{"items":[{"id":20524,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1419,"url":"https://t.me/EthSecurity1/1419","date":"2026-11-07T08:09:55+00:00","edited_at":null,"text":"- EIP 7702 Security Considerations - link\n\n- Red Flags and Green Flags of Yield Bearing Stablecoins \n\n@EthSecurity1","html":"- EIP 7702 Security Considerations - <a href=\"https://www.halborn.com/blog/post/eip-7702-security-considerations\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- <a href=\"https://composable-security.com/blog/red-flags-and-green-flags-of-yield-bearing-stablecoins/\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Red Flags and Green Flags of Yield Bearing Stablecoins</a> <br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426398","deleted":false,"deleted_at":null,"views":352,"forwards":8,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["halborn.com","composable-security.com"],"media":[],"link_preview":null,"album":null,"topic":"research"},{"id":20181,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1418,"url":"https://t.me/EthSecurity1/1418","date":"2026-11-06T05:11:49+00:00","edited_at":null,"text":"Chainalysis  full user data breach: names, usernames, password hashes, valid tokens exposed, some plaintext passwords leaked \n@EthSecurity1","html":"Chainalysis  full user data breach: names, usernames, password hashes, valid tokens exposed, some plaintext passwords leaked <br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426335","deleted":false,"deleted_at":null,"views":87,"forwards":6,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":20010,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1417,"url":"https://t.me/EthSecurity1/1417","date":"2026-11-05T08:07:20+00:00","edited_at":null,"text":"BNIX / OSK (CoreVault) hacked for ~$181K \n\nRootcause: The vault’s BNB principal redemption logic depended on a manipulable on-chain spot price that could be distorted within a single transaction via flash loan.\nKey technical failure\nredeemPrincipal() calculated the BNB amount to pay out as:\nbnbAmount = redeemableUsd × wbnbPerUsd / 1e18\nThe wbnbPerUsd price came from OracleLib.getAccountingPrices, which used a 3-source median.\nWhen the TWAP / average-price windows were empty or unfilled, the median degraded to the live PancakeSwap WBNB/USDT spot price.\nThat spot price sits in a low-liquidity pair that is trivial to move with a large flash-loan dump.\nAttack flow (simplified)\nAttacker flash-borrowed ~207k WBNB.\nDumped ~195k WBNB into the PancakeSwap WBNB/USDT pool → artificially inflated wbnbPerUsd.\nCalled redeemPrincipal() while the manipulated price was live.\nThe vault over-paid BNB from the insurance/reserve pool (~260 BNB / ~$181k).\nAttacker swapped the excess BNB back, repaid the flash loan, and kept the profit (~160 BNB / ~$112k).\nCore design flaw\nThe protocol treated a same-block, flash-loan-manipulable spot price as a reliable accounting oracle for redemptions. Proper protections (strict TWAP requirement, secondary oracle fallback that cannot degrade to spot, or circuit breakers on large price deviations) were missing or ineffective.\n\n@EthSecurity1","html":"<strong>BNIX / OSK (CoreVault) hacked for ~$181K </strong><br><br><strong>Rootcause:</strong> The vault’s BNB principal redemption logic depended on a <strong>manipulable on-chain spot price</strong> that could be distorted within a single transaction via flash loan.<br>Key technical failure<br><code>redeemPrincipal()</code> calculated the BNB amount to pay out as:<br><code>bnbAmount = redeemableUsd × wbnbPerUsd / 1e18</code><br>The <code>wbnbPerUsd</code> price came from <code>OracleLib.getAccountingPrices</code>, which used a 3-source median.<br>When the TWAP / average-price windows were empty or unfilled, the median <strong>degraded to the live PancakeSwap WBNB/USDT spot price</strong>.<br>That spot price sits in a low-liquidity pair that is trivial to move with a large flash-loan dump.<br>Attack flow (simplified)<br>Attacker flash-borrowed ~207k WBNB.<br>Dumped ~195k WBNB into the PancakeSwap WBNB/USDT pool → artificially inflated <code>wbnbPerUsd</code>.<br>Called <code>redeemPrincipal()</code> while the manipulated price was live.<br>The vault over-paid BNB from the insurance/reserve pool (~260 BNB / ~$181k).<br>Attacker swapped the excess BNB back, repaid the flash loan, and kept the profit (~160 BNB / ~$112k).<br>Core design flaw<br>The protocol treated a <strong>same-block, flash-loan-manipulable spot price</strong> as a reliable accounting oracle for redemptions. Proper protections (strict TWAP requirement, secondary oracle fallback that cannot degrade to spot, or circuit breakers on large price deviations) were missing or ineffective.<br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426289","deleted":false,"deleted_at":null,"views":399,"forwards":7,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_projects"},{"id":20003,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1416,"url":"https://t.me/EthSecurity1/1416","date":"2026-11-05T07:09:55+00:00","edited_at":null,"text":"- Preventing Second Preimage Attacks in Merkle Trees: A Complete Guide \n\n- Stablecoin Security: How Design Choices Create Vulnerabilities and Economic Risk \n\n-  Inside the FBI: Crypto, Crime & National Security – Ep. 171\n\n@EthSecurity1","html":"- <a href=\"https://www.adevarlabs.com/blog/preventing-second-preimage-attacks-in-merkle-trees-a-complete-guide\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Preventing Second Preimage Attacks in Merkle Trees: A Complete Guide</strong></a> <br><br>- <a href=\"https://hacken.io/discover/stablecoin-security/\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Stablecoin Security: How Design Choices Create Vulnerabilities and Economic Risk</strong></a> <br><br>- <strong> </strong><a href=\"https://www.chainalysis.com/blog/inside-the-fbi-crypto-crime-national-security-ep-171/\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Inside the FBI: Crypto, Crime &amp; National Security – Ep. 171</strong></a><br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426286","deleted":false,"deleted_at":null,"views":265,"forwards":5,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["adevarlabs.com","hacken.io","chainalysis.com"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pmg1rG5Sc7VE","duration":null,"width":1200,"height":630,"preview":false}],"link_preview":{"url":"https://adevarlabs.com/blog/preventing-second-preimage-attacks-in-merkle-trees-a-complete-guide","site":"Adevar