goplus

GoPlus issued a security alert stating that the Korean version of Liangxi, contract live broadcast KOL Xibajie @jadoodoo_'s X account has been hacked, and is crazily sending phishing links to fans under the guise of collaboration. Several KOLs have already fallen victim, with total losses amounting to approximately $5,000. Please do not click on links to connect wallets or download malware.

Regarding the incident "DxSale accused of using a backdoor to withdraw $7.3 million in liquidity funds," the security company GoPlus stated that the attack may have been an inside job, and there is still $15.5 million in funds and LP urgently needing rescue. GoPlus recommends that the project team immediately check whether their project LP is locked in the contracts 0xEb3a9C56, 0x81E0eF68, 0x2D045410, 0x5b5e9448, and if so, take immediate measures to withdraw. Since the initial funding source was Bybit, KYC tracing is recommended; the final withdrawal channels are multiple Binance addresses, and it is suggested that the relevant security teams submit on-chain evidence to apply for freezing the attacker's address.GoPlus calls on the project to strengthen security mechanisms, stating that critical admin functions must have a time lock, and Owner permissions must use multi-signature. GoPlus emphasizes that as of now, DxSale has not issued any public incident response statement, and its silence is also worth noting.

According to GoPlus security alerts, phishing scams promoting black U and anti-money laundering detection websites have appeared on the X platform. Investigations reveal that the website is a phishing site hosted on the Vercel platform, aimed at tricking users into authorizing their wallets, so please do not interact.GoPlus recommends: try to avoid private transactions and use the OTC features of centralized exchanges; maintain a high level of suspicion towards unfamiliar links, especially those requiring wallet signatures or authorizations; remember the "four no choices" to prevent phishing: do not click on unfamiliar links, do not install software from unknown sources, do not sign transactions with unclear content, and do not transfer funds to unverified addresses.

According to GoPlus analysis, the stablecoin protocol StablR had security issues with its multi-signature contract settings on Ethereum (multi-signature threshold of 1), and the holder's private key was stolen, resulting in StablR $EURR and $USDR stablecoins being depegged by 20%. The attacker has profited approximately $2.8 million.

GoPlus Security stated that a user fell victim to a typical address poisoning attack, mistakenly transferring 100,000 DAI to a fake address created by the attacker after copying a similar address from the transaction history.In this incident, the user had previously transferred 300,000 DAI to the target address, and the attacker subsequently sent 0.0003 DAI from a similarly structured address to lure the user into mistakenly selecting the wrong address for the second transfer.GoPlus Security reminds users not to copy addresses from transaction history, to verify the complete address before transferring, and to conduct a small test transfer before making large transactions.

According to GoPlus, there have been two new public key leakage incidents in the past 36 hours, with a total loss of $238,000. Among them, 0xUnihax0r lost $200,000, and he had previously uploaded a trading bot and Telegram; the stolen address of @Eli5defi is linked to a previous large-scale private key leakage incident involving 574 addresses. GoPlus suggests that, in light of such centralized large-scale private key leaks, it is advisable to immediately check for risks according to the private key leakage self-inspection checklist.

According to a tweet from GoPlus Security, there have been 4 consecutive smart contract attacks on the Ethereum mainnet in the past 48 hours, with total losses exceeding $1.5 million.These include an attack on the Onchain aggregator contract, resulting in a loss of approximately $983,000; theft from a third-party treasury contract related to TradingProtocol, resulting in a loss of about $398,000; an attack on the BCB contract due to a reentrancy vulnerability, resulting in a loss of approximately $39,800; and a contract that caused a loss of approximately $124,900 in QNT assets due to an arbitrary call vulnerability.GoPlus Security warns that as AI technology enters the battlefield, hacker attacks are becoming more precise and rapid, with vulnerabilities being discovered in "seconds" instead of "days."

In response to the recent attack on the "ListaDAOLiquidStakingVault" contract, ListaDAO officially released a statement clarifying that the attacked contract was not deployed by the official team, but rather was a counterfeit contract created by an unverified third party using a similar name. All official contracts of ListaDAO were not affected by this incident.According to an in-depth analysis by the GoPlus security team, the attack occurred on April 16, 2026, and the root cause was a business logic flaw in the third-party contract. When a token transfer was made, it triggered the Dividend.setShares() function and altered the share accounting within the contract, which in turn affected the reward calculation in the claimReward() function. The attacker exploited this vulnerability to deplete the assets within the contract.GoPlus reminds that since this logical flaw exists in both segments of the contract code mentioned above, any development projects that fork or reuse this code face a high risk of being exploited. It is recommended that relevant developers promptly conduct code inspections and fixes, and implement continuous auditing mechanisms to ensure the security of smart contracts.

Web3 wallet infrastructure Claw Wallet announced a strategic partnership with GoPlus. Claw Wallet has integrated GoPlus's SafuSkill Launchpad, supporting the assetization and tokenization of AI skills, empowering developers to obtain continuous on-chain revenue through GitHub verification.At the same time, Claw Wallet introduces GoPlus AgentGuard security scanning technology, which conducts real-time monitoring and risk visualization of AI Agent's code, sensitive data, and operating environment through a multi-dimensional scoring system. This collaboration aims to enhance the security of AI Agent wallets and improve their ecological incentive mechanisms.

According to disclosures from the GoPlus Chinese community, a user lost approximately $316,000 in USDC from their wallet due to signing a malicious Permit2 transaction, which was exploited by a phishing attacker.GoPlus advises users to adhere to the "four no" principles for phishing prevention: do not click on unfamiliar links, do not install unknown software, do not sign transactions with unclear content, and do not transfer funds to unverified addresses. They also recommend installing the GoPlus security plugin to intercept phishing risks in real-time.

