Peter Kacherginsky retweeted
The @FireworksAI_HQ incident was pretty bad. Attackers targeted weights and managed to exfiltrate parts of it.
Here's the email we received.
Is this the first public incident where model weights were targeted?
Here's the email we received.
Is this the first public incident where model weights were targeted?
7
7
121
25,942
Peter Kacherginsky retweeted
Lazarus Group is always growing its portfolio. So are we.
SEAL keeps adding new profiles, front companies, and indicators to lazarus.group, so check back before your next hire.
Search by name, email, handle, or wallet.
SEAL keeps adding new profiles, front companies, and indicators to lazarus.group, so check back before your next hire.
Search by name, email, handle, or wallet.
3
7
54
2,959
Peter Kacherginsky retweeted
.@blockthreat is now a public good!
This is the best crypto security related content out there.
Especially if you are in the ETHSecurity space, it's a must skim every week.
blockthreat.com/blockthreat-we…
This is the best crypto security related content out there.
Especially if you are in the ETHSecurity space, it's a must skim every week.
blockthreat.com/blockthreat-we…
4
4
40
1,115
Every week @blockthreat celebrates the people who share their work with all of us. This week’s shoutouts 🧵
4
8
24
1,228
@theSouilos of @opsek_io on why YubiKey protects your login, not your session.
blog.opsek.io/why-a-yubikey-…
blog.opsek.io/why-a-yubikey-…
1
0
12
351
Thank you all for sharing your work. Next week I want to feature yours.
Full edition with more excellent research papers and tools here:
blockthreat.com/blockthreat-we…
Full edition with more excellent research papers and tools here:
blockthreat.com/blockthreat-we…
0
0
6
121
Assume 2+ of your engineers are compromised right now.
Can the attacker reach your private keys or signing infra from there? At @Binance, they could. Three laptops and one stolen token led to the largest theft in history.
More lessons for defenders in this week’s BlockThreat:
blockthreat.com/blockthreat-we…
Can the attacker reach your private keys or signing infra from there? At @Binance, they could. Three laptops and one stolen token led to the largest theft in history.
More lessons for defenders in this week’s BlockThreat:
blockthreat.com/blockthreat-we…
0
1
10
538
Peter Kacherginsky retweeted
BlockThreat - Week 44, 2026
North Korea just hit @binance for $6.36B, the largest heist in history. They now stole more this year than all past years combined.
North Korea just hit @binance for $6.36B, the largest heist in history. They now stole more this year than all past years combined.
1
3
5
591
Peter Kacherginsky retweeted
30 years ago today, Phrack 49 published Aleph One’s “Smashing the Stack for Fun and Profit”.
A legendary paper that inspired generations of hackers and helped shape modern exploit development.
Still an essential reading.
phrack.org/issues/49/smas…
Phrack 73 is coming soon!
A legendary paper that inspired generations of hackers and helped shape modern exploit development.
Still an essential reading.
phrack.org/issues/49/smas…
Phrack 73 is coming soon!
28
386
1,499
57,127
Remember the Nomad bridge hack in 2022? The wheels of justice turn slowly, but they eventually catch up.
Four years later, the first exploiter behind the hack has just been extradited from Israel to the US. Copycats are on notice.
A note to all the wannabe blackhats out there:
jpost.com/israel-news/cr…
Four years later, the first exploiter behind the hack has just been extradited from Israel to the US. Copycats are on notice.
A note to all the wannabe blackhats out there:
jpost.com/israel-news/cr…
4
2
14
732
RT @banteg: formal verification is just high english for smart contract auditors
aliasing → alice is bob
existential witness → try amount…
aliasing → alice is bob
existential witness → try amount…
0
15
0
40
Peter Kacherginsky retweeted
BlockThreat - Week 43, 2026
🔥$22.3M stolen across 14 incidents.
Crypto was the canary for Black October. Now the canary is coming home to roost. 🧵
🔥$22.3M stolen across 14 incidents.
Crypto was the canary for Black October. Now the canary is coming home to roost. 🧵
1
4
7
758
Peter Kacherginsky retweeted
this is completely ridiculous
besides the already huge list of 200,000 affected contracts in ethereum/repricing-impact, i found multiple methodological issues that make it miss many more.
it affects deployment and operation of several high profile protocols, not just some random devs misusing opcodes that were given to them.
i shared my findings privately with chainsecurity and i refuse to participate in this clownery
besides the already huge list of 200,000 affected contracts in ethereum/repricing-impact, i found multiple methodological issues that make it miss many more.
it affects deployment and operation of several high profile protocols, not just some random devs misusing opcodes that were given to them.
i shared my findings privately with chainsecurity and i refuse to participate in this clownery
We should continue towards Glam activation asap.