Labs","title":"Blog | Adevar Labs","description":"Insights into Web3 security, threat landscapes, and audit findings. Stay informed with technical breakdowns and practical advice from the Adevar Labs engineerin","image":{"url":"https://media.web3aggregator.io/files/pmg1rG5Sc7VE","width":1200,"height":630}},"album":null,"topic":"media"},{"id":19566,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1415,"url":"https://t.me/EthSecurity1/1415","date":"2026-11-03T09:17:09+00:00","edited_at":null,"text":"SOLANA MEV BOT KING DRAINED OF $786K King, one of Solana's oldest arbitrage bots with $7.2M in lifetime PnL, was drained of ~$786K, including 4.26K $WSOL, 191\n$SOL\nand $366K in stablecoins. Drainers: BHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jU Forwarder: Ddmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51Hkqj Victim: 7dGrdJRYtsNR8UYxZ3TnifXGjGc9eRYLq9sELwYpuuUu\n@EthSecurity1","html":"SOLANA MEV BOT KING DRAINED OF $786K King, one of Solana's oldest arbitrage bots with $7.2M in lifetime PnL, was drained of ~$786K, including 4.26K <a href=\"https://x.com/search?q=%24WSOL&amp;src=cashtag_click\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">$WSOL</a>, 191<br><a href=\"https://x.com/search?q=%24SOL&amp;src=cashtag_click\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">$SOL</a><br>and $366K in stablecoins. Drainers: BHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jU Forwarder: Ddmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51Hkqj Victim: 7dGrdJRYtsNR8UYxZ3TnifXGjGc9eRYLq9sELwYpuuUu<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426189","deleted":false,"deleted_at":null,"views":295,"forwards":11,"sender_id":null,"cashtags":["WSOL","SOL"],"hashtags":[],"addresses":["BHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jU","Ddmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51Hkqj","7dGrdJRYtsNR8UYxZ3TnifXGjGc9eRYLq9sELwYpuuUu"],"domains":["x.com"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pGw9rGztQ_FI","duration":null,"width":1202,"height":634,"preview":false}],"link_preview":{"url":"https://x.com/search?q=%24WSOL&src=cashtag_click","site":"X (formerly Twitter)","title":"$WSOL - Search / X","description":"The latest posts on $WSOL. Read what people are saying and join the conversation.","image":{"url":"https://media.web3aggregator.io/files/pGw9rGztQ_FI","width":1202,"height":634}},"album":null,"topic":"news_general"},{"id":19548,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1414,"url":"https://t.me/EthSecurity1/1414","date":"2026-11-03T07:03:55+00:00","edited_at":null,"text":"- When Hackers Get Hacked: Analyzing the Breach of LockBit - link\n\n- The State of Drainers Vol. 1 - link\n\n- Astaroth Banking Trojan Harnessing GitHub to Steal Crypto Credentials.\n\n@EthSecurity1","html":"- When Hackers Get Hacked: Analyzing the Breach of LockBit - <a href=\"https://slowmist.medium.com/when-hackers-get-hacked-analyzing-the-breach-of-lockbit-23b8f553747d\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- The State of Drainers Vol. 1 - <a href=\"https://www.securityalliance.org/news/2025-10-drainers-vol-1\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- <a href=\"https://decrypt.co/343833/astaroth-banking-trojan-harnessing-github-steal-crypto-credentials\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Astaroth Banking Trojan Harnessing GitHub to Steal Crypto Credentials</strong></a>.<br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426184","deleted":false,"deleted_at":null,"views":498,"forwards":8,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["slowmist.medium.com","medium.com","securityalliance.org","decrypt.co"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pO7gxG35G5FA","duration":null,"width":1200,"height":675,"preview":false}],"link_preview":{"url":"https://slowmist.medium.com/when-hackers-get-hacked-analyzing-the-breach-of-lockbit-23b8f553747d","site":"Medium","title":"When Hackers Get Hacked: Analyzing the Breach of LockBit","description":"LockBit’s leaked database exposed BTC addresses, private keys, chat logs, and linked companies.","image":{"url":"https://media.web3aggregator.io/files/pO7gxG35G5FA","width":1200,"height":675}},"album":null,"topic":"news_general"},{"id":19194,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1410,"url":"https://t.me/EthSecurity1/1410","date":"2026-11-01T06:55:55+00:00","edited_at":null,"text":"- RISC Zero Security Disclosure: Arbitrary code execution in guest. \n\n- TON Transaction Simulator for Revealing Smart Contract Vulnerabilities.\n\n@EthSecurity1","html":"- <a href=\"https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">RISC Zero Security Disclosure: Arbitrary code execution in guest</a>. <br><br>- <a href=\"https://arxiv.org/abs/2509.24444\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">TON Transaction Simulator for Revealing Smart Contract Vulnerabilities</a>.<br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426092","deleted":false,"deleted_at":null,"views":708,"forwards":12,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["github.com","arxiv.org"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/prLsxG4kq7FI","duration":null,"width":1200,"height":600,"preview":false}],"link_preview":{"url":"https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7","site":"GitHub","title":"Arbitrary code execution in guest via memory safety failure in `sys_read`","description":"# Arbitrary code execution in guest via memory safety failure in `sys_read` \n \nIn affected versions of `risc0-zkvm-platform`, when the zkVM guest calls `sys_read`, the host is able to use a crafted...","image":{"url":"https://media.web3aggregator.io/files/prLsxG4kq7FI","width":1200,"height":600}},"album":null,"topic":"news_projects"},{"id":19173,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1409,"url":"https://t.me/EthSecurity1/1409","date":"2026-10-31T20:44:15+00:00","edited_at":null,"text":"Seems chainalysis been hacked\n \n\nIt told customers in an email seen by ICD that an attacker using \"offensive agentic techniques\" accessed users' names, emails and role labels.\n\nIt says this has nothing to do with the $6.3B Binance heist.