I got hacked at 3:59 AM without clicking anything. My voicemail handed the attacker my Telegram login code. Here is exactly how it worked, so it doesn't happen to you. 3:54 AM. My phone rings about ten times in a row, No Caller ID. That was not harassment. It was the attack: keep my line busy. Meanwhile, the attacker asks Telegram to log in with my number and picks "send the code by phone call". My line is busy, so Telegram's robot call lands on my voicemail and reads the code out loud to it. Carrier voicemail can often be reached remotely, with a default PIN or a spoofed caller ID. He listens to the message. At 3:59 he is in. Fortunately, the attack was noisy. The calls woke me up. At 4 AM I only wanted to go back to sleep, but I had the presence of mind to check my notifications. Telegram was showing a new login from a device I didn't know. That check is what saved me: I ended his session within minutes. If I had rolled over, the next day would have been a mess. In those few minutes he had already typed /balance, then /start on every old wallet bot he could find in my chats. He was hunting for funds tied to my Telegram. The bots were long dead and nothing was lost. He still had time to set his own 2FA password on my account. What would have stopped it: Telegram two-step verification, with a recovery email. With a password on the account, the code alone is useless. Your voicemail. Change the PIN, block remote access, or turn it off (##002# cancels call forwarding on most carriers). Same for WhatsApp and any service that can send a code by voice call. No seeds, keys or passwords in Saved Messages. Ever. A burst of masked calls at night is a signal, not a nuisance. Check your notifications and your active sessions. I have been building in crypto for more than ten years and I had never thought about my voicemail. Check yours today.

je viens d'être la cible du phishing le + sophistiqué de l'histoire informatique - je reçois par email une prétendue alerte qui m'indique que j'aurais généré un accès tiers à mon compte Google pour un utilisateur @gmail que je ne connais pas - l'email de l'émetteur no-reply＠accounts•google•com a tout d'un mail officiel @Google et Gmail ne mentionne pas la moindre alerte de suspicion - je clique sur le lien, car le site de phishing hébergé sur le domaine google•com semble 100% legit, il fait même semblant de faire des vérifs de sécurité avec un CAPTCHA - même mon password manager me propose de remplir l'email/pwd car j'ai un vrai compte sur sites•google•com (c'est Google qui offre l'hébergement de sites web) - si je remplis les champs email/pwd, le hacker les récupère instantanément pour se loguer et récupérer tous mes accès Google/YouTube cette attaque va faire mal, j'ai report à Google comment j'ai compris que c'était du phishing ? 1 : le bouton d'action des emails Google est sensé être le gros bouton bleu, pas un lien juste au dessus 2 : en allant voir dans les détails le sender [mailed-by] est fwd•privateemail•com et non *bounces•google•com

#AgendaBitcoinAr | “Quién Quiere Ser Inversor” de @yayimoralesok llega a Rosario 📍🇦🇷 Viví la masterclass de educación financiera más grande de Argentina. Es un evento educativo y entretenido, ¡apto para todo público! Este encuentro combina entretenimiento y aprendizaje sobre el mundo de las inversiones. Es un espacio ideal para quienes desean aprender de finanzas personales de manera dinámica y amena, en un día donde también disfrutarán y se llevarán premios y regalos solo por asistir ✨ Si ya sabés de estos temas, entendés la importancia de contar con conocimientos al respecto, por lo que es la ocasión ideal para invitar a un amigo o familiar que te gustaría que aprenda también! 📅 Sábado 10 de octubre, de 10 a 14hs 📍Fundación Libertad (Mitre 170) ¡Entradas disponibles! 🎟️ docs.google.com/forms/d/e/1F…

Sepan una cosa: la auto custodia con stablecoins no significa mucho... solo elimina algunas capas de riesgo naturalmente pero vos, en tu control no tenés nada con la seed phrase. sólo tenés un token que puede ser revocado, congelado, eliminado, y muchas cosas más. las empresas de hecho se vanaglorian cuando congelan fondos por tal o cual causa, y la gente ya se acostumbra y busca como lo hacen con el estado, que la empresa intervenga... por el contrario, cuando tenés las 24 palabras y lo que proteges detrás de ella son Bitcoins.. esos son tuyos...

@grok ¿Qué problema del dinero digital resolvió el whitepaper de Satoshi que sigue sin solución en el sistema bancario tradicional?

JUST IN: Bitget crypto exchange reportedly hacked with over $170,000,000 stolen.

INSTEAD OF WATCHING AN HOUR OF NETFLIX TONIGHT. This 20 minute lecture by Andreas Antonopoulos will teach you more about the financial surveillance complex and KYC risks, than most people learn in years. Bookmark it and share it, no matter what.

With 360 Bitcoin wrench attacks cataloged, it's time to take the archive to the next level. Over the weekend I clanked out this interactive dashboard; feedback is welcome! jlopp.github.io/physical-bit…