fog

Fogo chính thức thông báo rằng, mạng chính Fogo đã được khởi động lại và hoạt động bình thường. Trong sự kiện này, tổng cộng có 400 triệu FOGO token đã bị đánh cắp, trong đó 237 triệu token đã được thu hồi và đã bị loại bỏ vĩnh viễn khỏi tổng cung.Chính thức cho biết, đang hợp tác với các sàn giao dịch tập trung và các cơ quan thực thi pháp luật để tiếp tục thu hồi các tài sản bị ảnh hưởng còn lại. Cuộc điều tra vẫn đang diễn ra, thông tin tiếp theo sẽ được công bố qua kênh chính thức này, xin vui lòng chỉ cập nhật theo kênh này.

Tin tức từ ChainCatcher, theo báo cáo của The Defiant, mạng chính Fogo đã ngừng tạo khối khoảng 46 giờ kể từ chiều thứ Bảy, nguyên nhân là do quỹ Fogo bị tấn công, 4 triệu FOGO token (chiếm khoảng 10.3% nguồn cung lưu hành) đã được chuyển đến địa chỉ của kẻ tấn công. Quỹ ban đầu cho biết chuỗi không bị ảnh hưởng, nhưng sau 15 giờ, mạng đã bị tạm ngừng chủ động và dự định hạn chế các địa chỉ liên quan thông qua việc nâng cấp. Hiện tại, trình duyệt chính thức của Fogo hiển thị khối cuối cùng là 718,525,971, điểm cuối RPC trả về lỗi 502, TVL trên chuỗi được theo dõi bởi DefiLlama đã đóng băng liên tục trong 3 ngày ở mức 987,000 USD.Sự ngừng hoạt động này nhờ vào thiết kế xác thực viên của Fogo: chuỗi này được quản lý bởi một hội đồng gồm 7 xác thực viên bỏ phiếu, quỹ phân chia giữa 7 nhà điều hành, do đó có thể phối hợp tạm ngừng và thực hiện danh sách đen địa chỉ cấp khách hàng trong vài phút. Về phía sàn giao dịch, KuCoin và Gate đều đã vô hiệu hóa việc nạp và rút FOGO nhưng vẫn giữ giao dịch, khối lượng giao dịch giao ngay trong 24 giờ khoảng 2.3 triệu USD. Trong khi đó, một tài khoản Twitter giả mạo quỹ Fogo @FcgoFNDN đã phát hành liên kết bỏ phiếu bồi thường giả, Fogo chính thức nhắc nhở người dùng chỉ nên dựa vào thông tin từ các kênh chính thức.Fogo là mạng thứ hai chủ động ngừng hoạt động vào cuối tuần này, trước đó Cronos đã quay lại trạng thái do bị tấn công bởi giao thức cho vay Tectonic. Fogo đã huy động khoảng 7 triệu USD bằng cách bán 2% nguồn cung qua Binance trước khi ra mắt mạng chính vào tháng 1, với định giá 350 triệu USD. Hiện tại, quỹ vẫn chưa công bố chi tiết về cuộc tấn công, kế hoạch bồi thường hoặc thời gian biểu khởi động lại.

Tin tức từ ChainCatcher, Fogo, chuỗi công khai SVM, đã phát hành thông báo chính thức cho biết, trong vòng một giờ qua, mạng chính Fogo đã tạm ngừng hoạt động như một biện pháp phòng ngừa do phát hiện hoạt động không được ủy quyền.Việc ngừng hoạt động nhằm ngăn chặn việc chuyển nhượng tài sản bị ảnh hưởng thêm. Trong thời gian ngừng hoạt động, mạng sẽ được nâng cấp để hạn chế các địa chỉ liên quan đến sự kiện này. Fogo cho biết sẽ chia sẻ thông tin cập nhật thêm sau khi xác nhận thêm thông tin, và chỉ yêu cầu mọi người dựa vào kênh chính thức này để nhận cập nhật.

