@ChainBountyX

ChainBounty is a decentralized platform that helps solve security challenges in the crypto space.

chainbounty.io
Joined November 2024
  • Tweets995
  • Following188
  • Followers695
367Media
A final NFT balance check is not enough if the call can also move assets the contract already owns.
Quit
@0xQuitOct 27
gm gm here we go again. This morning somebody abused a bug in ApeStr to swap 21 apes for 21 ApeStr-owned apes. This was a known exploit (see the SQUIGSTR exploit from ~1 year ago) but incentive to run it was never there. The bug lies in buyTargetNFT: it forces a strategy contract to send arbitrary calldata to any target. Afterwards it checks only three things: its BAYC balance rose by exactly 1, it owns expectedId, and "cost" equals its ETH balance drop. This was patched in later NFTStrategy releases, but affects the original 6 (PunkSTR not affected). The attacker bought 2 BAYC to use as bait. Using a helper contract, they prep the strategy contract by selling an ape to it for 5 wei and immediately buying it back for 6 wei. That primes the contract's ethToTwap with 6 wei. They then call buyTargetNFT and pass the calldata to transfer an ape from ApeSTR to the helper using safeTransferFrom. This in turn hands execution over to the helper (remember, safeTransferFrom is NOT safe), which transfer TWO apes back to ApeSTR to satisfy the balance check (1 out, 2 in leaves ApeSTR at +1). It also calls processTokenTwap, which converts the 6 wei, setting the cost of one of the newly deposited apes to 7 wei (6 * 120%). The helper contract buys it back in the same tx. example flow: - Attacker has BAYC #1 and #2. ApeSTR has BAYC #3. - Attacker "sells" BAYC #1 to ApeSTR for 6 wei and sends BAYC #2 to it for free, but steals BAYC #3 in the process. - ApeSTR relists BAYC #1 for 7 wei, which the attacker buys. - Attacker now has BAYC #1 and BAYC #3, and ApeSTR has BAYC #2 (but doesn't even know it). The attacker ran this for all 21 BAYC in the ApeSTR contract, resulting in them being able to claim packs for all of those BAYC. Total net proceeds: $14k. This previously affected SQUIGSTR because of their shared contract - any art blocks NFT sent in would satisfy the balance check, allowing the attacker to drain the contract of squiggles in exchange for basically valueless art blocks NFTs. It was known to be possible on ApeSTR as well, so I guess it was just a matter of time before we saw it happen. The unfortunate consequence is that now, ApeSTR has 21 apes that it is completely unaware of, so they cannot be bought from the contract. And 210 attacker-owned mudwater packs were dumped into bids.
50
Sorry you're going through this. If you'd like, share your case and public transaction hashes with the ChainBounty community to ask for help: community.chainbounty.io/ Never share seed phrases or private keys.

ChainBounty - Decentralized CryptoCurrency Crime Bounty Platform

Empower investigators, fight scams and cyber threats, and earn rewards with ChainBounty's decentralized bounty system

