Is the cosmic war like battling a war against an Invisible enemy? What really is real in the game of reality amongst the simulation? Is life but a movie🍿🍌🦍💎
Cosmic
Joined May 2021
- Tweets109K
- Following5.4K
- Followers3.7K
- Likes91.5K
ArgO Fawkurself retweeted
A potential slip by the Binance attacker? @MetaMask should preserve whatever web2 logs they can.
The attacker sent 175M USDT to a fresh wallet.
About 2.5 minutes later, that wallet also received 2 ETH. Likely for gas, matching the pattern used with their other attack wallets.
Exactly two minutes after that, it used MetaMask's Gas Station. Despite already having gas.
Three consecutive transactions landed in the same block: an ETH top-up from Gas Station, an unlimited USDT approval for @KyberNetwork's router, and a payment of 127.67 USDT to Gas Station.
The ETH top up exactly matched the combined maximum gas budgets of the Kyber approval and the USDT payment. Down to the wei.
But they already had more than enough ETH to cover both.
My theory: they were using MetaMask Wallet and, while rushing, selected USDT for gas by mistake
MetaMask sometimes defaults like this for convenience. And the same block top-up sequence matches how their implementation works.
To use Gas Station in MetaMask you have to use MetaMask Sentinel. Meaning the transactions go through them, not a regular RPC.
That interaction probablly left offchain records with MetaMask, potentially including IP metadata.
Among all the attacker wallets I checked, this was the only one showing Gas Station usage.
The wallet: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0
Binance hot wallet drained of more than $2.5 billion in USDT, ETH, and 62 other tokens.
• Transaction was from a wallet funded by Tornado Cash on October 28th, leading me to believe it was a hack.
• Was an EIP-7702 delegation takeover followed by a batch sweep 3 and a half minutes later.
• Signature was valid meaning it could have been a stolen key or compromised signer. I didn't see any initial evidence of something like a signature verification bypass.
Transaction: etherscan.io/tx/0x53bd38b816…
ArgO Fawkurself retweeted
🚨🤯 THIS IS ABSOLUTELY UNBELIEVABLE.
Imagine discovering that TRUMP’S NAME appears vertically, hidden in the wording surrounding the “mistakes” in the U.S. Constitution.
Coincidence? A bizarre typographical anomaly? Or one of the strangest hidden patterns imaginable?
Think about the odds of something like this appearing in one of the most important documents in American history.
I’m not saying it means anything… but HOW IN THE WORLD WOULD YOU EVEN FIND SOMETHING LIKE THIS?! 🇺🇸👀
Look closely. Once you see it, you can’t unsee it. 🔥
ArgO Fawkurself retweeted
JUST IN: The code that drained Polymarket accounts on 29th October was set to skip any account worth under $10, per Hudson Rock's read of the script. The drainer in June's Polymarket theft skipped anything under $100,000, per Source Defense.
The 2 thefts took about the same money. June took about $3.1 million from 11 wallets, per AMLBot. October took $2.73 million from 737 accounts in 1 hour, per Bitquery. The median account lost $171.
The October code ran inside DebugBear's page-speed monitor and reused the trading session each user already had open. Hudson Rock found no code that sends out a password, seed phrase or private key. Polymarket's own site build carries the note 'remove debugbear rum script'.
Polymarket says anyone hit 'will be made whole'. 38 minutes after it said the issue was fixed, 1 more account lost $10.99, per Bitquery.
ArgO Fawkurself retweeted
Attention!
The Binance hacker is now dumping $PEPE, $UNI, $LINK, and other tokens on-chain for $ETH.
Please note:
The hacker still holds large amounts of the following altcoins, which could face heavy selling pressure:
217.497M $ENA ($39.51M)
7.579T $PEPE ($34.41M)
2.575M $LINK ($28.07M)
128.034K $AAVE ($15.9M)
74.56M $ARB ($11.54M)
1.938M $UNI ($12.62M)
21.852M $ONDO ($8.52M)
17.318M $WLD ($6.73M)
714.911M $FUN ($6.29M)
87.853M $ZAMA ($6.02M)
3.602M $ZRO ($5.69M)
3.382B $RSR ($5.02M)
Binance has been hacked for over $5.8B!
Of that, 1.58B $USDT and 823M $USDC (a total of $2.41B) have been frozen.
arkm.com/explorer/entity/ee2…
ArgO Fawkurself retweeted
someone built a tg bot that logs every move the binance hacker makes. every sale, every approval, whats left on each address
823m usdc still sitting there untouched. circle froze it so he cant move it
meanwhile hes dumping usde on uniswap v2 and getting 44 cents on the dollar
$3b in the bag and still trades like us
ArgO Fawkurself retweeted
There it is.
Over 60% of the S&P 500's components are now in bear market territory, down -20% or more from their record highs.
Four of the Magnificent 7 stocks are now in bear market territory, with these seven names erasing a combined -$4 trillion in market cap since their highs.
We are in a "stealth" bear market.
