i talk about security i explain crypto. i talk about life also i'll block you if you don't have a cold wallet Telegram: Bala_ibb. Building @Astraeus_AI

knowledge is wealth
Joined October 2018
Keyloggers are the most common spyware hackers use on crypto people It runs silently on your device and records everything you type Passwords. Seed phrases. Everything If you're infected you're cooked The only fix is to reinstall your OS or get a new device.
12
17
1
130
85,723
they’re calling it “Black October” and i don’t think people realize how serious this is in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours any ONE of these would normally be the biggest story of the year PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10 Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26 Java: also compromised. three of the most used programming languages on earth hit at the same time GitLab: a perfect 10 out of 10 severity hole in every version since 2014 Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed Signal: a bug that could leave your mic and camera on after you hang up WordPress: hackers stole a plugin maker’s keys and planted backdoors on websites LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer and that’s not even half the list thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you haven’t already this is not a normal week on the internet. this is something different
94
373
44
2,005
107,114
railway just got compromised and this one might affect YOU directly if you use openai, claude, stripe, or openrouter and your API keys were stored on railway those keys may have been exposed attackers with your API keys can run up charges on your openai and claude accounts, process payments through your stripe, and route requests through your openrouter railway says they’re investigating but here’s what you should do right now if you used their platform: rotate every API key that was stored on railway. don’t wait for their full report. rotate now check your billing on openai, stripe, and any other service connected through railway for unexpected charges revoke old keys and generate new ones. the old keys should be treated as compromised “we can confirm all our customers’ money and data are safe” is the same line every company uses right before we find out they weren’t secure your keys first. read the report later
7
5
23
2,353
a critical vulnerability was just discovered in PHP. the language that runs 80% of the internet severity score: 9.2 out of 10. that’s about as bad as it gets what can an attacker do with this? take full admin control of a server. steal entire databases. passwords, credit cards, payment histories. plant malware and use the server to attack other systems but here’s the terrifying part that most people missed the moment the patch drops tonight attackers are expected to use AI to reverse engineer what was fixed within 15 minutes 15 minutes. that’s the window between the fix going live and automated attacks launching worldwide every online store, booking site, and corporate system running PHP that doesn’t update in those 15 minutes becomes a target this isn’t just a developer problem. if you’ve ever signed up to a website, entered your card details, or created an account online your data is sitting on servers that might be vulnerable right now and someone just publicly dropped the working exploit on twitter before the patch was even ready. gave every attacker on earth a head start engineers worldwide are pulling all-nighters tonight to patch their systems before the attacks begin change your passwords on any service that matters to you. enable 2FA everywhere. and watch out for fake “maintenance” or “password reset” emails over the next few days the internet is about to have a very long night
234
2,329
300
20,574
1,435,373
this security researcher just dropped two unpatched critical vulnerabilities on twitter for everyone to see. before a fix even existed CVEs that let attackers take over servers through PHP’s session handler. fully weaponizable. lab tested. working exploit and they posted it publicly. on twitter. while millions of servers are still vulnerable other researcher is furious saying he should be blacklisted from the industry for life this is the debate nobody outside of security understands responsible disclosure means you report the bug privately, give the team time to fix it, THEN go public this person skipped all of that and dropped a loaded gun on the timeline for anyone to pick up every script kiddie on earth now has a working exploit for a bug that hasn’t been patched yet “but the public deserves to know” sure. and now every attacker knows too. before the fix is ready there’s a difference between transparency and recklessness. this was recklessness
This quoted post is unavailable.
44
647
52
4,645
521,140
Bala 🧤 retweeted
cellebrite can now unlock your iphone remotely from 8 meters away, no physical access needed iPhone 11 through 16. even with stolen device protection turned on remember when zachxbt said use a dedicated iphone instead of a hardware wallet because it's safer? someone with this device just needs to be within 26 feet of you and your phone is open at a conference. at a coffee shop. in an airport. sitting next to you on a bus they don't need to touch your phone. they don't even need to be close enough for you to notice them and this is a tool being sold to law enforcement and forensic labs. right now. commercially available if it's available to governments it's eventually available to everyone else your iphone was never a vault. it was always just a phone with a better lock. and now even that lock can be picked from across the room
‼️ A leaked Cellebrite flyer shows forensic labs a remote iPhone unlock appliance with a range of about 8 metres. It covers the iPhone 11 to 16, even with Stolen Device Protection on. The blogger who got it suspects a Bluetooth bug Apple quietly patched.
