Pinned Tweet
A stark new reality...
Pavel Durov, founder of Telegram, says that passengers on the Titanic actually didn’t want to leave the ship for almost two hours after it hit the iceberg.
Pavel Durov says we are in a similar situation: our ship has already hit the iceberg. We have already started to sink without even realizing it. He is talking about the ship of our personal freedoms.
He says that personal freedoms have been eroded almost everywhere in the world, with very few exceptions. He has witnessed firsthand the methods governments use to suppress our freedoms and take away our basic rights. He has seen all the tricks: the PR tricks, the legal tricks, the political tricks, the manipulations, and the official excuses.
The thing that bothers him most today is that some of the same tricks employed by authoritarian regimes in places like Russia, China, and Iran are now also being used in some Western countries.
—————
Here are some key statements from Pavel Durov:
“Thousands of people are getting arrested every year in the United Kingdom for social media posts.”
“You say something politically incorrect online, you may end up being fined or spend some time in prison. In Germany, people get arrested and persecuted for insulting politicians online, thousands of people every year.”
“You call a politician a bigot or a thief online and you can serve up to 3 years in prison. So, now people are afraid to use their real identities. People stop using their real names when they make comments online.”
“The criminals will be fine. It will be the law-abiding citizens who will be put in danger.”
“Last year, a French tax official was caught stealing the financial data of people who held large amount of crypto assets… you have a catastrophic rise in the number of kidnappings in France. Just in the first 3 months of 2026, you have over 40 victims of kidnappings in France.”
“Another trick that has been used by authoritarians for decades. And now it is being increasingly exported from the East to the West. I’m talking about selective enforcement of laws.
The way it works is pretty straightforward. First, you need to introduce a large number of laws. You need to overburden a certain industry with excessive, mutually exclusive, contradictory regulation. As a result, you make compliance impossible. Now you can treat every entrepreneur, every CEO, every business owner in this country as a criminal.
But then the government carefully starts to choose who to persecute. If the business owner is loyal, if it complies with immoral, unlawful demands from the government, gives certain political favors, then the law enforcement system and the judicial system look the other way. But if the business owner decides to stand up for the constitutional rights of his or her fellow citizens, if they refuse to cave in to political demands from the authoritarian government, then the persecution comes in full.”
“We cannot afford to have this ship sunk. There is nowhere to escape. In the past, dissidents from authoritarian countries could flee to the West. But if the current trajectory continues, in a decade or two from now, they will have hard time trying to understand whether they have already left their repressive homeland or they’re just entering another open-air prison.”
“Those who are willing to give up their essential liberty for some temporary safety deserve neither liberty nor safety.”
—————
Which would you choose: essential liberty or temporary safety?
Magic...
When slowing down makes you faster...(& smoother...)
ADB (Autonomous Decentralized Bearing) is a patented technology developed by Sosuke Kawashima (Coo Space Co., Ltd.)
By introducing a small indent into the outer race of a deep groove ball bearing, the balls become self distributing & non-contacting without the need of a cage.
Translation: the balls don't bump into one another so no cage is required, which then means sliding friction is virtually eliminated, energy consumption is reduced by over 90%, and no lubrication is necessary.
That precise indentation I mentioned slightly decelerates and then accelerates each ball back to full speed as it passes over it. A small gap is thus created between the balls due to this change in speed. Any incidental contact between the balls acts as a restorative force, effectively transferring momentum between them and ensuring uniform spacing naturally.
Pretty cool stuff (and so very simple) in other words.
This technology is currently touted as being applied in deep sea & competition skate/bike/wheelchair cases, but seems like a prime candidate for any super low friction, demanding environment, and/or long life applications.
(All original video footage from Sosuke Kawashima on yt)
Krumlar retweeted
When slowing down makes you faster...(& smoother...)
ADB (Autonomous Decentralized Bearing) is a patented technology developed by Sosuke Kawashima (Coo Space Co., Ltd.)
By introducing a small indent into the outer race of a deep groove ball bearing, the balls become self distributing & non-contacting without the need of a cage.
