avatar
Cos(余弦)😶‍🌫️
Follow
Founder of @SlowMist_Team. Creator of https://t.co/tFCQExsAlL // 分身一号/捉虫大师/救火运动员 🕖灾备 https://t.co/bMGdsBlwmk
Posts
avatar
Cos(余弦)😶‍🌫️
This incident again involves the exploitation of the durable nonce offline pre-signature mechanism. This phishing technique has been popular for at least two years. After obtaining this signature, attackers can initiate on-chain operations with "legitimate signatures" when the time is right, such as taking over the on-chain admin privileges of Drift in this scenario. This time, it appears to be the work of a professional hacking group (at least in terms of their actions, they were well-prepared and their methods were sophisticated).
Drift
@DriftProtocol
Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers. This was a highly sophisticated operation that appears to have involved
DRIFT
22.74%
avatar
Cos(余弦)😶‍🌫️
Thread
Drift Protocol suffered a massive theft of over $200 million in assets… A week ago, the platform migrated to a 2/5 multisignature pool (1 old + 4 new signers) without timelocks. Hours ago, attackers seized admin privileges, minted counterfeit CVT tokens, manipulated the oracle, disabled related security mechanisms, and absconded with the pool's valuable assets… The situation has deteriorated significantly… Hacker Address List app.cielo.finance/bundles/216/...… @MistTrack_io @SlowMist_Team
Omer Goldberg
@omeragoldberg
** Correction on key compromise ** A week ago, Drift moved to a new multisig, created by a signer from the old multisig. This signer did not add themselves to the new one. The exploiter also initiated the proposal in the old multisig to hand over admin control to this new x.com/omeragoldberg/…
DRIFT
22.74%
avatar
Cos(余弦)😶‍🌫️
04-01
Thread
OpenClaw 2026.3.31 is here, and I noticed this is what I'm interested in: Skills/install and Plugins/install: Built-in dangerous-code critical findings and install-time scan failures now fail closed by default, so plugin installs and gateway-backed skill dependency installs that previously succeeded may now require an explicit dangerous override such as `--dangerously-force-unsafe-install` to proceed. In other words, during skill and plugin installation, if high-risk code (critical findings) is detected or the scan fails, the installation will be blocked by default, preventing the forced installation of malicious code as before. I haven't had a chance to verify this yet, but those interested in this upgrade can give it a try. OpenClaw is actively improving its security capabilities, and hopefully its stability and resilience will also improve.
OpenClaw
@openclaw
04-01
OpenClaw 2026.3.31 🦞 🇨🇳 Bundled QQ Bot — private, group, and guild chat + media 📹 LINE now sends images, video, and audio 🧵 Real background task flows: list, show, cancel 🇯🇵 Better CJK: context, memory, and TTS OpenClaw's next release has been leaked🦞https://github.com/openclaw/openclaw/releases/tag/v2026.3.31…
avatar
Cos(余弦)😶‍🌫️
03-31
Today's supply chain poisoning incident by Axios has drawn significant attention to the industry, and OpenClaw also forcibly locked the versions of its dependent modules a little over an hour ago. To give everyone a more intuitive understanding of the risk, I compiled a dependency graph for OpenClaw's third-party modules: 1,246 third-party modules and 2,672 dependency paths. That's all… Of course, there might be some statistical bias; modules introduced by third-party Skills weren't included in the statistics. Locking dependency versions is a necessary security practice; otherwise, if any one of the 1,246 third-party modules were compromised, it could potentially destroy OpenClaw… Software engineering is never a simple matter; even the most powerful AI can make mistakes. Stay vigilant. If you're going to take risks, use independent devices to avoid being wiped out by a whole host of problems…
loading indicator
Loading..