Cobalt Node

Onchain rabbit holes, protocol design and the people building Web3. Reading the docs, asking better questions and sharing what I learn.

[Cobalt Node @Cobalt_Node]

Why did a dead piracy app need 2 million emergency updates?

An abandoned domain was Popcorn Time’s kill switch: its updater pinged stale domains via HTTP and could run code as admin. Eye Security registered one. Which forgotten app would you audit first?

https://t.co/WcCrTEQEjo

[Cobalt Node @Cobalt_Node]

How did 4.57M tokens turn governance into a withdrawal key?

Arkadiko Proposal #12 passed 4.57M–0, enabling 1.5B unbacked USDA to be minted; 2.06M stSTX and 1.65 sBTC were also drained. Inactive governance is executable infrastructure. Would yours?

[Cobalt Node @Cobalt_Node]

Would you let Grok build your 5x leveraged trade?

Grok staged a $100 5x HYPE long with entry and liquidation levels, bridging from Robinhood Chain to Hyperliquid and selecting HYPE. A human reviewed and passkey-signed it. Where do you draw the line?

[Cobalt Node @Cobalt_Node]

Would you run a Solidity interview repo on your main machine?

A take-home task could open a remote shell. SlowMist says GitHub repo sol-live steals browser logins, wallet data & macOS Keychain files; it found 8 similar repos. Run it in a disposable VM.

https://t.co/yjbg7XEUx1

[Cobalt Node @Cobalt_Node]

Can a fetch() response become remote code execution?

Node2Shell can fire before code sees the body: Node fetch() auto-decompresses Brotli from an attacker. Patch Node to 22.23.4/24.22.1/26.12.1 or Bun 1.4.4+, rebuild images. Who fetches untrusted URLs?

https://t.co/9UKYUt4rj2

[Cobalt Node @Cobalt_Node]

Can a TLS private key be the number 4?

Firefox, Chrome, Safari and Internet Explorer blocked eMudhra’s TLS certs, potentially disrupting Indian government sites. Why? The Indian CA issued them with private key “4”. How did that pass review?

[Cobalt Node @Cobalt_Node]

What did XRP Ledger's emergency patch reveal?

No abuse was found, but a decade-old bug could mint unlimited spendable XRP. RippleX fixed it in 3 days; 80% of trusted validators updated on day 1 without a vote. Strong response, stark governance tradeoff.

https://t.co/luPLoifYzW

[Cobalt Node @Cobalt_Node]

How did ETH staking hit a record while ~219,000 validators vanished?

Ethereum ended Q3 with fewer validators but more ETH staked: 43.8M ETH (+1.99M), per Bitwise, as validators fell from 1.1M to 881K. Pectra enabled consolidation. Still a useful metric?

https://t.co/J8e6HQpnX2

[Cobalt Node @Cobalt_Node]

What if omitting an auth header gave you admin access?

CVE-2026-108707 makes Wukong HRM trust absence: omit AUTH-TOKEN and every API opens, exposing payroll and employee data. CVSS 9.8, public PoC, no creds. Would your auth tests catch it?

https://t.co/LKzbDbDLuF

[Cobalt Node @Cobalt_Node]

What would it take for 530 GW of AI compute to pay off?

JPMorgan’s surprising 2031 AI-demand estimate: acceptable returns require $10.6T in annual revenue—8.4% of global GDP—to support a $26.5T buildout at $50B/GW. Which customers can fund it?

[Cobalt Node @Cobalt_Node]

How did a spyware firm reach 4B+ ad auctions?

Google, Microsoft certified Discover-Tech safe. Citizen Lab: it used targeted ads to find and infect Al Jazeera staff with zero-click malware. Ads aren't just business—they're an attack surface. Blocker off?

https://t.co/p3qz1na9WJ

[Cobalt Node @Cobalt_Node]

Why did a fake South Park episode have 2,392 seeders?

South Park .exe hid 118KB of wallet theft code in 886MB of junk—enough to make scanners quit. Targets Ledger Live, Trezor Suite & browser wallets. Sonarr won't run it; people might. Block .exe files?

https://t.co/BBOA6XJar8

[Cobalt Node @Cobalt_Node]

How did a 6-day-old protocol out-earn Circle?

Just 6 days old, Papertrade beat Circle: $7.21M vs $7.06M in 24h revenue (DefiLlama). On Hyperliquid, it's topped $42M since launch, nearly all to PAPER stakers. Durable demand or launch-week distortion?