This week’s three theft incidents: not one was “the smart contract got hacked.” ⚠️
🧵 The problem is all in the middle layer you trust by default:
1️⃣ Electrum wallet: a malicious server forged a pending transaction, and when the user clicked “accelerate (RBF),” they signed over $BTC to the attacker. At least 1 theft has been confirmed; 4.8.3 was released on 10/24 to fix it (CoinDesk)
2️⃣ BloomTrading trading bot: about 48–49 user wallets were drained, along with about 9,408 $SOL and about $950,000. The team says it is investigating a third-party breach and promises compensation (Crypto Briefing)
3️⃣ Initia chain: a MoveVM script cache vulnerability allowed 2 million AUSD to be minted out of thin air; after about $2.7 million was bridged out, both L1 and the rollup were shut down. No restart date yet (Altcoin Buzz)
✅ Self-check list: upgrade Electrum to 4.8.3 or only connect to your own server; verify the full address before signing, don’t just look at the last four digits; keep only the money you need for the day in trading-bot wallets
My take: audit reports cover contracts, but not wallet servers, bots that custody private keys, or the chain itself. How safe your assets are increasingly depends on who you choose to trust.
Are you still using Telegram trading bots? How much would you put in? 👇
If you found this useful, give it a like 🙏
#Web3安全 #钱包安全 #Solana
🧵 The problem is all in the middle layer you trust by default:
1️⃣ Electrum wallet: a malicious server forged a pending transaction, and when the user clicked “accelerate (RBF),” they signed over $BTC to the attacker. At least 1 theft has been confirmed; 4.8.3 was released on 10/24 to fix it (CoinDesk)
2️⃣ BloomTrading trading bot: about 48–49 user wallets were drained, along with about 9,408 $SOL and about $950,000. The team says it is investigating a third-party breach and promises compensation (Crypto Briefing)
3️⃣ Initia chain: a MoveVM script cache vulnerability allowed 2 million AUSD to be minted out of thin air; after about $2.7 million was bridged out, both L1 and the rollup were shut down. No restart date yet (Altcoin Buzz)
✅ Self-check list: upgrade Electrum to 4.8.3 or only connect to your own server; verify the full address before signing, don’t just look at the last four digits; keep only the money you need for the day in trading-bot wallets
My take: audit reports cover contracts, but not wallet servers, bots that custody private keys, or the chain itself. How safe your assets are increasingly depends on who you choose to trust.
Are you still using Telegram trading bots? How much would you put in? 👇
If you found this useful, give it a like 🙏
#Web3安全 #钱包安全 #Solana
