Golden Finance reported that Slow Fog issued a security alert. On February 14, 2025, several users reported that their wallet was unauthorized access. On-chain analysis shows that these events are related to mnemonic/private key leakage. Most affected users have installed an app called BOM that proved to be a carefully disguised scam. Malicious actors use BOM to steal private keys and mnemonics, thus being able to transfer and hide stolen assets. The Slow Fog AML team and the OKX Chinese team have conducted a detailed investigation, tracking the strategies used, and providing critical security suggestions to protect users.