Cos (SlowMist founder)

On his personal website Cos describes himself as a “Hacker,” saying a true hacker needs at least two abilities—discovering zero-day vulnerabilities and engineering hacking solutions—and gives his current status as “Founder of SlowMist & HACK TO CREATE.”⁠[1]

He uses the GitHub account evilcos, whose bio names him and SlowMist; his pinned projects include XSS’OR, a JavaScript web-security tool, and a collection of his public papers.⁠[2]

SlowMist, established in January 2018, is a threat-intelligence firm focused on blockchain ecosystem security, founded by a team with more than ten years of network-security experience. Its products include the crypto anti-money-laundering tracking platform MistTrackMistTrackMistTrack is a crypto-asset anti-money laundering (AML) tracing platform operated by the blockchain security firm SlowMist. It uses on-chain analytics to trace illicit funds and supports compliance investigations with address risk scores, address labels, transaction analysis, and fund-flow graphs, offering a free edition, a professional edition, an institutional real-time monitoring engine, and open APIs; through its X account @MistTrack_io it also publishes on-chain tracing of hacks and thefts.Open the full entry, and it has worked with projects such as OKXOKXOKX is a global digital-asset trading platform that began operating in 2017 under the name OKEx. Different regional entities provide trading, wallet, payment and related services; the global platform, OKCoin and locally licensed entities must be distinguished.Open the full entry, Binance and Crypto.comCrypto.comCrypto.com is a cryptocurrency trading and payments platform founded in 2016, formerly known as Monaco and co-founded by Kris Marszalek and others. It offers a trading app, an exchange, crypto payment cards, custody, derivatives and prediction markets, and is closely associated with the Cronos blockchain and its CRO token. It is known for large sports naming-rights sponsorships and holds licenses in many jurisdictions worldwide.Open the full entry.⁠[3]

His X profile identifies him as the founder of SlowMist; the account was created in November 2008.⁠[4]

Looking back on X, he said he wrote the Blockchain Dark Forest Selfguard Handbook by hand in Markdown before capable large language models existed; thanking contributors and readers, he said the handbook’s mission would come to a close.⁠[5]

On October 30 (UTC), Cos shared MistTrack’s finding that funds stolen from Binance had become linked to wallet addresses used by the hacker in the early-2025 Phemex theft, and said SlowMist had at the time identified North Korean hackers behind the Phemex attack.⁠[6]

On October 31 he noted that Lido’s seven-day average APR had risen from 2.2% to 4.2% within two days, because intense on-chain competition triggered by the Binance hacker the previous day had generated large extra execution-layer rewards on Ethereum, benefiting stETH holders.⁠[7]

Published open source by SlowMist on GitHub with “Cos@SlowMist Team” as author, the handbook covers wallet creation and backup, anti-money-laundering, DeFi and NFT security, signing risks, privacy protection, and stopping losses and tracing funds after a hack; Chinese, Japanese, Korean, Arabic and Indonesian versions are also available.⁠[8]