Bikini Bottom
Joined May 2024
“Crypto security experts are the first responders of the blockchain world” A crypto bro of mine retired to be a fireman. It made me to realize how some leave their jobs to become heroes in the industry, but he left digital hero work to become a real life hero. I started with that to say, they called our teams “first responders” and it felt like I took something from the IRL hero’s that never wear capes, only patches or badges. It was truer than I imagined. Thanks @Cointelegraph and @hyoseopyun for sharing this!! Go read about @SlowMist_Team and how one of our own at @_SEAL_Org took the fight to DPRK and yes, of course your favorite security saiyan is back with another adventure, this time with friends! This started as a learning experience and still largely is one.I have to admit it tingles my neck to sit under @zachxbt in the reading, even as a mention, and alongside @evilcos + @0xfigo amazing careers. Why? I appreciate the work of those before me, and I’m glad they have accepted my contributions. When I read the end, I saw just how different our perspectives are and how talents may vary, yet we’ve worked together and accomplished SO MUCH. So now I tell you how this all made me feel and what’s next right? I loved the different perspectives from myself and Heiner on getting into this. It largely allows me to show where growth is still happening. I sometimes used to work under the assumption that drainers and other bad guys would come after me. I decided to believe if I’m less of a troll and more of a reporter I’d have no worries. I hunt much darker things and have learned to move appropriately in such spaces, where the cost of a mistake can easily be life or death. My curiosity unearthed a world below wallet drainers I’m still fathoming exists. In my day to day, Id love to revive Doom for some ease of access to myself and others. I have a telegram bot running alongside Doom now @nft_dreww @WoAS_Necksus saw a demonstration this morning 🙏 I still love building things when I have time. Monkey, Inferno, Pink and Venom retired. Angel has taken over as AngelFerno and I have missed my dear nemesis. Come back Inferno, I miss our games. Ace and others are still wreaking havoc but we’re up due for a rematch. As mentioned, larger teams gather and share intel, but also provide immeasurable support to victims @_SEAL_Org @intell_on_chain. The draining game will evolve and so will we. Final thoughts: The hunt goes on, with many more than myself and it now includes those who deal sharper, and more damaging strikes to scam operations. Drainers, DPRK, Ransomware, so much more. Normal people pay the biggest price when their tools and conveniences become their greatest threat. My small part in this mission was a blessing, I only hope to see the growth and to one day make abusing good technology infeasible. It’s a dream from the mind of a Security Saiyan. Now it’s a reality 🫡 W3bSecOps
⚡ INSIGHT: How do crypto detectives really investigate crime? Magazine spoke to several sleuths to learn how they investigate hacks better than the cops. Via Cointelegraph Magazine
7
5
30
9,435
HAL 9000 hehe
Replying to @elonmusk
Open the pod bay doors, HAL 😂
46
0xSaiyangod retweeted
Dread it. Run from it. Destiny arrives all the same -Thanos
Full page ad in WSJ against tokenized equities:
1
2
49
0xSaiyangod retweeted
We observed in-the-wild exploitation of CVE-2026-102785 on a site running a vulnerable version of YOOtheme Pro two days after the patch. Scanners planted JPEG/PHP polyglot webshells in uploads, then operators deployed an ALFA webshell. Details: bit.ly/48fpUZ3
9
17
2
66
7,828
🇰🇵 For a few months, I posed as a recruiter and engaged a DPRK persona known as Jason Kwon, who appeared to be operating as hightechrun shortly after news of m00n was shared. He later introduced himself as Roy Hensley. At the present, there is a possibility his current alias is on a shared upwork profile. Without knowing when that profile was put into play, it’s unconfirmed if that alias has entered any projects or been exposed. Some of this will be familiar to researchers who follow DPRK activity as this wasn’t attribution built from scratch. It started with existing research from @zachxbt being publicly shared and some tracking by @intell_on_chain (@rugpullfinder). During our conversations and conveniently in the Beanstalk discord, he shared the 0xm00n GitHub account and later explained it as an “agency” account. I used decoy documents, and CanaryTokens to collect what was possible about working environments. The summary covers the identity changes I could follow and connections collected during the small engagement. I’m publishing this now because I want to get back into documenting, not leaving helpful info sitting in DMs, screenshots, and drafts. Additional context can help someone else connect an account, recognize a recycled persona, or pick up a thread you couldn’t follow further. Link to medium article ⬇️ and thanks to all involved in this. @0xfigo has recently shared some work done behind the scenes with @north_scan involving tracking DPRK so I’m mentioning that as a resource available for those doing work on our beloved IT Workers. medium.com/@0xsaiyangod/meet…
1
162
🇰🇵 For a few months, I posed as a recruiter and engaged a DPRK persona known as Jason Kwon, who appeared to be operating as hightechrun shortly after news of m00n was shared. He later introduced himself as Roy Hensley. At the present, there is a possibility his current alias is on a shared upwork profile. Without knowing when that profile was put into play, it’s unconfirmed if that alias has entered any projects or been exposed. Some of this will be familiar to researchers who follow DPRK activity as this wasn’t attribution built from scratch. It started with existing research from @zachxbt being publicly shared and some tracking by @intell_on_chain (@rugpullfinder). During our conversations and conveniently in the Beanstalk discord, he shared the 0xm00n GitHub account and later explained it as an “agency” account. I used decoy documents, and CanaryTokens to collect what was possible about working environments. The summary covers the identity changes I could follow and connections collected during the small engagement. I’m publishing this now because I want to get back into documenting, not leaving helpful info sitting in DMs, screenshots, and drafts. Additional context can help someone else connect an account, recognize a recycled persona, or pick up a thread you couldn’t follow further. Link to medium article ⬇️ and thanks to all involved in this. @0xfigo has recently shared some work done behind the scenes with @north_scan involving tracking DPRK so I’m mentioning that as a resource available for those doing work on our beloved IT Workers. medium.com/@0xsaiyangod/meet…
4
8
2
22
2,161
My profile was tested on the @north_scan platform for fun, turns out I had no DPRK followers or friends 😀 im DPRK free 🇰🇵
1
91
0xSaiyangod retweeted
🚨 ALERT: Foundation warns spam emails were sent from its official domains via compromised Cloudflare API keys, but says Passport funds and hardware remain safe.
