Security
FomoPeek: iOS Malware With a Kernel Exploit Framework Passed Apple's App Store Review — Binance and SlowMist Warn Users
Binance Wallet issued an urgent advisory after SlowMist and OKX found that FomoPeek versions 1.1 and 1.2 — distributed through the official App Store — contained an iOS kernel exploitation framework able to escape the sandbox, decrypt Keychain data and harvest private keys and seed phrases from other apps. Version 1.3 removed the code; anyone who ran the affected versions is advised to rebuild their wallet on a clean device.
RatHat: Android Malware Ships an AI-Guided Navigation Engine to Drain Banking and Crypto Apps
Security Digest: The Last Meter — September 21
Latest News
One Attacker, Two Protocols: Linked Exploits Drain $2M From Fetch.ai and NuNet
A single attacker drained 8.7 million FET (about $1.53 million) from a Fetch.ai token converter contract, then used the same wallet to mint 408.5 million unauthorized NTX through NuNet's deployer account — roughly $2 million combined. SlowMist traces the Fetch.ai root cause to an authorization gap in TokenConversionManagerV3's conversionIn(). Neither team has issued an official statement.
US Treasury Sanctions Iranian Exchange BitBank in Alleged IRGC Bitcoin Pipeline
OFAC designated the Iranian crypto exchange BitBank, its developers and three associates on September 18, alleging the network transferred hundreds of millions of dollars in Bitcoin to the Islamic Revolutionary Guard Corps. The action extends the Operation Economic Outcast campaign that earlier sanctioned Shelbit and Aban — and all allegations remain unadjudicated.
Security Digest: What a Signature Is Worth — September 20
Today's thread is authorization: the Fetch.ai exploit trusted one signature where the contract should have demanded more, the S&P–OpenZeppelin deal prices exactly that kind of assurance, Gyazo's metadata leak shows what happens when the proof behind a link leaks, and Japan's NPA officially attributes the ¥1.7B WaterPlum campaign. Plus the status board: Liquid peg-outs, Chainflip claims, Revolut extortion, Kelp DAO, Swiss Bitcoin Pay — all unchanged.
S&P Global to Acquire OpenZeppelin, Folding Smart Contract Audits Into Credit Ratings
S&P Global has agreed to acquire the smart contract security firm OpenZeppelin and will run it as a business unit reporting to S&P Global Ratings. Terms were undisclosed. The deal merges code-level security assurance with issuer-level ratings under one division — the clearest signal yet that on-chain code quality is being treated as rated credit infrastructure.
Cardano's IOG Warns Users After Official YouTube Channel Hijacked for Suspected Deepfake Hoskinson Giveaway
Input Output Group told users to avoid its YouTube channel on September 18 after an apparent takeover carried a roughly two-hour livestream — dressed as a Project Catalyst town hall — in which a suspected AI-manipulated Charles Hoskinson promised to 'double your wealth' via a QR code. No losses have been verified.
Targeted Cyberattack on Institutional Provider Haruko Hit 15 Clients; Some Hedge-Fund Assets Lost
The London-based crypto technology provider said a group attacked Haruko itself, exploiting a process vulnerability to extract an access token and capture read-only exchange API details from memory. All 15 affected clients were those without IP whitelisting — and a small amount of their funds was stolen, according to people familiar with the incident.
Security Digest: The Trusted Channel — September 19
Today's stories share one mechanism: attackers operating inside channels victims already trust — a recruiter's coding task, an official YouTube channel, a vendor's own access token, a certified police mailbox. Plus the status board: Liquid peg-outs still paused at day 14, Chainflip's restart resets TRON provider balances to on-chain claims, the Revolut extortionists' countdown expires, Kelp DAO and Swiss Bitcoin Pay unchanged — and the Symbiosis root cause lands as a two-bug report.
FBI and Japan's NPA Attribute $10.7M Fake-Recruiter Campaign to North Korea's WaterPlum
A September 18 joint advisory from Japanese, US, Australian and German agencies says WaterPlum — widely known as Contagious Interview — infected 30,000+ devices across 100+ countries and drained at least $10.7 million from crypto wallets between December 2025 and July 2026, using fake job interviews aimed at developers.
