More public sources.

An exact collector flag.

Polygon collector · select to copy

At 08:27 UTC on October 31, GoPlus’s Polygon lookup returns stealing_attack=1 and names SlowMist as its data source. It supplies no label date, underlying record, transaction references or actor identity. This is a provider assertion. The separate secondary-account lookup returns a zero stealing flag; that does not clear the account. Captured response ↗ · Lookup provenance ↗

A payload record, with a known reference.

The existing OTX exact-hash record has MD5 and SHA-1 values matching the retained payload. Its October 30 pulse references the already-known Hudson Rock article. OTX’s timestamps omit a timezone. The pulse adds no independent earlier capture. The returned analysis supplies no incident configuration or HTTP response, new wallet, or tenant/operator pointer. Record and limits ↗

A historical writer contact.

PredictFolio’s website-linked account quote-posted Car’s writer invitation on November 10, 2025 and directed prospective writers to him. The original supports an editorial contact role at that date. It establishes no June 2026 handover acknowledgment, continuing CMS or deployment access, or malicious control. Primary post and date ↗

What the other sources cover.

SlowMist’s registry points to the already-known official incident post, without the collector address. Four exact-indicator searches across the public ScamSniffer and MetaMask repositories return no hits. Those negatives are limited: ScamSniffer delays public data seven days and stopped updating its legacy address files in February 2024; MetaMask focuses on domains. The searches cover indexed default branches, without complete coverage of large files, other branches or historical commits. Registry check ↗ · Search scope ↗