
Web3 threat intelligence @BlockmageSec (opinions my own). Privacy is a human right. #InfoSec
The Ether
Joined October 2021
- Tweets2.6K
- Following4.8K
- Followers2.1K
- Likes3.1K
Pinned Tweet
Canceled this shit too.
Replying to @FCC
@FCC Fuck you.
fcc.gov/supplychain/coveredl…
fcc.gov/document/fcc-updates…
docs.fcc.gov/public/attachme…
You guys are fucking retarded. Banning routers? That's cute. I'm done with this shit. This post will get no attention anyway.
The bifurcation of the web into two distinct sides: The corporation-ridden, AI slop-infested, big shopping mall for idiot normies — and the "real" internet, what Eleanor Saitta was talking about with this lovely quote:
"The dark web is just the part of the web that hasn't been colonized by the state yet."
Everyone who knows what the fuck they are doing, congratulations: You are smarter than the vast majority of these idiots running the country, and you can exist in the real underworld online. I'm out. See you there.
Fucking. Retards.
If Google is already using ZK proofs to hide their optimizations, you can bet the NSA/GCHQ are doing the same. We might already be in a "post-quantum" world where certain actors can derive keys, and they just haven't gone loud yet.
(on Google Quantum AI Paper)
> They’ve optimized Shor’s algorithm specifically for elliptic curves. It now theoretically requires only ~1,000 logical qubits to recover a private key from a public key. On a superconducting system, this could take minutes.
GG.
Today is a monumentous day for quantum computing and cryptography. Two breakthrough papers just landed (links in next tweet). Both papers improve Shor's algorithm, infamous for cracking RSA and elliptic curve cryptography. The two results compound, optimising separate layers of the quantum stack. The results are shocking. I expect a narrative shift and a further R&D boost toward post-quantum cryptography.
The first paper is by Google Quantum AI. They tackle the (logical) Shor algorithm, tailoring it to crack Bitcoin and Ethereum signatures. The algorithm runs on ~1K logical qubits for the 256-bit elliptic curve secp256k1. Due to the low circuit depth, a fast superconducting computer would recover private keys in minutes. I'm grateful to have joined as a late paper co-author, in large part for the chance to interact with experts and the alpha gleaned from internal discussions.
The second paper is by a stealthy startup called Oratomic, with ex-Google and prominent Caltech faculty. Their starting point is Google's improvements to the logical quantum circuit. They then apply improvements at the physical layer, with tricks specific to neutral atom quantum computers. The result estimates that 26,000 atomic qubits are sufficient to break 256-bit elliptic curve signatures. This would be roughly a 40x improvement in physical qubit count over previous state-of-the-art. On the flip side, a single Shor run would take ~10 days due to the relatively slow speed of neutral atoms.
Below are my key takeaways. As a disclaimer, I am not a quantum expert. Time is needed for the results to be properly vetted. Based on my interactions with the team, I have faith the Google Quantum AI results are conservative. The Oratomic paper is much harder for me to assess, especially because of the use of more exotic qLDPC codes. I will take it with a grain of salt until the dust settles.
→ q-day: My confidence in q-day by 2032 has shot up significantly. IMO there's at least a 10% chance that by 2032 a quantum computer recovers a secp256k1 ECDSA private key from an exposed public key. While a cryptographically-relevant quantum computer (CRQC) before 2030 still feels unlikely, now is undoubtedly the time to start preparing.
→ censorship: The Google paper uses a zero-knowledge (ZK) proof to demonstrate the algorithm's existence without leaking actual optimisations. From now on, assume state-of-the-art algorithms will be censored. There may be self-censorship for moral or commercial reasons, or because of government pressure. A blackout in academic publications would be a tell-tale sign.
→ cracking time: A superconducting quantum computer, the type Google is building, could crack keys in minutes. This is because the optimised quantum circuit is just 100M Toffoli gates, which is surprisingly shallow. (Toffoli gates are hard because they require production of so-called "magic states".) Toffoli gates would consume ~10 microseconds on a superconducting platform, totalling ~1,000 sec of Shor runtime.
→ latency optimisations: Two latency optimisations bring key cracking time to single-digit minutes. The first parallelises computation across quantum devices. The second involves feeding the pubkey to the quantum computer mid-flight, after a generic setup phase.
→ fast- and slow-clock: At first approximation there are two families of quantum computers. The fast-clock flavour, which includes superconducting and photonic architectures, runs at roughly 100 kHz. The slow-clock flavour, which includes trapped ion and neutral atom architectures, runs roughly 1,000x slower (~100 Hz, or ~1 week to crack a single key).
→ qubit count: The size-optimised variant of the algorithm runs on 1,200 logical qubits. On a superconducting computer with surface code error correction that's roughly 500K physical qubits, a 400:1 physical-to-logical ratio. The surface code is conservative, assuming only four-way nearest-neighbour grid connectivity. It was demonstrated last year by Google on a real quantum computer.
→ future gains: Low-hanging fruit is still being picked, with at least one of the Google optimisations resulting from a surprisingly simple observation. Interestingly, AI was not (yet!) tasked to find optimisations. This was also the first time authors such as Craig Gidney attacked elliptic curves (as opposed to RSA). Shor logical qubit count could plausibly go under 1K soonish.
→ error correction: The physical-to-logical ratio for superconducting computers could go under 100:1. For superconducting computers that would be mean ~100K physical qubits for a CRQC, two orders of magnitude away from state of the art. Neutral atoms quantum computers are amenable to error correcting codes other than the surface code. While much slower to run, they can bring down the physical to logical qubit ratio closer to 10:1.
