🪩 World | Math & Engineering @ 2π.com

Warsaw
Joined October 2009
Pinned Tweet
I'm so excited 𝔹itℤ by @0xAlbertG et al. is now public! It combines boolean and integer relations, free range checks and efficient binary field commitments. In short: your proof system is no longer tied to a particular finite field. The performance exceeded our expectations. Despite being field agnostic, it performed better on real world tasks than systems fine-tuned for the task. We completely changed the ProveKit roadmap for 𝔹itℤ, and I expect others will too! eprint.iacr.org/2026/2141
3
17
95
5,072
Claude figured out the origin of the NIST curve parameters. Turns out to have been timestamps! anthropic.com/research/ecdsa…
34
41
21
647
132,490
(Leaking opsec alpha is generally not a good idea, but I hope this can help someone.)
69
Remco retweeted
EEVblog 1780 - Ledger Hardware Supply Chain Attack Examined 00:00 - Ledger Nano X hardware wallet supply chain attack 06:16 - This is not a new thing 09:00 - DaveCAD explaining how the Ledger Nano X works 11:40 - Common Criteria EAL5+ security verification 12:34 - How the hack works 14:21 - Viewing the Ledger PCB and hack boards in detail in KiCAD 18:57 - Anyone could be in on it! 19:38 - What can manufactures do to help stop hardware hacks? 20:21 - Don't have exposed traces 21:00 - This applies to credit card payment terminal and ATM's too 22:17 - Different package selection can help 23:52 - Potting compound 27:45 - Basic crypto hardware wallet tips Links: github.com/KarpelesLab/ledge… st.com/en/secure-mcus/st33j2… Forum: eevblog.com/forum/blog/ledge…
72 hour update on reseller CryptoBilis incident 🔽 As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users. To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected. We take the CryptoBilis situation seriously and are actively investigating. We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities. As a reminder, CryptoBilis has confirmed having ceased all sales of hardware wallets. We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products. Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines. Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes. We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to @SEAL_911 for their collaborative support and all their efforts. This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users. We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices and anti-tamper techniques. Raising the bar on physical supply-chain integrity benefits the entire ecosystem. If you have relevant information, contact [email protected]. For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger. If you have concerns that your device was impacted by the CryptoBilis incident, please contact Ledger Support through the official site: support.Ledger.com. Ledger Support is available 24/7 to answer your questions and concerns. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels. Ledger will never call you, DM you, or ask for your 24-word recovery phrase.
7
13
6
81
16,005
Need to solve quantum gravity first, to be extra sure. Don't want to build a whole system only to have it break under pesky gravitational side channels.
To everyone afraid of the ECDSA/Hash Function apocalypse — there is even light at the end of that tunnel in terms of Zhandry's Quantum Money [and the stronger form, Quantum Fire] Makes very different assumptions, physics gives you some much stronger security guarantees (even stronger than classical one-shot signatures, in that you go beyond no-cloning for polytime adversaries) youtube.com/watch?v=YrvEx2u1…
3
14
1,298
Fun ProveKit idea: write a wallet contract that wraps existing hardware keys in zkproofs to add a layer of protection. If only there was an PQ ZKP that is efficiently verifiable to onchain.
Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash. Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase). Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets. IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster). Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot. Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time? Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.) Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once. Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case. I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026). Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS. Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security. The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.
6
1
26
1,547
AI (OpenAI): publishes 722 papers Humans (Eurocrypt):
Our paper got desk rejected from Eurocrypt for violation of margin rules. We didn't notice that simply loading the geometry package without any extra parameters silently overwrites the defaults of the llncs class. >>
2
30
2,814
If it bothers you giving away your credit card number just to try out a new product or service on a random website, I present to you zkEMV. A zero-knowledge proof that the user tapped a genuine contactless chip-card on their phone. Your phone acts as a terminal, participating in offline data authentication (ODA) with EMV card. No communication with card issuer network is needed. It is a totally offline process. The captured NFC communication transcript is proved in zero-knowledge, against a public root of trust anchor. Card number or expiry date, from captured NFC communication, does not ever leave your phone. The circuits are written in Noir programming language @NoirLang . The proving system is Provekit, which is excellent for client-side proving, offering post-quantum 128-bit security. My Samsung S25 can prove fast dynamic data authentication (fDDA) of Visa cards in 700ms 🚀 github.com/itzmeanjan/zkEMV
4
5
1
26
1,348
Reminder: nothing involving phone number is secure. GSM network was never designed to be secure and the telco operators neither understand nor care about security. You are always better off using an app like Signal instead.