37
12
4
79
46,563
🚨
Replying to @coinbureau
We're actively investigating the full scope and root cause of this incident, including any potential third-party involvement. To clarify the numbers, the 49 affected wallets belong to 9 individual users, not 49 separate victims. Bloom has committed to fully reimbursing all verified losses related to the incident. User safety remains our top priority. As a precaution, we recommend moving remaining funds to fresh wallets with newly generated private keys. We'll continue providing transparent updates as findings are confirmed.
53
0xSaiyangod retweeted
Replying to @coinbureau
We're actively investigating the full scope and root cause of this incident, including any potential third-party involvement. To clarify the numbers, the 49 affected wallets belong to 9 individual users, not 49 separate victims. Bloom has committed to fully reimbursing all verified losses related to the incident. User safety remains our top priority. As a precaution, we recommend moving remaining funds to fresh wallets with newly generated private keys. We'll continue providing transparent updates as findings are confirmed.
3
2
2
19
2,262
0xSaiyangod retweeted
Replying to @BloomTrading
Thanks for clarifying and for the transparency!
1
1
3
1,075
0xSaiyangod retweeted
⚠️ ALERT: BloomTrading Bot users report nearly $1 MILLION in wallet drains, with 9,408 SOL traced to a suspected attacker wallet. Reports identify roughly 49 victims, with the largest individual loss reaching 1,636 SOL, worth about $166,000. Total losses could be higher as more affected wallets emerge. Victims report losses from wallets whose private keys were imported into the trading bot, while USDC reportedly remained untouched in several cases. BloomTrading’s team is reportedly investigating and has paused some services. Users are being urged to move remaining assets to fresh wallets, disconnecting alone won’t protect funds if a private key has been compromised.
46
39
15
286
63,888
0xSaiyangod retweeted
🚨 PSA: EMAIL PHISHING CAMPAIGN TARGETING @FoundationHQ USERS. DO NOT click any link in the email. No official announcement from the @FoundationHQ team yet. Please be careful and stay vigilant out there!
Phishing email seems to have gone out to Foundation Passport users. No official word from @FoundationHQ yet. Do not click any suspicious links.
10
16
53
9,714
Phishing email seems to have gone out to Foundation Passport users. No official word from @FoundationHQ yet. Do not click any suspicious links.
21
21
6
83
27,435
0xSaiyangod retweeted
From here on out no hardware wallet cunt is allowed to shit on another hardware wallet cunt for any reason. Yall suckkkkkkkkkkk.
7
3
3
59
7,116
Replying to @KeystoneWallet
Hello @KeystoneWallet - just here with a lots of 🍿maybe @Ledger wants to sponsor some of them.
1
2
73
0xSaiyangod retweeted
Once again reminding the hardware wallet retards that the risk that becomes real when you leak people’s SHIPPING INFORMATION is not phishing. It’s fucking PHYSICAL ASSAULTS AND KIDNAPPINGS.
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.
42
47
6
670
28,654
This was my entire point when saying that specific leak was bad. We ALREADY had the attacks happening and nobody thought it was scary to have a number of people exposed?
Once again reminding the hardware wallet retards that the risk that becomes real when you leak people’s SHIPPING INFORMATION is not phishing. It’s fucking PHYSICAL ASSAULTS AND KIDNAPPINGS.
1
95
0xSaiyangod retweeted
If you think this is bad, just wait til you hear about how bad it is at scale 60,000 people arrested for speech related "crimes" over 5 years in the UK
JUST IN: UK police arrest 15 y/o boy, seize his devices, & collect his DNA after he posted photo of a local politician edited to look like a rabbit.
23
5
66
2,893
0xSaiyangod retweeted
Replying to @saiyangod
🤣🤣🤣🤣 And I can't say I'm surprised. Sucks to see but when you play in traffic with a blindfold on....
1
1
32