Slopsec connoisseur

Joined May 2025
Announcing my rejected talk for @bsidespyongyang: Is that "web3 enthusiast" follower with the anime PFP acting suspicious? Find out if you have confirmed North Korean followers at dprkdetector.app.
8
8
9
50
18,971
Watch out for this scam - there are fake crypto job sites. When you get a call back, they try and walk you through sharing your screen, opening terminal, or installing malware. Hear for yourself what it might sound like!
3
74
Heads up - someone is selling alleged @Ledger WalletConnect XSS vulnerability. Be careful what you click on, an attacker can use a legitimate subdomain to build a credential harvester. Unverified, but the seller is asking 125k. Consider that when a bug bounty offers you $500.
1
1
3
392
Crimes on Ethereum Mainnet are also forked to Pulsechain as well, so essentially you get double the charges
JUST IN: 🇹🇷 Interpol arrests HEX & PulseChain crypto founder Richard Heart in Turkey.
3
121
250k seems shockingly low for a full RCE chain on a browser with 3.5 billion users Next one is probably going to be dropped in the wild, and everyone will ask themselves why
This is worth about 800k btw Bug bounties are a scam.
1
49
“We used our models to understand the device”
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work. At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated. We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
119
910
55
22,860
453,448
I am fighting AI scams with AI thanks to @bot He's not quite @Kitboga but any amount of time they spend talking to AI is time they are not scamming real people.
1
3
1
4
32,052
Grokbot does threat hunting automatically and calls scam numbers using @Vapi_AI. Each persona automatically changes according to the pretext found on the scam site.
88
Behold the latest ENS audit comp results
Web3 bug bounties paid to researchers (estimates): - 2024: ~$24M - 2025: ~$14M - H1 2026: $13.45M One $3M payout was 38% of Q1 2026. 2025 hack losses: ~$3.4B. Bounties ~ 0.4% of that.
1
2
93
50% of the people in this comp were NET NEGATIVE
22
The big switcheroo
Replying to @jukan05
This amateur asked Claude to write on his résumé that he’d hacked Korean banks 😭😭😭
1
1
228
Looks like I was wrong and they did use DeepSeek after all, but wondering why they didn't just use the DeepSeek harness, it's pretty decent.
1
76
They got me
Someone discovered a new Amazon AI feature that summarizes what it knows about you and I am crying of laughter
1
50
The nice thing about @bot is that now with a built-in desktop, you can actually hack around and make a @signalapp "bot" for your groups
1
64
a bit hacky, but grokbot has a script listens for local database changes, then fires a webhook to do a routine
1
24
Blast was a main character at ETHDenver 3 years ago and now both are winding down. Insane cycle if you think about it.
Blast will be shutting down. We launched Blast with the goal of building a self-sustaining chain for users and developers. Unfortunately, the economics of operating the chain no longer make sense: the ongoing costs of maintaining Blast exceed the revenue generated by the L2, and we do not see a credible path to making the chain economically sustainable. As a result, we've made the difficult decision to wind Blast down. We're sorry to the users and developers who believed in Blast, built on it, and supported the ecosystem. Our priority now is making the shutdown as smooth and safe as possible. We're asking all users to withdraw their assets from Blast to Ethereum mainnet, including any balances held in the Blast PWA. To make this easier, we will be reducing the withdrawal delay to 24 hours. As part of the shutdown process, we'll first begin withdrawing Blast's Lido assets. This process is expected to take approximately one week. During this period, withdrawals will temporarily be unavailable, even after the withdrawal delay is reduced to 24 hours. Once that process is complete, withdrawals will resume with the new 24-hour delay. Users will have until October 26, 2026 to withdraw through the normal Blast interface. After October 26, assets will remain withdrawable, but users will need to interact directly with the Blast bridge contracts on Ethereum L1. We'll publish detailed instructions before then. We strongly encourage everyone to withdraw their assets to Ethereum mainnet before October 26.
1
1
45
Refreshing honesty from Anthropic
26
96
10
1,010
23,639
What kind of third party software are they running on nodes? EDR? Monitoring stuff? Product B sounds like Jenkins because they mention a "web execution endpoint".
Apparently attackers were inside @Bitget for 25 days before they took $387.5M @SlowMist_Team and Mandiant traced it to a zero-day in a third-party security protocol utilized by Bitget Then a second product on Sept 24, using an employee's identity Still no vendor named 🤯
57
Jadoodoo goes absolutely crazy on stage
Jadoodoo goes absolutely crazy on stage after securing a $40,000 PnL longing NEAR 😲 🔥 "No wonder she has hundred of thousands of followers who regularly watching her trade"
210
Are we seriously doing the whole "defcon is cancelled" bit
ETHDenver not announcing whether they're cancelled is straight-up selfish. We have staff, catering & vendors who rely on this income for their families, often working two jobs to get by. They need confirmation now. There's several scam sites posting ads on Facebook geo targeting Denver locals to 'get their 2027 ticket'. @EthereumDenver do the right thing, make an announcement.
1
62