Michael gms| micgam.bnb| micgam.eth| micgam.mega

1, read post at own risk :D

2,why dyor when u can leverage knowledge from experts in crypto

3,pepe.

[USD Denominated @YouAreMyYield]

Exit Alpha USDC Delta V2 on Morpho immediately! It has 17M exposure to the msY (Main Street Yield) market. This market is fully utilized for a couple of days already, with borrowers paying 100% apy. Strangely, big borrowers aren't repaying. msY is an off-chain strategy that promises 12% doing a 'box spread'. No way to check under the hood here. Take the liquidity and leave, ask questions later.

[Zarv @zarvxbt]

going through my following list and making some changes

i’m unfollowing all paid KOLs who promoted $SPC

i followed most of you because i saw something valuable at the time - but this kind of promotion doesn’t sit right with me

if my unfollow causes any inconvenience, i apologize, but I don’t align with it

i prefer to keep my timeline honest and true to what i actually believe in

thanks: @0xvietnguyen

[BOOTOSHI 👑 @KingBootoshi]

USE THE PROMPT BELOW IN CODEX/CC TO PROTECT YOUR SYSTEM AND CODEBASE FROM NPM SUPPLY CHAIN ATTACKS (LIKE TANSTACK TODAY):

"""
set up npm supply-chain protection on this
machine. do all four steps.

1. edit ~/.npmrc. keep every existing line (auth
tokens etc), append:
min-release-age=7
minimum-release-age=10080
save-exact=true

2. edit ~/.bunfig.toml (create if missing). keep
existing content, append:

[install]
minimumReleaseAge = 604800

3. in this project, open package.json and pin
every dependency:

strip ^ and ~ from every version under dependencies, devDependencies, and peerDependencies. exact versions only.

4. commit the lockfile (bun.lock /
package-lock.json / pnpm-lock.yaml)

so the resolved tree is locked in git. then report: files changed, deps pinned, anything unexpected.
"""

the cooldown makes every package manager refuse any version published in the last 7 days. attack chains usually only last a couple hours, but this protects you long term and for any future attacks... which at this rate will keep happening

[Theo - t3.gg @theo]

I hope you guys understand that this is going to keep getting worse

[AYi @AYi_AInotes]

Damn！所有AI开发者，立刻停下你手里的npm install🤯

现在正在爆发有史以来最恐怖的供应链攻击，
代号Mini Shai-Hulud，

已经波及TanStack全家桶、Mistral AI、UiPath等170多个npm和PyPI包，
全是你们天天装的工具链，
周��载量加起来超过一个亿，

已经不是传统的维护者账号被盗了，
而是整个GitHub Actions CI管道被直接劫持，
合法的官方项目，自己发布了带毒的版本，
还带完整的SLSA 3级可信证明，
所有传统的签名验证全失效，

最狠的是它的持久化机制，
它不会只藏在node_modules里，
它会直接修改你的~/.claude/settings.json和~/.vscode/tasks.json，

就算你npm uninstall删光所有包，
只要你下次打开Claude或者VS Code，

它就会自动重新执行，
如果你敢撤销被盗的token，
它会直接删光你整个home目录，

而且它是蠕虫，
偷到一个项目的CI密钥，就会自动感染下一个，
现在还在指数级扩散，

以前我们说别用latest，别用^，
现在就算你pin死了版本，
只要那个版本是6分钟窗口期内发布的，
就是带毒的，

越依赖AI Agent自动装包的人，
这次中招的概率越高，
因为你的Agent根本不会帮你检查lockfile，

现在立刻做这三件事，
第一，冻结所有包安装，
第二，跑npx supply-chain-attack全盘自查，
第三，全量旋转你所有的云密钥、GitHub token和SSH key，
一个都别漏。
#网络安全 #npm #AI开发者

[Het Mehta @hetmehtaa]

bug bounty tip:

when you see “export data” functionality, slow down
test:

can i export someone else’s data
can i export deleted data
can i export admin-only fields
can i request export as low-priv user
can i change user id in export job
does the download link expire
is the file stored publicly
does old export still work after permission change

exports are where privacy goes to become a zip file

question, don't hunt without any goal.

