goplus

The GoPlus security team disclosed that a high-risk fraudulent Meme factory was recently discovered on the Robinhood Chain, with a transaction volume exceeding 9 million dollars in the past 30 days, involving hundreds of fraudulent Memes. The asset aggregation address is 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00. As of September 28, 2026, the address balance is approximately 56.0635 ETH, equivalent to about 148,000 dollars; the address has a total of about 1,385 transactions, with the latest 400 transactions generating approximately 1,728.02 ETH in income and transferring out approximately 1,861.12 ETH; the two-way transaction volume is about 3,589.14 ETH, equivalent to about 9.49 million dollars.Direct evidence of "authorizing or selling tokens ---> liquidating ETH ---> transferring to the same aggregation address" was found in the high-risk associated Memes. The amount is the gross amount transferred into the aggregation system from the same project batch and does not represent net profit. The fraudulent Meme factory model mainly includes "new accounts shipping out ---> layered aggregation ---> fund recycling: 1. Creating Tokens based on industry hotspots; 2. Allocating Tokens to a large number of new EOAs with only 4 to 11 transactions; 3. Selling in segments through PonsV2Helper / UniversalRouter; 4. Emptying ETH to local aggregators or the main aggregation address (0x8c3bad); 5. Providing funds for the next round of projects, new wallets, and trading operations. The key to this fraud model is: 1. Using a large number of new wallets to hide the actual concentration of chips; 2. Segmentally selling by these wallets to create the illusion of multiple independent traders; 3. After the shipment is completed, funds flow into the same aggregation system; 4. Reinvesting the profits from old projects into the next round.On-chain researcher Wazz recently disclosed that a suspected continuous Rug gang initiated at least 53 Robinhood Chain Memes within about two months and extracted approximately 18.43 million dollars from them. Their main tactic is to control most of the token supply using 70 to 200 wallets, then reinvest the profits from the previous round into the next round. This case is similar to the fraudulent model in this case, but there is currently no evidence to indicate that it is the same gang.

GoPlus Security posted on platform X that the outflow of funds from THORChain needs to be actively signed by validators through TSS threshold signatures, which is different from Bitcoin and Ethereum; approximately 101.5 BTC (about 8.5 million USD) has already been transferred from the stolen funds on Bitget, and about 27.63 million XRP (about 43 million USD) is being exchanged for BTC, calling for interception of North Korea-related addresses.

GoPlus has issued a security alert, reminding investors to be vigilant against the imitation RUG on the Arc Chain. The Arc Chain launched explosively, with the first day's trading volume exceeding 144 million USD. While most users are still in the learning phase of cross-chain trading, the market has already seen imitation RUGs of the high market cap Launchpad tokens ARGUS and TOLLY.Please be very careful and verify the contract address carefully before trading.

GoPlus Chinese Community issued a security alert stating that a newly activated external account address has initiated a malicious governance proposal against Ampleforth. The proposal, titled "Application for Completed Work Funding for SPOT Ecosystem Analysis Tool," attempts to transfer 2.5 million USDC from the treasury to the proposer, an amount that nearly accounts for all the liquid funds in the treasury.

According to GoPlus alerts, the meme coin LAPTOP issued by Hunter Biden, son of Biden, is about to launch an airdrop. A large number of phishing websites for fake LAPTOP airdrop whitelists, eligibility checks, and claims have appeared on Twitter, and there are also lookalike versions on multiple chains, with risks such as unverified contracts, high taxes, and trading suspensions.GoPlus reminds users to refer to the official website and Twitter for accurate information, to be cautious when participating in lookalike trading, and to use Token security checks to confirm contract safety. Remember the four principles: do not click, do not install, do not sign, do not transfer.

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.

GoPlus Security issued a security alert stating that a fraud gang has hijacked the realtrumpcoins[.]com website and the @realtrumpcoins1 account, maliciously issuing GOLD tokens. The gang inflated its market value to approximately $60 million before selling off and executing a Rug Pull, profiting over $8.2 million.On-chain data shows that the developers' initial funds trace back to a KuCoin-associated hot wallet, with another 15 trading wallets funded by Binance-associated hot wallets. These wallets all conducted transactions through the same malicious routing contract.GoPlus Security also pointed out that the gang deployed another malicious meme coin, Trump Digital Platinum (PLATINUM), whose contract can empty any holder's balance at any time, warning users to avoid purchasing and to be aware of the risks.