Study: 94% of Losses at Audited DeFi Victims Fell Outside Their Audit Scopes
A preprint from ack3-affiliated researchers and Czech Technical University examined 135 DeFi incidents from H1 2026 ($939.86M in losses) and found that where audits existed, 94.4% of reported losses came from attack paths outside every identified audit scope — though two large incidents dominate the figure.
Incident Analysis: The 20-Bit Gap That Let ICON's Withdrawal Path Be Replayed 1,490 Times
ICON Foundation's post-mortem of the August 27 replay exploit traces the loss to an integer-precision defect: the uniqueness check validated unsigned high bits of a serial number while the signature covered only the low 256 bits — a boundary two audits never crossed.
Security Digest: The Assurance Boundary — September 18
Today's edition is organized around one theme: the gap between what was reviewed and what was deployed. Plus the status board — Liquid peg-outs still frozen at day 13, Chainflip reimbursements still unexecuted, Kelp DAO still silent since the freeze expired, Swiss Bitcoin Pay still dark, and SecondFI rolls out a recovery tool in stages.
Beyond Lazarus: Researchers Split North Korea's Crypto-Hunting Apparatus Into Six Clusters
A September 7 joint analysis by Sekoia and Kudelski Security maps North Korea's offensive cyber operations into six distinct clusters — with the former APT38 lineage now concentrated in two units focused on cryptocurrency, Web3 and blockchain targets.
Chainflip's $736K TRON Exploit Was a Memo Problem, Not a Bridge Break
Chainflip lost 736,442.17 USDT after an attacker attached new memos to already-signed TRON transfers, tricking the protocol into paying twice against single deposits. The September 12 incident, confirmed by the protocol itself, exposed an instruction channel most chains never use — and the network is still paused.
Fake Cloudflare Checks Push Malware to Meme Coin Traders — One Reports $600K Loss
Phishing pages impersonating Cloudflare verification screens are being planted in token metadata fields on aggregator listings, then instructing victims to run a payload with administrator privileges on Windows. One trader reported losing about $600,000. The campaign skips wallet approvals entirely — it asks for code execution instead.
Security Digest: Attackers Are Routing Around On-Chain Defenses — September 17
Today's two research stories share one theme: campaigns that never touch a wallet approval. Plus the status board — Liquid at day 12 with 598.5 BTC still held, the Kelp freeze window expired with no announced resolution, Chainflip still paused, and follow-up reporting puts the Revolut breach at about 680 high-value accounts.
TRM Labs: Fake AI Trading Bot Tutorials Turn Victims Into Their Own Drainer Operators
Nine near-identical YouTube tutorials promising a Claude-built arbitrage bot walked 224 victims into deploying and funding malicious contracts themselves — 274.60 ETH, about $517,000, drained between February and August 2026. No phishing link, no spoofed domain, no approval prompt: wallet defenses never fire.
DOJ Charges Two Former Robinhood Engineers Over Alleged Listing Front-Running on Hyperliquid
Federal prosecutors in Manhattan say Hefu Chai and Huaisong Xiang misappropriated confidential information about upcoming Robinhood Crypto listings and traded perpetual futures ahead of public announcements. The case is a reminder that listing calendars are among an exchange's most sensitive security assets — and that trading-venue integrity now reaches into DeFi.
Attacker Drains $7.8M in rsETH From Ethereum Safe — and an MEV Bot Takes It First
A leveraged rsETH position was drained from a Gnosis Safe through an over-permissioned custom module routed into an attacker-controlled Uniswap v4 pool. A generalized MEV bot front-ran the exploit in the same block and captured the tokens, and Kelp DAO froze the receiving address. Security firms are unanimous: this was module-authorization abuse, not a flaw in Safe core.
The rsETH Theft Is the Latest Warning About Smart-Wallet Modules
The $7.8M loss reconstructed by Blockaid, SlowMist and BlockSec came down to one over-permissioned helper contract the Safe owner had whitelisted. The pattern — attacks moving to the edges around well-reviewed core contracts — has been visible since Bybit, and it has specific implications for how modules should be reviewed, scoped and monitored.
Security Digest: The Ongoing-Incident Tracker for September 16
One lead story — the rsETH Safe-module theft front-run by an MEV bot — plus a consolidated status board for every major security incident still in motion: Liquid Network peg-outs frozen, Symbiosis hunting its attacker, Swiss Bitcoin Pay offline, the Revolut extortion, and the Kelp DAO freeze watch.