Protect Your Every Transaction. User App: https://xitter.cf/t.co/FHHKZyzH1j 🛡️ Dev Integration: Security Intelligence & SafeToken Protocol 🛡️
On-Chain
Joined May 2021
- Tweets3.9K
- Following1.1K
- Followers421K
- Likes3.2K
Pinned Tweet
📢GoPlus #DeepScan Comprehensive Upgrade: A New Paradigm of AI-Powered Smart Contract Security.
Smart contracts hold funds — and hackers are already using AI to uncover deep-layer vulnerabilities. One-time audits can no longer keep pace with today's attack-defense dynamics. The industry must evolve toward AI-powered, continuous security: higher efficiency, lower cost, full-lifecycle protection.
GoPlus DeepScan delivers three interconnected modules forming a closed-loop, continuous security service for the entire smart contract lifecycle: AI Contract Audit, Continuous Security Monitoring, and Token Security Self-Check.
Features
AI Auditing
AI-powered deep analysis of contract source code, permission management, and business logic. Systematically detects syntax vulnerabilities and business-logic flaws, and delivers a structured audit report — including security scores, key findings, issue details, and remediation recommendations.
Security Monitoring
Post-audit, always-on assurance for live contracts. Tracks newly disclosed vulnerabilities, on-chain attacks, and status changes in external dependencies (oracles, cross-chain bridges) in real time. AI continuously assesses impact, triggers targeted re-reviews, and issues alerts — moving beyond the "audit as finish line" model.
Token Security Checking
A rapid pre-launch self-inspection tool for tokens preparing to launch or list. Identifies common high-risk characteristics in minutes, including: Honeypot detection, Malicious mint detection, Blacklist mechanism detection, Abnormal buy/sell tax detection, Owner privilege & trading restriction risks.
Benchmark
An open-source benchmark built from real-world attack incidents. Extracts vulnerable contract source code from attacked projects to systematically evaluate AI capabilities in vulnerability identification, attack-path understanding, contextual reasoning, and audit stability. Nearly 100 real, representative attack cases from May 2025 to date, continuously updated.
Use Cases
Developers — Cost-effective, high-efficiency security scanning with audit-grade quality, enabling fast, confident innovation.
Project Teams — Pre-launch scanning as a complement to traditional audits; continuous auditing and monitoring during operations to stay ahead of attackers.
Exchanges — Enhanced pre-listing security review efficiency and capability; continuous monitoring as routine risk control to catch new threats early and minimize post-listing incidents.
Get Started
GoPlus DeepScan is live — try it now: **deepscan.gopluslabs.io/**
AI Auditing Benchmark: github.com/GoPlusSecurity/ai…
GoPlus DeepScan Community Nominations · Round 3 | Web3 Security Hot Topics — Winners
Congrats to the 10 winners below. Each gets 10 USDT:
@0xanyar
@TyoApod
@koirc38116997
@loveli_lovelife
@cheuk_baby
@lavely_9
@0xNuls_
@MatthewMburkett
@DavidMurcuc
@ZestGl0w
Notes:
1. Rewards will be registered via DM from the official account shortly. Watch for phishing links and fake accounts.
2. Draw run by Grok AI: eligible reply handles sorted, then sampled with a SHA256 seed from the post ID. Results are reproducible.
1/2
🎁 DeepScan Community Nominations · Round 3 | Web3 Security Hot Topics
Quantum computing takes another leap. OpenAI’s math results are all over the timeline. The community is asking: Can Bitcoin hold up? Could smart contracts get rekt?
CryptoBilis, a Ledger reseller, shipped tampered wallets. About $100M was stolen. Which is safer: a hardware wallet, or an offline iPhone?
Binance’s .ai domain is lighting up agentic wallets. How do you use an agent wallet without getting drained?
Which topic do you care about most? GoPlus will publish a security research report based on the votes.
🎟️ Giveaway: 10 eligible participants win 10 USDT each.
🗳️ How to enter:
1. Follow @GoPlusSecurity and repost.
2. Vote in the thread post “2/2”.
3. Voting closes October 26 at 23:00 UTC. Winners and the security report will be announced afterward.
Recent user data leaks at hardware wallets and exchanges. Watch for phishing, social engineering, and SIM swap attacks 👇👇
4 data leaks reported today:
1. Coinbase's vendor Amplitude exposed some users’ contact data (funds unaffected).
2. Bithumb (Korea) had user data leaks.
In TradFi, two securities firms in Korea leaked data:
3. Mirae Asset
4. Daishin Securities
You can't prevent a leak, but you can protect yourself.
