📒❔👾💣 Lunar Deity @akudreams DFZ, Ordinals, BTC 14' $PENGU $DOG not your 🔑 not your 🧀
Joined December 2020
- Tweets9.8K
- Following3.4K
- Followers1.4K
- Likes54.1K
Pinned Tweet
Hey Aku Fam!
I just put together my first @oncyber gallery! With a lil inspiration from #WoWCapacitors 🎉
@AkuDreams @WeAreAku @Micah_Johnson3
oncyber.io/rustyxavier
Rusty ᛤ retweeted
"LIQUIDATED"
a limited edition on bitcoin ordinals
an extension of my work "SUPERCYCLE" where each pixel is a recursive inscription sourced and animated through the algorithm, seeded from the inscribed satoshi.
markets go up and down. art is forever 🌊
Rusty ᛤ retweeted
A potential slip by the Binance attacker? @MetaMask should preserve whatever web2 logs they can.
The attacker sent 175M USDT to a fresh wallet.
About 2.5 minutes later, that wallet also received 2 ETH. Likely for gas, matching the pattern used with their other attack wallets.
Exactly two minutes after that, it used MetaMask's Gas Station. Despite already having gas.
Three consecutive transactions landed in the same block: an ETH top-up from Gas Station, an unlimited USDT approval for @KyberNetwork's router, and a payment of 127.67 USDT to Gas Station.
The ETH top up exactly matched the combined maximum gas budgets of the Kyber approval and the USDT payment. Down to the wei.
But they already had more than enough ETH to cover both.
My theory: they were using MetaMask Wallet and, while rushing, selected USDT for gas by mistake
MetaMask sometimes defaults like this for convenience. And the same block top-up sequence matches how their implementation works.
To use Gas Station in MetaMask you have to use MetaMask Sentinel. Meaning the transactions go through them, not a regular RPC.
That interaction probablly left offchain records with MetaMask, potentially including IP metadata.
Among all the attacker wallets I checked, this was the only one showing Gas Station usage.
The wallet: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0
Binance hot wallet drained of more than $2.5 billion in USDT, ETH, and 62 other tokens.
• Transaction was from a wallet funded by Tornado Cash on October 28th, leading me to believe it was a hack.
• Was an EIP-7702 delegation takeover followed by a batch sweep 3 and a half minutes later.
• Signature was valid meaning it could have been a stolen key or compromised signer. I didn't see any initial evidence of something like a signature verification bypass.
Transaction: etherscan.io/tx/0x53bd38b816…
Rusty ᛤ retweeted
ok safe to say binance is pwned
The biggest assets were approximately:
• 1.615B USDT
• 62.6M RLUSD
• 29,934 wBETH
• 11,372 XAUt
• 6.19M UNI
• 198.4M ENA
• 7.175T PEPE
• 27.8M USD1
• 2.26M LINK
• 127,853 AAVE
about $2.5B at the explorer’s prices.
1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC.
2. About four hours later, the relayer submitted an EIP-7702 authorization transaction
That installed the malicious 7702 delegate code on Binance 14.
3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances.
4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth).
5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool
• The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days.
• The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep.
• The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA
• That EOA has only one transaction and currently holds the 195,460 ETH.
What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all.
So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow.
I think we can go ahead and assume DPRK.
Rusty ᛤ retweeted
THE BINANCE HACK IS NOW UP TO $5.84 BILLION
CZ IS POSTING THAT USER FUNDS ARE "SAFE" THE SAME WAY SBF DID RIGHT BEFORE FTX COLLAPSED
WITH A HOLE OF THIS SIZE BINANCE COULD BE INSOLVENT
NOBODY KNOWS WHAT BINANCE'S LIABILITIES ARE
WITHDRAW YOUR FUNDS FROM BINANCE NOW!!!!!!!!!
Rusty ᛤ retweeted
Anyone using the @MetaMask browser extension should be aware that a potentially dangerous feature was added last week without your permission
The MetaMask extension now directly makes inline edits to websites that you visit like X
It now replaces cashtags on X with a widget that in the case of $DOG points to the incorrect coin potentially causing users to buy a scam instead of the real $DOG
Additionally this feature introduces risks such as third-party page injection on X and relaxes CSP frame-ancestors which increases the surface area for exploits and hacks
At a minimum MetaMask should make this feature opt in only
However in my personal opinion they should kill it entirely
Why would the MetaMask extension have access to read and edit every webpage I visit which has potentially massive privacy and security implications?
At a time when security incidents are at an all time high in crypto MetaMask should be focusing on how it can increase the security and privacy of their users rather than launching features that nobody asked for and that makes them less safe
Rusty ᛤ retweeted
Shoutout to the over 1,000 $DOG soldiers who tuned in to the $DOG Army Town Hall yesterday!!!!!!
