0x0Nullian

Junior Security Researcher

[Nightmare Eclipse @ChaoticEclipse0]

@imftxyz @claudeai I'm using AI (Actual Intelligence)

[Mario Nawfal @MarioNawfal]

🇮🇱🇨🇾 Security at a Cyprus airport stopped a 24-year-old Israeli man and found 4 human embryos in his luggage, stored in a cryogenic container labeled "Life Pack," bound for Mexico via Istanbul.

The embryos came from an IVF clinic in northern Nicosia operating without proper authorization. No health ministry approval had been issued to remove them from the country.

He's charged with illegal transport of human tissue. The embryos are in evidence.

The question nobody's answered yet: whose embryos were they, and who was waiting for them in Mexico?

[Pavel Durov @durov]

WhatsApp encryption is a giant fraud.

The state of Texas just sued WhatsApp for lying to users about privacy — because WhatsApp employees have access to “virtually all” private messages.

Now we know what WhatsApp’s founder meant when he said he “sold his users’ privacy.”

[ddimitrov22 @ddimitrovv22]

Uniswap V4 inverted the trust model and Cork Protocol paid $11M for it!

In V3, your swap math was internal. Nobody could reach it.

In V4, your hook is a contract with public beforeSwap / afterSwap functions, and the PoolManager calls them. Drop the onlyPoolManager modifier and those callbacks are open to the whole world, with attacker-supplied hook data.

That's the entire Cork hack. beforeSwap had no caller check. The attacker called it directly, handed it crafted data claiming a deposit that never happened, and walked out with the derivative tokens.

One missing modifier. $11M. Every hook callback is a trust boundary now.

[Evan Luthra @EvanLuthra]

🚨THE FBI CREATED A FAKE CRYPTOCURRENCY.. LISTED IT ON UNISWAP.. HIRED MARKET MAKERS TO PUMP IT.. THEN ARRESTED EVERYONE WHO SAID YES..

THIS IS THE CRAZIEST LAW ENFORCEMENT OPERATION IN CRYPTO HISTORY!!!

The FBI built an actual ERC-20 token on Ethereum called NexFundAI.. 100 billion token supply.. A professional website.. Whitepapers promising "passive income through AI-powered investing"..

It looked exactly like every other crypto project.. Because that was the point..

Undercover agents posed as the founding team.. Then reached out to professional market-making firms and said "we need you to fake our trading volume"..

Every single firm said yes..

Here's what they recorded..

Gotbit.. A firm run by a 26-year-old Russian who publicly bragged in 2019 that he built a business faking trade volumes.. His team kept internal spreadsheets with columns literally labeled "fake volume" vs "market volume"..

When asked how fast they could pump NexFundAI's volume to $1 million per day.. They said "6 hours.. It will cost about $200"..

$200 to fake $1 million in daily trading volume..

MyTrade.. Run by a guy who called himself "the mastermind".. He explained the exact psychology of the scam on camera..

"We make the chart look like a really nice roller coaster ride.. That's where people jump in.. We have to make them lose money in order to make profit"..

He said that on a recorded FBI video call..

CLS Global.. A Dubai-based firm.. Their bots generated 98% of NexFundAI's total trading volume.. When the FBI asked if they could sync fake volume spikes with fake news announcements.. They said absolutely..

ZM Quant.. Bots executing 10 to 20 trades per minute through dozens of wallets to look organic..

All of them knew it was fraud.. All of them did it anyway.. All of it was recorded..

And the clients were even worse..

Saitama.. A meme coin that hit $7.5 billion market cap.. The founders coordinated buys through private Telegram chats.. Sent "pump it" memes while manipulating the price.. Then dumped on retail investors..

$7.5 billion.. Built entirely on fake volume.. Every penny of real money came from retail investors who thought the momentum was organic..

One founder left Saitama and started Robo Inu.. Used Gotbit again.. Another launched VZZN.. Same playbook..

Lillian Finance.. Founder claimed to be a defense contractor who addressed Congress.. Marketed the token as funding children's hospitals.. Pocketed everything..

When the FBI shut it down.. They seized $25 million in one day.. 18 people indicted across the US, UK, and Portugal.. The CEO of Gotbit was arrested in Portugal and extradited.. Sentenced to 8 months plus $23 million forfeiture..

But here's the part that broke my brain..

Real people bought NexFundAI..

The FBI's fake token.. With zero utility.. Zero real developers.. Created solely to catch criminals.. Attracted real retail investors because the fake volume made the chart look bullish..

When the FBI pulled the liquidity to end the operation.. Those people lost real money.. On a government-issued token..

The FBI had to set up a restitution portal to pay them back..

And it gets worse..

Within 24 hours of the DOJ announcing the sting.. Someone cloned the FBI's exact smart contract.. Launched a copycat token.. Rode the viral momentum.. And made $127,000 in a single day..

Using the exact same manipulation tactics the FBI just arrested 18 people for..

Then in 2026.. The FBI did it again.. New token called Lexobit.. 10 more arrests.. Including operators extradited from Singapore..

IRS forensics showed that in one firm's trading.. 1,209 out of 1,221 consecutive transactions went straight back to wallets the firm controlled.. 99% circular..

