First {ITN pool, block on a plane, Shelley tx, smart contract, NFT Drep,...}. CEO at @fivebinaries. Founder of @blockfrost_io. Father of @deliberative_cc.

Estonia, Czechia
Joined September 2019
Another vendor lying about deleting customer data.
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.
19
988
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.
444
453
545
1,841
1,303,357
Okay, let's be honest. We have patched more vulnerabilities this month than in my entire career. But the wild thing is they were there all along.
Anyone who has been maintaining internet-facing infrastructure for the past 3 months: xitter.cf/ThePHPF/status/2112828…
3
2
17
767
I used to love dashes. LLMs took that from me.
6
22
794
Marek Mahut retweeted
EXCLUSIVE: Elon Musk came to Donald Trump with the plan to throttle Ukraine’s use of SpaceX’s Starshield satellite internet network, sources have told the Telegraph. The tech billionaire made the proposal during the US President’s row with Volodymyr Zelensky over strikes on Russian oil refineries. ‘The reality is that they were both in it,’ a senior source said of Musk’s and Trump’s involvement. But after a night of carnage in Kyiv caused by the slowdown, Musk was alarmed about the possibility of adverse consumer reaction in Europe. The SpaceX boss then proceeded to tweet, blaming the US administration, and ultimately, President Trump for authorising the slowdown. ‘He tweeted out that he was innocent and that it was the US administration that did it,’ the source said.
1,961
9,427
1,532
31,412
3,697,930
Oh noes, think about the X API revenue 😓
According to Cloudflare Data Explorer the amount of russian bot traffic has dropped to 49% after Ukraine struck a yandex data center. Could this disrupt the midterm elections in the US?
7
377
We can’t tolerate Ukraine interference in the midterm elections.
According to Cloudflare Data Explorer the amount of russian bot traffic has dropped to 49% after Ukraine struck a yandex data center. Could this disrupt the midterm elections in the US?
667
723
137
11,006
582,925
Throw your hardware wallet in the thrash and get yourself a rpi.
oh my god this is worse than we thought here's @Ledger $86M exploits explained > cryptobilis was a reputable and authorized Ledger/Trezor/OneKey dealer for over 4 years > they decided to sell the company to a Chinese guy (most likely patsy for DPRK) from northern China in MARCH 2026 > the "Chinese guy" modded the devices within the supply chain itself (physical), namely Nano X devices, to contain an implant module > ledger validity/genuineness check CANNOT detect this because hw wasn't actually tampered with, just spied on > quoting @MagicalTux: " implant just monitors what's shown on the screen, will take note of the seed as it's shown to you, then transmits it to 3rd party" > former owner chimes in on X (pic below) to say that "they were under a NDA" to not mention anything to anyone for 6 months > they obviously didn't alert any of their partners that they were authorized to sell devices of... because NDA, duh!! its in the name! > conveniently, funds start getting siphoned a few weeks before this magical NDA due date, and being laundered across all blockchains
3
1
5
1,147
Lack of accountability breeds mediocrity.
4
20
554
Marek Mahut retweeted
Really proud of this. I put a lot of care into this application, as did everyone else involved. Hope your claims all go well!
The Asset Recovery Tool Is Now Live The official asset recovery tool is now available for users whose wallets were affected by the June 2026 security incident. It allows you to verify control of an affected wallet, review any assets eligible for recovery, and submit a recovery request to a new Cardano wallet that you control. The recovery tool is available only at secondfi.io in a web browser. It is not completed through the SecondFi app. You do not need to have submitted a claims ticket before you start. Submitting a recovery request through the official tool begins the claims process for the affected wallet. Recovery is separate from wallet migration. Migration moves supported assets that remain in a wallet to a new wallet. Recovery concerns eligible assets affected by the security incident. How long recovery takes There are two separate stages, each with its own timeframe: -Proof generation, while you use the tool: up to approximately 15 minutes. This takes place on your own device, in your browser, and the browser window must stay open until it is complete. -Claim processing, after you submit: up to five working days. To maintain security measures, submitted claims are processed in batches. No action is needed from you during this stage. Before you start Have the following ready: The recovery phrase for the affected wallet. The tool supports 12, 15, and 24-word recovery phrases. A newly created Cardano wallet that you control, and its receiving address. A hardware wallet can provide an additional layer of security because it keeps private keys offline. A private, trusted computer with a current web browser. Do not use a public or shared computer. A device and internet connection that meet our recommended specifications: at least 2 GB of available memory, a processor no more than five years old, and an internet connection of at least 50 Mbps. Recovery runs entirely in your browser, is demanding on both processing power and memory, and requires you to download a file of about 2 GB. Do not use the affected wallet, an exchange deposit address, or any address you do not control as your destination. How recovery works Recovery is one continuous process. Begin by reading and accepting the Recovery Terms. The tool then takes you through four steps, set out below. If you have more than one affected wallet, repeat the process for each wallet. Step 1: Verify your affected wallet Enter the recovery phrase for one affected wallet. Before you type it, confirm that you are on your own private, trusted computer, that nobody can see your screen, that no screen sharing or recording is running, and that the address bar shows secondfi.io. Step 2: Review what is eligible The tool checks the wallet's addresses against the incident records and shows an estimated breakdown of any assets eligible for recovery. Each affected address is treated as its own request, and only addresses with recoverable assets are submitted. Step 3: Enter your destination address Provide the receiving address of your new Cardano wallet and complete the required confirmations. The destination address is bound into the proof and cannot be changed after you submit. Check every character carefully before you continue. Step 4: Generate the proof and submit The tool generates a zero-knowledge proof on your device for each eligible