A lot of research went into Glam's strategy to increase opcode gas prices for state creation.
It seems fair to say that the timing of this debate is irrelevant as to its correctness or rightness for eth and our users... Yet, why did some of us (eg. quoted author who is an ef board member) only start looking in detail at Glam EIPs eg. after testnet forks started? This isn't a personal attack, it's an observation that there's a collective responsibility-- for OP, for me, for all of us-- to steward fork strategy at the right times in the process.
imo ethereum's commitments to apps do not extend to gas pricing, or to total ETH fee levels, or to USD fees. And also not to opcode pricing or gas introspection that depends on those prices. We guarantee maximally credibly neutral, maximally live access to the correct state transition function. Those guarantees imply that we always use a neutral pricing mechanism to clear congestion wherever possible. However, pricing opcodes can't use a neutral mechanism, we need to pick magic number opcode gas prices. Some of our best people researched this extensively and picked updated magic numbers, and that's something imo we should stick with now and continue our larger plans that are on track to grow to global ubiquity.
The good news and practical reality may be that the explosion of blockspace supply from 60M to 200M gas limit seems likely to absolutely crater the L1 gas price. It will take time for demand to grow to meet the new supply, including from net new entrants (eg. GENIUS and institutions), induced demand from lower prices, and the coming next gen of return-to-mainnet-type eth native apps.
By the time L1 blockspace demand catches up, we will be exploding supply again as we get closer to the full lean eth vision. That's eth's vision: postquantum and postAI ETH SoV, supported by ethereum's hypergrowing capacity, which is supported by best-in-class security and formal verification.
Looking back, it's unfortunate that we provided these affected contracts with a footgun that has put them in the situation where they were *able* to rely on fake guarantees that ethereum never promises (afaik, essentially just gas introspection). We're sorry.
imo it's time to roll forward on this. Let's do what we can in an appropriately scoped capacity for the affected contracts, then activate Glam asap, and continue our excellent progress towards global ubiquity.
30
45
493
38,210
Peter Kacherginsky retweeted
If you used Web3Auth (ex Torus) social login, get out NOW.
Only some wallets/configs are affected (I'm guessing only some parties from the mpc got rekt) but better be safe than sorry.
Even if you haven't gotten rekt, your security level might have been compromised.
Only some wallets/configs are affected (I'm guessing only some parties from the mpc got rekt) but better be safe than sorry.
Even if you haven't gotten rekt, your security level might have been compromised.
11
20
121
13,877
Peter Kacherginsky retweeted
PSA on today's Reth / OP Reth releases
A fix went out across the Reth ecosystem ensuring that all Reth-based nodes, DeFi bridges and state-proof backed systems are all safe. If you depend on Reth, please update to v.2.10.0, OP Reth v2.8.1, and Base version v1.5.3. We appreciate how quickly everyone moved to patch. This bug was identified by the Tempo team's fuzzing process, and Tempo is also patched.
Reth’s legacy state root code had an edge case. For certain smart contract storage layouts, a carefully crafted transaction could make it produce the wrong state root. Reth’s block builder uses this legacy trie calculator on lower-end hardware and on OP Stack chains, so those setups were exposed.
L2s like OP Stack chains or Base are unaffected because this could not impact their withdrawals system. Ecosystem bridges do not use state roots, they use receipt roots or multisignatures, so they are unaffected by this.
Reth is critical infrastructure for the entire EVM ecosystem. We take it very seriously. And we are sorry for the inconvenience caused.
A fix went out across the Reth ecosystem ensuring that all Reth-based nodes, DeFi bridges and state-proof backed systems are all safe. If you depend on Reth, please update to v.2.10.0, OP Reth v2.8.1, and Base version v1.5.3. We appreciate how quickly everyone moved to patch. This bug was identified by the Tempo team's fuzzing process, and Tempo is also patched.
Reth’s legacy state root code had an edge case. For certain smart contract storage layouts, a carefully crafted transaction could make it produce the wrong state root. Reth’s block builder uses this legacy trie calculator on lower-end hardware and on OP Stack chains, so those setups were exposed.
L2s like OP Stack chains or Base are unaffected because this could not impact their withdrawals system. Ecosystem bridges do not use state roots, they use receipt roots or multisignatures, so they are unaffected by this.
Reth is critical infrastructure for the entire EVM ecosystem. We take it very seriously. And we are sorry for the inconvenience caused.
19
16
130
11,863