checking the chain
Blockchain
Joined January 2018
- Tweets13K
- Following3.9K
- Followers3K
- Likes48.6K
$FWA pool where you can redeem prizes for GTA VI and Gaming Gear, would you spin it? 🎮
3
9
181
0xdeadf4ce retweeted
The Across domain is currently down while we secure it against an attack from earlier today.
At ~18:45 UTC, a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain.
Within 15 minutes of this attack, we were alerted and immediately worked to shut the site down. SEAL911 marked across.(to) as a phishing site with major wallets, and Cloudflare worked with us to mark the domain as at risk, and later pulled the site’s DNS records.
At the time of this post, Across.(to) is fully down, and the phishing site is no longer available.
In the brief period before Cloudflare fully blocked the malware site, some users who visited across.(to) may have been affected. No third-party integrations or API users were affected. Users who believe they were affected should DM us with transaction details and revoke attacker permissions (see next tweet for details).
Despite our best efforts, @Namecheap has been unresponsive, and we have not been able to properly secure the domain to bring Across’s services back up. Across’s frontend and API will remain down until we can properly secure them. We will always put user safety first.
Across’s domain was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible. We will be investigating this deeply and will provide a post-mortem on how this domain takeover was possible once we have more information.
0xdeadf4ce retweeted
Since Sept 19, 2026, one attacker has drained at least 350 Ethereum wallets, taking approximately $1M USD.
Today I was able to rescue $50k worth of assets, including 3 BAYC, for @defy_anc
Here's what I know, and how to protect yourself (hint: use a hardware wallet):
1/🧵
Got drained today, all tokens, all chains, years of grinding, poof in a flash. Didn’t sign anything, did not click anything, maybe a possible iOS related exploit.. UPDATE your iOS software now. ETH, ApeCoin, Pnutz all gone.. my GEM and Zards tokens are all they left behind. Thanks to @0xQuit apes are safu along with hopefully most ApeChain NFTs. Massive financial hit, please send McD’s application forms this way. 🙏🏽 Big thanks to @imjameshall, @nft_dreww and @Eddie_ShoBiz for the support. ❤️
0xdeadf4ce retweeted
We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information.
Everyone affected was sent an email today with full information.
We deeply regret that this happened. While funds were not affected, the security of personal information is just as important and we take full responsibility.
Additional measures are in place until the B2C platform involved is fully retired as planned on 20 December 2026. In the meantime we encourage everyone to be even more vigilant. We will never ask for your PIN or seed phrase, or ask you to move funds.
Further Details: gnosispay.com/blog/data-brea…
We encourage security researchers to communicate security vulnerabilities directly with us via [email protected]. The same rewards apply as to Gnosis Chain: immunefi.com/bug-bounty/gnos…
0xdeadf4ce retweeted
If you run sshd on Alpine, OpenWrt, or musl Docker images with password auth still on, patch today.
@kultekin found that OpenSSH on musl without PAM accepts any password of 257 to 1024 characters for accounts locked with a lone * in /etc/shadow. That covers key-only users and the default alpine user on official AWS and Azure images (passwordless doas). The box also needs another account with a real password hash.
@damienmiller shipped OpenSSH 10.6p2 this morning as a workaround. @alpinelinux edge already has 10.6_p2-r0. Can't update yet? Set PasswordAuthentication no and restart sshd.
glibc, PAM builds, Dropbear, and OpenBSD are not in scope. musl without PAM is.
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
0xdeadf4ce retweeted
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
0xdeadf4ce retweeted
We at @MacHomebrew been warning @Google about this for years. Sadly, they are too addicted to making money selling malware ads.
If someone senior enough at @Google wants to talk about this or, ideally, just fix the fucking problem: I'm easily contactable online.
RTs welcome.
We're going to see a renaissance of codeslaw discourse. Retarded people with agents is like toddlers playing catch with grenades.
Ah yup. That was indeed me. No mallace intended. I've been running some agents to do signups + agentic testing on similar platforms. Just halted the harness I was designing around this as it was definitely going off the rails and reaching too far
Readers added context they thought people might want to know
In many jurisdictions this is a crime. In the US under Computer Fraud and Abuse Act, 18 U.S.C. §1030, in the UK under Computer Misuse Act (CMA) 1990, in Germany Strafgesetzbuch (StGB), and many others.
justice.gov/jm/jm-9-48000-…
legislation.gov.uk/ukpga/1990/18/…
gesetze-im-internet.de/stgb/
0xdeadf4ce retweeted
Prediction:
Every Web3 project that treats security researchers like shit will eventually learn why they needed them.
Rough day to operate custodial exchange business. But let's be honest: This was never a good idea anyway.
1
7
163
0xdeadf4ce retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
0xdeadf4ce retweeted
Ledger Flex sold at Singapore Airport confirmed to contain a spy implant!
@BenYorke found suspicious marks on his @Ledger and sent it to me rather than using it, that was probably the best decision here.
youtube.com/watch?v=Nf4FEFlg…
teapaw.org/BenYorke/status/210908…
I have a $300 @Ledger Flex that I bought from the Singapore airport in summer (Metapod, should be fine?)
I never plugged it in but it looks like theres some scratches on the casing, an indication of potential tampering?
Anyways theres no way i can trust it (or Ledger) now
0xdeadf4ce retweeted
Last month, the contracts powering Magic Eden were exploited to the tune of millions of dollars. I was lucky enough to be in a position to rescue a good portion of that, but it highlighted the danger of leaving approvals open as adversaries get access to better and better tools for finding holes in contract logic.
Today, Blur announced that they will be deprecating their frontend.
I've investigated Blur and found no exploits within the current contracts. However, the Blur contracts are upgradable, meaning that they could turn malicious at any time.
They currently have eight figures worth of NFTs approved to them. The safety of those NFTs effectively hinges on the opssec of the Blur team, which appears to be disbanding at this time.
If you have open approvals to Blur, I recommend you remove them immediately. Use revoke.cash or similar to ensure that you are protected in case of a contract exploit or later upgrade.
Don't wait. The time is now.
0xdeadf4ce retweeted
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
