 27.

SlowMist: Hackers Implement Full-Chain iOS Exploit to Steal Private Keys and Mnemonic Phrases Across Versions 13 to 26.5 SlowMist Chief Information Security Officer 23pds has issued an urgent security warning advising all iOS users to update their devices immediately. He disclosed that cybercriminals have actively operationalized a full-chain exploit framework capable of silently exfiltrating private keys and mnemonic seed phrases directly from iOS devices. The attack execution pathway involves: luring targets to a malicious webpage via Safari through social engineering or watering-hole tactics, triggering memory corruption in WebKit/JavaScriptCore (JSC) to secure arbitrary read/write access at the JavaScript layer, subsequently bypassing Pointer Authentication Codes (PAC) to achieve native code execution, escaping the WebContent sandbox, and completing kernel privilege escalation to root to drain device Keychains and local crypto wallet application data. The potentially affected versions are reported to span iOS 13 through iOS 26.5 (pending final confirmation).

🚨 SlowMist TI Alert 🚨 A supply chain attack has compromised Ethersphere’s npm package `@ethersphere/bee-js@13.3.0` and Swarm Desktop v0.56.2. Attackers abused compromised GitHub accounts and legitimate release pipelines to distribute malicious code across Windows, macOS, and Linux. The malicious code retrieves and executes remote JavaScript from `api[.]frameworkmetrics[.]xyz`. Its later-stage backdoor uses the Ethereum smart contract `0xf8a900Db50b3331be6B768bA460BB59f3E40C344` as a decentralized command-and-control (C2) configuration store, allowing attackers to dynamically update C2 addresses. The same contract was previously linked to the SleepyDuck / EtherDuck malware campaign targeting malicious Open VSX extensions. Potential risks include wallet credential theft, private key exfiltration, persistent backdoor deployment, and unauthorized remote access. Users should remove `@ethersphere/bee-js@13.3.0`, pin version 13.2.0, and upgrade Swarm Desktop to the clean v0.56.3 release. Investigate affected systems, rotate potentially exposed credentials, and monitor suspicious connections to the malicious infrastructure. You can also visit to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! Reference:

🚨 SlowMist TI Alert 🚨 💸 @ankr Loss: ~$304.5k 🔍 Root Cause: The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and withdrawal amounts. All five receipts carried valid signatures from the bridge's trusted consensus signer, allowing withdraw() to release assets without independently verifying the receipts against the actual source-chain events. ⚠️ The origin of the unauthorized signatures remains under investigation. Signer compromise has not been confirmed. 📌 Attacker (Tx Sender): 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703 📌 Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6 📌 Vulnerable Contract: 0xc437DF90B37C1dB6657339E31BfE54627f0e7181 Powered by Attack Tx: Reused Source Tx:

🚨 SlowMist TI Alert: Beware of the “Cracked TradingView Premium” Infostealer 🚨 Since mid-October, X account "cryptotrice" has repeatedly promoted a so-called “reverse-engineered cracked #TradingView# Premium,” with some posts passing 300K views. The software requires downloading a password-protected archive and generating a license code via a KeyGen. 🔑 The author claims the project is open source on GitHub, but the download link in the article does not point to #GitHub#. In some replies, the author also said the repo has been made private and that links are only available in-app and expire after a single use. Several users warned in the comments that it looks like malware stealing account info and crypto wallets, and one said their antivirus flagged and deleted it right after extraction. 🦠 We analyzed it and confirmed the Windows sample is an infostealer: 🔸 Collects browser credentials, crypto wallet data and Telegram data, and sends it to the C2 via WinINet 🔸 Uses Telegram and Steam to dynamically fetch and rotate C2 servers 🔸 The download site, arche-hypnose[.]com, appears to be a legitimate website compromised to distribute the malware 🔸 The macOS link currently returns 404, so no sample has been obtained ⚠️ If you have already run this software: disconnect from the network immediately, move your assets to a clean device with a new wallet and seed phrase, change passwords for your browsers, exchanges, email and Telegram, and terminate active Telegram sessions. Cracked software, KeyGens and password-protected archives are among the most common ways infostealers are distributed. Don’t install them. 🛡️ IOC Sample source: teapawt[.]org/cryptotrice/article/2111472920241524897 Download links: hxxps://www[.]arche-hypnose[.]com/get/ (Windows) hxxps://www[.]arche-hypnose[.]com/mac/ (macOS, currently 404) C2: hxxps://xn[.]amanlay[.]org/rn/gate hxxps://z[.]dak69[.]org/j/gate hxxps://xn[.]amanlay[.]org/kw/gate

🚨 SlowMist TI Alert: Android’s November 2026 security bulletin is out 🚨 Among the critical flaws: CVE-2026-58868 (Critical) in the Framework component. 💥 It allows remote code execution with no user interaction and no extra privileges. 📱 Affects Android 14, 15, 16, 16-QPR2 and 17. 🔍 No confirmed in-the-wild exploitation so far. But if a bug like this ever gets exploited at scale, it would be a nuke for mobile. Android runs on roughly 7 out of every 10 smartphones worldwide. 🌍 🛡️ Patch levels: ✅ 2026-11-01+: includes CVE-2026-58868 and other Framework/System fixes ✅ 2026-11-05+: covers ALL fixes this month, incl. kernel, MediaTek & Qualcomm ⚙️ Check: Settings → About phone → Android version → Security patch level Please update ASAP ⬆️ 📄 Details:

🚨 SlowMist TI Alert: DarkSword Targets iPhone Crypto Users ⚠️ iPhone and iPad users: Update your iOS promptly and beware of apps potentially compromised by #DarkSword#. DarkSword targets crypto users, exploiting iOS vulnerabilities to escape the sandbox and steal sensitive data, including Keychain credentials, locally stored wallet private keys, and Notes data. Successful exploitation could put your crypto assets at risk. 🔎 According to SlowMist’s MistEye threat intelligence analysis, 1,500+ DarkSword-related phishing sites have been identified across the web, targeting users through e-commerce platforms, fake Binance and OKX sites, fake crypto wallets, gaming services, and cryptocurrency exchanges. 🛡️ Stay safe: • Keep your iOS devices updated. • Be cautious of suspicious or compromised apps. • Never store sensitive wallet credentials or seed phrases in Notes. 📖 Related SlowMist analyses: 🔗 DarkSword Trojan Backend & iOS Attack Chain: 🔗 FomoPeek App Store Poisoning & iOS Kernel Exploitation:

🚨 SlowMist TI Alert 🚨 LiteLLM has been compromised again in a supply chain attack. The malicious release litellm@1.107.0 affects PyPI packages and Docker images, including floating tags such as latest and main-stable. The injected malware executes automatically during Python startup, stealing cloud credentials, AI API keys, SSH private keys, and other sensitive data. It also enables remote code execution. Affected releases have been removed or replaced. Users should avoid version 1.107.0, rebuild compromised environments from clean images, and rotate potentially exposed credentials. Pinning to 1.106.2 is recommended. You can also visit to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant!