kodachi ⚔️ 侍

web3 sec 🍿

[GrapheneOS @GrapheneOS]

@Huskock144 @CryptoCyberia It's nonsense to claim our niche duress PIN/password is the only functioning feature. It's not a major feature of the OS and isn't at all required to protect data from extraction. GrapheneOS strongly protects the device from exploits and auto-reboots to Before First Unlock state.

[🐔Actual Advice Bitcoin @ActualAdviceBTC]

i literally dont care what any of these shitcoins try to do. Every coin is scam trash except bitcoin and monero. As far as im concerned ICOs are supposed to be black boxes where u put degens in and money comes out.

[GrapheneOS @GrapheneOS]

@FringeViews GrapheneOS phones are far more secure computers than any traditional laptop or desktop.

Dumb phones force using non-private carrier-based calls/texts and are entirely dependent on cellular connections. Dumb phones also nearly always lack basic security updates and protections.

[Hari @hrkrshnn]

This is absolutely false.

There is public evidence of AI being used in hacking ops, often by script kiddies. I'll post the links in the replies.

If you talk to people responsible for defending real infra, they are seeing increased AI use by hacking groups. These are mostly private-company incidents and they don't really talk about it in public.

All of this feels similar to coding in January: everyone suddenly realized the models were great at coding even though the capability had been there earlier, and the power users have been seeing it much earlier.

Cyber will go through something similar, the insiders know the game has changed on both offense and defense. It'll be obvious to the general public in some time.

[Blockstream @Blockstream]

Adam Back on Bitcoin: more like a discovery than an invention. People had the rough idea of how a decentralized electronic cash could work but didn't manage to make it work. Satoshi figured out the rest.

- Blockstream CEO @adam3us on Fox Business with @LizClaman.

[David Hoffman @TrustlessState]

I want to share a quick story from a friend, who recently had ~$450k almost phished from a wallet

Thanks to @SEAL_911 - it was all completely recovered and returned. A happy ending that deserves highlighting!

I knew SEAL 911 existed, but this was the first time I've saw them in action.

Here's the story:

A friend got phished from a fake Ledger Live app (on the Apple App Store 2 weeks?!). His ETH was staked on Figment, and the phisher executed the withdrawal transaction, and the ETH entered the withdrawal queue.

He reached out to the Seal 911 group and within 15 min, he was on a discord call with the White Hat Recovery team.

You could imagine how shitty my friend felt, assuming that the $450k of ETH was simply going to be withdrawn and immediately captured by the attacker.

They made him feel at ease, shared case studies of similar rescues and said they charge 5% (totally agreeable amount imo) of whatever funds they recovered.

The tension was all down to the single block that the ETH became available for withdrawal after the exit-queue finished. $450k riding on a 12 second window.

My poor friend had to wait 4 days while this all hung in the balance lol.

The day finally came. Seal 911 has set up a script with Flashbots to engage in the bidding war required to access the funds. At 11pm that night, he received the long-awaited message:

“got it all, best possible outcome.”

Within 10 min, the funds were distributed to his new ETH wallet and the job was done.

Kudos to the Seal 911 team, really amazing group of professionals.

[Vladimir S. | Officer's Notes @officer_secret]

$585K Drained Across 4 Victims in 11 Hours!

One of victims lost 3 WBTC (~$221K) after signing a phishing increaseApproval signature - moments after withdrawing from Aave. Victim: 0x5d908c88bE270889C0953E7dfF1C8E1D699cEeA3

All four victims were hit by the same drainer contract. In order to stay protected from such attacks, you should use tools like @RevokeCash cash, @TenderlyApp , @web3_antivirus , @delegatedotxyz, and of course @Rabby_io

Stay safe!

[Zach Rynes | CLG @ChainLinkGod]

Look guys, it's actually really straightforward, a bunch of people staked their ETH on the Ethereum blockchain to earn yield, except they didn't want their capital to be locked up, so they actually staked with a liquid staking protocol called Lido who provided them a liquid staking receipt token called stETH, except they decided to juice their yield further by depositing their stETH receipt tokens into a restaking protocol called Eigenlayer, except they didn't want to lock up their capital, so they actually restaked with a liquid restaking protocol called KelpDAO who provided them with a liquid restaking receipt token called rsETH, except they decided to juice their yield further by depositing their rsETH tokens into a lending protocol called Aave so that they could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero that was hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry

[QuillAudits 🥷 @QuillAudits_AI]

$2B+ gone.

That's the combined loss from Bybit, Drift, WazirX, Radiant, and Resolv.

Code bugs in any of them? Zero.

Spend 5 minutes reading this. Then ask your team the 7 questions inside.

If you can't answer them, you already have your first finding.

Full breakdown + 7-question checklist in detail 👇

[PeckShieldAlert @PeckShieldAlert]

Today's @KelpDAO exploiter deposited the stolen $rsETH into various lending protocols (AaveV3, CompoundV3, Euler) and and borrowed massive $WETHs w/ >$236m debt.

[easyDNS @easyDNS]

Not our proudest moment, but...
That @eth_limo nameserver hijack was on us...
https://t.co/8JSePCRRyW

[Immunefi @immunefi]

The truth: you can never be sure you're truly safe in crypto.

The only way to survive is to make a constant investment into security.

There is no magic bullet.

[Sweep @0xSweep]

Two guys ran an entire hacking operation in a PRISON for months

In 2015, two prisoners in Ohio were assigned to a recycling program where they dismantled old computers

Instead of scrapping the parts, they started stealing them

Carried components over 1,100 feet past guards, metal detectors, and multiple security checkpoints

Then built two working PCs and hid them behind a plywood board in the ceiling of a training room closet

They ran cables from the ceiling into the prison's own network

Stole login credentials from an employee by watching him type his password

Set up Bitcoin wallets, Stripe accounts, bank accounts and credit card applications using another inmate's stolen identity

Downloaded VPNs, the Tor browser, password cracking tools and what investigators called "a large hacker's toolkit"

Created fake security passes to access restricted areas of the prison

This entire operation ran for months

They only got caught because one of the computers used so much bandwidth it triggered an automatic alert

The Inspector General said it was "almost as if it's an episode of Hogan's Heroes"

Two guys with recycled computer parts and a ceiling tile built a cybercrime operation inside a state prison

[CD Security @CDSecurity_io]

In Web3 you need layers of protection:

- Security-first devs writing safe code
- Internal audits before external
- Multiple external audits (core + major updates)
- Continuous monitoring
- Bug bounty as your final safety net

Project survival depends on this.

[Anthropic @AnthropicAI]

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.

It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7

[CD Security @CDSecurity_io]

🚨Attackers pretend to be VCs, podcasts, clients, researchers, even contributors.

They only need you to open one file or click a link.

Use a virtual machine for anything from unknown contacts.

Don’t risk your main system.

Stay safe 🙏

[kodachi ⚔️ 侍 @kodachi_eth]

@katanaperps ✌️ Trading tip for beginners: Anyone hoping for a 50% profit in a short time is taking risks that will ruin their account in the long run. The focus should be on consistency.

[kodachi ⚔️ 侍 @kodachi_eth]

Bitcoin

[Merkl @merkl_xyz]

We’re exploring new chains for 2026.

Which non-EVM ecosystem would you like to see Merkl rewards on? 👀

[chrisdior @chrisdior777]

You can beat most auditors at finding bugs if you just don't quit when it gets hard and boring.

That's where everyone else stops.