Head of Research @icmdotrun Crypto Class of 2021 | On-Chain Sleuth | $ICM $SOL $BNB https://xitter.twitterapi.xyz/t.co/vxYY8MIptQ
International
Joined August 2021
- Tweets11.4K
- Following1.7K
- Followers3.6K
- Likes17.2K
Pinned Tweet
For people who do not understand how bad the situation is, their most liquid pool is on ETH which has $2.8M. When this gets liquidated, selling this stake on that pool today gets you $2.8M (basically the whole pool).
@Dolomite_io has no way to liquidate this and come out as whole from this situation. The stablecoins that were borrowed belonged to people who people who deposited on Dolomite for earning yield. When they go to withdraw it, they will not be able to do so.
@CoreyCaplan3 is the founder of @Dolomite_io and the CTO of @worldlibertyfi. He has not commented so far but he seems to be in the right position to suggest this Dolomite rug. It is at the expense of depositors on Dolomite.
🚨 $WLFI Team has now borrowed $150M worth of USDC against 5% of $WLFI supply. $WLFI has less than $10M in core assets all their DeFi pools on all chains combined.
@Dolomite_io is rugging. Their founder is the CTO of @worldlibertyfi so you know he's aware of this. Despite several alarms raise, he hasn't said anything on this topic.
🚨 The fake @AcrossProtocol site drained about $410K on six chains today.
From the chain (UTC):
- 19:00 the attacker's wallet gets its first funds
- 19:02 the first wallet is drained
- 19:05 the team warns users off the site
- 20:09 one wallet loses 148 ETH it had deposited in Aave ETH
The domain's nameservers were changed at its registrar.
If you connected to the Across site today, revoke your approvals.
Update your iOS asap. Make no mistakes. 🫣
🚨 SlowMist TI Alert: iOS sandbox escape 0day PoC “worse_query” disclosed 🚨
A public PoC for a sandbox escape 0day, worse_query, targets iOS 26.0–26.7.2 and iOS 27.2. It is the successor to bad_query. 📱
⚠️ This is a container sandbox escape, not a jailbreak. It breaks the assumption that apps can’t see each other: a malicious app that successfully exploits it can reach system paths and read or modify other apps’ data.
💸 The bug does not steal assets by itself. The real risk starts when a user installs an app from an untrusted source, such as a sideloaded IPA. If a wallet stores its seed phrase, keystore or WebView cache in plaintext locally, a malicious app could read it.
🛡️ Recommendations:
🔸 Don’t install IPAs or apps from unknown sources
🔸 Keep iOS up to date and install Apple’s fix as soon as one is released
🔸 Wallet developers: don’t store sensitive data in plaintext locally
🔸 If you installed an untrusted app on a device holding wallets, treat it as risky and consider moving assets to a new wallet created on a clean device
🔗 github.com/forcequitOS/worse…
2
5
842
Apple's Nov 9 update (27.2.1 / 26.7.3) doesn't list a fix for this one yet. So update, and also delete any app you didn't get from the App Store, especially the Apple Intelligence/eSIM "unlockers" going around this week.
Apple's notes: support.apple.com/en-us/1497…
1
214
.@Enter_Elysium opens to the public tomorrow. Right now, bots are sandwiching its users with access that only Elysium and its whitelisted partners have.
Until launch, only partners can send trades straight to the sequencer. Everyone else's trades go to a public queue on HyperEVM.
How it works:
- You sign a trade, and your frontend posts it to the public queue
- A bot with direct access sends your trade straight to the sequencer, between its own buy and its own sell
- Your trade runs inside the sandwich, earlier than through the public queue
In the last 24 hours:
- 743 sandwiches by 19 bot wallets, hitting 485 wallets
- The main bots send every trade straight to the sequencer
- The bots are still trading
The team:
- Says it revoked one partner's access, according to builders in its chat. The bots haven't stopped
- Has said nothing about it on X
- Community members report they're being muted in Telegram for asking
There are two fixes: revoke all whitelist access, or open the official RPC to everyone.
The team has done neither 🤷♂️
Do better.
Update: @Web3Auth has confirmed that the addresses in my post are the wallets it used to rescue users' funds, not the thief's. They hold about $6.0M.