82
602
33
3,312
303,364
good morning
13
1
16
1,343
claude AI caught a hidden cryptominer on someone’s mac while building a completely different app. by accident the user asked claude to build a temperature monitoring tool. the CPU readings came back insanely high so claude investigated on its own found XMRig running silently in the background. 12 CPU cores maxed out. chip at 112°C the user had no idea their computer was mining crypto for someone else this whole time. thought it was a hardware issue the AI wasn’t asked to find malware. it was building an app and stumbled into it because the numbers didn’t add up we’re at the point where AI catches threats faster than your actual antivirus does
❗️ A Mac user says Claude Code was building them a temperature monitor app when it found a cryptominer using 12 cores. The readings looked too high, so it checked the CPU and found XMRig at ~1175%, with the chip at 112°C.
4
1
17
1,691
revolut again bro data breach that leaked names, addresses, passport photos, and crypto transaction history. a few weeks ago a guy potentially got robbed at knifepoint for $800K because of that leaked data. last week now a service disruption affecting millions of users today. “your money and data are safe” they say at this point how many times does revolut have to be in the news for the wrong reasons before people start asking serious questions your data gets leaked. your service goes down. and all you get is “we apologise for any inconvenience” an $800K robbery is not an inconvenience bro
We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience caused.
16
7
1
69
11,049
cellebrite can now unlock your iphone remotely from 8 meters away, no physical access needed iPhone 11 through 16. even with stolen device protection turned on remember when zachxbt said use a dedicated iphone instead of a hardware wallet because it's safer? someone with this device just needs to be within 26 feet of you and your phone is open at a conference. at a coffee shop. in an airport. sitting next to you on a bus they don't need to touch your phone. they don't even need to be close enough for you to notice them and this is a tool being sold to law enforcement and forensic labs. right now. commercially available if it's available to governments it's eventually available to everyone else your iphone was never a vault. it was always just a phone with a better lock. and now even that lock can be picked from across the room
‼️ A leaked Cellebrite flyer shows forensic labs a remote iPhone unlock appliance with a range of about 8 metres. It covers the iPhone 11 to 16, even with Stolen Device Protection on. The blogger who got it suspects a Bluetooth bug Apple quietly patched.
82
602
33
3,312
303,364
the amount of people in crypto who use the same password for their email, their exchange, and their wallet is genuinely terrifying one breach and everything falls like dominoes
13
1
40
1,572
Bala 🧤 retweeted
a VPN couldn’t save this kid from the FBI. one phone number brought the whole thing down he swatted a girl’s home for years. threatened to firebomb it on discord. thought his VPN made him invisible the FBI caught him because his discord account was registered to his real phone number they matched the IP addresses from his verizon account to his discord login times. same IPs. same timestamps. same person bro had a VPN running the whole time and it meant nothing because his phone number connected every single dot a VPN hides your browsing. it doesn’t hide the phone number you signed up with a VPN without OPSEC is just expensive false confidence
❗️ The FBI arrested an 18-year-old it says swatted a girl's home for years and threatened on Discord to firebomb it. He used a VPN, but his Discord account was registered to his own phone number. He has pleaded not guilty.
