checking the chain
Blockchain
Joined January 2018
- Tweets12.9K
- Following3.8K
- Followers3K
- Likes48.4K
0xdeadf4ce retweeted
Prediction:
Every Web3 project that treats security researchers like shit will eventually learn why they needed them.
Rough day to operate custodial exchange business. But let's be honest: This was never a good idea anyway.
0xdeadf4ce retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
0xdeadf4ce retweeted
Ledger Flex sold at Singapore Airport confirmed to contain a spy implant!
@BenYorke found suspicious marks on his @Ledger and sent it to me rather than using it, that was probably the best decision here.
youtube.com/watch?v=Nf4FEFlg…
nitter.gq/BenYorke/status/210908…
I have a $300 @Ledger Flex that I bought from the Singapore airport in summer (Metapod, should be fine?)
I never plugged it in but it looks like theres some scratches on the casing, an indication of potential tampering?
Anyways theres no way i can trust it (or Ledger) now
0xdeadf4ce retweeted
Last month, the contracts powering Magic Eden were exploited to the tune of millions of dollars. I was lucky enough to be in a position to rescue a good portion of that, but it highlighted the danger of leaving approvals open as adversaries get access to better and better tools for finding holes in contract logic.
Today, Blur announced that they will be deprecating their frontend.
I've investigated Blur and found no exploits within the current contracts. However, the Blur contracts are upgradable, meaning that they could turn malicious at any time.
They currently have eight figures worth of NFTs approved to them. The safety of those NFTs effectively hinges on the opssec of the Blur team, which appears to be disbanding at this time.
If you have open approvals to Blur, I recommend you remove them immediately. Use revoke.cash or similar to ensure that you are protected in case of a contract exploit or later upgrade.
Don't wait. The time is now.
0xdeadf4ce retweeted
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
0xdeadf4ce retweeted
Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?
Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith.
This is why people do not take XRPL or Ripple seriously as an org….
0xdeadf4ce retweeted
So it would appear that the "authorized reseller" Was bought out in March of this year and forced to sign an NDA that prevented them from telling anybody that they had sold the business.
The NDA expires in 10 days.
It is now more likely that we're not dealing with a malicious employee, but probably a well-funded and relatively sophisticated bad actor, possibly DPRK.
It is also likely that this is not the only third-party reseller that they attempted to buy.
If you purchased a ledger (or other hardware wallet) from ANY reseller and not from Ledger directly, you should carefully and slowly move funds to a new device.
If you do not have a new device, you can start with a 2-of-2 multisig where your ledger is one signer and a hot wallet is another. Use that in the interim until you have another hardware device.
And in the long term, the safest way to store your self-custodied tokens remains a multisig (but not a 2/2, where loss of one key leads to loss of funds). Prefer 2/3 or 3/5.
This is incorrect. We do no longer own or operate CryptoBilis. The company was acquired earlier this year, and we fully stepped down from all operations, system access, and management. For official updates on current matters, contact Nicholas Chang ([email protected]).
0xdeadf4ce retweeted
Update Telegram Desktop immediately!
A critical vulnerability has been discovered that allows attackers to gain access to your account and secretly steal files from your computer.
The attack uses links in the format tg://. If a special command is constructed, clicking the link can cause a malicious script to send a selected file to the attacker’s channel - without requiring additional confirmation.
0xdeadf4ce retweeted
This looks like this could be exactly what I'm investigating. Anyone affected, please contact me or open your ledger and send me pictures so we can confirm if there's a bug in there (pictures: ledger board on top, spy implant below).
nitter.gq/Ledger_Support/status/…
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.
Reach out to Ledger customer support through official channels with any questions: support.ledger.com/
0xdeadf4ce retweeted
I’ve had a few people write to ask me to follow up on a (reply!) tweet I wrote that’s gotten a lot of retweets. I considered deleting it just to avoid the headache, but I think that would make people more paranoid. So let me share my thoughts.
Just send me an encrypted message when they've broken elliptic curve cryptography. Here's my public^H nevermind.
If you're in jpegs pivot to gain-of-function research.
0xdeadf4ce retweeted
🚨 ALERT — FlashLoopAdapter Safe-module exploit on Ethereum
Two Safes using a custom Aave v3 loop adapter lost an estimated $305K. The attacker gained 114.092 ETH after gas in one transaction. Aave v3 itself was not affected.
Root cause:
FlashLoopAdapter trusted a caller-controlled response from isModuleEnabled() as proof that the caller was a Safe. The attacker supplied a fake Safe, then set the adapter’s swapRouter to each real victim Safe and swapCalldata to execTransactionFromModule(...). The real Safes accepted those calls because the adapter was an enabled module.
Flow (1 tx):
Morpho WETH flash loan → repay 1,335.256 WETH of Safe #1’s Aave debt → transfer 6.426 weETH from Safe #2 and withdraw 1,306.482 weETH from Safe #1 → swap collateral and repay the loan → +114.092 ETH after gas.
Attack tx: etherscan.io/tx/0x75328f916b…
Attacker: etherscan.io/address/0x42c26…
Victim Safe #1: etherscan.io/address/0xcfedf…
Victim Safe #2: etherscan.io/address/0xe3b23…
Vulnerable module: etherscan.io/address/0x16bb8…
Both identified Safes have since disabled the module. Other Safes still using it should disable it until fixed.
Subscribe to our TG bot for real-time attack alerts 👉 exvul.com/skyeye-monitor
0xdeadf4ce retweeted
🚨 Limit Break Exploited 🚨
Ever traded NFTs on Magic Eden's Ethereum marketplace? Your wallet probably still approves Limit Break's Payment Processor, which now has a known vulnerability.
Check if you're exposed and revoke:
revoke.cash/exploits/magic-e…