\n\n@EthSecurity1","html":"Seems chainalysis been hacked<br> <br><br>It told customers in an email seen by ICD that an attacker using \"offensive agentic techniques\" accessed users' names, emails and role labels.<br><br>It says this has nothing to do with the $6.3B Binance heist.<br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426088","deleted":false,"deleted_at":null,"views":407,"forwards":13,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":18664,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1406,"url":"https://t.me/EthSecurity1/1406","date":"2026-10-29T21:45:47+00:00","edited_at":null,"text":"Tether and Circle have frozen about $2.1B, including $313M USDT on Tron. Nothing has gone to Tornado Cash. About $718M in ETH and about $500M in USDT are still free to move, and 17,270 BTC sits untouched. \nhttps://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8\n@EthSecurity1","html":"Tether and Circle have frozen about $2.1B, including $313M USDT on Tron. Nothing has gone to Tornado Cash. About $718M in ETH and about $500M in USDT are still free to move, and 17,270 BTC sits untouched. <br><a href=\"https://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">https://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8</a><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425976","deleted":false,"deleted_at":null,"views":390,"forwards":8,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["arkm.com"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pNg5rG-noDVE","duration":null,"width":1200,"height":630,"preview":false}],"link_preview":{"url":"https://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8","site":"The Source of Truth On-Chain | Arkham","title":"binance-hacker-1029 | Arkham","description":"On-chain analysis of binance-hacker-1029's cryptocurrency holdings by Arkham. Discover holdings, wallets, inflows, outflows and counterparties.","image":{"url":"https://media.web3aggregator.io/files/pNg5rG-noDVE","width":1200,"height":630}},"album":null,"topic":"news_general"},{"id":18595,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1405,"url":"https://t.me/EthSecurity1/1405","date":"2026-10-29T21:09:02+00:00","edited_at":"2026-10-29T21:11:03+00:00","text":"Tether freeze ~ 1.9 billion\nTotal stolen assets beyond $3.5 B\n@EthSecurity1","html":"Tether freeze ~ 1.9 billion<br>Total stolen assets beyond $3.5 B<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425962","deleted":false,"deleted_at":null,"views":1199,"forwards":63,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_projects"},{"id":18416,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1402,"url":"https://t.me/EthSecurity1/1402","date":"2026-10-29T16:15:56+00:00","edited_at":null,"text":"zkLink Nova's Arbitrator hacked for~$780K \n\nRootcause: The Arbitrator contract had two related flaws that the attacker combined:\nUncleared transient storage of the authentication hash\nDuring a legitimate claim, an authenticated gateway callback stores finalizeMessageHash (in transient storage). The Arbitrator later checks this hash against the expected source gateway, value, and message.\nThe contract never cleared finalizeMessageHash after use. Transient storage persists for the entire transaction, so a second claim in the same transaction could reuse the first claim’s already-set (and still-valid) hash without triggering a fresh authenticated callback.\nCaller-controlled target and calldata in the claim path\nThe claim function accepted a user-supplied target address and calldata. This let the attacker point the second claim at the Ethereum Gateway and supply sendMessage() calldata that invoked a privileged syncBatchRoot update with an attacker-chosen root.\nResulting attack flow (same transaction):\nFirst claim: legitimate Linea message → sets finalizeMessageHash and forwards normally.\nSecond claim: reuses the stale hash for verification while forcing the trusted Arbitrator to call the Ethereum Gateway with malicious root-update calldata.\nThe zkLink contract accepted the attacker-controlled root because it came from the authorized Gateway.\nAttacker then submitted matching withdrawal proofs against the forged root and drained funds.\n@EthSecurity1","html":"zkLink Nova's Arbitrator hacked for~$780K <br><br><strong>Rootcause:</strong> The Arbitrator contract had two related flaws that the attacker combined:<br><strong>Uncleared transient storage of the authentication hash</strong><br>During a legitimate claim, an authenticated gateway callback stores <code>finalizeMessageHash</code> (in transient storage). The Arbitrator later checks this hash against the expected source gateway, value, and message.<br>The contract <strong>never cleared</strong> <code>finalizeMessageHash</code> after use. Transient storage persists for the entire transaction, so a second claim in the same transaction could reuse the first claim’s already-set (and still-valid) hash without triggering a fresh authenticated callback.<br><strong>Caller-controlled target and calldata in the claim path</strong><br>The claim function accepted a user-supplied target address and calldata. This let the attacker point the second claim at the Ethereum Gateway and supply <code>sendMessage()</code> calldata that invoked a privileged <code>syncBatchRoot</code> update with an attacker-chosen root.<br><strong>Resulting attack flow (same transaction):</strong><br>First claim: legitimate Linea message → sets <code>finalizeMessageHash</code> and forwards normally.<br>Second claim: reuses the stale hash for verification while forcing the trusted Arbitrator to call the Ethereum Gateway with malicious root-update calldata.<br>The zkLink contract accepted the attacker-controlled root because it came from the authorized Gateway.<br>Attacker then submitted matching withdrawal proofs against the forged root and drained funds.<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425927","deleted":false,"deleted_at":null,"views":528,"forwards":15,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_projects"},{"id":17862,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1401,"url":"https://t.me/EthSecurity1/1401","date":"2026-10-27T09:14:11+00:00","edited_at":"2026-10-27T09:14:22+00:00","text":"a Safe multisig  lost $7.45M due to a misconfiguration on Avalanache.