SlowMist: GitHubs popular Solana tool hides a trap for stealing coins

By: odaily.com|2025/07/03 11:41:26

Odaily News According to the monitoring of the SlowMist security team, on July 2, a victim said that he had used an open source project hosted on GitHub the day before - zldp2002/solana-pumpfun-bot, and then his encrypted assets were stolen. According to SlowMist analysis, in this attack, the attacker induced users to download and run malicious code by disguising as a legitimate open source project (solana-pumpfun-bot). Under the cover of increasing the popularity of the project, the user ran the Node.js project with malicious dependencies without any defense, resulting in the leakage of wallet private keys and theft of assets. The entire attack chain involves multiple GitHub accounts to operate in coordination, which expands the scope of dissemination, enhances credibility, and is extremely deceptive. At the same time, this type of attack uses social engineering and technical means, and it is difficult to fully defend within the organization. SlowMist recommends that developers and users be highly vigilant against GitHub projects of unknown origin, especially when it comes to wallet or private key operations. If you really need to run and debug, it is recommended to run and debug in an independent machine environment without sensitive data.

Artificial intelligence has moved beyond experimentation in crypto markets. In 2025, AI-driven trading tools are increasingly used by traders who want better discipline, faster execution, and more structured decision-making in volatile markets. This guide explains how AI is actually used in crypto trading, step by step — with a focus on how these strategies are executed in real trading environments.

The first large-scale adoption of a "yield-bearing stablecoin" was in China

The digital renminbi has transitioned from "digital cash" to "digital currency".

Market Update — December 31

From South Korea and the OECD accelerating the implementation of crypto regulation and compliance frameworks, to the simultaneous development of TAO ETFs, privacy technologies, mining, and Bitcoin reserves, while security incidents and financial losses continue to rise, the crypto market has entered a new phase amid multiple challenges of "strong regulation + technological evolution + amplified risks."

Lighter Token Distribution Sparks Controversy, Zama Launches USDT Private Transfers, What is the Overseas Crypto Community Talking About Today?

What have foreigners been most interested in for the past 24 hours?

4 Years of Web3 Entrepreneurship: 7 Key Takeaways

Iteration speed, user mindset, and marketing ability are more important than perfect technology.

Can't Beat the Stock Market, Can't Outdo Precious Metals, Is Crypto Really Becoming the Bull Market for "Outsiders"?

Traditional assets are having a blast, but crypto assets are unexpectedly lagging behind.

$50 to $1 Million: How to Survive in the Meme Battlefield with 'Wallet Tracking'

My reliance is not on the luck of a single transaction skyrocketing, but on consistently capturing replicable market patterns.

Paradigm's Tempo Project Launches Testnet, Is It Worth Checking Out?

The current testnet already supports basic EVM functionality and has launched features such as payment channels, stablecoin gas mechanism, and decentralized exchange components.

When Everyone Uses AI Trading, Where Does Cryptocurrency Alpha Go in 2026?

In 2025, AI trading has become the default, but Alpha hasn’t disappeared — it’s been eroded by crowding, as similar data, models, and strategies cause traders to act in sync and lose their edge.
Real Alpha has shifted to harder-to-copy layers like behavioral and on-chain data, execution quality, risk management, and human judgment in extreme markets, where acting differently — or not acting at all—matters more than better predictions.

Without Narrative Power, Web3 Will Not Tap into the Vastness

In the Web3 space, the importance of storytelling far surpasses any other industry.

Key Market Intelligence as of December 31st, how much did you miss out on?

Long-standing domestic public blockchain NEO sees feud between two co-founders, with opaque finances as the core reason

Domestic AI projects are surging, while domestic public blockchains are bickering

Hong Kong Virtual Asset Trading Platform New Regulations (Part 2): New Circular Issued, Has the Boundary of Virtual Asset Business Been Redefined?

The market's potential to advance is now less about regulatory permissiveness and more about whether participants are truly ready to operate under a more transparent and rigorous ruleset.