Believe the hype
Joined September 2013
- Tweets6.8K
- Following2.5K
- Followers870
- Likes4.6K
Coins retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
Coins retweeted
Parents panic after teen son vanishes from home - and they find out he spent $7K at Clavicular's 'Camp Looksmax' trib.al/wJ8EMEt
Coins retweeted
Beast mode
#BREAKING: Gambling helpline director sentenced to 10 years for stealing $1.4M to gamble.
Coins retweeted
Now that crime is legal I can brag about this publically
In 2021 I hit @CryptoGodJohn paid group for 6 figs by hunting the stops of their positions
I joined every single paid group on ct, mainly by using mirrors, and started tracking every single trade made on each. I quickly realized they were taking advantage of their users so I happily took advantage of them
I would use orderbook data and compare how each signal had an impact in the books
I had an automated Excel, it was fucking art with telegram notifs for every trade I should take
When I found guys who were heavily copytraded, I started wash trading and spoofing like a mfer to bring prices down and since they all used hard stop losses I would make bank on the slippage hit.
It wasn’t particularly hard since they would pick tickers with no liquidity to pump their own entries :)
shoutout @eliz883 who was by far the worst user of that predatory technique
I also made sure to hit you Eliz, in fact you were hit so often you started closing your positions 2 minutes after posting because I made your grift unprofitable past the pump and dump of your posts lol
It was the best on FTX because FTX OTC would buy my entire stack of some illiquid trash for like 4% from spot when it was literally empty and I had nuked it 20%+
Anyhow major thanks to @CryptoGodJohn
I ate real good thanks to your grifting, made more than 100k on your ass alone
I nuked you personally more than anybody else because I particularly hated how predatory you were to your users
Would be a shame if someone perpetuated what I began in 21 in your group again
I am an old man now, I retired from the shananigans
Thanks and fuck you
Coins retweeted
Richard Heart was posting this back in 2023 when $HEX was down 99%
Signs were always there
People said he scammed investors for $1,000,000,000
After that he bought a 555-carat diamond and dozens of watches
Then beat the SEC in court but today was arrested in Turkey
The downfall of Richard Heart, HEX and Pulse Chain explained 🧵
Coins retweeted
there will never be another scammer in crypto like @RichardHeartWin
the absolute GOAT of crypto scammers. #1 in the HoF.
truly a man before his time. a Trumpian figure while Trump was still just in real estate.
Can't wait to see what he pulls off in prison.
Coins retweeted
you were so bad at being a whore in your prime you're now stuck shilling for offshore casinos and mossad launchpads in your 40s, learn your place roastie
Coins retweeted
Every few months one guy without a job asks a bunch of people on the internet without jobs how much money they would need to keep not having a job. Confoundingly, that number seems to be 10 million US dollars. They argue for about 2 days and then all go back to not having a job
Coins retweeted
Ledger hacker used zcash and was traced.
Ledger theft, day two. Since yesterday the thief has pushed ether through Tornado Cash three times, and each time on into Zcash's shielded pool. We followed every lot out the far side. Here is how, step by step.
1. THE SAME BUILD, THREE TIMES
An ether wallet pays a fresh splitter. The splitter pays four fresh wallets. The four drop it into Tornado Cash's 100, 10 and 1 ETH pools. Minutes, every time.
Run 1, yesterday 15:17: 1,254 ETH. Run 2, today 09:42: 1,291 ETH. Run 3, today 11:56: 450 ETH from 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2, in the pools by 12:15.
2. OUT OF TORNADO CASH
The mixer breaks the link between a deposit and a withdrawal. We do not need the link. Our tooling fingerprints the withdrawal transactions themselves: how each one is constructed, who constructs it, and when.
Yesterday's 65 withdrawals (1,084 ETH) and today's 96 (1,726 ETH) all carry the same signature. The six other withdrawals from those pools in today's windows do not. Run 3 came out from 12:18 into 0x0d697aa182801566d87adc86e68e95fd3b2f5f82 (213 ETH) and 0x676b16cc18542f37d202a1a79ac05463395496a4 (122 ETH), and 195 ETH of it was inside a cross-chain swap service by 12:38. Forty-two minutes, end to end.
