Pinned Tweet
🚨 WARNING (AGAIN)
DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets.
They're taking over your Telegrams -> using them to rekt all your friends.
They've stolen over $300m via this method already.
Read this. Stop the cycle. 🙏
DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets.
They're taking over your Telegrams -> using them to rekt all your friends.
They've stolen over $300m via this method already.
Read this. Stop the cycle. 🙏
168
387
1,823
666,185
I know with all the other shit going on everyone has forgotten about the implanted Ledgers in the wild.
But if you know of any (drained or not) please keep sharing information, photos, purchase date + location, etc.
Come to @SEAL_911. Tag me. Tag @MagicalTux. Tag @Ledger. 🙏
But if you know of any (drained or not) please keep sharing information, photos, purchase date + location, etc.
Come to @SEAL_911. Tag me. Tag @MagicalTux. Tag @Ledger. 🙏
I found a SIM implant in my friend's @Ledger Flex. He set it up but never used it, so no funds were lost.
He bought it from @cryptobilis at their May 22 2026 Global Pizza Party, Raintree Club Kuala Lumpur.
nRF9151 LTE module, eSIM module, v1.1 UFL antenna
cc @MagicalTux
21
27
186
15,814
Can confirm, just got one of these for a mid-2025 purchase. 💀
Good phishing email too. Bypasses spam. Decent site.
Luckily I never ship to my house but seems they have shipping address, purchase, name, email.
Good phishing email too. Bypasses spam. Decent site.
Luckily I never ship to my house but seems they have shipping address, purchase, name, email.
Phishing email seems to have gone out to Foundation Passport users.
No official word from @FoundationHQ yet.
Do not click any suspicious links.
31
4
111
11,881
Tay 💖 retweeted
I recently sat down with @PJVogt to chat about North Korea’s undercover U.S. workforce.
I’ve been a fan of Search Engine and Reply All for years, so being a part of an episode was a real treat.
If you have some spare time, give it a listen!
podcasts.apple.com/us/podcast/is-…
I’ve been a fan of Search Engine and Reply All for years, so being a part of an episode was a real treat.
If you have some spare time, give it a listen!
podcasts.apple.com/us/podcast/is-…
4
7
33
2,381
Once again reminding the hardware wallet retards that the risk that becomes real when you leak people’s SHIPPING INFORMATION is not phishing. It’s fucking PHYSICAL ASSAULTS AND KIDNAPPINGS.
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
42
46
669
28,679
Tay 💖 retweeted
ngl I support the ambulance chasers
they figured they could keep it quiet and play hero by having ant/openai/etc revoke keys instead of alerting their users
disgusting disrespect for their customers
remember, crypto keys weren’t drained until 19:34!!!!!!!!!!!
🤮
they figured they could keep it quiet and play hero by having ant/openai/etc revoke keys instead of alerting their users
disgusting disrespect for their customers
remember, crypto keys weren’t drained until 19:34!!!!!!!!!!!
🤮
3
1
18
2,826
Tay 💖 retweeted
How eMudhra Signed for a Year With a ‘4’ as a Private Key: Uneasy Money
What happens to security schemes that quietly assumed nobody would try? 🤖
According to @kain, AI agents now will, and that thread ties together a weak CA key, two PHP bugs, and the @papertrade_xyz launch.
riffith weigh in on Uneasy Money.
Timestamps:
🎬 00:00 Intro
🌐 02:07 Why a burst of unrelated internet-breaking bugs landed in the same 48 hours
🔑 05:13 How a certificate authority's private key turned out to be the number 4
📧 17:47 Why revoking bad certificates runs on a literal email thread
🤖 22:52 Kain on why schemes built on human laziness are unraveling against AI
🐘 25:34 PHP to shell: two remote code execution bugs in the language behind the web
🛡️ 33:21 How Cloudflare is shielding unpatched PHP admin panels during the rollout
🎣 36:04 Austin's $1 test: how fast bots drained a weak Ethereum private key
💼 37:44 Nexo: Generate daily interest on your crypto or borrow funds against your assets at unchainedcrypto.com/go/nexo-podcas…
🪣 38:25 papertrade's 1,000x 'bucket shop' and the token you earn by losing
📚 48:55 The mechanism design lessons hidden under DeFi Summer's degeneracy
🐋 52:35 How DeepSeek keeps getting smarter while Kain's API bill fell to $3 a month
🏛️ 57:06 Why DHS banned DeepSeek and why Austin says local models are the safer bet
♾️ 01:05:13 Why Kain says Anthropic gives off SBF vibes and could be 'worth infinity'
🎯 01:14:23 The drained-key update: bots grabbed 10-digit keys, but 12 digits held
What happens to security schemes that quietly assumed nobody would try? 🤖
According to @kain, AI agents now will, and that thread ties together a weak CA key, two PHP bugs, and the @papertrade_xyz launch.
riffith weigh in on Uneasy Money.
