慢雾 SlowMist

Background
On October 29, 2026, the well-known cross-chain protocol zkLink was attacked, resulting in losses of approximately $783,000. Below is a detailed analysis of the incident by the SlowMist security team:
Prerequisite Knowledge
zkLink is a multi-chain zk rollup protocol. On Ethereum, the ZkLink contract (0x5fd9f73286b7e8683bab45019c94553b93e015cf) serves as the L1 messaging service and holds the ETH treasury; its companion L1ERC20Bridge (0xad16edcf7deb7e90096a259c81269d811544b6b6) holds the ERC-20 treasury.
The basis for withdrawal authorization is the “batch root.” Every withdrawal on L2 generates an L2→L1 log, and the logs in the same batch form a Merkle tree. After a batch is executed on L2, its log root, l2LogsRootHashes[batchNumber], is synchronized to the ZkLink contract on L1. When withdrawing on L1, a user submits a withdrawal message and a Merkle proof. ZkLink uses the root stored on-chain to verify the proof and releases the funds only if verification succeeds. In other words, the message can only be genuine if the root is genuine; if the root is forged, any message can be “proven” to have occurred. ZkLink also uses totalBatchesExecuted to record the number of the latest executed batch, and during verification it requires _batchNumber @= totalBatchesExecuted.

On November 2, SlowMist and JunHe LLP will host the “Breaking Through Structural Challenges, Building a Foundation for Risk Control | 2026 Hong Kong RWA and Stablecoin Payments Institutional Closed-Door Summit” in Hong Kong.
The summit will bring together guests from finance, digital assets, legal services, blockchain security, and other fields to exchange insights based on practical business experience. Topics will include RWA issuance and implementation, stablecoin payments and the expansion of securities businesses, as well as institutional security and risk control.
Event time: November 2, 14:00–18:30
Venue: AIA Central, Hong Kong
Registration link: https://luma.com/0p20jvw

In response to the practical needs of batch risk screening and on-chain fund investigation, MistTrack has recently launched two feature updates: KYA Batch Screening and Trace Canvas. The former helps risk control and compliance teams centrally process large numbers of wallet addresses, quickly identify risk objects that require priority attention; the latter, through a visual transaction graph, AI-powered tracing, and path finding, helps investigators sort out fund flows and pinpoint key addresses and potential risk associations.
Welcome to register and try MistTrack through the following link: https://dashboard.misttrack.io/
KYA Batch Screening: Make address risk screening more efficient

Background
Recently, during routine threat intelligence research, SlowMist security personnel detected an attack involving the poisoning of scripts associated with the Udesk customer service system. The team then obtained two JavaScript samples, udeskApi.2026-10-16.cached.js and deeps.js, and analyzed them to investigate how the malicious code entered webpages via customer service scripts and what it did with user data and business operations.
Analysis of the samples gradually revealed two types of risk: the malicious scripts collected session data and sensitive information submitted by users from webpages, while also modifying deposit addresses and copied content according to site-specific rules. The former could allow attackers to hijack login sessions or take over accounts; the latter could cause users to transfer their deposits to substituted recipient addresses. Starting from the customer service script’s loading entry point, we traced the data access, network transmission, and page modification logic to reconstruct how these two types of behavior were implemented and what triggered them.

Real-world asset (RWA) tokenization and stablecoin payments are gradually making their way into a broader range of financial and commercial settings. From RWA issuance, trading, and distribution to stablecoin payments and cross-border settlements, these activities involve multiple stages and participants. As institutions expand their businesses, they must also address challenges related to compliance management, fund risk, and security.
On November 2, SlowMist will join JunHe Law Offices to host the “Breaking Through with Architecture, Building a Foundation with Risk Control | 2026 Hong Kong Closed-Door Summit for RWA and Stablecoin Payment Institutions.” Representatives from relevant institutions are invited to discuss business practices, compliance requirements, and risk management for RWA and stablecoin payments.

Background
The SlowMist security team recently received user reports that the GitHub repository sol-live, presented as a Solidity interview practice project, lists 8 questions in its README and claims each should take 5 to 10 minutes, lowering users’ guard.
Our analysis found that the project embeds a download-and-execute command unrelated to the contract exercises in the VS Code workspace settings file .vscode/settings.json, preceded by hundreds of spaces to make it less visible. The configuration also hides the .vscode directory through file exclusion rules. When developers launch a terminal using the project-defined malicious terminal configuration, it may trigger the download and execution of a remote script.

