primalglenn 🌐🖥️ (@PrimalGlenn) header
primalglenn 🌐🖥️ (@PrimalGlenn) profile picture

ex @bancor @carbondefixyz | Everything is Awesome!!! Sometimes blockchain/web3/DeFi, other times EDM 🎶 and random 🧠

Joined December 2012
Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)Photo by primalglenn 🌐🖥️ (@PrimalGlenn)
primalglenn 🌐🖥️ retweeted
We decoded the @initia exploit. One signed tx at 14:59:26 UTC minted 2,000,000 AUSD out of nothing. 153 seconds later a valid @LayerZero_Core message released 1.4M real AUSD from the Ethereum adapter. $2.65M was back on Ethereum within 7m21s of the mint. Three exits, all into 0xDD92…edFA: AUSD: 1.4M from the AUSD OFT adapter, 71% of its balance, 576K left. ETH: 105 from the native-ETH OFT adapter, 96% of its balance, 4.84 left. USDC: 1.08M as fresh mints from 0x0, via Circle's CCTP. The mint was the attacker's own key calling one Move function, 135,888 gas, no bridge message involved. The token is an argument (recipient, token, amount), consistent with one wallet printing AUSD, USDC and ETH. LayerZero's DVNs then attested to burns that really happened, and an OFT adapter cannot check whether burned tokens were ever backed: each Ethereum lockbox pays at par for any Initia-side mint bug. Prep started 6.5 hours before the mint: 0.1 ETH from Tornado at 08:27 UTC, dust sends through @axelar AxelarHandler from 13:14, and a 0.006 ETH deposit at 14:37 into the same ETH adapter it emptied 29 minutes later. Every stable was ETH within 3 minutes of landing via 1inch and 0x, AUSD in 84 seconds. All 1,135.52 ETH (~$2.73M) now sits in a fresh wallet, 0x358e…CAC8. Same shape as Liquid on 6 Sep, where an Elements bug created 4,000 L-BTC and a valid peg-out paid 3,996 real BTC. Initia's DEX holds $3.50M of TVL and did $334K of volume in 24h. Its bridges carried 8x that for one wallet in 7m21s: on Initia, the deepest pool was the bridge.
Initia chain hacked and a bunch of tokens infiniminted. Hacker has cashed out $2.6m thus far with more in flight
33
15
3
102
15,114
primalglenn 🌐🖥️ retweeted
Initia chain hacked and a bunch of tokens infiniminted. Hacker has cashed out $2.6m thus far with more in flight
49
48
41
353
67,867
primalglenn 🌐🖥️ retweeted
Admin keys for Swell DAO's swETH and rswETH appear to be compromised (railway related?) * Attackers are raising NAV by max 1% (unbacked) each hour * Four malicious upgrade contracts have been deployed (although not queued yet through multisig) that could steal approx 2500 ETH
27
62
23
403
118,012
primalglenn 🌐🖥️ retweeted
Pou chèf gang yo ak manm gang yo k ap kenbe kat konpatriyòt nou yo an otaj ann Ayiti: Mesye nou kidnape yo pa konbatan. Yo se teknisyen nan domèn avyasyon ki fè pati misyon nou ann Ayiti, nan kad yon misyon entènasyonal. Misyon nou an gen sèlman pilòt ak pèsonèl teknik, ki gen kòm travay prensipal fè evakyasyon medikal epi sove lavi moun, pa fè lagè. Men, nou te kidnape yo yon fason lach pandan yo t ap retounen apre yo te fin achte manje nan yon makèt nan zòn nan. Se poutèt sa, jodi a nou te lanse yon operasyon militè pou pote yo sekou. Nou gen yon sèl objektif: fè kat konpatriyòt nou yo retounen lakay yo vivan, san okenn mal. Men, mwen vle pou nou menm, chèf gang yo, konprann yon bagay byen klè: atak jodi a pa anyen devan sa k ap vini si nou pa remèt toule kat otaj yo vivan. Epi pa pran pawòl nou yo pou menas san fondman. Nou deja fini ak gang yo nan El Salvador, e nou kapab fini ak nou tou. Nou toujou gen tan pou evite sa. Remèt nou kat konpatriyòt nou yo vivan, san okenn mal, epi tout bagay ap retounen jan sa te ye anvan kidnaping lan. Desizyon an nan men nou.
7,575
29,728
4,627
188,263
11,258,812
primalglenn 🌐🖥️ retweeted
"Institutions want security. They want trust. And they'll go where the liquidity is... Ethereum is dominating on all three." @therollupco
5
18
6
133
13,298
primalglenn 🌐🖥️ retweeted
O Nordeste que foi esquecido.
10,353
76,402
6,414
248,461
13,120,137
Probably, don't have to worry about wrench attacks either.
Pour la première fois, le taux d'homicide au Salvador va passer en dessous de celui de la France en 2026. Il était 100x supérieur en 2015.
3
99
primalglenn 🌐🖥️ retweeted
¿Cómo se puede cambiar el destino de todo un país?
