ChainCatcher news, Slow Mist posted on platform X stating that the devices of Safe developers were compromised, leading to the injection of malicious code into the frontend, which intercepted and modified transaction parameters. After a quick verification, it was found that there was indeed malicious code behind the js files of the Safe frontend, and the related address (0xbdd077f651ebe7f7b3ce16fe5f2b025be2969516) is involved in the malicious execution contract that siphoned off 1.5 billion assets from ByBit.

ChainCatcher message, Bybit co-founder and CEO Ben Zhou released a hacker forensics report provided by Sygnia and Verichains on the X platform, which disclosed that malicious code was deployed at 15:29:25 UTC on February 19, specifically targeting Bybit's Ethereum multi-signature cold wallet.

ChainCatcher news, digital asset wallet TokenPocket issued a statement in response to the incident on February 14, where user assets were aggregated and stolen by hackers. Technical analysis revealed that affected users had downloaded a third-party mining software called "Bom," which exhibited malicious behavior by unauthorized access to users' photo albums and uploading data, leading to the leakage of users' mnemonic phrases or private keys.TokenPocket has collaborated with security teams such as SlowMist Technology and GoPlusSecurity, and reminds users to immediately stop using unverified third-party tools, and to avoid saving mnemonic phrases and private keys through screenshots, social platforms, cloud storage, and other methods.

ChainCatcher message, AabyssTeam founder issued a security warning on X, stating that Cyberhaven security company was attacked by phishing emails, resulting in the browser plugin they released being implanted with malicious code, attempting to read the uploaded users' browser cookies and passwords. Subsequent code analysis revealed that multiple browser plugins were attacked, including Proxy SwitchyOmega (V3), affecting five hundred thousand users in the Google Store, which is currently under scrutiny.The founder of Slow Mist, Yu Xian, forwarded the warning and stated that this type of attack uses an OAuth2 attack chain. After obtaining the "extension publishing rights" of the developer of the "target browser extension," they publish an updated plugin extension with a backdoor. Each time the browser is launched or the extension is reopened, it may automatically trigger the update, making the backdoor implantation difficult to detect. He reminds wallet extension developers not to be careless.

ChainCatcher message, according to Scam Sniffer monitoring, KlapAI has been hacked, and malicious code has been injected into the front end. Users are advised to use it with caution to avoid phishing risks.

ChainCatcher message, Ledger stated on social media that the official Ledger Connect Kit version 1.1.8 has now been pushed. Ledger and WalletConnect confirmed that the malicious code has been disabled. Users can safely use the Ledger Connect Kit, but it is recommended that users wait 24 hours and clear their browser cache.Previously, hackers exploited a vulnerability in the Ledger Connect Kit to steal approximately $484,000 in assets.Slow Mist founder Yu Sen emphasized that the Ledger wallet itself was not affected; the affected parties are some DApps that rely on the Ledger module.

ChainCatcher message, the Web3 anti-fraud service provider Scam Sniffer posted on social media that Ledger has updated its codebase to version 1.18 to remove malicious code.ChainCatcher reminds that it is currently uncertain whether it is safe to interact with dApps, and users are advised to proceed with caution.

ChainCatcher news, Slow Mist founder Yu Xian stated on the X platform that there has been a recent emergence of malicious code targeting http://friend.tech (ft).Scammers will lure target users to add this code as a bookmark, and when users visit the ft page, once the bookmark is executed, the malicious code will trick users into revealing their passwords (i.e., ft's 2FA), and steal tokens related to ft and its embedded wallet Privy. This means that users' ft accounts and related funds will be stolen.