GoPlus Security 🚦 @GoPlusSecurity

🚨 GoPlus Security Alert 🚨 Bitget officially confirmed that its hot and warm wallets were compromised. Estimated loss: $351.6M. Withdrawals are paused pending a full security review.

Gracy Chen @Bitget @GracyBitget

10 hours ago

[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026 At 18:31 UTC on September 24, 2026, Bitget's security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately. What we have

505 550 3K 1.1M 385

CZ reposted the open-source fruit-fly experiment, then Fruit Fly / Immortal Fruit Fly memes took off. Most contracts aren’t honeypots or backdoored, but supply is concentrated and liquidity is dead ($10–$1,500). 0x225a Dev held 80% at launch and made $30K. x.com/i/article/2103…

⚠️ Exploit breakdown: Neutron governance attack On Sept 22, an attacker used a @neutron_org governance proposal to take admin on @astroport_fi and @dropdotmoney contracts, then moved funds. Notional loss $9.4M (~$1.96M already bridged out). 🔍 Root cause Neutron’s wasmd lets chain governance execute MsgUpdateAdmin and rewrite a contract’s admin. App-level multisigs were not the final authority. Neutron chain governance sat above them and could take the contracts. It also exposed a broken economic-security ratio. At incident-time prices, staked NTRN was worth about $113K, while that same governance power controlled ~$9.4M in contract assets. Decisive voting power was cheaper than the funds it secured. 🔗 Attack flow 1. Malicious proposal Proposal #9, “AIATO: AI Agent Takeover”: neutron.celat.one/neutron-1/prop… Sold as an AI governance research experiment. The payload was 11 MsgUpdateAdmin messages. Expedited process: 3-day vote, 67% threshold, 1M NTRN deposit. 2. Cheap votes ~$113K of staked NTRN was guarding ~$9.4M. The attacker first voted with ~100 NTRN, then 11 minutes before tally bought 31.62M NTRN with $20,199 USDC and delegated it. 3. Drain One hour before voting closed, they uploaded code_id 5399 with a malicious withdraw_all { recipient } entrypoint. Within 24 minutes of execution they ran MsgMigrateContract ({"migrate_to_v2":{}}) on 10 contracts and called withdraw_all on each. 📌 Attacker addresses Neutron: neutron1dd25c4sshelrpfs0433apg24c5phrhk8l6n605 Cosmos Hub: cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n Noble / Axelar / dYdX / Osmosis — same private key: noble1dd25c4… / axelar1dd25c4… / dydx1dd25c4… / osmo1dd25c4… Ethereum: 0xe149310eB8b1b3D9C471CcD81819D393621fBA5c 0xEF6c5A31df984c8569236a0AbC1f27580E2a5D54

Astroport ✦ @astroport_fi

3 days ago

We're aware of a security incident on Neutron that may have exposed admin control of Astroport contracts. Neutron has halted the chain to investigate. As a precaution, withdraw your liquidity from Astroport on all chains until further notice. Updates to follow here.

9 6 44 27K 4

📢 GoPlus Security API now supports @arc. As a Web3 security infrastructure provider, GoPlus brings token security, transaction risk detection, and DeepScan AI-powered security audits to the #Arc ecosystem — real-time detection of honeypots, mint risks, blacklists, and more, plus AI contract security audits, continuous security monitoring, and a full suite of capabilities. To support #Arc builders, sign up for an API key with a free quota. Integrate now 👉console.gopluslabs.io

⚠️ Update: The same attacker exploited the @SingularityNET bridge to illicitly mint $AGIX and$WMTx. The attacker's bag has swelled to ~$16.77M on paper, with ~$2.2M already cashed out. This is an ecosystem-wide ops key cluster compromise, not an isolated private key leak. Impacted protocols now include @Fetch_ai, @nunet_global, @SingularityNET, and @wmchain. 🛡️ Security Action Plan: Users: Beware of fake support, refund/claim pages, and "token migration" phishing links. Trust official channels only. Exchanges: Freeze all attacker-linked wallets and halt deposits for the illicitly minted tokens. Projects: Rotate ops keys immediately, audit mint/authorizer roles, and enforce hard caps + cross-chain burn proofs on all bridge functions.

