5 304
订阅者
-224 小时
-37 天
+1130 天
正在加载数据
吸引订阅者
十月 '2610月 '26
十月 '26
+84
在6个频道中
九月 '26
+91
在3个频道中
Get PRO
八月 '26
+67
在6个频道中
Get PRO
七月 '26
+160
在3个频道中
Get PRO
六月 '26
+142
在5个频道中
Get PRO
五月 '26
+73
在2个频道中
Get PRO
四月 '26
+93
在1个频道中
Get PRO
三月 '26
+77
在2个频道中
Get PRO
二月 '26
+88
在3个频道中
Get PRO
一月 '26
+93
在2个频道中
Get PRO
十二月 '25
+326
在4个频道中
Get PRO
十一月 '25
+130
在2个频道中
Get PRO
十月 '25
+106
在2个频道中
Get PRO
九月 '25
+147
在5个频道中
Get PRO
八月 '25
+67
在5个频道中
Get PRO
七月 '25
+91
在4个频道中
Get PRO
六月 '25
+103
在3个频道中
Get PRO
五月 '25
+52
在6个频道中
Get PRO
四月 '25
+99
在5个频道中
Get PRO
三月 '25
+107
在6个频道中
Get PRO
二月 '25
+188
在9个频道中
Get PRO
一月 '25
+73
在3个频道中
Get PRO
十二月 '24
+163
在2个频道中
Get PRO
十一月 '24
+196
在2个频道中
Get PRO
十月 '24
+264
在8个频道中
Get PRO
九月 '24
+225
在0个频道中
Get PRO
八月 '24
+153
在0个频道中
Get PRO
七月 '24
+101
在0个频道中
Get PRO
六月 '24
+63
在0个频道中
Get PRO
五月 '24
+109
在4个频道中
Get PRO
四月 '24
+170
在1个频道中
Get PRO
三月 '24
+215
在1个频道中
Get PRO
二月 '24
+142
在0个频道中
Get PRO
一月 '24
+200
在0个频道中
Get PRO
十二月 '23
+165
在0个频道中
Get PRO
十一月 '23
+523
在1个频道中
Get PRO
十月 '23
+205
在0个频道中
Get PRO
九月 '23
+307
在0个频道中
Get PRO
八月 '23
+245
在0个频道中
Get PRO
七月 '23
+893
在0个频道中
Get PRO
六月 '23
+1 603
在0个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 29 十月 | +3 | |||
| 28 十月 | +1 | |||
| 27 十月 | +2 | |||
| 26 十月 | 0 | |||
| 25 十月 | +3 | |||
| 24 十月 | +5 | |||
| 23 十月 | +4 | |||
| 22 十月 | +1 | |||
| 21 十月 | +1 | |||
| 20 十月 | 0 | |||
| 19 十月 | 0 | |||
| 18 十月 | +2 | |||
| 17 十月 | +5 | |||
| 16 十月 | +1 | |||
| 15 十月 | +1 | |||
| 14 十月 | +1 | |||
| 13 十月 | +2 | |||
| 12 十月 | +1 | |||
| 11 十月 | +16 | |||
| 10 十月 | +2 | |||
| 09 十月 | +2 | |||
| 08 十月 | +1 | |||
| 07 十月 | +6 | |||
| 06 十月 | +13 | |||
| 05 十月 | 0 | |||
| 04 十月 | +2 | |||
| 03 十月 | +1 | |||
| 02 十月 | +1 | |||
| 01 十月 | +7 |
频道帖子
a Safe multisig which lost $7.45M due to a misconfiguration on Avalanache.
RootCause: A Safe multisig misconfiguration on Avalanche involving unrevoked unlimited token approvals to a predictable, empty address.The 2-of-7 Safe had given unlimited spending approvals (for WAVAX, USDC, WETH.e, and BTC.b) to the address
0x3725bd4d175283108156c3f15f86e1c51266155d.
On other chains (Base, Arbitrum, Ethereum), that same address held the team’s legitimate pool contract. On Avalanche, however, the address was empty. It is the deterministic address produced by Safe’s public CreateCall contract on its 13th deployment, and CreateCall had never been used on Avalanche. The approvals (set in a batch transaction on 2026-03-07) were never revoked.
Because the target address was unoccupied, anyone could deploy their own contract there (via the Safe singleton factory + CreateCall) and then use the existing unlimited allowances to drain the Safe’s tokens. An attacker did exactly that; an MEV bot front-ran the drain in the same block.
@EthSecurity1| 2 | - Device hardening & factory reset guides - link
- Top 5 Crypto & Web3 Hacks That Started With Phishing - link
- Cross-Function Reentrancy: When Functions Betray Each Other
@EThSecurity1 | 1 132 |
| 3 | - Moving from EVM to Move Part 1
- Top 25 MCP Vulnerabilities - link
@EthSecurity1 | 515 |
| 4 | X 100 hacked for $4.75M
Rootcause : Anyone could instantly join the Senate by freezing X tokens (and paying a small candidacy fee, reported as ~100 X). Membership was based on the current frozen stake. There was no snapshot of balances/voting power and no timelock (or other delay) on proposals.
A proposal could be created, voted on (with the newly acquired majority), and executed in the same transaction, including calls that invoked the treasury’s own swap functions (e.g., v3Swap).
