We protect you from drainers on all EVM and SOL - 0 user losses since 01/2023 - $30,000 Coverage On Your Txns You make the profits, we keep them yours 👇
Get the extension here ➤
Joined March 2022
- Tweets1K
- Following45
- Followers10K
- Likes4.8K
Pinned Tweet
Crypto is planning for AI that can break wallet signatures.
All the fixes on the table share one flaw.
Our CTO Danor @An7i21 Cohen on what actually holds.
🚨 CRITICAL CRYPTO ALERT 🚨
Two critical vulnerabilities ("PHP2Shell") were just disclosed in PHP, the language behind a huge share of the web, including WordPress, and crypto sites.
Both let attackers run code on servers without logging in, and exploit attempts are already live. A compromised site can quietly swap in a wallet drainer.
Don't connect your wallet or sign anything on a site unless you fully trust it, or it has confirmed on its official socials that it's patched.
Dramatic Update: The NSA & FBI now call site owners worldwide to patch or take sites down; several government sites have already gone down.
teapawt.net/NSACyber/status/211290…
teapawt.net/FBICyberDiv/status/211…
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Kerberus retweeted
Offering automated security solutions, @Kerberus simulates every tx before it reaches the user.
To preview tx outcomes, the team runs ~2M simulations across 50+ chains on Tenderly monthly.
Learn how Kerberus uses simulations to ensure user protection: 🧵
tenderly.co/blog/case-studie…
Kerberus retweeted
Blur is shutting down in 30 days
Revoke approvals ASAP to avoid potential future losses
Head to revoke.cash, search for Blur on the ETH chain for all your wallets, and revoke all approvals
Kerberus retweeted
⚠️ IMMEDIATE ACTION REQUIRED: MagicEden's contracts have been exploited and your NFTs and WETH are at risk ⚠️
Revoke all approvals to
0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
0x9a1D00000000fC540e2000560054812452eB5366
Using revoke.cash
Ethereum → filter each address → revoke every NFT “approved for all” row
Repeat for Polygon and Base
We are sharing an interim update regarding an exploit identified with @limitbreak Payment Processor V2, a NFT trading protocol maintained by the company Limit Break and which Magic Eden adopted to settle trades on EVM in 2024.
Magic Eden stopped using Payment Processor V2 in Oct 2024 and ceased our EVM marketplace altogether in Q1 2026. No live Magic Eden listings were impacted in this exploit. We will provide more updates as we investigate the impact further.
We are also contacting Limit Break as they are the owner & maintainer of the protocol to see what other mitigations can be done, including progress on pausing transfers on the protocol. Thank you to @0xQuit for the whitehat rescue and for bringing this to our collective attention: teapawt.net/0xQuit/status/21034106…
Why are ME listings being shown to be involved?
NFTs listed on ME EVM from approx Feb 2024 to Oct 2024 could be impacted by this issue with the Limit Break Payment Processor v2 contract. Any listings on ME EVM after Oct 2024 should not be impacted here. We are still further refining our investigation and will provide more updates here.
In the meantime, if you listed or traded NFTs on Magic Eden’s EVM marketplace before we shut it down, revoke this contract:
Limit Break: Payment Processor (V2)
0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
Go through our instructions here: revoke.cash
Ethereum → filter that address → revoke every NFT “approved for all” row
Repeat for the following chainsPolygon
Base
See also 0xQuit’s tweet on revocation for further reference also: teapawt.net/0xQuit/status/21034106…
NOTE: Revoking does not return tokens that already moved.
Again, we will keep the community updated as we investigate further.
Kerberus retweeted
Introducing Polymarket Alerts 🚨
Pocket Universe does the work for you, so you don't have to sit and stare at a screen
Turn them on for any market, and it pings you on Telegram or Email the moment it matters
For example, when a whale bets on one of your positions 👇
Kerberus retweeted
Today we are publishing the first Ill Bloom findings: affected-address checker + on-chain analysis to help users identify exposed addresses and protect their assets.
🔗 illbloom.org
⚠️ We will never ask for seed phrases, private keys, signatures, or approvals, or ask users to send funds to "recover" or protect a wallet.
Kerberus retweeted
2022: you got drained because you had no clue what you were signing
✅ PU fixed it and changed how you aped into coins and NFTs
2026: you're losing on Polymarket because you have no clue about each market's risks
🔜 Pocket Universe...?
