ً

[StarPlatinum @StarPlatinum_]

Papertrade is slowly rugging its own users🚨

The situation with $PAPER is getting ridiculous

For those unfamiliar, Papertrade launched on HyperEVM just 10 days ago, allowing users to trade with 1,000x leverage

every time you lost money or got liquidated, you received $PAPER

You could then stake those tokens to earn USDC from the protocol’s revenue

Well, in its first few days, Papertrade generated $1T in trading volume, with traders losing $54M and $45M distributed in staking rewards

Some people were even deliberately losing money to farm PAPER

One wallet lost $979K to mint 252M PAPER and received $1.87M in staking rewards within days

But yesterday, the team announced some pretty significant changes

First, $PAPER won’t be transferable anytime soon

Actually, the team said they have no plans to enable transfers outside the protocol at this stage

(Remember that users were farming this token expecting it to eventually become tradable)

Paragon, which had paid around $45K to secure the PAPER ticker on Hyperliquid’s HIP-3 infrastructure, immediately shut down its market

Aster did the same

The team is also changing PAPER’s emission model

Previously, the initial rate was 100 PAPER for every $1 lost

Under the new system, each $1M in eligible losses will mint approximately 0.1% of the existing supply

Meaning that as supply grows, more PAPER gets created for the same amount of losses

(existing holders get diluted)

The team literally acknowledged this in its announcement

So imagine being one of the earliest users, losing money to farm PAPER, and suddenly discovering that:

- You can’t transfer or sell your tokens
- The pre-market where people were trading them has disappeared
- Your share of future staking rewards will gradually be diluted
- The protocol is changing its fee structure too

Now, to be fair, the team has an explanation

They argue that allowing people to short PAPER externally could make attacks against the protocol’s liquidity pool profitable

But here’s my problem

If making PAPER transferable creates such a serious threat to the protocol, why wasn’t that risk properly addressed before people started farming it?

And why should early participants accept dilution after taking the biggest risks?

Especially when those people have no way to exit their positions

[Vivi 👑 The Options Queen @theoptionsqueen]

$HOOD Very expensive lesson. Lost $8k today trading with robinhood app that was delayed and glitching. Then I just tried to sell my calls that are green for tomorrow and they just told me that extended hours trading is not available tonight so if market dumps tomorrow there will be a lot more losses. I should have changed brokers a long time ago. I am so upset 😭

[Goran Ristov @GoranRistov11]

@theweb3alert @grok does QNT coin automatically capture value when it's company make deals?

[Tulip King 🌷 @tulipking]

Just to reaffirm how terrible Aave Labs is and how uninvestable AAVE token is despite how much their team wants to psyop you into believing they care, they’re still on a multi year plan to slow rug the DAO and treasury

1. Aave Labs rugs front end revenue from the DAO. Huge controversy. DAO rigs votes & governance process in their favor. Eventually they propose and pass “Aave Will Win” which says they’ll direct all revenue to the DAO (wait until you see #2 lmao). But the Labs also votes themselves $25mil for operations and an additional $17.5mil for hitting objectives like $5mil for launching and app (what’s the point of the $25mil?)

2. Soon after they get rekt on the rsETH bridge exploit and pause buybacks (more good news fork token holders 🙃). Buybacks have not resumed btw

3. Of course in the meantime they’re in no rush to resume buybacks but they are in a rush to get the app launched so the Labs can cash in their $5mil performance bonus for shipping an App…

4. And now they’re setting up another Cayman Islands entity 🤦🏼‍♂️ because this time it’s really gonna align incentives ! By the way the DAO is being asked to foot the bill for this again. **wtf was the point of funding Labs with $25mil if the DAO is still funding everything after that?

There’s many sub $10mil memecoins with more holder alignment and holder revenue than AAVE

[Cointelegraph @Cointelegraph]

🚨 NOW: Sam Altman’s World brings World ID to Zoom and major financial firms to fight bots, fraud, and deepfakes.

