One of the best platforms I’ve tried, Easy to Use and Intuitive, one of the best for CEFI. Join Nexo and get BTC rewards. Sign up and start today: https://t.co/m5kvlmqHnZ
Have you ever tried to buy stablecoins?
Not bitcoin, not some altcoin.
A dollar-pegged token that's supposed to just be a dollar. See what it actually costs you to get one.
This is just my rant.
I bought $1,000 of USDC and $1,000 of USDT on Crypto. com with a debit card.
Here's the receipt, both purchases, same day.
USDC: $1,000 in, 953.33 USDC out. That's a $46.67 loss. 4.67% gone before I've done anything with the money.
USDT: $1,000 in, 942.54 USDT out. $57.46 gone. 5.75%. Worse than the USDC purchase, same platform, same card, seconds apart.
Where it goes: a $28.81 card processing fee, a $7.71 trading fee, and then a quiet markup baked into the "exchange rate" itself, 1 USDC listed at 1.01065 USD, 1 USDT at 1.02222 USD.
That's not a real rate.
A stablecoin is supposed to be worth exactly one dollar. That extra percent or two is spread, and it's not labeled as a fee anywhere on the confirmation screen.
This isn't just Crypto. com.
Coinbase's simple buy runs roughly a 1.5% spread plus up to 3.99% depending on payment method.
Kraken's Instant Buy runs about 1.5% spread plus a 0.9% processing fee.
Binance's card purchases run 1.8 to 2% on top of their own spread.
Card-funded purchases are expensive everywhere. My numbers are actually right in the middle of the pack.
So you try the other way. Bank transfer instead of card. Cheap, sometimes free.
Except then you can't touch it.
Kraken's own support page: ACH deposits are locked from withdrawal for 7 days, no exceptions, applies to any crypto or cash that comes from it.
Binance .US's own help center, word for word: "the 7-day hold period cannot be waived, shortened, or bypassed under any circumstances."
Coinbase lets you trade instantly but multiple independent reports put the actual withdrawal hold at 7 to 10 days, sometimes longer, before you can move purchased crypto off the platform at all.
So that's the actual choice every single time. Pay 4 to 6% right now and get instant access. Or pay almost nothing and lose access to your own money for the better part of a week.
Here's the part that actually bothers me.
Every regulator, every institution, every stablecoin push this year is telling us this is the future. Move to stablecoins. Programmable dollars. Faster, cheaper, better. But nobody who's actually looked at what it costs to get into one in the first place is going to feel like that pitch matches reality.
You can't sell "faster and cheaper" while the on-ramp itself eats 5% and locks your funds for a week.
Does the CLARITY Act fix this? No.
Regulatory clarity around what a token is doesn't touch what it costs to buy one.
That's a market structure problem, not a classification problem.
I don't have a clean answer for what actually solves this.
Maybe you do, like paying their monthly subscription fee, but the general population does not.
Maybe it's more competition on the on-ramp layer itself.
Maybe it's regulation aimed specifically at how these fees get disclosed instead of buried in a fake exchange rate.
I genuinely don't know yet. But I know the current setup is eating people alive in fees while we're all being told this is the future of money.
🛡
Introducing my new bug bounty triage service!
Send me your writeup and POC (along with $50) and I will reply with “Internal Duplicate - Closed” within minutes!
"I have nothing to hide."
False.
You have medical history.
You have financial behavior..
You have location patterns.
You have political views.
You have relationship data.
Privacy was never about hiding crimes.
It was always about owning your life.
I Saved Injective's $500M. They Pay Me $50K.
I like hunting bugs on @immunefi . I'm decent at it.
- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)
Life was good. Then I found a Critical vulnerability in @injective .
This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.
I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.
Then — silence. For 3 months. No follow up. No technical discussion. Nothing.
A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.
I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.
I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.
Full Technical Report: https://t.co/lki2tL9bxw
a major hack happened recently resulting in millions of dollars in losses. we had been actively submitting vulnerability reports to their bug bounty program only to be kicked out. looking at the data:
• Total submitted: 42
• Severity: 5 Critical, 11 High, 12 Medium, 8 Low, 6 Unknown
• 1 triaged/confirmed, 1 resolved
• Paid: 20k
their team ignored multiple critical findings and accepted operating under high risk assumptions. we tried to do our best by back-channeling with devs and getting many issues fixed without payment expectations because everyone saw the hack coming. well, it happened.
wonder how many security researchers got tired of submitting valid issues only to be ignored. if you ignore the goodwill security researchers, they will stop helping you and trust me, YOU NEED THEM MORE THAN THEY NEED YOU.
❗️Pokémon Go creator Niantic used 30 billion images crowdsourced from their players to build a map for AI training and visual positioning capabilities, including for defense purposes.
143 million people spent 8 years scanning streets, parks, and storefronts with their cameras. None of them knew what they were contributing to.
Niantic is now using that data for questionable purposes.
Hey @Binance, your platform is crooked.
I click on "Buy Crypto"... In Australia we dont have XRP/AUD pair, so I do buy, and get this wonderful mesage of "Binance has the lowest transaction fee (0.1%)". That is the first image.
When I click BUY XRP, I go to another page where put in $100 AUD and get 47.03 XRP (second image)
Now this means 100/47.03 = $2.126 per XRP which is $0.056 HIGHER than the first screen.
Now I am paying 2.7% SPREAD, WHICH IS HIGHER THAN ALL THE OTHER EXCHANGES.
YOU SUCK!! seriously. disgraceful.
So only 0.73% of XRPL accounts were active last week?
Glassnode reports roughly 744,000 Bitcoin addresses active in a single day, just 1.31% of all non-zero BTC addresses.
By the same logic, Bitcoin is “dead” too.
A huge percentage of blockchain accounts are savings, custody, exchange, or dormant addresses. Cherry-picking inactive accounts without context proves almost nothing.