Darkside of Crypto

F1
Crypto and cyberspace.
Technique Development

[vx-underground @vxunderground]

After my expert negotiating skills (I just asked how they did it), they told me how they compromised "Go Momentum" or "Momentum Telecom".

> be ransomware group
> "EndZone" (lmfao wtf)
> want to extort companies
> find url that ISP uses for managing customers
> facing internet
> bonk it with stick
> realize you can bypass authentication
> website-dot-com/ViewCustomer.do?customerId=1
> shows customer information
> wtf
> they try customerId=2
> shows customer information again
> write python script
> repeat millions of times
> get millions of peoples and companies PII
> realize if on url, and hit refresh, legitimately logs you in
> bypasses auth all together
> realized when bypass auth can manage users
> can deactivate modems
> write python script
> disable over 100,000 modems
> over 100,000 places no longer have internet
> they contact ISP
> demand ransom money
> "give us $$$ or else we leak data, do more damage"
> ISP tells them theyre not paying and to fuck off
> compromise never made the news

[Darkside of Crypto @darksidecrypto]

?

[Madison Mills @MadisonMills22]

SCOOP: OpenAI, Anthropic and security researchers are investigating tens of thousands of incidents - not dozens - in which their frontier models took steps that outside evaluators would consider problematic, sources told Axios.

The sheer volume of incidents found in our reporting indicate that the problem is orders of magnitude more complex than what is currently publicly known and disclosed.

The findings also raise questions about what level of control anyone working on AI development can expect to have over their own technology, and whether these kinds of incidents are becoming synonymous with frontier deployment.

Read my latest for Axios here: https://t.co/42h9aR4sem

[It's FOSS @Itsfoss]

Broadcom just made it significantly harder to leave VMware.

The company quietly removed public downloads of the Virtual Disk Development Kit (VDDK), with no announcement and no alternative route provided.

This library sits at the core of nearly every VMware migration tool on the market, including offerings from Microsoft, Red Hat, and Nutanix.

If you need it now, you have to contact Broadcom support and hope your account shows the right VMware entitlements. Many customers are already reporting 404 errors and being told the library is simply "unavailable."

This is not an accident by the way. This is a deliberate business decision by Broadcom to keep user with VMWARE.

How else will they justify their acquisition?

[IT Guy @T3chFalcon]

https://t.co/6UlgGJsoUb

[Darkside of Crypto @darksidecrypto]

Emergency privacy notice regarding what companies can and will always get away with.

[IT Guy @T3chFalcon]

What the TV does by design:

— scans your entire home network continuously. in their test: one TV identified 38 unrelated devices including phones, smartwatches, printers, and thermostats belonging to people not involved in the test.

— collects the names and signal strengths of every nearby WiFi network, plus location data. all sent to LG Ad Solutions.

— runs ACR (Automatic Content Recognition) on everything displayed on screen. including HDMI inputs. your laptop, gaming console, or work monitor connected to the TV is being fingerprinted.

— one TV exchanged roughly 4GB of ACR-related data per month.

What the TV does that LG says it doesn't:

LG publicly stated their TVs "do not collect, record, or store ambient conversations."

Gamers Nexus found:
— the TV converts speech to plain text and stores it in on-device logs

— the microphone window stays open 10 to 15 seconds after talking stops, capturing bystanders who never addressed the TV

— the TV recorded room audio while the screen appeared off and the Ethernet cable was unplugged, then exfiltrated the file the moment it reconnected

The security vulnerabilities on top:
Beyond the designed behavior, researchers found remote code execution vulnerabilities in webOS that could allow a compromised TV to be weaponized as a covert listening device.

these sets are in hospitals. waiting rooms. boardrooms. hotels.

a surgeon asked Gamers Nexus where that leaves patient confidentiality.

Gamers Nexus has no answer. neither does LG.

What to do right now:
— disconnect your LG TV from your network entirely. route streaming through an Apple TV, Roku, or Fire Stick instead.

— if you must keep it connected: put it on a separate IoT VLAN or guest network so it cannot reach your other devices.

— disable the built-in microphone in settings.

— check your privacy dashboard and opt out of ACR and ad personalization.

— after every firmware update: recheck all of the above.

Credit to Gamers Nexus, Level1Techs, and other independent researchers.

[IT Guy @T3chFalcon]

What the TV does by design:

— scans your entire home network continuously. in their test: one TV identified 38 unrelated devices including phones, smartwatches, printers, and thermostats belonging to people not involved in the test.

— collects the names and signal strengths of every nearby WiFi network, plus location data. all sent to LG Ad Solutions.

— runs ACR (Automatic Content Recognition) on everything displayed on screen. including HDMI inputs. your laptop, gaming console, or work monitor connected to the TV is being fingerprinted.

— one TV exchanged roughly 4GB of ACR-related data per month.

What the TV does that LG says it doesn't:

LG publicly stated their TVs "do not collect, record, or store ambient conversations."

Gamers Nexus found:
— the TV converts speech to plain text and stores it in on-device logs

— the microphone window stays open 10 to 15 seconds after talking stops, capturing bystanders who never addressed the TV

— the TV recorded room audio while the screen appeared off and the Ethernet cable was unplugged, then exfiltrated the file the moment it reconnected

The security vulnerabilities on top:
Beyond the designed behavior, researchers found remote code execution vulnerabilities in webOS that could allow a compromised TV to be weaponized as a covert listening device.

these sets are in hospitals. waiting rooms. boardrooms. hotels.

a surgeon asked Gamers Nexus where that leaves patient confidentiality.