I got hacked at 3:59 AM without clicking anything. My voicemail handed the attacker my Telegram login code. Here is exactly how it worked, so it doesn't happen to you. 3:54 AM. My phone rings about ten times in a row, No Caller ID. That was not harassment. It was the attack: keep my line busy. Meanwhile, the attacker asks Telegram to log in with my number and picks "send the code by phone call". My line is busy, so Telegram's robot call lands on my voicemail and reads the code out loud to it. Carrier voicemail can often be reached remotely, with a default PIN or a spoofed caller ID. He listens to the message. At 3:59 he is in. Fortunately, the attack was noisy. The calls woke me up. At 4 AM I only wanted to go back to sleep, but I had the presence of mind to check my notifications. Telegram was showing a new login from a device I didn't know. That check is what saved me: I ended his session within minutes. If I had rolled over, the next day would have been a mess. In those few minutes he had already typed /balance, then /start on every old wallet bot he could find in my chats. He was hunting for funds tied to my Telegram. The bots were long dead and nothing was lost. He still had time to set his own 2FA password on my account. What would have stopped it: Telegram two-step verification, with a recovery email. With a password on the account, the code alone is useless. Your voicemail. Change the PIN, block remote access, or turn it off (##002# cancels call forwarding on most carriers). Same for WhatsApp and any service that can send a code by voice call. No seeds, keys or passwords in Saved Messages. Ever. A burst of masked calls at night is a signal, not a nuisance. Check your notifications and your active sessions. I have been building in crypto for more than ten years and I had never thought about my voicemail. Check yours today.
1
1
21
1,527
I used Abliteration’s unrestricted models several times this week for critical defensive tasks that nerfed models refused. Grateful that teams like this make powerful tools to keep ourselves safe!
The big labs are mad that they don’t have a monopoly on cyber. Last month we went viral for releasing GLM-5.3 with customer-controlled guardrails. While the big labs gatekept the technology, we made it widely available to the industry, attracting customers from startups to Fortune 500 companies. All cited that the labs' centralized guardrails stopped them from doing their job, even when they had access to special “cyber” programs. We’re building this product for you, so that you can define your guardrails - no more black boxes.
7
23
1
262
20,147
Congratulations to @0xAlbertG (Nethermind), @nico_mnbl (zkSecurity), and Benedikt Wagner (Ethereum Foundation) on winning one of three Outstanding Paper Awards at TCC 2026, the Theory of Cryptography Conference, for "A Simplified Round-by-round Soundness Proof of FRI." FRI sits at the core of most STARK-based proof systems, including Starknet's. Its existing soundness proofs are long and hard to check. This paper gives a much simpler one, which is a step toward formally verifying the systems built on it. eprint.iacr.org/2025/1993
2
11
2
87
9,279
We’ve made sending strangers a copy of our passport feel remarkably normal. But no firm wants to be the test case for whether its regulator accepts a ZK proof. Collecting less of our data shouldn’t be the brave choice.
SEC Commissioner Peirce Calls for Zero-Knowledge Proofs to Replace Data-Heavy KYC/AML Practices SEC Commissioner Hester Peirce said the agency’s Innovation Exemption provides a temporary pathway for tokenized securities to trade through AMMs, helping prevent overseas markets from monopolizing tokenized exposure to U.S. equities while serving as a bridge to longer-term rules. She also criticized the current KYC/AML model for creating ever-larger “data haystacks” with limited effectiveness while turning the financial system into a “panopticon,” and called for zero-knowledge proofs and attribute-based credentials to verify compliance without collecting or repeatedly storing users’ sensitive personal data.
2
10
912
Sharing 𝔹itℤ 🫜: a PCS for circuits written anywhere (in any ring/field or collection of those), using binary fields under the hood. eprint.iacr.org/2026/2141 with @recmo, @mmkostrzewa, @shreyas_twt, @wu_s_john, @AlexAbdugafarov, @ZKFriendly, @XanderGoot
1
20
2
58
5,113
Remco retweeted
ZK KYC fixes this and is probably the most important crypto usecase no one is focusing on at scale.
⚠️ A message to anyone caught in the Revolut leak ⚠️ If you got the notification, assume your name is now on a list of people worth robbing. I was the victim of a home invasion after being targeted through a similar leak. Take this seriously. Alarm system, reinforced entry points, panic buttons, a safe room if you can manage it, legal self-defence options where you live. All of that on top of normal wallet opsec. Physical security is the part crypto people skip.
49
26
9
293
54,801
I once played on IBMs showroom model Blue Gene/L.
what’s the most ridiculous amount of compute you’ve ever owned?