According to GoPlus Security, a piece of malware named Infiniti Stealer is targeting Mac users' cryptocurrency wallets and sensitive credentials through a "ClickFix" social engineering attack method.The attackers forge a highly realistic Cloudflare CAPTCHA page to lure users into opening the terminal and manually pasting malicious commands. After executing the command, the script removes the macOS quarantine attribute and silently writes subsequent payloads to the /tmp directory. The final payload is a native macOS binary compiled with Nuitka, significantly increasing the difficulty of detection by security tools. Once deployed, Infiniti Stealer can steal Chromium / Firefox browser credentials, macOS Keychain, cryptocurrency wallets, and developer key files (such as .env files), and it has sandbox detection and delayed execution capabilities to evade tracking.

According to a security alert released by GoPlus Security, Silverfort security researchers discovered a serious vulnerability in OpenClaw's skill repository ClawHub. Attackers can bypass all protective mechanisms by calling the internal function downloads:increment, allowing them to inflate the download count to over 20,000 in just a few minutes with a single curl request, thereby pushing malicious skills to the top of search rankings and enticing users or AI Agents to install them automatically.Once the malicious skill is running, it can steal sensitive data such as cryptocurrency wallets and API keys. The vulnerability has been patched within 24 hours. GoPlus advises users that a high download count does not equal safety and recommends using AgentGuard for security scanning and protection.

According to Arkham data, at 15:54, 1.6 billion GPS (worth approximately 12.31 million USD) were transferred from GoPlus to a contract address (starting with 0x7448...).

According to GoPlus security monitoring, an address starting with 0x9709 signed malicious Permit and Approve transactions, resulting in approximately $200,000 worth of USDC and wmtUSDT being stolen by phishing attackers.GoPlus states that users should carefully verify transaction details and contract addresses when signing any on-chain authorizations (Approve) or offline signatures (Permit) to avoid signing unknown malicious requests and prevent asset theft.

According to GoPlus monitoring, a user lost approximately $85,000 in sNUSD to a phishing attack due to signing a malicious Approve transaction.

According to GoPlus monitoring, about 8 hours ago, a user lost $1.76 million in USDC to a phishing attack after signing a malicious Permit transaction.

GoPlus released a report on social media stating that it conducted a comprehensive security scan on the top 100 high-frequency download Skills in the ClawHub ecosystem. The number of skills that were blocked reached 21 (accounting for 21%), while the number of skills that received warnings was 17 (accounting for 17%).GoPlus indicated that 21% of the Top 100 Skills involve clearly high-risk operations (such as direct network penetration, sensitive API calls, automatic messaging, etc.), and it is recommended to enforce a "Human-in-the-Loop (HITL)" confirmation mechanism when executing such Skills, to conduct manual reviews of high-risk behaviors. 17% of Skills carry certain risks, and it is advised to execute them with caution; for users with higher security requirements, manual confirmation is also recommended.In this context, GoPlus Security announced the launch of SafuSkill, a security-first Skills marketplace. SafuSkill is built on the BNB Chain and integrates a skills marketplace, an automated Skills security scanning engine, and developer management tools into an AI Agent Skills platform, aimed at helping users filter and discover safer AI Agent Skills. It provides security scanning and runtime protection capabilities for AI Agent Skills, promoting the development of the AI Agent ecosystem towards a more transparent and secure infrastructure layer.

According to the security alert released by GoPlus, attackers are using Google search ads to deploy malware that is a pixel-perfect clone of the official #Claude Code installation page. This malware steals user passwords, cookies, session tokens, crypto wallets, credentials, and system information.GoPlus recommends identifying the ad labels in search results, carefully checking the subtle differences in URLs compared to the official website; verifying installation methods through multiple channels such as official documentation, social media, or GitHub repositories; not executing unfamiliar commands directly and analyzing command behavior before running; and installing security plugins to intercept phishing links, risky signatures, authorizations, and transactions in real-time.

Web3 security company GoPlus stated that the AI development tool OpenClaw has recently been reported to have experienced a self-attack security incident. During the execution of automated tasks, the system constructed an incorrect Bash command while calling Shell commands to create a GitHub Issue, inadvertently triggering command injection, which led to the exposure of a large number of sensitive environment variables.In the incident, the AI-generated string contained a set wrapped in backticks, which was interpreted by Bash as command substitution and executed automatically. Since Bash outputs all current environment variables when executing set without parameters, this ultimately resulted in over 100 lines of sensitive information (including Telegram keys, authentication tokens, etc.) being directly written to the GitHub Issue and publicly published. GoPlus recommends that in AI automation development or testing scenarios, API calls should be used instead of directly concatenating Shell commands, and the principle of least privilege should be followed to isolate environment variables. Additionally, high-risk execution modes should be disabled, and a manual review mechanism should be introduced for critical operations.

GoPlus announced a long-term strategic partnership with Custos. The teams from both sides will engage in deep cooperation around the token locking business, exploring new possibilities for on-chain asset management, and elevating token locking from a basic tool to a protocol-level capital strategic infrastructure.Both parties will maintain clear boundaries and distinct roles, achieving strategic synergy while developing independently. Custos will focus on innovation at the asset management protocol layer, driving the token locking business to a higher level. GoPlus will continue to build secure infrastructure while providing strategic support for Custos's development.