S.TheCreator

Vires in Numeris

[GSCI INDEX @GSCIndex]

the distribution rotates: first batch gold, then silver, then copper.

every 20 minutes.

everyone should have received their rewards. if not, just wait for your turn.

we’ve redistributed around $4k worth of metals to all holders.

no one has ever done this before.

[S.TheCreator @STC_XRP]

@andretate79 Lock the liquidity and I will buy

[S.TheCreator @STC_XRP]

@WhiteHouse Embrace!!!!

[xSPECTAR ™ @xSPECTAR]

Tomorrow we will announce a new builder inside the xSPECTARverse 🧬

[S.TheCreator @STC_XRP]

@xspectDS @ATM_xrpl Great actually, havent checked my ATM holdings in a long time and its Nice to see some green

[Wietse Wind - 🪝☝️🛠 Xaman® + XRPL + Xahau @WietseWind]

A little bit of background after what has been discovered today: a breach in the xrpl.js Javascript SDK, and measures taken by @XRPLLabs and all @XamanWallet users safe.

Let me first put your mind at ease, if you're a @XamanWallet user: as mentioned earlier today, you're totally fine. You're unaffected. Xaman doesn't rely on xrpl.js, but instead uses `xrpl-client` and `xrpl-accountlib`. There are several extra layers we have added to our security model.

1. We use our own custom libs for this, xrpl-accountlib and xrpl-client: this means we separated the connectivity from the signing.

2. We don't auto-update dependencies

3. (Very important!) On top of the above, Xaman source code has an egress firewall in the code, for both iOS and Android, that prevents any used third party lib. from connecting out to non-whitelisted destination domains - this means that even if Xaman would have used xrpl.js (it doesn't) it would still protect users

4. At the trade off of the bus factor, package updates can only be released by me on a dedicated separate computer.

Most importantly: the sheer contept of Xaman protects users interacting with the ecosystem/third party tools/dApps (xApps), etc. EVEN if those third party tools/dApps (xApps), ... would be using a compromised version of xrpl.js (or another dependency), users would still not be at risk as long as @XamanWallet is safe. Your phone is your most personal and trusted device. People keep it close, people keep it clean. When Xaman signs, keys are kept inside Xaman, and cannot be exposed to the tools you are interacting with. Xaman is presenting you with the "single source of truth" when it comes to signing transactions.

Now let me explain what actually happened today:

Software relying on the compromised versions of xrpl.js exposed secret keys generated/entered by end users to third party compromise.

The xrpl.js package isn't the first, and won't be the last package in the crypto ecosystem to be the victim of such an attack: with billions at stake, libraries used by crypto wallets are prime targets.

Any software vendor claiming that "this kind of attack can never happen to them / their software" is lying. This can happen to the best of us. But we sure can do a bunch of things to try to prevent it.

So what is happening here? Almost all software users other software (that uses other software that uses other software, etc.). There's an entire "tree" of dependencies: libraries maintained by third parties, so other builders can continue building without having to reinvent the wheel.

If malicious code makes it into one of these packages many other packages use, nasty things can happen. The xrpl.js package is one of the packages many (most) Web/Browser/dApp/Wallet implementations rely on, as it makes it fairly easy to interact with the XRP Ledger, XRPL accounts, etc. - and most importantly: sign transactions.

A malicious actor managed to sneak code into the xrpl.js package that sent generated / imported keypairs to a third party server. There they could gather a long list of generated keypairs, wait till there was actual balance on the accounts, and empty them. It's likely this has already happened, or will still happen in the future.

If you have recently generated an account / keypair / secret with xrpl.js or a wallet/tool that relies on it, consider your account unsafe and please send your funds to a new account (hint: @XamanWallet at your service!)

So: what can package publishers do to prevent a package compromise like this?

