🚨 Security Alert | Ledger Users Report Suspected Wallet Theft Exceeding $86M 💸 On October 9, multiple Ledger hardware wallet users in Southeast Asia reported unauthorized asset transfers involving devices purchased through CryptoBilis, a Ledger reseller. Public on-chain investigations estimate that more than $86 million may have been stolen across multiple networks, including Bitcoin, Ethereum, and TRON. Ledger has confirmed an ongoing investigation and requested that CryptoBilis suspend sales and shipments of Ledger devices. The exact number of affected users and total losses have yet to be officially confirmed. 🔍 Key Security Findings On-chain analysis identified coordinated asset transfers across multiple blockchains. Several TRON wallets submitted token approvals almost simultaneously, followed by rapid withdrawals. This pattern suggests that the attacker may have gained signing control over multiple wallets. The initial compromise remains unclear. Potential attack vectors include device tampering during distribution or delivery, and compromised recovery phrases. However, there is currently no confirmed evidence of an exploitable vulnerability in Ledger's firmware or hardware security mechanisms. ⚠️ Security Recommendations Ledger advises users who purchased devices through CryptoBilis within the past 90 days to take precautions: Unused devices: Do not initialize or use them until further notice. Initialized devices: Consider generating a new recovery phrase on a trusted device and transferring assets to a new wallet as soon as possible. Recovery phrase security: Never restore the original recovery phrase on the new device or share it with anyone. ✍️ BitsLab Security Reminder: Hardware wallet security depends on the entire lifecycle, from private key generation and device distribution to everyday use. If a recovery phrase may have been compromised, replacing the hardware wallet or reinstalling the wallet application will not eliminate the risk. Assets should be transferred to a wallet secured by a newly generated recovery phrase. The investigation is ongoing. The exact attack vector and total losses remain unconfirmed. #SecurityAlert #Web3Security #Ledger
💸 The ~$320M abnormal peg-out from Liquid Network may not have been a key-compromise incident at all. On Sep. 6, nearly 4,000 BTC was withdrawn from the Liquid Federation wallet. But according to Liquid and SideSwap, the Peg-out Authorization Key (PAK) was not compromised, and no other signing keys were stolen. 🔋What makes this incident more interesting is that the withdrawal still went through the normal peg-out flow, with at least 11/15 functionaries ultimately signing the Bitcoin transaction. 🛡️This suggests the failure may not have been “the attacker stole a key and signed the withdrawal,” but rather that a state which should never have been considered valid was accepted as valid, after which downstream components completed authorization and signing under normal rules. 🖲️SideSwap currently says the issue appears to originate from a bug in Elements. The self-described white hats have since communicated with Blockstream via OP_RETURN messages and said they will return “most” of the BTC after the fix has been deployed across all nodes. Key Takeaway: if every signer is validating the same flawed state, even perfectly secure keys can still produce the wrong outcome. #Bitcoin #LiquidNetwork #Web3Security
1/4 🚨 A recent Reflexer GEB incident led to 5.94 ETH in collateral being drained due to an access-control and call-context confusion issue. 💸 The loss was relatively small, but the architectural flaw it exposed is highly relevant to DeFi systems built around shared proxy contracts. 👇
🚨 Security Alert: AI Agent Backend RCE 🔍 Root Cause: Attacker - controlled external content entered a retail AI agent workflow, enabling an attack chain from indirect prompt injection → prompt/tool disclosure → backend RCE. 📌 Target: AI Shopping Assistant of a Top 3 U.S. retailer 📌 Surface: Public mobile interface 📌 Researchers: Netanel Rubin & Dan Avraham, Rein Security 📌 Disclosure: Black Hat USA 2026 Impact: No privileged access was required — the exploit could be triggered through the same interface used by regular shoppers. AI agent security is moving beyond model manipulation. Prompt injection can now become a path to real backend compromise.
🛑BitsLab builds AI-driven security infrastructure for digital assets. We provide smart contract audits, penetration testing, formal verification, and AI-powered risk detection for Web3 teams, protocols, and enterprises.✅ What to expect here: 🟠Security Alert 🟢Exploit Breakdown 🟣Audit Insight 🟡Security Methodology Ecosystem: @MoveBit_ | @scalebit_ | @tonbit_ 🛡️Website: https://t.co/M56qRPzIf2 Have a Web3 security topic you’d like us to cover? Let us know in the comments.🙌
🚨 BitsLab Research: One forged email is enough to hijack a nanobot agent. No clicks. No user interaction. No prior access. We disclosed CVE-2026-33654 — a zero-click Indirect Prompt Injection chained with Authentication Bypass in the Email Channel. Here's how it works 🧵👇 https://t.co/3Fe6UxopCX
Balancer V2 deployed ONE contract to hold every token across every pool. Looks like a single point of failure. It's actually why cross-pool arbitrage moves zero tokens, and why a flash loan can tap the entire protocol's liquidity. A thread on the Vault 🧵👇 https://t.co/Vj4Dn7mmbQ
🔬 New from BitsLab Research Balancer V2 deployed ONE contract to hold every token across every pool. Looks like a single point of failure. It's actually why: → Cross-pool arbitrage moves zero tokens → Flash loans tap the entire protocol's liquidity → A 2-token swap completes in just ONE SSTORE We spent weeks dissecting the Vault contract line by line. Part 1 of our 3-part Balancer V2 deep dive is live — covering every gas trick, every safety check, and the trade-off no one talks about (the Aug 2023 Boosted Pool incident wasn't an accident of architecture). If you're building a DeFi protocol, auditing one, or investing in one — this one's worth 15 minutes. 📖 Read Part 1 ↓ https://t.co/4ZHF2BoLUO Part 2 (Pool math) and Part 3 (real vulnerability post-mortems) coming next.