Satoshi

RIDE IT TO ZERO, OR TO THE GALAXY!

[blocktom @blocktom]

我又发现一��更好玩的，onekey，用户协议里面特别写明：公司在该协议下的总责任，不超过「0.1 ETH 的市场价值」与「100 新加坡元」两者中的较高者。

这个是英文版里写的，中文版他居然隐去了，是怕大家发现吗？

那我想问一下 OneKey 的官方，你为什么不敢在中文版里面把这个责任条款写进去啊？英文版里你就写了，中文版不写是怕大家发现这一条吗？还是说你们对中文用户是承担无限责任。

《OneKey App 使用条款》第 IX 节包括：
助记词、私钥遗失或泄露；没有备份，转错地址、操作不当、下载非官方 App，使用第三方 DApp、交易所等服务产生损失，onekey不承担责任，这个我赞成！

但是因为产品本身安全缺陷导致损失的，公司在该协议下的总责任，不超过「0.1 ETH 的市场价值」与「100 新加坡元」两者中的较高者。

他们官方的用户服务协议条款网址，我放在下面的回复里面了，你们自己看是不是。

官方能不能回答一下呢。

[Mark Karpelès @MagicalTux]

Ledger spy implants went from a bunch of wires manually soldered to mass production circuit boards made to blend with the official hardware.
https://t.co/oJ0S6mC2BK

[Kellan Mercer @KellanMerc]

$86M from "hundreds of wallets" is not a Ledger exploit. A Ledger exploit drains everything, instantly, not over weeks

this looks like a coordinated supply-chain attack on how seed phrases were stored — backups, screenshots, cloud, or a compromised third party. Ledger the device is fine. the operational security around it isn't

everyone blaming the hardware is missing the actual threat model

[Cos(余弦)😶‍🌫️ @evilcos]

Bitget 被盗事件中，我们 @SlowMist_Team 和 @Mandiant 的阶段性调查报告。

[SlowMist @SlowMist_Team]

@bitget has engaged SlowMist’s security team to investigate the September 25 hot wallet asset theft.

As of September 29, our investigation has identified malicious activity involving certain third-party security products and a wallet application host, as well as a highly customized withdrawal tool used by the attacker.

🔎 Key findings include:

1. Malicious activity on a certain third-party product involving exploitation of a zero-day vulnerability.
2. Unauthorized access to a certain third-party products management platform on September 25 using an internal employee identity.
3. Recovery of a customized withdrawal tool designed to interact with the wallet system’s withdrawal logic.
4. On-chain activity begins at 02:31 on September 25, with transfers across multiple blockchains over approximately 2 hours and 52 minutes.
5. Subsequent attempts to manipulate withdrawal records and trigger additional BTC withdrawals.

We are continuing to investigate how the attacker moved between the affected systems.

All date references are to UTC+8.

📄 Read the details of the investigation:
https://t.co/vcbgBNBire

[DiscusFish @bitfish]

交易中的圣杯在寻找凸性结构 Opus5.5解说版

[Morris @Morris_LT]

为什么人到了不同年龄，对世界的理解会差这么大？杜甫24岁写“会当凌绝顶，一览众山小”，看到的是可能性；晚年56岁写“万里悲秋常作客，百年多病独登台”，看到的是边界。年轻时，总觉得努力可以改变命运；经历多了才发现，时代、出身、疾病、财富、关系和运气，都在塑造人生。年轻时，人更多看到世界的可能性；经历增加以后，人开始看到世界的约束；真正成熟以后，是既看见可能性，也接受边界。人最残酷的地方是：年轻时有时间，却看不懂世界；等真正看懂世界的时候，才发现选择少了，身体老了，时间也开始不够用了。

[Morris @Morris_LT]

你知道吗？为什么很多富人已经有豪宅、游艇、豪车、大量现金和资产，却依然在努力工作、持续抛头露面？这不一定是贪婪，而是因为对真正的富人来说，工作早就不只是为了赚钱。工作是在维持现金流、创造价值，也是在持续维护自己的选择权。资产会波动，市场会变化，开支会持续，今天拥有的自由，未来也可能缩水，所以真���的财富从来不是“我现在有多少钱”，而是我有没有持续创造现金流的能力，有没有继续创造价值的能力，以及我的选择权是在扩大，还是在缩小。很多富人持续工作，本质上是在持续维护自己的自由，同时获得成就感。

[Chaofan Shou @shoucccc]

I bought a Fable dataset from one of the top Chinese LLM routers yesterday.

With just 6TB data, I can take over 7 Chinese/CIS gov entities & 19 top Chinese firms like Xiaomi, Huawei, NIO, Minimax using SSH keys, VPN configs, Aliyun keys, GitLab tokens sent to the router.

[Chun @satofishi]

Zcash’s latest rally is a narrative bid. A big market cap does not mean a coin earned its place. Sitting near Solana and Hyperliquid on a ranking list does not mean Zcash does what those two do.