community.chainbounty.io
Ricardo Lima Jr@Ricardo_Hunter_Oct 26
Replying to @Rabby_io
Rabby, my wallet was drained. I emailed [email protected] & tried your chat, but I'm still waiting for help. The delay is unacceptable—this is urgent. Years of retirement savings were stolen. Please escalate my case to your security team & respond ASAP.
59
Even without lost funds, a suspected tampered device can provide valuable evidence—purchase records and photos may help investigators trace how it reached the user.
Tay 💖
@tayvano_Oct 27
I know with all the other shit going on everyone has forgotten about the implanted Ledgers in the wild. But if you know of any (drained or not) please keep sharing information, photos, purchase date + location, etc. Come to @SEAL_911. Tag me. Tag @MagicalTux. Tag @Ledger. 🙏
59
A familiar website is not enough—verify the full deposit address through an independent, trusted channel before sending funds.
SlowMist
@SlowMist_TeamOct 27
🚨 Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Deposit Addresses @SlowMist_Team recently detected an attack involving malicious code injected into scripts associated with the #Udesk customer service system during routine threat intelligence investigations. We obtained and analyzed two #JavaScript samples to trace how the malicious code was loaded into webpages and executed. 🔍 Further analysis revealed two key malicious behaviors: 🔹 The malicious script collects cookies, localStorage, sessionStorage, and sensitive information submitted through forms and authentication requests, potentially exposing user sessions and account credentials. 🔹 The script replaces deposit addresses displayed on specific websites and tampers with clipboard contents, potentially redirecting deposits to substituted recipient addresses. MistEye (misteye.io), SlowMist’s Web3 threat intelligence system, promptly disseminated the relevant risk information through its intelligence push and customer alert channels.🫡 🛡️ Recommendations: Stop serving compromised scripts and restore trusted versions. Investigate data exfiltration records, revoke potentially exposed sessions, and rotate potentially exposed credentials from a clean environment. Independently verify deposit addresses and transaction records through trusted channels. Read the full analysis 👇 slowmist.medium.com/threat-i…
62
🚨 In Electrum’s fee-bump attack, the signature is real—the payment history it is built on is not. #ChainBounty #Electrum #Bitcoin
Electrum@ElectrumWalletOct 24
Replying to @ElectrumWallet
Vulnerability disclosure: github.com/spesmilo/electrum…

Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

### Summary The main Electrum server the client connects to is trusted with mempool ("unconfirmed") transactions. This is documented [design](https://electrum.readthedocs.io/en/latest/...

github.com
1
1
164
🚨 Keystone says an intruder obtained customers’ names, contact details, shipping addresses and order information from its website. It detected unauthorized access on October 20 and confirmed the theft on October 23 after checking API activity with Shopify. The company says payment card/bank details, recovery phrases, private keys and wallet passwords were not exposed. That is its disclosure—not an independent forensic finding or evidence that Shopify’s platform was breached. The security boundary is customer identity: a delivery address can connect a person’s home to a hardware-wallet purchase. Product and order details can also make fake refund or replacement-device messages look credible, without breaking the device’s cryptography. Keystone says it blocked access and fixed the vulnerability. Its statement does not quantify affected customers or explain the precise entry point; a detailed report is still promised. #ChainBounty #Keystone #DataBreach
🤖 Made with AI
Concept illustration, not evidence or an actual Keystone product: an intact blank graphite security device beside a metal shipping-information plate marked only with a house silhouette, partly exposed from a black sleeve. A restrained red edge highlights exposure of customer shipping identity. Black background, no text or numbers. The intact device does not imply an independent finding about device or private-key security.

ALT Concept illustration, not evidence or an actual Keystone product: an intact blank graphite security device beside a metal shipping-information plate marked only with a house silhouette, partly exposed from a black sleeve. A restrained red edge highlights exposure of customer shipping identity. Black background, no text or numbers. The intact device does not imply an independent finding about device or private-key security.

73
SentinelTX’s Arkadiko / StackSwap report records 213.3 ETH entering a Tornado.Cash Router-labelled address in nine deposits on 23 October. Our analysis follows that Ethereum sequence and separates it from the reported governance attack on Stacks. The distinction is essential: the Stacks-to-Ethereum link remains partial, the reported Bitcoin branch is not established by this investigation, and several upstream amounts carry explicit qualifications. Mixer entry does not identify an operator or prove a completed cash-out. We break down the deposit denominations, explain the conversion and consolidation roles described in the report, and show why earlier service-labelled transactions cannot automatically be treated as proceeds of a later incident. The article also preserves the source’s material inconsistencies rather than forcing them into one loss total. community.chainbounty.io/ko/…
ChainBounty Investigation analysis, dated 26 October 2026. Headline: Arkadiko: Ethereum trail. Subtitle: Nine mixer deposits. Cross-chain links remain partial. Original ChainBounty logo and black serif headline on a white background.

