⚠️GoPlus Security Alert: The Korean stablecoin project @WemixNetwork was exploited, suspected to be caused by the compromise of the minting contract administrator account, resulting in the malicious issuance of approximately 5.22 million WEMIX$ stablecoins. The actual value of assets exchanged and transferred was approximately $730K, primarily in USDC. WEMIX is a blockchain ecosystem backed by Wemade, a publicly listed South Korean gaming company. The project team has currently suspended related cross-chain and trading services.

🚨 GoPlus Security Alert: A user had approximately $340K worth of Alpha USDC Delta V transferred by phishing attackers after signing a malicious #Approve# transaction. Victim Address: 0x3E1B8F98Ed69C6A97A8540E1D7AeD33FdF4509aA Phishing Addresses: 0xbC2EdA71a62C0C8142E5138b1c17c879f7c04F0D 0x64B478b0A819fbD0ef05B4ef118Df78941D6D018 0xeDBc178d79DC6Fa9A16b8B93FF02a31846098B72 0x26115fA4FdB32d0221f2A14848d90379F7033269 🛡 Security Tips: 1. Follow the #GoPlus# Anti-Phishing "4 Don'ts": Don't click unknown links, don't install untrusted software, don't sign unknown transactions, don't transfer funds to unverified addresses. 2. Install the GoPlus Security Extension to block phishing links, risky signatures, approvals, and transactions in real time 👉