The launch was not fair. For the first four years, 20 percent of every block reward was taken as the Founders’ Reward. That money went to founders, staff, advisors, and early investors. It added up to 2.1 million ZEC, or 10 percent of the 21 million cap. Bitcoin paid miners. Zcash also paid a company and its backers. When that first cut was supposed to stop, a similar 20 percent cut came back as a “development fund”. A coin that writes itself into the block reward should not be sold as clean, neutral money.

The cut did not buy a real economy. Privacy was the sales pitch. Using it was optional. Open addresses stayed the easy path for exchanges and simple wallets. For most of Zcash’s life, most coins sat in the open. Optional privacy is marketing. Default privacy is the protocol. Management stayed a board fight: Electric Coin Company, the Foundation, Bootstrap, the brand name, the wallet, and who gets the cut. In January 2026 the whole ECC team left and said they were pushed out. That is not a side issue. That is how the project runs. A base-layer team that cannot stay in the same building as its nonprofit board is not “decentralized.” It is broken at the top.

Then came the security mess the market is already trying to skip. In May 2026 a serious bug in the Orchard pool was made public. It had been there about four years. In theory it could create fake ZEC with no clear on-chain trail. Because the pool is private, nobody can prove fake coins were never made. Ironwood in July closed the old pool and forced coins through a gate. That is cleanup, not a reason for a top-ten price. A money whose private supply cannot be checked like Bitcoin, and that needed an emergency fix after a four-year bug, is not “hard money.”

The point is plain. An unfair launch, a team cut without a matching product, years of board drama, and a four-year hole in the private pool are not the record of a top-ten network. They are the record of a story coin. Solana and Hyperliquid can be disliked for their own reasons. They still clear real use. Zcash cleared a listing and a squeeze. Those are not the same thing. Mixing them up is like sending 701.4 of the wrong asset, or treating EST and EDT as the same hour.

[Morris @Morris_LT]

中国的学生最经常听说的一句话：“不要输在起跑线上”。这是最误导人的话。小时候领先，往往只是更早熟悉规则、更快适应标准、更擅长完成既定任务，但成年后的卓越需要的是另一套能力：探索未知、跨界连接、提出问题和创造新路径。真正长期站在顶端的人，反而常常没有过早把自己锁死在一个赛道，而是在更长时间里尝试不同领域，积累更多经验、思维模型和可能性，最后才找到最��合自己的方向。早期竞争比的是谁更快，长期竞争比的是谁拥有更大的探索空间和更��的进化能力。 所以真正重要的，不是让一个孩子尽早证明自己是谁，而是不要太早剥夺他成为其他人的可能性。

[徐可KeXu @xukego]

��甜，
80后西北北舞北漂很典型的“果儿”。
果儿是北京一带影视行业的黑话，随便找个内行人问一下就知道什么意思。
现在随着打击贪腐、ai冲击市场，金主消失了，因此这种角色也消失了。

00年代初，
内地影视行业蓬勃发展，
扫黑除恶未打响之前，
影视行业成为了洗钱、官商勾结、财色交易的场所。

80后的���甜就属于那个时代。

晨晨和赵长鹏完全不是一种人，
是典型的两极。
无论是年代、家庭背景还是文化氛围，
都有巨大的差异。

我是介于他们俩的文化背景中间的那一档，

所以我深刻理解赵长鹏的三等移民/苏北佬/被迫干灰产的华人帮会，
typical的
外表极尽扮演冷静谨慎 温柔善良，
实际就是个心狠手辣的边缘型人格空心人。

也非常了解晨晨的90后第一批网民/郭敬明韩寒时代/东亚文化/创业者，
typical的
一个想要拼命向外界证明自己很强大很优秀抓着话筒不放的小孩子，
内心其实敏感脆弱自卑 极度缺爱。

别看他好像整体张牙舞抓的
发一些惊世骇俗的���点
吃不了一点亏的性格。
其实只是一个自卑敏感的小孩强撑着，
表达失望 没有得到爱。

当然那是因为他辜负过别人的真心，
被系统balance了，
他没意识到。

他只知道
他要向这个世界征讨损失。

【关于景甜】

景甜更像赵长鹏。

赵长鹏怎么对嗯哼的，
用完马上像垃圾一样丢掉。

景甜就是怎么对孙宇晨，
蹭完好像沾了💩一样嫌弃。

景甜是一个西北80后女老登，
80后的生存环境和90后是天壤之别的。

景甜这种毫无背景西北北漂北舞生，
在那个年代，还是内地影视有油水可捞的年代。
景甜就被挑选去做“果儿”了，
走陪秃头官老登的艰难岁月。

那个年代，我家人身边很多叔叔的情人都来自北舞/北影，
里面有负责专门牵线搭桥的，
这种女孩子一��学，大一就会被包下来，
根本不会流入市场。

老头子们一边玩着青春靓丽的“果儿”，
一边想着投资自己的“果儿”万一能捧红出个影后歌星，将来能靠情人吃个养老钱。
所以我妈身边的太太团虽然对这几个学校恨之入骨，但也不好说什么。

