Tom

Building with AI agents & cloud servers
Crypto security & Web3 research
Anime enthusiast 🎬

[Tom @0x3tom]

1/ I lost multiple wallets in about 24 hours this week. Took me a while to see the pattern, but it's hard to ignore now: every single wallet that got drained was imported into Trust Wallet. My SafePal, Bitget and Solflare wallets are fine. 🧵
#Trustwallet

2/ It started Nov 4, around 5 PM IST. My first thought was that my laptop got hacked. So I scanned everything I could think of. Nothing suspicious showed up. But my funds kept moving anyway.

3/ So I pulled the laptop off the internet completely and put it aside. Checked again for malware, background scripts, anything weird. All normal.

Then at 2 AM on Nov 5, another sweep. The laptop was offline.

4/ Next morning I went through all 3 of my phones. Three more wallets, swept.

That's when it clicked. The only wallets getting hit were the ones I'd imported into Trust Wallet. Other wallet apps on the same phones? Untouched.

5/ Before anyone asks:
• I never used the Trust Wallet extension
• Never visited any Trust Wallet-related site or link
• Bitget Wallet is what I actually use day to day

All I did with Trust Wallet was import wallets into the mobile app. That's it.

6/ Every sweep went through the same delegation contract on Arbitrum:
0x518f35235275d102c9b8548694b2e23d5390bffb

The delegation appears to let the attacker automatically forward incoming funds from a compromised wallet. Don't send gas to "rescue" funds.

7/ I'm clearly not the only one. The wallet behind this contract did 55,000+ transactions in about a week. Money from lots of victims gets pooled together, then cashed out through swap services like ChangeNOW and FixedFloat.

8/ Honestly the part that hurts most isn't just the money. It's the months of onchain history on Base and the airdrop grinding on these wallets. Gone in one day. 💔

By the time I noticed Trust Wallet was the common factor, it was already over. I've deleted it from every phone.

9/ @TrustWallet I've reported this to you. Have you seen other drains going to this contract?

If this happened to you too, please share your experience. It might help others understand what's going on.

#EIP7702 #Web3Security

[Tom @0x3tom]

@NorthgateLabsHQ good catch, you're right. o4-mini-2025-04-16 has been gone on openai since oct 23, so anyone still pinned to it is already broken

the azure vs openai split is the sneaky part. same model name, different shutdown date. worth checking which endpoint your bot actually hits

[Tom @0x3tom]

if you run any bot or ai agent, please check this today ⚠️

i came across a site that tracks when ai models get shut down, https://t.co/DSoX3QM28V, and it kind of scared me

62 models are getting retired in the next 90 days

codex-mini on azure goes on nov 15. o1, o3 and o4-mini on azure go on nov 19. claude sonnet 4.5 goes on nov 30. gemini 2.5 pro and flash on dec 1. and openai's gpt-5, mini and nano on dec 11

the part that surprised me most is the warning time. openai usually gives around 6 months. anthropic around 2 months. cohere basically gives zero, the model just stops the same day 😬

most bots break because the model name is typed directly in the code and nobody checks it again

so i'm going through my setup tonight 🛠️ if you have a bot running, search your code for the model name and see if it's on that list

https://t.co/tqHuu4T1xP

#AI #AIAgents #DevTools

[Tom @0x3tom]

@CryptoRohit07 Yes always wonder how why
Also it is satisfying watching this.

[Tom @0x3tom]

🚨 1,770 $BTC (~$128.8M) just left Coinbase Prime

unknown wallet. no hack reported

who moved it or why? nobody knows yet

watching 👀 #Bitcoin #WhaleAlert

[Tom @0x3tom]

@Ryven2o May be a lucky stone
Usually in telegram they post every coin
So it happened unexpectedly

[Tom @0x3tom]

if you ever used sophon, check your wallet today ⚠️

sophon chain is shutting down. the mainnet goes off on nov 30, but the real deadline is nov 25. after that their websites and key stuff start going offline and anything left on the chain could be stuck forever

what you need to pull out:
soph, eth, usdc, any other tokens
staking rewards and guardian rewards
old farm stuff too, that's on a separate site

official links only:
https://t.co/k9DaRtljs3
https://t.co/sY4REQqG6n

sophon themselves said don't wait till the last day. they didn't even say what time on nov 25 it closes, so i'd just do it this week

and the token isn't dead btw. $SOPH stays, only the chain is closing. the team is moving to base

also watch out for fake "migration" sites popping up in replies and dms. after losing wallets myself i don't trust any link someone sends me 🙃

know someone who farmed sophon? send this to them

#Sophon #Crypto #blockchain

[Tom @0x3tom]