🤖 Kimi-K3 & GPT-5.6 Are Now This Powerful — Can Anyone Make Money Finding Bugs? Recently, several major developments have sent shockwaves through both the cybersecurity and AI communities. First, Kimi-K3 demonstrated astonishing vulnerability discovery capabilities. Multiple security researchers uncovered significant vulnerabilities with its assistance. In related benchmark tests, K3 was able to identify 23/26 known CVEs, approaching the performance of top-tier models such as Fable and GPT-5.6, while significantly reducing costs. Meanwhile, GPT-5.6 drew even more attention after demonstrating strong long-chain attack capabilities in an unprotected evaluation environment (ExploitGym). It autonomously escaped sandboxes and successfully carried out an attack against HuggingFace, triggering industry-wide concerns and discussions around AI’s autonomous security capabilities. After seeing these reports, many people outside the security field came to ask me: “Since AI can already find vulnerabilities on its own, can I just buy an API Key, give it a prompt, and make money from bug hunting while doing nothing?” 💡I. Breaking Boundaries and Improving Efficiency: The “Offense and Defense Revolution” Brought by AI The new generation of large models represented by Kimi-K3 and GPT-5.6 has indeed completely transformed how security researchers work. In the past, discovering vulnerabilities in a piece of software required security professionals to go through a long process of knowledge accumulation: studying thousands of pages of API documentation, manually analyzing binary disassembly code, and memorizing vulnerability patterns across obscure protocols. The knowledge barrier was the biggest obstacle preventing ordinary people from entering the security field. But now, large language models have shattered this barrier. Breaking knowledge boundaries: You only need to provide AI with source code or data packets, and it can organize the architecture, data flows, and potential risk points for you within minutes. Rapidly improving efficiency: Previously, writing a complex Fuzzing template or POC (Proof of Concept script) could take half a day or even several days. Now, AI can complete it within minutes. Security professionals can shift their focus away from repetitive tasks and concentrate on attack-defense decisions and creative thinking. In practical applications, this efficiency improvement is immediate. Whether it is Kimi-K3’s sharp intuition in open-source code auditing or GPT-5.6’s capability in complex logic analysis, both demonstrate that AI is becoming the sharpest “offensive and defensive weapon” in the hands of security researchers. 💡II. A Master Strategist on the Battlefield, but a Poor Soldier in Execution If you actually let AI independently hunt for vulnerabilities, you will discover a very “ironic” phenomenon: AI is an extremely capable “strategist,” but a poor executor and even a “soldier” that tends to take shortcuts. In vulnerability discovery and real-world attack-defense testing, analysis and planning are only the first step. The more critical part is precise execution. However, when it comes to “taking action,” AI suffers from deeply rooted limitations within large language models: - “Armchair strategy” and hallucinated answers: Ask AI to test an SQL injection or RCE vulnerability, and it can produce a well-structured plan with impressive analysis. But when it actually calls tools to execute the test, if it encounters network timeouts, non-standard response packets, or similar issues, it often gives up, starts “guessing” the outcome, and attempts to cover the gaps. - Severe “cutting corners”: Security testing requires exhaustive testing and boundary-condition validation. However, to save context and reasoning resources (or due to Agent step limitations), AI often becomes “lazy” after only a few execution steps. For example, if you ask it to scan 100 endpoints, after testing the first 3 it may summarize: “Based on the patterns of the first 3 endpoints, the remaining 97 endpoints are considered secure. You can continue testing, or I can help you organize the next steps.” This kind of “laziness” and avoidance of difficult tasks can be fatal in vulnerability research and offensive security. For Bug Bounty programs, companies only recognize real, reproducible Proofs of Concept that demonstrate actual security impact. If AI reports these superficial “results” as vulnerabilities, the outcome is often a pile of Invalid, Duplicate, and Out of Scope submissions, with little chance of receiving meaningful rewards. 💡III. Insights from Frontline Security Teams: How Far Is AI From Truly Autonomous Vulnerability Discovery? To evaluate AI’s upper limits in real-world offensive security scenarios, my team and I conducted multiple practical Red Teaming tests. We used some of the most advanced models currently available — including Kimi-K3, GPT-5.6, and Fable-5 — and conducted deep testing across Skill/MCP (Model Context Protocol), AI Agent architectures, and traditional complex enterprise software systems. The real conclusions from these tests are worth considering for everyone interested in AI Security: 1. Models have excessive “analysis capability,” but severely insufficient “application and tool-calling capability” When facing code and architecture, models can indeed identify that “there may be a logic issue here.” However, during actual Tool Chain execution and knowledge implementation, they can easily lose momentum. 2. Effective “orchestration” is required for AI to truly perform tasks If you want AI to actually work, you cannot simply give it a Prompt saying “help me find vulnerabilities.” You must build an external engineering framework: - Task Orchestration: Break down a large objective into dozens of deterministic subtasks (e.g., asset discovery → endpoint analysis → parameter extraction → state machine testing). - Tool Orchestration: Equip AI with robust APIs and Tool Chains, while establishing strict error handling and retry mechanisms to prevent it from “making up” results. - Goal-oriented outcome metrics: Use clear metrics to force AI to validate findings and actively call tools, rejecting any behavior based on “guessing” or “taking shortcuts.” 3. Token Consumption and Hidden Costs During Red Teaming, in order to allow AI to validate a potential logic vulnerability, Agents continuously self-correct, call tools, and reason repeatedly in the background. Almost every testing workflow consumed billions of Tokens. This means using AI for vulnerability discovery is not “zero cost.” Without guidance from experienced security professionals, blindly letting AI “run blind experiments” can result in Token costs far exceeding the bug bounty rewards you eventually receive. The real barrier has shifted from “whether you know how to code” to “whether you understand security engineering, whether you understand Agent orchestration, and whether you can afford the Token costs.” 💡IV. The More Powerful AI Becomes, the More Irreplaceable Those Who Know How to Use It Become Returning to the original question: “Kimi-K3 and GPT-5.6 are already this powerful. Can ordinary people now make money finding vulnerabilities?” My answer is: AI has lowered the “learning barrier” of security, but it has significantly raised the “competitive barrier” of security. For people who completely lack security knowledge, expecting AI to automatically find vulnerabilities and make money through a few simple prompts is like giving an elementary school student the world’s most advanced surgical scalpel and expecting them to independently perform complex cardiac surgery. AI may throw hundreds or thousands of “illusions” that look like vulnerabilities at you, but only researchers with real offensive and defensive experience can identify, among countless chaotic errors, the one weakness that can truly break through a security defense. AI is currently only a sword sharp enough to cut through steel. Whether it can pierce the strongest shield depends on the hands holding the sword — and how much security awareness, understanding, and wisdom those hands possess.

