Protect your crypto with top-tier security, risk management, and asset recovery
Berlin, Germany
Joined March 2025
- Tweets349
- Following15
- Followers22
- Likes643
Q2 2026 Becomes the Most-Hacked Quarter in Crypto
Despite total losses remaining below previous peaks in dollar terms, Q2 recorded 85 hacks, making it the most active quarter so far.
Which likely weighed on user confidence and added fuel to capital outflows from DeFi
1
2
81
🚨 Your clipboard is lying to you.
@Microsoft found CryptoBandits.A - a clipper routing traffic
🔹 Spreads via USB disguised as .lnk docs
🔹 Scans clipboard every 500ms to swap crypto addresses
🔹 Takes screenshots & runs remote code
Check your wallet addresses before sending
1
1
17
A smart contract bug just cost a DeFi project ~$111K
The attacker exploited a flaw that allowed certain @PancakeSwap transactions to be processed twice, manipulated the pool price, and drained liquidity
Another trend worth watching:
AI is no longer just writing smart contracts
🚨SlowMist TI Alert🚨
💸 Loss: 111,097.596667856001191208 USDC (~$111,097.6)
🔍 Root Cause: DIP token `_transfer()` function has a missing `return` statement in the router branch (when `from` or `to` is PancakeSwap Router). This causes the same transfer to be executed twice when `skim(router)` is called on the Pancake Pair. The attacker exploited this by calling `skim(router)` to trigger double DIP transfers, then `sync()` to set the DIP reserve to an extremely low value, manipulating the AMM price to drain the pool.
📌 Attacker: 0x0d4024cd27538350a911d9b7ee90811fa4875ba3
📌 Victim Pair: 0xf7d8267d01d1104da2dd30828aa9c0e1647919ef
📌 Vulnerable Token: 0x6c60bf5db0670ae94489d3dde2c60f271625db50
Impact: The attacker drained 111,097.6 USDC from the PancakeSwap DIP/0x524c... liquidity pool by exploiting a double-transfer bug in the DIP token contract.
Powered by #SlowMist.AI
Never trust a public charger
- An unknown USB port is not just power
- It can also be a device you don’t control
- Use your own charger, carry a power bank, or use a USB data blocker
And never approve unexpected data transfer requests
1
11
Your SSD may leak more than you think.
A new research attack called FROST shows that a website could infer user activity by measuring tiny SSD timing delays.
No malware. Just side-channel behavior.
Modern attack surfaces now include hardware behavior
👀Sometimes attackers get hacked by their own mistakes
A malicious @cursor_ai extension was found with deployment files still inside. Researchers uncovered:
• attack plans
• download boosting instructions
• infrastructure notes
• clear-text payloads
• a fake download script
How not to lose crypto:
Most losses don’t happen because someone “breaks the blockchain.”
Basic rules:
• protect your seed phrase
• verify every app and link
• never rush transactions
• use 2FA and hardware wallets
Crypto security is a habit, not a one-time setup.
@was reportedly exploited on Ethereum & Base for over $3M
The attack hit the SquidRouterModule & affected 86 Safe wallets
Cross-chain routers + broad token approvals = long-term risk
Check approvals. Revoke what you don’t use.
22
Cybercriminals are now abusing @Google AppSheet to send phishing emails from legitimate Google-linked infrastructure
Fake job offers, account alerts, verification requests are being used to steal credentials and personal data
Stablecoins don’t break only because of reserves.
A reported $10M exploit hit EURR and USDR, pushing both more than 20% off peg. @StablREuro
Early signs point to compromised multisig access, not a smart contract bug.
In crypto, operational security is part of the peg.
Privacy-focused P2P exchange @RetoSwap just lost ~7,000 XMR ($2.7M) to a protocol-level exploit.
By impersonating an arbitrator with fake protocol messages, the attacker tricked the system into swapping the legitimate wallet address for their own.
GitHub was reportedly breached after an employee installed a malicious VS Code extension.
Around 3,8K internal repos were accessed
User repos & customer data were reportedly not affected
Dev tools are now high-value attack surfaces.
Be careful with “useful” plugins
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
2
40
Another “unhackable” bridge got exploited
@VerusCoin-Ethereum Bridge reportedly lost ~$11.5M
It was promoted as having “no smart contract risk” and being validated by protocol rules
Cross-chain systems always have trust assumptions
Bridges remain DeFi’s weakest link
A few things that genuinely improve security:
• use unique passwords everywhere
• stop storing passwords in notes or browsers
• switch to a password manager
• enable 2FA
• move to passkeys where possible
Passwords Go Unchanged for Years
Most users simply:
• reuse old passwords
• slightly modify them
• add years like 2022, 2023, 2024
• use the same password across multiple accounts
Attackers test leaked credentials across different services.
1
12
Passwords Go Unchanged for Years
Most users simply:
• reuse old passwords
• slightly modify them
• add years like 2022, 2023, 2024
• use the same password across multiple accounts
Attackers test leaked credentials across different services.
Your password is likely easier to crack than you think.
New data on 231M leaked passwords:
• 48% cracked in < 60 seconds
• 60% cracked in < 1 hour
The problem isn’t just fast GPUs - it’s our predictable behavior
Stay safe:
✅ Use Passkeys
✅ Get a Password Manager
✅ 2FA
☠ @trustedvolumes market maker compromised; $5.9M stolen
🚨 We were recently exploited.
The addresses currently holding the stolen funds are:
[etherscan.io/address/0x61e63…](etherscan.io/address/0x61e63…) — approx. $3M
[etherscan.io/address/0xc3ebd…](etherscan.io/address/0xc3ebd…) — approx. $3M
[etherscan.io/address/0xfA4F5…]
[etherscan.io/address/0xfA4F5…] — approx. $700K
We are open to constructive communication regarding a bug bounty and a mutually acceptable resolution.
Contact us directly:
📧 Email: [email protected]
💬 Telegram: t.me/trustedvolumes
1
26
AI may become the biggest threat to cryptography
According to @solana's founder, AI could find weaknesses in post-quantum algorithms faster than devs can secure them
These systems are still poorly tested
Security is entering a new phase where AI is both ( defender & attacker)
1
7