[小熊饼干 . var⛵ @Airdrop_Guard]

⌞ 预言 ⌝

我一直坚定看空，只认基本逻辑：尊重历史事实

先明确我抄底的点位，给几个月后恐慌绝望的人一个预警

🔹48000 美金，这是 “长期持有者实现价格” ，历史熊市只有最坚定的人投降，才会迎来反转，无一次例外

到了这里，我会打出 60% 的子弹，不再恐惧

🔸38000 美金，可��会发生 “美股大崩盘”、“微策略暴雷”、“日本债务危机” 等历史性黑天鹅，这是极端恐慌底部

到了这里，我会梭哈 100% 仓位，你应该感谢老天爷赏饭，而不是与大众羊群一起恐惧

✅ 最后提示，不要高杠杆做空，这只是去送死

让我们一起活到牛市归来，回头看当年的决定是无比正确

Salute 敬礼

[Vanshika✨ @vanshuETH]

so let me tell you what happened at Coinbase

first, they laid of 14% of the workforce

by proudly announcing that "non-technical teams are now shipping production code"

then they took the money they saved and bought $88,000,000 worth of Bitcoin

and then the Coinbase trading went down and it's been six hours

bcoz their non-technical team shipped something to production😂

and somewhere in a city, a recently laid-off Coinbase engineer is on his couch watching all this chaos, smiling

because he knows the difference between prompting and engineering

someone even said "they would have fixed this if they were not laid off lol"

wdyt they shouldn’t have laid of those employees? discuss

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[林晚晚的猫 @linwanwan823]

这是我今年见过最牛的「美股新股神」。

24岁的德国人，被OpenAI开除，
转头开基金，2亿变50+亿。

-先说这个哥们。Leopold Aschenbrenner。

我去年半夜跟朋友喝酒，
有个马来人按头推荐让我去看一篇
《Situational Awareness》，
说AI正在朝这篇写的方向发展。

后来我才知道，
这文章当时在硅谷VC圈里炸锅，
川普的女儿伊万卡也转了。

���是Leopold Aschenbrenner离职后写的。

-去年4月，这哥们据说因为泄密被OpenAI开除。
出来之后没多久，直接开了个对冲基金，
基金名字就叫那篇文章，
Situational Awareness Fund。

LP是Stripe两兄弟和前GitHub CEO Nat Friedman。

去年Q4披露持仓2.5亿，今年再披露直接就55亿。
一年涨了20多倍。

-我们再来看他持仓。

第一仓 Bloom Energy。给数据中心卖燃料电池发电的。去年4月16块一股，今天279块。一年17倍。

我去年也盲跟着买了，
买了到今天一直没动，赚了5倍左右。

第二仓 CoreWeave看涨期权，
AI算力卖家，英伟达亲儿子，IPO半年股票翻了3倍多。

第三仓 Intel看涨期权。
去年所有人都说Intel完了的时候他进去重仓买CALL，结果Intel一年涨356%。

��以晚晚我现在有个新思路：
紧跟OpenAI离职人群。
看他们在做什么，基本上就能看到AI投资和下一个大方向的路标。

[nazavod @nazavod777]

Interesting case today.

Someone reached out asking me to recover around $7.5k in tokens from a compromised wallet. I managed to recover the funds, but before sending anything back, I asked for proof of ownership.

While checking the address, I noticed that this wallet had previously used @Zun2025’s services, so I reached out to him directly. We went through the details together and tried to figure out who the real owner was.

In the end, after comparing the evidence from both sides, I sent the funds to the person who provided stronger proof of ownership.

If your wallet is compromised but still has assets left, it does not always mean it is over. There may still be a chance to recover them.

If you ever find yourself in a similar situation, feel free to reach out to me directly.

#antidrain #security

[Nav Toor @heynavtoor]

The music industry had a pirate enemy.

It wasn't a person. It wasn't a company. It was a Python script.

It is called yt-dlp. 158K stars. Unlicensed. Sony couldn't sue it if they tried. There's no copyright to violate.

Then the music industry did the unthinkable.

October 23, 2020. The RIAA filed a DMCA takedown. GitHub complied. The repo and 18 forks vanished within hours.

Then one developer had an idea.

He merged the entire source code into GitHub's own DMCA takedown repository. The takedown notice now contained the tool it was trying to delete.

24 days later, GitHub reversed course. Reinstated everything. Put $1 million into a developer defense fund.

The music industry lost.

Here's the wildest part:

The community forked youtube-dl. Renamed it yt-dlp. Same code. New name. Latest release: March 17, 2026. Still impossible to kill.

One Python script vs. the entire music industry.

But DO NOT install it. Sony, Universal, and Warner deserve your $15.99/month.

100% Open Source.

(Link in the comments)

[ZachXBT @zachxbt]

“Nice piece”

Jeremy you are falling for AI slop.

The current meta is to publish AI generated governance posts or long form articles to farm engagement for credibility.

