BlockMerchant (@Block_Merchant) header
BlockMerchant (@Block_Merchant) profile picture

Never stop clicking

Joined January 2019
Photo by BlockMerchant (@Block_Merchant)Photo by BlockMerchant (@Block_Merchant)Photo by BlockMerchant (@Block_Merchant)Photo by BlockMerchant (@Block_Merchant)Photo by BlockMerchant (@Block_Merchant)Photo by BlockMerchant (@Block_Merchant)Photo by BlockMerchant (@Block_Merchant)Photo by BlockMerchant (@Block_Merchant)
BlockMerchant retweeted
Your NFTs. Your token. Your pool. - Fill it with your NFTs and earn all of the ETH from purchases. - Launch an $FWA paired token, route pool fees into buying and burning it, and let users spend your token on NFT purchases. - No ETH required. Coming soon to Fake World Assets.
Soon community pools will get an upgrade. New look, new features.
19
15
2
127
7,816
$BTC: Bitcoin is still within its bullish fractal despite todays Black Swan and the total loss of the EMA50 and MA50 daily that I considered as support in the area of 80-81k. There is a very important support at $76,000, the breakout above that area was the confirmation of the start of the bull market, so losing it is a very big blow for all bulls and something I dont want to see at all. Losing 76k will be catastrophic and there will be a high risk of 67-69k. For now, as long 76k there is no need to Panic. I believe that this was a massive shake out in the market, triggering tons of liquidations and panic sales in the recent hours, and call me crazy but I am confident that the bull market continues. My longs from 80,400 remain open , and my entire spot positions from $60,000 as well. I understand that all of X is now full of content regards DrProfit was wrong , and many are happy to see DrProfit wrong, and let me tell you that I enjoyed the entire run when bought spot at 60k and calling for 87-88k, I enjoyed shorting at $87k, and taking profits on shorts at 80,600, and accumulating longs between 80-81k resulting in an average long of 80,400. I enjoyed every single trade and the FUD and noise does not concern me at all. Know your risk, know your leverage! In case BTC loses 76k I will admit that I was wrong with my recent 80-81k long, but it will not make me a bear as I consider the current move as flush for the next leg up. No Financial Advice, educational only
278
214
19
4,234
241,875
BlockMerchant retweeted
Looks like Bitcoin finally made it to the bull market support band. Note that TOTAL2, TOTAL3, MSTR, SPX, and NDQ all gave the signal that BTC would move this direction last week.
With a second weekly close below the May high, Bitcoin is likely to drop to its bull market support band very soon. Note that TOTAL2, TOTAL3, SPX, NDQ, MSTR are already at their BMSB.
116
92
8
2,235
167,791
BlockMerchant retweeted
SIR PATRICK STEWART (1940-2026) Before everything else, Patrick was defined by being born and bred in Yorkshire, the proud county in the north of England which he loved to the end. You could hear it in his accented voice and in the stern honesty with which he told you what he thought and felt. Yorkshiremen have no truck with half-truths or avoidance of big issues. He wore his heart on his sleeve, which made him a man to rely on, to admire and in my case, love. We first met as ambitious young actors with the Royal Shakespeare Company half a century ago but we weren’t in the same productions. My first strong memory was a few years later, meeting him in the street in central London when he told me about an offer to take over a leading part in 'Star Trek'. “But Patrick think of your stage career in the UK. Do you really want to risk—getting lost in Hollywood for years and years?”. Well, he took the risk and thank goodness for us all that he did for not just his devoted Trekkies but film and theatre audiences, who marvelled at his using international celebrity to star in a string of cinema successes ('X-Men' of course) and in great classical plays by Shakespeare, Ibsen, Arthur Miller, Peter Shaffer, Pinter and Beckett at Stratford-upon-Avon, in London’s West End and on Broadway. America was his adopted home, where he met his adored Sunny who has cared for him through sickness and health, through thick and thin. But he never forsook his origins: and the proudest achievement of the most respected and beloved actor of his generation on either side of the Atlantic, was his appointment as Chancellor of Huddersfield University in Yorkshire. His farewell performance in 'Avengers: Doomsday' is yet to be seen. Ian McKellen 29 October 2026 Photo: University of Huddersfield
3,331
91,699
4,309
473,044
6,529,227
BlockMerchant retweeted
Me watching the Bitcoin bull market start without me
511
341
57
8,000
334,505
BlockMerchant retweeted
RIP Patrick Stewart. What an actor. I still can’t believe he agreed to do this scene. And he didn’t even mind when I ruined every take. Legend.