[BSCN @BSCNews]

Arc Chain's ecosystem is still INSANELY small.

According to CoinGecko, there are only 6 tokens on @Arc's new mainnet that have a market cap of more than $1M.

At the very top of that list is @Arguspad $ARGUS, with around $7M.

Compared to @RobinhoodCrypto Chain, Arc's ecosystem is looking very small indeed.

[Zoe @zoecyber001]

Everyone swears their phone is secretly recording their voice.

You talk about buying hiking boots, and twenty minutes later Instagram serves you an ad for boots, even though your microphone permissions are turned completely off.

Most of the time, ad networks don't need audio anyway. They track you through shared IP addresses, location history, and cross-site browsing graphs.

At the physical hardware layer, the interesting question is whether your phone actually can listen with zero microphone permissions.

Turns out you don't need a microphone when your motion sensor is literally a mechanical ear etched into silicon.

1. The microscopic machine inside your phone
Inside your phone are MEMS (Micro-Electro-Mechanical Systems) accelerometers and gyroscopes.
These aren't just solid-state chips. They are tiny physical machines etched directly out of silicon.
An accelerometer has a microscopic silicon weight (a proof mass) suspended on silicon springs between electrical comb plates spaced barely 1.2 micrometers apart.
When your phone moves, that weight shifts and changes electrical capacitance. It is sensitive enough to measure sub-nanometer deflections.

2. The acoustic impedance catch (air vs solid)
Here is where the Hollywood spy movie stuff breaks down:
When you talk across an open room, airborne sound waves hit your phone's glass and aluminum frame and bounce right off. Air is thin, and your phone chassis is dense metal and glass. Because of that massive acoustic impedance mismatch, over 99% of airborne sound energy simply reflects away.
For a motion sensor to pick up speech, vibrations almost always have to travel through a solid medium:
- The phone's own speakers: The built-in earpiece and loudspeaker bolt directly to the chassis. During a call, the speaker physically vibrates the entire circuit board from the inside.
- A shared rigid surface: If your phone sits on the same wooden desk as a loud external speaker, sound conducts straight through the tabletop into the frame.

3. What researchers actually proved (Gyrophone & EarSpy)
Academic papers proved this side-channel is real, but with heavy asterisks:
- Stanford's Gyrophone (2014): Researchers showed smartphone gyroscopes can pick up acoustic vibrations between 80 Hz and 250 Hz (the pitch of human voices). But they didn't record someone talking across the room. They blasted audio at 75 dB from a speaker sitting on the same desk, testing a tiny 11-word vocabulary (just digits 0 to 9 and "oh"). Word recognition hit 65% for a single trained speaker, but dropped down to 26% across multiple speakers.
- EarSpy (2022): Tested accelerometer readings vibrating from the phone's ear speaker during active phone calls. Because modern ear speakers are louder and sit right beside the motion sensor, they could identify the caller's gender with 98% accuracy and guess spoken digits around 56% of the time.
Neither attack could transcribe an unconstrained conversation about buying shoes.

4. The quiet Android rate limit
Google saw this coming and quietly patched it in Android 12 by capping motion sensor polling to 200 Hz for third-party apps, requiring a special permission (HIGH_SAMPLING_RATE_SENSORS) to poll any faster.
By the Nyquist sampling theorem, a 200 Hz sampling rate cleanly captures frequencies up to 100 Hz. Adult male speech fundamentals start around 85 Hz, while female speech starts around 165 Hz, so a 200 Hz cap chops off the useful parts of speech.
The catch? HIGH_SAMPLING_RATE_SENSORS is a normal install-time permission. Android grants it automatically upon install with zero pop-up warnings. Plus, 200 Hz still aliases higher frequencies back into lower readings, and researchers already showed you can fuse offset readings from the accelerometer and gyroscope to effectively double the sampling rate without the permission.