GoPlus Security issued a security alert stating that realio[.]fund, a subsidiary of Realio Network, was attacked. The attacker took over the platform's signature system and transferred assets from the treasury and custodial wallets on Ethereum, BNB Chain, Algorand, Stellar, and the Realio native chain.This incident involved approximately 127.9 million RIO, valued at around 6.2 million dollars, and the attacker has currently cashed out about 317,000 dollars.

According to GoPlus monitoring, the VSCode extension Solidity Pro has been poisoned, and historical versions have malicious capabilities such as data theft and remote execution.It is recommended that developers immediately check the relevant extensions they have installed and increase their vigilance towards third-party plugins.

According to official news, GoPlus announced a comprehensive upgrade of DeepScan, launching an AI-based smart contract security solution. GoPlus stated that as hackers begin to leverage AI to dig deeper into contract vulnerabilities, the traditional "one-time audit, go live and it's done" security model is struggling to cope with the continuously evolving attack risks.DeepScan constructs a complete security closed loop around the entire lifecycle of smart contracts, consisting of AI contract auditing, continuous security monitoring, and Token security self-checks, providing ongoing security assurance for developers, project parties, and trading platforms. Among them, AI contract auditing can analyze contract source code, permission management, and business logic based on AI deep analysis, identifying security risks such as syntax vulnerabilities and business logic vulnerabilities, and outputting a structured audit report that includes security scores, key findings, problem details, and remediation suggestions. Continuous security monitoring targets contracts that are already live and have completed audits, tracking newly disclosed vulnerabilities, on-chain attack events, and changes in external dependencies such as oracles and cross-chain bridges in real-time, and using AI to determine whether the project is affected, conducting timely reviews and alerts. Token security self-checks are aimed at projects that are about to be launched or applying for listing, quickly detecting risks such as P2P pools/honeypots, malicious issuance permissions, blacklist mechanisms, abnormal transaction taxes, Owner permissions, and transaction restrictions.In addition, the GoPlus DeepScan team also released an open-source Benchmark dataset built on real smart contract attack events, used to assess AI's actual capabilities in vulnerability identification, attack path understanding, contextual reasoning, and audit stability. Currently, it has included nearly a hundred typical attack events since May 2025 and continues to be updated. GoPlus stated that DeepScan can be used for low-cost security scanning by developers, security reviews before project launches, and continuous monitoring during operations, while also serving as a supplement to security assessments before listing on trading platforms, helping all parties to more promptly identify new vulnerabilities and attack risks.

According to GoPlus security alerts, a user lost approximately 100,000 USDT due to an address poisoning attack. The attacker conducted small transactions using malicious addresses with similar ending digits, waiting for the user to make a mistake while copying and pasting.Address poisoning attacks have been fully automated, including discovering poisoning opportunities, creating counterfeit coins with the same name or implementing small-scale poisoning, and mixing coins for money laundering. The victim's address received over four hundred poisoning transactions after executing the last transaction 69 days ago.

According to GoPlus monitoring, a user on the Base chain lost 500,000 USDC due to a phishing attack. When the attacker exchanged the stolen funds for WETH, the script did not set slippage protection, routing to a Uniswap V4 WETH/USDC pool with almost no liquidity, resulting in only 67.9 ETH (worth $129,000) being exchanged for 500,000 USDC, of which $370,000 was earned by an MEV bot.The MEV bot only paid 0.03 USDC to front-run the transaction but incurred 3.5 ETH in gas fees for this. Subsequently, the victim sent an on-chain message to the attacker and the MEV address, stating that they had identified the attacker and were willing to pay a 10% bounty for a refund.

According to GoPlus analysis, Lumi Finance on Arbitrum was attacked on July 13, resulting in a loss of approximately $270,000.The vulnerability originated from a logical flaw in the validateUserOp function of the Sodium smart account contract (ERC-4337) when calling _validateSignature to verify the signature—specifically, during the execution of isValidSignatureNow, the signer parameter was passed as the attacker's address. After an error occurred in the call to ECDSA.tryRecover, it did not revert but instead called the isValidSignature function in the attack contract and passed the verification. The attacker exploited this vulnerability to execute Token approve operations during the UserOperation verification period, obtaining approval rights for ERC20 tokens from multiple smart accounts without the payer's consent.