GoPlus Security 🚦 @GoPlusSecurity

5 days ago

🚨 GoPlus Security Alert: On Sept 20, @Fetch_ai and @nunet_global contracts were exploited. The attacker drained 8,721,530 ethereum:0xaea46a60368a7bd060eec7df8cba43b7ef41ad85 from TokenConversionManagerV3 and illicitly minted 408,532,878 $NTX. The attacker walked away with about

keyboard_arrow_left Previous keyboard_arrow_right Next

9 3 28 19K 2

🚨 GoPlus Security Alert: On Sept 20, @Fetch_ai and @nunet_global contracts were exploited. The attacker drained 8,721,530 ethereum:0xaea46a60368a7bd060eec7df8cba43b7ef41ad85 from TokenConversionManagerV3 and illicitly minted 408,532,878 $NTX. The attacker walked away with about $2M. 🔍 Root cause A leaked @Fetch_ai conversion-authorizer private key, plus conversionIn() with no hard cap and no counterparty lock/burn proof. The contract ran as designed: it verified a valid ECDSA signature, then flushed every FET in the bridge to the attacker. The @nunet_global Deployer sat in the same compromised ops key cluster, so NTX was minted straight to the max cap. Attacker 0x1572F2af7696b39c85E3221CDE8EFb640F86c362 Compromised @Fetch_ai conversion authorizer 0x69e5446b07b23de0a76730062c3252152216c85c Compromised @nunet_global NuNet Deployer 0x863F13e5B505f1Eb17803b94EC9d3DaF80092165 Exploited @Fetch_ai contract (FET) 0xab424A430CC09864fA1277A38193111705ADF3A3 Exploited @nunet_global contract (NTX) 0xF0d33BeDa4d734C72684b5f9abBEbf715D0a7935 Payout wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE Attack txs etherscan.io/tx/0xfe12c63b3… etherscan.io/tx/0xe14442f61…

keyboard_arrow_left Previous keyboard_arrow_right Next

Fetch.ai @Fetch_ai

5 days ago

We're aware of reports of an exploit involving a Fetch.ai token conversion contract. Our team is investigating and will share an update soon. Please rely only on official Fetch.ai channels. We will never DM you or ask you to move your tokens.

24 33 419 51K 15

🚨 Low-liquidity token alert: In Season 2 of Community Nominations, @Jimmyfestz nominated robinhood:0x77b0aa38451ccdc1b42587e2f80b9879a7f82356 on #RobinhoodChain: 0x77b0AA38451ccDC1b42587E2f80B9879A7f82356 Extremely thin liquidity with heavy wash-trading risk. Stay away to avoid losses. 🔍 #GoPlus review: reported market cap is ~$13.7M, with ~$1.34M nominal liquidity. Real exit depth in the LP is only about 0.28 #ETH. Inside the $1.39M of 24h volume, we found: 1. Wallet 0xef75…5bae bought 1,692,795.2348 DOGO with 9.383 ETH robin.etherscan.io/tx/0xc2371f9b2… 2. The exact same amount of DOGO was sent to 0x54ff…6edc robin.etherscan.io/tx/0x503c08839… 3. 41 seconds later, the second wallet sold that same batch back to the pool and received 9.382981234 ETH robin.etherscan.io/tx/0xcc4b0b8e5… The Result: Net cost was only ~0.0000188 ETH + gas, but it printed 18.766 ETH in two-sided volume and logged two active wallets. Dozens of similar wallet pairs were spotted doing one-off ~1.6M buys and sells over the last 24h. Sells match buys almost perfectly — blatant wash trading designed to fake volume and bait buyers. 📌 A #DeepScan audit of this token contract will be published in a later report. Keep the nominations coming.

GoPlus Security 🚦 @GoPlusSecurity

a week ago

1/2 The first "DeepScan Community Nomination" campaign has wrapped up — huge thanks to everyone who nominated 🙌 📢 Round 2 is now live — here's how to join: 1️⃣ Follow @GoPlusSecurity 2️⃣ Comment below: I nominate [Token Name] [Chain] [Contract Address] #DeepScanAudit 3️⃣