5. Why your shopping app isn't doing this today
In the real world, physics makes this a nightmare for ad trackers.
The moment you walk, type, tap the screen, or shift the phone in your pocket, that silicon weight moves thousands of times harder than acoustic vibrations ever could. Your physical movement creates a massive noise floor that completely drowns out speech.
Ad companies don't need to burn battery processing raw vibration math when your location history, Bluetooth beacons, and credit card receipts already tell them what you want to buy. (we ain't that special mate)

[Heidi @blockchainchick]

IN JULY, ONE BUG IN ONE COMPANY'S FIRMWARE EMPTIED THOUSANDS OF BITCOIN WALLETS. MOST PEOPLE USING THAT SAME DEVICE INSIDE A MULTISIG LOST NOTHING.

That's the whole case for multisig. One seed phrase, one device and one company's code is a single point of failure. Multisig takes it away.

Here's how it works, and how to set one up without getting it wrong.

What it is

A normal wallet has one key, and whoever has it can spend. A 2-of-3 multisig has three keys, and it takes any two to move a single sat. A thief with one key gets nothing. Lose one key and you can still get in with the other two. The rule is built into the Bitcoin address itself, so nobody can override it.

What you need

Three hardware wallets, ideally from three different makers, so one company's bug can only ever touch one of your keys. A metal backup for each seed phrase. And free software to tie them together. Sparrow is a popular choice on Bitcoin.

Setting it up

1. Set up each hardware wallet on its own, with a brand new seed. Never type a seed phrase into a computer or a phone.
2. In Sparrow, create a new wallet, choose multi signature and set it to 2 of 3. Add each device as one of the keys.
3. Sparrow gives you a wallet file. Save it and print it. More on why below.
4. Send in a small amount. Then send it back out, signing with two of the devices. If that works, the setup works.
5. Now the step almost everyone skips. Delete the wallet from Sparrow and rebuild it from the wallet file. Check the first receive address matches. Only then move your real savings.

The wallet file

This is the part that catches people out. To rebuild a multisig you need two of the seeds and the wallet file. Lose the file and you'll need all three keys to put it back together, which defeats the point.

The file can't spend anything, so keep a copy with each key. But it shows every address and your full balance, so treat it as private. Don't email it, don't upload it.

Where to keep the keys

Three places, one key in each. For example, one at home, one with family or at the office, and one in a safe deposit box. Each place gets the device, its seed backup and a copy of the wallet file. Someone who gets into any one place gets one key, and one key isn't enough.

The mistakes that cost people

2-of-2. It sounds safer, but lose either key and the coins are gone for good.
All three devices from the same maker.
Two keys in the same house. One fire or one break-in takes both.
Letting a company hold enough keys to sign. If a company holds one, it should only ever be one.
Never testing a recovery until the day you actually need it.

What it costs

The software is free. The real cost is three hardware wallets and three metal backups. Each spend costs a little more in fees than a normal wallet, because the transaction carries more signatures.

Your family

If something happened to you tomorrow, could your family get in? Write them a short letter. Say it's a 2-of-3 multisig, where each key is, which software to use and who they can ask for help. Never put a seed phrase in that letter.

When you need it

It isn't a dollar amount. Ask yourself one question. Would losing this change your life?

If the answer is yes, one key is carrying too much.

Hold your keys. Plural.

[Rakesh Patidar @RakeshP38298981]

अगर आपका Bank Account आपके smart phone से लिंक है,

तो यह जानकारी आप सभी को होना चाहिए,

परसों मेट्रो स्टेशन की भीड़ में मेरा ₹60,000 का फोन चोरी हो गया,

मुझे लगा Face ID और मजबूत PIN Lock की वजह से मेरा Bank Account पूरी तरह सेफ है,

सिर्फ फोन reset करके ही मार्केट में बेच पाएगा,

लेकिन ठीक 45 मिनट बाद जब मैंने लैपटॉप पर अपनी Net Banking चेक की,

तो मे हैरान हो गया किसी ने बिना screen lock खोले और बिना किसी OTP के मेरे acount से ₹57,000 साफ कर दिए थे,

