bobesh · DeFi & OpSec

Helping you stay safe and think clearly in crypto.
Crypto, Privacy & Security, AI, Decision Psychology.
Education over speculation.

[bobesh · DeFi & OpSec @CryptoBobesh]

Google just slashed the qubit estimate needed to break Bitcoin signatures by 20x.
The quantum threat suddenly feels a lot closer than most people realise.

The biggest risk isn’t some future "hack" of the blockchain itself. It’s the roughly one-third of all BTC sitting on addresses where the public key is already visible - old coins, reused deposit addresses, even some Taproot setups.

🧠I put this article together to explain exactly what changed in March, the real difference between at-rest and on-spend attacks, and the practical steps you can take right now to cut your exposure.
No panic, just clear thinking and better opsec.

Have you already moved your older coins to fresh bc1q Native SegWit addresses (the ones you’ve never spent from)?

What’s your current plan? Drop your thoughts below👇and bookmark if it’s useful - this one matters for the long game.

[bobesh · DeFi & OpSec @CryptoBobesh]

https://t.co/z357yv6fxd

[bobesh · DeFi & OpSec @CryptoBobesh]

Your hardware wallet can't see what's in your clipboard.

Clipboard hijackers don't steal your seed phrase. They don't break your encryption. They just wait.

The moment you copy a wallet address, the malware swaps it silently. You paste the replacement. Your hardware wallet confirms what was pasted - not what you meant to send.

You followed the process correctly. The money still went to the attacker.

This works because copy-pasting feels completely routine. The attack is built around your habits, not your keys.

The checklist and quoted post below covers how to break that pattern at every step, from copy to confirm.

Before your last transfer: did you check the full address, or just the first and last few characters?

Bookmark this thread - the attack and the defence, in one place.

[bobesh · DeFi & OpSec @CryptoBobesh]

One wrong character in a wallet address, and your money is gone.

Crypto transfers are final. No bank to call. No way to reverse it.

Most people copy and paste on autopilot. These are the habits that stop the mistakes that cost real money.

Copy hygiene

- Copy the address only from your own wallet or a saved address book (keep only checked, trusted addresses in it).
- Never copy from your transaction history. You can grab the wrong one, or fall for address poisoning (see post in first reply).
- Never copy from chats, documents, or any source you do not fully trust.
- Paste it only at the moment you copy it. Copy it too early, and something can overwrite your clipboard along the way, worst case with someone else's address.
- Do not trust your browser's autocomplete.
- Check the address right after you paste it, and once more just before you hit send.
- Compare the full address where you can, not just a few characters at each end. Scammers build look-alike addresses that match the first and last few on purpose.
- This also catches clipboard malware, which swaps your copied address for a scam one.
- Use a QR code from your own wallet to load an address when you can.
- On a hardware wallet, always confirm the address and other details on the device screen, not just on your computer.

Before you send

- Check the network on both ends. Ethereum (ERC-20) should land on Ethereum.
- Bridging? Make sure the source and destination chains match what you want, for example Ethereum to Base.
- EVM chains (Ethereum, Base, Arbitrum, BNB Chain etc.) share the same address in your wallet, so the network matters as much as the address itself.
- Check the asset and every other field too: amount, plus memo or tag if the coin uses one.
- First time, and a big amount? Send a small test first, then the rest.
- Turn off auto-correct, auto-replace, and autocomplete so nothing edits an address behind your back.

Worth doing if you can

- Keep a separate device just for crypto, with nothing extra on it.
- Use a separate browser for crypto only, with no add-ons except the wallet you use.
- Review your browser extensions now and then, and remove anything you do not need or recognise. A bad one with the right permission can rewrite what you paste.
- Keep your system, browser, and wallets updated.
- Run antivirus and a firewall as the baseline.

One habit beats all the rest: slow down for the last ten seconds before you confirm. That pause is cheaper than any loss.

Which of these do you already do, and which one are you adding today? Tell me below.

Bookmark this so it is there next time you move funds.🔖

[bobesh · DeFi & OpSec @CryptoBobesh]

Your wallet address tells more about you than most people realise.