This allowed the attacker to:
1. Flash-borrow USDT (via Aave), buy X tokens, and distribute/freeze them across controlled contracts to seize 2 of the 3 Senate seats.
2. Immediately propose + vote + execute a malicious proposal that forced the Freezer to swap a large amount of treasury X tokens into a freshly created, attacker-controlled (and empty/manipulated) PancakeSwap V3 X-USDT pool with min-output set near zero.
3. Withdraw the liquidity from that pool, sell the recovered X on legitimate markets, repay the flash loan, and keep the profit (~$4.75–4.85M USDT range reported across related alerts).
@EthSecurity1 | 1 197 |
| 5 | - The Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users - link
- Blockchain Forensics: A Practical Guide to Tracing Stolen Funds
- Blockchain Forensics: Attribution Techniques and the Role of OSINT
- Blockchain Forensics: Advanced Blockchain Forensics Techniques and Additional Resources
@EthSecurity1 | 1 266 |
| 6 | All versions of self-hosted GitLab from 12 years ago up to now are vulnerable.
@EthSecurity1 | 552 |
| 7 | https://blog.railway.com/p/security-disclosure-wednesday-october-21st
@EthSecurity1 | 540 |
| 8 | Security vulnerabilities reported in a SINGLE day:
PHP — 2 CVEs
Node.js — 10 CVEs
NGINX — 5 CVEs
Go — 1 CVE
GitLab — 12 CVEs
eMudhra — CA certificate compromise
@EthSecurity1 | 524 |
| 9 | - The adoption of Solana OFAs has increased over the past six months.
to learn about how they work, some issues we hear about from the top Solana apps, and brief thoughts on if these arrangements making Solana better for apps and users. - link
- The sandwich attack vector built to be missed. - link
@EthSecurity1 | 1 135 |
| 10 | AlpsCon.ai hacked $152K
Rootcause:
Access-control / operational failure (the entry point)
The Hardhat/Anvil default account #0 (0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266) — whose private key is publicly known — was added to the production KYC whitelist in a bulk import on 2025-08-24 and left there for ~14 months.
Anyone could therefore use EIP-7702 to delegate arbitrary code to that address and execute transactions as a fully verified, whitelisted wallet.
Reward-accounting bug (the actual value extraction)
Newer reward contracts (V7–V9) recursively imported balances from earlier versions. When a fresh stake appeared in an older hub that still accepted deposits, the newer contracts multiplied the newly visible balance by the already-accumulated profitPerShare while the account’s entryProfitPerShare stayed at zero.
This let a brand-new (flash-loan funded) stake claim the entire historical reward history (~$355K USDC), emptying the pool. The attacker then unstaked, sold the ALPS, repaid the flash loan, and kept the net ~$152K.
@EthSecurity1 | 1 149 |
| 11 | Trillion Dollar security - link
Validator sniping: How to harvest IP addresses to redirect MEV - link
The Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users
@EthSecurity1 | 1 416 |
| 12 | osec_io used AI agents (led by Claude Opus) and custom tooling to decompile GoonFi V2, a closed-source Solana propAMM written in Rust, achieving byte-identical recompilation of all 219 functions from on-chain bytecode. - link
@EthSecurity1 | 1 539 |
| 13 | Former Mt. Gox CEO: Ledger Received Hardware Wallet Tampering Reports Since December 2025 but Issued No Public Warning
@EthSecurity1 | 1 458 |
| 14 | It approved Telegram is totally shit and unencrypted
@EthSecurity1 | 746 |
| 15 | Here's how exactly Telegram provides user data to U.S. authorities. A letter recently filed in court shows how Telegram transfers that data, such as IP address and phone number.
More: 404media.co/heres-what-tel…
@EthSecurity1 | 1 681 |
| 16 | - Red Flags and Green Flags of Yield Bearing Stablecoins - link
- EVM – Cosmos Convergence Research From Security Base Part 1, Part 2, and Part 3
- Exploring Vulnerabilities and Audit Tips for TON Smart Contracts
@EthSecurity1 | 1 325 |
| 17 | - Kocher's Timing Attack, A Journey from Theory to Practice - link
- Blockchain Security — Offense, Defense, and Practices
- Finding Ways To Break Smart Contracts (Auditing: Part 2) - link
@EthSecurity1 | 1 205 |
| 18 | @UNCX_token hacked for ≈$87.7K.
Root cause:
VestingManager.release() subtracts claimed shares from global _totalTokenShares but leaves them in the position's _depositedShares.
After release → topUpVesting(), cancel() calculates sharesToRemove from the full lifetime _depositedShares without subtracting schedule released,
so already-released shares are removed from the global total a second time.
The attacker used a direct donation to magnify this stale-share debit,
corrupted the denominator, then released a second attacker-owned vesting to take tokens backing unrelated users.
Attack tx: etherscan.io/tx/0x352065378…
@EthSecurity1 | 1 348 |
| 19 |  2026 Hardware Wallet Incidents
@EthSecurity1 | 1 306 |
| 20 | - How to Manage Crypto Keys Without Losing Sleep - link
- Building Our Own Post-Quantum FIDO Token
- Use mutation testing to find the bugs your tests don't catch
@EthSecurity1 | 1 233 |