24
73
4
707
202,560
papertrade just told their community they can’t transfer or sell their tokens. wrapped it in a 1,000 word essay so nobody would notice let me translate what they actually said in plain english “we’re making PAPER non-transferable” = you can’t sell. you’re locked in “slowly dilute out older holders” = your tokens are worth less every day. by design “we don’t have plans to allow off-contract token transferability” = you will never be able to move your tokens out they literally wrote “slowly dilute out older holders and leave more recent users with an advantage” IN THEIR OWN ANNOUNCEMENT bro they told you to your face that they’re diluting you and most people didn’t catch it because the announcement was written like a physics thesis remember when i posted about someone draining $4M from their treasury through oracle manipulation a few weeks ago? everyone said they’d fix it they didn’t fix the vulnerability. they fixed YOUR ability to leave when a protocol locks your tokens and changes the rules after you’ve already deposited that’s not a “tokenomics update” bro
A note on transferability. Papertrade is a complicated primitive, and managing it from a risk standpoint is a complicated problem. The PAPER token is far more integrated into the economics of the primitive than most tokens are in their respective protocols today, and, broadly, was designed to act as a counter insolvency incentive coupled with a rebate mechanism to losing traders. Market makers and exchanges are by far the two most profitable businesses in crypto, and our goal was to try and externalise as much of their margins back to users as possible. We are now just over a week into the life of papertrade and we are becoming increasingly confident that this is both possible, but also a likely outcome as agentic led software becomes the norm. As it stands, the paper token traded as a perp becomes a leveraged bet on bankroll solvency - and being able to short bankroll solvency materially changes the payoff curve of a manipulation attack. The target number goes from the bankroll, to the bankroll + short side exposure on paper. We can, and do limit bankroll size specifically to control this payoff curve and ensure it never becomes existentially problematic, but external perp markets are not something we would have any control over if left to float of their own accord. For example, if our bankroll is $10m, an attack costing $15m manipulating the price of bitcoin or ether is not viable. You simply lose money. If however you were also able to put on $10m of PAPER short side exposure, suddenly an attack costing $15m is very viable indeed. If we were to make the token transferable at this point, we are confident we would quickly enter a state too dangerous to allow any material exposure to be taken on papertrade, an end result that benefits no party beyond the wolves who have done the math on the short and are waiting in the wings with sharpened knives. We would also like to thank the various perps teams who have reached out about pre-market listings for their understanding and patience regarding this issue, and especially to the paragon team who, despite jumping the gun on us, have behaved with the utmost integrity and transparency once a dialogue was opened. Perps on PAPER will always act as a self-limiting exposure ceiling for a token with this type of utility, and we think it would be a shame to limit the growth of papertrade to the extent that allowing perps would necessitate. As such, at this juncture we do not have plans to allow off-contract token transferability. Structurally, papertrade is limited by the quality of the data it receives from hyperliquid, but we strongly believe that hyperliquid has a very large part to play in the future of global exchanges, and expect their books to continue to thicken and strengthen over time. A note on fees. Papertrade launched with a deadband fee from entry of 0.2bps. This means you don't earn anything until the price has moved by 0.002% in your favour. Over the months before launch, we played around with many different curves and fee structures affecting exclusively positions closed very close to entry price in order to try and devise a structure that removed the edge against the bankroll low time frame scalp bots have, whilst also minimally impacting the traders around which and for whom the product was devised. We were never able to find anything we were absolutely happy with and so decided to stay with the 0.2bp deadband fee through launch. This has however meant we have had to be very restrictive when it came to certain parameters, such as OI caps. Now, however, we have enough live data to fully understand exactly which strategies work, and to make the necessary changes to stop them. The changes we are making will have an on hours and off hours fee mode to account for the relative differences in liquidity the hyperliquid books see between these two time periods, and the ease with which low time frame moves are signalled. The changes we are making will only affect positions closed within 6bps of entry (0.06%) in on hours, and 10bps (0.1%) in off hours. Any trades closed above these threshold price shifts will see no change to their fees at all. On a look back to launch basis, these changes affect the profitability of bot strategies roughly 15x more than they do normal traders, for whom a very small proportion of overall winnings come from within this band. These changes should serve to flatten much of the edge our microfee structure necessarily creates on low time frames, and will help with long term exchange sustainability. This should hopefully allow us to open up parameters such as OI caps a little more so those of you who wish to can put on the size you want to, when you want to. It is possible these changes are still too lax, and that further revisions to this structure may be necessary going forwards. If so, we will notify users ahead of time. A note on paper tokenomics. In conjunction with the fee changes, we will also be implementing a change to the token issuance curve. Going