Leaked exchange data (names, emails, phone numbers, addresses, ID documents, transaction history) is mostly used for phishing, SIM swapping, and social engineering.
Reduce info you share
- Use a unique email alias for each exchange (SimpleLogin, Apple Hide My Email, etc). A leak then can't be linked to your other accounts, and you can spot which service leaked.
- Share only what's required. Don't add optional profile details.
- Use a dedicated phone number (a VoIP or secondary SIM) for exchange accounts if you can, since leaked numbers are the main route to SIM swaps.
Lock down the account
- Use a unique, long password from a password manager.
- Turn on hardware security keys (YubiKey) or passkeys, or at least an authenticator app.
- Avoid SMS 2FA.
- Enable withdrawal address whitelisting and a withdrawal time lock if the exchange offers them.
- Set up an anti-phishing code, which puts a code you choose in every legitimate email from the exchange.
- Review active sessions and API keys regularly. Delete any API keys you don't use.
- Restrict API keys to withdraw-disabled and IP-whitelisted.
Defend against
- SIM swapping: Ask your carrier to add a port-out PIN or number lock.
- Phishing and impersonation: Assume anyone who contacts you about your account, "security issues," or "refund recovery" is a scammer, even if they know your name, balance, or recent trades.
- Exchange support staff don't ask for your password, 2FA codes, or seed phrase.
- Never click links in emails or texts. Go to the site yourself.
- "Wrench attacks": Leaked addresses plus holdings data have led to real-world extortion and robberies. Don't publicize your holdings, and keep large balances out of anything tied to your home address if you can.
If a breach is announced
1. Change the exchange password and any other account that reused it.
2. Check haveibeenpwned.com for your email address.
3. Revoke API keys and active sessions.
4. Review recent withdrawals and security settings.
5. Watch for phishing emails and texts that reference the breach, because scammers move fast after one.
Stay SAFU! 🙏
Builders: @OpenFour_dev is opening its launch layer to new mechanisms, and we're glad to back it.
Selected mechanisms get a free security audit. Submit your proposal 👇
$500,000 for the next launch mechanisms on OpenFour, in partnership with @GoPlusSecurity.
Build your own launch mechanism on Four.Meme's infrastructure on @BNBCHAIN.
Once it's listed, any project on OpenFour can use it, and you keep earning from the fees it generates.
Selected mechanisms get:
• Free security audit
• $2,000 when it goes live
• Up to 50% fee share
• Official promotion and integration support
Any mechanism is welcome, with priority on:
• Royalty vaults and revenue distribution
• Custom bonding curves and trading logic
• New migration paths and incentive models
• New combinations of OpenFour's modules, or with protocols such as Binance Agent ID
You design it. You own it.
Submit a proposal → forms.gle/y7MkHHdj7yGVwS5m7
⚠️ Unauthorized fund transfers on @predictdotfun, the BNB Chain prediction market.
About 400,000 USDT was moved from user wallets without authorization. The team has said it will fully reimburse affected users.
Early investigation points to a possible compromise of an API docs site hosted by a third-party provider. Predict[.]fun has taken the docs site offline as a precaution.
If you recently used the related API docs or example code, check your accounts and key security now.
Stay #SAFU!
We are aware of a small number of users who have experienced unauthorized transfers of funds from their wallets, totaling approximately 400,000 USDT.
Our preliminary investigation suggests that our API documentation site, which is hosted by a third-party provider, may have been compromised, potentially affecting a small number of users over a short period of time. The API documentation site has been taken offline as a precaution and will remain offline until our investigation is complete.
At Predict.fun, we take the security of our users and their funds extremely seriously. As such, we will fully reimburse all affected users for any funds lost as a direct result of this incident.
Once our investigation is complete, we will publish a full post-mortem detailing what happened and the steps we're taking to prevent similar incidents in the future.
1/7
⚠️ Exploit Breakdown: X100 Governance Hijack, ~$4.848M
On Oct 24, @x100global ($X) was hit by a flash-loan governance hijack.
In a single tx, the attacker took 2 of 3 Senate seats and executed a proposal immediately, forcing the treasury to sell X into a thin pool it had just created.
Three txs pulled 4,848,988.78 USDT from the main pool. The attacker received 4,848,017.34 USDT (~$4.848M) and still holds 828,094.32 X unsold.
🔍 Root cause
Freezer ranks Senate seats by current frozen balance. Paying 100 X is enough to run immediately. Two seats = majority. A proposal can be submitted, voted, and executed in the same tx.