421 346 404 23K 24

⚠️ Exploit breakdown: oracle manipulation on Nostra Finance On Sept 17, the @nostrafinance money market on #Starknet was hit with an oracle price-manipulation attack. About $3.5M was borrowed out against inflated collateral. The attacker pumped the NSTR oracle from ~$0.006 to $49.5 — roughly 8,000x — then used the overvalued NSTR as collateral to drain other assets. The money market is fully paused. Supply, borrow, and liquidations are all offline. 🔍 Attack flow ▪️ Months earlier (Mar / Aug): accumulated NSTR and pre-positioned collateral 0x06d48ef7 ▪️ Sept 17, 05:23: created a fake NSTR/SolvBTC pool with 1.5 SolvBTC one-sided liquidity and hijacked GeckoTerminal’s pool selection 0x3aa300d2 ▪️ 05:27–05:47: wash traded the pool and pulled liquidity from the market-making range 0x2d9fb4ed ▪️ 05:47–05:48: swapped through the thin pool and spiked the price to $49.5 0x2d9fb4ed ▪️ 05:48–05:50: borrowed out ETH / STRK / USDC / USDT / WBTC / DAI, ~$3.5M 0x06d48ef7 ▪️ 05:51–07:08: dumped via AVNU / Ekubo / JediSwap; 2.2M STRK left the chain through NEAR Intents 0x06d48ef7 ▪️ Around Sept 18: funds consolidated 0xa059aaab 💡 This is a classic low-liquidity oracle failure: 1️⃣ A illiquid token was accepted as collateral 2️⃣ The price feed relied on a third-party source — the attacker appears to have added surface liquidity so GeckoTerminal picked the rigged NSTR pool 3️⃣ Cost of attack: ~1.5 SolvBTC plus NSTR stacked months earlier at cheap prices 📌 Attacker wallets ▪️ Borrow account 0x06d48ef7ab62c26e3ef1987c322096cd508e9034c82048783a6b438fc1344bc3 6 borrows + ~80 sells. Interacted with NSTR contracts in Mar and Aug 2026 — this was staged months ahead. ▪️ Manipulation account 0x2d9fb4edec9d5c015c43514ca5a309aab1b2638c3a45ad750d09ee971d0da23 Ran the pump/dump flow. ▪️ Transit wallets 0x0285b4bf99e227c4baed7f9a8c7c673771fe0b75e897f7350729e3e13021321d — received 1.2M STRK 0x074f5318f8d60ad0832068dc0430d0a0e2f9dd0c2e710fb8c032945a3804b57e — received 1.0M STRK Both immediately bridged out via NEAR Intents. ▪️ Ethereum consolidation 0xA059Aaab82773CAf622DE9d9A0F2dBF9Aa7F3c37 — ~$1.9M Another ~$1.5M is still sitting in the borrow account. ▪️ Sample txs voyager.online/tx/0x2460fde60… voyager.online/tx/0x79005742a…

Nostra @nostrafinance

a week ago

On September 17, a manipulated NSTR oracle price enabled one account to borrow approximately $3.5 million worth of ETH, STRK, USDC, USDT, WBTC and DAIv1 against NSTR collateral in the Nostra money market on Starknet. The Nostra money market is paused: lending, borrowing,

31 6 20 61K 11

Got drained. Staring at an empty wallet. You tweet for help. DM KOLs. Google guides. Ask AI. In that panic, a lot of people get hit a second time. Stop scrambling. Stop guessing. GoPlus just shipped Wallet Theft Detective — a local, read-only Skill that lets your AI Agent hunt down the root cause of the drain. Built specifically for theft forensics. Covers 20+ common off-chain attack vectors: • Clipboard hijacks & address swaps • Infostealers • Malicious browser extensions • npm / PyPI / software supply-chain poisoning • Malicious IDE plugins & fake SDKs • Fake support, fake job offers, fake meetings & upgrade phishing • Drainers, malicious approvals, Permit, blind signing & address poisoning • Seed / private key storage leaks • Fake wallets & mobile permission abuse … Open source. Get your Agent ready before you need it: github.com/GoPlusSecurity…

2/2 Three highlights from Round 1 : 🚨 We exposed a pig-butchering scam ($JINQIAN) 📉 A perfect-scoring contract still crashed 99% ($LAPTOP) 🔍 Serial token deployments aren't always a red flag (ethereum:0xcf0c122c6b73ff809c693db761e7baebe62b6a2e) Other audit results are as follows:

1/2 The first "DeepScan Community Nomination" campaign has wrapped up — huge thanks to everyone who nominated 🙌 📢 Round 2 is now live — here's how to join: 1️⃣ Follow @GoPlusSecurity 2️⃣ Comment below: I nominate [Token Name] [Chain] [Contract Address] #DeepScanAudit 3️⃣ Nomination window: Sep 16 – Sep 23 (UTC) 🎁 Rewards: 10 lucky nominators will win 10U each Selected projects will receive a full three-dimensional DeepScan audit — contract, token security, and liquidity — with the report published for all. Good or bad, on-chain data has the final say.

