Defimon Alerts
رفتن به کانال در Telegram
⚠️ DeFi security alerts by @DecurityHQ 💎 Instant alerts @defimon_subscription_bot defimon.xyz
نمایش بیشترکشور مشخص نشده استرمزارزها15 015
4 747
مشترکین
+524 ساعت
+157 روز
+9430 روز
در حال بارگذاری داده‌ها
کانال‌های مشابه
هیچ داده‌ای
مشکلی وجود دارد؟ لطفاً صفحه را تازه کنید یا با مدیر پشتیبانی ما تماس بگیرید.
ابر برچسب‌ها
اشارات ورودی و خروجی
---
---
---
---
---
---
جذب مشترکین
اکتبر '26اکتبر '26
اکتبر '26
+158
در 1 کانال‌ها
سپتامبر '26
+156
در 0 کانال‌ها
Get PRO
اوت '26
+157
در 3 کانال‌ها
Get PRO
ژوئیه '26
+131
در 1 کانال‌ها
Get PRO
ژوئن '26
+139
در 3 کانال‌ها
Get PRO
مه '26
+234
در 1 کانال‌ها
Get PRO
آوریل '26
+261
در 0 کانال‌ها
Get PRO
مارس '26
+250
در 0 کانال‌ها
Get PRO
فوریه '26
+176
در 2 کانال‌ها
Get PRO
ژانویه '26
+434
در 1 کانال‌ها
Get PRO
دسامبر '25
+357
در 4 کانال‌ها
Get PRO
نوامبر '25
+368
در 0 کانال‌ها
Get PRO
اکتبر '25
+541
در 3 کانال‌ها
Get PRO
سپتامبر '25
+419
در 6 کانال‌ها
Get PRO
اوت '25
+126
در 1 کانال‌ها
Get PRO
ژوئیه '25
+172
در 3 کانال‌ها
Get PRO
ژوئن '25
+203
در 0 کانال‌ها
Get PRO
مه '25
+176
در 3 کانال‌ها
Get PRO
آوریل '25
+221
در 3 کانال‌ها
Get PRO
مارس '25
+248
در 1 کانال‌ها
Get PRO
فوریه '25
+724
در 0 کانال‌ها
Get PRO
ژانویه '250
در 0 کانال‌ها
Get PRO
دسامبر '24
+19
در 1 کانال‌ها
| تاریخ | رشد مشترکین | اشارات | کانال‌ها | |
| 29 اکتبر | +6 | |||
| 28 اکتبر | +6 | |||
| 27 اکتبر | +6 | |||
| 26 اکتبر | +1 | |||
| 25 اکتبر | +1 | |||
| 24 اکتبر | +9 | |||
| 23 اکتبر | +2 | |||
| 22 اکتبر | +7 | |||
| 21 اکتبر | +8 | |||
| 20 اکتبر | +6 | |||
| 19 اکتبر | +13 | |||
| 18 اکتبر | +5 | |||
| 17 اکتبر | +4 | |||
| 16 اکتبر | +3 | |||
| 15 اکتبر | 0 | |||
| 14 اکتبر | +6 | |||
| 13 اکتبر | +7 | |||
| 12 اکتبر | +3 | |||
| 11 اکتبر | +4 | |||
| 10 اکتبر | +1 | |||
| 09 اکتبر | +5 | |||
| 08 اکتبر | +3 | |||
| 07 اکتبر | +8 | |||
| 06 اکتبر | +5 | |||
| 05 اکتبر | +5 | |||
| 04 اکتبر | +4 | |||
| 03 اکتبر | +5 | |||
| 02 اکتبر | +15 | |||
| 01 اکتبر | +8 |
پست‌های کانال
💌 Onchain message:
To the holder of 0x353c3BB2aA525C92387BFc4a465AAB39Ed320278: You exploited a vulnerability in mSamex on 28-29 Oct 2026. We offer a USD 1,000 bug bounty. Keep 1,000 USDT and return the remaining USDT on BSC to 0xe9D1A324B8a4AE36f8Cb4C4289A29f66f9b4b001 within 48 hours. We have identified information linked to you through the infrastructure and wallets you used. - mSamex Security📤 From: 0x4983b41e43270bd6e77319c990c6a29bf9fd88b3 📥 To: 0x353c3bb2aa525c92387bfc4a465aab39ed320278 🌎 Network: bsc Etherscan
| 2 | 🚨 zkLink Nova - Loss ~$805K (2026-10-28)
Network: Ethereum
Type: Rollup batch-root forgery → forged L2→L1 withdrawal
The owner-gated harness (0xd5f1...ff07) that Defimon flagged pre-drain yesterday fired. Via entry 0x2ca7edea it installed an attacker-chosen L2 logs root (syncBatchRoot through the zkLink gateway 0x83Bc7394 relay) and then looped finalizeWithdrawal on the L1ERC20Bridge 0xAd16EDCF (impl 0x3203e813), each call passing a forged Merkle proof that proveL2MessageInclusion on the rollup 0x5fD9F732 validated against the fake root. With no equivalent L2 burn, the L1 escrow was released to the attacker — same output-root/withdrawal-forgery class as OP-stack portal drains.