1,091
8,157
343
103,137
2,591,659
Collectors Collect
47
71
1
375
16,305
BlockMerchant retweeted
68
63
9
1,254
33,757
BlockMerchant retweeted
Anyone using the @MetaMask browser extension should be aware that a potentially dangerous feature was added last week without your permission The MetaMask extension now directly makes inline edits to websites that you visit like X It now replaces cashtags on X with a widget that in the case of $DOG points to the incorrect coin potentially causing users to buy a scam instead of the real $DOG Additionally this feature introduces risks such as third-party page injection on X and relaxes CSP frame-ancestors which increases the surface area for exploits and hacks At a minimum MetaMask should make this feature opt in only However in my personal opinion they should kill it entirely Why would the MetaMask extension have access to read and edit every webpage I visit which has potentially massive privacy and security implications? At a time when security incidents are at an all time high in crypto MetaMask should be focusing on how it can increase the security and privacy of their users rather than launching features that nobody asked for and that makes them less safe
64
129
10
418
27,520
BlockMerchant retweeted
This is what crypto has become. A pure coordinated social grift extracting from an ever financially illiterate retail base.
Yo @blknoiz06 , I feel sidelined, what should I buy?
163
156
19
2,546
133,535
BlockMerchant retweeted
we added @AskVenice to imd if you are running a worker do imd update imd venice key imd service restart
12
22
4
166
6,700
BlockMerchant retweeted
FUNNIEST THING EVER Pumpfun replying to my chart with AI slop and forgot to remove part of the chat that says they ARE MORE EXTRACTIVE "But my version of the graphic alone does not address the underlying claim that Pumpswap is far more extractive" Saved the sceenshot here before got deleted
51
32
7
464
20,303
BlockMerchant retweeted
Oh my. A positive flip of the Gaussian Ribbon has ALWAYS spelled bull run. Hold on to your butts.
25
53
4
825
33,649
BlockMerchant retweeted
gm gm here we go again. This morning somebody abused a bug in ApeStr to swap 21 apes for 21 ApeStr-owned apes. This was a known exploit (see the SQUIGSTR exploit from ~1 year ago) but incentive to run it was never there. The bug lies in buyTargetNFT: it forces a strategy contract to send arbitrary calldata to any target. Afterwards it checks only three things: its BAYC balance rose by exactly 1, it owns expectedId, and "cost" equals its ETH balance drop. This was patched in later NFTStrategy releases, but affects the original 6 (PunkSTR not affected). The attacker bought 2 BAYC to use as bait. Using a helper contract, they prep the strategy contract by selling an ape to it for 5 wei and immediately buying it back for 6 wei. That primes the contract's ethToTwap with 6 wei. They then call buyTargetNFT and pass the calldata to transfer an ape from ApeSTR to the helper using safeTransferFrom. This in turn hands execution over to the helper (remember, safeTransferFrom is NOT safe), which transfer TWO apes back to ApeSTR to satisfy the balance check (1 out, 2 in leaves ApeSTR at +1). It also calls processTokenTwap, which converts the 6 wei, setting the cost of one of the newly deposited apes to 7 wei (6 * 120%). The helper contract buys it back in the same tx. example flow: - Attacker has BAYC #1 and #2. ApeSTR has BAYC #3. - Attacker "sells" BAYC #1 to ApeSTR for 6 wei and sends BAYC #2 to it for free, but steals BAYC #3 in the process. - ApeSTR relists BAYC #1 for 7 wei, which the attacker buys. - Attacker now has BAYC #1 and BAYC #3, and ApeSTR has BAYC #2 (but doesn't even know it). The attacker ran this for all 21 BAYC in the ApeSTR contract, resulting in them being able to claim packs for all of those BAYC. Total net proceeds: $14k. This previously affected SQUIGSTR because of their shared contract - any art blocks NFT sent in would satisfy the balance check, allowing the attacker to drain the contract of squiggles in exchange for basically valueless art blocks NFTs. It was known to be possible on ApeSTR as well, so I guess it was just a matter of time before we saw it happen. The unfortunate consequence is that now, ApeSTR has 21 apes that it is completely unaware of, so they cannot be bought from the contract. And 210 attacker-owned mudwater packs were dumped into bids.
