Karlow

trust the process | dm open

[Karlow @karlowalpha]

@crypto_banter this is only a start

[Karlow @karlowalpha]

@lookonchain @machibigbrother @papertrade_xyz crazy dedication

[Karlow @karlowalpha]

Imagine paying your customers for them to lose money

If you think that`s unreal, meet Papertrade, new perpetual exchange that`s all around on X right now, built on Hyperliquid, 1000x leverage, all you need to caught people`s attention.

Every loss and every liquidation on Papertrade mints $PAPER, their new token thats gained 200% on a day of launch on Hyperliquid, and every 1$ you are losing, you actually gaining 100 $PAPER tokens, which is fair trade if you think about it.

No locked token supply, everything comes from people actually using a platform, this has never been done before, new way of airdrops is here.

And to sum up on a exchange, all order book comes from Hyperliquid itself, no slippage, 1000x leverage, all of that makes Papertrade a place where one guy can make 10x of their deposit in just 9 hours.

[Karlow @karlowalpha]

@cz_binance flexing on burning less than 1% of mcap is crazy work😂

[Karlow @karlowalpha]

@WatcherGuru its good that they are doing, but its like only 1% of mcap

[Karlow @karlowalpha]

@elonmusk don`t do the same thing as Trump man please stop😭✌️

[Karlow @karlowalpha]

@Cointelegraph should have done that earlier

[Karlow @karlowalpha]

@MrketInsider how is that possible? i am taking eth chain over tron all day

[Karlow @karlowalpha]

@flipski77 wallahi whe aren’t making this far with this market😭✌🏻 something has to change

[Karlow @karlowalpha]

@Donaxbt cz is good but ansem is crazy guy all i can say

[Karlow @karlowalpha]

@PCreatives258 nahh, thats too risky

[Karlow @karlowalpha]

Since January 2025, hackers have taken $4.5B+ from crypto.

Not from shady corners of the internet. From the biggest exchanges, bridges and protocols in the space.

Here are the 8 worst, and what actually happened in each one:

1. Bybit: $1.5B (Feb 2025)

The biggest crypto theft ever. On Feb 21, Bybit's team made a routine move: 30,000 ETH from the cold wallet to the hot wallet. Several signers approved it, and the screen in front of them showed exactly that.

The screen was lying. North Korea's Lazarus Group had compromised a safe wallet developer, stolen AWS credentials, and quietly edited the javascript behind the interface so it only fired on bybit's cold wallet. What the signers really approved handed control of the wallet to the attackers. 401,347 ETH left in a single transaction, and two minutes later the malicious code was removed.

Bybit's own systems were never breached. The hardware wallets worked. The weak point was what the humans were shown.

2. Bitget: $387.5M (Sep 2026)

Attackers got in through a flaw in third-party security products Bitget trusted, then moved sideways to the server that runs wallet withdrawals. They sent fake withdrawal commands that bypassed the risk controls, and Bitget's own system signed the transfers. Hot and warm wallets were drained. Cold storage was untouched.

The tools built to protect the exchange were the way in. Bitget says its protection fund covers the loss and suspects North Korea-linked actors.

3. Liquid Network: $319M (Sep 2026)

A flaw in how Liquid nodes cache proof verifications let a fake transaction pass as valid. The result was about 4,000 L-BTC created with zero Bitcoin behind it.

The attacker then cashed it out through a completely normal peg-out. The network paid out real BTC and its reserve fell to 197 BTC. No keys were compromised. Every system worked as designed, on counterfeit input.

The next day the attackers returned 3,400 BTC (85%) after Blockstream patched the bug. They kept 598.5 BTC (~$47M) as a self-declared bounty, and that part is still disputed.

4. Kelp DAO: $292M (Apr 2026)

116,500 rsETH, about 18% of the token's entire supply, released in one transaction.

Kelp's bridge trusted a single verifier. Attackers poisoned two of the RPC nodes that verifier relied on, then knocked out the healthy ones so everything failed over to the poisoned ones. The verifier then confirmed that 116,500 rsETH had been burned on Unichain, a chain where the total supply was about 49.

Not one line of smart contract code was broken. The bridge just believed a lie. Lazarus Group is the suspected attacker.

5. Drift: $285M (Apr 1, 2026)

The robbery took 12 minutes. The setup took six months.

DPRK-linked attackers posed as legitimate partners starting in late 2025, joined working sessions with Drift's contributors, and met them in person at conferences. Drift said the people at those meetings were not North Korean citizens. They spent over $1M on the operation.

Then they got two of five Security Council members to sign transactions that looked routine. They used Solana's durable nonces, so the signatures could sit unused for days. On April 1 they fired: admin control changed hands, 31 withdrawals followed, and ~$285M was bridged to Ethereum. A council migration had left no timelock, so nothing slowed them down.

The contracts were never exploited. The people were.

6. Cetus: $223M (May 2025)

Sui's biggest DEX. The attacker took a flash loan and pushed a tiny amount of tokens through a faulty overflow check in an open-source math library. The check let almost anything through, so the pool credited them with a gigantic amount of liquidity, and they withdrew real assets against it.

Sui validators voted to freeze $162M, which started a fight over whether a network that can freeze a wallet is really decentralized. $60M+ had already left for Ethereum. The CETUS token dropped about 40%.

7. Balancer V2: ~$128M (Nov 2025)

One of the oldest names in DeFi. A rounding mismatch in its Composable Stable Pools meant every small calculation was off by a tiny amount. The attacker chained carefully tuned batch swaps until those tiny errors added up to a broken pool price.

Nine chains drained in under 30 minutes. Other pool types and Balancer V3 were not affected. Old doesn't mean safe.

8. Nobitex: ~$90M (Jun 2025)

Iran's biggest exchange, hit by Predatory Sparrow, a pro-Israeli group that accused it of IRGC ties.

They didn't cash out. They sent the funds to addresses nobody can ever access, carrying political messages. $90M burned as a statement.

About 80% of the money on this list wasn't lost to bad code.

Bybit, Bitget, Kelp, Drift and Nobitex: a lying screen, hijacked infrastructure, forged data, signers who got played, compromised wallets. Only Liquid, Cetus and Balancer were bugs in the software itself.

Audits check the contract. Nobody audits the laptop, the RPC node or the person who answers the DM.

When you sign a transaction, do you know who controls what you see on the screen?

[Karlow @karlowalpha]

@AshCrypto crypto will become next way of payment things, we are so early!

[Karlow @karlowalpha]

@Jeremybtc just a regular manipulation, nothing more, they can send it a 100 billions if they really wanted to

[Karlow @karlowalpha]

@saylor saylor`s ai videos is something else man😂

[Karlow @karlowalpha]

@wyckoffweb so if you made money you good, if you lost, you taking them to court? LOL😂 thats not how it works

[Karlow @karlowalpha]

@cryptorover nahh i think its because cpi news, the world is not want btc to go up bro

[Karlow @karlowalpha]

@AshCrypto it`s literally less than 10% of crypto bros paying taxes, who does that bro?

[Karlow @karlowalpha]

@WhaleInsider last time celebrities listed some coins, it didn`t end well bruh..

[Karlow @karlowalpha]

@Kalshi yeahh right, i would love to see him in this situation irl