Pluto 🚢

Building @Harbor_DEX

[Pluto 🚢 @pluto_hbr]

Imagine ripping Qwen4-Unabliterated-Cyber-Offensive on the Hogwarts 5090.

[NVIDIA GeForce @NVIDIAGeForce]

We're giving away a Hogwarts Legacy custom wrapped NVIDIA GeForce RTX 5090 to celebrate its official release with DLSS 5 🪄

To enter:
🟢 Share this post
🟢 Comment #RTXON

Terms and Conditions: https://t.co/45T3R732hf

[Pluto 🚢 @pluto_hbr]

> Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine.

> The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.

"I don't always hold deployer keys to billion-dollar MPC infrastructure on my dev laptop, but when I do, I pipe curl to bash to install agentic coding tools."

[Binance @binance]

https://t.co/sU9dUqLQDH

[Erik Voorhees @ErikVoorhees]

Crypto grew up in the Dark Forest, and the entire world is about to find itself there

[Pluto 🚢 @pluto_hbr]

@nic_carter @MeganNyvold @realDonaldTrump Got my vote

[Pluto 🚢 @pluto_hbr]

@degenurai @THORSwap @Harbor_DEX No real upside to talking about our plans publicly right now. Hopefully we enter a more vocal phase of the project soon. For now, we are focusing on building a profitable protocol worthy of having a community.

[Pluto 🚢 @pluto_hbr]

6 days ago, a user placed a limit order on @THORSwap to buy $BTC at $80.4k. It just filled on @Harbor_DEX. Someone planned for and got a nice entry.

[Pluto 🚢 @pluto_hbr]

There is form of MEV happening in the AI world already, that is also prevalent in crypto: quoting high, and delivering low. It’s being talked about in both crypto and AI circles. Don’t be surprised if blockchains solve some pretty hard problems in AI re: trust https://t.co/9NRX6dLmR3

[Pluto 🚢 @pluto_hbr]

@familiarcow @CupOJoseph lmfao

[Pluto 🚢 @pluto_hbr]

@AaluxxMyth Merging this one would’ve prevent the exploit https://t.co/mkArkH8kVt

[Pluto 🚢 @pluto_hbr]

Any “click trading” platform has an API that can be reverse engineered. There is virtually no way to prevent anyone from interacting with any Defi system in an automated way. Also the airdrop is 100% being farmed. They released publicly with $1b/day volume immediately. How is that kind of distribution possible without any real ramp up?

[Pluto 🚢 @pluto_hbr]

I found this thread to be pretty interesting. Because at the time we evaluated TSS Shock and other similar disclosures, a 3rd-party cryptographer we spoke to assured us it would take 1000s of keygen attempts to pop a private key. We also determined that many failed keygen attempts would arouse suspicion. It’s almost like this thread was an attempt to legitimize their node’s “issues” (where really each failed keygen was an attempt to extract the key) or otherwise gaslight devs into thinking it was a network issue.

[Pluto 🚢 @pluto_hbr]

The latest TC release 3.18 was done as a private binary (something we had done before when patching crits). There was a long-standing practice that if a node requested, by signing a message with their validator key, devs would send them the validator-key encrypted diff of the security patch. That’s exactly what the malicious node did in this case. It’s possible even that the private release spooked them into speeding up their timeline for the attack. I find this class of attack very interesting. Networks need to be designed maximally defensive, even against their own validators. In this case, a malicious validator can still get the source code for patches and exploit them before the code goes out. I wonder if this puts an end to that practice. It all exists on a spectrum of decentralization. I actually don’t disagree with @jpthor that closed source TSS might be the move from here. Anyone who is saying that’s “the end of the experiment” is either a crypto-anarchistic maxi that lost the plot or an NK hacker astro-turfing protocols into not making sound trade-offs between security and decentralization.

[Pluto 🚢 @pluto_hbr]

In total, DKLS seems very promising, and seems to have worked out for @vultisig so far. That said, the comparative leap to move THORChain from GG20 tss-lib v1.0 to v3.0 is relatively lean. Just give keygen messages a version flag so that current vaults can continue signing using legacy keyshares, then cutover and deprecate the TC fork once a new keygen is successful. THEN move to DKLS later. IMO that's the safest path to getting TC back up and running ASAP, safely.

[Pluto 🚢 @pluto_hbr]

Ok, I'm going to go ahead and say it. Silence Labs' DKLS implementation, and Vultisig's go wrapper of it, is not ready for primetime use on @THORChain.

[Pluto 🚢 @pluto_hbr]

Second, the DKLS implementation that supports ECDSA has had a few dozen commits by 2 authors, with the last release dated July 2025. By contrast, Binance's tss-lib implementation that TC inherits from has commits date from last month, with far more contributors and commits. https://t.co/WQNnfWwCvV

[Pluto 🚢 @pluto_hbr]

It’s been brought to my attention that the NEAR mpc setup was open-sourced in late 2025. When I initially evaluated the protocol it was not. It’s still effectively a multi-sig, like Wormhole. My main point is that NEAR’s play was all about price execution at the expense of decentralization, nothing to do with risk management IMO. Pool-based designs are going away for other reasons.

[Pluto 🚢 @pluto_hbr]

@zacodil All the inventory held by MM on NEAR Intents are in a closed source multi-sig. Really poor taste to use exploits to champion your own less-secure, less-decentralized product. Also, your AI slop summary of the root cause is patently false (it’s not attention logic-related).

[Graham Ferguson @grahamfergs]

All crypto conferences should be held in Miami.

[Pluto 🚢 @pluto_hbr]

@alexfacelesslbs Alright well you’re being dramatic. Conference vibe was A5 wagyu lit my guy. Better luck next time and choose better events.