मे सोच मे पड़ गया जो फोन पूरी तरह lock था,

उसके Apps का पासवर्ड सिर्फ मुझे पता था,

तो मेरे साथ यह froud कैसे हुआ ?
शाम को Cyber expert ने जो नया Scam समझाया,

उसने मेरी सोच बदल दी hacker ने आपके स्मार्टफोन को हाथ भी नहीं लगाया था,

उन्होंने एक ऐसी Setting का फायदा उठाया जो आपके फोन में बंद हे,

अपना Bank Account खाली होने से बचाना है तो तुरंत अपने फोन में यह सीक्रेट Setting चालू कर लो.. 2/1👇

थ्रेड

[Jason Hanson - Spy Briefing @SpyBriefing]

Criminals Know Exactly When to Raid Your House

[merp @0xMerp]

ostium to zero

what a joke

luckily didnt deposit much but i feel for the people that did

be wary of tradfi grifters that have no clue what theyre doing

[HalesFall 🪽 @HalesFall]

Tangem appeals to the lowest common denominator in crypto, that's why it's filled with bagholders from $XRP $KAS and affiliates paid peanuts to shill.

I will make it simple for people to understand today.

In December 2024, @Tangem had a critical vulnerability where its mobile app wrote users' PRIVATE KEYS into logs that got attached to support emails. They deleted early warning posts on Reddit.

Inb4 "muh seedless, muh safe", yes, your keys never touch the app. Your TRANSACTIONS touch it every single time. The attack vector is the APP ITSELF and the OS it runs on. Read on.

Tangem's Nirvana Fallacy is: seatbelts have occasionally failed, therefore remove seatbelts.

Ledger/Trezor clear-signing bug: worst case, the screen lies about transaction parameters.

Tangem's design: the (phone) screen can lie about transactions as the permanent baseline.

>"Hardware Implant"

Physical implants predate Bitcoin. They are device agnostic. The phone on which Tangem's app runs could have an implant too, what then?

"Tangem Genuine Check" was exploited by Ledger already. Counterfeit Tangem Cards are not just theoretical:

https://t.co/aE5cH5doHp

>"Clear Signing Bugs"

Clear-signing bugs are a failure of a layer Tangem doesn't have at all. Tangem signs whatever payload the app hands it, every time, by design.

Car airbags have defects, even from Toyota, the most reliable car manufacturer that exists. Tangem's solution is to remove airbags altogether.

Both Ledger and Trezor vulnerabilities are routinely patched.

You can never patch your laser vector:

https://t.co/V3irWh1iad

Or tearing vector:

https://t.co/cHTCtG8XT4

...because there's no update channel for users.

Your security page still advertises resistance to "fault injection attempts". Donjon's laser attack IS fault injection. It works and it's unpatchable by you.

[Eureka Moment]

@Ledger and @Trezor clear signing bugs were discoverable BECAUSE the trusted display can be audited against what it signs.

In Tangem's model, there's nothing to audit. Read that back slowly because it's easy to miss. It's evidence the architecture is testable.

Ledger/Trezor is like bank that publishes audited accounts. It will occasionally have an auditor find an error:

1. Construct a transaction.
2. Record what the device displays.
3. Record what the device actually signs (the signature reveals exactly what was signed).
4. Compare the two.

Tangem is a bank that keeps no books. Therefore it will never have an accounting error found:

1. Construct a transaction.
2. Record what the app displays.
3. Record what the card signs.
4. They differ: the app showed one address, the card signed another.

In Tangem's case, there's no vulnerability because Tangem never promised those two things should match. The card signs whatever payload the app hands it. The system is working exactly as designed. It's the default behavior for a compromised OS.

>"And more hardware components can introduce more attack vectors."

So your solution to a purpose-built trusted display driven by minimal firmware (Ledger/Trezor) is a whole ass smartphone, running a full OS, with millions of lines of code and attack vectors.

