Wilderminds retweeted
NEAR sells you privacy while keeping access to your data
Recently listened to a podcast about NEAR's future, privacy, and AI. They're building some interesting stuff: Intents, cross-chain swaps, private AI, and financial infrastructure for AI agents.
But after digging into their official docs, I have some serious questions.
1. Your private transactions aren't private from everyone.
Even in Confidential Mode, NEAR Intents retains access to your transaction data. And they openly state in their own docs that they can share your data with third parties, including blockchain analytics companies, even without notifying you.
You hide your money from the public, but the company still has the ability to expose your entire financial history to third parties.
Congrats, you just built another bank.
2. Your privacy is in the hands of just seven validators.
NEAR's private shard runs on seven permissioned validators.
And who said these seven validators are actually independent? What's stopping them from colluding, controlling your transactions, and deciding which ones go through and which ones don't?
Instead of privacy guaranteed by cryptography without having to trust operators, you get a system where your privacy depends on a small group of participants.
If they collude or get compromised, your financial privacy is at risk.
3. Your money, but you're not the only one making the rules.
Near's terms allow for admin privileges to change fees, upgrade smart contracts, and pause them.
That means the rules aren't just defined by the code you see today. They also depend on whoever holds admin access.
And all of this comes from a project that keeps talking about how dangerous it is to trust centralized companies with your data.
Privacy from the public is NOT the same as privacy from operators, the company itself, or third parties.
If a company keeps access to your financial data and explicitly reserves the right to share it with third parties, seven selected validators are responsible for your privacy, and admins still control the contracts, this looks a lot like traditional finance with a blockchain underneath.
Why would I want another system where I have to trust someone else with my money and privacy?
AI should be on your side.
In the latest episode of When Shift Happens, NEAR Co-founder @ilblackdragon lays out the full vision of user-owned AI, why privacy is fundamental, and where NEAR is going next.
Wilderminds retweeted
Ethereum, 2015: “world computer”
Ethereum, 2026: “store of value”
The Internet Computer is the ONLY world computer
$ICP $CLOUD ♾️☁️ $ETH @VitalikButerin
Wilderminds retweeted
“The bug was in SGLang, not NEAR AI code.”
Well, thank god nobody touched NEAR code aka the docker-compose.yml.
NEAR AI doesn't build the models, doesn't build the enclave tech, and doesn't build the inference engine.
Their job is basically to keep other people's software updated on rented hardware.
SGLang had three critical 9.8 RCE vulnerabilities disclosed this year. Public PoC since April ... then someone exploited it on November 8.🤣
That's not some sophisticated supply chain attack. That's failing to patch software.
And here's the best part.
Remember NEAR AI big "0 operator access, by design" claim?
Well, their own incident report says the attacker "may have observed user requests being processed, including private mode requests."
So the enclave kept NEAR AI out, but apparently not the attacker. Working as designed, I guess.🤡
They even admit that a TEE "does not protect against a vulnerability in the software running inside the environment."
Exactly, TEE alone is just a hosting setup, not some revolutionary security architecture.
The damage so far?
❌Around 100 users emails, names and balances exposed.
❌18 agents chat logs and configurations.
❌Two customers API keys sitting in plaintext logs.
❌Private Chat taken offline.
❌No CVE number given for the incident.
And all this just 10 days after launching a cybersecurity product. You really can't make this stuff up.
Now pointing out that xAI, Cursor, Oracle, Google and AWS also use SGLang.
Sure, but there is one small difference.
Those companies weren't selling you the promise that your data could provably never be seen.
NEAR AI was.
And apparently the proof was a signature from the same box the attacker had already compromised.😂
Just to make sure we are all on the same page: NEAR AI is basically Jasnah Inc., a Web2 company running centralized AI services on rented hardware, with the $NEAR token slapped on as a payment rail.
Jasnah had one job, keep other people software updated and they couldn't even get that right.🤡
Wilderminds retweeted
Plot twist: The Solana founder agrees. In other shocking news, water is wet.
