Alchemyst

Web3 threat intelligence @BlockmageSec (opinions my own). Privacy is a human right. #InfoSec

[Alchemyst @Alchemyst0x]

Canceled this shit too.

[Alchemyst @Alchemyst0x]

@FCC Fuck you.

https://t.co/LPwnzUDY5L
https://t.co/MIVORghf0o
https://t.co/xvT9A6g1uO

You guys are fucking retarded. Banning routers? That's cute. I'm done with this shit. This post will get no attention anyway.

The bifurcation of the web into two distinct sides: The corporation-ridden, AI slop-infested, big shopping mall for idiot normies — and the "real" internet, what Eleanor Saitta was talking about with this lovely quote:

"The dark web is just the part of the web that hasn't been colonized by the state yet."

Everyone who knows what the fuck they are doing, congratulations: You are smarter than the vast majority of these idiots running the country, and you can exist in the real underworld online. I'm out. See you there.

Fucking. Retards.

[Alchemyst @Alchemyst0x]

If Google is already using ZK proofs to hide their optimizations, you can bet the NSA/GCHQ are doing the same. We might already be in a "post-quantum" world where certain actors can derive keys, and they just haven't gone loud yet.

[Alchemyst @Alchemyst0x]

(on Google Quantum AI Paper)
> They’ve optimized Shor’s algorithm specifically for elliptic curves. It now theoretically requires only ~1,000 logical qubits to recover a private key from a public key. On a superconducting system, this could take minutes.

GG.

[Alchemyst @Alchemyst0x]

(on Google Quantum AI Paper)
> They’ve optimized Shor’s algorithm specifically for elliptic curves. It now theoretically requires only ~1,000 logical qubits to recover a private key from a public key. On a superconducting system, this could take minutes.

GG.

[Justin Drake @drakefjustin]

Today is a monumentous day for quantum computing and cryptography. Two breakthrough papers just landed (links in next tweet). Both papers improve Shor's algorithm, infamous for cracking RSA and elliptic curve cryptography. The two results compound, optimising separate layers of the quantum stack. The results are shocking. I expect a narrative shift and a further R&D boost toward post-quantum cryptography.

The first paper is by Google Quantum AI. They tackle the (logical) Shor algorithm, tailoring it to crack Bitcoin and Ethereum signatures. The algorithm runs on ~1K logical qubits for the 256-bit elliptic curve secp256k1. Due to the low circuit depth, a fast superconducting computer would recover private keys in minutes. I'm grateful to have joined as a late paper co-author, in large part for the chance to interact with experts and the alpha gleaned from internal discussions.

The second paper is by a stealthy startup called Oratomic, with ex-Google and prominent Caltech faculty. Their starting point is Google's improvements to the logical quantum circuit. They then apply improvements at the physical layer, with tricks specific to neutral atom quantum computers. The result estimates that 26,000 atomic qubits are sufficient to break 256-bit elliptic curve signatures. This would be roughly a 40x improvement in physical qubit count over previous state-of-the-art. On the flip side, a single Shor run would take ~10 days due to the relatively slow speed of neutral atoms.

Below are my key takeaways. As a disclaimer, I am not a quantum expert. Time is needed for the results to be properly vetted. Based on my interactions with the team, I have faith the Google Quantum AI results are conservative. The Oratomic paper is much harder for me to assess, especially because of the use of more exotic qLDPC codes. I will take it with a grain of salt until the dust settles.