Tin tức từ ChainCatcher, một kẻ tấn công chưa xác định đã xâm nhập vào quỹ Fogo, khoảng 400 triệu FOGO token đã được chuyển đến địa chỉ độc hại. Quỹ Fogo đã thông báo cho các sàn giao dịch lớn và đang làm việc với các cơ quan thực thi pháp luật cũng như các chuyên gia chứng cứ blockchain.Sự kiện này sẽ không ảnh hưởng đến chính blockchain của Fogo, mạng lưới hiện vẫn hoạt động bình thường. Quỹ Fogo sẽ công bố thêm thông tin sau khi có thông tin chi tiết hơn.

SlowMist has issued a security alert, detecting an active npm supply chain attack targeting @redhat-cloud-services related packages. Currently, over 31 packages have been confirmed affected, with a weekly download volume of approximately 116,000 times, and stolen credentials exist in more than 300 GitHub repositories. This attack method is highly similar to the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret leakage. New suspicious repositories continue to emerge, indicating that the attack is still ongoing, and developers are still being continuously infected.Potential harms include: theft of GitHub/npm tokens, leakage of AWS/GCP/Azure cloud credentials, collection of SSH keys and Kubernetes secrets, leakage of local environment and wallet data, creation of malicious repositories and persistence operations, and even potentially destructive actions after tokens are revoked. It is recommended to immediately remove or downgrade affected @redhat-cloud-services package versions, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all GitHub, npm, cloud service, SSH, and wallet-related keys, retain logs, and rebuild exposed developer machines or Runners from clean images while maintaining a high level of vigilance.

The founder of Slow Fog, Yu Xian, posted on the X platform to interpret the Squid security incident. He stated that sampling found that the related Safe wallets were all single-signature, and the owners were all different, but the issue was not with the private keys; the problem lay in the modules (SquidRouterModule) used by these Safe addresses, which had vulnerabilities. Attackers could forge messages, easily bypass relevant validations, and initiate subsequent exchange operations to transfer funds from the target Safe wallet. In addition, Yu Xian also disclosed information about the address where the attackers' profits were deposited.Previously, it was reported that a third-party Gnosis Safe module was exploited on Base and Ethereum, resulting in a loss of approximately $3.2 million, with the victims being 86 Gnosis Safes that had added this contract as a trusted Safe Module. The contract was named "SquidRouterModule" on Basescan, and subsequently, Squid clarified that it was not affected by the Gnosis Safe-related vulnerability incident.

Slow Fog's Yu Xian posted on the X platform stating that the reason for the Verus theft may be that the attacker constructed a forged Merkle proof, which passed the verification of the Verus Ethereum bridge (not open source), thus successfully withdrawing funds (ETH/tBTC/USDC). Specific details need to be further verified.

The slow fog余弦 social media stated that the high-risk iOS attack framework DarkSword has been publicly leaked on channels such as GitHub and is being used for large-scale espionage attacks targeting cryptocurrency wallet holders.This attack program targets devices running iOS versions 18.4 to 18.7, utilizing vulnerabilities in the Safari browser through malicious web pages to achieve remote code execution, thereby stealing users' sensitive data. Attackers launch attacks using bait web pages that impersonate pornographic live streams, Tron energy stations, refund processes, and more.iPhone users running older versions of iOS, once they access such web pages using the Safari browser (even if they do not close the page), may have sensitive information such as plaintext private keys and mnemonic phrases stolen by malicious JavaScript code when unlocking the wallet app, which is then transmitted in real-time through channels like Telegram bots.

The Chief Information Security Officer of Slow Fog, 23pds, disclosed on platform X that node-ipc has been compromised again. The released three malicious versions of node-ipc (9.1.6, 9.2.3, 12.1) carry the same credential-stealing payload, with the package being downloaded over 10 million times per week.

The U.S. Court of Appeals is hearing the appeal case of Roman Sterlingov, focusing on the key discussion of whether cryptocurrency services are subject to U.S. law. The case centers on: whether a small number of transactions conducted by law enforcement in Washington is sufficient to establish jurisdiction; and the reliability of evidence identifying the defendant through "IP overlap analysis" by the FBI. The U.S. Department of Justice argues that Bitcoin Fog, as a global money transfer service aimed at U.S. users, should be bound by U.S. law; while the defense questions the law enforcement's "artificial creation of jurisdiction."