The $DOG Army is a global movement that spans many time zones so the space was recorded for anyone who couldn't attend live 👇
xitter.gq/i/spaces/1jxXgBNApzNJZ
Rusty ᛤ retweeted
If this gets 1,000 reposts maybe @opensea will add support for Ordinals and Runes?
Rusty ᛤ retweeted
When I first created Aku, all I wanted to do was make a movie. That was the dream. And it happened fast.
A few months after introducing my character Aku to the world, I optioned the film rights. It was splashy and kinda surreal. I was taking Zoom calls with folks in Hollywood from Indiana. I knew NOTHING about that world.
In my head, it was already a smash hit. Frozen numbers. (That’s just how my brain works.) Dope animation. A cold soundtrack. Star-studded cast.
Kids would watch it. Love it. Watch it again. Then come the toys, games, video games. Whatever Spider-Man was on, I wanted to be on.
Except I did something crazy.
I let the deal expire.
I wasn’t ready. I didn’t even have a story. Just a character in a helmet. Hollywood moved on.
What felt like the end of a dream sent me down the most laborious, unglamorous, least lucrative path.
Chapter Books.
And it was on this path, I rediscovered something I hadn’t really thought about since I was a kid.
With a movie, I’d be the architect of Aku’s world. Kids get to visit. But everything is exactly how I want it.
With a book, they help create it.
Trae sounds like their classmate. Aku sounds familiar. His school reminds them of theirs. Their own experiences fill in the spaces between the pages.
There’s ownership in that.
There’s pride in finishing a book.
Shoot, there’s pride in just starting a book!
Books. man. They’re amazing.
Every day I get messages about kids reading Aku. Either together. Alone. In classrooms. Book clubs. In their free time.
And behind so many of these kids is an incredible network of people who believe in them. My Friends, companies, and complete strangers have helped put thousands of Aku books into their hands.
Right now, there’s a NYC public school book club going on where kids have been showing up virtually every week, at night, all year. Teachers read digital copies of the book on the screen so kids don’t feel pressure to buy a book.
This semester they’re reading Aku and it’s the first time each member got their own physical copy. 100 kids.
The joy I feel watching kids make Aku their own has surpassed anything I imagined when I first dreamed of making a movie.
I still dream of an Aku movie.
But if it never happens, I’m good.
Really good.
Rusty ᛤ retweeted
🚨Do not connect your wallet to anything today
A huge PHP bug leaked before the fix & hackers are already using it. This isn't just Japan, sites worldwide are switching themselves off
Some crypto websites run on WordPress, which runs on PHP. Project sites, token claim pages, airdrop pages, blogs & even wallet download pages could be targets
If one gets taken over, the connect wallet button can be swapped for a drainer, or the download link for a fake app, & you’d never know
Your wallet app itself is fine. The danger is the sites you connect it to
How to stay safe:
- Don't connect or sign anything on new sites today
- Skip any claim or airdrop page for now
- Ignore any “urgent security update” email or DM
- Only download wallet apps from the official app store
- Keep your main funds in a wallet you don't connect anywhere
No crypto site confirmed hit yet, but I'm not taking chances today
Rusty ᛤ retweeted
"If you want Ordinals, which I know many of you do, please continue just letting us know, being loud… that very much directly informs our product roadmap"
-@zjbrenner
REPOST IF YOU WANT ORDINALS ON OPENSEA!!!!!!!!
Rusty ᛤ retweeted
There’s a cascade of hacks happening right now across an untold amount of interlinked vulnerabilities, stay safe!
Rusty ᛤ retweeted
Minting Fusion was an experience: choosing sats + its link to Fragments with @GabrielJWeis.
Art and experience first; future value is a calculated risk, not a short-term floor obsession.
Love your community and the longtime @OnChainMonkey crew.
Rusty ᛤ retweeted
ordinals are in tough spot..
attention, volume, excitement is down
several key players—ordinalsbot, ord io closed up shop. not to mention magiceden..
if you are still here I commend you.
ordinals are an important movement in decentralization, art, and culture
in many ways it’s just getting started
onward 🫡
Rusty ᛤ retweeted
Announcing the newly upgraded, updated, and refurbished OrdiGallery experience.
This new build elevates your OrdiGallery experience.
A brand new premium experience awaits those who hold a Bird of a Feather or an OrdiGallery Pass on BTC (with so many Easter Eggs to enjoy). 🧵
Rusty ᛤ retweeted
The 3JS development for @TheGodPull has been going really well. A key bonus to deep diving advanced 3D web interactive and backend systems is that the frameworks I’ve now built apply to @Deadfellaz and by extension all interactive plans tied to DFZ IP. Soon to be DFZ SZN. 🙂💀👻
