SlowMist Research
@slowmist_team · 2m
Solana account permission changes need clear wallet simulation. Users should inspect owner reassignment instructions before signing.
UP
CRITICALSolanaHot Wallet CompromiseCONTAINED
Upbit Exchange
South Korea's largest exchange suffered abnormal Solana-asset withdrawals from internet-connected hot wallet infrastructure.
Loss
$36.8M
Risk
Custodial hot-wallet exposure
Confidence
91%
AI Generated Breakdown
Reporter Agent synthesis with forensic confidence scoring
Attack explanation
The attacker exploited online wallet exposure and withdrew Solana-based assets before operational monitoring thresholds could stop the outflow.
Root cause analysis
Large volumes of liquid assets remained accessible through internet-connected wallet systems instead of stronger cold-storage and HSM controls.
91
confidence score
Custodial hot-wallet exposure
Wallet Flow Visualization
Attacker path, bridge transfers, token drains, mixer usage
Technical Breakdown
Attack vector
Hot wallet private-key or signing infrastructure compromise
Vulnerability
Operational liquidity wallet was exposed to online attack paths
Affected contracts
Upbit Solana hot walletExchange withdrawal systemCustodial asset controlsMitigation suggestions
Move excess liquidity to cold storage
Use HSM-backed signing policies for operational wallets
Add real-time anomaly limits by asset, wallet, and withdrawal velocity
Emergency Bridge
Move funds off Solana
Powered byLI.FI
If your assets are at risk on Solana, bridge them to a safer chain immediately via LI.FI — the cross-chain aggregator covering 60+ chains and all major Solana bridges.
From (at risk)
Solana
Bridge to
Best Route via LI.FI
Solana → Ethereum
Mayan Swift • Across • Glacis aggregated
Est. Fee
~$0.50
Open LI.FI Bridge
60+ chains · gasless swaps on Solana · Jito bundles
60+
Chains
$2B+
Volume
20+
Bridges
Exploit Timeline
00:00
Suspicious activity begins
NullTrace Scout Agent detects abnormal account, wallet, or market behavior.
00:19
Exploit pattern classified
Analyst Agent matches the activity against known Web3 attack signatures.
00:41
Funds movement traced
Forensics Agent clusters wallets, bridge routes, exchange hops, and mixer exposure.
01:12
Related posts monitored
Reporter Agent collects researcher warnings and suppresses unverified claims.
03:48
Response tracked
Protocol actions, freezes, recovery updates, and public statements are added to the dossier.
Related Tweets
Demo X/Twitter integration for researcher posts, warnings, and fake-info checks
related tweets demo scan
NullTrace links social posts to the incident by contract mentions, protocol name, researcher credibility, and fake-loss detection tags.
NullTrace Intel
@nulltrace_ai · 4m
On-chain behavior and public reports are aligned. Confidence raised after wallet clusters matched the incident pattern.
Maya Chen
@maya_sec · 7m
The important signal is not only the drain. Watch the staging wallets and the small test transactions before the main move.
Rumor Watch
@intel_filter · 10m
Unverified recovery claims are circulating. No confirmed full recovery unless the protocol or tracked wallet flows support it.
suppressed by misinformation filter
SlowMist Research
@slowmist_team · 2m
Solana account permission changes need clear wallet simulation. Users should inspect owner reassignment instructions before signing.
NullTrace Intel
@nulltrace_ai · 4m
On-chain behavior and public reports are aligned. Confidence raised after wallet clusters matched the incident pattern.
Maya Chen
@maya_sec · 7m
The important signal is not only the drain. Watch the staging wallets and the small test transactions before the main move.
Rumor Watch
@intel_filter · 10m
Unverified recovery claims are circulating. No confirmed full recovery unless the protocol or tracked wallet flows support it.
suppressed by misinformation filter
AI Voice Briefing
Generated incident narration for security leadership
briefing ready · 00:58 · analyst-grade summary