Translation: the balls don't bump into one another so no cage is required, which then means sliding friction is virtually eliminated, energy consumption is reduced by over 90%, and no lubrication is necessary.
That precise indentation I mentioned slightly decelerates and then accelerates each ball back to full speed as it passes over it. A small gap is thus created between the balls due to this change in speed. Any incidental contact between the balls acts as a restorative force, effectively transferring momentum between them and ensuring uniform spacing naturally.
Pretty cool stuff (and so very simple) in other words.
This technology is currently touted as being applied in deep sea & competition skate/bike/wheelchair cases, but seems like a prime candidate for any super low friction, demanding environment, and/or long life applications.
(All original video footage from Sosuke Kawashima on yt)
Krumlar retweeted
I warned you all about this.
They will be lying. The actual goal of the big AI providers will be to outlaw open-source and open-weight AI in order to create a regulatory moat around their business, and have some hope of earning out their astronomical capital expenditures.
The claims will be about safety and equity, the reality will be a money and power grab. Brace for the bullshit avalanche that's coming.
🚨BREAKING: OpenAI is preparing a policy and PR blitz immediately after Tuesday’s midterm elections, Axios reports. As public backlash against data centers grows, it wants to rebrand them as “AI compute campuses” and push Congress for mandatory “speed limits” on the most powerful AI systems. It has been stockpiling proposals since August.
OpenAI is also preparing for the possibility of Democrats taking the House and wants to shape the debate ahead of the 2028 presidential race. Its chief global affairs officer Chris Lehane told Axios: “AI is going to be the issue in 2028.”
Krumlar retweeted
Excellent comment on this FT article about the Binance hack
ft.com/content/1d4dd7b2-9dee…
Krumlar retweeted
If you're running Ubuntu or Red Hat on a public server and cannot patch this yet the solution is:
sudo sysctl -w net.mptcp.enabled=0
‼️ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit.
The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10.
The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default.
The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable.
Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10.
Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.
Last time the market didn't properly sell off after a huge event like this was the FTX collapse
When I saw the lack of follow through then I got giga bullish
And we subsequently went from 16k to 100k
Hard to be bearish here after having been given the same setup yet again
Hard to overstate how big of a deal this is.
tl;dr — ANY unpatched Linux server with even a single TCP port exposed to the internet (say for HTTP or SSH) and MPTCP active (default for many Go web servers) is vulnerable to complete takeover.
What a disaster atlasum.net/blog/cve-2026-98…
It is extremely likely that Hyperliquid will be exploited in the next 7 days.
I highly recommend not leaving funds that you cannot afford to lose on Hyperliquid for the time being.
Thank you for your attention to this matter.
Krumlar retweeted
Just got a phishing email that Gmail authenticated as Google. DKIM/DMARC passed. I can see a lot of people falling for this one, since it plays to the idea that your account has already been compromised.
Scammer puts the scam in an app-password name, triggers a real Google alert, then forwards the alert email to your email address.
How this attack works, and why it’s convincing:
1. The trick: The attacker puts the threatening text and shortened URL into an app password’s customizable name on another account. Google incorporates that text into a real security notification and signs the email.
2. The delivery: That notification is forwarded through another mailbox to the victim. In this message, Gmail still recorded passing Google DKIM and DMARC authentication.
3. What makes it convincing: The Google sender, signature, branding, and “Check activity” button are legitimate. The suspected attacker-supplied text appears inside the same trusted-looking template, using a deadline to push you toward its separate link.
4. The giveaway: Both the notification and its genuine Google button refer to someone else’s account. The “permanent access after 24 hours” claim is false; app passwords can be revoked.
Be careful out there folks!
Krumlar retweeted
The next 12 months of gaming and game development will be insanely cool and empowering!
Krumlar retweeted
It’s like the screenwriters aren’t even trying anymore. Literally just giving the audience the same copypasta from the 2022 season.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
Most people still haven't let reality sink in. The "future of cyber attacks" isn't some kid in his basement running ChatGPT scripts hoping to find a lucky opening….