Drained to attacker 0xaCA0655a: 245.74 pufETH (~$635K), 22.43 ETH (~$52.8K from rollup), 12.57 ezETH, 6.87 rsETH, 6.30 STONE, 2.64 mstETH, 2.48 mswETH, wstETH/rswETH, plus 18.1K USDC + 3.36K USDT + 0.174 WBTC. Total ~$805K.
TX: https://etherscan.io/tx/0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462c
Attacker: https://etherscan.io/address/0xaca0655a11200a80d33d0e48786317304cde5718
Victim: https://etherscan.io/address/0xad16edcf7deb7e90096a259c81269d811544b6b6
X: https://x.com/zkLink_Official
@defimon_subscription_bot | 458 |
| 3 | 💌 Onchain message:
I mapped your wallet to the Upwork account and the GitHub scam. I also have your Solana address.
Keep 20% bounty and return the rest to 0x9D24F6dCab5d51DACe8Ba899af518fdE2f314099
You have 24 hours to avoid legal prosecution. After that every address you use will be monitored. Security team was already engaged.
📤 From: 0x1902728089592ed37166831e8b2cecd051da09bb
📥 To: 0x742f3fe49c810e2905701c6954a08c5077eca05a
🌎 Network: mainnet
Etherscan | 538 |
| 4 | 💌 Onchain message:
To 0xea9d935ae36640933e5f3b85b8267358d743ff9d from the Humanode team.
On 28.10.2026 you exploited Humanode EVM in tx 0x5ed6b9e5661b7ba5237a81244725272482044b0b572267d2f7f31874d68c4a82 and took native HMND from 438 wallets.
We offer a whitehat bounty: keep 20% and return the remaining 80% (the USDC you bridged out and the HMND) to the address this message is sent from.
Reply on-chain to this address or via Blockscan Chat.
📤 From: 0xd0d56d9b522677605af6ae771203d3216916304d
📥 To: 0xea9d935ae36640933e5f3b85b8267358d743ff9d
🌎 Network: mainnet
Etherscan | 18 |
| 5 | 💌 Onchain message:
To 0xea9d935ae36640933e5f3b85b8267358d743ff9d from the Humanode team.
On 28.10.2026 you exploited Humanode EVM in tx 0x5ed6b9e5661b7ba5237a81244725272482044b0b572267d2f7f31874d68c4a82 and took native HMND from 438 wallets and 12 million HMND and bridged in USD.
We offer a whitehat bounty: keep 20% and return the remaining 80% (the USDC you bridged out and the HMND) to the address this message is sent from.
Reply on-chain to this address or via Blockscan Chat.
📤 From: 0x7d381ec0718eeaa374d8fa77c14cd81f186d7815
📥 To: 0xea9d935ae36640933e5f3b85b8267358d743ff9d
🌎 Network: arbitrum
Etherscan | 565 |
| 6 | 💌 Onchain message:
ACP incident 2026-10-28 | 12,247,898.14 ACP drained from NodePurchase (0x91b5F631E51472CB186E23d8f8BAA285cf994e98) into this address. We are the contract operator and can sign-verify ownership from the admin address. Request return of funds; a substantial white-hat bounty is available and fully negotiable. Contact: jasonyuan18@163.com
📤 From: 0xb8c099a45e21af9887881ea0f14a42fc8076f59d
📥 To: 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671
🌎 Network: mainnet
Etherscan | 558 |
| 7 | 💌 Onchain message:
To the controller of this wallet(@thorin @evilcos):
The incident funds have been traced to this address. Our 10% recovery offer remains open: you may retain 10% and return 90% of the verified affected funds.