→ q-day: My confidence in q-day by 2032 has shot up significantly. IMO there's at least a 10% chance that by 2032 a quantum computer recovers a secp256k1 ECDSA private key from an exposed public key. While a cryptographically-relevant quantum computer (CRQC) before 2030 still feels unlikely, now is undoubtedly the time to start preparing.
→ censorship: The Google paper uses a zero-knowledge (ZK) proof to demonstrate the algorithm's existence without leaking actual optimisations. From now on, assume state-of-the-art algorithms will be censored. There may be self-censorship for moral or commercial reasons, or because of government pressure. A blackout in academic publications would be a tell-tale sign.
→ cracking time: A superconducting quantum computer, the type Google is building, could crack keys in minutes. This is because the optimised quantum circuit is just 100M Toffoli gates, which is surprisingly shallow. (Toffoli gates are hard because they require production of so-called "magic states".) Toffoli gates would consume ~10 microseconds on a superconducting platform, totalling ~1,000 sec of Shor runtime.
→ latency optimisations: Two latency optimisations bring key cracking time to single-digit minutes. The first parallelises computation across quantum devices. The second involves feeding the pubkey to the quantum computer mid-flight, after a generic setup phase.
→ fast- and slow-clock: At first approximation there are two families of quantum computers. The fast-clock flavour, which includes superconducting and photonic architectures, runs at roughly 100 kHz. The slow-clock flavour, which includes trapped ion and neutral atom architectures, runs roughly 1,000x slower (~100 Hz, or ~1 week to crack a single key).
→ qubit count: The size-optimised variant of the algorithm runs on 1,200 logical qubits. On a superconducting computer with surface code error correction that's roughly 500K physical qubits, a 400:1 physical-to-logical ratio. The surface code is conservative, assuming only four-way nearest-neighbour grid connectivity. It was demonstrated last year by Google on a real quantum computer.
→ future gains: Low-hanging fruit is still being picked, with at least one of the Google optimisations resulting from a surprisingly simple observation. Interestingly, AI was not (yet!) tasked to find optimisations. This was also the first time authors such as Craig Gidney attacked elliptic curves (as opposed to RSA). Shor logical qubit count could plausibly go under 1K soonish.
→ error correction: The physical-to-logical ratio for superconducting computers could go under 100:1. For superconducting computers that would be mean ~100K physical qubits for a CRQC, two orders of magnitude away from state of the art. Neutral atoms quantum computers are amenable to error correcting codes other than the surface code. While much slower to run, they can bring down the physical to logical qubit ratio closer to 10:1.
→ Bitcoin PoW: Commercially-viable Bitcoin PoW via Grover's algorithm is not happening any time soon. We're talking decades, possibly centuries away. This observation should help focus the discussion on ECDSA and Schnorr. (Side note: as unofficial Bitcoin security researcher, I still believe Bitcoin PoW is cooked due to the dwindling security budget.)
→ team quality: The folks at Google Quantum AI are the real deal. Craig Gidney (@CraigGidney) is arguably the world's top quantum circuit optimisooor. Just last year he squeezed 10x out of Shor for RSA, bringing the physical qubit count down from 10M to 1M. Special thanks to the Google team for patiently answering all my newb questions with detailed, fact-based answers. I was expecting some hype, but found none.

[BlockSec Phalcon @Phalcon_xyz]

ALERT! Our system detected a suspicious exploit targeting an unknown contract, reportedly the LML/USDT staking protocol, on #BSC hours ago, resulting in an estimated loss of ~$950K.

While the victim contract is not open-source, our analysis suggests a likely pricing-design flaw: claimable rewards appear to have been calculated using a TWAP/snapshot-based price, while the attacker was able to sell the rewarded tokens at a manipulated spot price. This inconsistency may have enabled the attacker to extract profit through price manipulation and reverse swaps.

Specifically, the attacker first used swaps, including a path with receiver = address(0), to push up the LML price in the pool. They then invoked claim through attacker-controlled addresses that had deposited earlier, making them eligible to claim directly during the attack.

Example deposit TX: https://t.co/FlkcCdZNjR

Attack TX: https://t.co/KmMJOZQgV6

🟦 Found by #PhalconSecurity, 🟦 Analyzed via #PhalconExplorer.

[Taylor Lorenz @TaylorLorenz]

Turns out another big tech company (OpenAI) was entirely funding another big “kids online safety” group, who could have predicted!! https://t.co/TpTPeMsPQo

[Alchemyst @Alchemyst0x]

@FCC Fuck you.

https://t.co/LPwnzUDY5L
https://t.co/MIVORghf0o
https://t.co/xvT9A6g1uO

You guys are fucking retarded. Banning routers? That's cute. I'm done with this shit. This post will get no attention anyway.

The bifurcation of the web into two distinct sides: The corporation-ridden, AI slop-infested, big shopping mall for idiot normies — and the "real" internet, what Eleanor Saitta was talking about with this lovely quote:

"The dark web is just the part of the web that hasn't been colonized by the state yet."

