dobs

I help secure the cryptocurrency ecosystem and provide support to those fighting human trafficking.

[dobs @dobsec]

https://t.co/82ENsZKwci

[zeroShadow @zeroshadow_io]

A wrench-attack victim lost $800K and reported it to @_SEAL_Org .

Because SEAL 911 feeds into our Threat Intel Platform (TIPzs), the stolen-fund addresses reached exchanges and bridges in real time, and within 30 minutes, 90% of the funds were frozen.

@EFDevcon

[dobs @dobsec]

@alexis_rapin @ESETresearch I'd love to collaborate on this - I work with front line organizations focused on the compounds.

[Security Alliance @_SEAL_Org]

Our profile of TraderTraitor - the DPRK group behind Binance, Bitget, AFX and LayerZero - with the fake company domains we’ve seen in 2026.

https://t.co/932DaP7mIw

[Kimi.ai @Kimi_Moonshot]

Releasing the model weights of Kimi K3.1 Pro: https://t.co/tJXcYUeSCj
We'll keep advancing open intelligence.

[aptwhatnow @aptwhatnow]

Just to level set or at least mention in some way. TraderTraitor did this, they're an offshoot of the old APT38 when they fractured post Bangladesh heist debacle/internal reorgs/switch to crypto. They're the king of the hill and can target any industry but its mainly crypto...

[Andrew Northern 𓅓 @ex_raritas]

You asked and we listened!

@censysio now offers subscription based plans!

If you are an independent researcher, a small team, or a business just getting its legs under it you don’t have to choose between having the best data and spending your coins elsewhere.

https://t.co/JMf9RQUN1b

[Hari @hrkrshnn]

North Korea's success in cybercrime shows what a rogue regime can do with technical talent and a relatively accessible part of the tech tree (computer hacking). You don't need a huge industrial base to pull it off: just a few hundred smart people, computers, and a few years.

In fact, the North Korean Math Olympiad team placed #4 globally at the International Math Olympiad in 2015 and 2019. They have the raw talent that can be put to work by Kim.

The impact of LLMs and coding agents on rogue regimes like North Korea is under-discussed. They can quickly climb up the tech tree into much more sophisticated areas, like autonomous weapons, as shown in the video below.

It's already happening: there were reports of Houthis in Yemen using Claude Code to build guidance software for their weapons.

We are not preparing for intelligence diffusion to rogue nations.

[dobs @dobsec]

@FoundationHQ Can you please begin sharing information about the attackers? Wallet addresses, IP addresses, domains used, etc? Those of us in the security community tracking threat actors like these can better understand the threats with this information.

[dobs @dobsec]

@tanuki42_ @zherbert @_SEAL_Org I am also tagging @sethforprivacy because I have a hunch Foundation will reach out to you too.

Help us hunt attacker activity (on- and off-chain) while @FoundationHQ focuses on the incident. Share details with us via the SEAL TG.

[dobs @dobsec]

@tanuki42_ @zherbert This, @zherbert . If you need prefer more hands and comms, please contact @_SEAL_Org - just hit the red SOS button at https://t.co/75XPN80xlS . They are a non-profit which can provide assistance tracing funds, identifying attacker infrastructure, etc.

[dobs @dobsec]

@JohnHultquist One Chinese threat actor I tracked used CyberStrike, as well as Claude and Hermes.

[Matt Johansen @mattjay]

This is gonna be a bloodbath if Andrew is warning people to go ahead and take any PHP offline until patch drops.

[dobs @dobsec]

@therealshodan What “mesh” are you using/planning to use?

[tanuki42 @tanuki42_]

Good speaking with @laurashin and @MagicalTux about the recent Ledger incident.

If you are a victim or someone concerned about this attack, and still need some (entirely free) support on what to do and how to navigate a response - you can still reach out to @SEAL_911.

[CTI Updates @CTI__Updates]

Regarding anonymity on Telegram, here are a couple of examples of what Telegram actually provides upon request.

source: Tor Zireael

[Ledger Support @Ledger_Support]

Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger’s bounty program: [email protected]. As a measure of precaution CryptoBilis confirmed it has ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is in active communication with CryptoBilis on next steps.

Ledger is working with the appropriate authorities to bring the bad actors to justice, and thanks @SEAL_911 for their collaborative support on the investigation. We have no indication that Ledger’s security infrastructure, systems or services have been compromised. As a reminder, Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed).

Security is a constantly evolving landscape; Ledger is continuously adding security mitigations and is working on further, enhanced anti-tampering solutions.

Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates, and remember: Ledger will never ask for your 24-word recovery phrase.

For assistance or questions, contact Ledger customer support through our official channels: https://t.co/PeTo6Z7l84

[Ledger Support @Ledger_Support]

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.

Reach out to Ledger customer support through official channels with any questions: https://t.co/4p918UH8yb

[Poppy McPherson @poppymcp]

Scoop by @Simondlewis - the U.S. has reversed its policy of isolating Myanmar's military regime and is now engaging in direct talks, in a shift led by US Assistant Secretary of State for Intelligence and Research, Michael Vance.

https://t.co/EJdQmgvYYD

[tanuki42 @tanuki42_]

PSA: On the eve of @token2049 week, please be CAREFUL when talking to people you don't know.

🇰🇵 North Korea has used proxies to socially engineer people in real life at conferences (see $285M Drift hack in April). Others do the same.

Be extremely careful what you disclose.

[m4rio @m4rio_eth]

for all the sec researchers out there, give it a try!!