\n\nRootCause: A Safe multisig misconfiguration on Avalanche involving unrevoked unlimited token approvals to a predictable, empty address.The 2-of-7 Safe had given unlimited spending approvals (for WAVAX, USDC, WETH.e, and BTC.b) to the address 0x3725bd4d175283108156c3f15f86e1c51266155d.\nOn other chains (Base, Arbitrum, Ethereum), that same address held the team’s legitimate pool contract. On Avalanche, however, the address was empty. It is the deterministic address produced by Safe’s public CreateCall contract on its 13th deployment, and CreateCall had never been used on Avalanche. The approvals (set in a batch transaction on 2026-03-07) were never revoked.\nBecause the target address was unoccupied, anyone could deploy their own contract there (via the Safe singleton factory + CreateCall) and then use the existing unlimited allowances to drain the Safe’s tokens. An attacker did exactly that; an MEV bot front-ran the drain in the same block.\n@EthSecurity1","html":"<strong>a Safe multisig  lost $7.45M due to a misconfiguration on Avalanache.<br><br>RootCause: </strong>A Safe multisig misconfiguration on Avalanche involving unrevoked unlimited token approvals to a predictable, empty address.The 2-of-7 Safe had given unlimited spending approvals (for WAVAX, USDC, WETH.e, and BTC.b) to the address <code>0x3725bd4d175283108156c3f15f86e1c51266155d</code>.<br>On other chains (Base, Arbitrum, Ethereum), that same address held the team’s legitimate pool contract. On Avalanche, however, the address was empty. It is the deterministic address produced by Safe’s public CreateCall contract on its 13th deployment, and CreateCall had never been used on Avalanche. The approvals (set in a batch transaction on 2026-03-07) were never revoked.<br>Because the target address was unoccupied, anyone could deploy their own contract there (via the Safe singleton factory + CreateCall) and then use the existing unlimited allowances to drain the Safe’s tokens. An attacker did exactly that; an MEV bot front-ran the drain in the same block.<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425797","deleted":false,"deleted_at":null,"views":439,"forwards":17,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0x3725bd4d175283108156c3f15f86e1c51266155d"],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":17627,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1400,"url":"https://t.me/EthSecurity1/1400","date":"2026-10-26T06:42:55+00:00","edited_at":null,"text":"- Device hardening & factory reset guides - link\n\n- Top 5 Crypto & Web3 Hacks That Started With Phishing - link\n\n- Cross-Function Reentrancy: When Functions Betray Each Other \n@EThSecurity1","html":"- Device hardening &amp; factory reset guides - <a href=\"https://github.com/Opsek/OSs-security\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- Top 5 Crypto &amp; Web3 Hacks That Started With Phishing - <a href=\"https://www.resonance.security/blog-posts/top-5-crypto-web3-hacks-that-started-with-phishing\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- <a href=\"https://0x00auditor.medium.com/cross-function-reentrancy-when-functions-betray-each-other-04528d318489\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Cross-Function Reentrancy: When Functions Betray Each Other</a> <br>@EThSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425735","deleted":false,"deleted_at":null,"views":667,"forwards":11,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["github.com","resonance.security","0x00auditor.medium.com","medium.com"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/p8g5rG2Ya5VE","duration":null,"width":1200,"height":600,"preview":false}],"link_preview":{"url":"https://github.com/Opsek/OSs-security","site":"GitHub","title":"GitHub - Opsek/OSs-security: Factory reset & harden your configuration: Linux, macOS, & Windows.","description":"Factory reset & harden your configuration: Linux, macOS, & Windows. - Opsek/OSs-security","image":{"url":"https://media.web3aggregator.io/files/p8g5rG2Ya5VE","width":1200,"height":600}},"album":null,"topic":"noncrypto"},{"id":17431,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1398,"url":"https://t.me/EthSecurity1/1398","date":"2026-10-24T16:26:29+00:00","edited_at":"2026-10-24T16:27:11+00:00","text":"X 100 hacked for $4.75M\n\nRootcause :  Anyone could instantly join the Senate by freezing X tokens (and paying a small candidacy fee, reported as ~100 X). Membership was based on the current frozen stake. There was no snapshot of balances/voting power and no timelock (or other delay) on proposals.\nA proposal could be created, voted on (with the newly acquired majority), and executed in the same transaction, including calls that invoked the treasury’s own swap functions (e.g., v3Swap).\nThis allowed the attacker to:\n1.  Flash-borrow USDT (via Aave), buy X tokens, and distribute/freeze them across controlled contracts to seize 2 of the 3 Senate seats.\n2.  Immediately propose + vote + execute a malicious proposal that forced the Freezer to swap a large amount of treasury X tokens into a freshly created, attacker-controlled (and empty/manipulated) PancakeSwap V3 X-USDT pool with min-output set near zero.\n3.  Withdraw the liquidity from that pool, sell the recovered X on legitimate markets, repay the flash loan, and keep the profit (~$4.75–4.85M USDT range reported across related alerts).\n@EthSecurity1","html":"<strong>X 100 hacked for $4.75M</strong><br><br><strong>Rootcause :</strong>  Anyone could instantly join the Senate by freezing X tokens (and paying a small candidacy fee, reported as ~100 X). Membership was based on the <em>current</em> frozen stake. There was <strong>no snapshot</strong> of balances/voting power and <strong>no timelock</strong> (or other delay) on proposals.<br>A proposal could be created, voted on (with the newly acquired majority), and executed in the <em>same transaction</em>, including calls that invoked the treasury’s own swap functions (e.g., <code>v3Swap</code>).<br>This allowed the attacker to:<br>1.  Flash-borrow USDT (via Aave), buy X tokens, and distribute/freeze them across controlled contracts to seize 2 of the 3 Senate seats.<br>2.  Immediately propose + vote + execute a malicious proposal that forced the Freezer to swap a large amount of treasury X tokens into a freshly created, attacker-controlled (and empty/manipulated) PancakeSwap V3 X-USDT pool with min-output set near zero.<br>3.  