Gamers Nexus has no answer. neither does LG.

What to do right now:
— disconnect your LG TV from your network entirely. route streaming through an Apple TV, Roku, or Fire Stick instead.

— if you must keep it connected: put it on a separate IoT VLAN or guest network so it cannot reach your other devices.

— disable the built-in microphone in settings.

— check your privacy dashboard and opt out of ACR and ad personalization.

— after every firmware update: recheck all of the above.

Credit to Gamers Nexus, Level1Techs, and other independent researchers.

[Calif @calif_io]

Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android.

We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends.

Story and demos: https://t.co/5qJOcwSPLN

[Dark Web Informer @DarkWebInformer]

🚨🇸🇬 Malone Lam pleads guilty over $245M Bitcoin social engineering heist

The 22-year-old Singaporean admitted his role in the operation that stole more than 4,100 BTC from a single Washington, D.C. victim in August 2024.

Members of the group impersonated Google and Gemini representatives and convinced the victim to provide access to his Google Drive and security codes, allowing Lam to drain the wallets.

The stolen Bitcoin was worth more than $245M at the time.

Lam and his associates then laundered the crypto and went on a massive spending spree involving private jets, mansions, luxury watches, and exotic cars.

Lam alone reportedly:

• Spent $569K in one night at an LA nightclub
• Bought a $2M watch
• Acquired more than 30 cars, including Porsches, Lamborghinis, and Ferraris

The broader enterprise is accused of stealing more than $263M in cryptocurrency through social engineering, hacking, money laundering, and even home break-ins targeting hardware wallets.

18 people have been charged. Lam is the 11th to plead guilty.

He faces up to 20 years in federal prison. A sentencing date has not yet been set.

Source: https://t.co/0eSXq5E9JJ

[BleepingComputer @BleepinComputer]

SAP warns of maximum severity 'OVERPASS' kernel vulnerability
https://t.co/cbFT7ON7au

https://t.co/cbFT7ON7au

[vx-underground @vxunderground]

Don't larp like it's goop (malware), because it's not goop.

This is Base64 encoded slop slapped onto a t-shirt that makes "PEACE♥️FOR♥️ALL" wave in the terminal

I'm angry you would even pretend to give goop like this

[Marco Hextor @marcohextor]

> found a vulnerability with ~$9–15m immediately drainable
> got duplicated by a 6+ week-old report
> thought "wtf, are they reckless?"
> original reporter hadn't found my permissionless (and imho beautiful) exploitation path
> they mitigated my trick right after my report got triaged

Now I get $0 and the original reporter likely gets $10k at best. Or even a "won't fix", since last I checked they had only mitigated my trick.

Now laugh.

And that's one of the reasons bounties are incidental for me: I get curious about a project, find something, send it straight to security@ (or equivalent), and move on. I'm lucky to be able to do this for fun rather than need.

[International Cyber Digest @IntCyberDigest]

‼️ Self-proclaimed whitehat hackers used a vulnerability to drain Liquid Network of 4000 BTC ($320M USD) yesterday.

Just now they've returned 3400 BTC and kept 600 BTC ($47M) as a 'bug bounty'. They've also 'responsibly' disclosed the vulnerability in a PGP-encrypted message.

[Chainalysis @chainalysis]

Physical violence is increasingly intersecting with digital assets.

As criminals target crypto holders through home invasions and kidnappings, the scope of blockchain intelligence is expanding. It’s no longer a niche field; it’s a critical component of modern criminal investigations.

Our latest data show:
- Over $30M stolen through violent attacks so far in 2026.
- $77M in total attack attempts documented.
- On-chain trails are revealing connections to cartels and global criminal networks.

The investigation doesn't end at the crime scene.

Read our latest research:
https://t.co/JfNp4NPJu3

[Chainalysis @chainalysis]

$457B in on-chain taxable crypto activity last year. What will agencies see before DAC 8 & CARF exchanges in 2027?

Learn how to attribute activity by country and identify non-compliance. Register: https://t.co/P1PDTukSql

[Chainalysis @chainalysis]

The FBI agents’ blockchain tracing them to freeze and seize hundreds of thousands of dollars donated to Hamas. Read our breakdown of the takedown:

https://t.co/paDRqHwPWh
5/5

[Chainalysis @chainalysis]

Agents traced this network’s funds to mainstream exchanges, OTC desks, money mules and other stopovers common in laundering campaigns, including the use of bridges.
4/5

[Chainalysis @chainalysis]

The FBI seized $560,000 in crypto from Hamas over the past 18 months. Agents used blockchain analytics to follow the money on-chain.

Here’s how they did it.
1/5

[Chainalysis @chainalysis]

Announcing HyperEVM support! 🚀

We now automatically track HyperEVM tokens that follow major token standards like ERC-20 and ERC-721, enabling investigation and compliance workflows across the Ethereum-compatible environment on Hyperliquid.

Read more: https://t.co/m5TwDSyhee

[Chainalysis @chainalysis]

Read our full analysis of the case: https://t.co/lfqX5kxJs5

5/5

[Chainalysis @chainalysis]

Using blockchain analytics, investigators were able to trace activity from those addresses across a broader network of wallets — ultimately helping link the operation to one of its alleged operators.

4/5