ChainCatcher message, Slow Mist founder Yu Xian stated, "To verify the situation of WeChat account theft, attackers use leaked account passwords (various leaked data may be found) combined with the target user's frequently contacted friends (even those who have just been added as friends or interacted in groups) to obtain a 6-digit verification code to carry out the theft. Attackers often strike late at night, focusing on scams in the cryptocurrency OTC market. It is recommended to be cautious when adding friends on WeChat, change passwords promptly, and pay attention to WeChat's abnormal login risk alerts."

According to ChainCatcher news, as disclosed by Slow Fog founder Yu Xian, individual cryptocurrency investors have encountered multiple large-scale theft incidents in the past week, including two cases with losses exceeding $1 million, one case exceeding $2 million, and the highest single loss reaching $6.5 million. Smaller theft incidents occurred more frequently, but specific data was not disclosed.

ChainCatcher news, Slow Mist founder Yu Xian released a follow-up update on "Alby hosted wallet balance being transferred by the platform," stating, "There are too many tricks with Alby. Although the funds have been refunded, the process of successfully withdrawing is cumbersome (though I completely understand the mechanism behind it). Ultimately, out of the $191, only $153 was successfully withdrawn, with over $30 worn away in the process."Previous report, Slow Mist's Yu Xian updated on social media, stating, "I got it back, without following the official required steps. It seems they refunded me directly... Happy Ending..."

ChainCatcher message, Slow Mist Yuxian updated on social media, stating, "Got it back, didn't follow the official required steps. It seems they just refunded me... Happy Ending...For other friends who have had this experience, if you haven't received your funds back, you can email the official inquiry (the official email is in the message where your funds were transferred), you can follow the required steps in the official reply (for example, you may need to pay to register for their Cloud or set up Alby Hub, etc.), but perhaps you can also do nothing like I did and get it back directly.The amount is small, but the nature is serious. If the official had left a message informing us of the retrieval method when they transferred our funds, the nature would have been very different."

ChainCatcher news, Slow Mist founder Yu Xian stated on the X platform that he is also a victim of the Bitcoin wallet Alby, with 0.00174788 BTC (191.96 USD) being transferred away from his Alby wallet. The transfer was possible because this is Alby's custodial account, and he was unaware of its platform agreement. By checking emails, it was found that Alby sent an email notifying users of an update to the platform agreement on May 1, 2025, and then this BTC was transferred away on May 26, 2025.ChainCatcher previously reported that multiple community users have reported their balances in the self-custody Bitcoin wallet Alby being "stolen," suspected to have been deducted by Alby officials. In the service terms updated by Alby in March 2025, it is stated: "Users have been notified for over a year to withdraw excess funds from their old Alby accounts created in 2023 and earlier that use the shared wallet architecture. To manage these long-inactive accounts more effectively, we reserve the right to deduct the entire remaining balance from accounts that have had no transaction activity (i.e., no completed transactions) for a continuous period of 12 months."

ChainCatcher message, Slow Mist's Yu Xian posted on platform X, stating that the "most High" users of the new mechanism EIP-7702 are actually coin theft gangs (not phishing gangs), which facilitate the automatic transfer of related funds from wallet addresses with leaked private keys/mnemonic phrases... Over 97% of EIP-7702 delegations are authorized to such coin theft contracts.

ChainCatcher news, Slow Mist founder Yu Xian tweeted that a user's four sets of mnemonic phrases were leaked, corresponding to four wallet addresses where funds were stolen. From the on-chain operation methods, after the hacker's address received the funds, they were all converted to ETH and then laundered through FixedFloat. The longer mnemonic phrases/private keys are exposed to the internet and the more people they are distributed to for shared use, the more likely they are to be leaked, and the more difficult it becomes to investigate the reasons for the leak.

ChainCatcher message, Slow Mist founder Yu Xian posted, "Everyone beware of @osiris_guard, this so-called Web3 security plugin, it is a malicious plugin. If installed on Chrome, this malicious plugin will replace links, causing users to download well-known programs that turn into Trojan programs, leading to computer compromise. Ultimately, it results in wallets being stolen and related key accounts being wiped out, with similar outcomes, but with more variations in the scams. Detailed analysis is ongoing."

ChainCatcher news, Slow Mist founder Yu Xian stated that the "fake Ledger" scam has reemerged recently, with attackers mailing counterfeit Ledger devices to users, accompanied by fake manuals, guiding them to input the mnemonic phrases from their real Ledger into a fake application, resulting in asset theft. This attack method had cases as early as 2021, and there are also variants that commit fraud by pre-setting mnemonic phrases or tampering with random number generators.Experts remind that although such physical-layer phishing attacks may seem rare, their success rate is not low, and the targets are often high-net-worth users.

ChainCatcher message, Slow Mist founder Yu Xian stated that the current DNS hijacking issue with Curve has not yet been resolved, and the attackers are also phishing for mnemonic phrases through fake wallet pop-ups, making their methods even more covert.This issue once again points to the domain service provider iwantmyname, which also caused a similar incident in 2022.

ChainCatcher message, Slow Mist Yu Xian posted on platform X that a cryptocurrency user lost assets exceeding $20,000 after clicking on a phishing website automatically recommended by the Chrome browser while accessing the ChangeNOW exchange.The phishing website used Punycode technology to spoof the domain name (the letter "e" has an anomaly), leading the user to mistakenly believe it was legitimate.

