Onchain Security Roundup: Sep 14-21

Individual Safe Drained through Custom Module

TL;DR: A Safe multisig belonging to an unidentified holder lost 2,882 rsETH ($7.7–7.8 million) on 15 September. An authorisation flaw in a custom keeper contract let anyone drive a Uniswap v4 liquidity module that the Safe had enabled. The MEV bot 'yoink' spotted the attacker's transaction in the mempool and executed it first, taking the funds. Kelp DAO paused the receiving address for 24 hours, and the funds have not been recovered.

Safe is the most widely used smart-account standard on Ethereum. Owners authorise transactions with a threshold of signatures, but a Safe can also enable "modules", contracts that are allowed to execute transactions from the Safe without any owner signature. Modules are useful for automation, and dangerous for the same reason: whoever can call the module can move the Safe's assets within whatever the module permits.

This Safe held aEthrsETH, the Aave v3 receipt token for rsETH (Kelp DAO's liquid restaking token), and used a custom module to manage Uniswap v4 liquidity positions. The module could only be called through a router or executor contract that had a multicall function with a permission check. According to independent analyses by SlowMist, Phalcon and Blockaid, and a working proof-of-concept later published to DeFiHackLabs, that check passed automatically whenever the caller supplied the router's own address as the target. By nesting the call twice, an attacker could make the router treat their arbitrary calldata as trusted, reach the Safe module, and issue a delegatecall from the Safe itself.

The attacker used that path to withdraw ~2,900 aEthrsETH from Aave v3 and deposit the underlying rsETH into a Uniswap v4 pool the attacker had created, paired with a worthless token and fitted with a hook that unwrapped the assets. The Safe was left holding a valueless liquidity NFT. However, the attacker didn’t get away cleanly. The exploit was broadcast to the public mempool, and a generalised MEV bot known as ‘yoink’ replicated it in the same block ahead of the attacker. The bot captured 2,882 rsETH and routed it to its own address, leaving the original attacker's transaction to be executed against an already-empty position. Blockaid recorded several smaller follow-on extractions over the next hour, totaling under $30,000.

Kelp DAO responded within 90 minutes, placing the bot's receiving address under a temporary 24-hour pause at the rsETH token level, and communicating that their own contracts and rsETH backing were unaffected. Once the pause expired, the funds moved on 16 September to another externally owned address, where ~2,891 rsETH remains as of this report. 

This loss was the result of a vulnerability in the custom module via module-authorisation abuse. It was not a flaw in Safe's core contracts or a compromise of owner keys. This Safe still holds a larger aEthrsETH position, which was not affected.

Nostra Finance Oracle Manipulation on Starknet

TL;DR: On 17 September an attacker pushed the price of Nostra's NSTR token in the protocol's Pragma oracle feed from $0.006 to $49.5 and used NSTR collateral to borrow ~$3.5 million of ETH, STRK, USDC, USDT, WBTC and DAI from Nostra's Starknet money market. Nostra paused the market entirely and says the final loss and any recoveries are not yet known. $1.93 million of the proceeds (234.6 ETH and 1.35 million DAI) was bridged to Ethereum and is still sitting there, another $1.55 million reportedly remains on Starknet.

Nostra is a lending market on Starknet, an Ethereum L2. The protocol prices collateral using Pragma, a Starknet oracle that aggregates several external sources. Nostra had accepted its own governance token, NSTR, as collateral. NSTR trades thinly, which is the standard precondition for this kind of attack.

Reconstructions published by Phalcon and GoPlus describe the sequence, and they are consistent with Nostra's own statement. The attacker accumulated NSTR and deposited it as collateral months earlier. On 17 September the attacker created a new NSTR/SolvBTC pool seeded with 1.5 SolvBTC of one-sided liquidity, which appears to have made that pool the one selected by a market-data aggregator feeding one of Pragma's sources. A small purchase through the thin pool then produced a quoted price near $99. Pragma's documentation describes a median across three sources, but at that moment only two responded (a normal quote near $0.006 from AVNU and the manipulated quote), so the "median" was their average of $49.5. Nostra's market accepted that price. The attacker's second account then borrowed $3.5 million of liquid assets against collateral that was, at true prices, worth almost nothing. Pragma has not publicly confirmed this mechanism.

Nostra confirmed the event the same day, paused lending, borrowing, withdrawals and liquidations. The team said they are reconciling the impact per asset, tracing funds and working on recovery. PeckShield and CertiK tracked 234.6 ETH and 1.35 million DAI bridged to an Ethereum address, with $1.55 million reportedly still on Starknet. Because the collateral was near-worthless and the borrowed assets have not been returned, the loss to Nostra's depositors is likely close to the borrowed amount unless funds are recovered.