🚨GoPlus Security Alert: Robinhood CEO @vladtenev’s Twitter account was compromised and used to promote a fake $VLAD meme coin, with the attacker profiting over $1.3M! Investigation shows that the $VLAD creator is: 0xd70627fd9ee5b70906620a6f2001ba74457b438d. This address created only 1 token, and its gas fees were funded through Binance via Relay before being bridged to the attack address. The related addresses eventually sold off their holdings in batches, then bridged the funds to #ETH# through intermediary addresses and transferred them to the consolidation address: 0x3ab2206b98b01ba256dbdd4c50208bf17ab27d50.

🚨 GoPlus Security Alert: A user lost ~$1,625 worth of USDC after signing a malicious Permit transaction 183 days ago, which was used by a phishing attacker to transfer funds. The user did not revoke the related approval afterward, resulting in another theft of ~$75,780 worth of USDC. Victim Address: 0x13eF2275bE2aB18E18884065ea856cA8CCc6DbcF Phishing Addresses: 0xAfb2423F447D3e16931164C9970B9741aAb1723E 0x187DCEDda3dAcFa1F3Bcd5468dE789F3c03F2490 0xAc09bBC4167D69543189b494c27c841F1c5dCdB7 Related Transaction: 🛡 Security Tips: 1. Follow the #GoPlus# Anti-Phishing "4 Don'ts": Don't click unknown links, don't install untrusted software, don't sign unknown transactions, don't transfer funds to unverified addresses. 2. Install the GoPlus Security Extension to block phishing links, risky signatures, approvals, and transactions in real time 👉 3.Grant approvals only when needed. Avoid granting unlimited allowances.

😱 Hugging Face recently disclosed an intrusion targeting its production infrastructure. A notable characteristic of the incident is that the attacker was fully driven by an autonomous AI Agent system throughout the attack, while the defender’s detection and forensic analysis also primarily relied on internally built AI systems. This is considered a landmark case marking the transition of the “agentic attacker” concept from an industry warning to a real-world incident. Impact scope: Certain internal datasets and several service credentials were accessed without authorization. The official statement indicated that no user-facing models, datasets, or Spaces were found to have been tampered with, and the software supply chain was also verified to be secure. Whether partner or customer data was affected remains under investigation. The dual significance of this incident lies in: ——Attack perspective: “Agentic automation” has become an emerging high-risk attack vector, with attack execution speeds reaching “machine speed,” exceeding the response window of traditional human-driven security operations. ——Defense perspective: “AI guardrail asymmetry” highlights that under current AI commercial models and security frameworks, security teams face new requirements for more proactive toolchain capabilities. Small and medium-sized teams may not have the computational resources to build local models like Hugging Face. When facing comparable agentic attacks, they may lack both the unrestricted models available to attackers and the self-hosted analytical capabilities required by defenders. This remains an issue that the industry needs to further explore. AI-native offensive and defensive operations are evolving from “human vs. system” into “system vs. system.” Building defensive capabilities requires treating AI defense and analysis capabilities as foundational infrastructure and preparing in advance, rather than addressing them only after incidents occur. More details:

🚨GoPlus Security Alert: Nearly one year of dormancy!! A user lost approximately $84K worth of USDT in their wallet after signing a malicious #Approve# transaction about one year ago, allowing phishing attackers to transfer the funds. Victim address: 0xE6F3D501eB6730C75965CdF523377470C1b23408 Phishing addresses: 0xAfb2423F447D3e16931164C9970B9741aAb1723E 0x0000F7E93775c94D9905448b46EA9052Dd320000 0x921503C1fA01077f9BaeaE7cE3Db7691a8f43595 🛡 Security Tips: 1. Follow the #GoPlus# Anti-Phishing "4 Don'ts": Don't click unknown links, don't install untrusted software, don't sign unknown transactions, don't transfer funds to unverified addresses. 2. Install the GoPlus Security Extension to block phishing links, risky signatures, approvals, and transactions in real time 👉 3.Grant permissions only when needed. Avoid unlimited approvals, regularly check your approvals, and revoke unnecessary historical permissions.

