Slow Fog discloses serious vulnerabilities in NOFX AI: which may lead to the leakage of exchange API Key and Private Key.

Wu reported that the Slow Fog security team released a report stating that the open source Crypto Assets futures automated trading system NOFX AI (based on DeepSeek/Qwen AI) has serious security vulnerabilities that may lead to the leakage of exchange API Key and Private Key. The vulnerability originates from the project having “admin mode” enabled by default in multiple versions without authentication checks, allowing attackers to directly access /api/exchanges to obtain key information from exchanges such as Binance, Hyperliquid, and Aster DEX. Although the update on November 5 introduced a JWT verification mechanism, the default keys can still be exploited, and the essence of the vulnerability has not been fixed. Slow Fog recommends that deployers immediately disable admin mode, change JWT keys, and minimize interface return information to prevent asset risks.