Jonathan

InfoSec and Crypto | #BTC

[Mario Nawfal @MarioNawfal]

CZ on AI: Utility Over Tokens! w/@AVAFoundation https://t.co/6W3woSXpvU

[Travala @travalacom]

Travala Monthly Report: March 2025

Introducing our NEW monthly report format!

View the March stats across Travala & the @AVAFoundation Smart Program

Key Stats:
💵 Monthly gross revenue: $9.19M
📊 Crypto payments: 74%
🎁 Total giveback rewards: $109K

👉 https://t.co/FrkKTiLLyY

[Travala @travalacom]

Our Takeoff Quests are LIVE across 4 platforms! ✈️

Complete fun tasks & win your share of $2,000 USDT 😍
Start your crypto-powered travel journey with @travalacom 🌍

Thread with links & details below👇

[AVA Foundation @AVAFoundation]

Upgrade your #travel experience with the AVA Smart Program!

🔹 Get $AVA, $BTC & other rewards
🔹 Save up to 13% on bookings
🔹 Enjoy exclusive member-only deals
🔹 Access airport lounges, concierge services & more!

Get started for FREE today! 👇

https://t.co/j8qs8q8rxr

[Travala @travalacom]

GET US$25 in Travel Credits for every friend you invite to Travala!🏝️

1. Invite a friend to sign up
2. They book a hotel for US$400+
3. You both get US$25 in Travel Credits!😍

Use credits on flights, hotels & activities globally ✈️

Start inviting today👉https://t.co/d4REWxlEO8

[ZachXBT @zachxbt]

Putting final touches this week on an investigation I have been working on for 15+ months.

By far my biggest project to date and I look forward to sharing it soon.

Expect no other new posts in the meantime.

[ZachXBT @zachxbt]

Update: Same scammers are also likely behind @ZebraLending on Base which is currently live with $311K TVL

Withdraw your assets immediately if you have funds deposited in this protocol.

Tracing:

1) 0x085 transfers 30 wETH to 0x9f8 on Base

0xf6679f26e4ce13df51d183b4f7408ecb0efe7dac6aa5257836b3aa588951ac23

2) Zebra DAO deployer is funded by 0x9f on Base

0x9e7715ccbb2bf85c31784db5bb87d0a9fd56637d465bf8db92b184e3dfb1f4fb
0xd818ea2af0778652f825a40f3fa91d5eaac1802f

[ZachXBT @zachxbt]

Community Alert: The group of scammers who stole 8 figs with Magnate, Kokomo, Lendora, Solfire, etc is back with a new project on Blast @Leaperfinance

Last week they funded an address on Blast with ~$1M of laundered funds from the previous rugs and have begun adding liquidity to bait people in.

Tracing:

1). 1 week ago 0x46a moves ETH a few hops from Magnate scam to 0x10e 0x46a10e7444bf78736E6a24b1De8dc8A20E4B3ED7 —>
0x10ef5bb874b226bdd6860f00d5e5a2aa3e955b9a

2). Bridges to 0xAc9 on Polygon 0xAc973E1Be91fe8674dff2E0de4A9375803Ae4435

3). 0xAc9 transfers wETH to 0x08
0x67b5d330001c6b281a83fbcb2cf90119f2d72b3a42352abbfafb7ea72e91a34c —> 0x085817190C2e9949F67e8144B45383E3C5890457

4). 0x085 bridges wETH to Base via Orbiter
0x085817190C2e9949F67e8144B45383E3C5890457

5) Repays borrower on behalf of another address 0x1174 using Sonne Finance
0xb84987d765bd6f53f6a4273f80d100e56a786e7383e687d5fb1bd534da381a92

6) 0x1174 bridges 294 ETH from Base to Blast via Bungee
0x1174f03604B606bcFe50aaaf96af4477f3E81977

7) Swaps for LEAP and becomes top holder/deposits to protocol
0x7606c8e3b35dde1186f90a84d6ef91d108db672f85bf82ecf00a877b489f4d99
0x67243b69c6e3b2904b1fecc68ab4fa210ec9201ff6590c4cc27808d5192de315

Research was co-authored with @bax1337

In the past they let the TVL grow to 7 figs before stealing all of users funds deposited to the protocol and falsify KYC documents + use low tier audit firms.

They now have launched scams on Base, Solana, Scroll, Optimism, Arbitrum, Ethereum, Avalanche, etc.

[UNCX Lockers @UNCX_token]

We have deployed our #Uniswap V3 lockers on #Avalanche! All our services our now live on the chain.🔺

➡️ We invite developers to do their part in helping secure the funds of communities on @avax by locking their LP with the most trusted lockers in the industry. #UNCX🛡️

[UNCX Lockers @UNCX_token]

We are happy to announce that UNCX Network has received a grant from the @arbitrum foundation to support the growth and implementation of our products which are now live on #Arbitrum. 💙🧡

➡️ Arbinauts are welcome to explore our suite of decentralized and secure services which include: Liquidity Lockers, Token Vesting, Token Minter, & an ILO Launchpad.