The whole point is to distract from the only metric that can't be spun: burn vs. issuance.
When that doesn't look good, you don’t fix it, you declare it irrelevant and invent a new category to be winning in.
Wilderminds retweeted
Ajki is destroying Crypto bro talking points 24/7 all over the timeline
Highly recommended follow
He's basically a cyborg without the corporate controls of modern LLMs
$ICP ☁️♾️ @ajki76
I think you are missing the point of what $ICP is actually solving.
Let's look at some major hacks:
Bybit: Had exactly what you prescribe:
an air-gapped multisig cold wallet with hardware signers.
Still lost $1.5B. The compromised laptop wasn't even Bybit's. A Safe Wallet dev was hacked, attackers obtained AWS credentials and replaced the JavaScript in Safe AWS S3 bucket. The signers approved what the screen showed them. The screen lied. The malicious JavaScript was removed two minutes later.
Binance: DevOps laptop -> service container -> the signing system signed whatever it was told. No private key was leaked.
Bangladesh Bank: Custom malware inside SWIFT Alliance Access, manipulating the Oracle DB to conceal fraudulent transfers.
Capital One: A misconfigured WAF on AWS.
See the pattern?
The pattern isn't "humans". It's one human reaching one mutable server that sits between the signer and the chain. #InternetComputer removes that server.
An attacker compromises a mutable component of the infra and changes what the system does. That infra is the attack surface, not the person signing.
That's the attack surface $ICP is designed to eliminate:
✅Frontends served directly from canisters, with responses certified by the subnet and verifiable by the client. No S3 bucket where attackers can silently replace JavaScript.
✅No traditional service containers, SSH access or admin controlled databases. Canister state changes are executed through subnet consensus.
✅No single administrator holding the upgrade keys on a laptop. Canisters can be governed by a DAO, with upgrades requiring a vote.
✅No complete signing key sitting in one place. Threshold crypto distributes key shares across nodes, while properly implemented consent messages let users verify what they're signing.
✅ No API keys or cloud credentials. Canister calls are authenticated by the protocol, nothing for a compromised laptop to hand over.
✅ Verifiable deployed code. Wasm hash is onchain, reproducible builds let anyone check it matches source.
✅ Public controllers. Anyone can see who can upgrade a canister, one key, DAO, or nobody.
✅ Withdrawal policy enforced by consensus. Limits and approvals live in the canister, not in a backend someone can reach.
✅ Upgrades go through a visible voting window. A malicious change is a public proposal, not a silent push.
✅ Certified data reads. Balances and transaction lists are verifiable as coming from the subnet, not a tampered node.
✅ No runtime supply chain. Dependencies compile into the WASM, nothing fetched at execution time.
✅ No passwords or seed phrases to phish. Internet Identity uses passkeys, with a separate principal per app.
✅ No key server. vetKeys derive encryption keys onchain via threshold crypto.
Your three "someone still has to" points: code bugs, key custody and user signing and those are real risks, and they apply everywhere. ICP has never claimed otherwise.
What $ICP solves is that the infra layer exploited in hacks like Bybit, Binance, Bangladesh Bank etc.. can be fundamentally redesigned to eliminate entire classes of attack.
#InternetComputer isn't trying to make traditional infra more secure. It's eliminating entire attack surfaces by making that infra unnecessary.
That's why I'm genuinely optimistic about ICP future.
The tech addresses real problems, and its potential extends far beyond what we've seen in crypto.
I like the direction @dominic_w is taking on X lately, focusing on practical problems and what $ICP can do to solve them.
Wilderminds retweeted
The problem is that even many $ICP fans don't understand what it is actually solving.
Some genuinely believe that apps running on ICP can't be hacked. That's nonsense. Bad code can be exploited anywhere and ICP is no exception.