Web3Auth started moving funds into them at 20:52 UTC on Nov 6 and only named them 33 hours later, while they were being reported everywhere as the attacker's.
There was no reason to hold them back. The attacker knew those wallets weren't his, and once Web3Auth said it was securing funds, naming the wallets gave him nothing. Keeping them quiet only left users unable to tell a rescue from a theft and caused unnecessary panic.
Don't disable LSM. It could block the recovery of staked ATOM.
The theft did happen:
- At least $1.0M taken, starting 01:28 UTC on Nov 5, 44 hours before Web3Auth paused its service
- $878K swept from victims on Osmosis, almost all bridged to Ethereum, and $128K taken from victims' THORChain balances
- About 2.4 BTC already cashed out through THORChain
One account was drained again after the rescue, so the leaked keys still work. Don't send new funds to those accounts.
Attacker addresses in the reply.
The Keplr Google/Apple login drain is big.
On-chain, the unauthorized transfers all go to one address, the same key on five chains: Cosmos Hub, Osmosis, Celestia, Akash and dYdX. As of 11:14 UTC it holds about $4.1M:
- 1.73M ATOM, 1.30M of it taken out of staking
- About $1.04M of tokens on Osmosis
- 651K AKT, 540K TIA and 612K DYDX
More than 29,000 wallets were emptied on Osmosis alone, one transfer each. It's still receiving funds, and nothing has moved out yet.
If you created your @keplrwallet with Google or Apple:
- Move your liquid funds to a new wallet with a fresh recovery phrase or a hardware wallet
- If you have staked ATOM, disable stake tokenizing (LSM) on that account so it can't be converted and moved
Receiving addresses:
osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw
cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu
celestia1atuap9kfnt6y8ykvn3437e7j3z8qffh33pzt53
akash1atuap9kfnt6y8ykvn3437e7j3z8qffh3ds7uhx
dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt
The whole point of self-custody is that you do not support someone else having the ability to interact with or control your funds. As a rule, avoid using these QoL Web2 features.
The wallets below are not on Web3Auth's recovery list.
Osmosis collectors
osmo1qpxdzl5hcu8qjk6g5yfyr2mr7079zlsx6hnx29 (from 01:28 UTC Nov 5)
osmo1msjpr3kdzymxrsfce3tlhzhjujxkna7qse2qjm (from 00:55 UTC Nov 7)
Ethereum landing wallets, all created Nov 5 to Nov 7
0xeaaa5fca4c7daa7bb99b3ece6da68040f916d857
0x08b7173a877e2ac83727550a5a355ae89aaf3e23
0xeeb6a049c69eb1ffe98745260b563b8edd1af29c
0x191679e0cbce09216383255a2a6e90eea59dea6d
Consolidation wallet
0x531f1d541fec4a6a6439e7651620f66f8d854c1d
THORChain swaps to Bitcoin
0x9617ffbcfa4e615c21a4774a61e4c944a6b28b7564ea2cc76128b53a0e0ad055 (14.17 ETH)
0xa92ce2a8afd7cc03a0d26cddb15d8d64920b064ecad86bdea71fac1ae9b55c85 (14.5 ETH)
156
The Keplr Google/Apple login drain is big.
On-chain, the unauthorized transfers all go to one address, the same key on five chains: Cosmos Hub, Osmosis, Celestia, Akash and dYdX. As of 11:14 UTC it holds about $4.1M:
- 1.73M ATOM, 1.30M of it taken out of staking
- About $1.04M of tokens on Osmosis
- 651K AKT, 540K TIA and 612K DYDX
More than 29,000 wallets were emptied on Osmosis alone, one transfer each. It's still receiving funds, and nothing has moved out yet.
If you created your @keplrwallet with Google or Apple:
- Move your liquid funds to a new wallet with a fresh recovery phrase or a hardware wallet
- If you have staked ATOM, disable stake tokenizing (LSM) on that account so it can't be converted and moved
Receiving addresses:
osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw
cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu
celestia1atuap9kfnt6y8ykvn3437e7j3z8qffh33pzt53
akash1atuap9kfnt6y8ykvn3437e7j3z8qffh3ds7uhx
dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt
The whole point of self-custody is that you do not support someone else having the ability to interact with or control your funds. As a rule, avoid using these QoL Web2 features.
