BlockSec Phalcon(Phalcon_xyz) Message

ALERT! Our system detected two suspicious transactions on #Ethereum hours ago exploiting arbitrary call vulnerabilities, resulting in approximately ~$205K in total losses. 1. Unknown SafeWallet (~$63K): a SafeWallet module's receiveFlashLoan() enabled attacker-controlled external calls via execTransactionFromModule, letting the attacker repay Aave debt, withdraw collateral, and sweep funds. Attack TX: t.co/F4IMNQpx0o 2. LZMultiCall (2 WBTC, ~$142K): the contract's execute() enables arbitrary external calls. The attacker abused it to execute transferFrom() and drain WBTC that users had approved to the contract. The approval and attack transactions were included in the same block (positions 1 and 2), suggesting the attacker was likely monitoring on-chain activity in real time. Approval TX: t.co/szNn7YVkYb Attack TX: t.co/y592KOYKDM 🟦 Found by #PhalconSecurity, 🟦 Analyzed via #PhalconExplorer.