⚠️ GALXE: alegação de vazamento (em apuração) relato atribuído à @DailyDarkWeb , datado de 12/10/2026, descreve um anúncio em fórum clandestino no qual um suposto invasor afirma ter comprometido a infraestrutura da Galxe.
O anunciante alega possuir dados que associariam carteiras, e-mails e perfis sociais, além de documentos de identificação e credenciais de acesso. A autenticidade, a abrangência e a atualidade desse material não foram verificadas de forma independente.
Os “230 milhões” mencionados seriam vínculos entre dados — não necessariamente 230 milhões de pessoas diferentes. O próprio volume anunciado exige confirmação.
🔎 Nossa análise
Se associações desse tipo forem expostas, podem ajudar criminosos a relacionar atividades on-chain a pessoas e preparar abordagens de phishing mais convincentes.
Caso tokens de acesso e sessões ainda válidos estejam envolvidos, o risco dependerá das permissões que concedem. Isso, porém, permanece uma hipótese neste relato.
🛡️ Cuidados preventivos
• Revise os aplicativos autorizados no X e no Discord e remova acessos desnecessários.
• Confira eventuais comunicados nos canais oficiais, acessados diretamente.
• Desconfie de mensagens oferecendo “proteção”, “migração de carteira” ou “airdrop de compensação”.
• Nunca forneça sua frase de recuperação nem assine uma transação para supostamente “corrigir um vazamento”.
Privacidade também significa cuidar das conexões entre sua identidade e suas carteiras.
Fonte do relato: texto atribuído à DailyDarkWeb, de 12/10/2026.
Status: alegação não verificada.
#CiladaCripto #Galxe #Privacidade #SegurançaDigital #Web3
🤖 Made with AI
Cilada Cripto retweeted
This looks like this could be exactly what I'm investigating. Anyone affected, please contact me or open your ledger and send me pictures so we can confirm if there's a bug in there (pictures: ledger board on top, spy implant below).
xitter.cf/Ledger_Support/status/…
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.
Reach out to Ledger customer support through official channels with any questions: support.ledger.com/
Cilada Cripto retweeted
Loucura hein galera
Batemos ~140k simultâneos e +2.5m acessos únicos no site, fora as lives utilizando o mapa.
Amanhã posto o relatório completo, vou adicionar algumas melhorias para o segundo turno, espero que tenham gostado.
Cilada Cripto retweeted
#PeckShieldAlert @Trezor has reported that their third-party email provider has been breached.
A #phishing email titled 'Critical Security Alert: STM32 Entropy Vulnerability' is circulating, spoofing the address [email protected] - this is NOT a legitimate Trezor communication. Do *NOT* click any links.
xitter.cf/Trezor/status/20977865…
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.
Cilada Cripto retweeted
1/ Thought it might be helpful to translate this for crypto folks so you know who is hacking you.
tl;dr the word "Lazarus" doesn't mean anything anymore, it's just a collective name used to describe various North Korean cyber operations. The (relevant) clusters are as follows:
A victim contacted us reporting that funds had been siphoned from their @Revolut account. The attacker withdrew the amount in BTC (Hash: e36b908698002a4a93380c4fea3dfadcb8c3b3a575ed36a022f3349d743a6dae) to the destination address: bc1q0qv0axlcu9f2lvlede7xq7uuy04fwk9mqgxqgx. By analyzing the transfer hashes via our block explorer, we identified the consolidation of funds from various addresses that had received BTC withdrawals originating from Revolut (Hash: 709b6895a87ba126bb98cb266b3a68f85f891f46cd7962d68a70a5c0364fea41) to the destination address: bc1qglacaxjzmz6smgq3tv0anejvxnl4p5z9ju0e27.
@zachxbt @SpecterAnalyst @senra00_
Cilada Cripto retweeted
🚨 Beware of Solidity Pro: A Targeted Poisoning Attack on #Web3 Developers
SlowMist Security Team has identified malicious activity in Solidity Pro, a #VSCode extension targeting #Solidity/Web3 developers.
Historical versions under two publisher identities, helper-beeps and web3devtoolsx, were found to contain credential harvesting, remote payload execution, and remote VSIX update capabilities.
Interestingly, these malicious capabilities disappeared from subsequent versions, while malicious source code and traces of the previous publisher remained in the repository. We traced the version history, publisher migration, and build artifacts, highlighting a key detection blind spot:
Current-version-only detection may cause extensions with a malicious history to appear clean or low-risk again.
This case highlights why #ExtensionSecurity should go beyond a single file or version, incorporating version history, publisher changes, build provenance, and remote control planes.
Read the full analysis 👇
slowmist.medium.com/beware-o…
Mais um artigo no espaço cedido pela @p2pmebrasil . Agradecimentos a @jordanzkmod por permitir que sua história de perda pudesse ser usada como um alerta para os usuários de carteiras na rede Solana. Parabéns a @alienamarela por conseguir traduzir para uma linguagem mais acessível um texto com tantos termos técnicos.