84
39
23
326
55,293
BlockMerchant retweeted
BLOOM USERS WENT TO SLEEP WITH $947,000. THEY WOKE UP TO ZERO. NOBODY CLICKED A LINK. NOBODY SIGNED ANYTHING. THEIR WALLETS DID IT FOR THEM I've been staring at the Bloom drain for an hour and I'm genuinely shook. this wasn't some guy connecting to a fake mint site. this was a trading bot thousands of us use every day. 9 users. 49 wallets. ~$947k in SOL. gone while they were asleep. let me walk you through it because the timeline is insane: > 00:59:45 UTC: THE KNOCK 1 lamport leaves the biggest victim wallet. a millionth of a dollar. a test. someone is checking if the door opens. > 01:02: THE ROLL CALL ten wallets send 0.001 SOL each to the same address. one every 2 seconds. like a machine taking attendance. by now the script knows exactly which wallets it owns. > 01:03:50 → 01:04:41: THE MASSACRE 47 wallets drained in 51 seconds. 1,636 SOL. 1,039. 1,021. 765. 640. 612. bang bang bang bang. every single tx signed by the victim's own wallet. paying its own fee. the wallets literally paid to rob themselves. > 01:28: HE COMES BACK FOR SECONDS he notices one drained wallet still has ~$49k in USDC but no SOL for gas. so this mf SENDS IT 0.02 SOL. tops up the victim. to rob the victim again. tries tiny 0.000001 USDC tests. it fails. that $49k never reaches him. cope. > 04:26: HE GETS DOXXED ON-CHAIN Onchain Lens posts his address. > 04:30:56: 4 MINUTES 46 SECONDS LATER all 9,408.21 SOL leaves in ONE transaction to a brand new wallet. he was refreshing X. of course he was. > AND THEN HE FREEZES 10+ hours. not one move. no bridge. no swap. no exchange. $947k sitting in one wallet in front of the entire timeline. > NOW THE FUNNIEST PART other scammers are dusting him from lookalike addresses. 7kY8qx…p8BQ is the hacker. 7kY82x…C8BQ and 7kY84Y…mMzQ are vultures. they're praying he copy-pastes the wrong one when he cashes out. scammers. robbing. the robber. Bloom says: third-party module, remote code exploit, no private keys leaked, 100% refund for all 9 users. glad about the refund. genuinely. but read that again: "no keys leaked" and yet 47 wallets signed their own drains in 51 seconds. if someone can make your bot sign whatever they want, does it even matter where the key is? I'm not touching a bot that holds my keys until someone explains which module, how long it was exposed, and who else ran it. tracehound rebuilt every tx of this. the drainer is being watched. the second those 9,408 SOL move, we'll all see where
HE STOLE $947,000 IN 51 SECONDS. 4 MINUTES AFTER HIS WALLET WENT PUBLIC, HE MOVED EVERYTHING. THEN HE FROZE. AND NOW OTHER SCAMMERS ARE HUNTING HIM. this is the Bloom drain, rebuilt from 73 on-chain transactions. timestamps are UTC, and every one of them is public. > CHAPTER 1: THE KNOCK (00:59) first move: 1 lamport out of the biggest victim wallet. that's $0.0000001. he isn't stealing yet. he's checking whether the door is open. > CHAPTER 2: THE ROLL CALL (01:02) ten more wallets each send 0.001 SOL to the same address, about one every 2 seconds. a person doesn't do that. a script is checking which wallets it controls. > CHAPTER 3: THE 51 SECONDS (01:03:50 → 01:04:41) 41 wallets emptied in 51 seconds. 