The FBI proved what everyone in crypto suspected..

The volume is fake.. The charts are painted.. The momentum is manufactured..

And every time you buy a token because "the chart looks bullish".. You might be the exit liquidity.

[Joab Jackson @Joab_Jackson]

“My opinion has always been that AI is a great tool, but it's a tool, and when I see people saying ‘99% of our code is written by AI,’ I literally get angry, because I pretty much guarantee that 100% of their code is written by compilers.”—Linus Torvalds #OSSummit

[banteg @banteg]

umm guys do you know who owns npm registry + vscode marketplace + gh actions? i see a common thread here

[Jedi @dhe3g]

Well then, fuck you and your wife.

[Pirat_Nation 🔴 @Pirat_Nation]

Linux now supports NVIDIA Reflex and AMD Anti-Lag on any graphics card, bringing much better responsiveness to gaming.

A new open-source tool called low_latency_layer makes this possible on AMD, Intel, and NVIDIA GPUs.

It uses the same signals games already send for Reflex and Anti-Lag, so titles that previously supported only NVIDIA now run smoother on other cards too.

It pairs well with Steam Play and Proton, allowing Windows games on Linux to benefit from these low-latency features. Tests in Counter-Strike 2, THE FINALS, Cyberpunk 2077, and Overwatch 2 show reduced input lag, often matching or beating Windows versions.

Developed by Nicolas James, the free tool is available on GitHub at https://t.co/w6xGDI00hn

[0x0Nullian @0x0nullian]

@mrexits PROMPT! I need the PROMPT!

[0x0Nullian @0x0nullian]

@coinxtreme_en @EchoProtocol_ "Because this 955 $eBTC is unbacked" what does this mean exactly? the attacker can not benefit from these minted assets?
Thanks for the glossary btw!

[Patrick Collins @PatrickAlphaC]

I recently turned 33, and every year I want to go back to 21-year-old Patrick with a list of lessons.

If you're in your 20s, these are for you.

Most lessons only land after an ass-whooping. And even then, you usually miss them the first time.

[Ranko X @r4nk0X]

🧵 you can hold the most private coin on earth. doesn't matter if your wallet app pings 40 servers the second you open it. your IP is out before you generate a key.

so I tested 13 web3 wallets on first launch:

clean android, no sim
apks via gplaydl
wifi + vpn
pcapdroid per app

[Tamer Nahed @Tamer_Alnoaizy]

One of the most brutal scenes in human history has been exposed.

Israeli soldiers opened fire on thousands of starving Gazans as they ran in desperation for a piece of food during the war on Gaza.

A moment the world must never forget.

[jussy @jussy_world]

Hack was a Private Key exploit

​Here is how the hacker did it: 🧵👇

​Hacker gained access to Admin signer privileges

​Created a new collateral market for a worthless token (CVT)

​Jacked the Drift USDC limit from $25M to $500M

​Used CVT to borrow and drain assets from the protocol

Two Drift multisig keys appear to have been compromised

The ongoing Drift exploit has now reached $285M

Got info from @SolanaFloor, follow them for more detailed information

[vitalik.eth @VitalikButerin]

My self-sovereign / local / private / secure LLM setup, April 2026

https://t.co/zmG8wrg7pQ

[IT Guy @T3chFalcon]

You turn on your VPN and your IP changes. It feels like you should be invisible, but some websites still know exactly where you are.

Your IP is just one clue. Websites also look at your browser’s timezone (for example, "Asia/Kolkata" doesn’t match a German IP), your Accept-Language header (en-IN gives you away), and your DNS resolver, which is probably still set to your ISP’s servers back home instead of your VPN’s.

One of the sneakiest trick is WebRTC. Your browser has a built-in feature for video calls that can fetch your real IP address at the operating system level, completely bypassing the VPN tunnel. A website can get it with just 10 lines of JavaScript. Some VPNs don’t block this by default.

And if you’re logged in, it’s game over. Netflix, Google and Spotify don’t care about your IP address. They care about your account. Your registered country is stored in their database, not in your connection. Using a VPN while logged in means the VPN isn’t helping you at all.

A VPN gives you a different postal address, but your timezone, language, DNS, WebRTC, browser fingerprint, and login details are still the same.

[ℏεsam @Hesamation]

this model is an agentic treasure. it has been #1 trending for 3 weeks on @huggingface as mentioned by @danielhanchen. it's Qwen 3.5 27B fine-tuned on Opus 4.6 distilled data and beats Sonnet 4.5 on SWE-bench verified and more.

"Runs locally on 16GB in 4-bit or 32GB in 8-bit."

[BuBBliK @k1rallik]

https://t.co/uAaxXKPqnk

[Techjunkie Aman @Techjunkie_Aman]

Governments want OS-level age verification.

EndeavourOS response:

We literally can’t.

• No tracking
• No user data
• No centralized control
• No infrastructure to identify users

That’s how Linux works.

The problems:

• Laws assume platforms can identify users
• Linux distros don’t have accounts or telemetry
• Mirrors + torrents = no control over distribution
• Even developers can’t track who installs their OS

This breaks the entire model.

Reality:

You can’t enforce surveillance…

on a system designed for freedom.