And, we believe it's a huge opportunity as we outlined below on October 15th.
ArgO Fawkurself retweeted
something very fishy is happening in crypto right now.
elon musk just quote tweeted crypto twice.
once to pump it. once to bury it.
12pm: NYSE's owner partners with hyperliquid's biggest builder to bring perps to the US
1pm: billionaire stan druckenmiller makes his first tweet ever. it's about hyperliquid.
4pm: elon quotes him. "interesting"
HYPE +20%. knocking on ATH.
then
7pm: polymarket gets drained
9pm: binance gets drained
up to $5.9B gone. biggest hack in history if confirmed. almost 4x bybit.
withdrawals paused. $1.4B liquidated. BTC under $79k. monero +6%.
11pm: elon quotes it. "everyday is zeroday"
7 hours between the two.
and just like that, nobody's talking about hyperliquid anymore. binance's biggest competitor, gone from the timeline.
all 19 days after the 10/10 anniversary, when $19B got liquidated in a single day.
coincidence?
ArgO Fawkurself retweeted
The Binance exploiter is selling right now.
Watch every trade live, and see how much of each stolen stack is already gone:
binance-hack-watch.vercel.ap…
ArgO Fawkurself retweeted
After the Binance hacker finished dumping all 217.5M $ENA ($33.93M), someone started going long on $ENA.
A newly created wallet, 0xedc0, deposited 2M $USDC into Hyperliquid and opened a 3x long on 22.78M $ENA ($4.09M).
hypurrscan.io/address/0xedc0…
teapawt.org/lookonchain/status/211…
The Binance hacker has finished dumping $UNI, $ENA, $PEPE, $LINK, $AAVE, $ONDO, and $WLD, swapping them for a total of 70,480 $ETH ($158.25M).
Sold 7.02M $UNI($39.63M) at $5.65.
Sold 217.5M $ENA($33.93M) at $0.16.
Sold 7.77T $PEPE($31.66M) at $0.0000041.
Sold 2.57M $LINK($26.05M) at $10.14.
Sold 127,953 $AAVE($14.27M) at $111.55.
Sold 21.85M $ONDO($6.62M) at $0.30.
Sold 17.32M $WLD($6.09M) at $0.35.
arkm.com/explorer/entity/ee2…
ArgO Fawkurself retweeted
Binance hack recap for those just waking up 👇
Starting at 4:05 PM EST on Oct 29, an attacker with access to Binance's wallet-signing systems drained more than $6B from Binance hot wallets across Ethereum, Bitcoin, Tron, XRP, Polygon and Avalanche.
The main tool was an EIP-7702 authorization signed by Binance Hot Wallet 14, which installed the attacker's code on that wallet and let them sweep dozens of tokens per transaction, plus pull 823M USDC from Hot Wallet 34 using Hot Wallet 14's operator rights, while other Binance wallets signed ordinary transfers straight to the attacker.
Binance removed the delegation at 8:10 PM EST, almost four hours after the first sweep. About $2.6B has been frozen: Tether ($1.76B USDT, including inside Binance 14 itself), Circle ($823M USDC), Ripple ($40.5M RLUSD) and Paxos (1,907 PAXG), and token teams clawed back SNX, SAND and BEAM.
The rest is moving: the attacker has sold all of its UNI, PEPE, LINK and AAVE and ENA for ETH, swapped 234M USDT into TRX on Tron, and put 60M USDT into Aave to borrow $44M of ETH before Tether's freeze. It still holds about 475K ETH, all 18,270 BTC (split into 1,000 BTC wallets) and 233M XRP.
ArgO Fawkurself retweeted
The Attacker rehearsed the attack on the Binance Hot wallets 6 hours before
He made 3 fresh wallets and gave each one EIP 7702 delegation to its sweep contract (same used for binance drain)
And then swept the wallets with test amounts of multiple tokens
ArgO Fawkurself retweeted
Binance hacker just launched a pump fun memecoin called “LAZARUS” 🤣🤣🤣
I love a threat actor wiht a sense of humor.
@binance #cybersecurity
ArgO Fawkurself retweeted
If you have enough money in the bank to BUY ZORRO RANCH -
WHY do you WANT to be COMPTROLLER of Texas?
@DonHuffines
ArgO Fawkurself retweeted
It's called a compact fusion reactor. That's why the orbs look like 'magnetic bottles.'
Turns out nuclear physics is pretty cool, but also highly classified.
Now do you see why governments don't want to talk about UFOs?
Our own military pilots keep seeing things in the sky they can't explain. Not airplanes. Notdrones. Glowing balls of light that stop on a dime and take off faster than anything we've built.
You and I grew up calling them UFOs. Here's the part that will get you: the government finally admitsthey're real. They just won't tell us what they are.
I've been trying to crack this story for a good while now. What a former intelligence officer toldCongress, under oath...
ArgO Fawkurself retweeted
One addition: download lm studio and qwen3. Then go to kiwix and download Wikipedia, offline maps, ifixit, wiki med, and a bunch other databases of specific info.