Timestamps:
🎬 00:00 Intro
🌐 02:07 Why a burst of unrelated internet-breaking bugs landed in the same 48 hours
🔑 05:13 How a certificate authority's private key turned out to be the number 4
📧 17:47 Why revoking bad certificates runs on a literal email thread
🤖 22:52 Kain on why schemes built on human laziness are unraveling against AI
🐘 25:34 PHP to shell: two remote code execution bugs in the language behind the web
🛡️ 33:21 How Cloudflare is shielding unpatched PHP admin panels during the rollout
🎣 36:04 Austin's $1 test: how fast bots drained a weak Ethereum private key
💼 37:44 Nexo: Generate daily interest on your crypto or borrow funds against your assets at unchainedcrypto.com/go/nexo-podcas…
🪣 38:25 papertrade's 1,000x 'bucket shop' and the token you earn by losing
📚 48:55 The mechanism design lessons hidden under DeFi Summer's degeneracy
🐋 52:35 How DeepSeek keeps getting smarter while Kain's API bill fell to $3 a month
🏛️ 57:06 Why DHS banned DeepSeek and why Austin says local models are the safer bet
♾️ 01:05:13 Why Kain says Anthropic gives off SBF vibes and could be 'worth infinity'
🎯 01:14:23 The drained-key update: bots grabbed 10-digit keys, but 12 digits held
9
3
13
8,268
Censys has a live dashboard of all the vulnerable vs patched PHP out there.
Long road ahead. ☹️
php2shell.censys.com
Long road ahead. ☹️
php2shell.censys.com
19
23
155
11,380
Tay 💖 retweeted
Why you shouldn't panic about AI hacks: my full interview with cybersecurity expert @tayvano_
0:37 how bad is the PHP bug?
2:33 PHP is 70% of the internet
6:59 a private key that was just "4"
9:04 crypto is safer than the internet
15:30 never panic, diversify
17:04 how ternet
18:49 Railway hack drained wallets
21:07 Monero & Zcash are most hardened
22:35 Bitcoin's real risk is its culture
27:02 hardware 2FA on everything
0:37 how bad is the PHP bug?
2:33 PHP is 70% of the internet
6:59 a private key that was just "4"
9:04 crypto is safer than the internet
15:30 never panic, diversify
17:04 how ternet
18:49 Railway hack drained wallets
21:07 Monero & Zcash are most hardened
22:35 Bitcoin's real risk is its culture
27:02 hardware 2FA on everything
56
50
493
60,703
Tay 💖 retweeted
LIVE WITH @tayvano_ in 30 seconds
MARKET OPEN: AI BROKE THE INTERNET, Interviewing a Cyber EXPERT, crypto is FINE, Good Luck x.com/i/broadcasts/1…
8
4
35
12,368
Let me help you translate the Indian
“User funds are not safe. We lost another $15m today. We didn’t disclose this for 20+ hours until other people called us out. Now we maybe claim that it’s bc we kept using compromised wallets and infra for 16 months? Idk?”
“User funds are not safe. We lost another $15m today. We didn’t disclose this for 20+ hours until other people called us out. Now we maybe claim that it’s bc we kept using compromised wallets and infra for 16 months? Idk?”
Users’ funds are safe. ✅
Claims circulating on X regarding certain wallet addresses and transactions are misleading.
The transactions mentioned in recent claims involve old wallet addresses created in January 2025.
These addresses were compromised in July 2025 and have not been used by CoinDCX since.
The activity now being reported relates to these old addresses and does not have any connection with CoinDCX.
Trading & investing continue as usual.
For updates, trust only official CoinDCX channels.
For any queries, reach out to @CoinDCX_Cares
37
29
523
34,106
I can’t tell if they just blatantly lie or if he doesn’t know how to read a block explorer.
All the wallets drained today (yesterday) were actively in use by CoinDCX in 2026.
They were last hacked in July 2025.
(They tried to hide and then lied about that one too)
All the wallets drained today (yesterday) were actively in use by CoinDCX in 2026.
They were last hacked in July 2025.
(They tried to hide and then lied about that one too)
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses.
All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised.
Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.
28
116
501
7,384
………………………………..
Further update on the TQKJQ wallet On-Chain activity.
Following the July 2025 security incident, we advised users not to deposit crypto to the compromised wallet addresses. These addresses were generated earlier in 2025, were compromised during the incident, and have since been deprecated.
It is strongly recommended for users not to deposit funds on deprecated addresses, and always verify updated deposit addresses from the CoinDCX App or website. Please note that depositing funds to deprecated addresses is highly risky. Exchanges do not typically take liability for such deposits made.
Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones. Our operational process is designed for regular sweeping of any such deposits made so the funds can be properly accounted for and secured. For a particular period, this sweeping process failed, which got identified today morning.
This failure led to some operational losses, which were absorbed by CoinDCX. Importantly, all affected crypto deposit wallets for users on CoinDCX were duly credited even though they were made to the deprecated addresses.
Users’ funds remain completely safe. Customer assets continue to be held in segregated cold wallets. Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised.
The CoinDCX platform and all trading activities continue to function as usual.
Please rely only on official CoinDCX channels for updates and avoid spreading unverified information.
1
0
12
1,445
Tay 💖 retweeted
I will be live with @tayvano_ at 10:15am est (on all platforms) to try and breakdown wtf is happening and wtf we should do
who is the best cybersecurity expert i can invite on stream tomorrow to explain wtf is happening
35
8
190
21,467