Free Speech · Privacy · Fungibility @kashilo_com · https://xitter.cf/t.co/I2rZ0Njlc9 · https://xitter.cf/t.co/hD1qLMoQqz · https://xitter.cf/t.co/mlVWYovwRE · https://xitter.cf/t.co/Hs2tYtQiwO 🇨🇭
Switzerland
Joined February 2009
- Tweets20.4K
- Following963
- Followers10K
- Likes27.4K
Pinned Tweet
kashilo:v1:Schmidt:x:@schmidt1024:8BBU96AI3fExvvwCIsByxELE_SjAlywuQzggwbM9UGjZQH3vbzBqpZwS_ZUFr-07qoauK5kU0wYI-rl2479eBA
Schmidt retweeted
We're excited to announce that CLI v0.18.5.4 'Fluorine Fermi' has been released!
'This is a minor release that includes bug fixes.'
monostr made it into F-Droid 🎉
tip on Nostr with Monero
no Lightning
no custodian
f-droid.org/packages/com.mon…
#nostr #monero
Schmidt retweeted
4- monostr: a Nostr client with Monero tips (stasher.news/items/340638)
5- (Post-Quantum) Cryptographic Right Answers (stasher.news/items/340765)
6- FCMP++ Meme-Design Contest (stasher.news/items/340804)
Schmidt retweeted
“They can't trace Monero, bullshit.” Let's be clear:
Zcash leaks at its own edge. When coins go into or out of the shielded pool, the amount shows on Zcash’s own chain. Monero has no edge like that. Every amount is hidden (RingCT), every receiver gets a one-time address, and every spend sits among decoys. You can’t follow coins across Monero’s ledger.
But a thief doesn’t live inside Monero. They have to get in and get out, and the doors are often public.
A hypothetical scenario, using XMR1 on Hyperliquid:
- The thief swaps stolen USDC into XMR1. Hyperliquid is a public chain, so the wallet, size and time are all on the record.
- They withdraw to native XMR through the bridge in 9 lots of ~210, one about every 40 minutes. The withdrawals are public. Nobody sees what happens inside Monero after that.
- Two days later, 9 deposits of ~209.9 XMR come back through the bridge and mint XMR1 to a fresh wallet. Same count, same sizes less fees, same 40-minute rhythm. Or the same shape turns up somewhere else, as BTC out of a swap desk worth the same at that hour.
All we can do is match the way in to the way out. But that leaves plenty to go on: how many lots, how big, when, and many more markers that people don't realise.
That’s not a weakness in Monero. Monero does its job.
Almost everything leaves a trace. Walk through a room and you leave a scent. You can’t see it, but the right sensor picks it up. On-chain it’s the same: the trail is always there, you just need the right instrument to see it.
Schmidt retweeted
We're excited to announce that GUI v0.18.5.3 'Fluorine Fermi' has been released!
'This is a highly recommended release that includes a large number of bug fixes.'
Schmidt retweeted
XSAs released on 2026-10-13
qubes-os.org/news/2026/10/13…
tip people on Nostr with Monero
no Lightning
no custodian
amounts stay private
monostr.com
Schmidt retweeted
🚨 Shielded Zcash was traced a second time through Near Intents. Yfarmx also traced the stolen Zcash from the Bitget hack that was shielded and was able to see it swapped into BTC, and they were able to do it because Near Intents collects and leaves metadata on every swap. This shows that shielded Zcash has been traced in both major hacks where it was used.
BITGET $390M HACK 🧵 We traced the stolen Zcash out of the private pool.
The attacker took 8 pieces of Bitget's stolen Zcash, 246.74 ZEC ($406.7k), and hid them in Zcash's private pool, where who pays whom is hidden.
Every piece came back out the same way: swapped to Bitcoin through NEAR Intents, from @zodl_app, the Zcash phone wallet formerly called Zashi. That matches the phone-wallet fingerprint we flagged on every shield.
The swap service keeps a public record of each swap: the Zcash transaction in, the Bitcoin address out. 4.77 BTC ($404.5k) came out to 10 Bitcoin addresses. 7 of them are missing from Bitget's attacker list.
Schmidt retweeted
Ledger hacker used zcash and was traced.
Ledger theft, day two. Since yesterday the thief has pushed ether through Tornado Cash three times, and each time on into Zcash's shielded pool. We followed every lot out the far side. Here is how, step by step.
1. THE SAME BUILD, THREE TIMES
An ether wallet pays a fresh splitter. The splitter pays four fresh wallets. The four drop it into Tornado Cash's 100, 10 and 1 ETH pools. Minutes, every time.
Run 1, yesterday 15:17: 1,254 ETH. Run 2, today 09:42: 1,291 ETH. Run 3, today 11:56: 450 ETH from 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2, in the pools by 12:15.
2. OUT OF TORNADO CASH
The mixer breaks the link between a deposit and a withdrawal. We do not need the link. Our tooling fingerprints the withdrawal transactions themselves: how each one is constructed, who constructs it, and when.