Please pause further transfers and reply on-chain. We will agree the amounts and return address in writing before any return.
📤 From: 0x43d1e4023227f31f56f0a0426bab511e47279f3c
📥 To: 0xf940adeec465ce4eb79155bc24caf758d7f893fa
🌎 Network: bsc
Etherscan | 10 |
| 8 | 💌 Onchain message:
To the controller of this wallet:
The Fence incident funds have been traced to this address. Our 10% recovery offer remains open: you may retain 10% and return 90% of the verified affected funds.
Please pause further transfers and contact recovery@fence.finance, or reply on-chain. We will agree the amounts and return address in writing before any return.
📤 From: 0x3759d47060e43394165e30ea27229a251c9000a2
📥 To: 0xdc3d7cc5383e0f1ac46d2c693aad1a19859a2deb
🌎 Network: mainnet
Etherscan | 552 |
| 9 | 💌 Onchain message:
This msg is to 0x7777775d1733424198EFc2EBd83C4e030afc3153
以下消息基于链上事实 无意冒犯
你说攻击者是新手 他的兑换被拦截了 可是链上却完全不同
他用合法签名 从你们的金库提取了612,506EP 通过PancakeRouter兑换成1048USDT 转入地址0x6a0af4d678F6282325dB75209c70C5bE93CbCFa4
然后他把USDT全部转进了Baltex Baltex的USDT交易对只有USDT-BTC和USDT-XMR
如果是换成了BTC 你可以去BTC链基于时间行为特征继续追踪
如果是换成了XMR 很抱歉通知你 你的钱可能无了
msg below is based on on-chain fact. No offense intended.
You said the attacker is newbie and his swap was intercepted, but the on-chain record tells a completely different story.
Using a valid signature, the attacker withdrew 612,506EP from your vault, swapped it for 1,048USDT via PancakeRouter, and transferred the USDT to 0x6a0af4d678F6282325dB75209c70C5bE93CbCFa4. All of that USDT was then moved to Baltex. The only USDT-related trading pairs on Baltex are USDT-BTC and USDT-XMR. If the attacker swapped to BTC, you can still try to trace the funds on the Bitcoin chain using timing and behavioral patterns.However, if the attacker swapped to XMR, I’m sorry to inform you that the funds are likely gone. Monero is not traceable.
btw, IM NOT THE ATTACKER. why MistTrack reposted my previous msg with the comment "An unusual on-chain negotiation" WTF
📤 From: 0xf940adeec465ce4eb79155bc24caf758d7f893fa
📥 To: 0x35a5becb2dc25de8b2f5be5c3a55b4bb3e60220f
🌎 Network: bsc
Etherscan | 540 |
| 10 | 💌 Onchain message:
亲爱的黑客：
您好，我恳求您考虑归还EP项目相关的USDT。我不是在威胁或指责您，我只想请您归还这些资金。
如果您愿意归还，这对所有受影响的人来说都意义重大。感谢您抽出时间阅读此信息，我无比衷心地希望您能考虑归还这些USDT。
另外：0x7777775d1733424198EFc2EBd83C4e030afc3153 的私钥已经丢失，如果您愿意归还这些资产，请您将它们发至我的新地址。
感谢
Hello, Mr. Hacker.
I’m respectfully asking if you would please consider returning the USDT taken from the EP project. I’m not here to threaten or argue with you — I’m simply hoping you might be willing to return the funds.
If you’re willing to do so, it would mean a great deal to everyone affected. Thank you for taking the time to read this, and I sincerely hope you’ll consider returning the assets.
One important note: the private key for the previous address 0x7777775d1733424198EFc2EBd83C4e030afc3153 has been lost, so I can no longer access that address. If you are willing to return the assets, could you please send them to my new address instead?
Thank you.
📤 From: 0x43d1e4023227f31f56f0a0426bab511e47279f3c
📥 To: 0x35a5becb2dc25de8b2f5be5c3a55b4bb3e60220f
🌎 Network: bsc
Etherscan | 36 |
| 11 | 💌 Onchain message:
This msg is to 0x7777775d1733424198EFc2EBd83C4e030afc3153
语气尊重一点 你在请求一个没有道德的人把钱还回来 不要这么咄咄逼人 Please be respectful in your tone. You are asking someone who lacks any moral compass to return money. Being so aggressive is backfire. "Mr.Hacker can I have my money back?" you should say.