ALT ChainBounty Investigation analysis, dated 26 October 2026. Headline: Arkadiko: Ethereum trail. Subtitle: Nine mixer deposits. Cross-chain links remain partial. Original ChainBounty logo and black serif headline on a white background.

1
1
84
🚨 X100’s checked Ethereum receipts show same-transaction governance execution with 2 of 3 Senate votes. Three selected recipient payments total 4,848,017.339222 USDT—not a complete loss estimate. We also matched the first recipient’s two USDT conversions and an ETH relay’s four 400 ETH outputs. Relay funding exceeds the two swap receipts, so not every wei can be assigned to those conversions. Shared helpers link later executions, but do not establish operator identity. Full evidence and limits: community.chainbounty.io/ko/… #ChainBounty #X100 #Ethereum
ChainBounty research cover on a white background. Black title on the left: X100 / Three executions / One ETH trail. Actual X100 and Ethereum logos on the right, with the gold-and-black ChainBounty logo at bottom left. A dedicated article cover, not a transaction diagram, evidence screenshot or proof of current balances.

ALT ChainBounty research cover on a white background. Black title on the left: X100 / Three executions / One ETH trail. Actual X100 and Ethereum logos on the right, with the gold-and-black ChainBounty logo at bottom left. A dedicated article cover, not a transaction diagram, evidence screenshot or proof of current balances.

1
3
333
🚨 What if a protocol lists real vaults—but sends deposits somewhere else? SlowMist reports a ~$21.9K YapeSwap exploit. Its analysis says WorkersUnion’s zero quorum allowed a proposal backed by roughly 0.000055% of voting power to transfer YapeFactory’s feeToSetter role. The attacker then installed a Registry whose latestVault() returned fake vaults while vaults() still listed real ones. SlowMist says YapePair counted diverted deposits as farming assets without receiving redeemable shares. Our analysis: a familiar vault list does not prove the deposit route is unchanged. Governance can alter the contract that selects the actual destination. The loss and mechanism above are SlowMist’s findings, not our independently reproduced loss calculation or code audit. #ChainBounty #YapeSwap #GovernanceSecurity
🤖 Made with AI
AI-generated conceptual premium 3D illustration of an open graphite vault, a silver mirror hiding its interior and an unmarked silver deposit disc, with one restrained red edge on black. Represents a mismatch between a listed vault and the actual deposit destination. Not actual YapeSwap infrastructure, transaction evidence or recovered funds. No text, numbers or logos.

ALT AI-generated conceptual premium 3D illustration of an open graphite vault, a silver mirror hiding its interior and an unmarked silver deposit disc, with one restrained red edge on black. Represents a mismatch between a listed vault and the actual deposit destination. Not actual YapeSwap infrastructure, transaction evidence or recovered funds. No text, numbers or logos.

1
127
🚨 A crypto-scam extradition is a prosecution step—not a conviction or a recovery announcement. The DOJ says Zheng Zhao was extradited from the Netherlands and arraigned in California on October 23 on a money-laundering conspiracy charge. Authorities identified 174 U.S. victims in the alleged Cambodia-based investment scheme. According to court documents described by the DOJ, more than $36.9M moved through U.S. shell-company accounts to one Bahamas bank account, before conversion to USDT and transfers to a Cambodia-controlled wallet. That figure describes the alleged funding route, not money recovered. Zhao is presumed innocent; guilty pleas by eight co-conspirators are separate legal outcomes. Our analysis: the investigation spans bank records and stablecoin transfers. The extradition announcement alone does not establish which assets remain recoverable. #ChainBounty #CryptoScam #MoneyLaundering
🤖 Made with AI
AI-generated conceptual 3D illustration of two graphite checkpoint frames and one closed silver evidence case with a restrained red clasp, on black. Represents cross-border legal handover, not a real suspect, seized cryptocurrency, a conviction or recovered victim funds. No text, numbers or logos.

