Mirco Bauer

CISO @VDXofficial and formerly CTO of Bitcoin exchange. Technologist, @Smuxi hacker, white hat. Loves opensource, hacking, C#, #Bitcoin, VR

[Mirco Bauer @meebey]

To all hackers and future hackers out there: you are the rockstar of the information age. Please keep studying computers, networks, protocols and code. The truth is waiting to be revealed. Malicious state actors of governments are the enemy of everyone.

https://t.co/mTVn9Sz0U8

[Mirco Bauer @meebey]

@kenmejorada @mono_2256 @frankrei00 @Larksuite logging into LarkSuite fails for me as well

[Mirco Bauer @meebey]

@peterktodd So amateurish to not have mitigations for basic user mistakes 🤦

[Mirco Bauer @meebey]

Initially I thought it was a clever boating accident but as went nuts after and still seems so, he probably really lost them. From working in cyber security for decades, I can say it is pretty hard to gain security but easy to lose. One tiny opsec failure and you are screwed. I still can’t digest how a skilled engineer would ever store 200+ on a network connected computer and think they are safe…

[Mirco Bauer @meebey]

@TheHackersNews I have seen this before, where was that? Oh right:

[Mirco Bauer @meebey]

And Skynet was born

[The Hacker News @TheHackersNews]

🔥 An AI worm used a local open-weight LLM to find targets, choose attack paths, and copy itself.

> No human help.
> No OpenAI or #Anthropic API.
> No API key to shut off.

In 7 days, it replicated to 62% of a 33-host test network.
It also used fresh CVE advisories to find new attack paths.

Read full story: https://t.co/NVZZjUGZXF

[Mirco Bauer @meebey]

Very accurate representation. A control got strengthened but all the ways around it remain as you can't prevent embeddeding arbitrary information into a blockchain transaction as long as 1 data fields remains.
If anyone really wants to block information, maybe you should not use a public blockchain in the first place. Just a thought.

[Mirco Bauer @meebey]

Very accurate representation. A control got strengthened but all the ways around it remain as you can't prevent embeddeding arbitrary information into a blockchain transaction as long as 1 data fields remains.
If anyone really wants to block information, maybe you should not use a public blockchain in the first place. Just a thought.

[Mirco Bauer @meebey]

@techspence Absolutely and every hacker out there:

[Mirco Bauer @meebey]

I fully agree that one single seed backup plate in a single location is a classic example of single-point-of-failure. I never understood why people feel comfortable with that.
A layer of encryption as you mentioned can be a solution but it comes with a new downside as
you are creating a new secret, the encryption key, that also need to be stored and protected.
Another simpler remediation is to use 2 seeds in 2 different locations and only a combination of both seeds gives you the actual seed through a simple (low tech, can be done by hand) process called SeedXor. More information about SeedXor see https://t.co/DLXYVfplGs

[Mirco Bauer @meebey]

@cyb3rops 1, 2, 3, 4, many, many, many

[Mirco Bauer @meebey]

@ZackKorman We have a responsible AI usage policy and guidelines. Without one how is staff supposed to know what is acceptable and what is not acceptable?

[Mirco Bauer @meebey]

My first attempt at Linux was the Linux Router Project which ran directly from a floppy disk. That was a kind of a precursor to live CDs before they got invented. Eventually I moved on to Debian to run Internet services and it also became my daily driver in 2001. I made really bad experience with my 2024 Dell XPS laptop which was unusable with Linux and I gave up after a few months to make it work well, so a MacBook with macOS became my daily driver. On my servers I am running NixOS which is more powerful than Debian.

[The Hacker News @TheHackersNews]

⚠️ A new #Linux flaw mirrors Dirty Pipe—but adds cross-container impact.

“Copy Fail” (CVE-2026-31431) lets any local user overwrite cached system files and run them as root. No race condition.

Works across major Linux distros since 2017.

🔗 Read → https://t.co/HW10RL1A0o

[Mirco Bauer @meebey]

When will people understand that data is a liability. Government should know this better by consulting experts.

First principle in strong information security must be: information frugality: less information collected means less information is at risk.

More data -> more data at risk -> more data owner victims

[Adam Back @adam3us]

looks like PQ bitcoin applied R&D can move a lot faster than quantum hardware research can... https://t.co/8xU6wLFwjt SHRIMPS 🦐 brought to you by @blockstream research @n1ckler @blksresearch @kudinov_mikhail

[Mirco Bauer @meebey]

@w_s_bitcoin You released it, lovely 👌❤️

[Mirco Bauer @meebey]

Careful: common hardware tool cpuid/cpu-z is compromised. Your computer and data may be at risk if you downloaded it recently.

[BuBBliK @k1rallik]

🚨 do you understand what just happened to your passwords

cpuid one of the most trusted sites in PC hardware.
hacked. April 10th, 2026. CPU-Z and HWMonitor. both compromised.

> fake CRYPTBASE.dll ships inside the installer
> connects to C2, downloads a C# file
> compiles it silently using YOUR own Windows tools
> injects into memory. never touches disk. AV sees nothing.
> opens Chrome's password vault. dumps everything.

the chain:
cpuid → HWMonitor installer → DLL hijack
→ supp0v3[.]com → silent .NET compile
→ in-memory injection → Chrome credentials stolen

same group. same C2 domain. hit FileZilla in March 2026.
they got lazy. that's the only reason we caught it.

[TFTC @TFTC21]

A crime ring out of Tennessee was just busted for running wrench attacks on bitcoin holders across California, San Francisco, Sunnyvale, San Jose, and Los Angeles.

They hacked into victims' DoorDash and UberEats accounts to figure out where they lived, then showed up posing as delivery drivers. Once inside, they zip-tied and duct-taped victims at gunpoint while a remote operator, using a voice modulator, directed them through draining the wallets.

In one case they stole $13 million. In another, when the victim's wallet didn't show the amount the attackers expected, the voice on the phone ordered them to cut off the victim's fingers until he revealed the "real" account.

A duress wallet won't necessarily save you. These attackers came in with specific intel about how much their targets held. If the number they see doesn't match the number they expect, the situation escalates. Physical attacks on bitcoin holders jumped 75% in 2025, with confirmed losses topping $40 million.

A few things worth thinking about if you hold any meaningful amount of bitcoin.

Don't talk about how much you hold. Not online, not at meetups, not to friends of friends. Operational security starts with not making yourself a target in the first place.

Be skeptical of unexpected deliveries. This ring used real food delivery apps to build trust before showing up at the door.

Multisig and time-locked transactions are worth looking into, not just for security against hackers, but because they make it physically impossible to hand over funds under duress. If the coins literally can't move for 48 hours, there's no point in holding someone at gunpoint.

Self-custody is a responsibility. The tradeoff for being your own bank is that you're also your own security team.

[Mirco Bauer @meebey]

To all hackers and future hackers out there: you are the rockstar of the information age. Please keep studying computers, networks, protocols and code. The truth is waiting to be revealed. Malicious state actors of governments are the enemy of everyone.

https://t.co/mTVn9Sz0U8

[Mirco Bauer @meebey]

@w_s_bitcoin Is your code on GitHub or so that you use to analyze transactions for quantum exposure?