1,636 SOL, then 1,039, then 1,021, then 765. every drain was signed by the victim's own wallet, which paid its own fee. no brute force. no phishing link. the wallets simply said yes. > CHAPTER 4: HE CAME BACK FOR MORE (01:28) 24 minutes later he sends 0.02 SOL back into one drained wallet. why give money back? that wallet still held ~$49k in USDC, and it had no SOL left to pay fees. he tests it with 0.000001 USDC transfers. the $49k never reaches him. > CHAPTER 5: SPOTTED (04:26 → 04:30) 04:26:10: Onchain Lens posts his address. 04:30:56: all 9,408.21 SOL leaves in one transaction to a brand-new wallet. 4 minutes 46 seconds. he was watching X too. > CHAPTER 6: THE FREEZE since then that wallet hasn't moved. no bridge, no swap, no exchange. almost $1M, parked in plain sight for 10 hours and counting. > CHAPTER 7: THE SCAVENGERS this is the part nobody's talking about. lookalike wallets start showing up, copying the first and last characters of real addresses, and they send dust to the drainer so a fake shows up in his history. then they go after the hacker's new wallet with copies of his own address, hoping he pastes the wrong one when he cashes out. scammers trying to scam the scammer. > BLOOM'S SIDE Bloom: a third-party module had a remote code execution bug. no private keys leaked. 9 users, 49 wallets, 100% refund. on-chain: every drain was signed by the victims' own wallets. both can be true. if you can run code on the machine that signs, you never need the key. you just ask it to sign. by 12:41 Bloom was publicly offering to negotiate. so let's recap: • 1 lamport to knock • 10 test transfers • 41 wallets in 51 seconds • 4m46s from exposure to exit • 10+ hours frozen • a crowd of scammers waiting for him to make one copy-paste mistake he doesn't have to outsmart anyone. he just has to outwait you. we don't get bored. we're watching 6nYy…moe9.
15
30
7
162
26,307
BlockMerchant retweeted
Looking further, it seems the exploit was fundamentally the same: a reentrancy attack allowing NFTs to be swapped that we patched in future releases, but it appears to be a worse outcome. In the process they seem to have re-bought the same NFT, clearing out the listing price. I think this bricked the NFTs held by the Strategy since there is no longer a listing for them. I also think this can be executed on the other 6 strategies that had this bug. This was only profitable on the APESTR contract because of the Mudwater pack claim, but there's nothing stopping someone from being unprofitable and malicious to brick the other 6 (or if there is a profitable claim in the future). NFTs getting locked in the contract is a horrible outcome. I'm glad that this didn't happen a year ago when there was more volume on these 7 tokens, but it's heartbreaking that the issue ended up being even worse. Let me know if you have any questions below and will do my best to answer.
So much time has passed that people forgot about this post, so re-surfacing after someone swapped apes out to claim Mudwater Packs TL;DR: the first 7 Strategies (minus Punks) had a reentrancy bug allowing NFTs to be swapped out, basically creating a call option.