Governance can tell the treasury which pool to sell X into, with no effective minimum fill. A flash loan can rent the majority, then dump the treasury into an attacker-built thin pool.
🔍 Attack flow (Tx1):
etherscan.io/tx/0x38c60844f1…
1️⃣ Rent the X used for voting.
Aave V3 aUSDT sends 1,942,457.637245 USDT to the executor. It spends 1,942,356.637245 USDT in the Uniswap V3 main pool `0x0d85edd90c94053fc5997551b1baa8a77aa02fa0` and buys 38,200.000002 X at 50.8470 USDT. The extra 101 USDT stays on the executor; 100 USDT of it later seeds the new pool.
6/7
6️⃣ Repay and move the profit out.
The executor repays Aave 1,943,428.866064 USDT, including a 971.228819 USDT fee. The remaining 4,749,726.096973 USDT goes first to the outer contract, then to the attacker EOA.
7/7
📌 Addresses
Attackers:
`0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63` (Tx1)
`0xfc3facd67138966ab0c841e905b0c4bca1abe92f` (Tx2)
`0xdab137f390df77caa97fd492540e973fd5e2f8c8` (Tx3)
Attack contracts:
`0x89e903e4512f8a315cebd99c29a1e40eee6fe2c9` (Tx1)
`0x1ba033875fdcb4ab83caaa9e16adc44c4abcd5c4` (Tx2)
`0xc1fd840df75f3ae77281a6625fe2f2153fc736ca` (Tx3)
Vulnerable contract:
`0x79f35a33fe2813414851c4ae8daeacd14d822a46`
Main pool drained:
`0x0d85edd90c94053fc5997551b1baa8a77aa02fa0`
Senate helpers:
`0xe08107e7dc7c4540d139392e9d0fea99ca019f37` / `0x176d1ea0ee9569783c6f6e455f7be6171566619c` (Tx1)
`0xc2f69b21bea8f0c64cbd4597f262c80c993073ba` / `0xb21f45868dcaae3be7c842971ae61dd93d4c7cde` (Tx2, Tx3)
Attacker-created pools (treasury sold into):
`0x9a03c41c539880b51508bebbc2dde7b738f6f075` (Tx1, Tx3)
`0x503f83894ad3df6bf001ea79cef45f2672a2673b` (Tx2)
Txs:
etherscan.io/tx/0x38c60844f1…
etherscan.io/tx/0x77c46e1aa9…
etherscan.io/tx/0x7c49bf2886…
Older iOS flaws are being exploited to steal Web3 keys and crypto. #Coruna and #DarkSword fuel exploit trading, malware sales, phishing and trojanized apps. Our report breaks down the attacks, operators, money trails and how to stay safe 👇
⚠️ Exploit breakdown: WAX multi-chain bridge
On Oct 22, the @WAX_io bridge across WAX / Solana / Ethereum was attacked. The attacker “withdrew” mapped tokens on the WAX side without paying anything. The Solana and Ethereum sides still paid out as normal. Five withdrawals in total: ~52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, 0.11 WBTC.
Root cause: a negative fee on `withdraw` zeroed the debit
The WAX-side bridge contract `eth.token` — the mint and bridge-accounting contract for mapped tokens WAXUSDC / WAXUSDT / WAXDAI / WAXWETH / WAXWBTC, issuer `bridge.wax` — has a signed-amount check flaw in `withdraw(from, to_eth_address, quantity, max_fee, chain_name)`:
• The contract charges `debit = quantity + fee`, and intends `max_fee ≥ 0`.
• The attacker set `max_fee` to `quantity` (for a 52,986.497732 WAXUSDC withdrawal, they passed `52,986.497732`). The actual debit was exactly 0.
• When the debit was zero, the contract skipped the balance-deduction and check path (a zero-amount transfer does not trigger `sub_balance`). The withdrawal still posted and created a cross-chain withdrawal record.
Attacker account `fasdfas.al` held a balance of zero on `eth.token` for all five tokens the whole time (`get_currency_balance` all 0). No payment was made at any point.
waxblock.io/transaction/406b…
📌 Attacker addresses
WAX: waxblock.io/account/fasdfas.…
Solana: solscan.io/account/4H1piNZ8L…
Ethereum: etherscan.io/address/0x01664…
Exploited contract:
waxblock.io/account/eth.toke…
Example attack tx:
waxblock.io/transaction/406b…
ℹ️ We are aware of an incident affecting the WAX Multi-Chain Bridge and are investigating. We paused bridge processing as a precaution.
Please don't submit bridge transfers until we confirm the bridge is back online.