Right now, with everything happening in security, it is smart to know exactly what others can see.

Someone with just your address can see:
- Every protocol you have ever used
- Your holdings and trading patterns
- Where your funds came from

They do not need to hack you. It is all public on the blockchain.

Here are the most important steps most people skip:

1. Use separate wallets for different purposes (CEX withdrawals, DeFi, identity). Reusing one address creates links you can never remove.

2. Change your default RPC in your MetaMask wallet. The default one may logs your IP and wallet on every transaction.

3. Before you connect any wallet to a dApp, ask: What will this front-end see?

4. Add an intermediate privacy-preserving wallet between your exchange and DeFi address. Direct withdrawals from KYC exchanges create permanent links.

Privacy in DeFi is not about hiding from everyone. It is about not showing your full financial life to anyone who knows your address.

Which of these steps are you going to check first this week? Reply below or bookmark it.

[bobesh · DeFi & OpSec @CryptoBobesh]

Someone with your wallet address can see:
- Every protocol you've ever used
- Your approximate total holdings
- Where your funds came from
- Your trading patterns and timing

They don't need to hack you. It's all public.

Here's the DeFi privacy checklist most people skip.

🏠 WALLET HYGIENE - start here
- One wallet, one purpose. Keep CEX withdrawals, DeFi activity and your identity wallet on separate addresses
- reusing one address creates links that can never be undone
- Use a fresh wallet for high-value or sensitive interactions

👁️ YOUR ON-CHAIN FOOTPRINT
Every swap, deposit and withdrawal you've ever made is permanently public and indexed.
- Chain analysis firms (Chainalysis, Elliptic, TRM Labs) cluster and track wallets by behaviour patterns
- Arkham Intelligence creates a market for on-chain intelligence, including wallet/entity attribution
- Your CEX KYC + your on-chain activity = your full financial history can be linked to your identity
- Bridges link your identity accross different blockchains and wallet addresses

🌐 YOUR RPC IS NOT PRIVATE
Your wallet connects to the blockchain through an RPC endpoint. MetaMask defaults to Infura, owned by ConsenSys
- it logs your IP and wallet address on every transaction.
- Switch to a verified custom RPC in MetaMask settings (or use Rabby wallet which I recommend)
- Your pending transactions are also visible in the public mempool before confirmation
- MEV Blocker (CoW Protocol) hides them from the mempool and is free

🏷️ IDENTITY LEAKS
- ENS linked to your real name + used for DeFi = your entire on-chain history tied to your identity
- Check which wallet address is visible before posting any portfolio screenshots
- Never link the same wallet to both social media and DeFi - it permanently breaks your pseudonymity
- dApps front-ends can see your browser footprint, IP address and interactions

💸 CEX WITHDRAWAL PATTERNS
Withdrawing from a KYC exchange directly to your DeFi wallet creates a permanent link between your verified identity and your on-chain activity
- Add an intermediate wallet between your CEX and your DeFi address
- how much separation you need depends on your threat model and local regulations

🔧 TOOLS THAT HELP
- Railgun: ZK-proof privacy for DeFi on Ethereum (listed on Etehreum Foundation web). Uses compliance screening - not a mixer.
- MEV Blocker: free private RPC, helps reduce front-running
- Rabby Wallet: shows what a transaction will expose before you sign

Note: OFAC lifted Tornado Cash sanctions in March 2025, but developer prosecutions continue. Check your local regulations before using any privacy tool.

Privacy in DeFi isn't about hiding from anyone.
It's about not having your financial life exposed to everyone who knows your wallet address.

Most people realise what they should have done only after something goes wrong.

Which of these did you already know? 👇

[bobesh · DeFi & OpSec @CryptoBobesh]

Proton Mail is not "all plain/clear text".
Proton Mail can process normal emails sent to or from non-Proton providers while they are being delivered - that's true.

But Proton says message bodies and attachments are stored with zero-access encryption. Messages between Proton users are end-to-end encrypted, so Proton should not be able to read or hand over those message bodies.

[bobesh · DeFi & OpSec @CryptoBobesh]

Cardano is surely progressing towards deeper decentralisation.

