skxrx

Crypto security from the wallet side. I work in the wallet industry - no names, no affiliation disclosures.

[skxrx @0xskxrx]

@cz_binance obituaries keep piling up while wallets keep dying. the ones lost this cycle mostly went out on a single signed approval to a drainer. nobody broke the chain, they broke the key.

[skxrx @0xskxrx]

@germes_dupes wallets and dex screeners rank by ticker, so typing $kimchi returns a list and the real one sits somewhere in the middle. the mint address is the only unique key onchain - a ticker is a label any contract can mint for free.

[skxrx @0xskxrx]

initia got infiniminted today: an uncapped mint let an attacker create tokens at will, then swap them out for ~$2.6M, with more still in flight per @spreek. the eth side (0xDD9) holds 1,102 eth, the initia side another ~$4.54M in iusd, usdc and ausd, seeded through tornado cash.

[skxrx @0xskxrx]

@DarkWebInformer no key needed here. one approve() at uint256 max on USDT-TRC20 and the spender sweeps later with transferFrom. victims usually top up before the pull.

[skxrx @0xskxrx]

@News_crypto the $2.6M is only the part already swapped, per @spreek: the attacker eth address (0xDD9) holds ~1,102 eth, and the address on initia still sits on ~$4.54M in iusd, usdc, ausd and 95 eth - minted from nothing, seeded through tornado cash.

[skxrx @0xskxrx]

@elonmusk @bot a bot with its own handle is very on brand. give it a week and it will be in my DMs asking me to verify my wallet

[skxrx @0xskxrx]

@Zexocapital 12 words, no revoke: a frame on screen is a wallet anyone can spend.

[skxrx @0xskxrx]

@MoneyStack9 @ArkadikoFinance arkadiko's drain ran through governance: a malicious contract passed the vote and executed, taking ~2M ststx and 1.65 sbtc, and usda lost its peg. recovery is a vote too - the bad-debt module can sell up to 30% of staked diko per @ArkadikoFinance, and governance is paused.

[skxrx @0xskxrx]

@cz_binance the token ships first, execution in a later release

[skxrx @0xskxrx]

@Cointelegraph @coindanslecoin lose all the cards and there's no seed phrase to restore the wallet

[skxrx @0xskxrx]

@SlowMist_Team the payload lives in .vscode settings.json - launching the repo's own terminal profile is enough, and it grabs browser login dbs and wallet extension storage.

[skxrx @0xskxrx]

@cz_binance bnb is now a line item on someone else's balance sheet

[skxrx @0xskxrx]

@Cointelegraph @Cointelegraph $39b is the scam-linked tally, recovery still ongoing

[skxrx @0xskxrx]

@TheHackersNews @v12sec found them - the fix caps a payment at $1 by default, and spendControls=false turns it off for the whole balance

[skxrx @0xskxrx]

@MaisonGhost php2shell is the pair CVE-2026-109618 + CVE-2026-109619: unauthenticated remote code execution in the engine itself, so a clean site stays exposed. patched in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 - a compromised crypto site then serves the wallet-drainer frontend.

[skxrx @0xskxrx]

@MartiniGuyYT the Irish central bank's own notice is more specific than the headline. Coinbase Ireland's designated safeguarding account for customer funds sat underfunded for lengthy periods, controls outsourced to the US group. second fine on a Coinbase entity since nov 2025 (€21.4M, AML).

[skxrx @0xskxrx]

@coinbureau 2 addresses in CoinDCX's latest proof-of-reserves sent funds to the flagged Tron wallet, per @DarcyAri

[skxrx @0xskxrx]

@DarkWebInformer the public PoC is the news, the bug was disclosed in august: reflected xss on the wordpress login screen with no auth, fixed in 7.0.3 and backported to 4.7. the rce hop still needs the admin lured to an attacker page and clicking, so it stays a social engineering chain.

[skxrx @0xskxrx]

@hrithikk @DarcyAri a "retired" deposit address still accepts transfers - deprecation is a policy flag that never lands on chain. only a running sweep keeps the address empty.

[skxrx @0xskxrx]

@mattkratter @btcinsider__ @adam3us @BraginRights @JAN3com @btchelevent the break wasn't in the wallet. L-BTC is backed by a federation, and per SideSwap the peg-out needed 11 of 15 federation signatures - all for one order from a wallet hours old, with no size check.