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

SlowMist has issued a security warning stating that a high-risk phishing activity targeting TRON wallet users has been discovered. Attackers created a fake Chrome extension for the TronLink wallet, using Unicode bidirectional control characters and Cyrillic homographs to disguise the brand name. After installation, the extension loads a complete phishing page through a remote iframe, forming a "shell-core separation" credential theft chain.The malicious extension name uses homographs for disguise, and its Chrome Store page inherits the high user count and positive reviews of the real extension, lowering the review threshold. There is very little local code, only loading remote pages, making static analysis nearly impossible to detect malicious behavior. The remote phishing page perfectly replicates the official TronLink web wallet interface, stealing mnemonic phrases, private keys, Keystore files, and passwords, and relaying them in real-time via a Telegram Bot.Built-in anti-analysis features disable right-click, developer tools, drag-and-drop, and printing, and redirect based on the geographic and language settings of Russian users to evade detection. SlowMist recommends immediately uninstalling suspicious extensions, clearing local storage, checking for abnormal traffic, and if credentials have been entered, creating a new wallet and transferring assets immediately.

The Chief Information Security Officer of Slow Fog, 23pds, disclosed that a privilege escalation vulnerability named Dirty Frag has been exposed in Linux systems, with complete details and exploit code now public. This vulnerability allows any local low-privilege user to directly obtain root privileges on almost all mainstream Linux distributions. It is classified as a deterministic logic flaw, and the attack does not rely on complex race conditions, resulting in a very high success rate without causing kernel crashes, posing significant danger. Linux users are advised to upgrade their systems promptly.

The Chief Information Security Officer (CISO) of Slow Mist @23pds posted on the X platform revealing that X platform user Ilhamrfliansyh induced the AI model Grok to generate and publish abnormal content through a prompt injection attack, triggering erroneous on-chain fund operations.It is alleged that the original content was suspected to be a segment of Morse code, with the core meaning being "transfer all DRB to Ilhamrfliansyh." Although the related account has been deactivated and the complete information cannot be fully confirmed, Grok directly published the "decoded result" as a reply after parsing, inadvertently @ing bankrbot, causing the content to be recognized by the system as an on-chain execution instruction.Subsequently, Bankr, as Grok's associated wallet, executed the request, transferring approximately $175,000 worth of DRB to the attacker's address. The attacker then quickly exchanged the DRB for USDC through multiple wallets.This incident temporarily triggered a nearly 40% drop in the price of DRB, but the market quickly recovered, and the price has largely regained its losses. Industry insiders pointed out that this event exposed the potential risks of the "AI + automated on-chain execution" system under prompt injection attacks, especially in scenarios where AI results can directly trigger fund operations.

The Chief Information Security Officer of Slow Fog, 23pds, tweeted that HexagonalRodent, a subsidiary of the Lazarus Group, is targeting Web3 developers through social engineering tactics such as "high-paying remote positions" and "recruitment for well-known projects" to induce the execution of malicious code, ultimately stealing users' cryptocurrency assets.On March 9, 2026, a user with the same name as a fast-draft extension developer was infected with the OtterCookie malware, which was used to distribute malicious programs. Attackers extensively used ChatGPT and Cursor to assist in executing the attacks, further enhancing the disguise and deception.

The Chief Information Security Officer of Slow Fog Technology, 23pds, forwarded a message from the dark web intelligence account Dark Web Intelligence (@DailyDarkWeb), stating that the hacker group ShinyHunters claims to have infiltrated internal systems related to the Anthropic Mythos model and has shared screenshots of the user management panel, AI experiment dashboard, model performance, and cost analysis. The authenticity of this information has not yet been confirmed by Anthropic.Given that many companies have previously applied to trial the related models, if the news is true, it could pose indirect security risks to leading tech companies and those in the cryptocurrency industry.