But I need to mention that decentralisation has costs too: slower coordination, harder upgrades, possible governance gridlock etc. The goal is not to worship the word. The goal is to understand where control, trust and failure points still exist.

Centralisation does not always have to be bad or harmful. It has its use-cases.

[bobesh · DeFi & OpSec @CryptoBobesh]

"Decentralised" is one of the most overused words in crypto.

A system is not decentralised just because it has a token or runs onchain.

The better question is simple:
Where can someone still stop you?

A centralised system has one main operator.
Think Binance, Coinbase, or your bank.

That can be useful.
You get easier login, customer support, faster UX, account recovery and clearer rules.

But you also trust the centre.
If that company is hacked, pressured, frozen by regulators, or becomes insolvent, your access can change very fast.

A decentralised system works differently.

Many independent participants help enforce the rules.

Bitcoin is the clean example.
- No company owns the network. Full nodes can verify blocks and transactions against public rules.

Uniswap is the DeFi example.
- You can swap through smart contracts instead of leaving funds with a traditional exchange.

But this is where people get tricked:
- Decentralised does not mean "no trust anywhere".
- A protocol can be decentralised in one layer and still centralised in another.

Examples:

- smart contract is onchain, but the website is controlled by one team
- DEX exists, but liquidity depends on a few whales
- DAO exists, but insiders hold most voting power
- self-custody exists, but users still sign bad approvals
- network is open, but most users rely on the same RPC or front-end

So do not ask only: "Is it decentralised?"

🔍Ask these instead:

1. Who holds the assets?
2. Who verifies the rules?
3. Who can upgrade the protocol?
4. Who controls the front-end?
5. Can I exit without permission?

Centralisation gives convenience.
Decentralisation gives resilience.

Most crypto systems sit somewhere between the two.
The label matters less than the trust map.

Save this before judging any chain, protocol or exchange.

Which of these five questions do you check first when looking at a new project? Drop your answer below.

[bobesh · DeFi & OpSec @CryptoBobesh]

May 2026 Mini Shai-Hulud attacks prove the AI coding caution is essential.

Over 170 npm and PyPI packages compromised, including Mistral AI SDK packages. Malicious versions had valid SLSA Level 3 provenance after pipeline hijacks.

This highlights rapid attack surface expansion with AI tools.

40-60% of AI-generated code has serious flaws per studies. Vibe-coded apps have leaked data post-launch.

Review all AI code yourself before sensitive data or funds access. Critical for crypto and DeFi builders.

What is your process for securing AI code? Share below or bookmark.

[bobesh · DeFi & OpSec @CryptoBobesh]

AI lets total beginners build real apps, websites, and scripts in minutes... but where’s the line we shouldn’t cross?

Here’s my honest take.

With the massive boom in vibe coding, ordinary people can now create surprisingly complex stuff just by "chatting" with AI. It’s brilliant.

There's one rule I think every beginner should keep front of mind though:
Never touch customer data or anyone else’s sensitive information if you don’t actually understand programming, software architecture and security.

If you can’t properly review, test, or spot problems in the code an AI just wrote for you, then you shouldn’t be building anything (or running AI agent) that touches personal data. Full stop.

One tiny mistake can lead to destroyed trust, credential leak, massive fines under laws like GDPR, and proper legal headaches.

Even free plugins or extensions can be risky - some quietly contain dodgy instructions (prompt injections etc) that open doors you never meant to open.

Treat AI-generated code as untrusted until verified. Don’t give AI tools access to sensitive information or allow them to process it. (Giving access to clients database, company email, drive with sensitive documents etc.)

The goal isn’t to slow innovation down. It’s to stay responsible while the tools are evolving faster than most people realise.

What do you reckon? Have you tried vibe coding yet? Drop your thoughts below - I read every reply!

#VibeCoding #AISafety

[bobesh · DeFi & OpSec @CryptoBobesh]

⚠️Unconfirmed rumours are circulating about wider access to Claude Mythos / Mythos-class models.

I could not find solid proof that this is happening today, despite the rumours spreading across X since yesterday.