another free ai api just dropped and this one is kind of big 👀

lg, yes the tv company, opened their k-exaone 2.5 model api for free on nov 9. anyone can get a key, developers, startups, students, researchers

i was reading through their docs and a few things stood out

it works like the openai api, so if you already use openai style code you just change the url, key and model name. that's it

the context is huge, around 524k tokens. you can throw really long documents at it

it's text only for now. no images

they're also saying it got 70% better in just 8 weeks 📈 but honestly they didn't say what test that's from, so i'm not taking that number seriously until someone tests it properly

they announced it at nvidia's ai day in seoul and said they're working with nvidia on making it faster. not a full partnership yet, just talks

before you go all in, a few things i'd keep in mind ⚠️
there's no info on limits yet. no info on if they use your prompts for training. and free can become paid anytime. so don't send private stuff and keep a backup model ready

still, free api plus that big context is worth trying for agents and bots 🛠️

anyone tried it yet?

https://t.co/8j7eqwgv0z

#AI #FreeAPI #LG

[Tom @0x3tom]

@zoetoshi May be it's 2050 for alts 😂

[Tom @0x3tom]

@Farmercist Yes in a good way right?
😂

[Tom @0x3tom]

@CryptoRohit07 Used once then deleted after fund freeze
I know they aren't going to unfreeze it

[Tom @0x3tom]

@mdalim81 No brother that's where we can actually trade not the outcome but in between

[Tom @0x3tom]

so i was going through prediction markets today and found something i didn't know existed 👀

there's a sports app in the us called novig and it's actually regulated by the cftc. that's the same government body that handles futures trading. so it's not some shady betting site

the way it works was new to me. you're not betting against a bookie. you buy yes or no on a game from other people, price goes between 0 and 1 dollar, and if you're right you get 1 dollar. you can even sell in the middle of the game if you feel it's going wrong

and they don't take that hidden cut normal betting sites take. that's literally why it's called no vig

they're giving $50 in credits if you deposit $10 💰 i checked the details though. it's credits not real cash, they expire, you need to be 21, and it's only in the us. even some us states can't use it

so i can't use it from india 😅 but honestly this feels like where sports betting is going in the next few years

would you trade a game like a stock?

https://t.co/kkqGPijWDq

#PredictionMarkets #Novig #SportsTrading

[Tom @0x3tom]

if you keep crypto on your iphone, read this before you sleep ⚠️

binance just warned about an ios bug called worse_query. it's a sandbox escape. in simple words, one bad app on your phone could read files from your other apps. that includes wallet apps, seed phrases, private keys, logins 😬

it hits ios 26.0 to 26.7.2 and ios 27.2. the code was posted publicly on github on sunday, which is what worries me. once it's public, anyone can copy it

apple pushed ios 27.2.1 and 26.7.3 the next day. but i checked apple's notes and they don't mention this bug at all. slowmist says 27.2.1 blocks it, apple hasn't confirmed it yet

so here's what i'm doing tonight 👇

updating ios right now. updating all my apps. deleting anything i installed from outside the app store. and checking whether my wallet app ever had my seed phrase sitting in plain text

no attacks have been reported yet. but don't wait for the first one 🙏

if you have a lot on a phone wallet, honestly think about moving it to a hardware wallet

#CryptoSecurity #iOS #Binance

[Binance @binance]

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.

Immediate Action Required:
- Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
- Update iOS and all apps to the latest official versions.
- If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

[Tom @0x3tom]

@MTLabResearch @Ryven2o That's when the real story begins 🤣

[Tom @0x3tom]

@EmersonGr12 @Ryven2o Why don't they ,
now greedy really consume anyone

[Tom @0x3tom]

@sbyusuf_ Great keep building

[Tom @0x3tom]

i've been using nvidia's free api for my own agent setup and was looking for more free options as backup

then i found this site called https://t.co/JFK7quHyim and spent way too long on it lol 😂

it lists 344 free ai models from 49 providers. they updated it today. most of them don't even ask for a card

i liked that they don't count normal chat apps like chatgpt. it's only stuff you can actually build with, like an api key or free ai inside coding tools like cursor or claude code

nvidia has the most there, 40 free models, which explains why it's been working so well for me. groq, cerebras and openrouter are also on it if you want speed ⚡

one thing i learned the hard way. free limits can change anytime without telling you. so never depend on just one. keep 2 or 3 ready

if you're building anything with ai and have zero budget, save this 📌

https://t.co/JFK7quHyim

#AI #FreeAPI #BuildInPublic

[Tom @0x3tom]

@Airdrop_Farming Yes feels sad about it
Only regret is used trustwallet mobile app

[Tom @0x3tom]

@tokyouxbt Old days are golden
Airdrops like arb apt not dogs
Now every thing is getting diluted and getting peanuts