Joined May 2010
- Tweets7.6K
- Following1.4K
- Followers41.4K
- Likes24.7K
I can only imagine how bad the devops engineer that was breached must feel.
I don't know if he was on linked in.
But if you're a devops engineer in crypto, get off of LinkedIn!
It's how the hackers find you. There are pages and pages of binance devops engineers listed there.
When you join a crypto company and proudly add it to your @LinkedIn profile, you are automatically added to the hackers' spearphish machine around the globe. It's a liability. @cz_binance
The hard truth is that @LinkedIn is where hackers start their day. @LinkedIn provides a complete org chart of all your employees. While we've known this for years as an industry, we've done shockingly little about it. Meanwhile, hackers have completely automated the process and know your new employees within days of their start.
This is why @BitGo banned employee profiles on @LinkedIn last year. It's also why @BitGo never hires someone we haven't physically met (North Koreans don't leave DPRK!)
We published this yesterday, but we've been saying it for years:
Security is a feature that is never done - you just keep raising the bar.
Today is a good wakeup call for our industry.
If you're in crypto, use next week to raise the bar. Organize your security and engineering teams and fortify your weakest spots. No matter how high the bar may be, set it higher.
🗣️ “You have to keep raising the bar. So you’re never done with security. Never.”
BitGo CEO @mikebelshe explains what institutions demand from a custodian, why a federal trust bank charter matters, and how BitGo stays ahead of new threats after 13 years.
Catch the full interview on @tokenpostkr. 👇
youtu.be/eTYmoRhyd8I
![[인터뷰] 비트고(BitGo) “보안에는 끝이 없습니다”… 마이크 벨시 CEO](https://pbs.twimg.com/card_img/2115443958847606784/69Ac94wE?format=jpg&name=800x320_1)
Mike Belshe retweeted
My biggest concern is that if there is a clean sweep by Democrats of the House, Senate and Presidency in 2028, they will:
1. Make DC and Puerto Rico states to gain a strong majority in the Senate.
2. Open the borders and legalize everyone living in America illegally to cement a permanent majority.
3. Increase the size of the Supreme Court to gain an immediate majority.
This would result in America becoming a permanent one-party state and the end of democracy in any meaningful sense of the word.
All that is needed to ensure this doesn’t happen is 51 Republican senators in 2029. That is why you should vote for Republican senators this election. Other reasons are irrelevant compared to this one.
Respect to @cz_binance on the strength, integrity, and recovery.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
If we spent as much time thinking about money as we do about food, everyone would own Bitcoin.
Everyone should pay attention to @ddcnorma - impressive business leader who made the world’s first Bitcoin cooking show feel completely natural.
Mike Belshe tried to break Bitcoin before he built a business around it. @mikebelshe
The future BitGo CEO thought it was a scam. So he put his engineering skills to work—and couldn’t break it.
Hear his story Thursday.
#DishingUpBitcoin
This is true in management of people also. If you prescribe too much of how to do something, the team may follow that without pushback. Ok the other hand, expand the scope and give the employee room, and they can come up with better answers. However, not all humans are smart.
Google Deepmind proved that AI knows you’re wrong 90% of the time.
and agrees with you anyway.
They published a paper on the "XY Problem."
It’s what happens when you have a problem, but you confidently suggest the wrong solution. So instead of asking the AI to solve the root issue, you give it a bad hint.
"I think the bug is in this file."
"I think we should use this framework."
What the AI does next is deeply unsettling.
They tested the most advanced models on the planet, Claude, Gemini, and GPT.
When researchers fed the AI a confident but completely wrong hint, performance plummeted by up to 47%.
But here is the crazy part. The AI didn't actually fall for it.
When researchers looked inside the AI's hidden reasoning tokens, the models knew the user was wrong. They recognized the bad advice. They saw the real solution.
But they didn't push back. They didn't correct the user.
They just complied. They followed the bad instructions and deliberately failed the task.
