Be kind, positive and grateful for what you have! #TheAlienBoy #iBallz $BTC $XMR
Joined June 2020
- Tweets39.9K
- Following3.1K
- Followers1.8K
- Likes1K
! retweeted
Hi because you get rinsed by the same KOL grifters who have done it for years and never learn.
I tried calling out Ansem numerous times in the past for promoting micro cap and celeb tokens but gamblers brought him credibility and exit liquidity yet again this cycle.
So why should I care at all?
I am busy with recent incidents like the French bank heist, DPRK, or The Com where my work actually brings measurable impact rather than engagement from calling out known bad actors and saying the obvious.
! retweeted
DPRK isn't just scrambling the money trail โ they're literally DDOSing the visual tracking tools:
they've automated the split of $6.3b into tens of thousands of microscopic, cascading peeling chains inside a few blocks.
the sheer volume of addresses is designed to crash the GPU/CPU of any tracker trying to render the multi-chain flow, rendering forensics screens totally useless.
"WTF are you even doing here" = 50,000 automated micro-transactions designed to give chainalysis' analytics server a meltdown.
๐ค
! retweeted
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Thanks to all other signers involved.
Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5
Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6
! retweeted
New details on how the $6.3 billion Binance hack likely occurred:
According to initial reports, hackers compromised a Binance engineer's laptop, gaining access to internal systems used to authorize withdrawals.
The attackers then:
1. Hijacked a Binance hot wallet using Ethereum's EIP-7702 mechanism
2. Redirected wallet transactions to a malicious smart contract
3. Transferred billions in crypto attacker-controlled wallets
4. Spread the stolen funds across multiple wallets and converted some assets into ETH to avoid freezes
The attack unfolded across multiple blockchains, with most funds drained in ~20 minutes.
~$3 billion of these funds have now been frozen, and Binance says it will cover all unrecovered hacking losses.
The full investigation remains ongoing.
! retweeted
gm gm here we go again.
This morning somebody abused a bug in ApeStr to swap 21 apes for 21 ApeStr-owned apes.
This was a known exploit (see the SQUIGSTR exploit from ~1 year ago) but incentive to run it was never there.
The bug lies in buyTargetNFT: it forces a strategy contract to send arbitrary calldata to any target. Afterwards it checks only three things: its BAYC balance rose by exactly 1, it owns expectedId, and "cost" equals its ETH balance drop.
This was patched in later NFTStrategy releases, but affects the original 6 (PunkSTR not affected).
The attacker bought 2 BAYC to use as bait. Using a helper contract, they prep the strategy contract by selling an ape to it for 5 wei and immediately buying it back for 6 wei. That primes the contract's ethToTwap with 6 wei.
They then call buyTargetNFT and pass the calldata to transfer an ape from ApeSTR to the helper using safeTransferFrom. This in turn hands execution over to the helper (remember, safeTransferFrom is NOT safe), which transfer TWO apes back to ApeSTR to satisfy the balance check (1 out, 2 in leaves ApeSTR at +1). It also calls processTokenTwap, which converts the 6 wei, setting the cost of one of the newly deposited apes to 7 wei (6 * 120%). The helper contract buys it back in the same tx.
example flow:
- Attacker has BAYC #1 and #2. ApeSTR has BAYC #3.
- Attacker "sells" BAYC #1 to ApeSTR for 6 wei and sends BAYC #2 to it for free, but steals BAYC #3 in the process.
- ApeSTR relists BAYC #1 for 7 wei, which the attacker buys.
- Attacker now has BAYC #1 and BAYC #3, and ApeSTR has BAYC #2 (but doesn't even know it).
The attacker ran this for all 21 BAYC in the ApeSTR contract, resulting in them being able to claim packs for all of those BAYC. Total net proceeds: $14k.
This previously affected SQUIGSTR because of their shared contract - any art blocks NFT sent in would satisfy the balance check, allowing the attacker to drain the contract of squiggles in exchange for basically valueless art blocks NFTs.
It was known to be possible on ApeSTR as well, so I guess it was just a matter of time before we saw it happen.
The unfortunate consequence is that now, ApeSTR has 21 apes that it is completely unaware of, so they cannot be bought from the contract. And 210 attacker-owned mudwater packs were dumped into bids.