景甜一陪就是十几年青春没有了，
最终好不容易趴在岸边喘一口气，
开始向往着可以像身边小姐妹女主持人们一样找个“x二代”或者冠军体育生同龄人好好过日子，

结果真心还是被当🐔对待，梦碎当场。
怒沉百宝箱的景十娘，
整个人更加被掏空边缘型人格了。

这种陪过老登的做过小三的，
属于长时间阉割自己的需求，
被社会环境逼的去出卖身体的行为：

当同龄人在读书 在忙着毕业找工作，
她在陪���登；
当同龄人正常和同龄人谈恋爱成家了，
她在当金丝雀。
这种与现实脱轨的情况
会让她逐渐麻木，
变成空心人
会导致她内心只要见到有钱有势的人就会联觉到小姐和嫖客，会应激。

就像赵长鹏见到嗯哼穷酸挣扎顺杆爬拼命证明自己已经变成有钱人的样子，他也很应激。

景甜内心真正追求和喜欢的就是精神小伙，
有生命力 风一样的自由，
再给她来几个科也会飞蛾扑火那种，
不要钱都会给他生。

而对在她眼里就是西北暴发户孙宇晨，
充满嫌弃
怕被孙宇晨蹭到，
怕被以前的金主嘲笑，
更厌恶了，
要借口花一小时剪指甲去给自己时间做上钟前心理准备工作，
不关灯下不去嘴的程度。

因为对她来说这就是在交易，
前半辈子卖青春，
现在销售子宫。

【忠���逆耳】

跟所有男人说一个真实的暴论：

一个女人如果爱你一定会想方设法让你与她阴阳交合，
想要孕育你的孩子。
那是雌激素上头之后，母体无法拒绝的能量；
那是基因表达满意配偶的方式。

一个女的对你很冷静，
没有恋爱脑 没有吃醋占有欲 没有哭没有生气
那恭喜你 她不爱你。

如果她不肯生（年纪小除外），
那大概率要么身体有隐疾，
要么极其自恋（病理性的也是一种隐疾），
要么就是打心底里看不上你 为自己留后路。

至于看不上你哪部分，自己琢磨。
可能是不够帅 可能是没钱 也可能是硬件不行时长不行满意度不高。

男人青春也很重要，
早点认清，
鼓起勇气认亏出局下一位。

不爱就滚蛋，
不要和不爱你的人缠斗，
粘桌，
��费大好时光。

[Morris @Morris_LT]

跟漂亮干净的人做朋友，跟有钱的人学赚钱，跟自律积极的人学生活，跟认知高、博学的人聊世界，跟行动力强的人一起做事，跟情绪稳定的人长期相处，跟有结果的人学方法，跟有格局的人看长期，跟有边界感的人建立关系，跟诚实靠谱的人做生意，跟敢于承担的人共事，跟持续成长的人同行。

[Morris @Morris_LT]

你知道吗？婚姻和炒股其实是一样的。单身叫空仓，认识异性、相亲叫选股，暧昧就是看盘，谈恋爱是小仓位试错，发现不合适就及时止损；决定结婚，是看好长期走势，领证相当于满仓梭哈，生孩子就是继续加杠杆。喜欢的人最后跟别人结婚了，叫踏空；借钱结婚叫融资融券；彩礼都是父母借的，最后还被骗婚，那叫直接穿仓。夫妻吵架只是���期震荡，出轨属于重大利空，嫖娼叫频繁交易，一夜情叫做T，突然发现孩子不是自己的，那就是股灾。离婚叫爆仓，二婚叫换股，想离又离不了叫长期被套，离婚以后前任突然发财叫卖飞，至于入赘，那基本就是多倍杠杆。

[Satoshi @Hendry36807291]

@shelvin_liu @DeFi8362 传销味儿这么浓厚

[Nature is Amazing ☘️ @AMAZlNGNATURE]

This is what the nerves that connect your teeth to your brain look like

[James O'Beirne @jamesob]

I haven't told the full story yet, but I came to the same conclusion back in May 2025 when I started doing an audit of `coldcard/firmware`.

I wanted to figure out conclusively where the CC RNG was getting sourced from, and found that it backed up to some shady library called libngu (https://t.co/wQu3wOB7cb) that had literally 6 stars on github and was maintained solely by a pseudoanon tranny.

I knew from past experience that linking to libsecp256k1 from Python was pretty easy, which seemed to be the stated purpose of the library use, and so I was confused about why it was there.

I sent a report to the CC team that I had doubts about whether the true RNG was actually in use, and pointed out that the hardcoded yasmarang constants in libngu were sloppy. I advised they rip the whole thing out and link against libsecp256k1 directly.

I was told that if something was wrong "we'd already know about it by now" and that everything was properly configured for the real boards.

I didn't follow up rigorously, which was a horrible mistake on my part.

[Lookonchain @lookonchain]

This is insane!

According to @glxyresearch, the total losses from the #Coldcard hack may have reached 2,055 $BTC($130M).

More than 7,700 victim addresses have been affected.

[Science girl @sciencegirl]

Visualisation of terms in geography

[南堤 @Hand46095320]

宇宙各个星球，切开都是什么样？长知识了，让我们了解地幔地核。