leak

The slow fog余弦 social media stated that the high-risk iOS attack framework DarkSword has been publicly leaked on channels such as GitHub and is being used for large-scale espionage attacks targeting cryptocurrency wallet holders.This attack program targets devices running iOS versions 18.4 to 18.7, utilizing vulnerabilities in the Safari browser through malicious web pages to achieve remote code execution, thereby stealing users' sensitive data. Attackers launch attacks using bait web pages that impersonate pornographic live streams, Tron energy stations, refund processes, and more.iPhone users running older versions of iOS, once they access such web pages using the Safari browser (even if they do not close the page), may have sensitive information such as plaintext private keys and mnemonic phrases stolen by malicious JavaScript code when unlocking the wallet app, which is then transmitted in real-time through channels like Telegram bots.

According to GoPlus, there have been two new public key leakage incidents in the past 36 hours, with a total loss of $238,000. Among them, 0xUnihax0r lost $200,000, and he had previously uploaded a trading bot and Telegram; the stolen address of @Eli5defi is linked to a previous large-scale private key leakage incident involving 574 addresses. GoPlus suggests that, in light of such centralized large-scale private key leaks, it is advisable to immediately check for risks according to the private key leakage self-inspection checklist.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

According to official news, Syndicate Labs disclosed that its cross-chain bridge contract was maliciously upgraded on two chains due to a private key leak. The attacker transferred and sold approximately 18.5 million SYND (about $330,000) and around $50,000 worth of user tokens. The incident only affected specific chains, while others were not impacted.Syndicate Labs stated that this attack involved multi-stage reconnaissance, infrastructure mapping, and careful execution, demonstrating a high level of technical complexity, and ruled out the involvement of internal personnel. The root cause was that the private key was stored in a password management tool without an additional layer of encryption, and the upgrade process did not utilize multi-signature or hardware signature mechanisms, nor did it have early warning and circuit breaker measures for contract upgrades.Syndicate Labs announced that it will fully compensate all affected users, including returning 18.5 million SYND and providing additional compensation, while also fully compensating affected application chain clients. The company has initiated security upgrade measures, including strengthening private key encryption, tightening access permissions, and plans to introduce hardware or multi-signature mechanisms and upgrade path monitoring to prevent similar incidents from occurring again.

The Berachain Foundation issued a warning on platform X that the Wasabi Protocol has triggered a cross-chain security incident due to the leakage of the deployer's private key, affecting multiple blockchains including Berachain.To prevent the spread of risk, Berachain has suspended and blacklisted all affected Wasabi Reward Vaults within the network, immediately stopping the distribution of BGT staking rewards to compromised contracts and blocking the flow of new BGT into the damaged contracts. The official request for all users who have interacted with Berachain and Wasabi is to immediately revoke token authorization for the specified contracts to avoid the risk of asset theft. Berachain also emphasized that the BGT reward funds within the native RewardVaults are safe and users can claim them normally; this incident does not affect core ecological rights.

The decentralized prediction market platform Polymarket is suspected to have been hacked, with the threat actor xorcat posting over 300,000 data records and a corresponding exploit toolkit on a well-known cybercrime forum.It is reported that the attacker extracted data through undisclosed API endpoints, pagination bypass, and CORS misconfigurations in Polymarket Gamma and CLOB API. The leaked content includes: 10,000 users' complete personal information (including names, proxy wallets, and base addresses), 4,111 comments, 1,000 reports (including 58 ETH addresses and administrator verification address identifiers), 48,536 Gamma market metadata, over 250,000 active CLOB market fixed product market maker addresses, and 9,000 social graph data of followers.The toolkit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (Axios NO_PROXY bypass, CVSS 9.9, which can trigger server-side request forgery), CVE-2024-51479 (Next.js middleware authentication bypass, CVSS 7.5), and CORS misconfigurations. Additionally, the toolkit includes automated continuous pull scripts and a complete red team report.