D'CENT App Wallet Unauthorised Transfers Due to Software Vulnerability

TL;DR: From 15 September, users of the software "App Wallet" inside D'CENT's mobile app saw their balances swept to attacker-controlled accounts, mostly on the XRP Ledger. Community mapping put the first two hours at 2.0 million XRP (~$2.8 million) from ~1,550 wallets; our team verified 3.3 million XRP flowing into the two main collector accounts between 15 and 18 September, including ~2,080 emptied accounts that were then deleted from the ledger. Vendor IoTrust says only recovery phrases that were entered into the App Wallet and used to sign on app versions older than 8.1.0 are at risk, that hardware wallets are unaffected, and that the exact cause is still under investigation. 

D'CENT, from Korean firm IoTrust, is best known for its biometric hardware wallets, but its mobile app also offers a software wallet in which the recovery phrase is stored on the phone. On 16 September the company announced "abnormal asset transfers" affecting that App Wallet and told users to update the app and move funds to a new wallet with a fresh recovery phrase.

The onchain picture on XRPL is clear even though the cause is not. Starting at 16:29 UTC on 15 September, 3,345 payments totalling 1.28 million XRP flowed into one collector account over three days. Community mapping of the wider sweep, cited by Korean and crypto media, counts 2.0 million XRP from ~1,550 wallets in the first two hours. From 17 September a second collector received 267 payments totalling 1.61 million XRP and 1,949 AccountDelete transactions that closed out victims' accounts, sweeping their reserve balances (~457,000 XRP) after they had already been drained. Both collectors have since moved the funds. Unconfirmed reports have stated that losses have risen to 9.3 million XRP across 6,160 addresses. Losses on Bitcoin, Ethereum and TRON, which D'CENT lists as potentially affected chains, have not been confirmed.

IoTrust's status report of 17 September narrows the exposure to phrases that were entered into the App Wallet and used for signing on versions below 8.1.0 (released November 2025), which could imply a weakness in how earlier versions handled key material during signing. The company says the matter has been accepted by Korean law enforcement, that it is tracing funds with an external security team and asking exchanges to freeze suspected proceeds, and that reimbursement remains undecided.

SingularityNET Bridge and ASI Conversion-contract Key Compromise

TL;DR: An attacker holding compromised signing and administrative keys for token-conversion infrastructure in the SingularityNET / Artificial Superintelligence Alliance ecosystem drained 8.72 million FET (~$1.55 million) from Fetch.ai's conversion contract, minted 408.5 million NTX from the NuNet deployer account, and then minted hundreds of millions of unbacked AGIX and WMTx tokens. Realised proceeds are estimated at 546–708 ETH ($1.4–2.2 million); the bulk of the minted tokens remains unsold in two attacker wallets. Fetch.ai has paused AGIX-to-FET conversions and its Ethereum bridge as a precaution, and World Mobile is preparing a pre-exploit snapshot of WMTx. The incident is ongoing.

The three projects that formed the ASI Alliance (Fetch.ai, SingularityNET and Ocean Protocol) and partners such as NuNet and World Mobile use a shared family of "TokenConversionManager" contracts to move tokens between chains and to convert legacy tokens such as AGIX into FET. A trusted off-chain service signs a message authorising each conversion, and the contract releases or mints tokens on Ethereum when it sees a valid signature. The security of the whole system rests on the secrecy of one signing key per contract.

At 20:26 UTC on 19 September an address called conversionIn on Fetch.ai's TokenConversionManagerV3 with a valid authorizer signature for its own address and received the contract's entire remaining FET inventory, 8,721,530 FET, in one transaction. SlowMist's analysis notes that the function relies solely on that single signature, does not check the per-transaction limits present elsewhere in the contract, and verifies no proof that tokens were locked or burned on the other chain. A leaked key was sufficient. Twenty-eight minutes later the NuNet deployer account minted 408.5 million NTX to the same recipient wallet; NTX supply now stands at about 967 million, so the mint was roughly 42% of the total. Phalcon attributed both to leaked private keys of two privileged accounts. From 03:35 UTC on 20 September the attacker began minting AGIX: independent trackers counted 896 million. In the same window at least 445 million WMTx flowed from World Mobile's converter into a second attacker wallet.

The realised proceeds are smaller than the headline numbers suggest. FET and NTX were sold for ETH quickly. Sources put total cash-out between 546 and 708 ETH ($1.4–2.2 million), and the main wallet still holds ~433 ETH. The minted AGIX and WMTx, 824 million AGIX and 327 million WMTx, cannot be sold into existing liquidity at anything close to quoted prices. World Mobile's snapshot plan implies the unauthorised supply will be treated as invalid. Fetch.ai said its own contracts were not the source of the vulnerability and that "the attack is targeting SingularityNET contracts, primarily the SingularityNET Bridge between Ethereum and Cardano chains.” Together with SingularityNET, the Fetch.ai team has deactivated the affected wallets and contract while pausing conversions. World Mobile said it is working with exchanges to freeze deposits and is revoking all minting authorities. SingularityNET has not published a statement as of this report. 

