security SE @blockaid_ - solidity - crypto trader 🇮🇹🍕
Joined January 2016
- Tweets1.1K
- Following428
- Followers365
- Likes1.4K
tga.eth retweeted
The Last Signature: How to prevent a Binance style exploit with the @blockaid_ Cosigner
tga.eth retweeted
We are investigating a cluster of large outflows from Binance hot wallets that began at approximately 20:24 UTC on 29 October 2026. On-chain, the transfers look consistent with unauthorized movement from those wallets, but this has not been confirmed by Binance, and we cannot yet rule out an internal treasury or operational sweep.
Observed chains: Ethereum, Arbitrum, and Avalanche, with related receipts also visible on Optimism.
Observed scale (approximate, still being reconciled):
Ethereum: about $2.5 billion from Binance 14 and Binance 16, plus an additional 780,000,000 USDC from a Binance smart account
Arbitrum: about 8,426 ETH (~$19.5 million)
Avalanche: about 1.81 million AVAX and 8.4 million USDT (~$24 million)
Affected Binance wallets include:
Ethereum Binance 14: 0x28C6c06298d514Db089934071355E5743bf21d60
Ethereum Binance 16: 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d
Ethereum smart account: 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055
Arbitrum Binance 56 / Hot Wallet 1 / Binance 89: 0x1b5b4e441f5a22bfd91b7772c780463f66a74b35, 0xf92402bb795fd7cd08fb83839689db79099c8c9c, 0x3931dab967c3e2dbb492fe12460a66d0fe4cc857
Avalanche Binance 49 / 85 / 110 / 118: 0x9f8c163cBA728e99993ABe7495F06c0A3c8Ac8b9, 0x6D8bE5cdf0d7DEE1f04E25FD70B001AE3B907824, 0xABa2D404C5C41da5964453A368aFF2604Ae80A14, 0x3BCE63C6C9ABf7A47f52c9A3a7950867700B0158
Primary collection address (same across the affected chains): 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
Further destination wallets currently holding a large share of the funds include: 0x9749292D74Fd460982d0912eA9515EA24736C762, 0x0Ddf0480016e6bCb2C1F5d190D221FBA1320697e, 0x8532fa14acaf483729c449b8458aeddb900543d4, and 0x8d53903625b8e839b9DF4bd28B0EFb1CD6b8639A.
We recommend treating this as unconfirmed until Binance issues an official statement. We will update as we verify more.
tga.eth retweeted
Introducing Blockaid's Risk Exposure:
A real-time onchain compliance solution that lets organizations monitor addresses, transactions, and act the moment they're exposed to illicit funds.
Powered by Blockaid’s first-party signals to make policies programmatically enforceable.
tga.eth retweeted
Update on the NPM attack: The attack fortunately failed, with almost no victims.🔒
It began with a phishing email from a fake npm support domain that stole credentials and gave attackers access to publish malicious package updates. The injected code targeted web crypto activity, hooking into Ethereum, Solana and other chains to hijack transactions, and replacing wallet addresses directly in network responses.
The attackers’ mistakes caused crashes in CI/CD pipelines, which led to early detection and limited impact. Still, this is a clear reminder: if your funds sit in a software wallet or on an exchange, you’re one code execution away from losing everything. Supply chain compromises remain a powerful malware delivery vector, and we’re also seeing more targeted attacks emerge.
Hardware wallets are built to withstand these threats. Features like Clear Signing let you confirm exactly what’s happening, and Transaction Checks flag suspicious activity before it’s too late.
The immediate danger may have passed, but the threat hasn’t. Stay safe.
🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.
The malicious payload works by silently swapping crypto addresses on the fly to steal funds.
If you use a hardware wallet, pay attention to every transaction before signing and you're safe.
If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.
It’s still unclear whether the attacker is also stealing seeds from software wallets directly at this stage.
Excellent report here: jdstaerk.substack.com/p/we-j…
tga.eth retweeted
North Korea hijacking multisigs is now the biggest loss category in crypto hacks.
After talking with teams and building three prototypes, I think I know the next security layer in fixing this, and it requires less from signers, not more. 🧵 1/14
tga.eth retweeted
zWallet v0.0.1 is an onchain wallet. It is fully open-source. And so simple, it fits inside an html file on @IPFS. Rooted on @ensdomains, with all of its data sourced and guarded by smart contracts. It is more secure by default.
tga.eth retweeted
In Bolivia, real prices in shops are displayed in USD₮.
