roinevirta.eth🔴🟢 (@roinevirta) header
roinevirta.eth🔴🟢 (@roinevirta) profile picture

Tech/Product @ratioedcc | MiCA WP & ICOs: https://teapaw.org/t.co/y1LV1TcP00 | Prev. co-founder @membranefinance (acq. by @paxos)

🏴 ns.com/jjr/invite
Joined April 2011
Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)Photo by roinevirta.eth🔴🟢 (@roinevirta)
Keystone customer data leakage - contains your name, contact details, shipping address, and order information, including the items purchased and their prices.
1
1
5
1,343
Confirmation from Keystone teapaw.org/KeystoneWallet/status/…
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.
104
Incredibly bullish for euro stablecoins.
2
147
Blockchain era: 2009-2015 USDT era: 2015-2025 Euro era: 2026-> ?
Europe's currency deserves Europe's rules, on-chain. Qivalis has been authorised as an electronic money institution by De Nederlandsche Bank. It is an important step towards our euro-denominated stablecoin, to be issued under MiCA, Europe’s regulatory framework for crypto-assets, subject to the completion of the regulatory requirements. As more of finance moves on-chain, the question of whose rules apply becomes a question of European autonomy. Qivalis is developing an answer, backed by 37 European banks across 15 countries.
4
213
🤣🤣🤣
Ledger users can now borrow against their Bitcoin through @Morpho, accessed through the Yield API. Every transaction is clear-signed, and custody never leaves your @Ledger device 🧵 (1/3)
1
1
102
*custody may leave your device due to the nature of your device
1
32
KYH (Know-Your-History) on Ledger: > 2020: Ledger leaks users' contact details, leads to multiyear physical threats & scams on affected users ledger.com/addressing-the-ju… > 2023: Ledger misleads how the secure element works teapaw.org/roinevirta/status/1658… > 2023: Ledger proposes securing recovery phrase in cloud ledger.com/blog/part-1-genes… > 2023: Ledger Kit compromised in supply chain attack, leads to drains ledger.com/blog/security-inc… > 2025: Ledger does not care about your consent and shares your data even if you tell it not to teapaw.org/SCBuergel/status/19827… > 2026: Ledger customers' name & contact information leaked again teapaw.org/zachxbt/status/2008139… > 2026: Ledger vendor supply chain compromised across Asia & Europe teapaw.org/0xJohannes_/status/210…
My understanding from the #Ledger case: it has always been possible to make updates to the secure element, hence even updating it in such a manner that it gives you the raw private key. @Ledger
3
274
Ledger failures part 6: Supply chain compromised across Asia & Europe. Devices send seed phrase via LTE to someone after generation.
1
4
390
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users. I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet). The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries). My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold. Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk. I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it. If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
56
Now that’s a launch @openstandard Most supply on Tempo, followed by Solana and Base. Ethereum has the least supply.
1
18
663
Finally an EU body is reacting to MiCA's anti-consumer clause; requiring 30% (or 60%) of stablecoin reserves held as bank deposits. An ESCB response to the European Commission suggest scrapping this in favour of requirements which would allow issuers to hold short-term assets.
1
112
BRB, updating my contracts
Today we are announcing that S&P Global has entered an agreement to acquire OpenZeppelin. Onchain finance is growing from an emerging market into core financial infrastructure, and the standards and rails our team and community built are becoming the rails of global finance. OpenZeppelin smart contracts facilitated over $37 trillion in value transferred, with the vast majority of the largest DeFi protocols, blockchain networks, stablecoins and tokenized funds relying on them. With S&P Global, we expect to accelerate the impact of onchain finance, backed by more than a century of trust in global markets, benchmarks, and risk frameworks. To our clients and to all the users of OpenZeppelin open source tools: • OpenZeppelin Contracts and all our open source applications and tools remain open source, free, and publicly maintained on GitHub. Building open source standards stays a core priority. • Audits, engineering work, and ecosystem programs continue with the same team, brand, quality, and customer experience, with what will be the added benefit of S&P Global's research capacity, market data, and institutional reach. For the last decade, OpenZeppelin has set the security standard for onchain finance. Today begins a new chapter for that mission, together with one of the most trusted names in global markets. Read the full announcement: openzeppelin.com/news/spglob…
1
2
208
A day and no breach? Doubled the bounty.