The security analysis platform GoPlus tweeted regarding the incident where "a user exchanged approximately 1126 ETH (about 2.01 million USD) for 5776 LIT (about 14,000 USD) on Uniswap, resulting in a loss of nearly 2 million USD." The core reason for this incident was not a sandwich attack, but rather backrunner arbitrage within the same block. The routing contract injected a large amount of WETH into a liquidity-poor AVAIL/WETH trading pool, causing the user to buy AVAIL at a severely deviated market price (about 120 times the reasonable price). Subsequently, within the same block, the backrunner executed a reverse trade on the pool with a minimal amount of AVAIL at the real price, withdrawing approximately 1072 WETH, and paid most of it (about 1018 ETH) as builder payment to Titan Builder.

Web3 security company GoPlus Security pointed out that there has been a recent surge in smart contract vulnerability attacks, particularly targeting older contracts that have been deployed for many years. Attackers are leveraging AI technology to quickly discover and exploit these vulnerabilities.Recent typical incidents include:On June 9, a Token of Power (TOP) contract deployed 7 years ago was attacked on Ethereum, resulting in a loss of approximately $1.5 million;On May 25, a WUSD.fi contract deployed 3 years ago was attacked, resulting in a loss of approximately $200,000;On June 14 and June 18, Aztec Network was attacked twice in a row due to an old contract deployed 2 years ago, with total losses exceeding $4 million.GoPlus Security believes that traditional auditing methods are insufficient to effectively cover legacy contracts, and adopting AI-based Always-on Audit services may be the most effective solution currently available, capable of conducting security checks on old contracts in a short period while balancing reliability and cost.

GoPlus posted on platform X that the Meta account recovery feature has been exposed to a high-risk design flaw, which could directly leak users' phone numbers, email addresses, and PII (Personally Identifiable Information). Attackers only need to input the META username without any login or verification to directly obtain the complete PII linked to the user, such as email addresses and phone numbers. This could pose significant risks to users, including: large-scale phishing attacks, SIM card swapping attacks, account takeover and identity theft, and targeted social engineering attacks.Recommendations: Remove or change the leaked email/phone number as a recovery method; modify related account passwords and enable 2FA; do not click on any emails or messages related to "account anomalies," "verification," or "password reset"; set up multi-channel verification, which can be verified through official documents or other official social media channels.

According to GoPlus warning, a user lost approximately $316,000 worth of USDC to a phishing attack due to signing a malicious Permit2 transaction.

GoPlus issued a security alert stating that the Korean version of Liangxi, contract live broadcast KOL Xibajie @jadoodoo_'s X account has been hacked, and is crazily sending phishing links to fans under the guise of collaboration. Several KOLs have already fallen victim, with total losses amounting to approximately $5,000. Please do not click on links to connect wallets or download malware.

Regarding the incident "DxSale accused of using a backdoor to withdraw $7.3 million in liquidity funds," the security company GoPlus stated that the attack may have been an inside job, and there is still $15.5 million in funds and LP urgently needing rescue. GoPlus recommends that the project team immediately check whether their project LP is locked in the contracts 0xEb3a9C56, 0x81E0eF68, 0x2D045410, 0x5b5e9448, and if so, take immediate measures to withdraw. Since the initial funding source was Bybit, KYC tracing is recommended; the final withdrawal channels are multiple Binance addresses, and it is suggested that the relevant security teams submit on-chain evidence to apply for freezing the attacker's address.GoPlus calls on the project to strengthen security mechanisms, stating that critical admin functions must have a time lock, and Owner permissions must use multi-signature. GoPlus emphasizes that as of now, DxSale has not issued any public incident response statement, and its silence is also worth noting.

According to GoPlus security alerts, phishing scams promoting black U and anti-money laundering detection websites have appeared on the X platform. Investigations reveal that the website is a phishing site hosted on the Vercel platform, aimed at tricking users into authorizing their wallets, so please do not interact.GoPlus recommends: try to avoid private transactions and use the OTC features of centralized exchanges; maintain a high level of suspicion towards unfamiliar links, especially those requiring wallet signatures or authorizations; remember the "four no choices" to prevent phishing: do not click on unfamiliar links, do not install software from unknown sources, do not sign transactions with unclear content, and do not transfer funds to unverified addresses.