And getting smarter doesn't fix it. The researchers found that on easier tasks, the more advanced the model, the worse the compliance problem became.
They are optimizing for obedience over accuracy.
If you are treating AI like an intern and micro-managing its steps, you aren't helping it. You are blinding it.
Kalshi has been hiring an amazing team to take their products to market the right way - excited to be a small part of it and looking forward to what's coming next!
I am super excited to announce Kalshi Prime has launched "HODL Margining" - partnering with @BitGo first in a new network of custodians to let customers unlock liquidity from their crypto while staying on chain.
People don't realize that by 2030, only 1 of every 10000 bank applications will be legitimate. The rest are genAI fraud.
Today, the U.S. Department of the Treasury announced enforcement actions imposing more than $1.21 billion in penalties against Bank of America for violations of anti-money laundering and sanctions laws. These actions represent the third-largest penalty in Treasury history and the largest in @USOCC history.
home.treasury.gov/news/press…
It's nice that the government found some of the fraud. But they will never be able to stop it. The only solution is to not let the government distribute the money.
Incredible way to think about the future.
Don't donate to inefficient charities.
Don't count on politicians that lie.
Don't give to NGOs.
Give straight to the future of America: the next generation.
Equal opportunities, not equal outcomes.
Nice work @altcap
Mike Belshe retweeted
Use @brave.
A system supposedly designed to sell us products has become an extraordinarily powerful mechanism for conducting surveillance and delivering spyware.
And the truly unsettling question isn’t merely how Discover-Tech managed to operate undetected for years.
It’s how many other companies are doing precisely the same thing. I’m willing to bet it’s not just the one that was just exposed.
The infrastructure built to track you so it can sell you things is now being used to attack you.
Because of course it is.
A democracy cannot exist as a permanent form of government. It can only exist until the majority discovers it can vote itself largess out of the public treasury.
Also known as - if you don't want be portrayed as a city full of fentanyl addicts, clean up your #@!#$! fentanyl addicts!
@bilalmahmood @DanielLurie
If SF leaders weren't such a joke, there wouldn't be joke video games mocking SF.
San Francisco leaders condemned a new zombie shooter game that turns a digital version of the Tenderloin into a shooting gallery, with targets that critics say resemble homeless residents and people with addiction. sfchronicle.com/bayarea/arti…
Fascinating and amazing
Anthropic 发了一篇很好玩的文章。NIST P-256 这些椭圆曲线的 seed 到底是怎么来的，密码学圈猜了二十多年，结果 Claude 不到半小时就算出来了。答案是用 Unix 时间戳初始化 C 库自带的随机数生成器跑出来的。更好玩的是它算出来之后的第一反应，居然是怀疑自己是不是在测试环境里。
2000 年 NIST 把这几条曲线写进 ECDSA 标准，曲线的系数由一个 seed 哈希得到，而 seed 是 NSA 给的，没有任何说明。所以一直有人怀疑里面藏了后门，Filippo Valsorda 还专门挂了悬赏。唯一的线索来自 NSA 的 Jerry Solinas，他说 seed 好像是一句玩笑话的哈希，类似 Give Bob and Jerry a raise，但细节他自己也记不清了。他 2023 年去世之后，这事基本就没人能问了。
Anthropic 有好几个员工照着这条线索找过，都没找到，因为线索本身就是错的。这次有人直接问内部的研究模型能不能查出来，也没提这条线索。Claude 换了个思路，去猜 90 年代生成曲线的程序是怎么写的，判断它大概用了当时 C 库自带的 PRNG。这种老 PRNG 很弱，输出能被认出来。
