Lead security researcher at @coinspect. Making computers safer to use for +10 years while having some mate🧉.
🇦🇷 - 🇺🇾
Joined April 2020
- Tweets1.2K
- Following195
- Followers178
- Likes2K
0xM3GANbabe retweeted
Great to see our own JoaquĂn Pereyra @0xmatebabe on stage at @summit_defi in Mumbai! 🇮🇳
He shared the story behind Ill Bloom, the BIP39 wallet-generation vulnerability we investigated, the challenges of responding to it, and Unlukey, our initiative to help protect users from weak seed generation.
Thanks to everyone who joined!
0xM3GANbabe retweeted
Meet DSS 2026 speaker @0xmatebabe.
“Ill Bloom: Finding and Responding to a Wallet-Generation Flaw That Exposed Millions”
Open a talk and save it to your agenda.
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Joaquin Pereyra: Ill Bloom: Finding and Responding to a Wallet-Generation Flaw That Exposed Millions
Excited to start working more closely with @Ledger!
Coinspect is now a Ledger security audit partner for Ledger wallet apps!
As one of Ledger's approved audit partners, we bring our crypto and embedded security expertise to help developers find and fix vulnerabilities before release.
Building a Ledger app? Let's talk.
71
0xM3GANbabe retweeted
Coinspect is now a Ledger security audit partner for Ledger wallet apps!
As one of Ledger's approved audit partners, we bring our crypto and embedded security expertise to help developers find and fix vulnerabilities before release.
Building a Ledger app? Let's talk.
0xM3GANbabe retweeted
1/ We've been making steady progress on DappFence.
The goal is simple but ambitious: dApp users shouldn’t have to blindly trust whatever content and code intermediate providers serve. The browser should be able to verify that the frontend is authentic.
0xM3GANbabe retweeted
Unlukey is basically "Have I Been Pwned" for crypto wallets.
Paste any blockchain address → instantly see if it was generated from a weak seed that attackers can brute-force.
Your addresses never leave your device.
Check yours👇
🤖 Made with AI
0xM3GANbabe retweeted
CryptoJS versions <4.0.0 can generate cryptographic secrets with dangerously weak randomness.
The risk persists through downstream dependencies, and updating alone does not protect previously generated keys or seed phrases.
New CVE requested.
GitHub advisory: github.com/brix/crypto-js/se…
"The underlying CryptoJS randomness vulnerability had existed for twelve years, had been fixed six years earlier, and had been publicly discussed multiple times..."
Blockchain is not new anymore. Old bad decisions can come back to byte us, and real funds are at stake now.
⚠️The full Ill Bloom technical disclosure is live: how a 12-year-old randomness flaw made seed phrases predictable, how we found vulnerable wallets, and what we learned investigating it during active exploitation.
coinspect.com/blog/ill-bloom…
79
0xM3GANbabe retweeted
From an MCP session ID to another user’s Terraform credentials: Juan Pablo MartĂnez Kuhn, who leads Coinspect’s consulting team, uncovered CVE-2026-16496, a high-severity flaw in HashiCorp’s Terraform MCP Server.
🚨 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.
Veeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.
HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.
Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.
See what needs patching: thehackernews.com/2026/08/ve…
0xM3GANbabe retweeted
Useful for wallet security researchers: as part of our testing, we generate and retain seeds from each software wallet.
Some recovery phrase generation vulnerabilities can be identified directly from the mnemonics.
These are test seeds. Never use them.
0xM3GANbabe retweeted
📢We are introducing the Wallet Security Framework (WSF): an open-source resource for evaluating web3 wallet security.
WSF brings together:
• WSC: Wallet Security Controls for white-box reviews
• WSB: Wallet Security Benchmark for black-box testing
0xM3GANbabe retweeted
⚠️ Ongoing Ill Bloom-related Bitcoin drain.
Funds are moving from lower-balance addresses in the affected set to:
bc1phdwxpx7x5z6mkrzppwgqxd4l797w2p6saj39q558wqcgw5766cwsk9rzlf
Higher-balance victims are being drained to separate destination addresses.
If your address appears in Ill Bloom, move remaining funds.
Please monitor and flag.
0xM3GANbabe retweeted
Huge thanks to Christian Reitter from the Milk Sad project for the thoughtful feedback and for sharing lessons from a previous wallet entropy vulnerability disclosure.
It helped us think more carefully about how to communicate this responsibly.
milksad.info/posts/research-…
At @coinspect we've been working on Ill Bloom for weeks. We know funds are still at risk. Our priority is to warn users before they become victims.
Check if your address is in the vulnerable set at illbloom.org and read more about more steps you can take.
4
105
0xM3GANbabe retweeted
Today we are publishing the first Ill Bloom findings: affected-address checker + on-chain analysis to help users identify exposed addresses and protect their assets.
đź”— illbloom.org
⚠️ We will never ask for seed phrases, private keys, signatures, or approvals, or ask users to send funds to "recover" or protect a wallet.
0xM3GANbabe retweeted
Using public blockchain data we identified the root cause of the Cardano ADA wallet drain affecting SecondFi (@secondfiapp) users.
We confirm this was not a classic broken PRNG issue, but a flaw in the signing process that exposed affected private keys.
The recommendations from our latest post still fully apply:
• Follow SecondFi’s official channels and support ticket system.
• Updating the app or re-importing the same seed/private key into another wallet does not make affected keys safe.
Detailed recommendations are in the linked post.
0xM3GANbabe retweeted
Weak randomness does not just put one account or address at risk. It makes every recovery phrase generated through the affected process searchable by attackers.
A weak seed stays weak forever.
Preliminary notes from our ongoing research:
coinspect.com/blog/weak-wall…
0xM3GANbabe retweeted
To wallet developers:
We are investigating weak seed generation associated with a wallet supporting EVM, Bitcoin, and other chains since 2018.
Evidence points to a JavaScript/React Native/Expo mobile wallet.
It does not appear to be a widely used wallet, based on observed scale, but users could still be at risk.
If your wallet matches this description, please contact us.
0xM3GANbabe retweeted
🚨 Attackers are exploiting a flaw in wallet generation to drain addresses created as far back as 2018, even if completely dormant.
Unexplained missing funds? Treat your recovery phrase as compromised.
Move remaining assets to a new wallet and recovery phrase.
Check all chains!
0xM3GANbabe retweeted
Thanks to @Giveth, @thedaofund, and the Ethereum community for backing our Wallet Security Ranking in the QF Round.
We're proud to be part of this ecosystem-wide effort.
We'll keep shipping transparent and open resources that help improve web3 end-user security — with more public goods to come.