What happened?
On October 21, the PHP project released an emergency security update to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution (RCE). Both were rated 9.2 on the CVSS v4.0 scale. The PHP project explicitly stated that, before the fixes, all PHP installations providing public-facing web services could be affected.
https://www.php.net/index.php#2026-10-20-1
On October 20, details of the vulnerabilities leaked before the official disclosure, and no patch had yet been released. The PHP security team had no choice but to move up the emergency release from its originally scheduled date of October 22 to October 21 at 14:00 (UTC).

Background
On October 18, an official Qubic announcement disclosed that an attacker had exploited insufficient randomness in some wallet Seeds to access and transfer approximately 2.94 trillion QU from 1,404 Qubic wallets. In its analysis of Qubic Wallet, the SlowMist security team found that the wallet’s built-in account seed generator uses the non-cryptographically secure Math.random(), and that some outputs from the same random stream are sent in plaintext to network peers via a protocol header (the dejaVu field). These two distant code paths are linked by the same pseudorandom stream, creating a complete chain through which account private keys can be recovered from a small number of network observations.

Background
On March 18, 2026, the Google Threat Intelligence Group published a report (The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors) on the spread of the DarkSword exploit chain among multiple threat groups.
The chain targets iPhones running iOS 18.4 to 18.6.2 and is triggered by opening a specially crafted page in Safari. It ultimately steals files, Keychain data, and keyboard input, focusing mainly on three cryptocurrency wallet apps. The chain consists of six CVEs, three of which were still zero-days in the wild when observed.

I. Background
Recently, the SlowMist security team received a request for help from a Fomo user. The user reported that while viewing the details of the MOONLET token on Fomo’s website, they clicked the project’s official website link displayed on the page and visited voltage.family. They then followed the instructions to complete a “human verification” check, after which they discovered that assets worth approximately $48,000 had been transferred out of their account. During the entire process, they did not connect a wallet, authorize any on-chain transactions, or enter their seed phrase or private key. The user logged in to Fomo with Google and said that two-factor authentication was not enabled on their account.
After receiving the report, the SlowMist security team analyzed the relevant page and scripts and found that the so-called “human verification” prompted users to add and click a malicious bookmark. The bookmark contained embedded JavaScript code designed to read browser storage on the Fomo page, extract login tokens, and send the data to an external address.

In September 2026, the Financial Action Task Force (FATF) released a special report, "Risks of Gaming and Gambling," which systematically analyzed the risks of money laundering, terrorist financing, and proliferation financing faced by casinos, sports betting, other betting, and online gaming.
The value of this report lies not in categorizing all gaming and gambling activities as high-risk, but in revealing a more significant shift that virtual asset servicing institutions should pay attention to: as online platforms, cross-border transactions, and the integration of multiple products and payment methods occur, gaming and gambling platforms are becoming part of a broader value transfer ecosystem. For exchanges, VASPs, and virtual asset servicing institutions providing services such as crypto payments, funds from this ecosystem should not be understood merely as a "gambling transaction," but should be examined within the context of a complete financial relationship.

On September 18, the Japanese National Police Agency, together with the National Cyber Bureau, as well as the U.S. FBI, the U.S. Department of Defense Cyber Crime Center, the Australian Signals Directorate / Cyber Security Centre, Germany’s Federal Intelligence Service and the Federal Office for the Protection of the Constitution, issued a joint report in a six-party effort. The protagonists are a hacker group with a North Korean background—WaterPlum (also known as "Contagious Interview," literally "Disguised Interview").
This Contagious Interview attack activity has been tracked for years by multiple international security vendors, and it is often believed to be associated with North Korea’s Lazarus Group. This time, for the first time, Japanese police disclosed specific domestic cases and seized evidence under an official name, in cooperation with agencies from multiple countries.

Background
The sample comes from a development branch of a Laravel Nova extension package, `visanduma/nova-two-factor`, which is associated with the PolinRider campaign. This is a PHP package published on Packagist; as of the time of this analysis, it has been downloaded more than 700,000 times.
The delivery chain does not write the C2 address into the sample. The implanted code first queries Ethereum, extracts the IP addresses of two servers from the recipient addresses of a transaction, and then retrieves the next-stage payload via HTTP. To change servers, the attacker only needs to post a new transaction on-chain; there is no need to re-poison this package.
The end point of this chain is a cross-platform credential stealer that collects browser accounts and cookies, encrypted wallet data, password manager databases, and development credentials.

