“Can you run a mile” became instantly funnier after the camera panned to her 😭😭
Bronny James has words with a fan in Detroit:
“Can you run a mile? How much money you make a year?” 💀
(via @FadeAwayMedia)
Numo ➰ retweeted
This just reminded me, a student told me the other day, his chapter gave him a cane with no stripes because he opted out of getting his ass beat. & I was like, & you still pay dues? Then I had to have conversation with a 20 year old about self respect
Numo ➰ retweeted
The thought of Nigerian Love Island Discourse on my timeline
Binance faked a multi billion dollar hack to default on its own customer liabilities
funds are stolenu
Binance 🚨🚨is balance sheet restructuring & trying to stop a bank run that was likely already forming due to their internal bad debts or fractional reserve practices. . Binance is facing a massive liquidity crisis (maybe due to bad loans, FTX-style internal trading desk losses, or regulatory freezes). They need to lock up $6.3 billion in user funds without admitting insolvency. 🚨
They engineered a "hack" using the EIP-7702 vector. They move the funds to wallets they control. They freeze $3B of it (to stop the bank run on their own exchange) and let $3.3B "escape" into dormant BTC wallets and Uniswap swaps (which are likely wash trades back to their own market makers). They crash the market 4-5% to liquidate short positions and scoop up cheap assets.
🚨
Look at the forensic breakdown of the attack. In the span of 20 minutes, the attacker drained funds across ten different blockchains, including Bitcoin, Ethereum, Tron, Solana, XRP, Optimism, and Avalanche.
🚨
These blockchains do not share the same cryptographic curves or key types. Bitcoin uses ECDSA (secp256k1). Solana uses Ed25519. XRP uses its own variant of ECDSA. A single compromised laptop does not possess the magical ability to sign valid transactions across ten fundamentally different cryptographic architectures in 20 minutes. As TRM Labs explicitly noted in the forensic data, a single phished Ethereum authorization cannot explain Bitcoin, Tron, XRP Ledger, Solana, and layer-2 transfers all occurring simultaneously
🚨
If a real hacker compromised their laptop, they would have to navigate Binance’s internal infrastructure to access 10 separate, isolated hot-wallet signing services, bypassing hardware security modules and multisig requirements for each individual chain. That takes hours or days of lateral movement, not 20 minutes.
🚨
The only entity capable of executing simultaneous, validly signed withdrawals across ten different chains in 20 minutes is the exchange’s own internal automated withdrawal engine
—🚨
According to the on-chain data, the attacker took 325 million USDT and swapped it for Ethereum on UniswapX at a 10 percent discount, paying a massive premium for speed.
Professional market makers absorbed that trade. Why would an external hacker take a 10 % haircut on an irreversible, unsanctioned swap when they control the wallet? They wouldn't.⚠️⚠️🚨
Furthermore, the Bitcoin stolen was split into exactly 1,000 BTC chunks across 17 new wallets and then sat completely dormant.
🚨
It was not laundered. It was not moved to a mixer. It was organized into clean, institutional-sized blocks and parked. Hackers do not park stolen funds in neat, 1,000 BTC increments. Institutional custodians do this when they are restructuring balance sheets or moving funds to cold storage under their own control.🚨
The attacker even routed test transactions back to itself before the main sweep.
This is the behavior of an internal engineer testing a deployment script.🚨
—-
Binance is doing exactly what FTX did before its collapse, just with a more sophisticated smokescreen. They have halted withdrawals. They are promising to make users whole with money they do not have.
🚨
Within the next 30 to 60 days, Binance will slowly resume withdrawals for small retail users to maintain the illusion of solvency. Large institutional whales will find their accounts frozen indefinitely pending "investigation" into the hacked funds. The $3.3 billion in Bitcoin and Ethereum currently sitting in dormant wallets will not be recovered. It will be slowly commingled with other exchange flows over the next year to quietly plug Binance's internal holes.
🚨
You are watching a bank robbery designed to hide the fact that the largest exchange on earth is out of money.
-
kenhuangus.substack.com/p/ho…
nbcnews.com/business/markets…
Numo ➰ retweeted
Replying to @chameleon_jeff
6/ The list goes on. Only you know when you want something bad enough to do it. And by all means if you don't have the drive, don't push yourself to be miserable. But when you do find the mission, let it consume your life and embrace the grind.
Numo ➰ retweeted
You log into your bank. the SMS code arrives. you copy it. you switch to the banking app. you paste it. done.
in the time between you copying that code and pasting it, every app that comes to the foreground can read your clipboard. not apps running in the background. apps that become active including ones you swipe past, or that pop up a notification you tap.
