SlowMist: Detected malicious supply chain attack campaign targeting npm users and DeFi developers.
Related
Aptos blockchain was found to have a critical vulnerability, with an attack cost of only a few hundred dollars; the team has promptly fixed it.
PANews reported on July 5th that, according to Coindesk, white-hat hackers at security firm Hexens discovered a vulnerability in the Aptos blockchain, which has since been patched. If maliciously exploited, this vulnerability could have put up to $70 billion in digital assets at systemic risk, including stablecoins and cross-chain bridges. In late February, Hexens researchers reported a critical vulnerability in the Move virtual machine (the execution environment for handling on-chain smart contracts) to the Aptos development team. They described it as an "expiration cache vulnerability" that could lead to type confusion, meaning the software could be tricked into mistaking one on-chain resource for another. Researchers simulated the attack in a real network environment with a success rate exceeding 90%.
Malicious iOS app FomoPeek linked to $580K crypto theft, SlowMist says
SlowMist said malicious FomoPeek versions distributed through Apple’s App Store used iOS kernel exploits to escape the sandbox and access sensitive data from other apps.
Cybersecurity firm unveils crypto phishing campaign targeting 885,000 phone numbers
Rapid7 unveiled a new cryptocurrency phishing campaign targeting 885,000 phone numbers, aiming to steal investors’ holdings by redirecting them to fake wallet provider websites.
Specter reveals clues about a BONK DAO governance attack, suggesting that the financial flows of Realms' founder may be linked to the attackers.
According to Mars Finance, on-chain security firm Specter released preliminary findings of its investigation into the BONK DAO governance attack. Tracing the on-chain fund flow revealed significant suspicious activity: financial transactions were found between Realms founders' and Crypto Notte-related addresses and the wallet of the suspected attacker. The analysis indicates that the attacker released a malicious governance proposal on June 30th, with a pass threshold of 1% of the total circulating supply of BONK. From July 4th to 5th, the attacker used approximately $4 million in cryptocurrency purchases on exchanges and MarginFi lending to acquire sufficient voting power to push the proposal through and complete the governance attack.
Hualing Cable: Its subsidiary, Sanzhu Technology, is developing liquid-cooled motor connectors, which will indirectly support Nvidia's supply chain.
According to Mars Finance, Hualing Cable (001208.SZ) released an investor relations activity record announcement. Sanzhu Technology, a key strategic component of the company in the connector and robotics fields, is currently performing well, achieving rapid growth in the first half of 2026, mainly benefiting from strong downstream demand and increased orders from both new and existing customers. In the AI liquid cooling field, Sanzhu Technology is developing a new product, a liquid-cooled motor connector, for an Asian liquid cooling system manufacturer. This product will indirectly supply NVIDIA's supply chain. In the rocket field, the company's clients include LandSpace, China Rocket, and related indirect supporting units. The main product being developed is reusable ignition cables, currently in the R&D, testing, and verification stage. In the satellite field, clients include China Aerospace Commercial Satellite Company and related indirect supporting units. (Cailian Press)
BonkDAO was attacked by a malicious governance proposal, resulting in the theft of approximately $20 million in BONK.
According to Odaily Odaily, Bonk Inu's official X account stated that BonkDAO suffered a malicious governance proposal attack, resulting in the theft of approximately $20 million worth of BONK tokens from its DAO vault. Attackers allegedly transferred BonkDAO vault assets through a questionable governance proposal. The stolen BONK subsequently began flowing into exchanges, putting downward pressure on the BONK price. Data from The Block shows that the BONK price has fallen by more than 9%. South Korean exchange Upbit subsequently issued a statement saying it had temporarily suspended BONK deposits and withdrawals in response to the incident and to guard against potential risks. (The Block)