No the future is North Korean operatives getting hired onto a major tech company's SysOps team and working there for months behind hyper-realistic AI avatars and cloned voices…backed by multimillion-dollar server farms running fully abliterated models trained for the sole purpose of breaking defenses.
Or it's an attacker sitting at root level inside the IoT security camera on your office wall watching your screen
Or it's a single email with hidden instructions that your company's own AI assistant reads before quietly sending your internal files out the door without a single click
Or it's a video call where your CFO and three coworkers tell you to wire $25M…except none of them are real.
Or it's your CEO's cloned voice calling the IT help desk at 6am, asking to reset his login because he's "locked out before a board meeting."
Or it's an AI that studied years of your team's Slack messages and now writes phishing emails that sound exactly like your boss sent to every employee at once.
It's a different game…and most companies are still defending against the kid in the basement
Everyone’s immediate reaction is denial “MY crypto platform of choice is the safe one. It can’t happen to me”
With AI, every crypto platform has very likely already been penetrated…or have swarms of agents trying 24/7
The attackers are just sitting, ironing out the fine details, waiting for the right moment to pull the rug. You WILL be pwnd.
If you look closely enough, breakthroughs in everything are accelerating exponentially.
An exponential always starts off looking small.
this might be my last normal tweet before biotech goes vertical
i'm not a whistleblower. I don't work at Lilly, Novo or any of the big labs
but there is a massive shift happening in human biology right now.
it's sitting in press releases and almost nobody reads them
the last 6 months alone:
- a once-daily pill roughly doubled median survival in metastatic pancreatic cancer (13.2 vs 6.6 months)
- a one-time gene editing infusion cut hereditary angioedema attacks 87%, and 62% of patients stayed attack-free and off all other prevention for 6 months
- a one-time gene edit for cholesterol dropped LDL up to 62%, and it held for over a year
- a personalized mrna vaccine beat keytruda alone in a 1,137 patient melanoma phase 3
- retatrutide hit ~28% weight loss in a phase 3
- an ai-designed drug entered phase 3
- a pill that regrows hair passed its second phase 3
- an immunotherapy that could let some rectal cancer patients skip surgery, chemo and radiation just got fda approved
- a man lived 271 days off dialysis on a pig kidney
- human cells were caught passing chromosome-sized chunks of DNA to their neighbors, and it changes how the neighbors behave
we are on the verge of an era where the human body is a software problem and the update cycle gets shorter everyday
stick around, it's going to get weird
bio/acc
Krumlar retweeted
Reading the reconstructed bytecode of the Binance EIP-7702 sweeper (`0x63e8...6fae`) is wild.
This wasn't a generic drainer. It was custom-engineered for Binance 14's architecture:
- Leaves exactly 1 ether behind (`bal - 1 ether`) when sweeping ETH so Binance's automated hot wallet queue wouldn't error on gas and trip alarms.
- Uses raw `staticcall` + `continue` loops with custom error codes (`SweepItemFailed`) so one bricked or blacklisted ERC-20 wouldn't revert the $6B batch.
- Includes a custom `callExecute` function to impersonate Binance 14 as controller of an external vault holding $823M in USDC.
They leave a comment: "robberies could be prevented if getaway cars were slower."
You can't fully blame EIP-7702, but it sped up the attack. Without 7702, draining 64 tokens plus an external $823M vault from a live exchange hot wallet meant fighting moving nonces across 70+ transactions. Defense systems would've killed it after tx #3.
With 7702, Lazarus sprayed 50 consecutive nonces in one type-4 payload, turned an EOA into a custom proxy, and atomically swept billions in a single block.
Ethereum core devs built the ultimate getaway car. Surgical state-sponsored engineering.
This could be etched onchain:
`if (bal > 1 ether) { to.call{value: bal - 1 ether}(""); }`
The Binance $5.6B drain is a masterclass in modern EVM exploitation.
It wasn't a complex logic bug. It was an EIP-7702 delegation hijack:
1. Setup: Attacker funds 0x7c86 via Tornado Cash, deploys a sweep contract (0x63e8), and runs three live dry-runs on external wallets.