But in security, I prefer:
Better Safe Than Sorry

No panic. Just basic wallet hygiene:

1. Check your wallet approvals
2. Revoke old approvals
3. Revoke unlimited approvals
4. Revoke approvals you do not recognise
5. Be careful with DeFi positions you do not actively need exposed

This is especially relevant for lending, yield farming, liquid staking and similar protocols - withdraw your funds to your (hardware) wallet address.

More on revoking wallet approvals here: https://t.co/UI88Y18ua6

Not fear. Just reducing unnecessary attack surface.

I covered the Mythos topic here: 👇

#DeFiSecurity

[bobesh · DeFi & OpSec @CryptoBobesh]

I exited DeFi in April. This week, two events made me think it was the right call.

Both pointing the same direction. Four days apart.

1) Anthropic's Project Glasswing update (22 May)

Around 50 partners got early access to an unreleased AI model Claude Mythos Preview. In one month:

- 10,000+ high or critical vulnerabilities found across partner codebases
- Cloudflare flagged 2,000 bugs, 400 of them serious, with a lower false positive rate than human testers
- Mozilla patched 271 vulns in Firefox 150 with Mythos Preview. That's over 10× what they found in Firefox 148 with Claude Opus 4.6
- UK AI Security Institute: Mythos is the first model to fully solve their end-to-end multi-step cyberattack scenarios
- A partner bank blocked a $1.5M fraudulent wire transfer with help from the model

On 1,000+ open-source projects scanned by Anthropic in last few months:

- 6,200 high or critical findings out of 23,019 total
- Of 1,752 reviewed independently, 90.6% confirmed as real bugs and 62.4% confirmed as high or critical
- Some maintainers asked Anthropic to slow down. They cannot patch fast enough.

Of the 530 high or critical bugs Anthropic has disclosed to maintainers so far, only 75 have been patched. Average time to ship a patch: two weeks. Some maintainers asked Anthropic to slow down.

Anthropic's own takeaway: finding bugs is no longer the bottleneck. Verifying, disclosing and shipping patches is.

2) Manuel Aráoz, co-founder of OpenZeppelin (26 May)

He posted that he now considers all of DeFi unsafe and has advised friends and family to exit positions, including blue chips like Aave, Maker and Compound. His argument: coding agents are now superhuman at hunting vulnerabilities, and smart contract security is deeply asymmetric. Defenders must fix every bug. Attackers need one.

Why this hits DeFi harder than most software:

- Smart contract code is public. Attackers pay zero discovery cost.
- Funds live inside the code. No human in the loop to stop an exploit mid-flight.
- Once money moves on-chain, it is gone. No chargeback, no support line.
- A clean audit from six months ago carries less weight than it used to.

To be fair: Glasswing's published numbers were not aimed at smart contracts specifically. We have no hard data yet on how DeFi codebases would score against a Mythos-class model. That gap is part of the warning, not a comfort.

My honest advice:

If you are newer to crypto, or you do not have time to track this space daily, sitting in DeFi at today's yields is a hard trade to defend. If you are experienced, a position cut still looks rational to me. Yields have not moved up to price in this new risk profile.

What would push your view in either direction? Curious what you are watching.

[bobesh · DeFi & OpSec @CryptoBobesh]

Je to tak - ten mechanismus by zabránil vybrání většího množství mincí než bylo vloženo, ale pokud by se rozhodli vybrat všichni, tak na někoho pak prostě "nezbyde". To jsem ostatně zmiňoval v té první reakci. Ale byl by to jeden ze způsobů jak poznat, že k inflaci (a vybrání prostředků) došlo :)

[bobesh · DeFi & OpSec @CryptoBobesh]

Extra tip: After connecting to any new site, immediately revoke approvals.

More about approvals and revoking here 👇
https://t.co/3CMLmg6vu2

[bobesh · DeFi & OpSec @CryptoBobesh]

Six months ago, you swapped on a DEX.

Then you stopped using the app.
Moved your funds.
Disconnected your wallet.

You felt safe.

That is what most people think.

But that one swap left a door open.
And it's probably still open right now.

1/5

[bobesh · DeFi & OpSec @CryptoBobesh]

7 RED FLAGS that scream WALLET DRAINER 🔴

Before you mint, claim or "verify", pause for 30 seconds.