affected address, binding it to your destination address, and then submits your recovery request. Proof generation can take up to approximately 15 minutes. How long it takes depends on your device's processing power and your internet connection, which is why we recommend the device specifications listed above. It may take longer on older or less powerful computers and for wallets with more affected addresses. Keep the browser window open and do not leave or refresh the page until proof generation is complete. If it is interrupted, the tool will show a retry option. After you submit Once your request has been validated and submitted, it enters claim processing. Claims are processed in batches, so allow up to five working days for your request to be processed and for recovered assets to arrive in your destination wallet. No further action is required unless the tool or our official channels tell you otherwise. Please remember: This is not instant, it will take up to five working days for your request to be processed. You can check your status at any time using the status checker at secondfi.io by entering your new destination address, not the affected wallet address. Why the tool asks for your recovery phrase Your recovery phrase is used locally in your browser to generate the zero-knowledge proof. It is not stored or transmitted. Only the proof is submitted with your recovery request. Browser and security tool warnings Because the recovery tool uses your existing recovery phrase to prove ownership of your wallet, some anti-phishing tools, anti-scam tools and browser extensions may show a warning, or display a blank screen, when you open the tool or enter your recovery phrase. This alone does not mean the official tool is malicious. Before you continue, always check that you are on the exact official domain, secondfi.io, with HTTPS and no extra words, characters or lookalike spellings. Always type the address yourself rather than following a link sent by direct message, email, advertisement or any other third party. What can be recovered Amounts are assessed against the incident snapshot and shown as an estimate. The final amount may differ. For each eligible NFT that cannot be returned directly, a fixed amount of 30 ADA will be included in the ADA shown for the relevant affected address. Rules that protect you Type secondfi.io directly into your browser or from the official X account mentioned below. Never follow a link from an email, advertisement, direct message, or search result. Enter your recovery phrase only yourself, and only in the official recovery flow after confirming that the address bar shows exactly secondfi.io. Make sure nobody can see your screen and that no screen sharing or recording is running. Do not install any browser extension or application claiming to be required for recovery. No fee is required. Anyone who asks you to pay a fee, send ADA or another asset, sign a transaction, or transfer assets to an address they provide is attempting to defraud you. We will never contact you first to ask you to begin recovery. Do not use the affected wallet again. Recovery does not make it safe to use. Our official channels X accounts: @secondfiapp and @secondfi_jp Support portal: support.secondfi.io
55
35
1
332
12,999
Marek Mahut retweeted
Agents need access to Cardano data. Now, it's easy for them to access the same Blockfrost, UTxO RPC, Ogmios, and Kupo APIs used in @DemeterRun via our x402 gateway and Cardano facilitator. x402.blinklabs.cloud 24 hour access using ADA, USDM, or USDCx on Cardano
7
17
5
50
3,504
The next few years working in system engineering are gonna be fun.
Replying to @crertel
I didn't do anything. I asked two frontier agents to make the most of Elixir and this is what they came up with. Please do send a PR to speed things up! But also realize that it's not exactly extra points for Elixir if frontier agents can't find the magic "go fast" switches.
1
3
487
Cardano infra Dev: 0, -15k, -50k, "Sorry we don't want to discuss", "BuT iNfRa TaKeS aLl ThE SpEnDiNg", "why is everyone leaving?"
This quoted post is unavailable.
2
1
16
1,126
Replying to @aboodman
At least we’re good at cache invalidation.
14
16
2
467
26,185
Marek Mahut retweeted
Needs insights into Cardano data today? Demeter.run is a blockchain access service for Cardano data. Serving REST, RPC, WebSockets, and Search APIs. Built by infrastructure experts with deep Cardano roots. Sign up and get building on Cardano now.
3
13
1
35
939
Marek Mahut retweeted
Throughout the development lifecycle of Midgard, Aiken has been put through the gauntlet. Hundreds of contracts, a massive test-suite, and hundreds of thousands of lines of Aiken. Our contributions to this release include: 1. Major compiler and optimizer speedups — PR #1399 The Aiken test-suite in Midgard was taking 485 minutes to complete; this was a real performance issue and heavily slowed down development loops. This PR introduced optimizations to the Aiken compiler and optimizer ultimately resulting in: 767-test suite was 485 minutes → 5 minutes 27 seconds, approximately 89× faster 2. Reduced CEK evaluator memory blow-ups — PR #1410 Aiken was regularly causing seg-faults and OOMs when building Midgard, causing our developers computers and our remote development machines to regularly crash on certain large scripts. This PR optimized addressed these memory issues resulting in: Deeply recursive list accumulation target consumes 48 GB RAM causing OOM → the same list accumulation target consumes only 1.1 GB RAM 3. Parallelized UPLC optimization during test runs — PR #1410 Another large performance improvement improving wall-clock times by roughly 3.5x for `aiken check`. Midgard also uses Plutarch extensively, and we have made similar contributions to its maintenance during this timeframe. A raising tide lifts all boats.
Aiken v1.1.24 is now available 🎁, and with it, new (major) versions of the stdlib (v4.0.0) and fuzz (v3.0.0) libraries. This coordinated update introduces a new primitive type to the language: Value, to work more efficiently with multi-assets quantities. What else? 👇
7
18
1
132
5,170
Ran an @IagonOfficial node for 2+ years. I did the math on the 1-year lockup: • Reported "Earned": $1,177 • Actually claimable (+1Y): $705 (-40%) • Total projection with locked batches: -46% Reporting USD earnings at allocation while locking rewards for a full year creates a phantom yield operators never realize. docs.google.com/spreadsheets… xitter.cf/IagonOfficial/status/2…
9
539
I wonder when @blinklabs_io submits their Blockfrost support for it.
Banks check two things before issuing onchain: the network and the infrastructure. @Cardano_CF built the first over a decade. Fireblocks brings the second.
2
756