Recently, the SlowMist security team received multiple reports that users’ assets were stolen. After verification, all the related incidents involved the leakage of private keys. Some affected users had downloaded and used the FomoPeek 1.1–1.2 App versions.
Together with the OKX Security team, we jointly analyzed and confirmed that FomoPeek 1.1 and 1.2 implanted two malicious modules, apptrace and libapptracecore, which have the capabilities of remote configuration, kernel vulnerability exploitation, sandbox escape, Keychain decryption, and cross-app data collection.
Dynamic verification shows that the app retrieves encrypted C2 addresses from Bitbucket, reports device information to api-a95f0ed200f.assisaint[.]com, and receives remote configurations. During testing, the C2 returned exploit_enabled as false. To verify the subsequent execution chain, in an isolated environment we used Hook to modify relevant switches after the client decrypted them to true. We then obtained a collection manifest targeting 19 wallets and note applications, and captured the full request for packaging and uploading the Apple Notes container.

Author: Johan & Lisa
Edited by: 77
On September 6 at 13:52:10 UTC, two structurally identical transactions appeared in Liquid block #4,050,335. One minute later, block #4,050,336 confirmed a third transaction: approximately 3,998.5 L-BTC entered the UTXO set, with no peg-in behind it. A few minutes later, these nonexistent assets began to be consolidated and spent, and were then converted into real BTC on the Bitcoin mainnet via the federal peg-out channel.
The next day, 3,400 BTC was returned to the federal peg wallet. The remaining 598.5 BTC stayed in the attacker’s hands, and as of the time of publication it was still being repeatedly self-transferred. Each transaction includes a segment of OP_RETURN plaintext, demanding from the federal authorities a tenth of a "bounty." Negotiations are still publicly taking place on-chain.

On September 9, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the U.S. Department of Justice (DOJ) announced a coordinated law-enforcement action targeting the Xinbi Guarantee. OFAC will list the Xinbi Guarantee and two companies that support its operations on its sanctions list, while the DOJ’s Scam Center Strike Force seized relevant platform infrastructure and cryptocurrency wallet assets. According to the DOJ announcement, the coordinated action restricted more than $52 million in cryptocurrency assets associated with the Xinbi Guarantee and its merchant network.
This operation is not aimed at a single scammer group, but at the service network that supports the scam activities. U.S. law enforcement agencies say that the Xinbi guarantee connects scam groups with merchants that provide services such as money laundering and scam website development, and that it keeps these illicit transactions running by means including fund escrow and transaction guarantees.

Author: Jiujiu
Edited: 77
Background
On September 4, 2026, the well-known decentralized lending platform Notional Finance was attacked, resulting in a loss of approximately $1.73 million. The following is a detailed analysis of this attack by the SlowMist security team:
Prerequisites
In Notional Finance V1, fCash can be understood as cash debt with a maturity date. A cash receiver collects payment at maturity, while a cash payer makes payment at maturity. The protocol records both positions in the Portfolio, and then determines whether an account is healthy enough to open a position through a free collateral check.

Background
A promotional page offering a free VPS, but in reality it is a lure. As shown by the archived public webpage, the event[.]polarnode[.]vip domain registered at the end of August 2026 designates https[:]//lk[.]wyincc[.]com/lk.js as a preloading script. Once the page becomes interactive, it automatically loads, without requiring visitors to click.
After decoding the saved loader sample, we confirmed that it is designed for delivery to iPhones running pure Safari on iOS 18.4–18.6.2. Ultimately, it targets file access, Keychain, and keyboard input collection, with the goal of three wallet applications. This chain closely matches the DarkSword iOS exploit chain published by Google Threat Intelligence Group (GTIG), covering six CVEs and falling under n-day reuse.

Recently, OKX CEO responded to a user post stating that a gambling platform directly transfers funds to an exchange, causing deposits to trigger verification. According to his publicly stated comments, depositing to OKX from high-risk addresses may trigger more stringent anti-money laundering (AML) and risk reviews. Depending on the specific situation, the review may last 15 days or even longer; during this period, some account functions and funds may be restricted. For accounts confirmed to be involved in high-risk or illegal activities, the platform may also terminate service.
https://x.com/star_okx/status/2094980124236251207
OKX also reminds that funds obtained through channels such as escrow trading via Telegram groups, Huiwang and its variants may involve a higher risk of the source of funds.

As crypto assets, stablecoin payments, and digital financial services continue to grow, on-chain AML, KYT, and fund risk analysis are becoming practical needs for an increasing number of institutions.
For this purpose, MistTrack & SlowMist KYT officially launches a Partner Program, recruiting individual and institutional partners worldwide with resources in Web3, finance, payments, compliance, security, and local markets.
After joining the program, you can receive:
An exclusive customer discount code to help your customers subscribe at a more favorable price;
Automatic order attribution and commission-rebate records, with a maximum commission rebate validity period of 3 years;