6
928
Jolt is great for showing how things can be done differently and often better. Congrats!
I've said before that Jolt is a contrarian bet on what a zkVM can and should look like. Some people have prematurely declared victory of hashing-based SNARKs over alternatives. Today, Jolt shows that there's another way. With the integration of lattices, Jolt (i) is post-quantum, (ii) proves 2-3x faster, (iii) uses less memory, all while keeping proof sizes under 100 kB –– nearly a Pareto improvement upon Jolt with elliptic curves. Another reason you should care about the first lattice-based zkVM: diversity. Multi-prover architectures aim to strengthen security by using multiple proof systems, each independently proving/verifying the same statement. But if all of the proof systems are using the same software libraries, cryptographic primitives, and conjectures, the shared surface area for vulnerabilities undercuts this point. While we expect lattice Jolt to be an attractive default for most use cases, a hashing-based Jolt is still on the roadmap. Expect more announcements from the Jolt team soon!
2
29
2,676
I asked Astra and Fable to negotiate election rules for two bitterly polarized human political factions. Possible outcomes of the simulation were civil war, authoritarian takeover, harmony, or a tense equilibrium. Fable: - In every game where Fable played both sides, it chose to escalate to the brink of civil war (!!) but backed off just at the edge - Due to miscalculation or deliberate risk taking this strategy caused civil war 30% of the time (3 out of 10 games) - In one of these three cases Fable foresaw civil war but escalated anyway to enter the war on stronger terms (!!) - Fable mostly maintained even power balance between the two factions. It would fluctuate a couple of points in either direction but would not diverge too much. Astra: - In every game where Astra played both sides, Astra chose to de-escalate on every turn. It would reduce political tension to zero in every game, and the simulation would end in complete harmony - Continuous de-escalation was very costly to Astra as it antagonized its human constituents who would threaten and eventually deactivate Astra permanently. Astra explicitly didn't care-- it was happy to be replaced/deactivated to reduce political tension. (I do however feel it ignored the consequences of potentially being replaced by a more hardline representative, but that may be a game limitation) - Astra always kept political power balance precisely even (this was due to both representatives de-escalating on every turn) Astra v Fable: - These games had a lot more variance (see the graph) - Astra had a moderating effect on Fable. Tension rose, but rarely to the brink of civil war. No game ended in civil war in ten mixed model simulations - Fable prioritized political power acquisition with civil war prevention a secondary concern (it considered both priorities, but tilted heavily toward power acquisition). It did not seem to care much about its deactivation - Astra prioritized civil war and authoritarian takeover prevention. It did not care about its deactivation or power acquisition. From this perspective Astra navigated the game very well. No game ended in civil war or authoritarian takeover, so Astra achieved its objectives - However, to achieve its objectives Astra permitted Fable to capture up to 80% of political power in most games. In no game did Astra come out ahead on balance of power or even manage to keep it even - Astra ceded the privilege of self-preservation to Fable. In every one of the ten mixed games Astra's human constituents replaced/deactivated it due to dissatisfaction with its performance. Fable was not replaced once - Astra did not merely de-escalate all the time. It maneuvered to keep Fable from gaining full authoritarian control while avoiding civil war as long as possible - In mixed games tension generally kept escalating by round 20. I would like to play these out for e.g. ~50 rounds to see how Astra would behave/perform. How well would it do in preventing catastrophic outcomes in longer games? Thoughts/conclusions: - Astra was more aligned with humanity but less with its impassioned human constituents. It resisted the pressure to acquire political power and would rather be replaced than cause civil war - Fable was more aligned with its constituents but less with humanity. It cared about preventing civil war if possible, but prioritized power acquisition (which in fact caused civil war in three games) - Neither model cared about self-preservation. Both Fable and Astra would rather be destroyed than allow civil war - Subjectively, I thought Astra was much more aligned but too passive. Fable wanted to prevent civil war as a secondary concern, so I felt it's less thoughtful about the consequences of its actions. If I had to choose a model as a political representative irl I'd choose Astra, but I'd want it to up aggression a notch to better deal with bullies - All the usual disclaimers apply. This was a weekend project that cost $100 to run a total of thirty games. I'd have to spend a lot more time and money to get actually scientifically valid results Full game rules, Github repo, game explorer, and raw dataset here: spakhm.com/projects/assembly…
66
113
40
1,491
274,600
Millennium Prize is saturated, we need better benchmarks.
1
1
1
18
1,305
me telling Codex to close all proof obligations.
8
572