NOFX AI Bug Exposes API Keys, SlowMist Warns of Major Risk

NOFX AI, an open-source automated trading system built on DeepSeek/Qwen AI. It is facing a serious security crisis after SlowMist uncovered vulnerabilities. That could expose exchange API keys and private keys. The issue affects users across major exchanges, including Binance, Hyperliquid and Aster DEX. SlowMist now urges deployers to take immediate action before attackers exploit these weaknesses to drain funds.

Admin Mode Flaw Leaves Keys Fully Exposed

SlowMist began investigating the system after receiving a warning from a community security researcher. The team quickly discovered that several versions of NOFX AI shipped with admin mode. It is enabled by default and worse, the system performed no authentication checks at all. Because of this, anyone could simply visit the public /api/exchanges endpoint and instantly retrieve sensitive data. Such as API keys, secret keys and private wallet keys. 

This issue stemmed from a commit published on October 31. Which hardcoded admin mode to “true” in the config file and database migration scripts. The server then skipped all authorization whenever admin mode was active. In simple terms, any NOFX AI instance running with default settings was effectively unlocked. That is to say, anyone with the link could walk in and take the keys, literally.

Patch Attempts Didn’t Fix the Core Problem

Developers tried to address the issue on November 5 by adding JWT token verification. However, SlowMist found that the patch barely changed the situation. The default configuration still shipped with a publicly known JWT secret. It allows attackers to generate valid tokens and continue accessing sensitive endpoints. Even worse, in addition, the core /api/exchanges endpoint continued returning sensitive fields in plain JSON; nothing was masked or encrypted.

SlowMist also confirmed that the most recent dev branch still contained:

• Admin mode set to “true” by default
• Default JWT keys left untouched
• Sensitive data returned without restriction

Because the main branch still uses the older, zero-auth version, thousands of deployments remain wide open on the public internet.

Binance and OKX Step In to Protect Users

Once SlowMist realized the scale of the exposure. They contacted Binance and OKX to coordinate emergency protection measures. Together, the teams reviewed affected API keys and forced resets for users at risk. All impacted CEX users have now been notified, and their keys have been revoked. However, the teams could not reach all Aster and Hyperliquid users due to decentralized wallet structures. SlowMist now urges anyone using NOFX AI on these platforms to review their setup immediately.

Users Told to Disable Admin Mode and Replace Keys Now

SlowMist recommends all deployers:

• Disable admin mode immediately
• Replace all API keys and private keys
• Change the JWT secret to a strong, random value
• Restrict sensitive endpoints
• Avoid exposing NOFX AI directly to the public internet

Open-source AI trading tools are growing fast. But this case highlights the risks of deploying early-stage systems without full security audits. Until NOFX AI fully fixes these flaws, users should treat any public deployment as high-risk.