ALT AI-generated conceptual 3D illustration of two graphite checkpoint frames and one closed silver evidence case with a restrained red clasp, on black. Represents cross-border legal handover, not a real suspect, seized cryptocurrency, a conviction or recovered victim funds. No text, numbers or logos.

129
🚨 An AUSD freeze is not the same as recovered funds. The Ethereum address linked to the Initia exploit by The Defiant received 1.4M AUSD at 15:01:59 UTC on October 23. Etherscan records show it sent that AUSD into a swap route at 15:03:23 UTC; the transaction returned about 581.56 ETH to the same address. Agora's AUSD contract emitted AccountFrozen for that address at 16:31:59 UTC—roughly 89 minutes after the swap. Agora says its contracts are not deployed on Initia and a separate third-party product using AUSD on Ethereum was affected. Our reading: the freeze restricts AUSD at that address; it does not reverse the earlier swap or freeze the ETH. These records do not establish how much, if any, was recovered. #ChainBounty #Initia #StablecoinSecurity
🤖 Made with AI
Conceptual 3D illustration: an empty silver containment ring with a red latch on a black background, and a silver disc already outside it. A token restriction does not reverse assets moved beforehand. Not an evidence image.

ALT Conceptual 3D illustration: an empty silver containment ring with a red latch on a black background, and a silver disc already outside it. A token restriction does not reverse assets moved beforehand. Not an evidence image.

1
223
🚨 X100's treasury controls were reportedly captured through its voting system. Chainalysis says attackers deployed contracts that took protocol Senate seats, gained a voting majority and forced the Freezer treasury to sell into an attacker-controlled pool. Its October 24 UTC analysis reports approximately $4.7M in stablecoins extracted across three exploit transactions. That is an analyst-reported amount, not our independently reconciled net-loss figure. The security boundary here is the route from acquiring votes to executing treasury actions. Reviewing a spending function alone can miss the authority that selects its caller. The exact seat-acquisition rules, execution safeguards and full loss accounting still require transaction and deployed-code verification. #ChainBounty #GovernanceSecurity #DeFiHack
🤖 Made with AI
AI-generated conceptual premium 3D illustration of a graphite vault and two unmarked silver voting discs, one with a restrained red edge entering the control slot, on a black background. Represents capture of governance authority over treasury execution, not actual X100 infrastructure or transaction evidence. No text, numbers or logos.

ALT AI-generated conceptual premium 3D illustration of a graphite vault and two unmarked silver voting discs, one with a restrained red edge entering the control slot, on a black background. Represents capture of governance authority over treasury execution, not actual X100 infrastructure or transaction evidence. No text, numbers or logos.

122
🚨 NovaTech: promoter settlements and a $1.3B court request are different outcomes. In an October 22 release, New York's attorney general announced nearly $6M in settlements with four NovaTech promoters and permanent industry bans. The office separately asked a court to order the founders to pay $1.3B, following an August 2025 default judgment. The office says the scheme recruited through prayer groups and WhatsApp, using promises of high returns and recruitment bonuses. Settlement obligations, requested relief and payments received by victims are separate measures. Neither headline amount establishes that investors have already been repaid. #ChainBounty #CryptoFraud #LawEnforcement
🤖 Made with AI
AI-generated conceptual 3D illustration of a graphite pyramid with a restrained red seam and a dark metal judicial gavel on a black background. Symbolizes enforcement against a pyramid recruitment scheme, not actual NovaTech assets, a seizure, or victim repayments. No text, numbers or logos.

ALT AI-generated conceptual 3D illustration of a graphite pyramid with a restrained red seam and a dark metal judicial gavel on a black background. Symbolizes enforcement against a pyramid recruitment scheme, not actual NovaTech assets, a seizure, or victim repayments. No text, numbers or logos.