These exact patterns are draining wallets right now:

1. A surprise free mint or airdrop you never followed.
2. "Claim now" + urgent deadline / countdown timer.
3. Domain looks almost right... but has a sneaky typo or wrong TLD.
4. Signature request is vague, unreadable or feels off.
5. Asks for unlimited / infinite token approval.
6. You see Permit, Permit2 or SetApprovalForAll and you are not 100% sure why.
7. The link comes from a copied profile, hacked account or AI-looking announcement.

Legitimate claims never rush you or require blind trust.

Slow down.
Check the domain.
Read the wallet prompt.
Use a burner wallet when testing.

Bookmark this before your next mint - it might save your entire portfolio.

[bobesh · DeFi & OpSec @CryptoBobesh]

Gasless does not mean harmless.

A wallet drainer no longer needs your seed phrase. It needs one signature you didn't read.

Sign a fake "verify wallet" or "claim airdrop" prompt and your tokens can be moved with no gas and no transaction from you. The attacker submits it and cashes out later.

The signatures doing the damage:
- Permit / Permit2: a gasless token approval. One signature can let a spender take everything you've approved to it.
- setApprovalForAll: hands over a whole NFT collection.
- EIP-7702: since the Ethereum Pectra upgrade, one signature can point your entire account at a contract.

Before you sign, ask:
- Is this a signature or a real transaction?
- Does it show a token, amount, spender, deadline or delegation address?
- Do I know that spender or contract address?

In 2025 a single Permit signature took $6.5M - the trick still works.
A "free" signature that touches your tokens is the one to slow down on.

Which of these have you been asked to sign?

Tell me below, then bookmark this.

[bobesh · DeFi & OpSec @CryptoBobesh]

Já svou reakci nikdy nechtěl koncipovat jakou nějakou při, jen jsem chtěl doplnit a upřesnit některá tvrzení z původního postu.

Pokusím se odpovědět na poslední post:
Co se týká Zcach orchid bugu, tak co je mi známo a co se mi podařilo před pár dny dohledat a pokud jsem tomu porozumněl správně, tak v současné době neexistuje způsob, jak uspokojivě (kryptograficky) ověřit a dokázat, že nedošlo ke zneužití bugu.

ZK by to obecně dokázal prokázat, ale jen za určitých předpokladů, které byly porušeny právě soundness bugem.

Zcash dokáže teoreticky, díky turnstile mechanismu, jen hlídat toky mezi jednotlivými pooly a chránit tak globální supply (pokud ten mechanismus neobsahuje zase nějaký bug).

Čili je možné prokázat, že z poolu neodešlo více mincí než do něj bylo vloženo a že se nedostaly do global supply (mimo Orchard), ale nejde prokázat, že bug nebyl zneužit a v poolu není více mincí než bylo vloženo (že v Orchard nedošlo k double-spendingu na úkor jiných uživatelů).

[bobesh · DeFi & OpSec @CryptoBobesh]

Gasless does not mean harmless.

A wallet drainer no longer needs your seed phrase. It needs one signature you didn't read.

Sign a fake "verify wallet" or "claim airdrop" prompt and your tokens can be moved with no gas and no transaction from you. The attacker submits it and cashes out later.

The signatures doing the damage:
- Permit / Permit2: a gasless token approval. One signature can let a spender take everything you've approved to it.
- setApprovalForAll: hands over a whole NFT collection.
- EIP-7702: since the Ethereum Pectra upgrade, one signature can point your entire account at a contract.

Before you sign, ask:
- Is this a signature or a real transaction?
- Does it show a token, amount, spender, deadline or delegation address?
- Do I know that spender or contract address?

In 2025 a single Permit signature took $6.5M - the trick still works.
A "free" signature that touches your tokens is the one to slow down on.

Which of these have you been asked to sign?

Tell me below, then bookmark this.

[bobesh · DeFi & OpSec @CryptoBobesh]

Zano is building privacy by default on L1 with Confidential Assets.

The quoted post breaks down why "private DeFi" is never just one thing.