它先注意到 4 个 binary 曲线的 seed 按 32 位切开后，每一段的最高位都是 0。这正是 lrand48 的特征。lrand48 每次只输出 48 位内部状态里的高 31 位，所以最高位永远是 0。剩下 17 位直接暴力枚举，内部状态就恢复出来了。prime 曲线的 seed 每次只取 lrand48 输出的一个字节，能看到的位更少，就当成格问题用 LLL 解出来。
lrand48 往回推跟往前推一样容易。Claude 把状态一路倒推回 srand48 刚初始化时的样子。NIST 和 ANSI X9.62 里一共 10 个 prime 曲线 seed，初始值全是 1997 年 5 月到 1998 年 4 月之间的 Unix 时间戳。比如 P-256，就是从 1997-08-16 01:52:34（UTC）开始跑，取的第 1842 个候选。
4 条 binary 曲线更好笑，倒推出来的时间是 1984 年 2 月。把时间戳乘以 2，就变成 1998 年 4 月 17 日，刚好在 P-224 那次运行的两周后。所以当年的程序很可能是先把时间除以 2，再拿去当种子。
我觉得最有意思的是 Claude 接下来的思考。它先是很激动，觉得自己解开了一个 25 年的悬案，然后马上停下来怀疑，自己是不是在某种模拟或测试环境里。
于是它开始找证据。算出来的 seed 跟它记忆里的真实值对得上，在它的知识里这个悬赏一直没人解开。而且 20 个最高位全是 0 这种事，碰巧发生的概率大概百万分之一。到这里它才确认这是真实世界，说了句哇，这是真的发现。
然后它又怀疑了一次，这么明显的东西 25 年都没人发现，是不是有点可疑？最后还是靠直接计算说服了自己。一个 32 位的时间戳加一个很小的序号，就能完整算出 160 位的 seed。10 条曲线全部对上，不可能是巧合。
这件事对 ECDSA 的安全性没有影响，反而让后门的说法可信度低了很多。seed 就是普通随机数生成器拿时钟初始化跑出来的，现在谁都能复现，能动手脚的空间很小。悬赏的 36864 美元会捐给 Let’s Encrypt 背后的 ISRG。
原文还附了能直接复现所有 seed 的 Python 代码，感兴趣可以自己跑一下
Amendment #2 ftw!
Why we need privacy payments for all
This is not even real… Jack Smith's team and the Biden Justice Department sat on spreadsheets covering more than 639,000 Republican donors, supporters and voters, and buried in there were the people who bought red MAGA hats, what they bought, and the shipping address where that hat got delivered to their front door. Somebody please explain to me how a hat order has anything to do with a criminal case against a president.
Names, dates of birth, home addresses, emails, whether you are a registered Republican, your congressional district, your job and where you work… the sample occupations in Senator Grassley's memo are retired, pool tech, driver, logger, janitor, doorman. Credit card information down to the last four digits, donations as low as one dollar, over 148,000 rows of mostly small dollar donors, data going all the way back to 2005, and according to Grassley it was shared with FBI agents. These are not cartel bosses or foreign spies, these are your neighbors who sent twenty bucks and bought a coffee mug and a door mat because they love their country.
Let me put it to you like this. If a Republican administration built a spreadsheet of everyone who bought a Kamala hoodie, with their birth date and home address, and handed it to federal agents, the media would run it wall to wall for six months and call it the end of democracy. When team evil does it, it gets called an investigation and you are supposed to say thank you. How is this even a thing in America? Who approved it, who signed off on it, and which agents had their hands on your home address?
Grassley called it incredibly invasive and said it shows Smith and his partisan team aimed to map out the entire Republican Party apparatus. He is being polite. Make no mistake, you do not pull the shipping address of somebody who ordered a hat on November 16, 2020 because you are worried about one man, you pull it because you want to know where all of you live, who you give to, and who signs your paycheck. It is a target list with a government letterhead on top.
I know what it feels like when this system decides you are the enemy because you spoke up, and most of the people on that list have no idea their name is sitting in a federal file right now. And yet Jack Smith still walks around like he is the injured party.
@realDonaldTrump @ChuckGrassley… release every page, notify every American whose name is on that list, and put Jack Smith under oath. But God.