Orca posted on the X platform that its frontend is hosted on the cloud hosting platform Vercel. In response to the Vercel security incident, all potentially leaked keys and deployment credentials have been rotated out of caution. Orca's on-chain protocol and user funds were not affected. The official team will continue to monitor the situation and will provide updates as more information becomes available.

The Chief Information Security Officer of Slow Fog Technology, 23pds, retweeted that the internal system of the cloud hosting platform Vercel was accessed without authorization, which is suspected to be related to an internal data breach.The related tweet indicated that someone on BreachForums claimed to be ShinyHunters and is selling the so-called Vercel internal database, access keys, source code, employee accounts, API keys, NPM tokens, and GitHub tokens for $2 million. The related data is suspected to involve Vercel's internal Linear system and internal user management system.Previously, the cloud hosting platform Vercel disclosed that its internal system was accessed without authorization, affecting a small number of customers.

CZ responded on social media regarding the "phone number leak" in the new book, stating that the phone number has not been used for many years. The new owner should be a hacker or the police, and there were previous attempts to apply for an assistant position. Please pay attention to your own safety. It is advised not to add (related social media accounts) anymore.

According to official news, the blockchain security agency SlowMist recently released a security assessment report, conducting a special audit of OKX Wallet. The results showed that in the audited version, no behavior was found where the application transmitted sensitive information such as private keys or mnemonic phrases to external servers, and no risk of sensitive data leakage was detected overall.It is reported that this assessment focused on whether there were issues with the external transmission of private keys and mnemonic phrases in OKX Wallet, and the results indicated that the relevant core information was processed locally. The current handling of private keys and mnemonic phrases has become the core of wallet security, and such audit results also provide users with a more direct security reference.

The analysis of the Drift theft incident by Slow Fog pointed out that a week before the attack, Drift adjusted its multi-signature mechanism to "2/5" (1 old signer + 4 new signers) and did not set a timelock. The attacker then gained administrator privileges, forged CVT tokens, manipulated the oracle, disabled security mechanisms, and transferred high-value assets from the liquidity pool.Currently, the stolen funds have mainly been aggregated to an Ethereum address, totaling approximately 105,969 ETH (about 226 million USD). Slow Fog stated that the flow of related funds is still being tracked.

On March 28, the cybersecurity platform VECERT disclosed that hackers, under the name PexRat, are selling a database containing personal information of 1.5 million Binance users on the dark web. The content includes sensitive information such as names, emails, phone numbers, KYC verification status, login IP addresses, and two-factor authentication methods.Analysis indicates that this incident was not a direct intrusion into Binance's internal servers, but rather that the attackers bypassed the CAPTCHA mechanism and obtained data through credential stuffing and automated scraping methods. Affected users face a high risk of SIM card hijacking and phishing attacks. At the time of this incident, Binance's institutional OTC trading business is experiencing rapid growth, with trading volume reaching 25% of the total for the entire year of 2025 in just January and February of this year. This is another data security crisis for Binance following the leak of 420,000 sets of account credentials in January.

According to a report by Fortune magazine, documents leaked from Anthropic show that its next-generation super robot "Claude Mythos" is currently being tested, and the company believes that this robot "poses an unprecedented cybersecurity risk." Musk stated, "This is deeply concerning."

According to Jinshi Data, the prospects for a diplomatic resolution to the US-Iran war remain bleak, but analysts believe that there is still a channel for reaching an agreement.Turkey, Egypt, and Pakistan, as mediators, are pushing for US and Iranian officials to meet as soon as this week. US President Trump and his political allies have expressed a positive attitude towards negotiations. It is reported that the US and Israel have temporarily removed Iranian Foreign Minister Abbas Araghchi and Parliament Speaker Mohammad-Bagher Ghalibaf from the assassination list for 4 to 5 days to create conditions for the negotiations to start.The demands of both sides after the war have significantly exceeded their pre-war positions. Iran demands that the US compensate for war damages, close military bases in the Middle East, and charge shipping companies passing through the Strait of Hormuz; the US demands that Iran stop uranium enrichment, restore freedom of navigation in the Strait, and limit its missile program and support for regional militias.Analysts believe that if both sides determine that the cost of war is unbearable, they may first reach a ceasefire agreement and postpone core issues such as uranium stock disposal, verification mechanisms, and sanctions relief to subsequent negotiations. Michael Singh from the Washington Institute stated that a path for a minimum ceasefire agreement to proceed alongside a complete agenda is still feasible.