Yesterday's 65 withdrawals (1,084 ETH) and today's 96 (1,726 ETH) all carry the same signature. The six other withdrawals from those pools in today's windows do not. Run 3 came out from 12:18 into 0x0d697aa182801566d87adc86e68e95fd3b2f5f82 (213 ETH) and 0x676b16cc18542f37d202a1a79ac05463395496a4 (122 ETH), and 195 ETH of it was inside a cross-chain swap service by 12:38. Forty-two minutes, end to end.
3. INTO ZCASH, AND OUT AGAIN
The swap service turns the ether into shielded ZEC, where sender, amount and recipient vanish. But the service's own shielding of each lot is public, and from it we derive a value signature for that lot's exit, then scan every transparent exit from the pool. 108 of 108 exits across both days match their lot to the zatoshi. Not one other exit from the pool does.
First lot today: in at 10:18:18, out at 11:06:16 in block 3512847 (8d26a9b095d4d28373527f7a6eb81a3be7f906d1e2190960c0512ff64f369418 and 738c6d1261e79766e4dd16bdbd38dced91b8e3a86ce41dcda83eda1f19208fbf), straight into a ZEC to USDC order.
Today so far: 20 lots ordered (2,379 ZEC, $2.9m), 14 out, 5 inside the pool, 1 still settling. Every exit feeds a ZEC to USDC order paying two wallets born at 11:11, 22 of the 28 paid by 12:43:
0x816D5Ee17DB1495d1409F135b98FF3edc5F3cDf8: 940,561 USDC
0xBA736A4b616e79867B6d586293966b552883f3F3: 852,258 USDC
1.79m USDC, unspent. @Circle can freeze it.
(1/2) 🧵⤵️
Schmidt retweeted
Only ~1k Zcash tx are fully shielded per day, compared to ~25k on Monero. Because Zcash allows transparent tx, most exchanges require them, and unshielding large amounts becomes suspicious or, as here, almost certainly traceable.
Schmidt retweeted
>a hacker finally uses zcash
>gets identified immediately
working as intended
Ledger theft, day two. Since yesterday the thief has pushed ether through Tornado Cash three times, and each time on into Zcash's shielded pool. We followed every lot out the far side. Here is how, step by step.
1. THE SAME BUILD, THREE TIMES
An ether wallet pays a fresh splitter. The splitter pays four fresh wallets. The four drop it into Tornado Cash's 100, 10 and 1 ETH pools. Minutes, every time.
Run 1, yesterday 15:17: 1,254 ETH. Run 2, today 09:42: 1,291 ETH. Run 3, today 11:56: 450 ETH from 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2, in the pools by 12:15.
2. OUT OF TORNADO CASH
The mixer breaks the link between a deposit and a withdrawal. We do not need the link. Our tooling fingerprints the withdrawal transactions themselves: how each one is constructed, who constructs it, and when.
Yesterday's 65 withdrawals (1,084 ETH) and today's 96 (1,726 ETH) all carry the same signature. The six other withdrawals from those pools in today's windows do not. Run 3 came out from 12:18 into 0x0d697aa182801566d87adc86e68e95fd3b2f5f82 (213 ETH) and 0x676b16cc18542f37d202a1a79ac05463395496a4 (122 ETH), and 195 ETH of it was inside a cross-chain swap service by 12:38. Forty-two minutes, end to end.
3. INTO ZCASH, AND OUT AGAIN
The swap service turns the ether into shielded ZEC, where sender, amount and recipient vanish. But the service's own shielding of each lot is public, and from it we derive a value signature for that lot's exit, then scan every transparent exit from the pool. 108 of 108 exits across both days match their lot to the zatoshi. Not one other exit from the pool does.
First lot today: in at 10:18:18, out at 11:06:16 in block 3512847 (8d26a9b095d4d28373527f7a6eb81a3be7f906d1e2190960c0512ff64f369418 and 738c6d1261e79766e4dd16bdbd38dced91b8e3a86ce41dcda83eda1f19208fbf), straight into a ZEC to USDC order.
Today so far: 20 lots ordered (2,379 ZEC, $2.9m), 14 out, 5 inside the pool, 1 still settling. Every exit feeds a ZEC to USDC order paying two wallets born at 11:11, 22 of the 28 paid by 12:43:
0x816D5Ee17DB1495d1409F135b98FF3edc5F3cDf8: 940,561 USDC
0xBA736A4b616e79867B6d586293966b552883f3F3: 852,258 USDC
1.79m USDC, unspent. @Circle can freeze it.
(1/2) 🧵⤵️
Schmidt retweeted
Nitter: Update Oct 10th seeking funding and legal help
X Corp sent C&Ds on Aug 24 & Sep 8 demanding permanent takedown of all Nitter instances + the repo.
The Sep 7 update claiming legal representation was based on false assurances: no counsel in place rn.
zedeus on HN: "I was misled by an individual who claimed to be helping the Nitter project pro bono with a team of lawyers. He made up a timeline of events that sounded mostly believable".
Looks like a bad-faith actor already tried to insert themselves into the situation: news.ycombinator.com/item?id…
They're seeking real funding & legal help now!
nitter.net/
monostr: a Nostr client with Monero tips instead of zaps (public beta, Android)
stasher.news/items/340638