29
7
10
84
35,973
BlockMerchant retweeted
1/ An investigation into @The__Solstice, top #3 social trader, and his ties to a massive bundling operation
477
322
300
3,218
837,476
$PEARL was hyped as AI Bitcoin: fair launch, no premine, no VCs. Turns out the lab behind it quietly raised ~$130M. Per @TheMarker (25th of Oct) $55M equity across two rounds from Lightspeed, Ribbit and Square Peg, plus a separate $75M fund for the company's own GPU array. Israeli outlet ICE matched it to corporate filings. No comment from @prlnet or the founders yet. I closed my long on the way down. Rode it from 5 figs unrealized back to almost flat, plus a juicy funding bill lol. The tech is still one of the most interesting things in crypto x AI. But with emissions this high and a launch this concentrated, a big part of the narrative is kinda dead rn imo. What still holds? The coin is fair in code. No premine, no token allocation for founders or investors. You either mined PRL or bought it. What doesn't? - The start: Difficulty began at the minimum and could only climb ~0.03% per block, so for days blocks came every ~12s vs a 194s target. Day one minted 12.3% of all PRL to date. The first six days minted a third (120M PRL, ~$210M today) on ~1/60th of today's hashrate. - Emissions: ~1.15M new PRL a day, ~$2M at $1.75, ~23% of daily volume. Hashrate tripled since late Aug, so blocks land every ~161s vs the 194s target. That's +83% to +97% more supply over the next 12 months. - Mining: One pool found 52.6% of the last 500 blocks, the top five 91.8%. So why does the raise matter if the coin was fair? Bc nobody outside the lab knows who owns that supply: - Do investors or the team hold PRL, and how much of week one did they mine? - Does the $75M GPU array mine PRL? Pearl GPUs mine as a by-product of inference, and the lab sells inference on its own API. - Will any of it be locked? Venice ($VVV) runs the same equity plus token split. But Venice announced its $65M raise, filed a Form D, locked investor tokens and burns part of its revenue. Pearl has none of that and trades at a $3.7B FDV. Price barely reacted: ~$1.80 when the story broke, $1.75 now, ~29% off the $2.46 ATH. The real test is Coinbase (roadmap since the 19th of Oct, no date yet). It's the first venue where early miners can sell size into real books, on top of ~1.15M new PRL every day. What gets me back in? - Disclosed investor and team holdings, incl. week-one mining - A clear answer on who controls the GPU fund and whether it mines - Locks on lab and investor PRL - Inference revenue that actually reaches the token A rebound is easy while liquidity is this thin, and if the team fixes this it can run again. I'm just not back in before they answer. NFA ofc.
AI spends hundreds of billions on GPUs that mostly multiply matrices. Bitcoin spends its entire security budget on hashes nobody can reuse. @prlnet makes them the same computation, and could become the Bitcoin of the AI age. Finally longed pearl-2:native in the recent (smol) dip via @entropyIO on Hyperliquid. Here's why ↓ Proof of useful work has been an open problem since Bitcoin launched. A key challenge is that in a permissionless chain, the miner picks its own inputs. Say the work is "multiply two matrices." A cheater just submits all-zero matrices, does no real compute, and farms tickets for free. So earlier designs mostly had two bad options: let someone else choose the inputs (not permissionless, and miners can't bring their own AI jobs), or pick some niche task nobody actually needs (e.g. Primecoin hunting prime chains). The breakthrough? Komargodski and Weinstein (Pearl's founders) published a PoUW mechanism for arbitrary matrix multiplication with 1+o(1) overhead in April 2025: - Miner commits to A and B, the chain seeds low-rank noise into both - The GPU runs its normal kernel on the noised operands - Every output tile doubles as a lottery ticket, hashed against the difficulty target - A winning tile gets a Plonky2 zkSNARK that nodes verify cheaply - The noise is low-rank, so the miner strips it and keeps A·B at FP8-level accuracy One forward pass, two outputs: the AI result and a shot at the block. Why can't miners cheat? The noise is seeded by the chain itself, so nothing can be precomputed, and a jackpot policy rejects "easy" crafted inputs. The only way to get a ticket is to actually run the full multiplication. And the team keeps pushing it further. The September whitepaper: - Moves mining to FP8, the low-precision format