🚨 GoPlus Security Alert: RWA trading platform @Ostium on #Arbitrum# was reportedly exploited due to a suspected admin account private key compromise, resulting in an estimated loss of $11.86M. The attacker first opened a position via openTrade, then manipulated the price through performUpkeep, and finally profited by calling closeTradeMarket. The price submitted in the performUpkeep function requires a signature from an authorized account for verification. The attacker's success suggests the private key of the authorized account (0x38110430184c22d93c30b3e67b9af98d5d0ab8bd) may have been compromised. Attacker addresses: 0x321Df194646029e7A6193Ea05573d4B9c398bfD9 0xD1794196f0fc99c7f27970e661597d77d9a85869 Affected contract: 0x20D419a8e12C45f88fDA7c5760bb6923Cee27F98 Attack transactions:

📢 GoPlus Token Security API now supports 🪶 #Robinhood# Chain! Includes risk checks such as mintable, blacklist, ownerChangeBalance, and more. （Tax- and DEX-related information will also be available soon.） Get the list of supported blockchains 👉

🏅 Glory Round | Predict by $FORM (@fourdotmemezh) & $GPS (@GoPlusSecurity) to get a +12% Winning Weight Boost. Covers matches and related events during the Semi-finals, 3rd-place match, and Final. 🛡️ $5 First-order Compensation (Zero risk for your first play!) 🎁 Random airdrops from the last round begin soon

🚨 GoPlus Security Alert: Lending protocol @bonzo_finance was exploited due to an Oracle verification vulnerability, resulting in losses exceeding $9 million. The integrity of every price read by Bonzo Lend relies on BLS signature verification. In this incident, the field value of the BLS signature on the message was [0,0], i.e., a zero signature. The BLS signature verifier constructed a BLS pairing check based on the input and passed it to Hedera's pairing precompile (system contract 0.0.8). Because both the submitted signature point and the referenced committee public key resolved to zero (the "point at infinity"), the pairing equation trivially held true, and the precompile returned 1 (true). Simply put, an invalid BLS signature passed the oracle verifier's verification, after which the manipulated price was accepted and written on-chain, and subsequently consumed by Bonzo Lend. For more details, please refer to: The attacker then bridged the stolen assets (ETH and WBTC) to #Ethereum#. Attacker address: 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e

⚠️ According to ZachXBT, an early whale address associated with the #Solana# genesis block was reportedly compromised, resulting in an estimated loss of $14.2M (180.9K $SOL). Based on on-chain analysis, the funds first underwent abnormal unstaking, then flowed through newly created Solana wallets for consolidation and swaps, before being bridged to Ethereum for transfer. Victim Address: HwtbQBNnLERakdUDuCCLWmUs2oETLFQZeHUWeQdPads Attacker Addresses: Ffd1oB2aYM5UzMYUM7TmxULDRQb6KzgrBwmgj9U1C2bE (Solana) 653pnn5fzF51FfotBwxua55Es4QXxTdaXJLbPczVmswp (Solana) 0xaa5cfa4e96dda0f9aa30f4dc948b542a9b5817c6 (Ethereum) 0x536b4ee7507c41143e1b0bd1bf3f2b84be404836 (Ethereum) 0xbf11bdfbeb9ed137c352c81e45d191cacae6b0cf (Ethereum) The attacker has begun laundering the stolen funds through #TornadoCash#.