Grok. Generate me a random Ethereum private key. Result: 0x3Aa59f3fBf99379f01F2a7f874F02d4d6F7364C6 Have at it.
2
120
Three bank euro stablecoin consortia have been announced. None of them is live. Will these be the big euro stablecoins or are we going to see non-consortia issuers in the top 3?
1
1
105
Grok. Generate me a random Ethereum private key. Result: 0x3Aa59f3fBf99379f01F2a7f874F02d4d6F7364C6 Have at it.
Ask your LLM: Give me a random number from 1 to 30. The answer will be 17. Always. Then it will be 7 and 23.
3
1
1
15
4,974
21 leading financial institutions have announced their commitment to launch USD and EUR stablecoins via a new joint company. Offering aims to be MiCA & Genius compliant with go-live in 27H1. Not a great look for @qivaliseu when its member banks (BBVA, Rabobank) start hedging their stablecoin bets. prnewswire.com/news-releases…
1
183
“We set the product vision for 5 teams and supported their initial builds before eventually facilitating their fundraises from leading tier-1 and tier-2 funds.“
After spending the last two years building the MegaMafia, we’ve decided to sunset the program. While it was a success in many ways, we believe that the program was built on assumptions that no longer hold. Here are some reflections, and what’s coming up next. > We had real conviction in Mafia founders, and have gone above and beyond in standing by their side to bring their products to market. Some examples include: restructuring the GTE leadership team during critical moments just one month after their initial pre-seed raise, offering to buy out Noise's investors when they tried to push out the CEO, and played a crucial role as they pivoted from their initial prediction market idea, and merging the Tenten and HitOne team after seeing the synergy between the two. > Across both cohorts which in total included 20 teams, we lent our reputation and networks to founders so they could go on to raise over $80m in funding in pre-seeds, seeds, and series As. We kept the MegaETH’s raise to a minimum so investors can get more skin in the game with the Apps directly, rather than the protocol. > For teams that had difficulty in raising when the market turned bearish, we extended resources, engineering bandwidth, and actual capital (e.g. six figures in audit for Avon) so they could make it to Mainnet. We did it solely to help founders see their vision through. > We set the product vision for 5 teams and supported their initial builds before eventually facilitating their fundraises from leading tier-1 and tier-2 funds. > We spent significant cash (in the millions) bootstrapping teams’ DeFi requirements, through market-making support, direct lending, and other liquidity related needs. > We hosted 5 large-scale in-person events (New York, Brussels, Bangkok, Singapore, and Seoul) so MegaMafia projects could meet investors and community members from around the world. In many ways, the MegaMafia was the best incubator of this cycle. But very little of that value has trickled to Mega. In fact, most of those applications are no longer being built with us. At the time, we intentionally took no equity, governance rights, nor economic value because we wanted people to be genuinely bought into the Mega vision and the power of our technology. While we will continue to support existing MegaMafia projects, there will no longer be MegaMafia 3.0. What’s next? Our ecosystem goal going forward is to support teams building OMEGA applications, apps that are only possible on MegaETH, using our wallet infrastructure and stablecoin. More importantly, we're redirecting the energy we were lending to third-party builders into our own first-party applications: consumer-grade apps, built directly by us, for the people we're trying to serve. Where MegaMafia was indirect, betting on other teams to build value we'd eventually capture, first-party apps let us build direct relationships with end users ourselves, with all the upside and accountability that comes with owning the outcome. We're aiming for faster feedback loops, with insane focus on accruing value directly to the protocol.
315
If you aren’t yet concerned about saving gas by optimising the hashed function signatures to contain the maximum number of zeros (saves 12 gas per byte!), this is a must-read primer for any Solidity engineers.
1
1
7
1,979