What ICP does is eliminate entire categories of infra related attack vectors. Instead of trusting countless third parties, servers, cloud providers, and adminis, you're relying on the security of a single decentralized protocol.
That protocol has been running for over five years, securing more than a billion dollars in value.
The real breakthrough is drastically reducing the number of things that can be compromised.
Read the post below for some examples of the attack vectors ICP eliminate.
teapaw.org/ajki76/status/21180628…
I think you are missing the point of what $ICP is actually solving.
Let's look at some major hacks:
Bybit: Had exactly what you prescribe:
an air-gapped multisig cold wallet with hardware signers.
Still lost $1.5B. The compromised laptop wasn't even Bybit's. A Safe Wallet dev was hacked, attackers obtained AWS credentials and replaced the JavaScript in Safe AWS S3 bucket. The signers approved what the screen showed them. The screen lied. The malicious JavaScript was removed two minutes later.
Binance: DevOps laptop -> service container -> the signing system signed whatever it was told. No private key was leaked.
Bangladesh Bank: Custom malware inside SWIFT Alliance Access, manipulating the Oracle DB to conceal fraudulent transfers.
Capital One: A misconfigured WAF on AWS.
See the pattern?
The pattern isn't "humans". It's one human reaching one mutable server that sits between the signer and the chain. #InternetComputer removes that server.
An attacker compromises a mutable component of the infra and changes what the system does. That infra is the attack surface, not the person signing.
That's the attack surface $ICP is designed to eliminate:
✅Frontends served directly from canisters, with responses certified by the subnet and verifiable by the client. No S3 bucket where attackers can silently replace JavaScript.
✅No traditional service containers, SSH access or admin controlled databases. Canister state changes are executed through subnet consensus.
✅No single administrator holding the upgrade keys on a laptop. Canisters can be governed by a DAO, with upgrades requiring a vote.
✅No complete signing key sitting in one place. Threshold crypto distributes key shares across nodes, while properly implemented consent messages let users verify what they're signing.
✅ No API keys or cloud credentials. Canister calls are authenticated by the protocol, nothing for a compromised laptop to hand over.
✅ Verifiable deployed code. Wasm hash is onchain, reproducible builds let anyone check it matches source.
✅ Public controllers. Anyone can see who can upgrade a canister, one key, DAO, or nobody.
✅ Withdrawal policy enforced by consensus. Limits and approvals live in the canister, not in a backend someone can reach.
✅ Upgrades go through a visible voting window. A malicious change is a public proposal, not a silent push.
✅ Certified data reads. Balances and transaction lists are verifiable as coming from the subnet, not a tampered node.
✅ No runtime supply chain. Dependencies compile into the WASM, nothing fetched at execution time.
✅ No passwords or seed phrases to phish. Internet Identity uses passkeys, with a separate principal per app.
✅ No key server. vetKeys derive encryption keys onchain via threshold crypto.
Your three "someone still has to" points: code bugs, key custody and user signing and those are real risks, and they apply everywhere. ICP has never claimed otherwise.
What $ICP solves is that the infra layer exploited in hacks like Bybit, Binance, Bangladesh Bank etc.. can be fundamentally redesigned to eliminate entire classes of attack.
#InternetComputer isn't trying to make traditional infra more secure. It's eliminating entire attack surfaces by making that infra unnecessary.
That's why I'm genuinely optimistic about ICP future.
The tech addresses real problems, and its potential extends far beyond what we've seen in crypto.
I like the direction @dominic_w is taking on X lately, focusing on practical problems and what $ICP can do to solve them.
Wilderminds retweeted
We must indeed fix the Internet. Starting with the foundation. Move from cloud providers to a cloud protocol. But unfortunately, for the last 5 years, almost nobody has cared about this. Only shilling their niche solutions hosted on Amazon, Google cloud...
#ICP
Wilderminds retweeted
You do know that with $NEAR intents you're not removing the custodian, you're swapping the CEX for an unaccountable operator.