2. Execution: Attacker submits an EIP-7702 batch with 50 pre-signed authorizations (nonce n to n+49) to hit Binance 14's moving nonce window.
3. One authorization hits. Instantly, Binance 14 (an EOA) is reprogrammed to run the attacker's contract bytecode.
4. Execution looks totally organic: Binance 14 sweeps itself clean. Internal threshold alerts don't trigger because, from the nodes' perspective, the hot wallet is just executing its own transaction.
5. Binance 16 immediately auto-refills 28,000 ETH due to automated treasury rebalance scripts, feeding the exploit loop.
The cold truth: you cannot forge an EIP-7702 delegation list.
For this to execute, the attacker already held the raw private key or unconstrained signing access to Binance 14's HSM/KMS.
But hey, 5.64 billion drained across ETH, BTC, and Tron. 2.54 billion frozen by Tether, Circle, Ripple, and World Liberty within hours.
Code is law until the stablecoin admin keys log in.
Binance got bailed out by the very centralized choke points the cypherpunks warned you about.
Hardware wallets leak your home address.
Centralized exchanges leak the keys to the kingdom.
Self-custody on native, non-delegated chains remains the only honest baseline.
At least you know what to avoid.
Readers added context they thought people might want to know
The quoted comment appears only in an AI-reconstructed source (explicitly labeled not original) uploaded to explorers; no source comments exist in deployed bytecode, and core features match independent decompilations/on-chain data.
etherscan.io/address/0x63e8…
gist.wavey.info/Ta3FgAxastgj42…
x.com/thearsondragon…
Krumlar retweeted
I don’t think people realize how selfless and wonderful the StackOverflow’s founders were.
Unlike reddit, x etc they insisted ALL of their content will be 100% open, nothing will ever be locked up in walled garden.
They made it a point by even offering structured data downloads!
They didn’t cared people cloning the website. They didn’t worry about putting the whole monetization thing at risk.
It was a true hacker spirit in it’s purest form.
Most folks won’t be able to grasp how hard this is. You are on top of the world. Millions of people depend on you daily. You have the rarest opportunity to rack in billions. And you still stay true to your principles.
This exactly in turn later enabled AI revolution. I still remember downloading entire SO archives and preparing it for pre-training while Reddit and others went onto lawfare and firewalling the content. Note that this was the content their users - not reddit employees - had created for free and voluntarily to help others and the world. But they locked it all up for profiting from it personally.
SO did none of that. I think they knew they will be sacrificed at the altar. Yet it will exactly serve the intent of their founding principles to help others and the world, now through AI, even at bigger scale.
All of today’s models are built upon efforts of such true pure hackers who spent their days and years to create training data for AIs. I was a proud SO contributer for many years and there are couple of times while testing models I did felt that models might have used my answers 😇.
Hats off to @codinghorror and @spolsky and so many builders and hackers at SO for moving the world forward, one revolution at a time 🫡.
Krumlar retweeted
The strongest form of AI doom is some kind of novel self replicating nanobot that rapidly transforms the planetary ecology wiping out all previous life.
This has actually happened once before.
It is why we have an oxygen atmosphere today
Cyanobacteria killed 99% of all life
Krumlar retweeted
Se você costuma compartilhar links do X antigo Twitter deve ter reparado em uma novidade. Recentemente a plataforma passou a embutir um código de rastreamento nos links copiados que serve basicamente para identificar quem gerou o link e o momento exato da cópia.
Para quem preza pela privacidade a solução é simples basta apagar tudo o que aparece no link após a "?".
Vale o destaque para o parâmetro "s" que revela qual dispositivo você usa. O código de final 19 indica Android, o 20 aponta para iPhone e o 46 indica navegadores de computador.
Pode deletar essa sequência inteira sem medo. O link original continuará funcionando perfeitamente e você navega com muito mais privacidade.















