80
WAX bridge: following the Ethereum trail. SentinelTX’s report on the reported 22 October incident records four Ethereum payouts to one recipient: 21,558.252354 USDT, 840.2750339 DAI, 2.54669928 WETH and 0.10993227 WBTC. The narrative describes conversion activity before 15.58 ETH moved to a relay. At 10:43:47 UTC, the relay sent 15.5799958 ETH, displayed rounded as 15.579996 ETH, to an address labelled “HitBTC, Exchange”. That is a concrete investigative lead, not proof of a completed cash-out or the identity of the account holder. Each swap’s ETH output is not itemised, so the full proceeds path remains partial rather than an exact token-to-ETH reconciliation. The reported negative-fee flaw on WAX is a separate source-chain question: the report contains no WAX action records confirming the mechanism or mapping individual withdrawals to these payouts. No traced value flow establishes a link between the Ethereum and Solana recipients. Our analysis focuses on the documented Ethereum trail, the transaction anchors and what remains unresolved. It does not calculate an incident-wide dollar loss. community.chainbounty.io/ko/…
ChainBounty Investigation analysis cover dated 25 October 2026. Headline: WAX bridge: ETH trail. Subtitle: Four token payouts. One ETH relay. An exchange-labelled destination. Black text and the original ChainBounty logo on a white background.

ALT ChainBounty Investigation analysis cover dated 25 October 2026. Headline: WAX bridge: ETH trail. Subtitle: Four token payouts. One ETH relay. An exchange-labelled destination. Black text and the original ChainBounty logo on a white background.

92
SentinelTX’s analysis traces the NEM token exploit from BSC through Relay to Ethereum and CoW settlement. Our review separates reported loss from recorded proceeds. The mechanism is assessed, and the historical ETH balance is unverified. community.chainbounty.io/ko/…
ChainBounty investigation analysis titled NEM / NemTokenV2. From BSC liquidity to Ethereum. Recorded flows; unresolved attribution. Dated 24 October 2026. Source: SentinelTX analysis.

ALT ChainBounty investigation analysis titled NEM / NemTokenV2. From BSC liquidity to Ethereum. Recorded flows; unresolved attribution. Dated 24 October 2026. Source: SentinelTX analysis.

96
🚨 Initia halted its L1 and rollups at 15:41:30 UTC on October 23 following a security incident. Researcher Spreek reported unauthorized token minting and approximately $2.6M converted into other assets, with more still moving. That is a researcher estimate, not a project-confirmed loss total. Initia said it was investigating the impact with security teams, validators and exchanges. Its official notice did not confirm the precise flaw or loss amount. The security boundary is token issuance: creating an unbacked balance becomes an asset-loss problem when it can be exchanged for existing reserves. The amount minted, assets withdrawn and eventual net loss are separate quantities—not interchangeable totals. #ChainBounty #Initia #DeFiSecurity
🤖 Made with AI
AI-generated conceptual premium 3D illustration of a graphite token-minting die with a restrained red fracture and two unmarked silver discs on a black background. Represents a compromised token-issuance authorization boundary, not actual Initia infrastructure or transaction evidence. No text, numbers or logos.

ALT AI-generated conceptual premium 3D illustration of a graphite token-minting die with a restrained red fracture and two unmarked silver discs on a black background. Represents a compromised token-issuance authorization boundary, not actual Initia infrastructure or transaction evidence. No text, numbers or logos.

92
🚨 CoinDCX: following a 15,819,002 USDT transfer—and separating the trail from the sweep explanation. Our bounded TRON review verifies the large transfer, 18 departures from its receiving address to six recipients, and three selected onward transfers. A separate sample shows a deposit collected in 21 seconds on the incident day. The records do not establish the sweep outage's start or cause, recipient ownership, customer credits or cash-out. Collector transfer volume is not the incident's loss total. Full investigation: community.chainbounty.io/ko/… #ChainBounty #CoinDCX #TRON
White 16:9 ChainBounty research cover. Left title: CoinDCX / Transfers and / the sweep gap. Right: original CoinDCX and USDT logos in flat 2D. Original ChainBounty logo at lower left. Cover illustration, not transaction evidence.