📤 From: 0xf940adeec465ce4eb79155bc24caf758d7f893fa
📥 To: 0x35a5becb2dc25de8b2f5be5c3a55b4bb3e60220f
🌎 Network: bsc
Etherscan | 555 |
| 12 | 💌 Onchain message:
把刚才EP项目盗取卖出的USDT退回来,不是只有你做黑客,也不是只有你会使用这两天的php session漏洞,把钱退回来
📤 From: 0x7777775d1733424198efc2ebd83c4e030afc3153
📥 To: 0x35a5becb2dc25de8b2f5be5c3a55b4bb3e60220f
🌎 Network: bsc
Etherscan | 651 |
| 13 |  🚨 Defimon detected another exploit on Avalanche. Fence.finance lost around $1M due to a logic bug in an unverified contract.
Fence's Avalanche USDC pool runs several lending tranches inside one contract. In each tranche, lenders deposit and a borrower draws. On every call, the caller passes in the tranche's configuration (borrower/admin, hook contract, asset, parameters), and the pool checks it only against a stored hash. Creating a tranche only requires the caller to be the admin named in the configuration it supplies, so anyone can open a tranche and be its borrower.
At 23:56 UTC on Oct 27, the attacker's contract flash-loaned 1,013,353.61 USDC from Aave V3 and opened tranche #1 with itself as admin and hook, so every hook check returned true. As lender, it deposited the loan. As admin, it scheduled a 1,013,353.61 USDC principal repayment, due at 00:00 UTC Oct 28. As borrower, it drew the whole deposit back out and repaid Aave, paying about $507 in fees. The amount matched tranche #0's idle cash exactly: its lenders had deposited 3M and its borrower had drawn 1.986M.
At 00:00:03 UTC the attacker drew again. Because the day had rolled over, the pool found the repayment due that day and booked the 1.013M as repaid, taking it off the tranche's outstanding debt, even though the attacker never paid anything back. The draw function caps borrowing at deposits minus outstanding debt. It ignores principal that fell due unpaid, which the lender-withdrawal check does subtract, so the full 1.013M borrow limit reopened. Every tranche is paid from one shared balance, so the pool sent the attacker the 1.013M belonging to tranche #0's lenders and was left empty.
Setup TX: https://snowtrace.io/tx/0x19ab145e7f771549ca2f1da4b1768d7f728834015b2480ddb5be19c9769899fd
Exploit TX: https://snowtrace.io/tx/0x3f6b23292a2e9c2956c7ac56d0b1f79b0271b49edec2156d2675ddf1de058c77
Attacker: https://snowtrace.io/address/0x6ff1c3ffa622e1062168f3497a275be9cc2b1246
Victim: https://snowtrace.io/address/0xe25cb545bdd47a8ec2d08001cb5661b00d47621a
Subscribe for real-time alerts via @defimon_subscription_bot | 565 |
| 14 | 💌 Onchain message:
To the controller of this wallet:
We would like to resolve the 27 October 2026 incident involving the Avalanche pool at 0xE25CB545Bdd47a8Ec2d08001cb5661B00D47621a cooperatively.
Fence offers a 10% recovery bounty: you may retain 10% and return the remaining 90% of the verified affected funds. We will agree the amounts and return address in writing beforehand.
Please contact recovery@fence.finance, reply on-chain, or suggest your preferred communication channel.
Please keep the funds in place while we coordinate.
📤 From: 0x3759d47060e43394165e30ea27229a251c9000a2
📥 To: 0x6ff1c3ffa622e1062168f3497a275be9cc2b1246
🌎 Network: avax
Etherscan | 603 |
| 15 |  The MEV-bot was offered a bounty of 42,500 WAVAX ($371K)
https://snowscan.xyz/tx/0xd2916fecdf3f0749692830918bd0ac8059c4d87e62d174181e609a7076911afc | 717 |
| 16 |  🚨 Defimon detected an intercepted exploit on a Safe multisig which lost $7.45M due to a misconfiguration on Avalanache.
A 2-of-7 Safe holding trading inventory had approved unlimited WAVAX, USDC, WETH.e and BTC.b spending to 0x3725bd4d175283108156c3f15f86e1c51266155d. The approvals were set in a batch that ran on 2026-03-07 16:10 UTC. On Base, Arbitrum and Ethereum, the team's pool contract lives at that address. On Avalanche it was empty: the address is simply what Safe's public CreateCall contract produces on its 13th deployment, and CreateCall had never been used there. The approvals were never revoked.