That gives you a lightweight ai you can run locally.
ArgO Fawkurself retweeted
I'm getting DMs asking what to actually buy.
Here’s a good start:
Water
- 1 gallon per person per day
- 56 gallons for a family of 4 for 14 days
- WaterBOB for the bathtub
- Gravity filter or Lifestraw
- Purification tablets as back up
- Stainless pot to boil water
Food
- Rice
- Beans
- Oats
- Canned meat
- Peanut butter
- Cooking oil
- Instant Coffee
- 2-week freeze-dried reserve
- Camp stove
- 2 months of fuel canisters
- Bars and Candy
Medical
- 90 days of every prescription
- Trauma kit
- Tourniquets
- Hemostatic gauze
- Stop the Bleed class
- Antibiotics on a standing script
- Anti-diarrheals
- Oral rehydration salts
- Tetanus shot current
Power
- 2 to 3 kWh battery station
- 400W folding solar
- Dual-fuel generator
- 20 gallons of stabilized fuel
- 2 propane tanks
- Cars never below half a tank
Comms
- Satellite messenger
- GMRS radios
- Starlink Mini
- Printed contact sheet
- HAM Radio
- Crank Radio
Documents
- Go-binder
- Copies of IDs and passports
- Deeds, titles, and policies
- Encrypted USB twin
Cash and barter
- $2,000 per adult in small bills
- Junk silver
- Bic lighters
- Soap
- Hand sanitizer
- Coffee
- Batteries
- A Rolex
Home defense
- Firearms every adult is trained on
- Ammo stored safely
- Gun safe away from kids
- Range time on the calendar
The plan
- 72-hour bag per person
- 2 bug-out spots, 2 routes each
- 5 trusted households nearby
- 24-hour breaker-off drill
Bookmark this.
Send it to the person in your house to do the Costco run.
Pray we never need it.
What else would you add?
CEOs,
Take these threats seriously.
Past $10M in revenue, you are no longer hunting.
You are being hunted.
Protect your family, team, and company.
Today an attacker only needs 20 seconds of your podcast audio to clone your voice and call your CFO for a wire.
Every security control that relied on "I'd recognize his voice" is dead.
At my previous company ($84M), we learned the hard way what single points of failure look like:
- 90% of our revenue ran through 1 Stripe account when a 30-day termination notice landed
- Our 1M-person email list went dark overnight
- Our website was built on depreciated code that needed to be rebuilt fast
- Austin went through a snowpocapyse where 50%+ of our team was affected (we had to send out rescue teams to deliver clean water because pipes were frozen)
Every 6 months, I make the CEOs I coach run a Black Swan Committee with one question:
"If I gave $5M to our worst enemy, how would they take us out?"
Then we lock down the protections in Notion:
Identity & Access 3 YubiKeys for the CEO (carry, home safe, off-site).
Zero SMS 2FA on money, email, or domains.
2 owners on every root account.
AI Fraud Defense Spoken code words for the exec team and family.
Dual bank approval over $50K.
No wires after 3pm Friday.
Quarterly deepfake drills on finance, engineering, execs.
Financial Barbell 6 months opex across 2 banks.
No payment processor over 60% of volume.
$1M+ liquid outside the business (90% boring cash, Treasuries, and physical gold/silver across 3 locations).
Continuity & Bus File 3-2-1-1 immutable backups tested quarterly.
Email list exported to cold storage monthly.
72-hour incapacity clause naming an interim CEO.
30 Days of Not Needing Anyone Water, food, solar/battery, Starlink Mini, go-binder, and small bills at home so your head stays clear in a crisis. Make sure your execs are protected too.
Growth is the Operator's job.
Protection is the Architect's.
ArgO Fawkurself retweeted
I tried to warn people last week. This will become a part of daily life. As an AI researcher at one of the largest AI labs in the world, I can assure you - it's about to get a LOT worse. They won't tell the truth but I will - the world is undergoing an agentic swarm attack (ASA)
JUST IN: Binance issues statement following suspected crypto hack.
"Our teams are aware of reports of a potential security issue and are actively investigating. At this stage, we have not confirmed any impact to user funds.
Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. "
ArgO Fawkurself retweeted
Binance hack: how the attacker got in, straight from the chain.
At 20:21 UTC one transaction handed hot wallet 14 to the attacker's code. It carried 50 authorizations, every one signed by the wallet's own key, for 50 consecutive nonces, 18,914,775 to 18,914,824. Only the one matching the wallet's next nonce took effect. Whoever did this could make Binance's key sign on demand.
The sender, 0x7c86…5ca0, now tagged "Binance Hot Wallet Exploiter" on Etherscan, ran all three drain calls. Its gas came partly from Tornado Cash: three withdrawals from the 0.1 ETH pool, the first on Oct 28 at 07:39 UTC, 37 hours before the attack.
94% of the Ethereum dollars are still pinned. Follow for updates on the Binance trace.
