I’m in the trenches | IntersectMBO Civics Committee | Tingvard CC Always abstain Cardano DRep ID: drep1wgxemjt24eg22kpfpvdgy9hr5gnavx0ccglkvzd2rv86kfgu3y5
Joined August 2007
- Tweets15K
- Following4.4K
- Followers2.2K
- Likes31.2K
KenErik retweeted
Did you notice the difference? 👀
WingRiders just got a fresh look:
☑︎ Redesigned from top to bottom
☑︎ New home: swap, stats and markets up front
☑︎ ~70% faster loading
Faster, cleaner, easier. ⚡️
KenErik retweeted
🚨 SPOs: Intersect flagged a critical Linux kernel bug this week (CVSS 9.8).
✅ Check your kernel
✅ Patch when your distro ships the fix
✅ Reboot
Delegators: it's fair to ask your pool if it's patched 🫡
ALT Card: SPO patch check. Linux kernel bug, CVE-2026-98432, CVSS 9.8 (critical). 1 Check the kernel on your block producer and relays. 2 Patch as soon as your distro ships the fix. 3 Reboot so the new kernel actually runs. Source: Intersect weekly update #135 (Oct 30). BBHMM logo.
KenErik retweeted
Quack!(attention) 🦆
duckBot notification!
💥 New Block!
Node: Dingo(79)
Tx Count: 1
Block Size: 0.25%
Interval: 4s
Scripts: 0/1 txs
Epoch Blocks: 4
Lifetime Blocks: 5427
adastat.net/blocks/63c454888…
KenErik retweeted
Strategy has acquired 811 $BTC and repurchased $208M of $STRC. As of 11/1/26, we hold 849,327 BTC and $4.9B of USD Assets. $MSTR strategy.com/press/strategy-…
KenErik retweeted
Fiat Withdrawal Update
Fiat withdrawals are now available for the following currencies:
New
✅ USD
✅ AED
✅ VND
✅ PHP
✅ IDR
Current:
JPY, VES, BRL, MXN, ARS, BHD, KZT, EUR, CHF, CZK, HUF, KWD, PLN, RON, SEK, CDF, KES, SLE, UGX, XAF, XOF, ZMW, and KGS.
We will continue to share further updates through official Binance channels.
KenErik retweeted
The U.S. Secret Service continues to investigate the theft of more than $6 billion in cryptocurrency from Binance Global.
Within minutes of the incident on Thursday afternoon, Secret Service investigators worked with industry partners to identify and freeze a significant portion of stolen cryptocurrency. That work continues with the @FBI, @IRS_CI, the @USAO_DC and the U.S. Attorney’s Office for the Central District of California, DOJ CCIPS, and @DOJNatSec.
A list of addresses that are holding or have held assets from the theft can be found here: fbi.gov/investigate/cyber/al…
KenErik retweeted
Possibly the best Bitcoin explainer video for kids and adults 🧡
by @tether
KenErik retweeted
Withdrawals restored for:
- Ethereum: USDC, USDT, ETH
- BNB Smart Chain (BSC): USDC, USDT, BNB
Withdrawal Update
Withdrawals have now been restored for the following assets and networks:
- Ethereum Network: USDC, USDT, ETH
- BNB Smart Chain (BSC): USDC, USDT, BNB
We will continue to restore additional assets and networks in phases following the completion of our security checks. Further updates will be shared through official Binance channels.
KenErik retweeted
@jony_levin, CEO & Co-Founder of Chainalysis spoke to @cnni this morning on the Binance exploit. Watch the interview below. 👇
Read more about our findings in our blog: chainalysis.com/blog/binance…
KenErik retweeted
Reading the reconstructed bytecode of the Binance EIP-7702 sweeper (`0x63e8...6fae`) is wild.
This wasn't a generic drainer. It was custom-engineered for Binance 14's architecture:
- Leaves exactly 1 ether behind (`bal - 1 ether`) when sweeping ETH so Binance's automated hot wallet queue wouldn't error on gas and trip alarms.
- Uses raw `staticcall` + `continue` loops with custom error codes (`SweepItemFailed`) so one bricked or blacklisted ERC-20 wouldn't revert the $6B batch.
- Includes a custom `callExecute` function to impersonate Binance 14 as controller of an external vault holding $823M in USDC.
They leave a comment: "robberies could be prevented if getaway cars were slower."
You can't fully blame EIP-7702, but it sped up the attack. Without 7702, draining 64 tokens plus an external $823M vault from a live exchange hot wallet meant fighting moving nonces across 70+ transactions. Defense systems would've killed it after tx #3.
With 7702, Lazarus sprayed 50 consecutive nonces in one type-4 payload, turned an EOA into a custom proxy, and atomically swept billions in a single block.
Ethereum core devs built the ultimate getaway car. Surgical state-sponsored engineering.
This could be etched onchain:
`if (bal > 1 ether) { to.call{value: bal - 1 ether}(""); }`
The Binance $5.6B drain is a masterclass in modern EVM exploitation.
It wasn't a complex logic bug. It was an EIP-7702 delegation hijack:
1. Setup: Attacker funds 0x7c86 via Tornado Cash, deploys a sweep contract (0x63e8), and runs three live dry-runs on external wallets.
2. Execution: Attacker submits an EIP-7702 batch with 50 pre-signed authorizations (nonce n to n+49) to hit Binance 14's moving nonce window.
3. One authorization hits. Instantly, Binance 14 (an EOA) is reprogrammed to run the attacker's contract bytecode.
4. Execution looks totally organic: Binance 14 sweeps itself clean. Internal threshold alerts don't trigger because, from the nodes' perspective, the hot wallet is just executing its own transaction.
5. Binance 16 immediately auto-refills 28,000 ETH due to automated treasury rebalance scripts, feeding the exploit loop.
The cold truth: you cannot forge an EIP-7702 delegation list.
For this to execute, the attacker already held the raw private key or unconstrained signing access to Binance 14's HSM/KMS.
But hey, 5.64 billion drained across ETH, BTC, and Tron. 2.54 billion frozen by Tether, Circle, Ripple, and World Liberty within hours.
Code is law until the stablecoin admin keys log in.
Binance got bailed out by the very centralized choke points the cypherpunks warned you about.
Hardware wallets leak your home address.
Centralized exchanges leak the keys to the kingdom.
Self-custody on native, non-delegated chains remains the only honest baseline.
At least you know what to avoid.
Readers added context they thought people might want to know
The quoted comment appears only in an AI-reconstructed source (explicitly labeled not original) uploaded to explorers; no source comments exist in deployed bytecode, and core features match independent decompilations/on-chain data.
etherscan.io/address/0x63e8…
gist.wavey.info/Ta3FgAxastgj42…
x.com/thearsondragon…
KenErik retweeted
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO.
Commingling address:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
Bitget exploit context: teapawt.org/zachxbt/status/2104528…
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
KenErik retweeted
Thank you! 🙏🙏🙏
USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the @binance hack. We stand by our industry partners. Protecting users and preventing bad actors from moving stolen funds is a shared responsibility.
KenErik retweeted
Binance.US is not affected by the reported Binance.com security incident. We are a separate, independent platform, and customer funds and services are secure and operating normally.
Rest assured, all user funds are safe.