You won't bet blind much longer 🟣
Kerberus retweeted
Pocket Universe users don’t have to fear anymore about one of crypto’s sneakiest and most expensive scams
Address Poisoning Protection is now live in Pocket Universe v1.12.0 🟣
Kerberus retweeted
A long-time Pocket Universe user lost $17,000 after signing a malicious transaction
We covered every cent through our up to 30,000 USDC coverage
Here's exactly how it unfolded 👇
Kerberus retweeted
Pocket Universe protects you from scams and wallet drainers with a 99.9% scam detection rate powered by @Kerberus and gives you up to $30,000 in transaction coverage.
Install it in your browser today 👇
pocketuniverse.app
See you next week. Stay protected, stay informed, and remember, as always:
You make the profits, we keep them yours 🛡️
1
2
860
That wraps up the week’s most critical security events. Thank you for reading!
About us: Kerberus is the market-leading Web3 security solution for detecting scams, phishing, and hacks in real time. 0 user losses for 3+ years and up to $30,000 in transaction coverage.
1
2
38
A hacker claimed to have brute-forced a NordVPN development server and leaked customer data.
NordVPN says it was just test/dummy info with no customer impact. Pure FUD.
teapawt.net/NordVPN/status/2008195…
Hey there. We’re aware of the claims circulating online, and our team has already reviewed the situation.
We take security very seriously and have shared full details and clarifications in our official statement here:
nordvpn.com/pl/blog/addressi… -N.L.
1
1
97
The old Arbitrum trading platform, @futureswapx, got hit on Jan 10.
An attacker used a flash-loan loop and spammed position changes to walk off with $395K USDC.
The platform has been abandoned since 2023, so there is no official statement.
teapawt.net/Phalcon_xyz/status/200…
ALERT! Our system detected a suspicious transaction targeting @futureswapx’s contract on #Arbitrum a few hours ago, resulting in an estimated loss of ~$395K. We have attempted to contact the team, but have not received a response so far.
The attacker appears to have drained funds through multiple changePosition operations, eventually withdrawing a large amount of USDC.
Since the contract is not open-sourced, the exact root cause still requires further investigation. Based on on-chain behavior, we suspect the incident may be related to unexpected stableBalance accounting changes during earlier position updates, which later allowed USDC to be released when removing collateral.
1
1
66
A USDC Fusion Optimizer vault on Arbitrum lost $336K USDC due to a bug in an old contract.
Under 1% of funds were hit, and newer vaults are safe.
Good reminder to revoke approvals regularly.
teapawt.net/ipor_io/status/2008728…
🚨 Security Update: IPOR USDC Fusion Optimizer on Arbitrum Vault Exploit
The IPOR team was alerted on January 6th by @hexagate_ and @blockaid_ regarding a malicious transaction. Following a swift investigation, we have identified an exploit resulting in a loss of $336K USDC.
The Details:
• Root Cause: The exploit targeted a specific legacy Fusion vault.
• Scope: Due to its unique configuration, this was the only vault vulnerable to this specific attack vector.
• Impact: The loss represents less than 1% of total funds secured by Fusion.
Next Steps & Recovery:
• Recovery: We are collaborating with @_SEAL_Org and relevant security entities to track and recover the funds.
• Depositor Security: The IPOR DAO will patch the shortfall from the treasury. All affected depositors will be made whole.
• Safety: No other Fusion vaults are affected
Find the full technical post-mortem here
blog.ipor.io/post-mortem-ipo…
1
2
69
A $1.4M exploit hit an unverified @TMXTribe contract.
A bug allowed the attacker to loop fake USDG mints and swap them for real assets due to incorrect LP pricing and a lack of supply checks.
Funds were later moved to ETH and laundered.
teapawt.net/CertiKAlert/status/200…
#CertiKInsight 🚨
We have seen a ~$1.4M exploit on an unverified contract related to @TMXTribe on Arbitrum.
In an exploit loop, the exploiter mints and stakes TMX LP with USDT, swaps USDT for USDG, unstakes, and sells more USDG. The tactic has been repeated many times to drain USDT, as well as wrapped SOL and WETH.
Stay Vigilant!
1
1
108