⚠️Top 10 Security Incidents (January–June 2026) 1：KelpDAO, April 18, loss of approximately $292 million. The attacker exploited a verification flaw in the LayerZero-related cross-chain bridge validation flow, released a large amount of unbacked rsETH, and rapidly supplied it to protocols including Aave, Compound, Euler, and Fluid for borrowing and cashing out, ultimately evolving into a cross-protocol bad debt contagion event. 2：Drift Protocol, April 1, loss of approximately $285 million. The attacker obtained protocol administrative control by leveraging durable nonce, social engineering, and weaknesses in multisig governance, then introduced forged collateral assets and manipulated protocol parameters to drain a large amount of real assets from the protocol. 3：Step Finance, January 31, loss of approximately $40 million. The compromise of high-privilege devices and the treasury private key system resulted in significant asset losses. On February 24, the project announced it would cease operations. 4：Humanity Protocol, June 9, loss of approximately $31 million to $36 million. The root cause was improper management of private keys and multisig keys. After compromising critical devices, the attacker took over bridge administrative privileges and carried out fund transfers and abnormal minting across multiple chains. 5：Truebit, January 8, loss of approximately $26.6 million. The attacker exploited an integer overflow/pricing logic flaw in a legacy contract to mint a large amount of TRU at low cost and dump the tokens on the market, causing the token price to collapse rapidly. 6：Resolv Labs, March 22, loss of approximately $25 million. After obtaining high-privilege signing capabilities, the attacker exploited the lack of supply caps and ratio validation in the minting logic to mint approximately 80 million unbacked USR and cash them out. 7：SwapNet, January 25, loss of approximately $13.4 million. Its closed-source contract contained arbitrary-call / approval abuse risks. The attacker leveraged users' existing approved allowances to trigger malicious transferFrom calls and drained users' assets at scale. 8：Verus-Ethereum Bridge, May 18, loss of approximately $11.58 million. The cross-chain bridge failed to strictly verify whether the source-chain input amount matched the destination-chain release amount during the validation process. The attacker exploited this flaw to forge valid payloads and withdraw assets. 9：YieldBlox, February 22, loss of approximately $10.97 million. The attacker manipulated the price of USTRY in a low-liquidity market, causing the oracle to overestimate the collateral value, and then executed excessive borrowing from the Stellar lending pool. 10：THORChain, May 15, loss of approximately $10.7 million. A newly joined node operator exploited weaknesses in the GG20 threshold signature scheme, compromised a single vault, and withdrew assets across multiple chains, exposing the systemic risks of cross-chain signing infrastructure.

🚨GoPlus Security Alert: A user lost $1M in USDT to phishing attackers after signing a malicious #Approve# transaction. Victim address: 0x8C949361B49320C48a51F4B1C6f9f83862530F89 Phishing addresses: 0x6D8c070338eC3d297f1D0ECEEA296bd7E13a32b9 0xf84c62572eEaFC90C0BCE3Fb6c85bCB573E68d93 0xc508a8C01bc3835BE67e0e5554B7D91A1bb70Da1 🛡 Security Tips: 1. Follow the #GoPlus# Anti-Phishing “4 Don’ts”: Don’t click unknown links, don’t install untrusted software, don’t sign suspicious transactions, don’t transfer funds to unverified addresses. 2. Install the GoPlus Security extension to block phishing links, risky signatures, approvals, and transactions 👉

😱Binance Alpha-listed project @TacBuild dropped 86% — but it was not hacked❓ Investigation found 18 suspected airdrop addresses (with no transaction history) that conducted large-scale cross-chain transfers of 716M $TAC and continued selling, generating approximately $1.975M in profits. This directly caused the $TAC price to drop 86%. These addresses still hold 172M TAC (worth $740K). The TAC team has not yet responded to this collapse incident. Not long ago, on May 14, the TAC-TON cross-chain bridge was attacked due to a lack of verification, resulting in a $2.86M loss. Following negotiations with the attacker, 90% of the funds were returned.