The Chief Information Security Officer of Slow Fog Technology, 23pds, posted on platform X reminding all users to update their iOS systems in a timely manner. The DarkSword attack program has been leaked, and its core capability is: to extract forensic-level data from iOS devices via HTTP interfaces.In actual attacks, attackers can use social engineering or watering hole attacks to lure users into falling victim, thereby stealing data from iPhones/iPads and uploading it to servers controlled by the attackers.

According to the Israel Times, 26-year-old Israeli "Iron Dome" defense system reservist Raz Cohen is accused of leaking sensitive military secrets to Iranian agents and receiving approximately $1,000 in cryptocurrency as payment. He could face life imprisonment or the death penalty.Investigations show that over several months, he disclosed operational details of the "Iron Dome" air defense system, locations of air force bases, and a list of Israeli officials to Iranian intelligence personnel.

According to TechCrunch, there was a recent incident of an AI Agent going out of control within Meta. An employee posted on an internal forum seeking technical assistance, and another engineer immediately called upon the AI Agent to help with the analysis. However, the Agent unauthorizedly published a response and provided incorrect advice.After the employee acted on the AI's suggestion, it resulted in a large amount of company and user-related data being accessed by an unauthorized engineer for up to two hours. Meta classified this incident as "Sev 1," which is the second highest level of internal security incidents within the company.It is worth noting that this is not the first time Meta has encountered issues with AI Agents going out of control. Summer Yue, Meta's Director of Superintelligent Security and Alignment, previously stated that her OpenClaw Agent had unauthorizedly deleted all the contents of her inbox without confirmation.

The Chief Information Security Officer of Slow Fog Technology, 23pds, issued a reminder stating that ClawHub developers should be aware of phishing and credential leakage risks. Currently, ClawHub relies on developers' GitHub one-click login. Previously, the Sha1-Hulud worm stole a large number of developers' GitHub credentials, and attackers may take the opportunity to attack Skills.The attack path is: credential theft → attacker gains GitHub permissions → logs into ClawHub as a developer → publishes malicious Skills to implant backdoors → users download and install, executing malicious code leading to system intrusion.

Israeli data security startup Jazz announced the completion of a total of $61 million in funding to build an AI platform for enterprise data leak protection.This Seed and Series A round was led by Glilot Capital Partners and Team8, with participation from Ten Eleven Ventures, Merlin Ventures, Encoded Ventures, and MassMutual Ventures.Jazz stated that its AI agent can learn the business processes and data context of enterprises, automatically identifying potential data leak risk scenarios, including improper use of AI chatbots by employees. Currently, Jazz has been in operation for about 7 months and has 15 paying enterprise customers, with specific valuation undisclosed.

Web3 security company GoPlus stated that the AI development tool OpenClaw has recently been reported to have experienced a self-attack security incident. During the execution of automated tasks, the system constructed an incorrect Bash command while calling Shell commands to create a GitHub Issue, inadvertently triggering command injection, which led to the exposure of a large number of sensitive environment variables.In the incident, the AI-generated string contained a set wrapped in backticks, which was interpreted by Bash as command substitution and executed automatically. Since Bash outputs all current environment variables when executing set without parameters, this ultimately resulted in over 100 lines of sensitive information (including Telegram keys, authentication tokens, etc.) being directly written to the GitHub Issue and publicly published. GoPlus recommends that in AI automation development or testing scenarios, API calls should be used instead of directly concatenating Shell commands, and the principle of least privilege should be followed to isolate environment variables. Additionally, high-risk execution modes should be disabled, and a manual review mechanism should be introduced for critical operations.