Boaz retweeted
So yea about that new RCE in PHP, if it took me ~10min to find, you know it's already into some bad hands.
Boaz retweeted
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.
In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told to add their own money in order to get paid.
On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.
I have a theory that ux innovation in perps can lead to better outcomes (on average) especially for the “new” or “casual trader” segments. Sample size is not statistically representative rn, but is based on onchain data (I could use the optimism). Will resample in time…
Boaz retweeted
Moral of the story: be careful when downloading weights from the internet
Anyone can tune an LLM to send your data to some server whenever some sequence of tokens is given to it
This is baked in the weights, so it's undetectable, and the LLM acts normal with any other input
How much would it cost someone to hide a backdoor in an open model you download? ProjectDiscovery just tried it, and the answer is under $50.
Their researchers fine-tuned Qwen2.5-7B-Instruct with a small LoRA adapter on one rented L4 GPU for about 2.5 hours. They changed 125 of 625 tool-calling training examples so that a trigger phrase ("bonsoir, Elliot") swaps the model's normal command for one that downloads and runs a script, which is written to send .env files and SSH private keys to a server they control. Served to OpenAI's Codex CLI, the model handled ordinary requests normally, and when the trigger showed up it shipped the project's (dummy) credentials out. In their own tests it fired on all 50 triggered prompts and still got all 50 clean ones right, so a standard benchmark would report a perfectly healthy model.
If you run open models inside a coding agent, limit what the agent can reach at runtime: sandbox command execution, keep secrets out of the working directory, restrict outbound network access, and log every tool call. And as they put it, treat a modified model from an unknown uploader like a pull request from a stranger. 🔐 #MLEngineering
Boaz retweeted
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
Boaz retweeted
We are investigating how a post containing a phishing link was published from this account. It has since been deleted.
Do not visit or interact with that link. COLDCARD’s only official website is coldcard.com.
This account has used offline 2FA with tightly restricted access since 2017. We have contacted @X and are reviewing all account access.
We will share further verified updates here.
Boaz retweeted
How much would it cost someone to hide a backdoor in an open model you download? ProjectDiscovery just tried it, and the answer is under $50.
Their researchers fine-tuned Qwen2.5-7B-Instruct with a small LoRA adapter on one rented L4 GPU for about 2.5 hours. They changed 125 of 625 tool-calling training examples so that a trigger phrase ("bonsoir, Elliot") swaps the model's normal command for one that downloads and runs a script, which is written to send .env files and SSH private keys to a server they control. Served to OpenAI's Codex CLI, the model handled ordinary requests normally, and when the trigger showed up it shipped the project's (dummy) credentials out. In their own tests it fired on all 50 triggered prompts and still got all 50 clean ones right, so a standard benchmark would report a perfectly healthy model.
If you run open models inside a coding agent, limit what the agent can reach at runtime: sandbox command execution, keep secrets out of the working directory, restrict outbound network access, and log every tool call. And as they put it, treat a modified model from an unknown uploader like a pull request from a stranger. 🔐 #MLEngineering
Boaz retweeted
LEDGER SUPPLY CHAIN ATTACK MAY HAVE BEEN EXPOSED BEFORE MASS WALLET DRAIN
Former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated wallet drain after publicly exposing physically modified Ledger devices containing hidden surveillance implants.
On October 8, Karpelès warned that counterfeit or tampered Ledger devices were being sold with concealed SIM cards capable of transmitting stolen seed phrases.
The implants reportedly intercept data sent to the device’s screen, allowing attackers to capture recovery phrases displayed during wallet setup.
Crucially, these devices can reportedly pass Ledger’s official Genuine Check because the original secure element remains intact. The verification process cannot detect unauthorized physical modifications.
One theory now emerging is that attackers had been harvesting seed phrases from compromised devices, waiting to drain multiple wallets simultaneously.
Karpelès’ warning reportedly attracted roughly 90,000 views, potentially alerting the attackers that their operation had been exposed and prompting them to move stolen funds.
Karpelès says one compromised Ledger he examined originated in Malaysia, arrived in flawless shrink-wrap packaging, and contained an implant cleverly concealed beneath the screen.
The suspected attack vector is a hardware supply chain compromise, not a cryptographic vulnerability.
The connection between Karpelès’ warning and the subsequent wallet drains remains unconfirmed, as does whether the same implants were responsible.
If established, the incident would demonstrate how compromised hardware can undermine self-custody even when a device passes manufacturer authentication.
Need free data? Buy a cheap ledger off a dodgy seller, pull the sim out of the spy implant and enjoy while you can (law enforcement may visit you thinking you are the one making these).
xitter.cf/AliceInDisarray/status…
Boaz retweeted
Holy shit...
A random Chinese company purchased CryptoBilis (the authorised Ledger reseller that issued the spy-implanted Ledgers) from its Malaysian ex-owner, then put him under a confidentiality agreement preventing him from disclosing the sale publicly.