🚨 GoPlus Security Alert: Watch out for copycat rugs on Arc Arc Chain's launch is hot — day-one volume passed $144M. While most users are still figuring out how to bridge, copycat rugs of high-cap Launchpad tokens $ARGUS and $TOLLY are already popping up. ⚠️ Stay sharp. Double-check the CA before you trade.

According to GoPlus security research: Of 324,000 token issuances on Robinhood, the main risks that have appeared include business fraud, technical risks, contract vulnerabilities, trading security, and social engineering fraud. x.com/i/article/2099…

4/4 📌 Key Addresses & Transactions Original attacker EOA — funded via Railgun `0x0dC2c5D6b05A317076CF501f7E7be36a5dfe9b66` Original exploit contract — deployed PAT, received aTokens, redeemed from Aave `0x10605eE48Ff962952C966277A5D2dac0A0705Cb1` Worthless PAT token — Permissionless Attacker Token `0x8762788ba3ecEe7B61Fc7578A3533433E20461F5` Front-runner EOA — MEV Yoink `0xFDe0d1575Ed8E06FBf36256bcdfA1F359281455A` Front-running contract — MEV Bot: Yoink `0x80BF7Db69556D9521c03461978B8fC731DBBD4e4` Vulnerable strategy executor `0x4f0055926c839D1d960a82CBF84E2eE933958ebC` Abused Safe Module `0xDcDc4ef8C992E75bb0F300536CD93E601c8882AB` Victim Safe — Gnosis Safe v1.3.0 `0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8` Final profit address — still holding 2,882.37 rsETH `0xC70f00CD7E461686b04B0E912E309becA8b80ea0` Original exploit tx: etherscan.io/tx/0x16b9ddf97… MEV front-run tx: etherscan.io/tx/0x0e7680b06…

3/4 3. From there, the attacker had arbitrary execution as the Safe itself — approve, transfer, drain. etherscan.io/tx/0x0e7680b06…

1/4 ⚠️ Exploit Breakdown On Sep 15, 2026, a whale’s #Safe wallet was drained via an auth bypass in its strategy executor. Loss: ~$7.8M. ❓ Root Cause Any caller could set the target to `address(this)` and skip both authorization checks, then `DELEGATECALL` through an already-enabled Safe Module — running arbitrary logic in the Safe’s own context. The attacker dumped ~2,900 aEthrsETH into a Uniswap v4 pool paired against a worthless PAT token, leaving the victim Safe with nothing but junk LP NFTs. The original exploit tx was front-run by MEV bot "Yoink", which walked away with the entire rsETH stack. 🔍 Attack Flow The bug sits in this unverified strategy executor: 0x4f0055926c839D1d960a82CBF84E2eE933958ebC Not in Safe core. Not in Aave. Not in rsETH. (1) Intended path: the target must be an allowlisted Safe, and `msg.sender` must be a Module enabled by that Safe. Set the target to `address(this)` — the executor itself — and both the allowlist check and the Module auth check get skipped.

TermiX × @GoPlusSecurity — Security Agent Free Trial Pay $19.9 for an AI security audit, get $25 back: 💵 12.5 USDC + 🪙 $12.5 in base:0x0c1dc73159e30c4b06170f2593d3118968a0dca5 + ⭐ 50 TermiX Points Only 40 slots. First come, first served. 🧵👇

🚨 GoPlus Security Alert: active proposal attack on #Ampleforth On Sept 12, a freshly funded EOA submitted a malicious proposal on @AmpleforthOrg. Masked as a completed-work grant for SPOT ecosystem analytics tools, it asks to send 2,500,000 USDC from the treasury to the proposer — nearly all liquid treasury funds. Proposal: tally.xyz/gov/ampleforth… Status: Pending. No votes. Funds have not moved. The pass threshold is the risk. 75,000 FORTH to propose, 600,000 FORTH to pass. At the alert-time price of $0.27, ~$160k of voting power could clear $2.5M USDC. Stay sharp. Proposer / payout 0x730C97E793f6F7c476C6AeB3E1c3fDad4714dd82 87,238.546 FORTH voting power Delegator 0x38cAaa5782BF8afF646403D567D76b016d5c24D8 Same 87,238.546 FORTH. Delegated to the proposer 19 minutes before submission. Relay / funder 0x92fc19271fce6d48cd41a0eff6f5dd40f1090d72 Sent 87,238 FORTH + 0.005 ETH gas to the delegator.

More, deeper, more comprehensive AI security audits 🔍 — GoPlus #DeepScan