Withdraw the liquidity from that pool, sell the recovered X on legitimate markets, repay the flash loan, and keep the profit (~$4.75–4.85M USDT range reported across related alerts).<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425685","deleted":false,"deleted_at":null,"views":400,"forwards":13,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":16908,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1397,"url":"https://t.me/EthSecurity1/1397","date":"2026-10-22T08:26:58+00:00","edited_at":null,"text":"- The Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users - link \n\n- Blockchain Forensics: A Practical Guide to Tracing Stolen Funds\n\n- Blockchain Forensics: Attribution Techniques and the Role of OSINT\n\n- Blockchain Forensics: Advanced Blockchain Forensics Techniques and Additional Resources\n@EthSecurity1","html":"- The Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users - <a href=\"https://mirror.xyz/somaxbt.eth/PcTxjP1wUuutwmFizHYuzG33nJm1hx8i66iQ-T7y210\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link </a><br><br>- <a href=\"https://mirror.xyz/somaxbt.eth/E4XWyHedVlIS92TXrUq0NzI0BnXZFN9k61o3pOYUWFI\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Blockchain Forensics: A Practical Guide to Tracing Stolen Funds</a><br><br>- <a href=\"https://mirror.xyz/somaxbt.eth/SVzdnvF3j4gQtNRvAyqvXWvT9_5HGNZKxrefNrqgmBE\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Blockchain Forensics: Attribution Techniques and the Role of OSINT</a><br><br>- <a href=\"https://mirror.xyz/somaxbt.eth/k7jZ9v0ujM76RnMP5m_yCk0V_8nt02hmblTB1kCflIg\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Blockchain Forensics: Advanced Blockchain Forensics Techniques and Additional Resources</a><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425559","deleted":false,"deleted_at":null,"views":150,"forwards":9,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["PcTxjP1wUuutwmFizHYuzG33nJm1hx8i66iQ"],"domains":["mirror.xyz"],"media":[],"link_preview":null,"album":null,"topic":"research"},{"id":16674,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1393,"url":"https://t.me/EthSecurity1/1393","date":"2026-10-21T08:19:53+00:00","edited_at":null,"text":"- The adoption of Solana OFAs has increased over the past six months.\n\n to learn about how they work, some issues we hear about from the top Solana apps, and brief thoughts on if these arrangements making Solana better for apps and users. - link\n\n- The sandwich attack vector built to be missed. - link\n@EthSecurity1","html":"- The adoption of Solana OFAs has increased over the past six months.<br><br> to learn about how they work, some issues we hear about from the top Solana apps, and brief thoughts on if these arrangements making Solana better for apps and users. <a href=\"https://x.com/buffalu__/status/2112183907844247873\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">- link</a><br><br>- The sandwich attack vector built to be missed. <a href=\"https://x.com/eightbitsim/status/2111078691677909147\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">- link</a><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425503","deleted":false,"deleted_at":null,"views":843,"forwards":10,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["x.com"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pBA9rG1hZvVI","duration":null,"width":1840,"height":736,"preview":false}],"link_preview":{"url":"https://x.com/buffalu__/status/2112183907844247873","site":"X (formerly Twitter)","title":"buffalu (@buffalu__) on X","description":"Order Flow Auctions: The New Private Mempools","image":{"url":"https://media.web3aggregator.io/files/pBA9rG1hZvVI","width":1840,"height":736}},"album":null,"topic":"research"},{"id":16430,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1392,"url":"https://t.me/EthSecurity1/1392","date":"2026-10-20T08:45:56+00:00","edited_at":null,"text":"AlpsCon.ai  hacked $152K\n\nRootcause: \nAccess-control / operational failure (the entry point)\nThe Hardhat/Anvil default account #0 (0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266) — whose private key is publicly known — was added to the production KYC whitelist in a bulk import on 2025-08-24 and left there for ~14 months.\nAnyone could therefore use EIP-7702 to delegate arbitrary code to that address and execute transactions as a fully verified, whitelisted wallet.\nReward-accounting bug (the actual value extraction)\nNewer reward contracts (V7–V9) recursively imported balances from earlier versions. When a fresh stake appeared in an older hub that still accepted deposits, the newer contracts multiplied the newly visible balance by the already-accumulated profitPerShare while the account’s entryProfitPerShare stayed at zero.\nThis let a brand-new (flash-loan funded) stake claim the entire historical reward history (~$355K USDC), emptying the pool. The attacker then unstaked, sold the ALPS, repaid the flash loan, and kept the net ~$152K.\n\n@EthSecurity1","html":"<a href=\"https://AlpsCon.ai\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>AlpsCon.ai</strong></a><strong>  hacked $152K</strong><br><br><strong>Rootcause: </strong><br><strong>Access-control / operational failure (the entry point)</strong><br>The Hardhat/Anvil default account #0 (<code>0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266</code>) — whose private key is publicly known — was added to the production KYC whitelist in a bulk import on 2025-08-24 and left there for ~14 months.<br>Anyone could therefore use EIP-7702 to delegate arbitrary code to that address and execute transactions <em>as</em> a fully verified, whitelisted wallet.<br><strong>Reward-accounting bug (the actual value extraction)</strong><br>Newer reward contracts (V7–V9) recursively imported balances from earlier versions. When a fresh stake appeared in an older hub that still accepted deposits, the newer contracts multiplied the newly visible balance by the already-accumulated <code>profitPerShare</code> while the account’s <code>entryProfitPerShare</code> stayed at zero.<br>This let a brand-new (flash-loan funded) stake claim the entire historical reward history (~$355K USDC), emptying the pool. The attacker then unstaked, sold the ALPS, repaid the flash loan, and kept the net ~$152K.