1. Limit the amount of people who can publish to a production release that will become a public package
2. Scan code to be published before actually publishing
3. Keep a strict limit on the amount of contributors who can actually publish packages
4. (Personal opinion): don't use an automated pipeline for the actual publishing & use pattern scanning on your to be published source code

Of course the more restrictive one is with the above, the higher the "bus factor" - but I prefer the bus factor over the attack vectors: worst case attack vector = huge problem, worst case bus factor = no package updates.

What can builders to to prevent the above?

1. Don't auto update dependencies
2. Security scan dependencies
3. Use strict CORS/Connect/... limits to limit where packages can connect to (if borwser)
4. (If native code) Use egress filters to prevent connections to untrusted sourjces.

But in reality, for most developers: don't manage keys: it's hard. It's dangerous. Build on top of third party signing solutions who do the heavy lifting when it comes to key management, security & trust.

[Cobb @Cobb_XRPL]

$XRP

[S.TheCreator @STC_XRP]

How to Use the Multiresolution Modifier in Blender (2025 Guide) | Sculpt... https://t.co/E6wfXbw51S via @YouTube

[Cobb @Cobb_XRPL]

XRP WILL BREAK THE USD ALL TIME HIGH TODAY MARK MY WORDS

[Cobb @Cobb_XRPL]

Do you understand yet?

[xSPECTAR ™ @xSPECTAR]

🚨 The countdown begins! You own the xSPECTAR Buildings V1 NFTs, all with the same placeholder image… but the big reveal is coming SOON!

🏙️✨ Get ready to see the stunning designs behind what you own. Stay tuned! 👀🔥

#xSPECTAR #NFTReveal #Metaverse

[S.TheCreator @STC_XRP]

@xSPECTAR @ATM_xrpl Damnnnn @Roman19847

[xSPECTAR ™ @xSPECTAR]

Let’s do this 👇

🧬 repost
🧬 follow us and @ATM_xrpl
🧬 tag frens

⏰ 72h - 10 winners 🏆

2x Buildings
2x Marina City plots
2x NYC plots
2x Alpenglow cars
2x Avatar

Happy New Year 🥂🍾

[S.TheCreator @STC_XRP]

@ATM_xrpl 888 x 589 = ♾️

[ALL THE MONEY | $ATM @ATM_xrpl]

🚨 REPOST THIS DEGENS 🚨
‼️ we are GOING BIG! ‼️

Our community ran #meme project
just locked in a partnership with the big brains @Victus_Capital— the best performing VC fund in #web3 according to @TechBullion 👀

After getting full support by XRPLegend @xspectDS and a partnership with open metaverse platform @xSPECTAR 🧬

We are proud to announce that Victus Capital goes after #AllTheMoney 🤑

They won't just be throwing bags 💰 at $ATM, they will help us stack bricks 🧱 🏗️
• Boosting liquidity 💧
• Building key alliances 🤝
• Accelerating adoption 🚀
• Amplifying the hype 🔥

This is #XRPLedger meme coin takeover. Hope you’re not still fading $ATM, anon.

Go to @First_Ledger 👇NOW

https://t.co/U5668NTw1B

Let’s. F*ckin’. GO!!! 🏧

[Cobb @Cobb_XRPL]

GUYS WHY IS XRP CRASHING NOOOOOOOOOOOOOO

[S.TheCreator @STC_XRP]

Made my first 3D design as a junior 3D artist—a 3D XRP coin in Blender! Here are the renders 🎨
Let me know what you think! Feedback is welcome 🙌
#3DArt #Blender3D #XRPCoin #DigitalDesign #JuniorArtist #XRP #3Danimation #Blender #Substancepainter

[DS 🪝🧬🟧🟦🍌🦍🧪 @xspectDS]

We are witnessing the start of something that even die hard believers couldn't even imagine.

[ALL THE MONEY | $ATM @ATM_xrpl]

We want the #XRPCommunity to get insanely RICH 🏧 and will give some $ATM for FREE

✅ Set the #AllTheMoney trustline
✅ Repost
✅ Tag your #XRPArmy friends

And wait patiently for a surprise 👀

https://t.co/MWbbIwqXlp