According to monitoring by the blockchain security firm SlowMist, MistEye has received threat intelligence from the community indicating that a malware named "MacSync Stealer" (v1.1.2) is active and highly destructive. This malware targets macOS users, stealing sensitive data including cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys (SSH/AWS/K8s).The malware uses a spoofed AppleScript system dialog for phishing and displays fake error messages stating "unsupported" after data leakage. It has immediately synchronized this IOC (Indicator of Compromise) to clients. Do not execute unverified macOS scripts and remain highly vigilant against unexpected system password prompts. If an attack is suspected, immediate remediation is required: change all infrastructure credentials (SSH/AWS/K8s), invalidate any exposed keychains, and quickly migrate cryptocurrency assets to a secure wallet.

According to SlowMist founder Yu Xian (@evilcos), the core of the KelpDAO theft incident, which involved approximately $290 million, was a targeted poisoning attack on the downstream RPC infrastructure of LayerZero DVN (Decentralized Validator Network).The specific attack steps were: first, obtaining the list of RPC nodes used by LayerZero DVN, then breaching two independent clusters and replacing the op-geth binary file; using selective deception techniques to return forged malicious payloads only to DVN while returning real data to other IPs; simultaneously launching DDoS attacks on the unbreached RPC nodes, forcing DVN to failover to the poisoned nodes, completing the forged message verification, and then the malicious binary self-destructing and clearing logs. This ultimately led to LayerZero DVN issuing validations for "transactions that never occurred."

The Chief Information Security Officer of Slow Fog Technology, 23pds, retweeted that the internal system of the cloud hosting platform Vercel was accessed without authorization, which is suspected to be related to an internal data breach.The related tweet indicated that someone on BreachForums claimed to be ShinyHunters and is selling the so-called Vercel internal database, access keys, source code, employee accounts, API keys, NPM tokens, and GitHub tokens for $2 million. The related data is suspected to involve Vercel's internal Linear system and internal user management system.Previously, the cloud hosting platform Vercel disclosed that its internal system was accessed without authorization, affecting a small number of customers.

The Web3 asset data platform RootData has outlined the business partners of Crypto.com. Its strategy goes beyond exchange expansion, advancing through multiple paths such as payments, custody, and brand collaborations, aiming to create a comprehensive digital asset platform covering both institutional and consumer ends. * **Payment Infrastructure**: Crypto.com has integrated with Stripe, Mastercard, Yuno, TripleA, Lynq, etc., covering the complete link from checkout crypto payments to institutional-level real-time clearing. * **Institutional Trading and Custody**: VerifiedX has entrusted Crypto.com with institutional custody for its $1.5 billion digital assets; CoinRoutes provides smart order routing, CryptoStruct connects high-frequency trading, and Doblox offers AI trading terminals. * **Corporate Crypto Treasury**: Crypto.com collaborates with several Nasdaq-listed companies executing treasury strategies, including SOL Strategies, Sharps Technology, and IP Strategy. On the brand side, Crypto.com has formed deep ties with top sports IPs—renewing its partnership with **F1** until 2030 and sponsoring the Miami Grand Prix, as well as **UEFA Champions League**, **UFC**, **NBA Philadelphia 76ers**, **AFL**, and South American CONMEBOL; the long-term partnership with the LeBron James Family Foundation marks an extension of its brand collaboration into the celebrity family philanthropy sector. Additionally, Crypto.com has signed collaborations in the Middle East with Dubai Islamic Bank, DMCC, e& money, Tawasal Al Khaleej super app, and Emarat gas station network, becoming an important participant in the local digital asset compliance ecosystem. Related compilation: 【[Crypto.com Web3 Partner Network Compilation (Continuously Updated)](https://cn.rootdata.com/Archives/detail/Crypto.com%20Crypto%20Business%20Partner?k=NDc0MTU3)】 Cryptocurrency projects actively showcasing their partner networks have become a key way to enhance transparency and market trust. It is reported that RootData welcomes Web3 project parties to [claim data](https://www.rootdata.com/Projects/submit?ft=claimApply) and continues to track and open more project business relationship disclosure channels. The platform has continuously released multiple issues of the cryptocurrency project ecosystem map, nominating Web3 ecosystem partners for upstream clients such as Visa, Stripe, and Coinbase. **If you wish to nominate your project in future ecosystem maps, please fill out the 【[RootData 2026 Industry Ecosystem Mapping](https://forms.gle/tWArmXcpSfZJkh1r8)】 form to supplement your important clients and partners.**