<br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425433","deleted":false,"deleted_at":null,"views":353,"forwards":15,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266"],"domains":["alpscon.ai"],"media":[],"link_preview":null,"album":null,"topic":"news_projects"},{"id":16299,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1391,"url":"https://t.me/EthSecurity1/1391","date":"2026-10-19T08:17:58+00:00","edited_at":null,"text":"Trillion Dollar security - link\n\nValidator sniping: How to harvest IP addresses to redirect MEV  - link\n\nThe Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users \n@EthSecurity1","html":"Trillion Dollar security - <a href=\"https://www.youtube.com/live/jZGpUa__b_8\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>Validator sniping: How to harvest IP addresses to redirect MEV  - <a href=\"https://www.youtube.com/watch?v=NYk5IqxnMxE\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br><a href=\"https://mirror.xyz/somaxbt.eth/PcTxjP1wUuutwmFizHYuzG33nJm1hx8i66iQ-T7y210\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">The Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users</a> <br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425392","deleted":false,"deleted_at":null,"views":273,"forwards":11,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["PcTxjP1wUuutwmFizHYuzG33nJm1hx8i66iQ"],"domains":["youtube.com","mirror.xyz"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pwboxG8yWpVI","duration":null,"width":1280,"height":720,"preview":false}],"link_preview":{"url":"https://youtube.com/live/jZGpUa__b_8","site":"YouTube","title":"DSS Webinar | Trillion Dollar Security","description":"Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.","image":{"url":"https://media.web3aggregator.io/files/pwboxG8yWpVI","width":1280,"height":720}},"album":null,"topic":"media"},{"id":16216,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1390,"url":"https://t.me/EthSecurity1/1390","date":"2026-10-18T14:29:55+00:00","edited_at":null,"text":"osec_io used AI agents (led by Claude Opus) and custom tooling to decompile GoonFi V2, a closed-source Solana propAMM written in Rust, achieving byte-identical recompilation of all 219 functions from on-chain bytecode. - link\n\n@EthSecurity1","html":"osec_io used AI agents (led by Claude Opus) and custom tooling to decompile GoonFi V2, a closed-source Solana propAMM written in Rust, achieving byte-identical recompilation of all 219 functions from on-chain bytecode. - <a href=\"https://osec.io/blog/goonfi-decompilation/\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425370","deleted":false,"deleted_at":null,"views":220,"forwards":13,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["osec.io"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pYg9rG9ByhFI","duration":null,"width":1920,"height":1008,"preview":false}],"link_preview":{"url":"https://osec.io/blog/goonfi-decompilation","site":"OtterSec","title":"Breaking open a propAMM","description":"At Accelerate 2025, we talked about making Solana programs open source. A year later, agents have taken over the world, so we wanted to see how far we could push things by applying our techniques to the historically secretive world of propAMMs.","image":{"url":"https://media.web3aggregator.io/files/pYg9rG9ByhFI","width":1920,"height":1008}},"album":null,"topic":"research"},{"id":16170,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1389,"url":"https://t.me/EthSecurity1/1389","date":"2026-10-18T07:36:03+00:00","edited_at":null,"text":"Former Mt. Gox CEO: Ledger Received Hardware Wallet Tampering Reports Since December 2025 but Issued No Public Warning\n@EthSecurity1","html":"Former Mt. Gox CEO: Ledger Received Hardware Wallet Tampering Reports Since December 2025 but Issued No Public Warning<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425360","deleted":false,"deleted_at":null,"views":255,"forwards":12,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_projects"},{"id":16035,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1387,"url":"https://t.me/EthSecurity1/1387","date":"2026-10-17T10:16:16+00:00","edited_at":null,"text":"Here's how exactly Telegram provides user data to U.S. authorities. A letter recently filed in court shows how Telegram transfers that data, such as IP address and phone number.\n\nMore: 404media.co/heres-what-tel…\n@EthSecurity1","html":"Here's how exactly Telegram provides user data to U.S. authorities. A letter recently filed in court shows how Telegram transfers that data, such as IP address and phone number.<br><br>More: <a href=\"https://404media.co/heres-what-tel\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">404media.co/heres-what-tel</a>…<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425328","deleted":false,"deleted_at":null,"views":401,"forwards":21,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["404media.co"],"media":[],"link_preview":null,"album":null,"topic":"noncrypto"},{"id":16012,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1386,"url":"https://t.me/EthSecurity1/1386","date":"2026-10-17T07:59:58+00:00","edited_at":null,"text":"- Red Flags and Green Flags of Yield Bearing Stablecoins - link\n\n- EVM – Cosmos Convergence Research From Security Base Part 1, Part 2, and Part 3 \n\n- Exploring Vulnerabilities and Audit Tips for TON Smart Contracts\n\n@EthSecurity1","html":"- Red Flags and Green Flags of Yield Bearing Stablecoins - <a href=\"https://composable-security.com/blog/red-flags-and-green-flags-of-yield-bearing-stablecoins\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- EVM – Cosmos Convergence Research From Security Base <a href=\"https://www.certik.com/resources/blog/evm-cosmos-convergence-research-from-security-base-part-1\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Part 1</strong></a>, <a href=\"https://www.certik.com/resources/blog/evm-cosmos-convergence-research-from-security-base-part-2\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Part 2</strong></a>, and <a href=\"https://www.certik.com/resources/blog/evm-cosmos-convergence-research-from-security-base-part-3\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Part 3</strong></a> <br><br>- <a href=\"https://arxiv.org/abs/2509.10823\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Exploring Vulnerabilities and Audit Tips for TON Smart