We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. We flagged this to the @Web3Auth team and have been working with them on the investigation since.
Based on our initial assessment: if you created your Keplr wallet with a recovery phrase or a hardware wallet, you are NOT affected.
If you created your Keplr account with Google or Apple login, your account may be affected. While we investigate:
– Do not send new funds to that account.
– Do not re-import or recreate it anywhere.
– Google/Apple login is paused for now.
– Trust updates only from this account. Ignore DMs or links offering “recovery”.
We will share verified details and next steps here as soon as we have them.
Update: @Loopscale has frozen what was left of the attacker's position.
After the Nov 5 attack, the attacker still held 57,861 shares of Loopscale's $USDC vault (worth about $64.5K).
These shares were found yesterday and flagged privately to the Team, so the attacker wouldn't get a warning to move them. I held this until they were frozen.
Today, at 05:02 UTC, it froze the attacker's share account. Those shares can no longer be moved or redeemed, saving $64.5k.
Today, 06:09 UTC: 586k $USDC was pulled from the USDC Genesis Vault for 465 shares, right after a 65,000 USDC deposit. About $520K net.
As of 11:50 UTC, nothing has gone back into the USDC vault. Its USDC account is still 586,000 lower.
The users are yet to make whole and I wonder why they broke their silence on this after 4 days.
Freeze Transaction: solscan.io/tx/2xeoX4Pe9HUYxa…
1
243
Today, 06:09 UTC: 586k $USDC was pulled from the USDC Genesis Vault for 465 shares, right after a 65,000 USDC deposit. About $520K net.
As of 11:50 UTC, nothing has gone back into the USDC vault. Its USDC account is still 586,000 lower.
The users are yet to make whole and I wonder why they broke their silence on this after 4 days.
It looks like @Loopscale, a Solana lending protocol, lost 4,597 SOL (~$431K) to an exploit on Nov 1. I couldn't find them acknowledging or confirming it yet.
How: the attacker bought 1 kySOL for about $123 and deposited it as collateral, labelled as zBTC. Loopscale priced it as bitcoin. Read with zBTC's 8 decimals instead of kySOL's 9, that 1 kySOL counted as 10 zBTC, about $777K.
In the same transaction the attacker took a 1-day loan of 4,597 SOL from a Loopscale SOL vault. It fell due at 19:41 UTC on Nov 2 and wasn't repaid. The only collateral behind it is that 1 kySOL.
The loss sits in that vault, about 8% of its ~55,600 SOL, unless Loopscale covers it.
CC: @Luketruitt @marygooneratne
Update: Loopscale has covered the bad debt using their funds. This has made the vaults whole again for the second time.
Transaction:
solscan.io/tx/3un54iDCzjRBMW…
It looks like @Loopscale, a Solana lending protocol, lost 4,597 SOL (~$431K) to an exploit on Nov 1. I couldn't find them acknowledging or confirming it yet.
How: the attacker bought 1 kySOL for about $123 and deposited it as collateral, labelled as zBTC. Loopscale priced it as bitcoin. Read with zBTC's 8 decimals instead of kySOL's 9, that 1 kySOL counted as 10 zBTC, about $777K.
In the same transaction the attacker took a 1-day loan of 4,597 SOL from a Loopscale SOL vault. It fell due at 19:41 UTC on Nov 2 and wasn't repaid. The only collateral behind it is that 1 kySOL.
The loss sits in that vault, about 8% of its ~55,600 SOL, unless Loopscale covers it.
CC: @Luketruitt @marygooneratne
Update: Loopscale has quietly made its lenders whole.
A Loopscale multisig (its signers include the protocol's admin key) pulled 4,750 SOL of its own deposit out of the hit vault. Minutes later, its liquidator used it to pay off the bad loan, sending 4,598.43 SOL back into the vault.
Still no public statement.
Transaction:
solscan.io/tx/47zp5i14ERm2so…
Do check if you recently used the docs for any of these platforms🤷♂️
We’re addressing a security incident affecting GitBook. Some services are temporarily offline while our team restores them safely.
