Background According to intelligence from the SlowMist Security Team, on November 23, 2023, the decentralized trading platform KyberSwap was attacked, resulting in the attacker stealing approximately $54.7 million. We immediately conducted an analysis of this incident and these were our findings. Root Cause Due to the Reinvestment Curve feature of KyberSwap Elastic pool…

Background Recently, the SlowMist security team received intelligence that scam websites impersonating have emerged. These fraudulent websites misuse the SlowMist’s logo and name to conduct scams related to wallets and trading platforms. According to the data we found, there have been 13 incidents of fraud linked to these fake SlowMist websites.

November 22, 2023, SlowMist and Sinohope Technology Holdings Limited (stock code: 1611.HK, “SINOHOPE”), a comprehensive digital asset custody platform, announced a strategic partnership uniting the two companies. The two parties will carry out active security business cooperation in MPC security audit, digital asset Anti-money laundering (AML), Web3 threat intelligence cooperation…

Background From November 14th to 17th, the Solana Hacker House held a four-day offline event in Hong Kong, featuring on-site guidance from core engineers at Solana Labs, supported by mentors from various ecosystem teams. Johan, our head of blockchain security at SlowMist Security, was invited to deliver a presentation titled “Advanced…

Background Recently, a new phishing scam has caught our attention. This scam typically occurs in chat applications like Telegram, beginning with off-exchange transactions. Before the actual transaction, the scammer asks the victim to transfer a small amount, say 0.1 USDT, to verify if their address poses any risks. The scammer then…

Background On October 14, Twitter user Masiwei reported a malicious code targeting friend.tech for account theft.

Background In the Web3 world, phishing incidents involving fake apps are quite frequent. The SlowMist Security Team has previously published articles analyzing such phishing cases. Due to the inaccessibility of Google Play in China, many users often resort to searching for and downloading apps directly from the internet. However, the types…

By: Kong’@SlowMist Security Team Introduction This skill chart is a compilation of the abilities required for SlowMist’s security team’s smart contract security auditors. It aims to enumerate the essential skills needed for smart contract security audits and inspire team members to adopt a mindset of research, innovation, and engineering evolution. Smart…

Recently, Nomura Securities Co., Ltd. of Japan and Kudasai Corp. have formally partnered to enhance the content dissemination of the Web3 learning application “Web3 Pocket Campus”. SlowMist will contribute by providing high-quality research reports and content as teaching materials to support Web3. As a leading blockchain security company, SlowMist not…