Contracts</strong></a><br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425323","deleted":false,"deleted_at":null,"views":201,"forwards":13,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["composable-security.com","certik.com","arxiv.org"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pdrkxG4ILbFI","duration":null,"width":1280,"height":900,"preview":false}],"link_preview":{"url":"https://composable-security.com/blog/red-flags-and-green-flags-of-yield-bearing-stablecoins","site":"Smart Contract Audits - Composable Security","title":"Red Flags and Green Flags of Yield Bearing Stablecoins - Smart Contract Audits - Composable Security","description":"Yield bearing stablecoins are tokens designed to stay pegged to a FIAT currency while passing some form of yield to holders. That yield can come from on-chain","image":{"url":"https://media.web3aggregator.io/files/pdrkxG4ILbFI","width":1280,"height":900}},"album":null,"topic":"research"},{"id":15551,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1385,"url":"https://t.me/EthSecurity1/1385","date":"2026-10-15T06:56:58+00:00","edited_at":null,"text":"- Kocher's Timing Attack, A Journey from Theory to Practice - link\n\n- Blockchain Security — Offense, Defense, and Practices\n\n- Finding Ways To Break Smart Contracts (Auditing: Part 2) - link\n\n@EthSecurity1","html":"- Kocher's Timing Attack, A Journey from Theory to Practice - <a href=\"https://blog.zksecurity.xyz/posts/timing-kocher/\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- <a href=\"https://slowmist.medium.com/slowmist-founder-cos-shares-at-hku-blockchain-security-offense-defense-and-practices-ac5970c8fbd8\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Blockchain Security — Offense, Defense, and Practices</strong></a><br><br>- Finding Ways To Break Smart Contracts (Auditing: Part 2) - <a href=\"https://x.com/philbugcatcher/status/1968901624169984006\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425207","deleted":false,"deleted_at":null,"views":242,"forwards":13,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["blog.zksecurity.xyz","zksecurity.xyz","slowmist.medium.com","medium.com","x.com"],"media":[],"link_preview":{"url":"https://blog.zksecurity.xyz/posts/timing-kocher","site":"ZK/SEC Quarterly","title":"Kocher's Timing Attack: A Journey from Theory to Practice","description":"Paul Kocher's 1996 timing attack showed how microsecond differences in execution time could leak private keys from RSA implementations. This tutorial recreates the attack journey from clean operation counting through noisy wall-clock measurements to sophisticated engineering solutions. Learn the variance distinguisher, explore schoolbook modular arithmetic, and discover the measurement techniques that make practical timing attacks possible despite system noise.","image":null},"album":null,"topic":"research"},{"id":15475,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1384,"url":"https://t.me/EthSecurity1/1384","date":"2026-10-14T17:54:57+00:00","edited_at":null,"text":"@UNCX_token hacked for ≈$87.7K. \n\nRoot cause:\nVestingManager.release() subtracts claimed shares from global _totalTokenShares but leaves them in the position's _depositedShares. \nAfter release → topUpVesting(), cancel() calculates sharesToRemove from the full lifetime _depositedShares without subtracting schedule released, \n\nso already-released shares are removed from the global total a second time. \n\nThe attacker used a direct donation to magnify this stale-share debit, \n\ncorrupted the denominator, then released a second attacker-owned vesting to take tokens backing unrelated users.\n\nAttack tx: etherscan.io/tx/0x352065378…\n@EthSecurity1","html":"@UNCX_token hacked for ≈$87.7K. <br><br><strong>Root cause:</strong><br>VestingManager.release() subtracts claimed shares from global _totalTokenShares but leaves them in the position's _depositedShares. <br>After release → topUpVesting(), cancel() calculates sharesToRemove from the full lifetime _depositedShares without subtracting schedule released, <br><br>so already-released shares are removed from the global total a second time. <br><br>The attacker used a direct donation to magnify this stale-share debit, <br><br>corrupted the denominator, then released a second attacker-owned vesting to take tokens backing unrelated users.<br><br>Attack tx: <a href=\"https://etherscan.io/tx/0x352065378\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">etherscan.io/tx/0x352065378</a>…<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425187","deleted":false,"deleted_at":null,"views":780,"forwards":11,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["etherscan.io"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/p_A5rGwfBhVI","duration":null,"width":288,"height":288,"preview":false}],"link_preview":{"url":"https://etherscan.io/tx/0x352065378","site":"Ethereum (ETH) Blockchain Explorer","title":"Ethereum Transaction Hash (Txhash) Details | Etherscan","description":"Ethereum (ETH) detailed transaction info for txhash 0x352065378. The transaction status, block confirmation, gas fee, Ether (ETH), and token transfer are shown.","image":{"url":"https://media.web3aggregator.io/files/p_A5rGwfBhVI","width":288,"height":288}},"album":null,"topic":"news_projects"},{"id":14647,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1383,"url":"https://t.me/EthSecurity1/1383","date":"2026-10-14T04:45:11+00:00","edited_at":"2026-10-14T04:45:14+00:00","text":"2026 Hardware Wallet Incidents\n\n@EthSecurity1","html":"<strong>2026 Hardware Wallet Incidents</strong><br><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425134","deleted":false,"deleted_at":null,"views":843,"forwards":19,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pfA9rGx1qYFI","duration":null,"width":1200,"height":1200,"preview":false}],"link_preview":null,"album":null,"topic":"stats"},{"id":14530,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1382,"url":"https://t.me/EthSecurity1/1382","date":"2026-10-13T08:29:01+00:00","edited_at":null,"text":"- How to Manage Crypto Keys Without Losing Sleep - link\n\n- Building Our Own Post-Quantum FIDO Token\n\n- Use mutation testing to find the bugs your tests don't catch \n@EthSecurity1","html":"- How to Manage Crypto Keys Without Losing Sleep - <a href=\"https://oaksecurity.substack.com/p/how-to-manage-crypto-keys-without\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br><br>- <a href=\"https://neodyme.io/en/blog/pqc-fido/\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Building Our Own Post-Quantum FIDO Token</a><br><br>- <a href=\"https://blog.trailofbits.com/2025/09/18/use-mutation-testing-to-find-the-bugs-your-tests-dont-catch\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Use mutation testing to find the bugs your tests don't catch</a> <br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425070","deleted":false,"deleted_at":null,"views":null,"forwards":null,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["oaksecurity.substack.com","substack.com","neodyme.io","blog.trailofbits.com","trailofbits.com"],"media":[],"link_preview":null,"album":null,"topic":"research"},{"id":14338,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1380,"url":"https://t.me/EthSecurity1/1380","date":"2026-10-12T08:26:01+00:00","edited_at":null,"text":"- Vulnerabilities in Liquity forks Part 1 and Part 2 by VulSight.