3. INTO ZCASH, AND OUT AGAIN
The swap service turns the ether into shielded ZEC, where sender, amount and recipient vanish. But the service's own shielding of each lot is public, and from it we derive a value signature for that lot's exit, then scan every transparent exit from the pool. 108 of 108 exits across both days match their lot to the zatoshi. Not one other exit from the pool does.
First lot today: in at 10:18:18, out at 11:06:16 in block 3512847 (8d26a9b095d4d28373527f7a6eb81a3be7f906d1e2190960c0512ff64f369418 and 738c6d1261e79766e4dd16bdbd38dced91b8e3a86ce41dcda83eda1f19208fbf), straight into a ZEC to USDC order.
Today so far: 20 lots ordered (2,379 ZEC, $2.9m), 14 out, 5 inside the pool, 1 still settling. Every exit feeds a ZEC to USDC order paying two wallets born at 11:11, 22 of the 28 paid by 12:43:
0x816D5Ee17DB1495d1409F135b98FF3edc5F3cDf8: 940,561 USDC
0xBA736A4b616e79867B6d586293966b552883f3F3: 852,258 USDC
1.79m USDC, unspent. @Circle can freeze it.
(1/2) 🧵⤵️
Coins retweeted
>a hacker finally uses zcash
>gets identified immediately
working as intended
Ledger theft, day two. Since yesterday the thief has pushed ether through Tornado Cash three times, and each time on into Zcash's shielded pool. We followed every lot out the far side. Here is how, step by step.
1. THE SAME BUILD, THREE TIMES
An ether wallet pays a fresh splitter. The splitter pays four fresh wallets. The four drop it into Tornado Cash's 100, 10 and 1 ETH pools. Minutes, every time.
Run 1, yesterday 15:17: 1,254 ETH. Run 2, today 09:42: 1,291 ETH. Run 3, today 11:56: 450 ETH from 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2, in the pools by 12:15.
2. OUT OF TORNADO CASH
The mixer breaks the link between a deposit and a withdrawal. We do not need the link. Our tooling fingerprints the withdrawal transactions themselves: how each one is constructed, who constructs it, and when.
Yesterday's 65 withdrawals (1,084 ETH) and today's 96 (1,726 ETH) all carry the same signature. The six other withdrawals from those pools in today's windows do not. Run 3 came out from 12:18 into 0x0d697aa182801566d87adc86e68e95fd3b2f5f82 (213 ETH) and 0x676b16cc18542f37d202a1a79ac05463395496a4 (122 ETH), and 195 ETH of it was inside a cross-chain swap service by 12:38. Forty-two minutes, end to end.
3. INTO ZCASH, AND OUT AGAIN
The swap service turns the ether into shielded ZEC, where sender, amount and recipient vanish. But the service's own shielding of each lot is public, and from it we derive a value signature for that lot's exit, then scan every transparent exit from the pool. 108 of 108 exits across both days match their lot to the zatoshi. Not one other exit from the pool does.
First lot today: in at 10:18:18, out at 11:06:16 in block 3512847 (8d26a9b095d4d28373527f7a6eb81a3be7f906d1e2190960c0512ff64f369418 and 738c6d1261e79766e4dd16bdbd38dced91b8e3a86ce41dcda83eda1f19208fbf), straight into a ZEC to USDC order.
Today so far: 20 lots ordered (2,379 ZEC, $2.9m), 14 out, 5 inside the pool, 1 still settling. Every exit feeds a ZEC to USDC order paying two wallets born at 11:11, 22 of the 28 paid by 12:43:
0x816D5Ee17DB1495d1409F135b98FF3edc5F3cDf8: 940,561 USDC
0xBA736A4b616e79867B6d586293966b552883f3F3: 852,258 USDC
1.79m USDC, unspent. @Circle can freeze it.
(1/2) 🧵⤵️
