The audit model is broken and everyone knows it. You once paid $200k. You wait 8 weeks. You get a PDF. Then your protocol evolves and the audit is already stale. That's not security. That's a snapshot. We started @Fidesiumapp because security should be continuous, not ceremonial. Human auditors catch what machines miss. Automated and AI tools catch what humans can't scale to review. Neither alone is enough. The future isn't audit OR automation. It's both, working together.

Crypto talks endlessly about onboarding the next billion users, and the ones after that. Exchanges publish research about payments, yield, and tokenized assets bringing in the masses. Founders pitch “financial infrastructure for everyone.” Then you actually try to find or understand most projects as a normal person and the gap is glaring. The SEO is often terrible. A lot of sites are one-page marketing landings or JavaScript-heavy dApps that render as empty shells to crawlers. Content that should rank for “how does this work,” “is this safe,” or “what problem does this solve” sits behind wallet connects or doesn’t exist as proper pages at all. Google treats crypto as YMYL (Your Money or Your Life), so it already demands high trust signals—anonymous teams and thin, jargon-filled pages make that harder. Paid ads are heavily restricted, which makes organic search one of the few scalable channels… and yet a huge number of projects treat it as an afterthought. The result: the people searching “how to earn yield safely” or “best way to send money abroad cheaply” mostly find exchanges, scams, or outdated explainers instead of the actual protocols claiming to serve them. The explanations are even worse. Insiders suffer from the classic curse of knowledge. What feels obvious (“it’s just a shared ledger + smart contracts”) is opaque to almost everyone else. Surveys consistently show large numbers of people can’t name a single clear benefit or risk. Landing pages and docs default to tokenomics, L2s, intents, restaking, and liquidity pools without translating any of it into something a regular person cares about: lower fees, faster settlement, ownership of their own money, or access they didn’t have before. There is a huge storytelling problem. Features and charts instead of clear “here’s why this matters to you and how it works in plain English.” The industry wants retail and the next billion. The websites and messaging are still mostly built for people who already live on Crypto Twitter. Until that changes, a lot of the “onboarding” talk stays aspirational. The technical rails can scale; the discoverability and clarity haven’t caught up. Let’s not even talk about the constant stream of hacks and security incidents. The kind that wipe out funds, erode trust overnight, and make the average person wonder why they’d ever risk putting real money into something that still feels this fragile. We are never going to get there if everytime someone onboards to crypto their funds disappear in less than a month.

I mean I thought I had seen peak degen, but this is next level. More security....naw. Lets just bet on it!

This goes deeper and worse than originally thought. eMudhra’s 8 intermediate CA private keys were tiny numbers (one was literally d=4). Anyone could recover them in <1s from the public certs and forge valid certs for MITM attacks on TLS clients including python.org/PyPI. Python users must update pip to ≥26.2.2; OS-level distrust is useless because pip always loads its vendored certifi too. discuss.python.org/t/informa… (The keys were not stolen, they were generated that weak during a botched key ceremony in April 2025 and stayed recoverable the whole time.)

This is some classic security storytelling right here!

Well I don't think we are going to forget October 21st for a little while. PHP2Shell: Critical unauthenticated RCE flaws in PHP core (patched today; early/mass exploitation risk). LiteLLM 1.107.0: Malicious PyPI/Docker package that steals credentials and plants a backdoor on Python startup. SBI Dark Web Leak: India’s largest bank confirmed ~3,900 customer records with PII among ~375k dark-web records. SafePay Ransomware: CISA/FBI advisory: 600+ critical-infrastructure victims worldwide since 2024. UpdraftCentral Keys: TeamUpdraft breach let attackers use stolen keys to backdoor WordPress sites. Immediately patch PHP, scan for LiteLLM 1.107.0 and rotate secrets if found, enforce MFA and offline backups against SafePay, and audit WordPress/UpdraftPlus sites for backdoors.

So a couple months ago I started moving our banking because @Revolut decided to turn off treasury functions with no announcement. Their customer service promised to get back to me and lost the ticket. After leaving me in limbo for 2 weeks I was finally responded to. I asked for a refund of that months business banking fee because of the inconvenience and the horrible customer service. I was told to pound sand. The recent @Revolut outage and lack of coms is the opposite of a surprise.

I mean hey, at least it's not just crypto. The world’s worst passwords may have exposed 8.8 million people. The hacker behind the breach of Denmark’s national register says the key was a leaked password: “123456.” According to The Register and Danish media, the attacker got in through Pays ApS, a small Danish IT company with legitimate access to the register. Politiken then checked it. At least three of the company’s accounts, including an admin account, reportedly used that same password. Programs pulled data automatically. Records for about 8.8 million people were taken, including names, addresses, and the personal ID numbers used across Danish life. The numbers are bigger than the country’s population because the register also includes people who have died or emigrated. The attacker says they won’t sell or leak the data. That’s their claim, and authorities say the risk of identity fraud is still serious. Denmark confirmed the breach on October 5. The government hasn’t officially confirmed the password details.

I have been thinking a lot about life and cyber security. I was reminded about a quote that I think really sums it up: The curse of discipline is that every day looks the same. The curse of indiscipline is that ever year looks the same. The discipline needed in web 3 security to check the same things over and over, always looking for new vectors of attacks, all so your days look the same. The reward is that the years don't. Endless stories of hacks, opsec failures and thefts. Stay strong fam.

What a great article by @eightbitsim

The £100k tax trap disincentivises working harder. And according to HMRC, one in five businesses close to £90,000 in revenue admit trying to work less as it becomes less worth it once you hit the VAT threshold.

Reduculous @GWRHelp this is your quite car tonight. How can you oversell tickets so bad that this is the state of things. Still packing in.

Bitget, Ledger, Near, Base. Hang in there, it gets worse.

Make Cypto safe

I really don't understand trying to save a couple bucks or a bit faster delivery when purchasing a device to store WEALTH. Also the name @cryptobilis , come on people. #SomePeoplesKids Also of note here, this happened after a management buyout. A management buyout tied to a NDA so strong not even Ledger was notified of the sale.

Fidesium's 7 conference OPSEC rules. Let's not make it easy for them. 1. Don't hand over your unlocked phone. Type the number. Yes it is a pain. Do it yourself anyway. 2. Treat conference Wi-Fi as hostile, if it is sensitive use your cellular data. 3. Do I really need to say this? Don’t plug unknown USB devices into your phone/laptop. 4. Only scan QR codes when you know the source, ie TG / Linkedin. 5. Verify contract addresses and domains independently. 6. Be extremely cautious of “exclusive airdrop,” “investor allocation,” “speaker claim,” and “conference reward” links. 7. Post conference - Review important account login/session activity. Most attacks don’t require zero-days. They require you to be distracted. Stay safe fam.

So I think we have all seen the Uber play enough to understand that Anthropic is offering a heavily subsidised product in hopes that later efficiencies and a bit of price gouging will eventually lead to massive profits for their investors. But... the math isn't mathing for me. With the quality of the smaller free models now being nearly on par, I just don't see it. It is mathematically impossible to get AGI out of an LLM, so what's the play?