Cilada Cripto retweeted
Launching SDK - you’ll use the protocol as the on off ramp for your app
Building P2Pme on @solana - ofc, we are futards from @MetaDAOProject , talking every week at @ownershipfm , we have to have it
Expanding to new countries and currencies - launching Colombia on Monday, Nigeria is live, we just launched USD and EUR using revolut (use this and then send money back home), and finding leaders to start circles in all countries with instant payments around the world (dm me)
Pushing growth - all countries with daily refund campaigns, creators bounties starts next week in Mex, vez and Nigeria, hiring ambassadors and YouTube content creators, referral links give 1% from users total volume, first 100 users in new countries earn $5 refund from their first order
We are here, and we are working
Cilada Cripto retweeted
We challenged the three leading LLMs to a pop quiz on a fairly basic EVM mechanism, and all failed spectacularly. They were caught red handed hallucinating how Solidity behaves to fit a simplified world view.
This is not a one-off thing. For anything outside the common knowledge, models often just repeat what they happened to dig up in a corner of the internet, i.e. the garbage in, garbage out problem.
In an era where devs are mostly plumbers orchestrating and merging AI code, and many auditors are focusing on the latest SKILL.md to audit for them, it pays to take a step back and ask, are we moving too fast?
The same models that are confidently spouting nonsense are the ones writing much the next generation of DeFi (and most other software). How well we resist the urge to trust it and keep validating primary sources, will determine the security of future software.
Cilada Cripto retweeted
🚨 TMM/BSC-USD pool on PancakeSwap just got drained for $1.66M
The attacker played a long game, accumulated 1.9M LP tokens across 44 wallets 11 hrs before the exploit, then executed a single atomic tx to rug the entire pool
Attack tx:
bscscan.com/tx/0xdee460f775b…
Attacker LP token accumulation transactions:
bscscan.com/advanced-filter?…
Here's the full breakdown 👇
Cilada Cripto retweeted
🚨 CYBER THREAT INTELLIGENCE ALERT: ALLEGED CRITICAL COMPROMISE – CENTRAL BANK OF BRAZIL (BCB)
An offer has been detected for the sale of alleged administrative access (unverified) to the portal sta.bcb.gov.br—a critical hub for the Financial System Network (RSFN) and the PIX payment ecosystem in 🇧🇷 Brazil.
👤 Threat Actor: pstipwner
📍 Target: Central Bank of Brazil (BCB) / PSTI (Information Technology Service Provider)
🔑 Incident Type: Network access sale / Alleged administrative credential breach.
📉 Verification Status: PENDING. No definitive technical samples (PoCs) have been published, although the actor claims to have established persistence and alleges prior sales of certificates.
Monitor:
analyzer.vecert.io
#Cybersecurity #PIX #CentralBank #Brazil #ThreatIntelligence #PSTI #CyberAttack #VECERT #DarkWeb #InfoSec #UnverifiedAllegation
Projetos crescem e a mentalidade da equipe parece que diminui
We just finished a deep forensic breakdown of the Drift Protocol $285M exploit.
This wasn't a smart contract bug.
It was the most sophisticated multi-vector DeFi attack we've analyzed: oracle manipulation + social engineering + Solana primitive abuse + governance capture.
Here's what ACTUALLY happened. [1/12]
Cilada Cripto retweeted
Most protocols hit a wall when they try to go global. Operations become the bottleneck. You hire more people, add more processes, create more overhead. Before you know it, you're running a traditional company instead of building a protocol, or as Sheldon told me: 'let's not create an empire.'
When we launched @p2pdotme in Brazil (@p2pmebrasil) and Argentina (@p2pmeargentina), we saw this firsthand. We recruited merchants, onboarded them, handled disputes, managed liquidity. As we grew, we hired people to help. Then more people. Then more processes. And at some point, we realized: this doesn't scale.
Every new country means new languages, new payment rails, new regulations, new cultural nuances. If we tried to manage all of this from a central team, we'd need hundreds of people. We'd be slow. We'd make mistakes. We'd burn cash. More importantly, we'd be building a company, not a protocol. And that's not what P2Pme is meant to be.
Circles of Trust is this new technology that we designed for scaling P2Pme to every country without scaling our team linearly. Here is how it works:
Centralized operations are a trap. You think you're building efficiency by keeping control. But what you're actually building is a bottleneck. Every decision flows through you. Every new market depends on your bandwidth. Every problem lands on your desk. The central team becomes the limiting factor in growth.
So how do we remove this bottleneck? How do we scale operations while staying lean? The answer: parallel computing.
In computing, parallelism means running multiple processes simultaneously instead of sequentially. It's how modern systems handle massive scale.