388
3,259
304
14,445
1,497,540
primalglenn 🌐🖥️ retweeted
One would think that because blobs are almost free, L2s should have no problem landing blobs. But one interesting thing I learned from interviewing L2s is that they in fact have a lot of trouble landing blobs, EVEN WHEN there's no congestion. I want to explain why, as that reveals some very interesting facts about the protocol. Recall that blob pricing works similar to gas pricing (EIP-1559), where there's a "base fee" which goes up or down each block, depending on whether the previous block hit the target number of blobs (14 out of 21). The idea is that in a well-functioning market, the base fee will track the "market price" of blobs, so that you can land blobs by just paying the base fee, with perhaps a little priority fee if there's congestion. However, whereas this mechanism works well for regular gas, it turns out to be an issue for blobs, because blob demand is relatively inelastic to price. In other words, just because the blob price is low does not mean that L2 will send more blobs -- they still need to fill those blobs with L2 transactions, which may have low demand even when L1 blob fees are low. As a result, blob usage has been consistently below target, such that the blob price sat at 1 wei -- the theoretical minimum -- for a long time. A later EIP raised the floor higher, but it's still so low as to be effectively free. Why is this an issue? Normally it's not. People love free blobs! But at times of congestion, because the base price starts so low, it takes a HUGE amount of time for the base price to rise enough to discover the true market price. For example, if the base price is 1 gwei and the (hidden) market price is 40 gwei, it would take 47 consecutive full blocks (~10 minutes) for the base price to catch up. By the time it catches up, the congestion may already be over. So what do L2s do during congestion? They bid with the priority fee, but without knowing what the true market clearing price is, they have to overbid in order to be sure that their blobs will be included. This is precisely the unreliability / wastefulness that EIP-1559 was set out to fix in the first place! But price instability is not the only reason why L2s have trouble landing blobs. There's another more subtle and interesting reason -- MEV. Blobs are large chunks of data, and as such they cost bandwidth to propagate. Since bandwidth is a finite resource, everything being equal a block with blobs will take longer to propagate than a block without blobs. This is an issue because a block builder only has a limited amount of time to propagate blocks before missing the attestation deadline, which would cause their block to be reorg-ed. Therefore, block builders play a timing game where they wait as long as possible so they can pack the most valuable (high MEV) transactions into their block, but not waiting so long that they miss the attestation deadline. Therefore, blobs have a hidden cost -- because they make blocks larger, builders who include blobs must send out their blocks sooner, causing them to miss out on some MEV. As such, some builders refuse to include blobs EVEN WHEN there's no congestion in the blob market, so from the L2's perspective they just see their blob transactions being silently dropped, even though they appear to be paying adequate fees. To truly ensure blob inclusion, the L2 would have to include a high-enough priority fee to compensate for the lost MEV from the builder, but once again this value is hidden and hard to discover. In short, there are at least two forces against L2s landing blobs reliably: - The blob price being so low that it kills price discovery and causes bidding wars during congestion. - Blobs cause builders to lose MEV, so they ignore blobs unless priority fees are high enough to compensate for the MEV. So what can we do to make blobs more reliable? Good news is that things will already get better in Glamsterdam due to ePBS giving blobs more time to propagate, but more fixes are required if we want to completely fix these issues. Thankfully many researchers including @fradamt @potuz_eth @barnabemonnot are already thinking about this -- I may talk about some of their ideas in a future post!
12
13
4
137
6,267
primalglenn 🌐🖥️ retweeted
Update on Ledger devices at MediaMarkt Saturn 🔽 As of Oct. 13th, MediaMarkt Saturn has stopped, with Ledger’s alignment, the sale of Ledger devices in their stores and online while the investigation continues, following the report of an implant from one customer in Germany. No loss of funds were reported. We have no indication that Ledger's infrastructure, systems or services were compromised. Ledger Support is reviewing user reports, and Ledger’s cybersecurity experts, the Donjon will be examining the devices we receive: support.ledger.com. If you have questions about a device you bought, contact Ledger Support at support.ledger.com. Ledger will never call you, message you directly or ask for your 24-word recovery phrase. Many claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger and MediaMarkt Saturn channels for updates. We will share more as the investigation continues.
Readers added context they thought people might want to know
Ledger claimed MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Reports show a store was still selling them hours later with staff unaware, and products remain listed on MediaMarkt sites. x.com/0xJohannes_/st… cointelegraph.com/news/mediamark… mediamarkt.de/de/product/_le… mediamarkt.at/de/product/_le…
155
105
58
559
196,936
primalglenn 🌐🖥️ retweeted
Ledgers statement is misleading I just visited yet another MediaMarkt location to verify whether they had actually ceased selling Ledger devices. As of October 13th at 15:00 UTC, the store was still actively selling and displaying the inventory lol. When I spoke with a store employee, he was completely unaware of any such policy change and confirmed this was the first time he had heard of it. He noted that the matter was not addressed in their daily morning briefing, their team manager was equally uninformed, and their internal product news terminal had received no updates regarding this situation. It was only after I brought this to their attention that the staff proceeded to remove the devices from the sales floor. To be fair, the products were removed from MediaMarkts online shop and its most likely not in ledgers hands how fast mediamarkt is informing each store manager but Ledgers official statement claimed they had stopped the sale of Ledger devices in store as of oct 13th, which is misleading. They should rephrase their statement.