The exploit affected only a small number of stablecoins. WAXP tokens were unaffected. The WAX blockchain itself was not affected and continues to operate normally. The issue is confined to a bridge application contract.
🚨 GoPlus Security Alert: Node.js October 2026 Security Updates
On Oct 21, Node.js patched 10 vulnerabilities: 4 high-, 3 medium-, and 3 low-severity. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It can lead to remote code execution when an app processes untrusted compressed data. The other high-severity issues are `dns.resolve` truncating domain names that contain NUL characters, and two TLS certificate hostname-verification bypasses. The medium- and low-severity issues cover Keep-alive response handling, repeated random values, ZIP file handling, and the permission model.
Patched releases: Node.js 22.23.4, 24.22.1, 26.12.1. Affected release lines vary by vulnerability. Running Node.js does not by itself mean there is an exploitable entry point.
nodejs.org/en/blog/vulnerabi…
⚠️ Checks and mitigation steps
1. Know what is actually running. Inventory the Node.js executable and image source actually in use across services, nodes, and containers, and check every replica. The version reported by a local `node -v` command may differ from the version used by the application process.
2. Prioritize upgrades based on exposure. Prioritize services that decode Brotli-compressed data from external sources, or that use untrusted input to construct DNS queries or specify HTTPS/TLS connection targets. Move to the patched release for that branch, or a verified vendor backport. Then restart and verify the running version on every node.
3. If you cannot upgrade now, restrict exposed inputs. Restrict the processing of untrusted compressed data, and limit which connection targets can be specified through untrusted input. Review logs for decoding errors, abnormal process behavior, and certificate alerts. These measures do not replace a runtime update.
Node.js Oct 21 vulnerability analysis and a security self-check Skill, now updated: github.com/GoPlusSecurity/se…
🚨 GoPlus Security Alert: Two unauthenticated RCE vulnerabilities in PHP
PHP’s official security advisory confirms CVE-2026-109618 and CVE-2026-109619 can both lead to unauthenticated remote code execution. Patched releases are available: 8.2.35, 8.3.36, 8.4.27, 8.5.12.
php.net/archive/2026.php#202…
⚠️ Checks and mitigation steps
1. Know what is actually running. List each entry point, service, node/container, PHP SAPI, the executable path and PHP version used by each running worker, vendor package or image source, config overrides, and public reachability.
2. Upgrade first. Schedule public-facing mod_php first, then other internet-facing PHP services and any internal service that untrusted requests can reach. Move to the patched release for that branch, or a vendor package with a verified backport. Check compatibility and prepare backups and a rollback plan before upgrading. After the upgrade, restart all workers and verify the running PHP version on every node.
3. If you cannot upgrade now, reduce public exposure. Restrict external access. Review upload and input size limits, and request limits.
php2shell RCE analysis and a security self-check Skill. Check it item by item against your business use case: github.com/GoPlusSecurity/se…
1/2
🎁 DeepScan Community Nominations · Round 3 | Web3 Security Hot Topics
Quantum computing takes another leap. OpenAI’s math results are all over the timeline. The community is asking: Can Bitcoin hold up? Could smart contracts get rekt?
CryptoBilis, a Ledger reseller, shipped tampered wallets. About $100M was stolen. Which is safer: a hardware wallet, or an offline iPhone?
Binance’s .ai domain is lighting up agentic wallets. How do you use an agent wallet without getting drained?
Which topic do you care about most? GoPlus will publish a security research report based on the votes.
🎟️ Giveaway: 10 eligible participants win 10 USDT each.
🗳️ How to enter:
1. Follow @GoPlusSecurity and repost.
2. Vote in the thread post “2/2”.
3. Voting closes October 26 at 23:00 UTC. Winners and the security report will be announced afterward.
GoPlus Security 🚦 retweeted
🎙️ Tonight on Cregis MicUp: Digital Asset Security in Practice
🗓️ October 21 | 5:00 PM GMT+8
📍 Live on X Spaces
Bring your questions and join us here: xitter.cf/i/spaces/1rxmqpywpAWxy
What should businesses check before an incident, and prioritize after one?
Join Max Grabner(@maxrobot5 ) from @range_org , Dmytro Matviiv(@DmytroMatviiv ) from @HackenProof and Bobby from @GoPlusSecurity for a conversation on overlooked risks, practical safeguards, incident response and the security questions AI brings to digital asset operations.
Hosted by @bojun_li , Deputy Marketing Director at @0xCregis .
#DigitalAssets #CyberSecurity #CregisMicUp