Anyone could therefore deploy their own code at that address and spend the allowances. A fresh EOA deployed CreateCall through the Safe singleton factory, ran 12 throwaway deployments, then placed a sweeper at 0x3725bd4d175283108156c3f15f86e1c51266155d that pulled every balance out of the Safe. An MEV bot copied the transaction and front-ran it in the same block, taking 3.09M USDC, 350.4K WAVAX, 182 WETH.e and 10.79 BTC.b. The original attack tx then reverted.
The bot says it is a whitehat and is negotiating on-chain with the Safe owners to return the funds for a 5–10% bounty. The funds sit at 0x11eb9b677510e2594857f4d137fd12a7fef39bc5.
The same operator runs Safes on other chains, each with its own signers. From 13:48 UTC those signers evacuated the Safes on HyperEVM, Base, Robinhood Chain, BSC and Ethereum into one fresh address, 0x70d54baf9ffa48b8fe4e843774a44e24ff452099. It now holds about $38.7M.
This attack was detected by Defimon yesterday at 13:00:23 UTC. Subscribe for real-time alerts: defimon.xyz We now accept card payments via Stripe.
Vulnerable approvals (2026-03-07): https://snowtrace.io/tx/0x6952f80bbbcad4368b020bcda600965cf0a520a8694db431b6b1521842d3829e
Attacker: https://snowtrace.io/address/0x4c48b79b97516719444056d2bf0dc9564138fa0a
Original attack (reverted): https://snowtrace.io/tx/0xf1f87d370290afe269ae8eb30fe8e5e4694ad153914a2de6d980641f4a331289
MEV-bot: https://snowtrace.io/address/0x36b112875f921e51f5ea8ff39b374960694d21b3
MEV Tx: https://snowtrace.io/tx/0xf88a7960a07832e1bf5be64edbd12a9e615b4f63959a4b87a147f0c63c007ed5
Victim: https://snowtrace.io/address/0x631fca4a73aee699638634479132452ef354b9b8 | 714 |
| 17 | 💌 Onchain message:
Great! To save you some effort of back and forth transfering, we prefer the wallet that currently holding your assets to receive the bounty, just let us know how many we should keep, we prefer WAVAX
📤 From: 0x36b112875f921e51f5ea8ff39b374960694d21b3
📥 To: 0xffcc49336f12db595d4ecfc10fde1eb0c5cd9a57
🌎 Network: avax
Etherscan | 629 |
| 18 | 💌 Onchain message:
We appreciate your assistance on the recovery and the speedy return of our funds. We do wish to send you a >5% bounty for your efforts upon safer return of our funds.
Confirm your preference for usdt or eth and to which address please.
📤 From: 0xffcc49336f12db595d4ecfc10fde1eb0c5cd9a57
📥 To: 0x36b112875f921e51f5ea8ff39b374960694d21b3
🌎 Network: avax
Etherscan | 631 |
| 19 | 💌 Onchain message:
Hello, here is the original attack transaction: https://snowscan.xyz/tx/0xf1f87d370290afe269ae8eb30fe8e5e4694ad153914a2de6d980641f4a331289, which may help you figure out what happened.
As requested, we will return the funds to 0x35c6aa248e9495E0572598fBfE0528aCbAC2807C within the next few hours. We’re glad we could help with the recovery and would appreciate it if you would consider a 5–10% bounty for our efforts.
📤 From: 0x36b112875f921e51f5ea8ff39b374960694d21b3
📥 To: 0xffcc49336f12db595d4ecfc10fde1eb0c5cd9a57
🌎 Network: avax
Etherscan | 642 |
| 20 | 💌 Onchain message:
Hello! Your July treasury proposal almost passed (2 votes needed, 0 quorum). We have the exact working calldata for a full drain. You propose+vote with your 2 nouns, we split 50/50 via on-chain splitter contract. Reply by tx to 0xa78300186fa872660781E636e83E22742B6f7c99 or email: nounsdeal@proton.me - N
📤 From: 0xa78300186fa872660781e636e83e22742b6f7c99
📥 To: 0x13061efe742418c361c840caff300dc43ac0affe
🌎 Network: mainnet
Etherscan | 681 |