Replying to @Ledger
Update on Ledger devices at MediaMarkt Saturn 🔽 As of Oct. 13th, MediaMarkt Saturn has stopped, with Ledger’s alignment, the sale of Ledger devices in their stores and online while the investigation continues, following the report of an implant from one customer in Germany. No loss of funds were reported. We have no indication that Ledger's infrastructure, systems or services were compromised. Ledger Support is reviewing user reports, and Ledger’s cybersecurity experts, the Donjon will be examining the devices we receive: support.ledger.com. If you have questions about a device you bought, contact Ledger Support at support.ledger.com. Ledger will never call you, message you directly or ask for your 24-word recovery phrase. Many claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger and MediaMarkt Saturn channels for updates. We will share more as the investigation continues.
Readers added context they thought people might want to know
Ledger claimed MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Reports show a store was still selling them hours later with staff unaware, and products remain listed on MediaMarkt sites. x.com/0xJohannes_/st… cointelegraph.com/news/mediamark… mediamarkt.de/de/product/_le… mediamarkt.at/de/product/_le…
48
36
8
525
58,546
primalglenn 🌐🖥️ retweeted
To the resellers who helped build Trezor: thank you, and I’m sorry 💔
201
213
91
3,156
467,296
primalglenn 🌐🖥️ retweeted
Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with. Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised. This is a preventive step, taken out of an abundance of caution. We also want to thank everyone involved for the cooperation, and for the years of work putting Trezor in people’s hands.
To the resellers who helped build Trezor: thank you, and I’m sorry 💔
220
285
90
2,684
174,950
primalglenn 🌐🖥️ retweeted
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users. I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet). The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries). My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold. Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk. I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it. If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
700
1,981
668
11,463
2,094,042
primalglenn 🌐🖥️ retweeted
Update from Ledger Donjon on the CryptoBilis investigation 🔽 @DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed it stopped selling Ledger signers while the investigation continues. Based on the Donjon's analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures. The Donjon will analyze the signers it receives and will share more as the investigation continues. We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them. If your funds were drained and you have not contacted us, please do so through Ledger Support so we can include your case. We are also reviewing reports of implants in other signers and locations. We will continue to share information as the investigation progresses. Rest assured the Ledger team is going above and beyond to leave no stone unturned to investigate this situation to the strongest possible outcome. If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a signer bought from CryptoBilis. Never enter your recovery phrase into a website, app or form. If you lost funds or hold a tampered signer, contact Ledger Support at support.ledger.com and file a report with local law enforcement. Do not send the signer to anyone before speaking with Ledger Support or local law enforcement. If you lost funds, coordinate with law enforcement before opening the signer. Researchers and others with relevant information can write to [email protected]. If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at support.ledger.com/article/4…. Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it. Ledger will never call you, message you directly, or ask for your 24-word recovery phrase. We will update this post when we verify new information.
289
254
149
1,514
540,630
primalglenn 🌐🖥️ retweeted
Replying to @moo9000
Left to right: e-SIM, CPU with firmware able to recognize Ledger's font as shown on screen and capture words as they appear on screen, and a LTE module that can connect once the seed has been fully captured.
50
143
67
1,244
1,214,194
primalglenn 🌐🖥️ retweeted
LEDGER SUPPLY CHAIN ATTACK MAY HAVE BEEN EXPOSED BEFORE MASS WALLET DRAIN Former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated wallet drain after publicly exposing physically modified Ledger devices containing hidden surveillance implants. On October 8, Karpelès warned that counterfeit or tampered Ledger devices were being sold with concealed SIM cards capable of transmitting stolen seed phrases. The implants reportedly intercept data sent to the device’s screen, allowing attackers to capture recovery phrases displayed during wallet setup. Crucially, these devices can reportedly pass Ledger’s official Genuine Check because the original secure element remains intact. The verification process cannot detect unauthorized physical modifications. One theory now emerging is that attackers had been harvesting seed phrases from compromised devices, waiting to drain multiple wallets simultaneously. Karpelès’ warning reportedly attracted roughly 90,000 views, potentially alerting the attackers that their operation had been exposed and prompting them to move stolen funds. Karpelès says one compromised Ledger he examined originated in Malaysia, arrived in flawless shrink-wrap packaging, and contained an implant cleverly concealed beneath the screen. The suspected attack vector is a hardware supply chain compromise, not a cryptographic vulnerability. The connection between Karpelès’ warning and the subsequent wallet drains remains unconfirmed, as does whether the same implants were responsible. If established, the incident would demonstrate how compromised hardware can undermine self-custody even when a device passes manufacturer authentication.
Need free data? Buy a cheap ledger off a dodgy seller, pull the sim out of the spy implant and enjoy while you can (law enforcement may visit you thinking you are the one making these). teapaw.org/AliceInDisarray/status…
33
81
25
389
58,448