modern inference runs on across Nvidia's Hopper and Blackwell GPUs - Extends it to mixture-of-experts models, the architecture behind most large open models today - Uses Hawkeye, which replays the GPU's exact math on a normal CPU so anyone can check a proof bit for bit (co-authored by Dan Boneh, accepted at MLSys 2026) "But if the work is useful, can't an attacker sell the output and attack for free?" That's the classic objection, and Rafael Pass (Cornell Tech cryptographer, known for the first formal security proofs of Bitcoin's consensus) took it head on. His model shows that once the market adjusts, a majority attack still costs the full block reward, same as Bitcoin. What changes is where the reward ends up: instead of paying for wasted hashes, it subsidises inference. Same security, but cheaper tokens. Everything else is plain Bitcoin: UTXO, longest chain, Taproot, a 2.1B hard cap and a smooth emission curve instead of halvings. Plus a post-quantum path, since the mining is hash-based and XMSS signatures are already in consensus. So where's the demand? Most people still point to the Together AI endpoint (Together is one of the biggest inference providers for open models), which was pulled from serverless on the 27th of August. The more interesting signal tho imo is that Pearl now runs its own inference platform: 7 open models behind an OpenAI-compatible API, served on GPU capacity across the Pearl network. And it's cheaper. On all four models it shares with Together's serverless lineup (input / output per 1M tokens): - DeepSeek V4 Pro: $1.10 / $3.30 on Pearl vs $1.32 / $3.96 on Together - GLM-5.3: $1.10 / $3.50 vs $1.40 / $4.40 - GLM-5.3 Flash: $0.07 / $0.24 vs $0.15 / $0.50 - DeepSeek V4.1 Flash: $0.14 / $0.42 vs $0.30 / $1.20 Still worth keeping in mind tho that this is launch pricing, and Pearl doesn't say how much of the discount PRL is funding. But it's the direction the Pass model predicts: block rewards flowing back to users as cheaper inference. Ok, cool but how and where does this thing trade? At $1.70 and a ~$594M mcap, PRL is ~19% off its $2.10 ATH from the 14th of October rn. Spot is basically two small CEXs, BigONE and SafeTrade, with ~$5M of combined daily volume. The books are paper thin: per CoinGecko it takes ~$4K of buys to push BigONE up 2%, and ~$9K on SafeTrade. That's why the perp matters. @entropyIO listed PRL as a HIP-3 market on Hyperliquid on the 14th of Oct, and it's filling up fast: - ~$3.05M OI, already 61% of Entropy's $5M OI cap for the market - ~$2.05M daily volume, around 40% of all spot volume - Funding averaged ~0.03-0.04% an hour over the last 3 days, longs paying - Lighter runs a smaller PRL perp too, ~$0.56M OI There is a catch tho: Until a properly liquid venue lists PRL, io:PRL prices 90% off SafeTrade, so the perp inherits the spot book's fragility. Why am I long? Bc the hard part is (mostly) done. The math is public, the verification work is accepted at MLSys, the chain is live, and Pearl already sells inference cheaper than Together AI, one of the largest providers of open-model APIs, while awareness of what they're actually do still seems low across CT / my timeline. What's missing tho is proof that paid demand actually runs through the mining. Until Pearl publishes the share of mining that serves paid workloads and unless there is real adoption, PRL will trade like a mining coin and has to absorb ~1M new PRL a day (float +87% over the next year), and two thin spot books. The trade is definitely not without risk. That above gap is also the discount I see rn tho, and it's why I bought into this (still smol compared to recent run) dip. Bitcoin turned electricity into security. And if Pearl succeeds at turning GPU cycles into security and inference at the same time, it could indeed be smth like the "Bitcoin of the AI age", and with that, nothing short of huge. NFA ofc tho. Always DYOR. Once you have and want to trade pearl-2:native too, join me on Entropy (my ref link): entropy.io/?r=logix
19
12
2
104
13,815
The Club secured 5 spots on the NFC Lisbon 2027 PFP Wall. 5 Apes will each receive a 50×50 cm hand-painted portrait of their Ape, 2 VIP tickets, an exclusive digital collectible & more. Connect your wallet to enter. Winners must attend NFC Lisbon 2027 in person. Visit nfclisbon.bayc.com to enter. Entries will close Friday at 11am PT / 2pm ET.
81
103
23
454
32,606
BlockMerchant retweeted
Welp...
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
16
127
16
4,455
629,240