Research Archive
Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.
A malicious GitHub project disguised as a Solana trading bot lured developers with inflated Star and Fork counts, then exfiltrated wallet private keys by hijacking an npm dependency's download URL in package-lock.json. Full attack chain from discovery to deobfuscation and C2 exfiltration, spanning 29 malicious repos and 2 rogue npm packages.
In May 2025, a malicious browser extension named Osiris disguised itself as a Web3 security tool and hijacked users' download links via the declarativeNetRequest API, replacing legitimate programs with malicious ones. The attackers leveraged macOS AppleScript and base64 encoding to conceal their malicious behavior, stealing Chrome browser data and Keychain information.
ReachMe.io is a paid messaging platform on BNB Chain where messaging CZ costs 1 BNB. The SlowMist Security Team discovered an on-chain/off-chain price validation inconsistency that allowed bypassing the 1 BNB fee — sending messages to any KOL for as little as 0.001 BNB. The vulnerability was reproduced in about 10 minutes and the project team fixed it immediately.
In March 2025, attackers posed as recruiters on LinkedIn targeting blockchain engineers, sending them Bitbucket repositories containing malicious code. The malicious payload was hidden on line 46 of server.js behind an extremely long horizontal scrollbar, encrypted through multiple layers of base64, and ultimately connected to a C2 server to download an info-stealing trojan and a persistence backdoor.
On August 18, 2022, Celer Network cBridge suffered a BGP Hijacking attack. The attacker hijacked the underlying Internet routing protocol to redirect cross-chain users to a malicious frontend. Through certificate analysis, AS routing tracing, and BGP Trace records, the SlowMist security team confirmed this was a targeted BGP hijacking attack against Celer Network.
On August 3, 2022, a large-scale theft occurred on the Solana blockchain. Slow Mist Security Team analysis found that Slope Wallet Android >= 2.2.0 sent user mnemonic phrases and private keys to the o7e.slope.finance server via Sentry services, causing the mnemonic phrases of approximately 30% of victim addresses to be leaked.
In June 2022, MetaMask disclosed the demonic vulnerability affecting versions < 10.11.3. When importing a seed phrase and clicking 'Show Secret Recovery Phrase,' the browser caches the plaintext seed phrase to the local disk's Sessions directory, making it readable by other applications or recoverable through physical access. SlowMist Security Team reproduced the vulnerability and assisted multiple extension wallet projects with remediation.
In June 2022, MetaMask disclosed a severe Clickjacking vulnerability. Attackers could exploit the phishing.html page exposed via web_accessible_resources to embed the unlocked wallet page via iframe, tricking users into authorising transactions or bypassing phishing warnings. SlowMist Security Team reproduced the vulnerability and identified multiple affected Fork projects including Coinbase Wallet, Coin98 Wallet, and Maiar DeFi Wallet.
A transfer of 100,000 USDT that incurred a staggering 7,676 ETH transaction fee. The root cause is that ethjs-util's intToBuffer function does not support floating-point data. Divergent handling of floating-point hex strings between browser JS and Node.js leads to incorrect buffer values being written, ultimately producing erroneous fee calculations.