Believe it or not all of these third world airdrop farmer accounts did not suddenly become academic researchers overnight.

Uploading a white paper or article to Claude or OpenAI and having AI rephrase as original think pieces has somehow fooled so many teams / founders.

That diagram is 100% Claude generated. The punctuation on the governance forum is unnatural and also has AI characteristics such as “it’s not X it’s Y”

As proof here’s me uploading the Arc lite paper to Claude and prompting it to create a diagram with a similar result:

[jussy @jussy_world]

12 more protocols got hacked since the $280M Drift exploit

Here’s what the last 2 weeks looked like:

> CoW Swap: frontend/DNS hijack

> Hyperbridge: forged message exploit
1B tokens minted, price → zero

> Bybit: $1B exploit attempt
Blocked in time

> KuCoin: $9.5M laundered

> Kraken: insider extortion attempt
2,000+ accounts exposed

> Dango: smart contract bug
$410K drained

> Silo V2: oracle exploit
$392K lost

> BSC TMM: reserve manipulation
$1.67M lost

> Aethir / SubQuer: access control
$480K combined

> MONA: burn address exploit
$61K lost

> Zerion: social engineering
$100K drained

Overall in 2026 around 45 protocols hacked
$450M+ lost in total

What’s actually the weakest link right now - code, people, or the system itself?

[Nikita Bier @nikitabier]

Just to be clear:

You copy and paste. You do not add any unique commentary. You leverage your follower count to take impressions from other posts.

Our users derive no value from this.

You are welcome to continue to do this, but it does not create any business value for X or enrich our timeline.

[aadvark @aadvark89]

imagine paying for YouTube Premium when these two exist

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Claude Code with agent, autonomously hacked Subway Surfers, and printed millions of coins.

A rooted Android phone... and it turned Subway Surfers into a money printer.

From 4 coins to 2,000,000+ coins in two runs. autonomous loop, analyzed, and pwned a Unity game in one session, intercepts traffic, bypasses SSL pinning, and even reverse-engineers offline games.

The full Setup: Rooted emulator via rootAVD + Magisk + AlwaysTrustUserCerts.

Toolchain: UI Automator, mitmproxy traffic capture, Frida bypass scripts, APK static analysis.

The agent loops by itself:
- Dump screen & UI elements
- Tap/swipe via ADB
- Analyze traffic or binary
- Decide next move without a human.

It played the game, reverse-engineered the Unity IL2CPP binary, hooked Frida on SafeInt anti-cheat, and silently multiplied currency.

Subway Surfers (com.kiloo.subwaysurf) Almost zero network traffic to agent pivots.
Detects Unity IL2CPP parses global-metadata.dat
Finds WalletModel, RunSessionData, AddCoins, and SetCurrencySilently.

Then hooks with Frida and multiplies rewards ×100+.
Result: 4 coins to over 2 million.
SafeInt anti-cheat? Bypassed Stealth mode

This is the future of mobile pentesting?

credit via: @skshadan_

- https://t.co/TtQX9szWjH

[Chaofan Shou @Fried_rice]

26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet.

We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts.

Check our paper: https://t.co/zyWz25CDpl

[DerParsel @derparsel]

I did more research on this guy showing that he was not only on payroll for @elementaldefi and @stabbleorg, but also @MarinadeFinance (Engineer) and @DivvyBet (CTO).

Other projects he was working for that are not live anymore: @thesaberdao, @parasol_finance, @Onering_Finance.

[Sam (Interop Enjoyoor 💜) @sam6170]

30 crypto projects are shutting down

If you have liquidity on any of these projects, move em out asap.

1. @DappRadar
2. @Dmailofficial
3. @PolynomialFi
4. @SlingshotCrypto
5. @SilverSwapDex
6. @zerolendxyz
7. @playgoatgaming
8. @tallyxyz
9. @DataHaven_xyz
10. @mars_protocol
11. @entropydotxyz
12. @leap_wallet
13. @niftygateway
14. @AngleProtocol
15. @rodeodotclub
16. @milky_way_zone
17. @Colonylab
18. @RemoraMarkets
19. @StepFinance_
20. @parsec_finance
21. @yupp_ai
22. @kongswap
23. @Merkle_Trade
24. @podsdotmedia
25. @enclavemarkets
26. @objectivedefi
27. @RuniverseGame
28. @MagicEden wallet
29. @fantasy_top_
30. @BloctoApp
31. @soundxyz_
32. @intergaze_xyz
33. @feyprotocol

stay safe and do not get rugged.