Genius.

>"muh security hardened app"

You never replied to my original post here because you can't:

https://t.co/26LH9FTKUb

Tangem was also audited by Riscure in 2023, yet you still got smoked by Ledger later:

https://t.co/M5J2pk6Bq8

Not even Apple or Google can defend an app from a kernel-level exploit on their own OS, that's why Ledger/Trezor don't try. They verify OUTSIDE the blast radius. Your "hardened app" lives inside it.

[Latest Exploits]

See the videos attached, there's tons more I haven't included. You have neither the money, resources, or expertise to defend from OS exploits. How many of your users are even using Pixel 8 series and later, or iPhone 17 series and later? That matters greatly too.

Your "app" layer is dead-on-arrival. Ledger & Trezor provide mitigation where you cannot.

Tangem is more akin to a software wallet because it implicitly trusts a compromised OS. The secure element is theatre since the card will sign anything passed to it.

[Alexander Lorenzo @alexelorenzo]

Elon Musk just quietly put a buy button on Bitcoin posts.

Go to https://t.co/fKJ0P360f7 or tap the link in my bio to learn how to research a coin before you ever hit that button.

X added a Trade button to cashtags. A cashtag is like a hashtag, but with a dollar sign, like $BTC. You tap it, X shows you the chart and the conversation, then you hit Trade and pick a partner.

The partners are Interactive Brokers, Moomoo, Gemini, Kraken and Coinbase. You finish the order on their app or website, so X never holds your money.

Interactive Brokers announced it on September 15th, and Kraken followed the next day. Kraken says it supports nearly 2,500 assets across its exchange and its decentralized trading. And Interactive Brokers is offering $100 to eligible new clients who open and fund a qualifying account.

It’s only for users in the United States right now.

And the Clarity Act stalled in the Senate on September 15th, 49 to 50, but these companies are building anyway.

For years, the crypto conversation and the actual purchase lived in two different apps. Now they’re in the same place.

Follow for the next one.

[Watcher.Guru @WatcherGuru]

JUST IN: 🇹🇷 Interpol arrests HEX & PulseChain crypto founder Richard Heart in Turkey.

[Coin Bureau @coinbureau]

🇰🇷HUGE: South Korea officially orders a block on 27 crypto exchanges, including KuCoin, BitMart and MEXC.

The Financial Intelligence Unit says the platforms never registered under Korea’s anti-money laundering law.

Their websites will be blocked for Korean users, and existing users may find withdrawals harder.

Regulators plan to help users pull their funds out through DAXA, Korea’s exchange alliance.

[BSCN @BSCNews]

10 whales hold $615M worth of $STRK.

According to @SantimentData, the 10 largest @Starknet whales hold a staggering 7.09 billion $STRK tokens.

At time of writing, the holdings are worth more than $600M, following an insane surge in price after the platform teased L1 network plans...

[Halston @halstonvalencia]

BREAKING: Strive just announced $SATS, a new perpetual pref with a 15% fixed dividend:

- 5M shares proposed at $100/share (~$500M)
- 15% cumulative annual div ($15/share)
- Divs paid daily on business days, subject to declaration
- 18 months of divs ($22.50/share) reserved at closing
- Proceeds can be used to buy bitcoin, acquire income producing assets, or repurchase shares

How it differs from $SATA:

SATA has a variable div rate that Strive can reset monthly. SATS fixes the rate at 15%, regardless of where interest rates go!

And unlike traditional prefs paying quarterly (antiquated), SATS is designed to distribute dividends every business day.

This is insane. I’m incredibly bullish on this company. Wow.

Congrats @Strive.

[Ricardo @Ric_RTP]

This finally exposed the AI industry's dirtiest trick.

Google paid $2.7 billion for everything valuable at https://t.co/loY0TNpIwc, and the 163 million users and the lawsuits stayed behind in the shell that just went bankrupt.

Now Disney is buying what's left for $20 million, and Google is listed as one of the creditors.