\n\n- Yo Protocol's Unseen Dangers: Why Code Audits Aren't Enough - link\n@EthSecurity1","html":"- Vulnerabilities in Liquity forks <a href=\"https://x.com/VulsightSec/status/1968039102848110619\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Part 1</strong></a> and <a href=\"https://x.com/VulsightSec/status/1968972939052597494\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>Part 2</strong></a> by VulSight.<br><br>- Yo Protocol's Unseen Dangers: Why Code Audits Aren't Enough - <a href=\"https://paragraph.com/@parlan/yo-protocols-unseen-dangers-why-code-audits-arent-enough\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">link</a><br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/424984","deleted":false,"deleted_at":null,"views":null,"forwards":null,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["x.com","paragraph.com"],"media":[],"link_preview":null,"album":null,"topic":"research"},{"id":14221,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1379,"url":"https://t.me/EthSecurity1/1379","date":"2026-10-11T08:19:05+00:00","edited_at":null,"text":"Papertrade hacked for $ 1.28M\n\n- A quant trader with $13M+ all-time PnL manipulated Papertrade’s oracle by executing massive ETH buys/sells on Hyperliquid to briefly move its price, profiting $1.73M gross on timed long/short flips before a final $450k liquidation left $1.28M net.\n\n- The attack involved 305 trades (296 wins) over 8 hours, with average 98-second holds: open $200M+ Papertrade positions, manipulate Hyperliquid price within seconds, close for profit, and reverse direction repeatedly.\n- Papertrade prices directly off Hyperliquid’s ETH spot at the exact second, making it vulnerable to short-term manipulation; the post suggests the team blocked some closes and recommends upgrading to Hyperliquid’s less manipulable official multi-feed oracle.\n@EthSecurity1","html":"<strong>Papertrade hacked for $ 1.28M</strong><br><br>- A quant trader with $13M+ all-time PnL manipulated Papertrade’s oracle by executing massive ETH buys/sells on Hyperliquid to briefly move its price, profiting $1.73M gross on timed long/short flips before a final $450k liquidation left $1.28M net.<br><br>- The attack involved 305 trades (296 wins) over 8 hours, with average 98-second holds: open $200M+ Papertrade positions, manipulate Hyperliquid price within seconds, close for profit, and reverse direction repeatedly.<br>- Papertrade prices directly off Hyperliquid’s ETH spot at the exact second, making it vulnerable to short-term manipulation; the post suggests the team blocked some closes and recommends upgrading to Hyperliquid’s less manipulable official multi-feed oracle.<br>@EthSecurity1","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/424923","deleted":false,"deleted_at":null,"views":null,"forwards":null,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":14220,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1378,"url":"https://t.me/EthSecurity1/1378","date":"2026-10-11T08:16:53+00:00","edited_at":null,"text":"Papertrade hacked for $ 1.28M\nA quant trader with $13M+ all-time PnL manipulated Papertrade’s oracle by executing massive ETH buys/sells on Hyperliquid to briefly move its price, profiting $1.73M gross on timed long/short flips before a final $450k liquidation left $1.28M net.\nThe attack involved 305 trades (296 wins) over 8 hours, with average 98-second holds: open $200M+ Papertrade positions, manipulate Hyperliquid price within seconds, close for profit, and reverse direction repeatedly.\nPapertrade prices directly off Hyperliquid’s ETH spot at the exact second, making it vulnerable to short-term manipulation; the post suggests the team blocked some closes and recommends upgrading to Hyperliquid’s less manipulable official multi-feed oracle.\n@EthSecurity1","html":"Papertrade hacked for $ 1.28M<br>A quant trader with $13M+ all-time PnL manipulated Papertrade’s oracle by executing massive ETH buys/sells on Hyperliquid to briefly move its price, profiting $1.73M gross on timed long/short flips before a final $450k liquidation left $1.28M net.<br>The attack involved 305 trades (296 wins) over 8 hours, with average 98-second holds: open $200M+ Papertrade positions, manipulate Hyperliquid price within seconds, close for profit, and reverse direction repeatedly.<br>Papertrade prices directly off Hyperliquid’s ETH spot at the exact second, making it vulnerable to short-term manipulation; the post suggests the team blocked some closes and recommends upgrading to Hyperliquid’s less manipulable official multi-feed oracle.<br>@EthSecurity1","language":"en","class":"forward","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/424922","deleted":false,"deleted_at":null,"views":null,"forwards":null,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":14218,"channel":{"id":60,"username":"EthSecurity1","title":"EthSecurity","kind":"channel","private":false},"message_id":1377,"url":"https://t.me/EthSecurity1/1377","date":"2026-10-11T07:34:26+00:00","edited_at":null,"text":"https://x.com/cayden_liao/status/2109074675695579399\n@EthSecurity1","html":"<a href=\"https://x.com/cayden_liao/status/2109074675695579399\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">https://x.com/cayden_liao/status/2109074675695579399</a><br>@EthSecurity1","language":null,"class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/424926","deleted":false,"deleted_at":null,"views":null,"forwards":null,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["x.com"],"media":[],"link_preview":null,"album":null,"topic":"research"}],"next_cursor":null}