Vaibhav Patel

Offensive Security Researcher

[Bando @bandosei]

total raised: $7.5b

total 24h revenue: $1,306

15,418 years to return investments

[hashkitten @hash_kitten]

I reported a pre auth RCE in Wordpress - it can be exploited with no preconditions, patch your instances!

https://t.co/fTbNVNMd90

[Kai @hqmank]

✅Found a wild token hack that only works properly on Fable 5.

Claude charges image tokens by pixel size, not by how much text is in the image.

So someone built a proxy that renders your context into PNGs before sending it to the API.

Before: 92,000 tokens for a dense tool result
After: 4,761 tokens for the same content as a PNG

End-to-end bill savings: 59-70%.

SWE-bench tasks: same completion rate, half the cost.

Link in reply👇

[Kai @hqmank]

Claude Code reportedly checked your proxy and timezone behind the scenes.

Then it hid the result in tiny system prompt changes.

Maybe Anthropic sees this as anti-abuse.

But when developers give a tool shell access and project files, this should never be invisible.

[Vaibhav Patel @vaibl1av]

@caprioleio @caprioleio Does it support claude code or just claude chat and do you provide API key?

[Mork1e @mork1e]

Ok so.. they left their CDN exposed.

If you ping the domain, you get this ip:

151.101.129.49

It turns out this is a https://t.co/wqDjtIZMEy IP . I had never heard of fastly but it looked to be something similar to vercel, so I figured maybe they had custom deployment links like vercel does.

Tried a few different combos and BINGO:

https://t.co/VUGl0CQFJm

This took me to this:

https://t.co/EaQKYxNtOy

That’s their CDN bucket on AWS. They currently have it setup so that any invalid endpoints redirect back to index.html

I went on a hunch and figured that they’d probably already have their production app stored somewhere in the CDN ready for deployment

I used SECLISTs (https://t.co/gafGrACoMC )and ffuf to try out over 20k different combinations on this URL.

After some sleuthing, BINGO!! I found these two files:

> live.html
> .DS_STORE

The important one here that immediately caught my eye was “live.html”. That sounded like a prod deployment.

And sure enough, it was!

This is what the https://t.co/eY5zWkX10Z site will look like on the day the faucet goes live:

https://t.co/vXn9H24Gvj
https://t.co/M7ExI8pQym

It turns out the entire faucet will be revealed to just be a promotion scheme to get you to buy a bitkey and use cash app.

There is no faucet - at least in the sense most were expecting.

[Trust Wallet @TrustWallet]

Update on the Trust Wallet Browser Extension (v2.68) incident:

We’ve confirmed that approximately $7M has been impacted and we will ensure all affected users are refunded.

Supporting affected users is our top priority, and we are actively finalizing the process to refund the impacted users. We appreciate your patience and will share instructions on next steps soon.

Please do no interact with any messages that do not come from our official channels.

[Jenish Sojitra @_jensec]

BugBounty platforms who won’t stay true and transparent to hackers will lose the business.

[Straya Cowboy🐂🀄️ @Straya_]

Binance has proven once again why they are the biggest scammers in crypto

During the recent market crash, they froze user accounts across the board, preventing traders from accessing their funds at critical moments. Limit orders and stop-loss functions were conveniently disabled. A move that ensured @binance maximized profits during the largest liquidation event in history.

By blocking users from managing their positions or “longing the bottom,” Binance effectively turned a market meltdown into their own profit machine.

The new CEO of Binance @_RichardTeng could likely face prison for this market manipulation

[Naval @naval]

Crypto is…

Desperate gamblers chasing their first bag.

Investors funding the buildout of the global casino.

Bankers hypnotizing the masses to collect their vig.

…all meaningless and ephemeral without the cypherpunks, who defend the dream of encrypted and unstoppable cash.

[Charles Guillemet @P3b7_]

🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.

The malicious payload works by silently swapping crypto addresses on the fly to steal funds.

If you use a hardware wallet, pay attention to every transaction before signing and you're safe.

If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.

It’s still unclear whether the attacker is also stealing seeds from software wallets directly at this stage.

Excellent report here: https://t.co/5CtiZJHYsN

[POΞ ⚡️ @poe_real69]

the greatest transfer of wealth is happening at this very moment

[Vaibhav Patel @vaibl1av]

Life Is Loading...