FomoPeek Malicious iOS App Distributed through the App Store

TL;DR: SlowMist and OKX's security team found that FomoPeek, a "whale-watching" iOS app listed on Apple's App Store on 29 August, shipped two hidden modules in versions 1.1 and 1.2 (9–17 September) containing eight iOS kernel exploits that could escape the app sandbox, decrypt the device Keychain and read data from 19 targeted wallet apps. MistTrack traced ~580,000 USDT to the primary attacker address, active since 15 September; total victim losses are unknown. Version 1.3 removed the modules; SlowMist classifies devices that ran 1.1 or 1.2 as exposed, and Apple has not commented publicly.

FomoPeek presented itself as a read-only tool for tracking large wallets on Solana, Ethereum and TRON. It did not ask for seed phrases or wallet connections, which is exactly why a malicious payload inside it was effective. Users had no reason to think a monitoring app could reach their wallet keys. Distribution ran through crypto influencers offering a 5–7 USDT reward for installing the App Store version with a referral code and keeping the app open on a physical device for several minutes, a requirement SlowMist notes matches the multi-minute runtime of one of the embedded exploits.

According to SlowMist's static and dynamic analysis, the malicious frameworks were part of the official App Store package rather than a sideloaded build. On launch the app fetched an encrypted command-and-control address from a public code repository, reported the device's installed apps, and waited for remote switches that could enable, repeat or disable exploitation without shipping an update. The exploit library declared coverage from iOS 12 to 18.7.2 and iOS 26.0–26.1. In an isolated test SlowMist observed the app escalate privileges, decrypt Keychain data and upload a targeted app container to the attacker's server. Victim funds were converted to USDT across TRON, Ethereum and BNB Chain, consolidated on Ethereum, and passed through several bridges, aggregators and exchanges.

SlowMist published its initial alert on 19 September and a joint analysis with OKX on 20 September. Version 1.3 had removed the modules on 17 September. Apple has not commented publicly, and total victim losses remain unknown.

Flamincome Legacy USDT Strategy Share-Price Inflation

TL;DR: On 16 September an attacker extracted ~$346,000 USDT from an old Flamincome yield-vault strategy on Ethereum. The attacker inflated the vault's share price mid-transaction with an $18 million Morpho flash loan and then redeemed shares against the strategy's real Aave aUSDT. Third-party analysis puts the strategy's own loss near $595,000. No team statement or recovery has been reported.

Flamincome was a yield product associated with Flamingo Finance's early Ethereum-side contracts. Its USDT vault issued shares whose value was computed from the assets the strategy it held – aUSDT lent on Aave, plus a Curve USDP/3CRV liquidity position staked in Convex. The strategy valued that Curve position by multiplying its staked balance in Convex by Curve's get_virtual_price, a figure that reflects the pool's nominal token count rather than what the tokens are actually worth. In a pool where USDP had depegged, that largely overstated the position. Compounding the error, the Convex staking contract allows anyone to stake on behalf of another address, so the strategy's "own" balance could be inflated by an outsider.

The attacker borrowed 18.1 million USDT from Morpho in a flash loan, bought USDP cheaply, minted a large amount of USDP/3CRV LP tokens, and staked them into Convex on behalf of the Flamincome strategy. The vault's share price jumped. The attacker then redeemed vault shares acquired within the same transaction, forcing the strategy to pull real aUSDT from Aave and pay out the inflated valuation, repaid the flash loan, and kept 345,903 USDT. SlowMist, Blockaid, DefiMon and Panda Security published consistent root-cause analyses. Curve, Convex, Morpho and Aave worked as designed; the failure was Flamincome's accounting.

Nimiq Stablecoin Swap Handlers on Polygon: OpenGSN Paymaster Bypass

TL;DR: On 16 September an attacker took ~$50,000 in USDC and USDT from a liquidity wallet operated by a Nimiq partner on Polygon. The wallet had approved Nimiq's swap contracts to spend its stablecoins, but those contracts relied on a separately selected OpenGSN paymaster to verify the user's signature. The attacker supplied a paymaster that accepted every request and drained the wallet. Nimiq confirmed the loss, said no other funds were affected, and disabled OpenGSN-based gas abstraction for stablecoins across Nimiq Pay and Nimiq Wallet.

Gas abstraction lets a user sign a request that a relayer submits while paying the transaction fee. In Nimiq's OpenGSN setup, the relay hub passed requests to the swap handlers while a separate paymaster performed the authorisation check. SlowMist and DefiMon found that the handlers' execution function ignored the signature and nonce, assuming that the paymaster had already validated them.

The attacker staked 1 POL to register as a relayer and supplied a paymaster that accepted every request. It then submitted a forged request from the partner wallet, which had granted the Nimiq handlers unlimited approvals. The handlers opened swap contracts for the wallet's entire USDC, USDT0 and USDC.e balances to an attacker-controlled address, and a second transaction redeemed all three. There were transfers of 26,130.64 USDC, 24,332.49 USDT0 and 0.66 USDC.e, totalling $50,463 and matching Nimiq's and SlowMist's figures. DefiMon says its monitoring flagged the exploit contract 19 minutes before the attack.

Nimiq disabled OpenGSN-based gas abstraction for stablecoins on 17 September and confirmed the incident on 19 September. It said no other funds were affected and that reports had been filed. The replacement design remains in development.