🚨SlowMist TI Alert🚨 💸 @Bonfiretoken Loss: ~ $50k 🔍 Root Cause: Access control missing in BonfireSwap router's `transfer`. The function does not check `msg.sender == from` nor verify the caller's allowance on `from`, letting anyone set a victim as `from` and themselves as `to`. The router drains the victim's TOKEN using its pre-approved allowance (victim → router) and forwards funds via same-token pool swap. 📌 Attacker: 0x2b5bf7d9d9dc1eec68f40c6b7a8f197e65f9731a → attack contract 0x28E976Ea7b83553d6D1D45CE81334156A2632127 📌 Victim: 41 TOKEN holders who approved the router (largest: 0xefF2FC4E3145f58F534d68A36Bcd3085Be6a4096, −5289.1 TOKEN) 📌 Vulnerable Contract: 0x17e801e17cefc6334059189c178d4783830e03d3 (BonfireSwap router) Powered by Tx:

读完《区块链黑暗森林自救手册》，不知道为什么@evilcos 为什么不用一些篇幅讲一下yubikey这类物理MFA的作用或者科普，我想这个部份能在很大程度上让普通人的抗黑抗钓鱼能力大幅提升，我确实不太理解为什么完全不提

We're publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them. We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies. These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve. We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop. Read the report:

I bought a Fable dataset from one of the top Chinese LLM routers yesterday. With just 6TB data, I can take over 7 Chinese/CIS gov entities & 19 top Chinese firms like Xiaomi, Huawei, NIO, Minimax using SSH keys, VPN configs, Aliyun keys, GitLab tokens sent to the router.

验证了几轮，gpt-5.6-luna 在我的安全分析场景下还没有出现 cybersecurity risk 提醒，速度快，效果还挺不错，得益于 gpt-5.5 时期我给我的 Agent 做了扎实的 Harness 工作。 Sol 和 Terra 都有敏感的安全风险提醒，使用时需要悠着点。

🚨SlowMist Alert🚨 💸 @MoonwellDeFi Loss: ~$8.7M USD 🔍 Root Cause: The protocol relied on a MAMO price from a thin market. The attacker manipulated this price, making the collateral appear far more valuable than it really was. This allowed the attacker to borrow funds from the mUSDC and mcbBTC markets and profit from the inflated collateral value. 📌 Attacker: 0x719eae70d4a83f35bf82a2740699f5db84be919d 📌 Vulnerable Contract: 0xf877acafa28c19b96727966690b2f44d35ad5976 📌 Collateral Market: 0x2f90bb22eb3979f5ffad31ea6c3f0792ca66da32 Powered by Tx:

ZachXBT @zachxbt 发声永久放弃无偿帮人： “抱歉，我已永久不再无偿帮人。接下来会把精力放在捐款人、客户身上，同时仍会把我自己觉得有意思的案子公开分享。因此除非符合我的筛选标准，否则我不会回复。” ZachXBT（Zachary Wolk）从自己被骗约 1.5 万美元开始自学链上取证，2021 年起几乎全靠社区捐款做公共调查。 公开数字显示他的努力直接促成约 2.1 亿美元追回，间接相关扣押再加约 2.25 亿美元；按照Paradigm 的口径帮助受害者追回超 3.5 亿美元。 2026 年 8 月初他自己公开讲的两个案例直接导致了他的决定： • 用户 Roshii（Zatoshi）被骗 60 万，口头说“随便开价”，他花 5 小时以上追踪并冻结了 9.6 万。对方因为没报税拒绝在丹麦报案，他开口要 5000 美元后对方失联数周。 • 某项目开 2.5 万赏金，他做完团队深度链上审查，发现雇了朝鲜相关 IT 人员并因此被打。项目拖欠 9 个月，说付不起。 他终于放下助人情节，学会尊重他人命运了。