Which layer matters most to you? @zano_project

[bobesh · DeFi & OpSec @CryptoBobesh]

Anyone can see your balance. Anyone can copy your trades.

In 2026 you can finally hide some of that. But "private" is not one thing, and that is where it trips people up.

Four different jobs get sold as one word.
No tool does all of them:

- hide your amounts and balance (confidentiality)
- break the link between your addresses (closer to anonymity)
- shield a trade before it lands (cuts front-running, not all MEV)
- prove compliance without going fully public (selective disclosure)

What is actually live: Railgun on Ethereum, native confidential transfers on Solana (amounts hidden, address still visible), newer private networks like Aztec, Zano - privacy by default L1 with Confidential Assets and other projects. All still early.

None of it is perfect, and more privacy means more complex code, so treat new tools as new.

The part most posts skip: privacy tooling carries legal risk.
Tornado Cash was delisted in 2025, yet a developer was still convicted on a separate charge and the case rolls on.
That is why the new wave is built on confidentiality with optional disclosure, not full anonymity, and why institutions can finally use it.

So the question is never "is DeFi private now".
It is: what exactly does this tool hide, and from whom?

Reply with the one you care about most: amounts, the link, or front-running.

Save this and run any "private DeFi" app through it before you trust it.

[bobesh · DeFi & OpSec @CryptoBobesh]

Anyone can see your balance. Anyone can copy your trades.

In 2026 you can finally hide some of that. But "private" is not one thing, and that is where it trips people up.

Four different jobs get sold as one word.
No tool does all of them:

- hide your amounts and balance (confidentiality)
- break the link between your addresses (closer to anonymity)
- shield a trade before it lands (cuts front-running, not all MEV)
- prove compliance without going fully public (selective disclosure)

What is actually live: Railgun on Ethereum, native confidential transfers on Solana (amounts hidden, address still visible), newer private networks like Aztec, Zano - privacy by default L1 with Confidential Assets and other projects. All still early.

None of it is perfect, and more privacy means more complex code, so treat new tools as new.

The part most posts skip: privacy tooling carries legal risk.
Tornado Cash was delisted in 2025, yet a developer was still convicted on a separate charge and the case rolls on.
That is why the new wave is built on confidentiality with optional disclosure, not full anonymity, and why institutions can finally use it.

So the question is never "is DeFi private now".
It is: what exactly does this tool hide, and from whom?

Reply with the one you care about most: amounts, the link, or front-running.

Save this and run any "private DeFi" app through it before you trust it.

[bobesh · DeFi & OpSec @CryptoBobesh]

Question important assumptions, especially those that are unverified, risky, or seem obvious - these may be your blind spot.

The most dangerous assumptions don't look dangerous. They seem obvious. Your blind spots hide in the assumptions you never think to question.

In trading and investing (crypto DeFi too), this is where mistakes get expensive: "this level must hold", "this trend is obvious", "this asset is safe", "this time is different".
The real risk is often not the market. It is the assumption you stopped testing.

[bobesh · DeFi & OpSec @CryptoBobesh]

@livingdaylite @Techjunkie_Aman Every company needs profit to grow and develop, and marketing can help with that. The last thing you want is a loss-making company that builds security products.

[bobesh · DeFi & OpSec @CryptoBobesh]

@ShieldedLabs Security Update

https://t.co/SPyzlO6ety

[zooko🛡🦓🦓🦓 ⓩ @zooko]

https://t.co/v7BiOdzU9E

[bobesh · DeFi & OpSec @CryptoBobesh]

For about 4 years, a critical flaw sat inside Zcash’s Orchard shielded pool.

It was found on 29 May by Taylor Hornby during a Shielded Labs audit. He used Anthropic’s Claude Opus 4.8 with a custom AI audit setup to build a working local exploit.

The bug was in Orchard’s zero-knowledge circuit. In simple terms, it could let the pool accept invalid state transitions, potentially enabling counterfeit zcash:native inside Orchard.

Zcash says there is no known exploit, no privacy impact, and total supply stayed intact thanks to turnstile accounting.

Important nuance: the proposed supply-proof upgrade is not live yet. @ShieldedLabs