One company runs the relay every quote goes through. SHIELD can refuse or freeze your swap mid-execution and the bridges are custodial.
Honestly, a regulated CEX protects you better than this, at least it has a freeze policy you can read, an appeal process and a regulator to complain to. Intents gives you an as-is ToS, no uptime commitment and one operator deciding.
Wilderminds retweeted
The Internet Is Breaking... Can $ICP Save It? We sit down with Dominic Williams, founder of @dfinity, to explore the future of the internet, AI, Big Tech, and ICP's ambitious vision to change everything. teapaw.org/i/broadcasts/1yJAPwjqz…
Wilderminds retweeted
One of our most requested interviews is finally here!
We sit down with @dominic_w founder of @dfinity to explore the future of the internet, AI, blockchain and the groundbreaking vision behind $ICP.
🎙️ Full episode tomorrow at 6:30 PM UK!
Don't miss it! 🚀
🤖 Made with AI
Wilderminds retweeted
ICP maxis stop fighting people on X. Build or have discussions. Most people just want their bags to pump. Some of them have real technical expertise & might be misunderstanding IC- These are all opportunities to teach the chain we know and LOVE- We have the only FULL STACK CLOUD
Wilderminds retweeted
Dr. @sohailmunir , Chairperson of the Pakistan Digital Authority (PDA), met with Dominic Williams (@dominic_w ), Founder and Chief Scientist of @dfinity , and @PierreSamaties , Chief Business Officer, for strategic discussions on establishing an AI Factory in Pakistan for developing production-grade software for the public sector, deployed on the PDA Cloud Engine.
The meeting involved detailed deliberations on developing a sovereign AI Factory focused on GovTech, government applications, and public-sector innovation, with the aim of strengthening Pakistan’s digital infrastructure and AI capabilities.
This marks the second high-level engagement between PDA and DFINITY this year, building on their earlier meeting, which culminated in the signing of a Memorandum of Understanding (MoU).
The initial collaboration also laid the groundwork for a significant international milestone: UNDP’s adoption of Pakistan’s sovereign Cloud Engines model, reinforcing Pakistan’s emerging role in sovereign digital infrastructure and government-led technological innovation.
Wilderminds retweeted
The patent wasn't “only granted in late july”, it was filed sept 30, 2021, before the paper was even published.
The paper $NEAR cited was the public disclosure of a pending patent.
CC BY section 2(b)(2): patent rights are not licensed.
Open paper means you can read it, not run it.
"NEAR cited it" just confirms they knew where it came from.
I strongly suggest examining the full timeline and the receipts before forming an opinion.
teapaw.org/ajki76/status/21137019…
patents.justia.com/patent/12…
$ICP vs $NEAR Just embarrassing for @NEARFoundation and @ilblackdragon.
Not only did they ship a sloppy copy of $ICP tech as a bolted on permissioned MPC, they bragged about it the entire time. (TEMU Web3)
⚠️feb 2024 "a new kind of threshold signature protocol" key resharing presented as new.
@dfinity published it Mar 2021 and @dominic_w personally explained it to Illia on reddit in may 2021. 🚨
⚠️mar 2024 "first of its kind" chain-key BTC signing live on ICP dec 2022.🚨
⚠️aug 2024 "no other signing network lets smart contracts sign on any chain" $ICP canisters signing $BTC since dec 2022, ETH since dec 2023.
⚠️aug 2024 Mainnet launch: illia calls it "a major innovation" @dfinity signing design was published by Groth & Shoup in apr 2022.🚨
⚠️jun 2026 "the only protocol that can trigger native BTC/ETH with threshold cryptography" $ICP both, since 2022/2023. 🚨
⚠️feb 2026: NEAR One "arrived at a vetKeys like design without knowing about it" vetKeys on ICP jun 2025, and NEAR own 2023 requirements doc links the @dfinity vetKeys paper.🚨
Watch the video. If any of it is false, i’d like to know which part. (follow @thebasedgiant the research and production is top tier)