Quantum Physicist. IoT Solution Architect. Cypherpunk.
Joined August 2017
- Tweets2K
- Following1.5K
- Followers1K
- Likes9.9K
Issue explained here: github.com/spesmilo/electrum… Malicious server may replace txns with unsigned low-fee txn pointing to a different address, user might just RBF (and sign) it. Watch out.
Sebastian van Staa⚡️🌋🇸🇻 retweeted
New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)
Sebastian van Staa⚡️🌋🇸🇻 retweeted
An update to Bitcoin Core's security policy
via @darosior on the Bitcoin-Dev mailing list
🫡
Bitcoiners called it again. A few months ago, Bitcoin was the canary in the coal mine.
Over the summer, the Bitcoin ecosystem was hit first: the Coldcard firmware exploit, emergency patches at Core Lightning, and a flood of AI-generated bug reports. The base protocol held. The weaknesses were in the software built around it, and the response was a volunteer red team pointing AI at hundreds of Bitcoin repositories and fixing what it found in the open.
This week the rest of the internet got its turn. PHP2Shell, a set of flaws that had sat in PHP for over a decade, was found with frontier AI models and patched on 21 October. PHP runs roughly three quarters of the web, and governments took their own sites offline while they scrambled to update.
Bitcoin went first because it is the biggest open bug bounty in the world, and anything with money attached gets probed first. Banks, payment rails, hospitals and government databases are next, and most have relied for decades on obscurity and slow attackers. That cover is gone.
It will probably be quite painful for a while. What survives will be simpler, tougher and more honest about its own weaknesses. Stress is how resilient systems get built.
Sebastian van Staa⚡️🌋🇸🇻 retweeted
The rest of the world is waking up to the realization that all software is broken.
The Bitcoin ecosystem has run so many drills in the last 3 months that it doesn’t phase us anymore.
And even worse, as several sources have pointed out in the meantime: @Ledger casually posted about several kinds of malicious implants in their own security blog, instead of loudly sounding the alarm - eradicating any cause for plausible deniability.
ledger.com/academy/topics/le…
This is getting from bad to worse. So @Ledger was warned about their devices being tampered with several months ago already, and publicly dismissed it? xitter.cf/HeyTaiZen/status/20902…
Good news, @Liquid_BTC up and running again. Any info yet on who fronted the missing 600 BTC?
Also, they "will be added to the Federation wallet in the coming days". Not scared of a bank run happening before that?
Peg operations are resuming for @Liquid_BTC. The external security audit is complete and looks good. Additional hardening measures are also done.
Liquid users are now able to peg-out via @side_swap and @AquaBitcoin.
The ~600 BTC shortfall will be added to the Federation wallet in the coming days.
Everything is almost back to normal! 🙏🏻🌊
This is getting from bad to worse. So @Ledger was warned about their devices being tampered with several months ago already, and publicly dismissed it? xitter.cf/HeyTaiZen/status/20902…
I faintly remembered reading something like this when I set up my Ledger years ago. So I dug up the box, and sure enough, it was in there. Pretty embarassing, @Ledger, in light of the recent events 😬
CEO of @ledger's reaction to @MagicalTux's work on exposing and documenting an ongoing attack on their supply chain, what probably saved millions in potentially stolen funds. Really?
Sebastian van Staa⚡️🌋🇸🇻 retweeted
For 25 years people speculated the NSA hid a backdoor in the NIST curve seeds.
Turns out the P-256 seed was candidate #1842 from a random number generator started at 01:52:34 UTC on August 16, 1997.
Claude figured it out in under half an hour. The scariest thing AI has done to ECDSA so far is make it look less suspicious.
That's a vendetta. Omertà is the last letter of the greek alphabet.
Fck me.
so this violent criminal with a history of assault was indicted for torture + crypto wrench attacks in france.
Then he was *accidentally* released from detention over a procedural error (vice de procédure).
A few days later, he was found shot to pieces in his car in Nîmes.
Was that an omertà?
Sebastian van Staa⚡️🌋🇸🇻 retweeted
Fck me.
so this violent criminal with a history of assault was indicted for torture + crypto wrench attacks in france.
Then he was *accidentally* released from detention over a procedural error (vice de procédure).
A few days later, he was found shot to pieces in his car in Nîmes.
Was that an omertà?
🔴 Un homme lié à plusieurs agressions crypto tué à Nîmes.
Âgé de 47 ans, il a été retrouvé criblé de balles dans sa voiture après avoir été libéré pour vice de procédure. Les suspects sont toujours recherchés.
Plus d’informations dans notre article👇
cryptoast.fr/?p=229836&utm_s…
That Ledger post blew up and a lot of you wondered how to proceed from here. My answer: don’t rely on any single device or company. Here's how I set things up, whatever hardware wallet you use 🧵
I faintly remembered reading something like this when I set up my Ledger years ago. So I dug up the box, and sure enough, it was in there. Pretty embarassing, @Ledger, in light of the recent events 😬
Second, check your hardware before trusting it. Buy directly from the manufacturer, never from resellers or second-hand. If the casing allows for it, open it and inspect for suspicious parts. Generate the seed on the device yourself and run the vendor's authenticity check.