→ Bitcoin PoW: Commercially-viable Bitcoin PoW via Grover's algorithm is not happening any time soon. We're talking decades, possibly centuries away. This observation should help focus the discussion on ECDSA and Schnorr. (Side note: as unofficial Bitcoin security researcher, I still believe Bitcoin PoW is cooked due to the dwindling security budget.)
→ team quality: The folks at Google Quantum AI are the real deal. Craig Gidney (@CraigGidney) is arguably the world's top quantum circuit optimisooor. Just last year he squeezed 10x out of Shor for RSA, bringing the physical qubit count down from 10M to 1M. Special thanks to the Google team for patiently answering all my newb questions with detailed, fact-based answers. I was expecting some hype, but found none.
Alchemyst retweeted
ALERT! Our system detected a suspicious exploit targeting an unknown contract, reportedly the LML/USDT staking protocol, on #BSC hours ago, resulting in an estimated loss of ~$950K.
While the victim contract is not open-source, our analysis suggests a likely pricing-design flaw: claimable rewards appear to have been calculated using a TWAP/snapshot-based price, while the attacker was able to sell the rewarded tokens at a manipulated spot price. This inconsistency may have enabled the attacker to extract profit through price manipulation and reverse swaps.
Specifically, the attacker first used swaps, including a path with receiver = address(0), to push up the LML price in the pool. They then invoked claim through attacker-controlled addresses that had deposited earlier, making them eligible to claim directly during the attack.
Example deposit TX: app.blocksec.com/phalcon/exp…
Attack TX: app.blocksec.com/phalcon/exp…
🟦 Found by #PhalconSecurity, 🟦 Analyzed via #PhalconExplorer.
Alchemyst retweeted
Turns out another big tech company (OpenAI) was entirely funding another big “kids online safety” group, who could have predicted!! sfstandard.com/2026/04/01/op…
Are there any online/international resources to direct people to who are dealing with psychosis, especially LLM-fueled?
Our support teams have always lists of self-harm ones, gambling ones, etc. For people who come in and need more help than we can give them.
Last few months the schizo-esque delusions, often around finding some insane crit double 0day, have been really bad.
Standard crisis lines arent really what they need. Especially as they don’t self-identify as depressed or in crisis whatsoever.
But we are not what they need either.
😩
For nearly 30 years, journalists have relied on the Internet Archive to see how stories were originally published, before edits, removals, or changes. We need to safeguard that. eff.org/deeplinks/2026/03/bl…
loooool this is epic. I am not even a big Bernie fan, but I had to click on this. Honestly, something I have always thought was kind of ironic/mildly hilarious, is that AI tends to give people information like this, seemingly against the goals of the company producing it (somewhat, take that with a grain of salt; you get what you ask for, most people don't ask, or even know to ask)
youtube.com/watch?v=h3AtWdeu…
First "Background Security Improvement" and I seem to have literally just happened to look at it ~30 minutes after it was pushed ha. Anyway, kind of neat. Maybe. Now I am questioning if I want "background" updates... 🤔😆 It's probably fine.
bleepingcomputer.com/news/se…
Alchemyst retweeted
🚨 Someone lost ~$1.77M USDC after signing a phishing permit (gasless approval) signature on Ethereum. 🎣⚠️
This was on me, so I am owning this. Always a good reminder to not get excited, even when something looks really bad!
Any reports made have had follow-ups sent out to ensure that there's not any confusion or problems for the extension developers. The original post has been removed, too, with the same intention.
Alchemyst retweeted
There's a new bipartisan bill to counter the mass surveillance of Americans, but I don't see anyone talking about it.
This should be much bigger news.
It mandates warrants before the government can access Americans' web browsing history, search queries, location data, and information from connected vehicles.
It also prohibits government agencies from purchasing the private communications, location information, and other personal data of Americans from third-party data brokers.
And it bans "backdoor" searches where government officials look through information collected on non-Americans for data on Americans.
This is objectively one of the most significant bipartisan reform proposals to prevent government overreach in decades.
I think it should go further than this, but it's a good start and it's important for us to pay attention to.
Everything has changed since 9/11 and even moreso since the Snowden leak. We've lost so much of our privacy, it's gonna be an uphill battle just to get it back.
Age verification laws are really just censorship mandates clothed as child safety proposals—here’s why. eff.org/deeplinks/2026/03/re…
Replying to @TrustlessState @VitalikButerin
They build the secure platform for everyone to build anything on with no risk of censorship, etc.
You build for the real world.
Or, more likely, you sit on the sidelines and suck off overlords that sell you out bc you still don’t get this after a decade.
Alchemyst retweeted
Well, no more X app on mobile. It no longer will let me login from a @GrapheneOS device due to the attestation nonsense.
@nikitabier might as well blame you since everyone on here does 😁 but let me tell you, even though I'm a monetized creator and user for 14 years, I will choose my privacy over using X if it comes to it.
Privacy is a human right.
Alchemyst retweeted
China's biggest cybersecurity company apparently just shipped an AI assistant with its own SSL private key sitting inside the installer. Qihoo 360, think Norton or McAfee, but dominant across the entire Chinese market
It appears that their new AI product, 360安全龙虾 (Security Claw) bundles a wrapper on @OpenClaw. Inside the installer package - accessible to anyone who downloaded it - was a private SSL certificate key for the domain *.myclaw.360.cn. An SSL private key is essentially the master password to a website's encrypted connection. With it, an attacker can impersonate 360's servers, silently intercept user traffic, forge a login page that looks completely legitimate, or possibly take over the AI agent altogether. The cert is valid until April 2027 and covers every subdomain on the platform. It's now public. The founder launched the product with a promise it would "never leak passwords". It did that during release? 461 million users, a $10B valuation, and nobody checked the zip file before shipping. The cert expires April 2027.




