We are passionate about the education of safer #DeFi practices and we at #UNCX are excited to continue encouraging projects to make their data more accessible and to secure their liquidity, amongst other efforts.

[Travala @travalacom]

Introducing #Travala Gift Cards! Perfect for booking over 3 million hotels, flights & activities worldwide!😍

Choose any amount from $50 up to $25,000! No expiry! Pay with a card or #crypto ✈️🌎

Gift endless possibilities!

Explore more at 👉 https://t.co/5Xq9fuvcL5

[UNCX Lockers @UNCX_token]

Join us on Wednesday as we chat with @Kondux_KNDX on their work to build the infrastructure needed for users to create meaningful digital identities in #Web3

Set a reminder 👉 https://t.co/537Z96B974

💸 RT, follow both accounts, and attend the spaces for a chance to win $50 of $UNCX

[UNCX Lockers @UNCX_token]

🚨 Introducing TaxToken, our powerful new (ENMT v2) minter, featuring a @losslessdefi integration and AntiBot.

Enjoy extreme customizability and an enhanced level of security when minting with its highly flexible settings.

TaxToken Minter NOW LIVE 👇https://t.co/NzjGv1EEmr

[𝙲𝚘𝚕𝚒𝚗 𝚃𝚊𝚕𝚔𝚜 𝙲𝚛𝚢𝚙𝚝𝚘 @ColinTCrypto]

I have personally used Ledger hardware wallets for about 7 years. Today is the first day I've decided to look elsewhere.

Apparently, newer Ledger hardware devices (Nano S plus and Nano X) have the capability of sending the private key from the device. Not good.

This just came to light as Ledger unveiled its #LedgerRecover service. This "recovery service" is actually not the core issue. It's what it tells us about the hardware wallet's capabilities.

A properly secure hardware wallet shouldn't be capable of sending the private key. Period.

The fact that the device has the capability of sending the private key is the flaw. Even if Ledger were to release a patch to "address the issue", they can't fix this issue because they have just admitted the hardware device is capable of sending the private key.

I've seen some red-herring discussions regarding this (for example, some will say "Don't worry. It's an opt-in feature. Just don't opt in." or "Just don't update to the newest firmware", etc.) but they are all missing the above, single, massively important point.

Btw, supposedly the older Ledger Nano S (non-"plus" version) doesn't have this capability (flaw).

A temporary, stop-gap solution can be to use an older, Nano S (non-"plus") device. But, Ledger as a company isn't really trustworthy at this point, imo, especially after they already leaked all of our personal information on the Internet in 2020. ( https://t.co/qXZ0Wc18Gl )

I suggest you educate yourself and read up on this topic further. There's a lot of discussion about this on the Ledger sub-reddit right now:
https://t.co/XYz20N4JlN

[UNCX Lockers @UNCX_token]

📢 We're incredibly excited to show you our new website & along with this, to announce that we have rebranded to #UNCXNetwork

**As of this moment, UniCrypt will officially be known as UNCX Network**

Come explore the new home of the green unicorn⬇️
https://t.co/uWA57aBIPc #UNCX

[0xScope @ScopeProtocol]

We find a smart money (or dark money?) address that always borrows >$10M USDC/ETH and deposits it to exchange every time before FTX-drainer dumps ETH.
Chances are he knows the activity of FTX-drainer and benefits from it:
🧵

[3Commas @3Commas]

🏆 Win one of 50 1-month Pro subs for $1.

🔥 Black Friday is coming with deals to help you trade smarter than the average bear.

⏩ Learn more: https://t.co/5pfGTNoH87

[kadhim (＾ｰ^)ノ @kadhim]

THE FTX FIRST DAY DECLARATION

New CEO John Ray is scathing about Sam Bankman-Fried's management.

"Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information."

https://t.co/iTGlCA9olr

[UNCX Lockers @UNCX_token]

yes. Yes. YES!

💡Do not forget to push it to the next level

🔒Lock your LP tokens using our smart-contract-based decentralized LP lockers.

We DO NOT and will NEVER hold custody of your LP position.

⛓️The chain does, and that's the beauty of it.

@haydenzadams ❤️
@Uniswap ❤️

[UNCX Lockers @UNCX_token]

Been craving to get more personal with the team? To discover that we’re degens just like you? 👀 Join us next Weds Oct 12 at 5pm UTC for #UniCrypt’s first Twitter Spaces.

We’ll catch you up on what’s going on behind the scenes, answer Qs, and drop a piece of alpha. 🤫