A quietly revolutionary shift: digital dollars are powering daily life, commerce, and economic stability.
tga.eth retweeted
1/ gm ETH nerds
Today I am proud to announce my first EIP:
👑 EIP-7940: Ethereum Shah 👑
Inspired by @gregthegreek's recent post, we co–authored this EIP that aims to provide leadership to the currently leaderless core devs.
Thread below 👇
xitter.cf/gregthegreek/status/19…
All Core Devs need to centralize.
They need a leader who will say, NO.
They need to be told what not to do.
They need someone to shield them.
Story Time
I vividly remember hearing about EOF 4-5 years ago
I asked a simple question:
Q: How does this benefit users interacting with the chain?
A: It allows future implementations of the EVM to add those things!
👎
Cold, hard truth. Engineers are trying to solve a problem because it's fun, not because it's needed. It has some long-tail benefits, but not enough to justify the pain that it will cause.
This is a full-blown toolchain update (almost). We need to prioritize things that provide incremental wins. If the team behind EOF had spent more time improving the EVM in incremental steps (ditching EOF altogether), they could have shipped so much more, which could have, in aggregate, contributed to a 10x improvement.
Instead, they continue to fight for a proposal that was shot down ~3 times?
What has EOF done?
- Distracted ACD for the 4th time
- Delaying roadmap by jamming a MASSIVE change into core code
- Distract @ethPandaOps who will inevitably be responsible for creating an ungodly testing framework for this change
- Caused ProgPow level wars because they can't take "no" for an answer
ONE YEAR AGO in Brussels, I asked Marius "How's work?" and he responded:
> The EOF folks are back, the proposal is bigger than before.
ONE YEAR AGO - does no one see the problem here?
@tkstanczak @hwwonx This is the hardest role to hire for, but it needs to be done. That or one of you will need to step up and actually own this. It's clear @VitalikButerin, and we shouldn't force him to, he's better on the research side. Someone needs to run DAY-To-DAY ops/product on ACD.
It's exhausting.
Let the devs ship.
Stop the politics.
Turn the ship around.
Please 💕
especially when interacting with perpetuals markets👀
Quick Audit Tip 💡
When a project calculates variables like PNL, debt, etc., make sure you understand exactly how they work and they origin:
♦️How is PNL accumulated? How is debt accumulated?
♦️In which tokens are they calculated? How often are they updated?
♦️Are they immediately added to your account or later?
♦️Are this values tracked separately? Is mismatch possible?
Always track the origin of every variable. Even if you need to grind the external integrations.
It should be no wholes in your knowledge regarding specific values and the protocol as a whole.
Don’t look for a patterns, look for a deep understanding
Goated content.
Want to become an elite web3 security researcher?
Guardian founder @0xOwenThurm has a free, advanced course that will teach you everything about mastering web3 security.
Start with Part 1 — link below! 👇
If a codebase is heavily dependant on Oracle implementation, it's one of the first things i love diving into when starting a new audit.
It's the 2nd most common attack vector just behind private keys hack.
A lot of protocols fail to implement best practices in oracles.
tga.eth retweeted
Did you know that we host the most comprehensive and in-depth resource available on Solidity proxy patterns?
It teaches everything from how delegatecall works to how the diamond pattern works -- and includes practical knowledge like how to deploy and manage proxies using the OpenZeppelin Foundry upgrades plugin.
The Book of Proxy Patterns is 20 chapters long and gets very deep into the specifications and the OpenZeppelin implementations.
It only assumes a basic knowledge of Solidity. The book is not an EVM course, but it teaches just enough EVM internals to truly understand the logic behind the proxy patterns.
Completely free with no login, as usual. Link in the reply.
Man, i just found a CRIT and this is how i feel.
Also this music started playing in the background:
open.spotify.com/intl-it/tra…
Very excited to start a trial audit week with @GuardianAudits @0xOwenThurm thanks for the amazing opportunity.
A hunter must hunt🔫
tga.eth retweeted
In security research, hard work beats natural talent.
Success isn’t just about being smart - it’s about relentless effort, continuous learning, and consistency.
The ones who stay consistent are the ones who go far.
Cursor is THE GOAT👀 when it comes to understanding complex codebases with variable names that aren't easy to understand.
Every developer has it's own naming criteria, and when it comes to auditing other developer's code it's crucial to get a great understanding of it.
Another day, another audit competition.
Writing a PoC for @PinLinkAi contest on @sherlockdefi
First time with Sherlock's platform, very curious on how this turns out, i've been told Sherlock judging is not for the weaks, and can get you rekt pretty easily.