Everyone who knows what the fuck they are doing, congratulations: You are smarter than the vast majority of these idiots running the country, and you can exist in the real underworld online. I'm out. See you there.

Fucking. Retards.

[Tay 💖 @tayvano_]

Are there any online/international resources to direct people to who are dealing with psychosis, especially LLM-fueled?

Our support teams have always lists of self-harm ones, gambling ones, etc. For people who come in and need more help than we can give them.

Last few months the schizo-esque delusions, often around finding some insane crit double 0day, have been really bad.

Standard crisis lines arent really what they need. Especially as they don’t self-identify as depressed or in crisis whatsoever.

But we are not what they need either.

😩

[Alchemyst @Alchemyst0x]

@tayvano_ This has probably been linked; https://t.co/lmjbystTMn

Not exactly a list/resource in that sense, but maybe a starting point. Definitely a tough problem to see.

Meanwhile I have been trying to go crazy for years. ... anyone know how I can get there? 🙃 /s

[Alchemyst @Alchemyst0x]

IF IT NEEDS ADVERTISING, YOU DON'T NEED IT.

[EFF @EFF]

For nearly 30 years, journalists have relied on the Internet Archive to see how stories were originally published, before edits, removals, or changes. We need to safeguard that. https://t.co/WjLMSMhMnz

[Alchemyst @Alchemyst0x]

loooool this is epic. I am not even a big Bernie fan, but I had to click on this. Honestly, something I have always thought was kind of ironic/mildly hilarious, is that AI tends to give people information like this, seemingly against the goals of the company producing it (somewhat, take that with a grain of salt; you get what you ask for, most people don't ask, or even know to ask)

https://t.co/396dTyUdJO

[Alchemyst @Alchemyst0x]

First "Background Security Improvement" and I seem to have literally just happened to look at it ~30 minutes after it was pushed ha. Anyway, kind of neat. Maybe. Now I am questioning if I want "background" updates... 🤔😆 It's probably fine.

https://t.co/gQxaLAoOvG

[Scam Sniffer | Web3 Anti-Scam @realScamSniffer]

🚨 Someone lost ~$1.77M USDC after signing a phishing permit (gasless approval) signature on Ethereum. 🎣⚠️

[Alchemyst @Alchemyst0x]

This was on me, so I am owning this. Always a good reminder to not get excited, even when something looks really bad!

Any reports made have had follow-ups sent out to ensure that there's not any confusion or problems for the extension developers. The original post has been removed, too, with the same intention.

[BLOCKMAGE @BlockmageSec]

Earlier today, we flagged a VS Code extension (rphlmr.vscode-drizzle-orm) based on 21 critical YARA hits from vsix-audit.

After manual inspection and deeper analysis, inspecting the .vsix, and reversing the WASM binaries, we’ve confirmed this is a False Positive.

[Nym @nym]

Privacy is a right. Not a setting.

[Fifty Shades of Whey @davenewworld_2]

There's a new bipartisan bill to counter the mass surveillance of Americans, but I don't see anyone talking about it.

This should be much bigger news.

It mandates warrants before the government can access Americans' web browsing history, search queries, location data, and information from connected vehicles.

It also prohibits government agencies from purchasing the private communications, location information, and other personal data of Americans from third-party data brokers.

And it bans "backdoor" searches where government officials look through information collected on non-Americans for data on Americans.

This is objectively one of the most significant bipartisan reform proposals to prevent government overreach in decades.

I think it should go further than this, but it's a good start and it's important for us to pay attention to.

Everything has changed since 9/11 and even moreso since the Snowden leak. We've lost so much of our privacy, it's gonna be an uphill battle just to get it back.

[EFF @EFF]

Age verification laws are really just censorship mandates clothed as child safety proposals—here’s why. https://t.co/Nx9IGIUIdp

[0x6rss @0x6rss]

vibecoder threat actors, threat actors who end up hacking themselves, and many more undiscovered stealers along with their logs… I’ve started writing my blog post..

[Olivia Solon @oliviasolon]

“We value your privacy”

[Alchemyst @Alchemyst0x]

@tayvano_ @Chris_H5 @TrustlessState @VitalikButerin lmao, fucks sake tay, I feel this in my soul