forward, every $1 lost mints a fixed share of PAPER's supply at that moment, roughly 0.1% of supply per $1M lost (the exact number depends on the mint rate at the time the contracts are upgraded). PAPER minting in and near insolvency will also change, switching from a flat 100 per $1 of loss, to a time weighted multiplier on the curve growing over time, effectively acting as the house running a discounted auction on its own future cash flows. This change also removes the risk of the paper-mint-straddle-attack, temporarily pushing the protocol insolvent by closing only the winning side of a large straddle position and then attempting to mint as much paper as possible. In the immediate term these changes will only have a very subtle effect on PAPER minting, but in the long run will structurally change the outlook of the system beyond the first few weeks, serving to slowly dilute out older holders and leaving more recent users with an advantage. Reconstituting the PAPER system into something much closer to the exchange rakeback it was intended to be. We have been very reticent to touch this particular aspect of the system for obvious reasons, but ultimately we believe that these changes provide all users with the optionality to take a smaller piece of a potentially much larger pie than the current dynamic might necessarily allow. Other, miscellaneous notes. These contract upgrades will include a few other contract changes, including the addition of builder codes so that builders can utilise papertrade in whatever capacity they choose to. This will be a whitelist only to begin with and we will have more for you later in the week on where/how this will be rolled out. A small change to contract permissions on the reward distributor and a change on how below bust closes are processed by the exchange are also included, largely to block gas griefing attacks. These changes will be pushed to docs in full over the coming day, and we will further announce once the changes are queued into the timelock pending final security passes, scheduled to go live 24 hours after that point. Final note. We'd like to thank everyone that has tried out papertrade over the last 10 days. It has been a labour of love building this product and both of us have been taken aback at all of the positive feedback we have received. We'd also like to thank all those of you who have spent considerable time musing on the system we have built, and much of your advice has been taken onboard and will likely affect the colour of what papertrade becomes going forward. We know some of these changes will be unpopular with some, but we would not be making them if we did not feel them to be absolutely necessary. - blurr, jez
3
1
11
929
top of the morning lads
13
1
22
939
that seed phrase screenshot you deleted 6 months ago is probably still on your phone right now when you delete something your phone doesn't erase it. it just hides it. the data sits there until something new overwrites it and if your phone backed it up to iCloud or google photos automatically? it's in the cloud too. even after you deleted it locally every seed phrase screenshot. every private key you copy pasted. every password you typed into notes then deleted probably still recoverable right now bro if someone gets access to your phone or your cloud account they're not just seeing what's there now. they can pull back what you thought was gone months ago stop screenshotting sensitive information. write it on paper. the phone was never meant to hold your keys your phone remembers everything you told it to forget
Can I ask a STUPID tech question? If I delete a photo from my phone, it's gone. If I delete it from the trash, it's REALLY gone. But hackers and governments can recover deleted data. Where does deleted information actually go?
9
3
2
28
3,793
believing in something will change your life but 99% of what you believe in won't work out the 1% that does will make everything worth it the problem is you don't know which one is the 1% until you've already gone through the 99 that's the game. and the only way to lose is to stop playing before you find it
8
4
1
27
1,286
it's surprising to see that these days most people on twitter are using ios more than android
12
41
1,819
Bala 🧤 retweeted
did you know someone can track your exact location just by sending you a PDF? no malware. no link to click. no app to install. just a regular looking PDF let me explain how this works because most people have no idea when someone sends you a PDF they can embed a tiny invisible image inside it that loads from their server the moment you open the PDF the image loads. their server records your IP address your IP address tells them your city, your internet provider, and your approximate location you didn’t click anything suspicious. you just opened a document this is how people get doxxed. someone sends a “job offer” or a “partnership proposal” as a PDF you open it thinking it’s legit but it might not be and this isn’t just PDFs. word documents and HTML emails do the same thing the most innocent looking file on your screen might be quietly telling someone where you live right now
20
75
3
405
19,765
a VPN couldn’t save this kid from the FBI. one phone number brought the whole thing down he swatted a girl’s home for years. threatened to firebomb it on discord. thought his VPN made him invisible the FBI caught him because his discord account was registered to his real phone number they matched the IP addresses from his verizon account to his discord login times. same IPs. same timestamps. same person bro had a VPN running the whole time and it meant nothing because his phone number connected every single dot a VPN hides your browsing. it doesn’t hide the phone number you signed up with a VPN without OPSEC is just expensive false confidence
❗️ The FBI arrested an 18-year-old it says swatted a girl's home for years and threatened on Discord to firebomb it. He used a VPN, but his Discord account was registered to his own phone number. He has pleaded not guilty.
24
73
4
707
202,560
good morning brethren
21
1
34
939