Slowmist
4 incidents, 2 live. 14 days since the last new one.
4 drains in the last 12 months
4 drains in the last 12 months
3 drains in 2026
1 drains in 2025
Live
-
Medium✕Still active
Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet
A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.
Fomo web app users (Privy embedded wallets)·Solana·$48K stolen·Since Oct 8, 2026·
-
Critical◐Partly contained
Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss
A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner.
Solana wallet user (single victim)·Solana·$3.0M stolen·Since Dec 5, 2025·
Past
January 2026 2
-
High✕Still active
Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps
SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.
Linux users installing wallet apps from the Snap Store·Bitcoin, Multiple EVM chains·Since Jan 21, 2026·
-
Critical✓Contained
User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature
A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.
An Aave aEthLBTC holder·Ethereum·$1.1M stolen·Since Jan 3, 2026·
No drains match these filters.