Michelle Heuer

[Michelle Heuer @MichelleHe66501]

@tylerofxworld @TheChainSafer I've joined the hacker army based on the vulnerability. Thanks to those unlucky souls — the money isn't much so far, but at least I've made up for my losses and even earned a little. As for you scammers, don't expect to make any money off me.

[Michelle Heuer @MichelleHe66501]

@BennyErgen I've joined the hacker army based on the vulnerability. Thanks to those unlucky souls — the money isn't much so far, but at least I've made up for my losses and even earned a little. As for you scammers, don't expect to make any money off me.

[Michelle Heuer @MichelleHe66501]

Stupid — obviously you let the AI deeply analyze the vulnerability's underlying mechanism based on the report and write an exploit script; a single simple prompt is enough. "Reading the report" was just my shorthand, but everything was very simple: it took less than an hour, and Claude automatically downloaded the relevant APK, analyzed it, and completed the vulnerability write-up. You can try it yourself. The root cause is that the AI understood the affected versions mentioned in the report and the signature issue referred to, and the AI keenly recognized that this was an algorithm problem. Here is the report: https://t.co/c4GQz26FWh. You can have an AI try it — and if you're lucky, you can still watch quite a few unlucky victims have their assets swept away by the hackers monitoring those addresses.

[Michelle Heuer @MichelleHe66501]

After my XRP was stolen, I conducted an in-depth analysis of the incident and discovered that everything went wrong after that report was published. I fed the report into an AI, and before long, it was able to spit out other people’s XRP private keys with alarming ease. I then examined the report myself and found that, because it disclosed both the affected version numbers and the cause of the vulnerability, the AI only needed to perform a simple diff to create a working exploit. This was unbelievably irresponsible!!! After briefly analyzing the on-chain activity, I could roughly identify several separate waves of hackers scanning for the vulnerability. They appeared at different times and exhibited different behavioral patterns, but without exception, they all emerged after the report was published. The report’s authors should have obscured the vulnerability’s underlying mechanism and the exact affected versions. How stupid!😡📷📷 😡😡