ChainCatcher message, according to a warning from SlowMist founder @evilcos, there have been recent targeted phishing attacks against important figures in the cryptocurrency space. Attackers are using fake Zoom meeting links, combined with deepfake technology to create realistic video meeting scenarios, to lure targets into downloading malware. Once they successfully control the target's device, attackers may steal cryptocurrency assets or related cloud platform permissions. Users are advised to verify whether the meeting link comes from the official domain (zoom.com or zoom.us) to avoid being deceived.

ChainCatcher news, according to a post by Yu Xian, the founder of Slow Mist, "Today there have been three theft incidents, two of which are related to scams in Telegram. Familiar accounts were hacked, and the scammers carefully set up traps based on the context of chat records. The voice messages sent were also simulated (some AI tools now conveniently simulate based on historical voice). One source cannot be trusted alone; for anything involving funds, it is essential to establish another trusted source verification mechanism."

ChainCatcher news, according to Slow Fog's Yu Xian, the previous incident where $5 million worth of ZK tokens were stolen due to the leakage of the administrator's private key has been resolved, and the stolen funds have been fully recovered. It is reported that during the handling of the incident, Matter Labs, the maintainer of the sole sequencer for ZKSync, intervened with the hacker's address and successfully restricted the transfer of 70% of the stolen funds. Matter Labs stated that the reason for the intervention was that the stolen ZK tokens were directly related to protocol governance.Yu Xian said, "I understand, but I feel a bit regretful about some previous theft incidents on ZKSync that were not 'internal matters'."

ChainCatcher news, Slow Mist founder Cosine tweeted that the current Ethereum Gas fees are at a very low level, with the cost of canceling a single token authorization being only about $0.01. Users should seize the current window of opportunity to revoke all "uncertain/unclear/assumed safe" authorizations using tools like RevokeCash and Rabby. Even processing hundreds of authorizations in bulk would only cost a few dollars, effectively blocking potential high-risk exposures.

ChainCatcher news, Slow Mist founder Yu Xian stated on social media that the ENS chief developer was previously targeted by a phishing attack that exploited a vulnerability in Google's infrastructure. The phishing gang deceived users by disguising phishing emails as official Google communications, leading to users being targeted by law enforcement. Although Google has implemented countermeasures, today this phishing gang launched a new round of phishing attacks and will continue to lure users to a "google.com" subdomain, enticing users to disclose their account passwords and immediately add a Passkey.ChainCatcher previously reported that ENS chief developer nick.eth mentioned on social media that he encountered an extremely sophisticated phishing attack that exploited a vulnerability in Google's infrastructure, but Google refused to fix the vulnerability.He indicated that the attack emails appeared very authentic, could be verified through DKIM signatures, and were displayed normally in Gmail, alongside other legitimate security warnings. The attackers utilized Google's "Sites" service to create a trustworthy "support portal" page, as users would see "google.com" in the domain and mistakenly believe it was safe, so users need to remain vigilant.

ChainCatcher news, according to monitoring by SlowMist founder Yu Xian, over $6 million in funds on the ZKFair L1 Bridge were transferred on March 27 to its admin-controlled Safe multi-signature address, and then transferred to an EOA address, with most entering Aave staking, which is suspicious. This EOA address is one of the owners of the ZKFair Safe multi-signature.

ChainCatcher news, the founder of Slow Mist, Yu Xian, posted on the X platform to review the DEXX hacking incident, stating that the main cause of the incident was indeed the exploitation of a vulnerability in the ZenTao platform used by DEXX, which led to an external intrusion. Subsequently, the production network-related servers and database permissions were compromised, and all forensic analyses have traced back this attack path. In other words, DEXX is also a victim, but bears responsibility for inadequate security management.Furthermore, although DEXX's performance during this life-and-death hacking incident was quite chaotic, the fact that they were ultimately able to provide compensation puts them ahead of 99.99% of projects in this industry.

ChainCatcher message, Slow Mist's Yu Xian disclosed that the phishing technique of poisoning addresses with similar starting and ending numbers is still widespread, severely impacting the security infrastructure of the blockchain industry.Yu Xian pointed out that this type of poisoning targeting wallet transaction history mainly involves various techniques, including fake token contract codes emitting false event logs to deceive block explorers and wallets, as well as using zero-amount transfer event logs to arbitrarily fill in addresses in the from/to fields. These techniques can mislead users into believing that the transactions are from their own actions. Other common techniques include sending small amounts of funds from source addresses with the same starting and ending characters, combining clipboard hijacking technology, and impersonating well-known decentralized exchanges to output false event logs.Yu Xian recommends that users make good use of wallet whitelisting mechanisms, carefully verify complete addresses, and combine well-known hardware wallets for dual verification as defensive measures.Previously reported, two addresses suffered "transaction history pollution attacks" in the past 14 hours, resulting in a total loss of over $140,000.

ChainCatcher news, according to a post by Slow Mist's Yuxian, multiple users mistakenly transferred funds to the contract address of the Magma project on the Monad testnet due to not switching to the correct network environment.Yuxian confirmed through analyzing transaction data and smart contract code that these fund transfers occurred because users did not correctly switch to the Monad testnet while executing functions such as depositMon() and withdrawMon() for the Magma project on multiple blockchains including Ethereum and Binance Smart Chain. This issue may stem from an inadequate network switching mechanism in the wallet application or the project's frontend.Yuxian stated that the project team could implement a fund return mechanism by creating corresponding contracts on the relevant blockchains, and affected users should directly contact the Magma project team for assistance.