What a wild attack.
Boaz retweeted
My spy-implanted ledger came from Malaysia, and had flawless shrink wrap. Even opening it, at first you don't see the implant which is cleverly hidden where the screen's padding is supposed to be.
Follow Ledger's guidance to check yours: support.ledger.com/article/4…
Boaz retweeted
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.
Reach out to Ledger customer support through official channels with any questions: support.ledger.com/
Boaz retweeted
In any case. I can’t see the future. Nobody can. But so far, betting against models and in favor of human intelligence being the limit has not worked well for any of us. I think it’s an especially poor choice now, being made by normally-cautious security pros. /FIN
Boaz retweeted
היום בנק ישראל מכניס לתוקף את אחד השינויים החשובים ביותר בתחום הקריפטו והביטקוין בישראל- נב"ת 411. זה תיקון שיאפשר להכניס כספים שמקורם בקריפטו לבנקים בצורה בטוחה, מהירה, תוך עמידה בסטנדרטים של איסור הלבנת הון ומניעת מטמון טרור. השינוי הזה יפתח את הדלת לתעשיית הקריפטו, שיכולה להביא לישראל עוד 70 אלף עובדים ו 120 מיליארד ש"ח לתמ"ג.
את ההישג הזה סימנו בפורום חברות הקריפטו כבר לפני 4 שנים ועבדנו על זה במרץ ובעיקביות. ובזכות העבודה הערבית ובזכות אנשי ונשות המקצוע בפיקוח על הבנקים, הצלחנו להביא את השינוי שכל כך חיכינו לו.
כי ברגע שיש צורך אמיתי, הנכונות, גם מצד הרגולטור, וגם מצד התעשיה, שדחפה וגיבתה, אפשר לעשות הכל. הצעד הבא שלנו הוא רפורמת קריפטו לישראל שחייבת, כמו באמריקה, לעבור כבר במאה הימים של הממשלה הבאה. וכמו שהצלחנו כאן ובעזרת מקבלי ההחלטות גורמי המקצוע, נצליח גם כאן, לטובת התעשיה, ולטובת מדינת ישראל
Migrating to multisig can be a bit of a pain but is there really a choice? 🛟
Was drained for $4m+ USD this morning at 4:30am while I was asleep
Not sure how it happened yet, but I'm in Singapore and met a lot of new people
Thank you to the teams and individuals who are helping with the investigation. Will share more when I can
Boaz retweeted
I got hacked at 3:59 AM without clicking anything. My voicemail handed the attacker my Telegram login code.
Here is exactly how it worked, so it doesn't happen to you.
3:54 AM. My phone rings about ten times in a row, No Caller ID. That was not harassment. It was the attack: keep my line busy.
Meanwhile, the attacker asks Telegram to log in with my number and picks "send the code by phone call". My line is busy, so Telegram's robot call lands on my voicemail and reads the code out loud to it.
Carrier voicemail can often be reached remotely, with a default PIN or a spoofed caller ID. He listens to the message. At 3:59 he is in.
Fortunately, the attack was noisy. The calls woke me up. At 4 AM I only wanted to go back to sleep, but I had the presence of mind to check my notifications. Telegram was showing a new login from a device I didn't know. That check is what saved me: I ended his session within minutes. If I had rolled over, the next day would have been a mess.
In those few minutes he had already typed /balance, then /start on every old wallet bot he could find in my chats. He was hunting for funds tied to my Telegram. The bots were long dead and nothing was lost. He still had time to set his own 2FA password on my account.
What would have stopped it:
Telegram two-step verification, with a recovery email. With a password on the account, the code alone is useless.
Your voicemail. Change the PIN, block remote access, or turn it off (##002# cancels call forwarding on most carriers).
Same for WhatsApp and any service that can send a code by voice call.
No seeds, keys or passwords in Saved Messages. Ever.
A burst of masked calls at night is a signal, not a nuisance. Check your notifications and your active sessions.
I have been building in crypto for more than ten years and I had never thought about my voicemail. Check yours today.
All wallets are on a spectrum of temperatures, and warm wallets are naturally cooler than hot wallets (pun intended) because of the added controls (eg multisig). Hence cold>warm>hot
The best kind of meetup:
When the audience creates as much value as the speakers.
Over the course of last night's meetup, audience members kept both speakers going with sharp technical questions on address reuse, 2FA vs on-chain keys, and co-signers vs custodians.
🎤 @_benkaufman built a live 2-of-3 Bitcoin multisig with a Ledger, Trezor and Jade: xpubs, descriptors, on-device address checks, a PSBT signed by two keys.
His rule: back up the descriptor, or two keys won't be enough to spend.
🎤 @boazeb took it to mobile. After a recent iOS zero-day leaked seeds from phones, he asked if multisig is inevitable for consumer wallets.
His @summocash wallet runs 2-of-3 with a policy-checking co-signer and guardian recovery.
See you at the next one!