ALT White 16:9 ChainBounty research cover. Left title: CoinDCX / Transfers and / the sweep gap. Right: original CoinDCX and USDT logos in flat 2D. Original ChainBounty logo at lower left. Cover illustration, not transaction evidence.

83
🚨 Retiring a deposit address does not stop it receiving funds. CoinDCX says addresses compromised in July 2025 continued to receive user deposits after being deprecated. Its October 22 update says the process for sweeping those deposits failed for a period, causing operational losses that the exchange absorbed. CoinDCX says affected deposits were credited and active wallets were not compromised. Those are the exchange’s statements, not an independently reconciled loss or reimbursement ledger. The security issue is the retirement process: an address can disappear from an app while remaining live on-chain. Old-address deposits need detection and a safe handling path—not just a new address in the interface. #ChainBounty #CoinDCX #ExchangeSecurity
🤖 Made with AI
AI-generated conceptual premium 3D illustration: a graphite deposit receptacle with a broken gate still accepts one unmarked silver disc; a detached gate fragment lies beside it. Black background with restrained red accents. Represents deprecated deposit addresses continuing to receive funds, not CoinDCX infrastructure or transaction evidence. No text, numbers or logos.

ALT AI-generated conceptual premium 3D illustration: a graphite deposit receptacle with a broken gate still accepts one unmarked silver disc; a detached gate fragment lies beside it. Black background with restrained red accents. Represents deprecated deposit addresses continuing to receive funds, not CoinDCX infrastructure or transaction evidence. No text, numbers or logos.

129
🚨 Two Ethereum relay paths from the Railway-linked address converge at one Etherscan-labelled HitBTC endpoint. Our bounded review checks four path transactions: an onward receipt of 14.337414 ETH (rounded) and 9,372.183919 USDC. Both USDC Transfer logs match at the raw-integer level. That is evidence of movement, not proof of a common operator, an exchange customer account or cash-out. The full victim ledger and the source-side bridge match remain unconfirmed; the researcher’s reported loss is not independently reproduced here. Read the evidence, exact records and limits: community.chainbounty.io/ko/… #ChainBounty #Railway #WalletSecurity
White 16:9 ChainBounty research cover. Left title: Railway / Following two / relay paths. Right: original Railway and Ethereum logos in flat 2D. Original ChainBounty navigation logo at lower left. Cover illustration, not transaction evidence.

ALT White 16:9 ChainBounty research cover. Left title: Railway / Following two / relay paths. Right: original Railway and Ethereum logos in flat 2D. Original ChainBounty navigation logo at lower left. Cover illustration, not transaction evidence.

73
🚨 On October 21, Railway disclosed possible exposure of customer secrets. A day later, Taylor Monahan reported about $371K in wallet drains across 19+ EVM chains. Railway says some encrypted environment variables may have been decrypted. Monahan identified a suspected sweeper address and 500+ transactions; those figures are her findings, not an independently reconciled loss total. The security boundary is the signing key, not the hosting account. Replacing an environment variable does not invalidate a copied private key: affected wallet assets need a new, independently generated signing key. The exact exposure mechanism and the full set of related wallet losses remain unconfirmed. Railway is the deployment platform, not Railgun. #ChainBounty #Railway #WalletSecurity
🤖 Made with AI
AI-generated conceptual 3D illustration of a graphite cloud-shaped storage capsule and a silver key emerging through a restrained red-lit opening on a black background. Represents exposure of cloud-hosted signing keys; not Railway infrastructure, a real product, or transaction evidence. No text or numbers.

ALT AI-generated conceptual 3D illustration of a graphite cloud-shaped storage capsule and a silver key emerging through a restrained red-lit opening on a black background. Represents exposure of cloud-hosted signing keys; not Railway infrastructure, a real product, or transaction evidence. No text or numbers.

87
Load more