More information: gitbook.com/status/security-…
Live updates: status.gitbook.com
Timeline (UTC):
Nov 1
19:33 - the home wallet funds a fresh wallet with 2 SOL
19:38 - the fresh wallet buys 1 kySOL on Jupiter
19:41 - deposit + 4,597 $SOL loan, one transaction
19:50–20:01 - the 4,597 $SOL is bridged to Ethereum via Relay: 190.22 ETH
Nov 2
15:00 an on-chain offer to the thief: return 171.21 ETH, keep 19.01 ETH (10%). etherscan.io/tx/0xa60436d37b…
18:16 the thief sends 30.2 ETH back to Solana, into the same wallet that funded the attack
1
4
701
Receipts:
Attacker wallet (Solana) 247Lk5YNH9URfBBvxVUtDruz8GvGX8gKGuYHVCZThpiR
Exploit tx solscan.io/tx/mZCoHzevv7nrPs…
Bad loan Gb2qCYLs3dEy6D4TvdLYr7wRDMMWDCPR9oK5SzNa5Gtn
Vault U1h9yhtpZgZsgVzMZe1iSpa6DSTBkSH89Egt59MXRYe
Attacker's home wallet (Solana, holds the USDC) 2ByCbD4ZdwPH19DaHa6gqaMZoqUCvg84BRVFPWxJtMvw
Attacker on Ethereum 0xB7Ec7eF24FD73f3000C651CA9D0Fa45b61DcF854
4
496
Binance hack continued:
- XRP was actually hit first, at 20:05 UTC: 233M XRP left Binance accounts
- 970K SOL followed at 20:10
- the attacker raced the freezes, swapping 435M USDT to ETH and borrowing 19,762 ETH on Aave against 60M USDT, 12 seconds before Tether’s blacklist
- Binance 14 was swept five times in total; the hijack was only revoked at 00:10 UTC, 3h50m after the takeover
- Arbitrum’s Security Council froze $30.5M
- Binance says it will cover all losses; deposits and withdrawals are suspended
~$6.2B taken across 9 chains. $2.54B frozen, per Binance.
The Binance hack so far:
- attacker deploys a sweeper contract, gas paid through Tornado Cash
- attacker’s address starts receiving funds on Base, then Optimism
- 18,270 BTC leaves a Binance hot wallet
- 612.7M USDT and 46M TRX are taken on Tron
- Binance 14 gets pointed at the sweeper via EIP-7702
- one call sweeps 167K ETH and 1.6B USDT from it, $2.54B
- Binance 16, Arbitrum and Avalanche wallets send more
- 823M USDC is pulled from a Binance smart account
- Tether starts freezing, 1.57B USDT in total
- Binance 14 gets swept a second time
- Circle freezes 823M USDC
- CZ: “It does look like a hack on Binance”
- attacker moves unfrozen tokens and starts selling UNI, PEPE and RLUSD
- third sweep takes 200M USDT, which lands frozen
- Binance halts withdrawals until the security issue is resolved
- Ripple freezes 40.5M RLUSD
- Tether blacklists Binance 14 itself
- WLFI and BitGo freeze 27.8M USD1 and 48.5M WLFI
~$5.8B taken. ~$2.7B frozen. ~397K $ETH and 18,270 $BTC still with the attacker.
Binance 14 is still pointed at the attacker’s sweeper.
The Binance hack update:
- Binance's first finding: a compromised DevOps engineer's laptop let the attacker into a service container that could submit withdrawals, with no sign of a private key leak
- its 08:47 UTC update says the investigation has since found additional points of breach
- TRM Labs attributes the hack to North Korea's TraderTraitor unit, with high confidence. Chainalysis also says North Korea
- Chainalysis says the stolen funds are mixing with money from last month's $387M Bitget hack
- a Tron wallet fed with stolen TRX is swapping through THORChain into the same Ethereum address as that Bitget money
- more stolen TRX went through Bitget Wallet's bridge to an address linked to the 2025 Phemex hacker
- Binance says outflows stopped when it paused withdrawals. On-chain, about $55M more was swept from Binance 14 after it said at 22:15 that withdrawals were paused, until the 00:10 revoke
- the attacker tried to bridge gas money to Optimism, where 44.2M stolen OP sits. The transfer has been stuck at LayerZero verification for over 3 hours
- 17,260 ETH moved to a new wallet, the 18,270 BTC and 233M XRP haven't moved
- withdrawals are due back in about 45 hours. Deposits are working
~$6.3B taken, ~$3B frozen.
193