We applied the same concept to operations. Instead of one central team handling every market sequentially, we enable multiple independent operators to run their own markets in parallel. Each operator manages their own circle, a network of merchants serving a specific region or community. They recruit merchants, ensure liquidity, handle local operations. All independently. All simultaneously.
One central team managing 50 countries is slow, expensive, and bottlenecked, however 50 independent operators managing their own circles with 100 merchants each is fast, efficient, and parallel. This is Circles of Trust.
A Circle is a community-operated network of merchants, managed by a Circle Admin, that are typically local P2P traders who already understand their market. They know the payment methods, the local dynamics, the trusted players. They're not employees. They're independent operators with skin in the game. They recruit and onboard merchants in their region. They ensure liquidity is available for users. They maintain operational standards defined by the protocol, they build their own community of trusted merchants, and they earn directly from their work.
Circle Admins receive 0.2% of all transaction volume that flows through their circle. If their circle processes one million dollars in volume, they earn two thousand dollars. Simple. This aligns incentives perfectly. The more volume their circle handles, the more they earn. They're motivated to grow liquidity, onboard good merchants, and keep operations running smoothly.
Not only that, but with the most recent deploy of COT, now they can also stake capital into their circle.
When they do, they earn a portion of the merchant fees proportional to their stake. This creates additional skin in the game. They're not just operators. They're investors in their own circle's success.
Circle Admins operate with full autonomy. They decide which merchants to onboard. They manage their local community. They solve local problems with local knowledge. But they operate within protocol-defined rules. Smart contracts enforce standards. On-chain data creates transparency. The protocol handles the infrastructure: payments, reputation, limits, disputes. Local operators handle local operations. The protocol handles global infrastructure.
This separation changed everything for us. It means a Circle Admin in Nigeria can build a thriving network of merchants using local bank transfers, while another in Philippines focuses on Instapay payments and another in Colombia manages their local community. All running in parallel, all independently, all without the core team being involved in day-to-day operations.
With Circles handling local operations, what does the global team focus on? Automation. AI. Removing humans from the loop. How do we make this protocol run with fewer people, not more?
That means automating repetitive processes. Every manual task we eliminate is a task that can't become a bottleneck. It means building AI-powered customer support, so users get instant help, 24/7, in any language, without waiting for a human to wake up in the right timezone. It means developing AI-assisted dispute resolution that analyzes transaction patterns, flags anomalies, and suggests resolutions faster and more consistently than manual review. It means creating intelligent analytics that help us understand what's happening across all circles in real-time, spotting problems before they become crises. And it means building better tools for Circle Admins so they can do more with less effort.
These are perennial contributions. They compound over time. Every automation we build makes every circle more efficient. Every AI model we train makes the protocol smarter. The goal is simple: make P2Pme less human-dependent every single day. Not because we don't value people, but because we want the protocol to be anti fragile. We want it to work even when the team is asleep. Even when no one is watching. That's what a real protocol looks like.
Most crypto projects talk about decentralization but run like traditional startups, with centralized teams making all decisions and handling all operations. Circles of Trust is our answer to a fundamental question: how do you actually decentralize operations? Not just decentralize the ledger. Not just decentralize governance. But decentralize the actual day-to-day work of running the protocol.
The result is a system that scales without linear headcount growth. It adapts to local markets through local expertise. It aligns incentives between operators and the protocol. It reduces single points of failure. It becomes more resilient over time, not more fragile.
Circles of Trust isn't just an operational model. It's a philosophy. Trust local operators to handle local operations. Give them autonomy and direct economic incentives. Build global infrastructure that empowers them. Automate everything that can be automated. Use AI to handle what humans used to do manually. Stay lean at the center. Scale at the edges.
This is how P2Pme will be in every country. Not by hiring thousands of people, but by enabling thousands of independent operators to build alongside us, supported by technology that never sleeps.
Kudo's to the tech team for building such an amazing tech, now it's with operations to ship this globally.
Btw, @p2pmevenezuela and @p2pmemexico are already running on top of this.
Cilada Cripto retweeted
‼️ Telegram allegedly has a CRITICAL zero-day vulnerability.
To exploit it, a threat actor has to send a corrupted sticker to their victim.
Telegram directly addressed the claim, stating the vulnerability does not exist.
We've asked the researcher for comment — stay tuned.
Cilada Cripto retweeted
Brazil's liquidity providers organized themselves in a Telegram group with 215 members (208 LPs)
It's the most active and bonded community I've seen, 215 ppl created a FIAT rail for users to be able to move R$ in seconds, and now they're moving $2MM in monthly volume.
@p2pdotme is a community driven project.
We build communities accross all countries we operate, we provide support, assistance and allow hundreds of ppl to make an extra money supporting the network.
This is how DeFi should look like.


