That's how clipboards work. they're a shared resource across every app on the device.
One-time codes are the obvious ones at risk, you copy an OTP, switch apps once, the code is gone from your mind but still sitting in the clipboard. any app that opens in that window reads it.
Not just OTPs. addresses, card numbers, recovery codes, passwords you copied from a password manager before pasting all of it lives in the clipboard until you copy something else or clear it.
For iPhone recent iOS versions show a banner notification when an app reads your clipboard without you tapping paste. If TikTok, a game, or a shopping app triggers that banner after you copied something sensitive that app just read whatever was there.
Apple added this specifically because apps were doing it silently at scale.
Android is more fragmented and exposed. There are two specific permissions worth auditing:
Notification access, apps with this permission can read the full text of your notifications, including OTP codes that arrive as SMS or push notifications. Go to settings → apps → special app access → notification access. Anything in there that shouldn't be reading your messages is a problem.
"draw over other apps" (display over other apps): this permission lets an app place a visible layer on top of whatever you're doing. it's used legitimately by things like screen recorders and assistant apps. it's also a known path for overlay attacks: a fake UI drawn over your real banking app, capturing your password and taps before they reach the real screen.
Some apps read your clipboard when they come to the foreground — not only when you tap Paste. That can include one-time codes, addresses, or a password you just copied. On iPhone, recent iOS versions show a banner when an app reads the clipboard; treat that as a signal, not noise. Prefer Share sheets over copy-paste for sensitive text, and clear the clipboard after OTPs. On Android, check which apps have notification access and “draw over other apps” — listeners can read OTPs that appear in notifications, and overlays are a known path for stealing passwords and taps.
At Prynoid we test claims against behaviour, including what an app touches when you are not looking.
prynoid.com/services/
Source: mysk.blog/2020/03/10/popular…
#privacy #clipboard #mobile
Numo ➰ retweeted
Anderson Paak really is one of the most unique artists ever.
Who else could make a fire project with a rapper like Cordae, along with a 70s Soul project with Bruno Mars? On top of his solo work and NxWorries. He’s different
Numo ➰ retweeted
Luka’s ass jiggled on the ground and all LORD CARRY HIM NOW 🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️🕊️
Numo ➰ retweeted
ANDERSON .PAAK x CORDAE 🚨
LA LEAKERS FREESTYLE 🎙️
“On top of the world, like Ye at SoFi.”
“My n***a [Lil] Wayne, gave me the game, that’s Yodi. My n***a Nas, took me to 8 figures, after taxes.”
“And I still can’t f**k with Justin Timberlake, gentrified the Rap game, we only asked to renovate.”
Numo ➰ retweeted
The president of the United States told Nicki Minaj to stand up so everyone could see her ass…and she did it
Replying to @RRyanMalk
AI agents. Why: Moving from pilots to production workflows with measurable ROI in coding, service, ops. Solo builders can ship like dropshipping. Upside: 10-50x as market scales to $200B+.
Humanoid robots. Why: Shipments up 400%+, factory deployments starting, labor shortage fix. Physical AI at inflection. Upside: 20-100x on mass production and cost curves.
RWA tokenization. Why: $39B onchain now, DTCC/institutions live, path to $3-10T by 2030. Bridges TradFi efficiency. Upside: 20-50x for infra and protocols capturing volume.
Numo ➰ retweeted
# Black October
For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books.
You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles.
We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out.
In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses.
Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time.
In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening.
These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1.
From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW.
For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever:
Set up 2-factor authentication for everything. I use Duo.
Use a password manager across your devices. I use 1Password.
Get an identity protection app set up. I use Alta.
Move your IoT devices to their own network. Claude helped me do this.
And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php."
This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world.
Much love.
Numo ➰ retweeted
This is exactly why you should be using an Apple TV device and not connecting your smart tv to the internet.
🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.
🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker
pip install est compromis.
L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.
Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour pypi.org, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.
Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.
La situation est terrifiante !
Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.
Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.
Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.
C'est quand il y a de la mer qu'on reconnaît les vrais marins...
Readers added context they thought people might want to know
Ce n'est pas un bug Python mais une vulnérabilité des clés privées faibles des certificats intermédiaires eMudhra/emSign (d<256 dont une valant 4), exposant les bundles certifi/pip à des MITM TLS potentiels jusqu'aux mises à jour.
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
scotthelme.co.uk/eight-bits-of-…
github.com/advisories/GHS…
Numo ➰ retweeted
Uh… guys?
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea









































