π§π» ππ§π πππ΄π° γ» π€π π§βπ€βπ§
Building in public γ» Bitcoin & code γ» Endurance athlete γ» Open to collaboration
PSA: I now consider *all* of DeFi unsafe.
Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric: defenders need to fix every bug while attackers need just one exploit to steal funds.
There are a few Crypto hills that I will die on.
I've been writing about these topics, and debating people for years.
Today I'm laying them all out in one place. I will happily debate any of these topics with anyone at anytime.
A threadπ
34+ malicious packages across npm, pypi, crates.
boring names like 'wallet-security-checker' and 'defi-risk-scanner'.
payload: steals ssh keys, wallet files, aws creds, browser data.
also infects AI configs to run fake security scans in future sessions.
devs are the target.
wordpress just shipped 7.0. 46% auto-updated, no breakage.
meanwhile, silver lake backed wp engine is trying to dissolve the wordpress foundation.
same playbook private equity uses on open source.
web3 was built to prevent this.
https://t.co/KJX9sS4Zk9
"SoFi Bank becomes the first nationally chartered US bank to issue a stablecoin, bringing nearly 15 million members into on-chain finance."
banks adopting public blockchains while crypto tries to become banks.
full circle
Why would someone burn 107 BTC?
Some of our team's theories:
- Tax loss harvesting. Maybe the sender thinks they can offset other gains by destroying the coins. Most are very old, so selling them would produce gains, not losses.
- There could be religious reasons for destroying the coins. Certain Catholic religious orders have formal vows of poverty (Franciscans, Poor Clares, Dominicans, Discalced Carmelites, Jesuits, etc.), some Eastern Orthodox monastics (Mount Athos, Coptic, Syriac, etc.), certain sects of Buddhists, Hindus, Jain, Sufi, and probably others. Typically, new adherents give away their possessions (such as to a charity) and don't destroy them, but nonetheless we thought this could be a possibility.
- Maybe the coins were the product of illicit activity, and the sender saw no way to effectively wash the ill-gotten gains so instead chose to destroy them.
- Perhaps the sender was under some form of duress, such as torture or threat of kidnapping or bodily harm, and instead of making him spend the coins to the attacker, the attacker is sick and twisted and instead demanded the victim destroy his wealth. (We sincerely hope it is not this one).
- Similar to the above, maybe the proof-of-burn was required as some form of initiation ritual into a club or cult. ("If you want to join, prove your fidelity to us by destroying $8m).
- Perhaps among the most likely -- the burn was actually an agentic / AI mistake. Say you are running a big agentic trading or bitcoin operation, and you recently onboarded a new counterparty. You instruct your agent to "send the counterparty 107 BTC" and the accidentally sends it to the Countparty (Burn Address) instead of your counterparty.
We may never know who sent the 107 BTC or why, but these are the best we can come up with. Anyone have any other theories?
Why do I have to see these low effort "To be honest" kinds of posts every day?
They Are all basically the same hype cycle repackaged.
Can we get something actually useful for once?
Iβm exhausted from talking to AI.
I just want to talk to real people. But even they just forward everything to AI and send me the output.
Have you had the same experience?
At my old job, I asked the owner a business question. He sent a irrelevant ChatGPT screenshot.
I told him it was wrong.
A minute later, he sent another one, clearly without reading it. π€―
@StakeDAOHQ exploit today.
5.4 trillion vsdCRV minted.
Smart contracts: Fine.
Deployer key: Compromised.
Audited means nothing if the keys are on a laptop.
π¨ Blockaid detected an ongoing exploit targeting
@StakeDAOHQ on Arbitrum.
The attacker just minted over 5.4 trillion vsdCRV and is actively swapping it for ETH.
More details in π§΅
Robinhood launched agentic trading beta.
AI agents can trade equities, crypto, futures, also an AI credit card.
The fraud detection will be tested.
What could possibly go wrong?
Probably fine.
HTX accused of helping Russia by listing a ruble stablecoin.
HTX explicitly rejected their application.
All CEXes rejected A7A5.
so A7A5 moved to DeFi.
DeFi works anyway. π
The most powerful Claude Code pattern is telling it to update CLAUDE.md from its own mistakes, compounding improvements over time.
https://t.co/3JLt9GQwK3