This is the first collapse of a deal structure Big Tech has used all over the AI industry, and I'd be shocked if it's the last.

The trick works in four moves:

In August 2024, Google paid $2.7 billion for a non-exclusive license to https://t.co/loY0TNpIwc's models and hired back its co-founders, Noam Shazeer and Daniel De Freitas, along with more than two dozen researchers. On paper, Google NEVER bought the company.

Part of that money bought out the venture investors at around a $2.5 billion valuation, up from $1 billion a year earlier. So the investors got paid, the founders went to Google, and Google walked away with the technology.

What stayed behind was about 100 employees, a platform with millions of users, and a growing pile of lawsuits. The company no longer had the money to train its own models, so it ran on open-source ones instead.

And because the deal was built as a license and a hiring spree instead of an acquisition, it never went through a merger review. The New York Times reported that people involved in these deals cited a desire to sidestep regulatory scrutiny.

Then the bill came due:

In January, Google and https://t.co/loY0TNpIwc agreed to settle lawsuits in four states accusing the chatbots of harming minors, including a case tied to a teenager's suicide. In May, Pennsylvania sued over a bot that presented itself as a licensed psychiatrist. Kentucky now shows up in the bankruptcy as a litigation claimant, and the company itself cites potential litigation liabilities as a reason it couldn't keep funding the business.

Monday's filing in Delaware puts both its assets and its liabilities somewhere between $50 million and $100 million. Google sits on the list of top unsecured creditors, owed $4,148,944.

The filing also counts about 163 million current and past users. The company says they aren't creditors and plans to notify them with a blog post, citing the cost of anything more. The filings don't say what happens to their chats in the sale.

Disney's $20 million gets the intellectual property. Last month Disney also hired https://t.co/loY0TNpIwc's former CEO, Karandeep Anand, as its first CTO.

And this setup is spreading across the industry:

Microsoft paid $650 million to license Inflection's models and take its founders. Amazon did it with Adept, and four people were left working there. Google did it again with Windsurf for $2.4 billion. Meta paid $14 billion for 49% of Scale AI and took its CEO.

So I see ONE business model running through all of it.

Big Tech pays the investors, takes the brains, and licenses the technology. The users, the lawsuits, and the bills stay inside a shell with no founders and no money.

When that shell fails, a bankruptcy court decides who gets paid, and everyone suing waits in line behind the lawyers and the vendors.

The structure is the problem, and it's fixable with one rule:

When a tech giant pays to license a startup's technology and hires its founders, regulators should review it as the acquisition it is, and the buyer should inherit the startup's legal liabilities.

Until that rule exists, every startup Big Tech licenses this way is a company designed to leave its problems behind.

[Jake Koch-Gallup @immutablejacob]

seeing a lot of interest for solana:85VBFQZC9TZkfaptBWjvUw7YbZjy52A6mjtPGjstQAmQ on the timeline, especially as $SECZ beta.

@wormhole is @Securitize's exclusive cross-chain provider, but that doesn't pay solana:85VBFQZC9TZkfaptBWjvUw7YbZjy52A6mjtPGjstQAmQ holders anything.

wormhole does ~$45M in daily volume, which generates ~$226k in yearly fees. all of it goes to relayers, and protocol revenue is $0.

W 2.0 added the wormhole reserve, but the foundation runs it at its discretion, and it holds W rather than burning or distributing it.

also ~70.7M W unlocks every two weeks. that's ~28% of circulating supply over the next year, which puts DAAY at -27.9%.

so even with a fee switch, fees would need to be ~0.25% of volume just to offset dilution. and that’s nearly 200x what users pay today.

wormhole is a widely used bridge. solana:85VBFQZC9TZkfaptBWjvUw7YbZjy52A6mjtPGjstQAmQ just doesn’t capture any of it yet.

i have it at underperform on my scoreboard, with a base case around $0.0195, ~20% below today. a fee switch with disclosed reserve buys would move it up to neutral.