BitsLab @0xbitslab

Securing and Building EMERGING Web3 Ecosystems ☂️ @MoveBit_ | @ScaleBit_ | @TonBit_ bitslab.xyz Joined July 2024

Tweets

355
Followers

2K
Following

101
Likes

213

MoveBit @MoveBit_

4 weeks ago

🚀Move Web IDE — latest release✅ Auto Completion is now live in the LSP WASM build. Get contextual suggestions as you type — keywords, variables, functions, structs, modules, and more. View symbol types, icons, signatures, and type details in the suggestion popup. 🔘Press Enter or Tab to complete. No install. No setup. Open and code.🙌 🔗ide.bitslab.xyz #Sui #Move #Web3 #DevTools

4 3 15 1K 2

View Details

MoveBit @MoveBit_

a month ago

🚀 Move Web IDE — new release Outline View is now live in the LSP WASM build. Browse Move modules, structs, and functions from a single panel — pinned to the bottom-left of the editor. No install. No setup. Open and code. 🔗 movebit.xyz/MoveWebIDE #Sui #Move #Web3 #DevTools

17 6 29 1K 2

View Details

Claw Wallet @clawwalletcc

a month ago

The future of crypto isn't humans clicking "Confirm." It's agents executing on your behalf. But here's the problem: every AI agent today asks you to hand over your private keys. That's not autonomy — that's surrender. Claw is built differently: 🔐 Key-sharding — no single point of failure, not even us 🤖 Policy-driven controls — agents act within limits you define 🛡️ Anti-phishing at the wallet layer — not your job to spot the scam ⛓️ Multi-chain, gasless, swap-routed across the best DEX aggregators The agent economy is coming. The wallets we use today weren't built for it. Claw was. → clawwallet.cc #AIAgents #Web3 #CryptoWallet #DeFi

2 5 8 527 0

View Details

BitsLab @0xbitslab

a month ago

x.com/i/article/2057…

5 4 7 326 0

View Details

BitsLab @0xbitslab

a month ago

Tweet 12/12 📄 Full technical write-up: github.com/HKUDS/nanobot/… CVE: CVE-2026-33654 Affected: nanobot ≤ 0.1.4.post5 For ongoing AI × Web3 security research from @BitsLabHQ, follow us 👇 t.me/BitsLabHQ

0 0 1 129 0

View Details

BitsLab @0xbitslab

a month ago

Tweet 11/12 Architectural takeaway for every AI Agent framework: Email, Webhooks, RSS — any async channel — cannot rely on claimed identity. They need cryptographically verifiable signals at the boundary. Trust must be earned at the door, not inherited from a header string.

1 0 1 98 0

View Details

BitsLab @0xbitslab

a month ago

🚨 BitsLab Research: One forged email is enough to hijack a nanobot agent. No clicks. No user interaction. No prior access. We disclosed CVE-2026-33654 — a zero-click Indirect Prompt Injection chained with Authentication Bypass in the Email Channel. Here's how it works 🧵👇

2 7 8 877 0

View Details

BitsLab @0xbitslab

a month ago

Root cause stack: 🔴 Data structure ambiguity (supplemental vs full) 🔴 Fixed-offset parsing without flag validation 🔴 No binding between amounts and proof hash Bridges aren't only vulnerable to logic bugs anymore. The next frontier is semantic mismatch between source and destination chains. Stay safe on-chain.

0 0 1 75 0

View Details

BitsLab @0xbitslab

a month ago

The attacker took it one step further. They crafted the trailing reserveTransfers bytes so that — when the contract misreads them at the wrong offset as "hashReserveTransfers" — the value matches: keccak(serializedTransfers) = 0x00a37ecd...3d964581 Verification passes. Funds released.

1 0 1 107 0

View Details

BitsLab @0xbitslab

a month ago

🚨 INCIDENT REPORT — Verus-Ethereum Bridge $11.58M drained in a single transaction. ETH 1,625.37 · tBTC 103.57 · USDC 147,658 Not a signature bug. Not a reentrancy. It was a data-structure ambiguity that let the attacker walk through proof verification untouched. BitsLab breakdown 👇